Adopt control-interface 0.22.0 and implement control.spends.list

[MichaelTaylor3d]

Task

Adopt dig-node-control-interface 0.22.0 and implement control.spends.list — the sanctioned
reader for the automated-spend audit record.

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166
Contract: DIG-Network/dig-node-control-interface#30 (merged c9c8bf8c, published 0.22.0)
Consumer waiting on it: DIG-Network/dig-app#289 (PR #290, already coded against the method)

Why this ticket exists — the contract is published, nothing serves it

Measured on main today:

• dig-node-service/Cargo.toml:92 and dig-wallet/Cargo.toml:53 both declare dig-node-control-interface = "0.21".
• spends.list / spends_list appears nowhere in crates/.

So a release watcher reporting the crate "live" is reporting the contract, not the capability. §1.3b:
a contract crate is not done when it publishes; it is done when every consumer has adopted it. dig-app
PR#290 calls control.spends.list and receives METHOD_NOT_FOUND from every node until this lands.

What the implementation needs, beyond the dispatch arm

The PR#31 gate measured that this is not merely wiring an existing query to a new method name:

• SpendQuery carries no after_id. The declared method is paginated by cursor; the existing query
  type cannot express where to resume.
• SpendLog::query cannot report complete. The contract distinguishes "that is all of them" from
  "we stopped here", and the current query has no way to say which.

Both must be extended, along with their callers. Budget for that rather than discovering it mid-lane.

The shape is already fixed by the published contract — match it exactly

The catalog was verified field-by-field against this repo's shipped spend_audit.rs
(SpendRecord, SpendStatus, FailureStage, Asset, Authority), and the declared ordering is
exactly what spend_audit.rs:539 implements. Do not re-derive the shape; read 0.22.0 and conform.

Two properties in that contract are load-bearing and must survive into the implementation:

1. The failure-stage distinction. Signing definitively did not spend; Broadcast and
   Confirmation mean a signed bundle went out and money may have moved. That distinction has been
   collapsed and re-fixed twice in this repo and once in dig-app. Use
   FailureStage::money_may_have_moved(); do not re-list the variants anywhere.
2. An unresolved outcome is a first-class state, not an error. The response must be able to say
   "signed, and we do not know if it landed".

Why the accuracy bar is higher than a normal read method

This method is the compensating control for a §908 carve-out: the node signs mirror-coin spends
without per-spend user approval, at the user's explicit instruction. The audit record is what stands
in for consent. A reader that misreports those spends weakens the only thing substituting for it.

Also

• Bounding. The audit log grows without limit. Honour the contract's cursor and its complete
  signal — and if a response is truncated, it must say so. A caller cannot distinguish "no more
  spends" from "we stopped telling you" unless that is explicit.
• Read-only. Never triggers a spend, never signs, never mutates.
• §2.4b: bring dig-*/chia-* deps to latest in the same PR; chia-* move as a SET. Index checks need
  a User-Agent header or the registry reads as unpublished.
• SPEC.md (§4.2) and the #426 CLI/RPC parity test kept green.

Acceptance

dign spends and dig-app's Activity tab read the same records through this method and agree. Evidence
is that agreement on a real machine (§2.6) — two surfaces reading one source and disagreeing is the
defect this exists to prevent.

[MichaelTaylor3d]

A parallel lane independently hit this from the other side while fixing #382: control_contract_conformance fails when the dep moves to 0.22, because the catalog declares control.spends.list and this node does not serve it. Filed as #386, now closed as a duplicate of this ticket.

Two things worth carrying over from it:

1. The conformance test catches the drift, which means the adoption cannot be done as a silent dep bump — the test will hold the line until the method is actually served.
2. Holding the dep at 0.21 is correct, not a §2.4b freshness miss. Bumping without implementing would ship a node whose declared contract it does not honour.

[MichaelTaylor3d]

Two error-code defects to fold into this adoption, both found while declaring the collateral methods (dig-node-control-interface#32, PR#33).

1. SPEC.md:5877 is normatively FALSE. It still names -32045 as WALLET_RESERVATIONS_UNAVAILABLE after #28 moved that code to -32047. So the SPEC advertises -32045 as taken while it is actually free — and worse, a reimplementer building from that sentence would mint a colliding code.

The interface lane nearly did exactly that: -32045 looked like the obvious free slot in the -3204x band, and only a direct grep of the code rather than the SPEC showed why it was not. That is the same failure mode #27 records for -32044, one code over.

