Lost `\` string continuations still bake source indentation into seven shipped messages

[MichaelTaylor3d]

Task

A Rust string literal continued with a trailing \ renders correctly, but when that backslash is lost the literal keeps the source's leading indentation, so the emitted text carries a 14-22 space run in the middle of a sentence. It compiles, no caller inspects it, and the mangled and correct forms are indistinguishable in a normal diff — so only a test over the rendered VALUE can see it. Seven such literals are still shipped in crates/dig-node-service/src.

Context

Found by the correctness gate on #501 via a control-tested literal scan (the pattern was validated against a known-bad synthetic AND a known-good string before its zeroes were trusted). All seven pre-date that PR's merge base (e.g. 95c95825), so they were out of scope there and are filed rather than fixed.

The same class was repaired at six other sites in PR #501 (mirror/advertise.rs, mirror/pass.rs, mirror/runner.rs) and is now pinned there by two guards that walk the whole message set: mirror/advertise.rs::every_operator_facing_line_reads_as_a_sentence and mirror/lifecycle.rs::the_refusal_messages_read_as_sentences. Copy that pattern — assert over the rendered string, reject any run of two spaces and any control character, and include a control assertion so a fixture too empty to exhibit the property cannot pass.

The Sites by Severity

• pairing.rs:146 — the only user-visible one: a JSON-RPC error body returned to a client, carrying two 18-space runs. This is what lifts the issue above housekeeping.
• logging.rs:261 — the assertion message of the_announcement_text_has_no_lost_string_continuation, the very test that guards this class.
• cli.rs:255, control.rs:6071, meta.rs:1743, meta.rs:1751, service.rs:2630.

Scope

Exactly those seven sites plus one guard that walks the set. Do not sweep other crates in this ticket, and do not reword any message — the text is what was always meant; only the space run is removed.

Acceptance

1. Each of the seven named sites emits its text with no run of two or more spaces.
2. A test walks the SET of messages rather than a chosen example, asserts the count so a shrinking walk fails loudly, and carries a non-vacuity control.
3. pairing.rs:146's corrected body is asserted through the JSON-RPC error path a client actually receives, not only at the literal.

References

• Discovering context: feat(mirror): activate bond promotion on the coin's own peer declaration #501
• Related prior work: Nothing verifies a mirror-coin claim against chain — the collateral economy is unenforced #466

Note: This ticket currently has no super-repo parent epic assigned. It is visibly unparented rather than orphaned; the orchestrator may link a parent later if a cross-repo family forms around it.

[MichaelTaylor3d]

Lane opened — orchestrator owns this end-to-end

Branch loop/526-lost-continuations, draft PR #531, base f8d45310, version 0.252.30 on disk.

Measurement — the ticket's count and its premise both need correcting

A control-tested source scan of crates/dig-node-service/src (stateless: skips comment
lines structurally, reports every run of 10+ spaces that is not leading indentation)
returns 25 hits, every one classified. Controls: a synthetic known-bad, the live
pairing.rs:146, and a multi-line-literal site an earlier literal-parsing version of the
scanner silently missed.

Correction 1 — the two guards this ticket says already pin the class do not exist.
every_operator_facing_line_reads_as_a_sentence and the_refusal_messages_read_as_sentences
return zero hits repo-wide. #501 is still OPEN — its six repairs and its guards are on
its branch, not on origin/main. So mirror/advertise.rs, mirror/pass.rs and
mirror/runner.rs still carry six live instances of this class today.

Correction 2 — the count is eight, not seven, in the files not owned by #501.
service.rs:1692 is an eighth site and was missed: it is an operator-facing WARN carrying
two 18-space runs, and it sits inside a multi-line literal, which is why a line-oriented
sweep does not see it.

In scope — 8 sites, 11 space runs

site	runs	surface
pairing.rs:146	2 x 18	JSON-RPC error body returned to a client
service.rs:1692	2 x 18	operator-facing WARN (new — not in the ticket)
cli.rs:255	2 x 22	test assertion message
meta.rs:1751	1 x 22	test assertion message
service.rs:2630	1 x 22	test assertion message
control.rs:6081	1 x 14	test assertion message (ticket said 6071; drifted)
logging.rs:261	1 x 14	assertion message of the guard for this very class
meta.rs:1743	1 x 14	test assertion message

Deliberately NOT in scope — 6 sites, owned by open PR #501

mirror/advertise.rs:94, :97, :116 (three are production tracing output),
mirror/pass.rs:794, :1067, mirror/runner.rs:1374. #501 changes all four of those files;
fixing them here would duplicate that work and conflict. Recorded on #501 instead.

Accounted for and correctly untouched

untrusted_text.rs:62-69, state.rs:1235, server.rs:3636 — trailing-comment column
alignment, outside any string. service.rs:2042,2047 — the sc qc output fixture, which
must stay byte-identical to real sc.exe output. Below the 10-space threshold, the run>=3 pass
adds only CLI column layout (network_info.rs, spend_audit_cli.rs, pair.rs, peer_ping.rs,
peers.rs, mirror/lifecycle.rs:1206) — every one of those follows a \n, which is the
structural signature that separates deliberate layout from a lost continuation.

Guard shape

wallet_env.rs:608 the_announcements_have_no_lost_string_continuation is the existing
walk-the-set reference, and it is too weak on all three of this ticket's acceptance points:
it tests contains(" ") (four spaces, so it misses a 2- or 3-space run), it asserts no
count, and it has no non-vacuity control. The guard here is a source scan rather than a
const-set walk, because six of the eight sites are inline test assertion messages that no
const-set walk can reach without hoisting them.

[MichaelTaylor3d]

Sibling-crate coverage — a named, bounded gap (comment, not a ticket)

This ticket scopes the sweep to dig-node-service, so the guard lands there. Measured the same
class in the other four crates of this workspace so the gap is stated rather than assumed:

crate	files	real sites
dig-node-core	77	1 — src/lib.rs:16159, 18-space run mid-sentence (test assertion message)
dig-wallet	42	1 — src/sage/chain.rs:1096, 14-space run mid-sentence (test assertion message)
dig-runtime	1	0
dig-chat-protocol	3	0

Everything else those scans return is trailing-comment column alignment outside any string
literal (lib.rs:10560, seams/dig_peer/net.rs:782, seams/dig_peer/resolve_capsule.rs:278,281,
download.rs:4595) — deliberate source layout, correctly untouched.

Recorded as a comment rather than filed: neither site is user-visible, neither touches money or
custody, and neither blocks anything in flight, so it does not clear the bar for a new issue
(CLAUDE.md 1.3c). Both are cheap for whichever lane next opens those crates, and the guard added
here is written so that pointing it at another crate's src is a one-line change.

Tooling

The control-tested scanner is now
.claude/scripts/find-lost-continuations.py in the superproject (--json, --min-run, and a
--self-test that refuses to report a zero from a pattern never shown to find anything). It is
written but not committed — .claude/scripts/ is superproject-owned and this lane is not its
writer.

Two failure modes are recorded in its header because both produced wrong answers here before
they were understood: a literal-parsing version desynced on r#"..."# and silently missed a real
site inside a multi-line literal while inventing one inside a doc comment; and a
spacing-intolerant character-class pattern missed logging.rs:261 entirely, because the run
there is bounded by : and { rather than by letters.