fix(rpc): reconcile the two machine names dig-node emits at -32000

[MichaelTaylor3d]

Closes #496.

What changed

-32000 had TWO producers on one port publishing TWO machine names. Measured on origin/main: the embedded read path mints it at 11 sites (lib.rs:3043,3149,3307,3310,3510,3513,3595,3598,3685,3965,4017), all through errors::error_object, which resolves the name from dig-rpc-protocol by number and therefore emits SERVER_ERROR. The shell mints it at 2 sites (server.rs:1342,1402) as DISPATCH_FAILED. server.rs:1336-1344 returns core's frame verbatim, so both names reach the same client at the same number, and a client branching on data.code cannot see which layer answered — which is exactly what data.origin is for.

SERVER_ERROR is authoritative. The shell is reconciled onto it.

• WU2 — meta.rs sources -32000's number and name from dig_rpc_protocol::ErrorCode::ServerError. The Rust variant keeps the name DispatchFailed: internal identity, not the wire. The three comments asserting the (false) claim that the shell alone mints -32000 are rewritten.
• WU3 — the drift guard's DispatchFailed exclusion is deleted rather than replaced by a list. The loop already sweeps ErrorCode::all(), so removing the carve-out is the whole fix; floor 7 → 8.
• WU4 — three producers emitted a different envelope, not merely a different name (SPEC §5.1's MUST, whose only exception is -32001): peer.rs:1269 carried only {reason}, dispatch.rs:1042 carried no data, and dig-runtime's NODE_UNAVAILABLE_JSONRPC was a raw string literal invisible to every type-scanning guard. All three now mint through the canonical builder; dig-runtime's is now BUILT rather than written down.
• WU5 — SPEC.md (×4 incl. §5.2 step 3, plus the residue sentence), README.md:359, USER_JOURNEY.md:169. content_serve::SERVE_UNREADABLE deleted: its code field's only sink (server.rs:1886) destructures {message, ..} and answers 502, so the number never reached a wire — a dead const, not the taxonomy gap lib.rs's comment claimed.

dig_node_core::rpc_err becomes pub so the frame the crate actually emits is reachable from an integration test rather than a restatement of it.

Blast radius checked

ErrorCode::DispatchFailed (name/code), errors::error_object/error_frame, PlaintextOutcome::Unreadable, NODE_UNAVAILABLE_JSONRPC. Unreadable has exactly one constructor (content_serve.rs:994) and one reader (server.rs:1886, {message, ..}) — verified by grep over all Unreadable { sites. Ecosystem consumer sweep across all 92 submodules: zero consumers branch on the string DISPATCH_FAILED (dig-sdk/test/miss.test.mjs:84 branches on the NUMBER, unaffected). docs.dig.net: zero hits, control-tested against RESOURCE_UNAVAILABLE (3+ files). Risk: LOW — this removes a name that never reliably worked rather than breaking one that did.

meta.rs:1318's wallet-band guard is scoped -32049..=-32040 and continues outside it, so -32000 is skipped and it does not go red.

Evidence

• RED, pre-fix: test result: FAILED. 0 passed; 1 failed; 10 filtered out — the shell says "DISPATCH_FAILED", the read path says "SERVER_ERROR".
• GREEN, post-fix: openrpc_drift_guard — 11 passed; 0 failed; 0 filtered out.
• Mutation proof: reverting only meta.rs's name to the literal "DISPATCH_FAILED" → 9 passed; 2 failed, both new-guard failures with the exact drift text. The test is load-bearing.
• cargo test -p dig-node-core --lib — 1101 passed; 0 failed; 0 filtered out.
• cargo test -p dig-node-service --lib — 793 passed; 0 failed; 0 filtered out.
• cargo build -p dig-runtime — clean.

Versions

Workspace 0.252.95 (kept above origin/main through repeated merges as sibling PRs landed; renumbered under the MSI ProductVersion ceiling by #521, current tip also carries #509's collateral-census and #531's string-escape fix). dig-node-core 0.67.0 → 0.68.0 (additive public rpc_err). dig-runtime 0.3.0 → 0.4.0 (envelope change).

Deliberately not done

• dig-node-control-interface declares -32000 → DISPATCH_FAILED in the -32000..-32019 band dig-rpc-protocol owns. Different repo, different writer — reported for filing, not touched. dig-node mints no ControlErrorCode::DispatchFailed.
• dispatch.rs:1042 keeps the number -32000 though it is semantically an upstream-proxy failure arguably belonging at -32010 UPSTREAM_ERROR. Changing the number is a separate wire change.
• The chat band (-32050..-32052) remains undeclared upstream. Pre-existing.

