build(deps): dig-node-control-interface 0.31, dig-mirror-coin 0.9; #357/#308 measured satisfied

[MichaelTaylor3d]

Closes #418
Closes #357
Closes #308

What this is

A freshness audit of dig-node-service (#418) that also measures #357 and #308 as already satisfied on origin/main. Two real drifts found and bumped; the rest of the family is current, and the residual lock incoherence is proven to be owed by upstream crates that are themselves already at their latest published version.

The two real bumps

dep	was	now	chia line
dig-node-control-interface	0.30	0.31	declares no chia/dig deps at all — zero line hazard
dig-mirror-coin	0.7	0.9	identical chia deps to 0.7.0 — chia-line-neutral

dig-node-control-interface is declared in both dig-node-service and dig-wallet; both moved together, because a workspace shares one lock and a one-sided bump resolves two lines while cargo prints success.

Both new versions were checked from the sparse index for their own chia-* declarations before bumping. dig-mirror-coin 0.9.0 declares exactly what 0.7.0 declared (chia-protocol ^0.36.1, chia-sdk-driver ^0.36.0, clvmr ^0.16.2, …), so neither bump can split the chia set.

#357 and #308 were already satisfied

Both tickets describe dig-wallet state that no longer exists. Measured on origin/main @ 04079d5:

ticket claim	declared today (crates/dig-wallet/Cargo.toml)
#308: chia = "0.26" umbrella, must be replaced with facade crates	the umbrella is gone entirely — no chia = declaration remains
#308: chia-protocol = "0.26" -> 0.36.1	chia-protocol = "0.36.1" (:29)
#308: chia-wallet-sdk = "0.30" -> 0.34	chia-wallet-sdk = "0.36.0" (:54) — past the ticket's target, at the ceiling
#308: clvmr = "0.14"	clvmr = "0.16.2" (:57)
#308: chia-traits/chia-sha2 0.26	both 0.36.1 (:173, :199)
#308: chia-sdk-test = "0.30" -> 0.34	chia-sdk-test = "0.36.0" (:208)
#357: chia-query 0.6.2 -> 0.16	chia-query = "0.20.0" (:112)
#357: dig-node-control-interface 0.19 -> 0.21	was 0.30, now 0.31 (:67)
#357: dig-offers 0.2 -> 0.3	dig-offers = "0.3" (:81)
#357: dig-clvm 0.2 -> 0.3	dig-clvm = "0.4" (:135)

#308's stated target is itself stale. It asks for chia-wallet-sdk 0.34; the ceiling is now 0.36.0, and dig-wallet is already on it. chia-sdk-driver/chia-sdk-types top out at 0.36.0 while chia-bls/protocol sit at 0.36.1 — that asymmetry is the real ceiling, not a drift.

The dig-gossip git carve-out — measured, not skipped

dig-node-core pins dig-gossip by git rev 1a339166. The registry check cannot see it (the crate is unpublished — a permanent carve-out, dig_ecosystem#2647), so it was compared against the repo instead:

git ls-remote https://github.com/DIG-Network/dig-gossip main
1a3391662ecce1a3cbe8b74122a52bbb1b28d3ee    refs/heads/main

The pinned rev IS main's tip. Zero drift.

dig-ipc-protocol is deliberately NOT bumped

dig-node-core:153 declares dig-ipc-protocol = "=0.3.0" while 0.3.1 is published. That exact pin is intentional and documented in place: the crate reaches the IPC surface, so a caret would let a wire-shape change arrive without a PR (the dig-node#369 gate). Bumping it is a reviewed decision, not a freshness chore. Stated rather than silently skipped.

What is NOT fixed here, and why it cannot be

The lock carries 21 gating split families, and this PR does not close them, because dig-node has no lever on any of them. Every relevant dig-node declaration is already at its latest published version. Traced from Cargo.lock:

dig-node-core declares  dig-store-cache = "0.1.1"   <- ALREADY LATEST (0.1.1)
  +- dig-store-cache 0.1.1 -> dig-store 0.5.1        (latest 0.8.0)
       +- dig-store 0.5.1 -> dig-merkle 0.4.5        (latest 0.9.0)
            +- dig-merkle 0.4.5 -> chia-wallet-sdk 0.30.0
                 +- the ENTIRE chia 0.26/0.30 subtree:
                    chia-protocol 0.26.0, chia-sdk-{driver,types,client,signer,test,coinset,utils} 0.30.0,
                    chia-puzzle-types 0.26.0, chia-consensus 0.26.0, clvmr 0.14.0

One edge, three hops above anything dig-node declares, roots the entire old chia line. dig-merkle 0.4.5 -> chia-wallet-sdk 0.30.0 is the single root; dig-store 0.5.1 + dig-merkle 0.4.5 likewise root the dig-chainsource-interface 0.1.0 split.

Same shape for dig-constants, which resolves to three lines (0.10.1, 0.11.2, 0.13.0) — the exact failure that crate exists to prevent, happening inside one binary:

line	pulled in by	consumer's own status
0.10.1	dig-clvm 0.4.0	already latest
0.11.2	dig-download 0.22.0, dig-nat 0.21.0, dig-tips 0.3.0, dig-wallet-backend 0.31.0, digstore-chain	every one already latest
0.13.0	dig-node's own direct declaration	current

§2.4b is satisfied at dig-node's manifests and the lock is still incoherent, because the drift lives inside already-published upstream crates. The remedy is a release-first cascade owed by other repos (dig-store-cache -> dig-store -> dig-merkle; and five separate crates re-releasing on dig-constants 0.13), not an edit dig-node can make. Bridging it with a [patch] would be the byte-drift class §4.1 exists to prevent. Reported, not shimmed — filed as a named child rather than let the cascade dwarf this change.

