CAT asset_id attribution never runs in production, so $DIG balance reads zero on a funded wallet

[MichaelTaylor3d]

Task

Production never runs the CAT asset_id attribution pass, so every CAT coin keeps asset_id = NULL
forever and the $DIG balance reads 0 on a funded wallet.

Reported by the user against the DIG App
(DIG-Network/dig-app#291) — "the dig-app is not displaying the DIG CAT
balance, it says zero when i know i have sent DIG to it" — but the app reports faithfully what this
node tells it.

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166

The defect

crates/dig-wallet/src/sage/sync_supervisor.rs:2277:

sync::run_update_loop(db, receiver, events, None, session).await

The fourth argument is attributor: Option<&CatAttributor<'_>>. Production passes None, and
run_update_loop only attributes behind if let Some(a) = attributor (sync.rs:1041).

Chain of consequence:

1. coin_state_to_row (sync.rs:438) stores peer-supplied coins with asset_id: None — correct; a
   CoinState frame does not carry the TAIL.
2. CatAttributor (sync.rs:726-744) is meant to fill it in by uncurrying the parent spend.
3. It is never constructed outside tests.
4. unspent_coins(Some(asset)) queries WHERE spent_height IS NULL AND asset_id = ? (db.rs:2039)
   and matches nothing.

Why CI is green — and what your regression test must therefore do

CatAttributor is correct and is tested: sync.rs:2382 passes Some(&attributor) and
sync.rs:2330 documents it as "Proves (#407): with a CatAttributor, the update loop runs the
attribution pass".

That test proves the capability. Nothing proves the wiring. Note also that all six None call
sites in sync.rs (1183, 1632, 1854, 1891, 2100) sit inside the test module, which starts at line
1102 — so a reader grepping the call sites sees mostly None and reads it as normal.

Your regression test must fail when the production construction path passes None. A test that
hands run_update_loop an attributor directly already exists and did not catch this. Assert on the
path the supervisor actually takes.

Also check, do not assume

unspent_coins(None) queries asset_id IS NULL, which is what unattributed CAT coins currently look
like. So the XCH balance may be correspondingly over-counted by the same defect. Measure it. If
XCH is inflated while $DIG reads zero, that is two money-lies from one cause and both need the
regression test.

Fix

Construct a CatAttributor in the supervisor and pass Some(..). It needs a LineageSource, the
address prefix, and the wallet's plain p2 puzzle hashes. Attribution is read-only ("it never signs or
broadcasts") and idempotent (already-attributed and already-spent coins are skipped by
reconstruct_coins), so running it on every update is safe.

Consider whether the catch-up path needs the same pass as well as the update loop — a wallet that
syncs from genesis and then receives no further pushes must still attribute what it found.

Bar

This is the money-lie class (§2.6's narrow stop): a surface telling a user they have no funds when they
do. Verify on the real funded wallet on this machine, not only in tests — a green suite is exactly
what failed here. dign wallet balance <address> --asset dig and dign wallet coins <address> --asset dig are the checks.

§2.4b: bring dig-*/chia-* deps to latest in this PR; index checks need a User-Agent header or the
registry reads as unpublished. chia-* move as a SET.

[MichaelTaylor3d]

Lane opened.

• branch: fix/382-cat-attribution (worktree C:\tmp\worktrees\dn-382)
• HEAD: 246b9e2
• PR: DO NOT MERGE (superseded by #391 + #393): make a funded wallet report its real $DIG balance #383 (draft)

Done: stub commit + push + draft PR. Defect verified in source — the production call is
sync_supervisor.rs:2322 (sync::run_update_loop(db, receiver, events, None, session)) inside
impl SyncSession for ChiaPeerSession::run; the test module starts at :2327, so it is production.

Found while reading (not in the ticket): there IS a second production attribution path —
rpc.rs:3116 refresh_tracked_coins calls singleton::reconstruct_all when a lineage source is
attached, and service.rs:326 attaches one only inside build_live_wallet (live broadcast enabled).
So the observable on a real machine depends on whether live broadcast is on. Measuring next before
touching code.

Next action: reproduce against the real funded wallet — dign wallet balance <addr> --asset dig
and dign wallet coins <addr> --asset dig, plus the XCH side (unspent_coins(None) queries
asset_id IS NULL, so XCH may be over-counted by the same cause).

[MichaelTaylor3d]

Measured on the real machine — there is a SECOND, upstream defect, and #382's fix alone cannot make the balance correct

branch fix/382-cat-attribution · HEAD cc0e5e6 · PR #383 (draft)

1. The reproduction the ticket asks for is currently MASKED on this machine — the diagnosis is not wrong

dign wallet balance <addr> --asset dig does not read zero here, and the reason is state, not a
wrong diagnosis:

• The node's replica is empty. wallet.sqlite (WAL replayed, read on a copy): coins = 0 rows,
  initial_sync_complete = 0, sync_state.peak_height = 9177574 while the live peak is 9208243.
• routing::route(db_synced=false, scoped=true) therefore returns Fallback for every wallet
  read, so nothing on this machine currently reads the replica at all.
• Control probe against a known-funded $DIG address (the treasury,
  xch1a37rq3cgcl2ecpudttsf35x75qzdan68lgw2l6ajvmqs44jxdn5qv6pk3y):
  {"balance":974518971,...,"source":"fallback","synced":false} and wallet coins --asset dig
  returns real attributed CAT coins. The fallback tier attributes correctly (rpc.rs:3116
refresh_tracked_coins → singleton::reconstruct_all); the replica tier is the broken one.

So the zero is a replica-tier defect, and it is invisible until initial_sync_complete latches.