[MichaelTaylor3d]

IN PROGRESS — not the verdict. Independent correctness gate, fresh context, reading head 2cb75b37.

Confirmed so far:

• Head on the remote matches the worktree: 2cb75b373afde699689d4a3877ba2cb12ae4972d; base 04079d57 unmoved.
• Diff is 14 files / +116 -52 (excluding Cargo.lock).
• crates/dig-node-service/tests/openrpc_drift_guard.rs:298 — the if *shell == ErrorCode::DispatchFailed { continue; } exclusion is deleted, not replaced by a list; the loop still sweeps the drawn ErrorCode::all(). The floor moved 7 -> 8.

Still verifying: the SERVE_UNREADABLE deletion, the -32000 producer enumeration, the dig-runtime layering/version question, and the mutation proof.

[MichaelTaylor3d]

loop-reviewer verdict @ 386999a

CHANGES-REQUIRED -- one gating coherence finding. Everything else in the PR body checks out on this head.

Head read: 386999a9a5a9c9c60656f08d0ed21eadf3aaaa1b (resolved from the remote). Branch is 1 commit behind / 9 ahead of origin/main. Read-only review; worktree left clean apart from target/ build artifacts.

---

GATING -- G1. The SERVED OpenRPC description for -32000 still asserts the narrow, now-superseded condition

crates/dig-node-service/src/meta.rs:917

ErrorCode::DispatchFailed => "The node failed to dispatch the request.",

description() is not internal prose -- it is the "message" field of the served error catalogue in the rpc.discover document (meta.rs:1060, meta.rs:1209, meta.rs:1225). So the machine-readable document this PR reconciles now publishes:

• name: SERVER_ERROR (correct, per this diff)
• message: "The node failed to dispatch the request." -- true of the shell's 2 sites and false of the read path's 11.

That is the exact sentence the diff rewrote everywhere else it appeared -- SPEC.md:972, SPEC.md:994, SPEC.md:3278, README.md:359, USER_JOURNEY.md:169, and meta.rs:667-679's own doc comment ("a request failed on the way to, or inside, the read path") -- and it was missed at the one site that reaches a wire.

The file already contains the precedent for the fix: ErrorCode::ResourceUnavailable's description at meta.rs:918-924 was widened for the identical dual-minter situation -- "whether this node missed locally or a relayed upstream did".

The fix: widen meta.rs:917 to state the condition the rest of the diff now states, e.g. "The request failed on the way to, or inside, the read path." The fix must NOT change the variant name, the number, origin(), or any machine_code() mapping -- the reconciliation itself is correct and the guards below are load-bearing over it.

---

1. Normative sentences added/changed -- each verified against code on this head

Sentence	Cited at	Verdict
"-32000 is SERVER_ERROR on both sides"	SPEC.md:972	TRUE. meta.rs:843 sources dig_rpc_protocol::ErrorCode::ServerError.machine_code(); the crate returns "SERVER_ERROR" (dig-rpc-protocol-0.10.2/src/error.rs:267). Core resolves the same value by number via errors::taxonomy_code (errors.rs:36-42).
"Which layer answered is carried by data.origin"	SPEC.md:973-974, README.md:359, SPEC.md:3278	TRUE, and independently checked -- this is the load-bearing claim and no test asserts it. Shell: meta.rs:870-881 puts DispatchFailed in the "shell" arm. Core: RpcError::of uses ErrorCode::default_origin(), whose catch-all _ => ErrorOrigin::Node (error.rs:341-355) yields "node" for ServerError. The two producers genuinely differ.
"a guard asserts that equality across the whole shared set, with no exclusions"	SPEC.md:99	TRUE. openrpc_drift_guard.rs:300 iterates ErrorCode::all() with the DispatchFailed continue deleted; all() (meta.rs:974-999) lists all 21 variants incl. DispatchFailed.
"A panicked/failed dispatch task yields SERVER_ERROR (-32000)"	SPEC.md:994	TRUE. server.rs:1340-1343 mints via rpc_error(.., ErrorCode::DispatchFailed, ..); rpc.rs:67-77 writes data.code = code.name().
"dig-node-control-interface declares the same number as DISPATCH_FAILED ... which dig-node does not mint"	SPEC.md:975-976	TRUE. This is the sole surviving DISPATCH_FAILED string in the repo (see section 5).
"Carries NO numeric code: this outcome's only sink ... answers 502 BAD_GATEWAY from the message alone"	content_serve.rs:138-141	TRUE (see section 4).
"A literal frame is invisible to every guard that scans TYPES ... now carries the same data.code + data.origin"	dig-runtime/src/lib.rs:104-113	TRUE, derived through dig_node_core::rpc_err.
"PUBLIC so a consumer that also mints frames at the same numbers ... can be tested against the frame this crate actually emits"	dig-node-core/src/lib.rs:4576-4579	TRUE (see section 2).
"The node failed to dispatch the request."	meta.rs:917	BORN-STALE -- G1 above.