Verification

• Every version read from the sparse index with the required User-Agent, never from memory or a manifest comment.
• Both bumped crates' own chia-* declarations read from the index before bumping, to prove neither introduces a split.
• Family state read from the resolved lock, not the carets; every crate named explicitly on re-lock.
• cargo tree -d deliberately not used as a gate — chia-bls/chia-traits/clvm-traits/chia_streamable_macro duplicate via clvmr/chialisp upstream and reach no DIG public signature; those four are excluded by root, not by name.

[MichaelTaylor3d]

Gate record — head 79d18c79

Merge preconditions: MET (check-merge-preconditions.sh --repo DIG-Network/dig-node --pr 519, exit 0, run unpiped and read from file):

draft=true  mergeStateStatus=UNSTABLE  unresolvedReviewThreads=0
--- required status checks (from branch protection, asserted BY NAME) ---
  Lint commit messages               SUCCESS
  Check version increment            SUCCESS
  Rustfmt                            SUCCESS
  Clippy                             SUCCESS
  Test + coverage                    SUCCESS
  Release-script tests               SUCCESS
---
  UNSTABLE (non-required, does not gate): build .deb (linux-amd64), build .deb (linux-arm64),
                                          build .msi (windows-x64), build .pkg (macos-universal)
RESULT: preconditions MET  [EXIT 0]

Test + coverage is the coverage-gated full suite and ran 19m45s. Analyze (rust) and CodeQL also pass.

The four red jobs are NOT this PR's, and they are not required

All four fail at Resolve + validate the package version with:

package-version: minor version 263 exceeds the MSI ProductVersion limit of 255

dig-node's 0.<minor>.<patch> scheme has run out of MSI minor field. Six open PRs are affected (#505 0.256.0, #517, #516, #515, this one, #518), while #509 (0.254.0) and #514 (0.255.0) are green — the boundary is exactly 255. main is still under it at 0.252.4, so the first merge of any PR at ≥ 0.256.0 is what breaks the Windows installer. Filed as #521 (kind:business, priority High). scripts/package-version.sh:71 fails closed, which is correct — the defect is the scheme, not the guard, and a truncated ProductVersion would make two releases compare equal.

Gate 1 — adversarial refutation (money path), fresh context: NOT-REFUTED

Prompted to refute the declared_peer: None decision. It verified by direct source diff of the vendored crates, not by inference:

• None is byte-identical to 0.7's output. create.rs 0.7→0.8 gates the memo append behind if let Some(declaration) = &declared_peer — no marker, no length prefix, no empty term when None. The rest of the memo build (namespace hint, store, root, epoch, urls) is unchanged. create.rs has zero diff 0.8→0.9.
• The mirror puzzle hash did not change. asset.rs has zero diff 0.7→0.9. The changelog's f2ed90e7 change was 0.4.0, before this range. Existing 0.7-created coins and new 0.9-created coins share a puzzle hash and remain discoverable and reclaimable together.
• reclaim.rs is identical across all three versions — ownership derivation and the conditions it builds are unchanged, so collateral locked under either version reclaims the same way.
• census is purely additive — 0.9.0 appends census_height_seeded and a private interpolated_probe; census, census_height, CensusHeight, MirrorCensus and Exclusions are untouched, and dig-node-service calls the new function nowhere. collateral.rs's arithmetic is unaffected.
• The scope risk was checked and is already fail-closed. bond_verify.rs:148-149 hard-codes peer_declaration to NotReadable, so no coin reaches Bonded today, declared or not — shipping None is not worse than staying on 0.7. Recorded on Nothing binds a mirror coin's owner to a DHT peer id — verification cannot name a claimant #473, along with the consequence that pre-Nothing binds a mirror coin's owner to a DHT peer id — verification cannot name a claimant #473 collateral will read Silent and never promote retroactively.

Gate 2 — correctness review, fresh context: PASS, zero CHANGES-REQUIRED

Read entirely via gh api .../contents/<path>?ref=79d18c79, never touching the shared worktree.

• deps(dig-wallet): four semver-incompatible steps outstanding — chia-query 0.6.2→0.16 may force the chia umbrella migration (#308) #357/build(deps)!: uplift dig-wallet onto chia-wallet-sdk 0.34 / chia 0.36.1 #308 are genuinely satisfied, not closed on a story. Every row of both tickets' tables re-checked against crates/dig-wallet/Cargo.toml at the head SHA. No bare chia = umbrella declaration exists (grepped ^chia\b, zero hits of the umbrella form).
• The lock-root claim verified byte-for-byte by parsing the actual [[package]] edges: dig-store-cache 0.1.1 → dig-store 0.5.1 → dig-merkle 0.4.5 → chia-wallet-sdk 0.30.0, the sole root of the old chia line. dig-store-cache confirmed at registry-latest, so dig-node has no lever.
• No new split. lock-family-scan.sh run against both base and branch locks and the <-- SPLIT lines diffed: 21 vs 21, identical set, zero difference. dig-node-control-interface → one line 0.31.0; dig-mirror-coin → one line 0.9.0.
• Comment accuracy checked across the long WHY-blocks in dig-node-service/Cargo.toml (95, 110, ~112-148, ~320-341) — no stale assertion.

Gate tier: two fresh independent contexts rather than the full triple, per §1.10 — the diff is behaviour-preserving and both bumps were proven chia-line-neutral from the index before landing. No crypto or signature type changes line, so no separate loop-security leg.