control.wallet.syncStatus can still emit `{phase: "synced", peak_height: null}` — the pairing every money read now abolishes

[MichaelTaylor3d]

Re-homed from #490, which was asked to re-home it
rather than let it vanish: both of its former trackers
(https://github.com/DIG-Network/dig_ecosystem/issues/2761 and
https://github.com/DIG-Network/dig_ecosystem/issues/3166) are CLOSED.

Task

control.wallet.syncStatus can still emit {phase: "synced", peak_height: null} — a positive
claim that the replica is current beside a refusal to say what height it is current AT. That
pairing is abolished on every money read: balance (#454) and, as of #490, coins,
coinsByParent, coinById, coinSpend and arrivals all compute their synced from a
CURRENCY test and now carry network_peak_height/stale_by beside it. syncStatus is the one
surface a caller consults specifically to ask how current is this node, and it is the one that
can still answer with an unbounded all-clear.

Context

• The exemption is recorded deliberately, not by oversight, at
  crates/dig-wallet/src/sage/rpc.rs in replica_answer_is_current's doc: the status endpoint
  reaches SyncPhase::Synced through SyncHandle::status's own is_following call and pairs it
  with the replica's raw peak_height. The phase machine belongs to another family, which is why
  fix(wallet): distinguish unknown from zero across the wallet surface #454 and The staleness marker stops at balance: coins, coinsByParent, arrivals and coinById still answer from an unbounded tier, and complete asserts more than they know #490 both scoped it out.
• The asymmetry that doc flags, worth carrying into the work: is_following's permissive arm is
  justified ENTIRELY in terms of an unmeasured PEER tier and offers no justification at all for
  the unmeasured-REPLICA arm. Those are different things.

Scope

Decide and implement what syncStatus should say when the replica has no peak of its own.
phase: "synced" with peak_height: null must not remain the answer. The likely shape, by
analogy with the money reads, is that Synced requires a known replica peak, with the
peer-tier-unknown case reported distinctly — but the phase machine is another family's and this
ticket does not presume the fix.

Acceptance

control.wallet.syncStatus cannot emit a synced phase without a height that bounds it, and a
test asserts that pairing is unreachable rather than merely absent from a fixture.

[MichaelTaylor3d]

Owned by the loop. Branch loop/495-syncstatus-honesty, draft PR
#500 (Closes #495 verified to parse), version 0.242.0.

The boundary against #490 — they are TWO defects, not one

Checked before building, because building the same fix twice was the risk.

	#490 / PR #492	#495 (this)
producer	coins_wire and its siblings, dig-node-service/src/control.rs	SyncHandle::status, dig-wallet/src/sage/sync_supervisor.rs:435
type	the per-read JSON payloads	WalletSyncStatus
the claim	synced: bool beside a figure	phase: SyncPhase
how the claim is computed	WalletBackend::replica_answer_is_current (rpc.rs:1089)	is_following(state.peak_height, tier.peak_height) (sync_supervisor.rs:485)
state of the Option narrowing	already narrows BOTH unmeasured arms	narrows NEITHER

replica_answer_is_current already returns false when either height is unmeasured. is_following
returns true in exactly those cases (_ => true, sync_supervisor.rs:580). So the two endpoints
disagree about the same moment, and #490's fix cannot reach this one: it never calls the phase
machine, and the phase machine never calls it. Merging #492 leaves {phase: "synced", peak_height: null} exactly as emittable as it is today.

The only overlap is textual — both edit rustdoc in rpc.rs. #492 fixes balance_for_address's
doc; this fixes replica_answer_is_current's, which is the passage that recorded #495 as
deliberately out of scope. Resolved by merging main after #492 lands.

The defect is production-reachable on both arms

• No replica peak. WalletDb::latch_synced_over_unless_reset (db.rs:1475) sets
  initial_sync_complete = 1 and never writes peak_height - its own doc says "This path has
  replayed nothing and has no terminal height to offer". With a may-write session attached, the
  ladder then emits {phase: "synced", peak_height: null}.
• No peer peak. ChainPeerTier::peak_height is None "until one of them says something", so a
  replica thousands of blocks behind reports synced because nothing can contradict it. That is the
  shape of The node's replica is ~8,380 blocks behind its own peers, and a stale-replica zero balance is indistinguishable from an empty wallet #416, whose measured lag was 8,380 blocks.

peak_height: null on its own is not evidence of staleness - #416's ticket coupled those wrongly.
What is wrong here is the PAIRING with a positive synced.

A money-adjacent consequence, not only a status one

server.rs:2843 reads this phase and passes it as synced to FundingObservation::classify
(wallet_funded.rs:39). A zero balance under synced: true classifies as ObservedEmpty; under
false it is CannotSay. So an unbounded synced lets the node assert it OBSERVED a wallet empty
when it was not entitled to. The latch is monotonic and nothing records "not funded", so withholding
the claim is strictly the safe direction.

The fix, and its shape

Synced is made to carry the evidence that licenses it. is_following is replaced by
FollowingEvidence::measure(replica, peers) -> Option<Self>, which refuses both unmeasured arms; a
private settled submodule then exposes SettledPhase::synced(evidence) as the only route to
SyncPhase::Synced, taking the reported height from the evidence rather than from a separately read
field. The pairing has no constructor rather than merely no fixture. replica_answer_is_current
adopts the same predicate, which makes its own long-standing claim - that the two endpoints cannot
disagree about the same moment - true for the first time.

The peer-tier-unknown case reports syncing with chia_peer_peak_height: null beside it, which is
what distinguishes "no second opinion" from "measurably behind". No new phase token, so no
dig-node-control-interface release is required and the six emitted fields are unchanged.

Live control reading, 2026-09-02 03:56Z, installed node 0.206.0, read-only

$ dign wallet sync-status --json
{"phase":"synced","peak_height":9233876,"chia_peer_count":8,"subscription_peer_count":1,
 "chia_peer_peak_height":9233876,"watched_addresses":3}
$ dign wallet peak --json
{"peak_height":9233876,"synced":true}

Corroborated against an independent source at the same minute: api.coinset.org
get_blockchain_state reported peak 9233876, delta 0. So this machine is genuinely at the
tip and is NOT currently exhibiting the defect - the healthy state is the control, and it must keep
reporting synced after the change. A node reporting synced against a fabricated chain prints the
same thing by self-report alone, which is why the second source is cited rather than the node's own
word.

One test encodes the defect

sync_supervisor/tests.rs:3252 an_unmeasured_height_leaves_the_phase_unchanged asserts
SyncPhase::Synced for BOTH unmeasured arms, including the exact reported pairing. It is being
reversed, with its reasoning stated rather than silently weakened: it generalised a justification
that only ever applied to the peer side, and treated a positive currency claim as if it were the
absence of an accusation.