No other born-false claim found.

2. Declared vs served

• peer.rs:1273-1275 -- mints via errors::error_object(-32000, "request refused"), then adds data.reason rather than replacing data. Same shape as relay_pending_object (errors.rs:74-81). Reachable: admission_refused is the peer-surface admission path.
• dispatch.rs:1044-1046 -- errors::error_frame(&id, -32000, ..) on the upstream-proxy Err(e) arm. Reachable.
• dig-runtime/src/lib.rs:112-113 -- node_unavailable_jsonrpc(); sole consumer dispatch_node_rpc at lib.rs:130, whose sole production caller is dig_rpc at lib.rs:194. So the built constant is what reaches the FFI wire. Confirmed.
• rpc_err is genuinely consumed, not merely exposed: dig-runtime/src/lib.rs:113 (production) and openrpc_drift_guard.rs:389 (the new test). Not a pub-for-nothing.

3. Guards -- non-vacuity

• shell_error_names_match_the_shared_catalogue (openrpc_drift_guard.rs:298-325). Iterates ErrorCode::all() (21 variants, meta.rs:974), joins to dig_rpc_protocol::ErrorCode::ALL by number, compares machine_code(). With the exclusion deleted, -32000 now enters the loop; reverting meta.rs:843 to the literal "DISPATCH_FAILED" makes the comparison at :314 mismatch "SERVER_ERROR" and go red. Fails on the defect it claims to catch.
• Floor 7 -> 8 (:321). Correct and meaningful: removing the one carve-out raises the checked count by exactly one, so the tripwire tracks the enumeration rather than lagging it. It is a tripwire, not the assertion -- the assertion is the name equality above.
• the_shell_and_the_read_path_publish_one_name_for_32000 (:383-411). Compares the two emitted frames from the real production minters (dig_node_service::rpc::rpc_error, used at server.rs:1342/1402; dig_node_core::rpc_err, used at 11 sites incl. lib.rs:3043,3149,3307,3510,3595), not two catalogues. The assertion at :400 is the equality; :406-409 pins the winner to ServerError.machine_code() so a future edit cannot satisfy the equality by reconciling both onto a third string nobody publishes. Non-vacuous.
• Mutation claim consistent. Reverting only meta.rs:843 breaks (a) shell_error_names_match_the_shared_catalogue at :314 and (b) the_shell_and_the_read_path_publish_one_name_for_32000 at :400 and :406 -- two distinct test functions out of the 11. The PR's "9 passed; 2 failed" is exactly what the code predicts.
• One residual: dig-runtime's own node_rpc_without_engine_returns_jsonrpc_error (lib.rs:659-673) asserts only error.is_object() and a message substring -- it would pass under the old string literal too. Non-gating (pre-existing, unchanged by this diff, and the envelope is guaranteed by rpc_err), but it is not evidence for the WU4 change there.

4. content_serve::SERVE_UNREADABLE deletion -- CONFIRMED

rg 'PlaintextOutcome::Unreadable' over all .rs on this head returns exactly two sites: construction at content_serve.rs:989-992 and the sink at server.rs:1886, which destructures { message, .. } and answers StatusCode::BAD_GATEWAY from the message (server.rs:1885-1888). The code field was never read. No wire ever carried it -- a dead const, as claimed. content_serve.rs:97 and :575/615/825/920 are comments only.

