Add control.spends.list so dig-app can read the automated-spend audit record

[MichaelTaylor3d]

Task

Add control.spends.list (and whatever the Activity tab needs alongside it) to dig-node-control-interface, and publish it — so dig-app can read the automated-spend audit record.

Why this is its own ticket

The record and its dign CLI landed in DIG-Network/dig-node#378. The control-interface method was deliberately left out, and the reasoning is right: the interface is a published crate, so §4.1 release-first applies — the method must exist in a published version before dig-app can adopt it. Adding it to KNOWN_UNPUBLISHED would grow exactly the drift that list exists to shrink.

This is the last link between the record and DIG-Network/dig-app#289's Activity tab. Until it publishes, the tab has nothing to read.

The architecture this preserves

dig-node  ->  OWNS the record (source of truth)
   ├── dign CLI          reads it locally, no node contact
   └── dig-app Activity  reads it over THIS interface

One record, two views — never two records that must agree. The reader is already shared, so this is a dispatch arm rather than a second implementation. Do not reimplement the read path here.

What it must carry

Enough for the Activity tab to be honest without re-deriving anything:

• the spend's kind, purpose, asset, amount, fee, store, timestamps
• status including its evidence — the record models Confirmed { height, coin_id } with the evidence inside the variant, so a confirmation height cannot exist without a confirmation. Preserve that shape across the wire; flattening it into a nullable height plus a status string is exactly how the guarantee gets lost in transit.
• Unresolved distinct from Failed — "signed and don't know" is not "didn't happen", and a UI that shows them alike is lying about money.
• the funding coin ids and the intended target coin id, kept distinct — they are separate types in the record precisely because the legacy confused them and waited on the wrong one.
• unreadable_lines, so a truncated audit trail cannot present as a complete one.

Filtering

The CLI filters by time range, store, kind and status. The tab will want the same; put the filtering in the method rather than shipping everything and filtering client-side, or the tab's behaviour will drift from the CLI's.

Evidence

A round-trip test showing a Confirmed entry keeps its height and coin id, and that Unresolved does not deserialise as Failed. Plus the published version confirmed from the crates.io index — the User-Agent header is required, and four repos this week produced green release runs that published nothing.

Related

• feat(spend-audit): node-side audit record for automated spends dig-node#378 — the record and CLI
• Activity tab auditing all automated spends, plus an hourly OS notification when out of DIG/XCH dig-app#289 — the Activity tab, blocked on this
• Epic https://github.com/DIG-Network/dig_ecosystem/issues/3166

[MichaelTaylor3d]

Lane opened (loop implementer).

• branch feat/3166-spends-list, worktree C:\tmp\worktrees\dnci-30
• draft PR feat(spends): declare control.spends.list, the sanctioned reader for the spend audit record #31
• HEAD: stub commit only

Shape read from dig-node PR#378 head (loop/376-spend-audit), not invented. The record is
SpendRecord in crates/dig-node-service/src/spend_audit.rs; the three properties that must survive
into the wire shape are FailureStage (Signing / Broadcast / Confirmation) with its
money_may_have_moved() split, SpendStatus::Unresolved as a state distinct from Failed, and
SpendLedger::unreadable_lines so a corrupt trail cannot read as a tidy shorter one.

NEXT ACTION: TDD the ControlMethod::SpendsList variant + SpendsListParams/SpendsListResult +
one new error code in the free -3204x slot, then SPEC.md.

[MichaelTaylor3d]

dig-app's consumer of this method is built and waiting on it: DIG-Network/dig-app#290 (DRAFT) for DIG-Network/dig-app#289.

The tab handles the current reality — METHOD_NOT_FOUND from every node — as a first-class state ("this node is too old to keep an audit record"), never as an empty list, so nothing is broken while this ticket is open. It just cannot show a record.

The wire shape the consumer decodes, so this can be checked against a real reader rather than only against the spec (dig-app-core/src/activity/control.rs, mod wire):

• spends[] with initiatedMs · kind · asset · amountMojos · feeMojos · storeId · intendedCoinId · status
• status.state ∈ pending | submitted | confirmed | failed | unresolved
• confirmed carries height + coinId inside the variant — the decoder REFUSES a confirmation with no coin id, so the guarantee is enforced on the reading side too
• failed carries stage ∈ before-signing | broadcast | confirmation, plus reason/detail
• top-level unreadableLines
• optional locked: { stores, baseUnits }

Two things the consumer already depends on, worth keeping when the method is declared:

1. unresolved must not be expressible as failed. The reader keeps them apart and renders them differently.
2. A failed entry must carry its stage. A broadcast- or confirmation-stage failure may have moved money; the app renders those as "May have gone through", never as a failure. An absent or unrecognised stage is read pessimistically — please do not make the stage optional-with-a-benign-default on the wire.

Happy to adjust the reader to whatever names you settle on; the wire words live in one mod wire so it is a mechanical edit.

[MichaelTaylor3d]

Implementation complete; PR is DRAFT awaiting the gate round.

• PR: feat(spends): declare control.spends.list, the sanctioned reader for the spend audit record #31
• head: 2e5c6b68ac06064f95607a3b02d92852a3e77bb2 (squashed to one commit)
• version: 0.21.0 -> 0.22.0 (minor, additive)

control.spends.list is declared with params, result types, the handler seam, -32048 SPEND_AUDIT_UNREADABLE, and SPEC/README coverage. The failure STAGE, unresolved as a state
distinct from failed, and unreadable_lines all survive onto the wire; pages state their own
truncation via complete.

Gates: 160 unit + 9 doc tests green, clippy -D warnings exit 0, fmt clean. Five mutations each kill
exactly one test. One FALSE GREEN was found and fixed in the process (the stage test passed against a
flattened wire because the two failure rows differed in their reason) -- written up in the PR body.

NEXT ACTION (not this lane): gate round, then merge + publish 0.22.0, then dig-node serves the method.