fix(mirror): mirror spends are signed under the DIG L2 genesis, so every mirror create and reclaim is rejected by Chia

[MichaelTaylor3d]

Task

crates/dig-node-service/src/mirror/lifecycle.rs:669 opens the operator wallet with
dig_constants::DIG_MAINNET.genesis_challenge() — the DIG L2 genesis
(0af981862a4df51f51ec59c312315d959931d917c375730b89b9e2b0854d1abf).

A mirror coin is a Chia L1 CAT. Its AGG_SIG_ME domain must be
ccd5bb71183532bff220ba46c268991a3ff07eb358e8255a65c30a2dce0e5fbb.

So every mirror create and reclaim is signed for the wrong chain. Chia's mempool returns
BAD_AGGREGATE_SIGNATURE -> TransactionAck.status = 3 -> ack: FAILED, deterministically,
from every peer. No mirror spend can land.

Evidence, measured on the live coin

Mirror coin 31e9077265a6254c32d3857a5cff3561c3b57d28e3bb7789b24173be6c89f14d
(1010 $DIG base units, block 9,224,641, unspent) — both variants of the same required signature:

required_signatures[chia-L1] key=a4ddda90... msg=0bafe268...||31e90772...||ccd5bb71...
required_signatures[dig-L2]  key=a4ddda90... msg=0bafe268...||31e90772...||0af98186...

AssertMyCoinId, AssertMyParentId, the CAT ring closing on itself, and CreateCoin of 1010
to the operator's own $DIG address all pass against chain. The signature is the ONLY unsatisfied
condition.

Regression window

Introduced by 5df3e34 (#419, merged 2026-08-30). v0.170.0 and v0.172.0 are clean;
v0.179.0 and v0.183.0 carry it.

Fix

Use MAINNET_CONSTANTS.genesis_challenge, matching every other chain-facing site in the tree
(dig-wallet/src/sage/service.rs:272, sage/peer_reads/dialed.rs:215). dig-constants is the
L2 chain's constants crate and has no business in an L1 CAT spend — that sentence goes in a
code comment so it is not re-introduced.

Acceptance

1. A regression test that signs a real mirror reclaim and verifies the signature under the
   Chia L1 domain; it must fail today for the right reason.
2. A class guard: the mirror agg_sig_data is not any dig_constants genesis.
3. The live mirror coin above reclaimed on mainnet — spent = true on api.coinset.org,
   1010 base units back at the operator address.

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166

[MichaelTaylor3d]

Lane owns this. Worktree C:\tmp\worktrees\dn-genesis, branch loop/mirror-l1-genesis, draft PR #448.

Done

• Fix applied: mirror::lifecycle::mirror_agg_sig_data() -> chia_sdk_types::MAINNET_CONSTANTS.genesis_challenge, used at the single site (lifecycle.rs, open_signer). The "dig-constants is the L2 chain's crate" reason is in the doc comment on the new function.
• chia-sdk-types 0.36.0 promoted from dev-dependency to dependency (same version already in the tree, so no second chia line).
• dig_wallet::sage::spend::required_bls_signatures added so a test can compare a produced signature against the CONSENSUS message rather than the signer's own.
• Tests written: crates/dig-node-service/tests/mirror_l1_genesis.rs (3 tests).
• Workspace version 0.185.0 -> 0.187.0.

In progress — first build of the new test target.

Next action — run the 3 tests green, then revert mirror_agg_sig_data to the L2 constant and confirm RED on the tests' own assertions (checking the test COUNT in each run), restore, then build the binary and reclaim the live coin 31e9077265a6254c32d3857a5cff3561c3b57d28e3bb7789b24173be6c89f14d.

Blast radius — gitnexus's dig-node index predates open_signer (new in #419) and returned not found, so this was done by grep + direct read, which §2.0 permits. open_signer has exactly one production caller (server.rs:2691, bring-up) and two in-file tests; its signature is unchanged. The value flows only into WalletSigner::new(agg_sig_data) and thence into the AGG_SIG_ME message domain — owner_puzzle_hash and synthetic_key derive from the phrase and are unaffected, so no address changes. dig_constants::DIG_MAINNET.genesis_challenge() remains in use for the DIG PEER network id (peer.rs:509/542), which is correct there and untouched.

[MichaelTaylor3d]

Fixed and PROVEN ON MAINNET

Branch loop/mirror-l1-genesis @ 4259b74, draft PR #448.

The network's answer changed, which is the whole proof. Same coin, same state dir, same wallet:

when	build	audit journal
before	0.185.0	failed / broadcast — "the network did not admit the transaction to its mempool (ack: FAILED)"
after	0.187.0	submitted

On api.coinset.org, not from the node:

• mirror coin 31e9077265a6254c32d3857a5cff3561c3b57d28e3bb7789b24173be6c89f14d — spent: true, spent_block_index: 9225254
• its only child: 1010 base units at 0xe0534fd8f369cf8a32646d131cf8593fb7e97f7e9aa1ec0ea901045fb05deffb, the operator's own $DIG address, confirmed in block 9225254

Tests — crates/dig-node-service/tests/mirror_l1_genesis.rs, 3 tests, 3 passed on the fix and 0 passed; 3 failed with the production line reverted, each on its own assertion. The load-bearing one verifies a signature produced by the production wallet against the message CHIA requires, so it cannot pass under the L2 constant.

Not merged — stays DRAFT pending the gate round.