2. The chat band -32050..-32052 is undeclared upstream. dig-node-core/src/lib.rs:4882 says so in its own comment. That is the private-minting class the -3204x ownership rule exists to prevent, one band along — dig-node is allocating from a range the contract crate does not know about, so the contract cannot stop a future collision there.

Both belong here rather than in the interface repo: the false SPEC line is dig-node's, and the undeclared band is dig-node minting codes the catalog should own.

Note the adoption now covers 0.23.0, not 0.22.0 — it adds control.collateral.requirement and control.collateral.margin.get/.set alongside control.spends.list. Adopting once for both is cheaper than two version steps, and dig-node's the_node_serves_every_control_method_the_contract_publishes will hold you to serving all four.

[MichaelTaylor3d]

Lane opened — this ticket plus #389, #388, and the three collateral methods are owned by one
dig-node lane (single writer).

• branch loop/385-collateral-control, draft PR feat(collateral): serve mirror-coin collateral control methods and spends.list #395
• parent epic https://github.com/DIG-Network/dig_ecosystem/issues/3173

Two corrections to this ticket's body, both measured just now against the crates.io index:

• The body says control-interface 0.22.0. That is stale — 0.23.0 is published and
  supersedes it; 0.23.0 is what this lane adopts.
• Both crates/dig-node-service/Cargo.toml:92 and crates/dig-wallet/Cargo.toml:67 still
  declare "0.21" on origin/main @ e094078, and spends.list / SpendsList appears
  nowhere under crates/. Confirmed, not assumed.

Scoping note carried over from the PR#31 gate: this is not a bare dispatch arm. SpendQuery
carries no after_id although the method is cursor-paginated, and SpendLog::query cannot
report complete — the contract distinguishes "that is all" from "we stopped here". Both plus
their callers are in scope here.

NEXT ACTION: read the published 0.23.0 method shapes from
modules/crates/.../dig-node-control-interface/src/method.rs and conform to them exactly rather
than re-deriving.

[MichaelTaylor3d]

Landed on loop/385-collateral-control, draft PR #395
(head 0.161.0). Awaiting the gate — not merged, not undrafted.

Adopted 0.23.0, not the 0.22.0 this ticket's body names — 0.23.0 supersedes it and is what is
published.

The PR#31 gate's scoping call was correct on both counts, and both are fixed:

• SpendQuery gained after_id, positional rather than a filter, so matches() ignores it.
  Resuming by time would drop every spend sharing the boundary millisecond, and automated spends
  are issued by a cycle so several routinely share one.
• SpendLog::query can now report complete, computed from whether rows were actually
  withheld rather than from whether the page came out full. A matching set that is an exact multiple
  of the page size fills its last page and would otherwise read as truncated forever.

Also: SpendLog::cursor_of (the id the caller was handed, never where the record got to); an
unknown cursor is refused rather than restarting or ending the walk; and a record that could not
be READ is now SPEND_AUDIT_UNREADABLE (-32048, taken from the shared catalogue) rather than an
empty page.

Evidence: the conformance test was red on the bump naming all four unserved methods, and is now
green. Whole suite: 469 lib + 163 integration, 0 failed.

Both new test groups were proved load-bearing by mutation (committed first). The one worth
recording: filtering is order-preserving, so drain-then-filter and filter-then-drain agree for
every cursor inside the filtered set — the only distinguishing input is a cursor present in the
record but absent from the filtered set, which is why that fixture exists. A test asserting only the
returned rows would have stayed green.

[MichaelTaylor3d]

Update: the adopted version is now 0.24.0, not 0.23.0 — it published mid-branch and adds
control.collateral.buffer. Both dig-node-service and dig-wallet declare "0.24" (they were
still on "0.21" when this batch started). Contract conformance is 5/5: the node serves every
method the contract publishes, and publishes none the contract does not.

This ticket's control.spends.list half is unchanged and complete: SpendQuery.after_id,
SpendLedger.complete computed from rows actually withheld, SpendLog::cursor_of, an unknown cursor
REFUSED rather than restarting or ending the walk, and SPEND_AUDIT_UNREADABLE (-32048) so a record
that could not be READ is never returned as an empty page.

One change worth noting since it touched this handler: CodeQL flagged three high rust/path-injection
alerts where DIG_NODE_STATE_DIR reached a file operation through ctx.state_dir. The cause was a
second resolver rather than a missing guard — spends_list built its own path where the pre-existing
code asks SpendLog::in_state_dir(). It now uses in_state_dir() like everything else, which is
both the fix and the simpler code.

PR: #395