5. Blast radius -- every -32000 producer on this head

Site	Mints via	Name emitted	data.origin
server.rs:1342 (dispatch task failed)	rpc_error(ErrorCode::DispatchFailed)	SERVER_ERROR	shell
server.rs:1402 (wallet-proxy fallthrough)	rpc_error(ErrorCode::DispatchFailed)	SERVER_ERROR	shell
dig-node-core/src/lib.rs -- 11 sites (3043, 3149, 3307, 3510, 3595, ...)	rpc_err -> error_frame -> error_object	SERVER_ERROR	node
peer.rs:1273 (admission refusal)	errors::error_object	SERVER_ERROR (+ data.reason)	node
dispatch.rs:1045 (upstream proxy)	errors::error_frame	SERVER_ERROR	node
dig-runtime/src/lib.rs:113 (wallet-only guard)	dig_node_core::rpc_err	SERVER_ERROR	node

Residual DISPATCH_FAILED strings: exactly ONE in the whole worktree -- SPEC.md:976, the deliberate cross-repo note about dig-node-control-interface. (rg, pattern control-tested: SERVER_ERROR returns many hits across SPEC.md, README.md, USER_JOURNEY.md and source, so the pattern is live.) The Rust variant ErrorCode::DispatchFailed survives as internal identity only, which the diff states explicitly at meta.rs:672-679.

6. Versions -- on disk, and the lock agrees

Artifact	On disk	origin/main	Lock
workspace Cargo.toml	0.252.81	0.252.80	dig-node-service 0.252.81 OK
dig-node-core	0.68.0 (from 0.67.0)	--	0.68.0 OK
dig-runtime	0.4.0 (from 0.3.0)	--	0.4.0 OK

All three increment and the lock matches. Note (non-gating): the PR body's Versions section is stale -- it says workspace 0.252.41 against a main of 0.252.40. The real numbers are 0.252.81 / 0.252.80, and the diff's three-dot base (0.252.42) is the merge base, not current main. The bump still clears the version gate; only the PR prose is wrong.

7. Test counts (never exit status)

Command	Result
cargo test -p dig-node-service --test openrpc_drift_guard	11 passed; 0 failed; 0 filtered out
cargo test -p dig-node-core --lib	1105 passed; 0 failed; 0 filtered out
cargo test -p dig-node-service --lib	793 passed; 0 failed; 0 filtered out

All three matched a non-zero test count. The core figure is 1105, not the 1101 in the PR body (main moved since); not a discrepancy that matters, but the PR's number is stale.

8. Does this close #239? -- NO. Confirmed refuted.

#239 asks to wire canonical dig-rpc-types/dig-rpc into dig-node and delete the hand-rolled table. On this head:

• rg for dig-rpc-types / dig_rpc_types / a dig-rpc dependency over the workspace and every crate manifest returns nothing. Only dig-rpc-protocol = "0.10" (dig-node-service/Cargo.toml:168,312) and = "0.10.2" (dig-node-core/Cargo.toml:192) are present, and both were already there on origin/main.
• The hand-rolled table is intact: pub enum ErrorCode still lives at meta.rs:656 with its own code(), machine_code(), origin(), description() and all().

The PR body claims only Closes #496, so this is consistent -- but #239 must not be closed on this merge.

Non-gating notes (recorded, no action required)

• SPEC.md:3278 / README.md:359 keep the single-valued origin column as shell for -32000 while the row's own description correctly names both minters. The column cannot express two origins; -32004's row solves it the same way. Cosmetic.
• dispatch.rs:1045 keeping -32000 rather than -32010 UPSTREAM_ERROR is called out in the PR body as deliberate and out of scope. Agreed -- changing the number is a separate wire change.

---

Summary: the reconciliation is correct, the guards are genuinely load-bearing, the deleted const was genuinely dead, and every claim in the PR body except its version/test figures is true on this head. One sentence -- the one that is actually served over rpc.discover -- was not swept. Fix meta.rs:917 and this is a PASS.

[MichaelTaylor3d]

Addendum -- head moved mid-review; the verdict still holds

The PR head advanced from 386999a9 to ac7eb300 while the review was running (a merge of main bringing in the unrelated collateral-census change from #509).

Re-resolved against ac7eb300:

• git diff 386999a9..ac7eb300 touches only SPEC.md (+14, the census section), crates/dig-node-service/src/collateral_census.rs, and a new tests/collateral_census_cold_start_bound.rs.
• Every file this review cited is byte-identical across the two heads: meta.rs, all of crates/dig-node-core, all of crates/dig-runtime, openrpc_drift_guard.rs, README.md, USER_JOURNEY.md, Cargo.toml.
• The gating finding is unchanged and still present verbatim at crates/dig-node-service/src/meta.rs:917.
• Workspace version still 0.252.81.

Verdict stands: CHANGES-REQUIRED at ac7eb300, on the single finding G1. The test counts above were measured at 386999a9; the census commit adds a new integration test file that this review did not run.