2. The upstream defect, measured in this node's own production logs

C:\ProgramData\DigNetwork\logs\dig-node\dig-node.jsonl.*, last 5 days:

566 "wallet sync: peer pushed coin states outside the subscribed puzzle-hash set"
565 "wallet sync: catch-up complete"

with dropped: 138, dropped: 188, dropped: 188 on the most recent three catch-ups — today.

The cause: sync.rs:884 requests puzzle state with CoinStateFilters::new(true, true, /*include_hinted*/ true, 0),
so the peer correctly returns coins hinted to our p2 hashes. A CAT coin's coin.puzzle_hash is the
CAT puzzle hash, not the p2 hash. apply_coin_states (sync.rs:701-713) then filters on
subscribed.contains(&s.coin.puzzle_hash), where subscribed is only the p2 set
(sync_supervisor.rs:638 — StandardArgs::curry_tree_hash over custody's public keys).

Every hinted CAT coin the node asks for is thrown away before it is ever written. Attribution
cannot fill in an asset_id for a row that does not exist, so fixing #382 alone leaves the $DIG
balance at zero on the replica tier.

Two money-lies from two causes, in series:

• ingest drops the CAT coins (this finding), and
• if any did land, they would never be attributed (CAT asset_id attribution never runs in production, so $DIG balance reads zero on a funded wallet #382).

3. What has landed so far

cc0e5e6 — the #382 wiring: Supervisor gains an Attribution field (lineage + prefix), builds a
CatAttributor per attempt from the subscription set it actually resolved, threads it through
SyncSession::run (so ChiaPeerSession forwarding it is enforced by unused_variables), and runs
the pass once after a completed catch-up. service.rs attaches the lineage whenever
enable_chain_sync is on — deliberately not gated on enable_live_broadcast, because uncurrying
a parent spend is a read and a read-only install must still be able to name its own $DIG.
cargo check -p dig-wallet green.

4. Next action

Fix the ingest drop in the same PR — #382's acceptance bar (the correct balance) is unreachable
without it. Shape chosen: an unsubscribed coin is admitted only once its parent spend has been
uncurried and the recovered owner hint proves to be one of the wallet's own p2 hashes; it is then
written with its asset_id already filled. That preserves the existing guard (a peer answers a
subscription, it never defines one), and it avoids the opposite money-lie — admitting unattributed
coins would inflate XCH, since unspent_coins(None) selects asset_id IS NULL.

Then the regression tests, each proven load-bearing by reverting only its own fix.

[MichaelTaylor3d]

FIXED AND VERIFIED ON THE REAL WALLET

branch fix/382-cat-attribution · HEAD dcb3130 · PR #383 (draft, one squashed commit)

The reproduction, then the fix

Before: all three watched addresses answered {"balance":0,"source":"db","synced":true} for --asset dig.

After, on a fixed 0.161.0 node with an isolated data dir, watching the same address:

dign wallet balance xch1htza92...kchv0 --asset dig
  {"balance":3856455,"source":"db","synced":true,"peak_height":9208582}
dign wallet coins  xch1htza92...kchv0 --asset dig
  source db  synced true  coins 8  sum 3856455

Corroborated independently: api.coinset.org reports 8 unspent coins totalling 3,856,455 mojos at
cat_puzzle_hash(owner_p2, DIG_ASSET_ID) = 6ce1cdf8.... 3,856.455 $DIG, exact match.

It was THREE defects in series, not one

1. The one this ticket names. Production passed None where a CatAttributor belongs.
2. Ingest threw the coins away. The catch-up asks for puzzle state with include_hinted, and
   apply_coin_states then dropped every hinted CAT coin, because a CAT coin sits at the CAT puzzle hash
   while the subscription set holds p2 hashes. 566 warnings in this node's own logs over five days, at
   138-188 coins per catch-up. Attribution cannot fill in an asset_id for a row that was never written.
3. The last mile, and the least obvious. chia-query's PEER tier returns the puzzle and solution
   faithfully and leaves the coin a placeholder: for parent 567d481d... the coinset tier answered the
   real coin and the peer tier answered puzzle_hash: 0x00...00, amount: 0 beside byte-identical reveal
   and solution. Every CAT driver derives its children's coin ids FROM that coin, so a placeholder makes
   Cat::parse_children compute children matching nothing and report not-a-CAT. All eight real $DIG coins
   were refused this way, and the per-coin log proves it: not_a_cat: 183, lineage_unavailable: 0.

Fixes 1 and 2 alone left the balance at zero. Only after 3 did the money appear.

The XCH question the ticket asked: answered NO

XCH reads 1599179999972 both before and after. The CAT coins were never admitted at all, so nothing was
ever miscounted as XCH. Ownership is now proved BEFORE the write precisely so that stays true —
unspent_coins(None) selects asset_id IS NULL, so admitting an unproven coin and attributing it later
would inflate XCH for the length of the window.

Tests

670 pass. Three regression tests, each proven load-bearing by reverting ONLY its own fix and watching it
go red on the right assertion. The supervisor test asserts on the DATABASE after starting the real
Supervisor — it never names run_update_loop or CatAttributor, which is what makes it a wiring test
rather than a repeat of the capability test that stayed green through the whole defect.

Next action

Gate round on PR #383, then merge. Not undrafted yet.

Realizations filed separately, not fixed here

• chia-query's peer tier returning a placeholder coin from get_puzzle_and_solution is a defect in that
  crate. dig-node now defends itself, but every other consumer of that call is exposed.
• digstore-* and dig-gossip are git-rev dependencies (NC-7), invisible to a registry freshness check.