Wire dig-mirror-coin's census to a ChainSource — a node can record epoch 1 and nothing after it

[MichaelTaylor3d]

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3173

Task

Give dig-node a dig_chainsource_interface::ChainSource and wire dig_mirror_coin::census to it, so a
node can record epoch n rather than only the genesis epoch.

Why — this is the gap between "the record store exists" and "a node knows its requirement"

Everything around it shipped today:

shipped	what it does
dig-mirror-collateral 0.3.0	the arithmetic — required_per_store, the controller, the protocol versioning
dig-mirror-coin 0.7.0	census — counts collateralised stores, owners and locked totals at the census height
dig-node-control-interface 0.24.0	four control methods, including control.collateral.buffer
dig-node PR #398 (26e640d8)	the immutable per-epoch record store, peer-record verification, dig.getCollateralEpoch, retention

But dig-node has no dependency on dig-mirror-coin at all — git grep dig-mirror-coin -- '*/Cargo.toml'
returns nothing on origin/main — and does not implement ChainSource. So:

• bring_up_collateral_records() records epoch 1 only, which is derivable from nothing.
• dign collateral requirement answers unknown for the current epoch, correctly and indefinitely.
• Sampled sync cannot cover for it. verify and adopt are complete and tested against forged
  records, but without a chain source the population is unknown, so adopt returns Advisory every
  time and never adopts. The safety property holds; the capability does not arrive.

The consequence worth stating plainly

The epoch-104 output quoted as this family's evidence — 3.780 DIG per store, from 17 advertisement(s) across 820 collateralised owner(s) — rendered a hand-placed record. The command genuinely works and
the arithmetic is right; the provenance was a fixture. That was corrected on the epic
(https://github.com/DIG-Network/dig_ecosystem/issues/3173#issuecomment-5457908969), and this ticket is
what makes such output real.

What to build

1. A ChainSource implementation in dig-node, or an adapter over what the node already has. Check
   first whether chia-query already satisfies the trait or nearly does — it is the ecosystem's
   canonical coinset access layer, and re-deriving chain reads beside it would be a rival implementation.
2. Depend on dig-mirror-coin 0.7.0 and call census at the epoch census height.
3. Write the resulting record through EpochRecordStore::put, which PR feat(collateral): per-epoch record, gossip serve, sampled sync #398 made immutable
   (PutOutcome::Conflict on any differing record) and which already distinguishes bootstrap /
   censused / adopted_from_peers provenance.

What NOT to do

• Do not restate any arithmetic. required_per_store is the whole answer; equilibrium × multiplier − handicap omits the floor clamp and is wrong as a formula. Call the function.
• Do not let a census failure become a figure. A node that cannot census says unknown with a
  reason — never zero, never a stale neighbouring epoch. Six instances of "an unknown rendered as a
  reassuring answer" were found and fixed in this family this week; the newest surface is the easiest
  place for a seventh.
• Respect the protocol-version ceiling. PR feat(collateral): per-epoch record, gossip serve, sampled sync #398 landed it at two boundaries; a record this code
  writes must carry the version that computed it.

What this unblocks

• dign collateral requirement answering for the current epoch on a real node.
• Sampled sync becoming meaningful — with a known population, adopt can do something other than
  Advisory.
• The wiring lane's own note from PR feat(collateral): per-epoch record, gossip serve, sampled sync #398: cap the collected set at plan.sample_size at the
  collection site, so SampleExceeded stays a backstop rather than the primary bound — otherwise one
  identity answering once can deny adoption to everyone.

Acceptance

On a real node with no seeded file: dign collateral requirement reports the current epoch's
requirement, derived from a census this node performed, with provenance: censused and a real
census_height in the record. A node that cannot reach a chain source says unknown with its reason.

[MichaelTaylor3d]

Lane opened. Branch loop/400-census-wiring @ 05bf94f9, draft PR #401.

Step 1 answer — chia-query already satisfies ChainSource, so this is wiring, not implementation

ChiaQueryProvider is a synchronous dig_chainsource_interface::ChainSource facade over the async
ChiaQuery router — chia-query/src/provider_registry/chia_query_provider.rs:62 (ChainSource) and
:144 (ChainSourceProvider), constructed with ChiaQueryProvider::new(Arc<ChiaQuery>, tokio::runtime::Handle, ProviderInfo).
It bridges each sync read with run_blocking and requires a multi-thread runtime handle.

Consequences for this ticket:

• No ChainSource implementation is owed in dig-node. Writing one would have been the rival
  implementation the ticket warns about.
• dig-node already has chia-query 0.19.0 in the graph exactly once, in crates/dig-wallet
  (crates/dig-wallet/Cargo.toml:112), with a comment recording that a second =0.5.1 pin was
  removed to collapse two chia-query lines. Adding a second declaration must not re-open that.
• dig_mirror_coin::census_height + census are generic over S: ChainSource, so they take
  ChiaQueryProvider directly.

Next action

Wire the census runner in crates/dig-node-service/src/collateral.rs beside the existing
bring_up_collateral_records() (crates/dig-node-service/src/server.rs:2522), writing through
EpochRecordStore::put with StoredRecord::censused, and fold in PR #398's own note — cap the
collected set at plan.sample_size at the collection site in collateral_sync.rs.

[MichaelTaylor3d]

Built and proven end to end. Branch loop/400-census-wiring @ 08f1088, draft PR
#401 (stays DRAFT until the gate round returns).

The acceptance bar, met on a real machine against mainnet

A node built from this branch, run with an isolated, empty state dir — no seeded file:

$ dign collateral requirement          # at start-up
collateral requirement UNKNOWN — this node has not censused the epoch · run the census for this epoch

$ dign collateral requirement          # ~11 minutes later
epoch 104 (protocol v1) — 1.000 DIG per store, before any safety margin
  from 0 advertisement(s) across 0 collateralised owner(s) · multiplier 1.000000x · handicap 4.000 DIG

The record it wrote for epoch 104, from its own census:

{"epoch":104,"protocol_version":1,"census":{"epoch":104,"stores":0,"owners":0,"locked":0},
 "band":"inside","multiplier_micros":1000000,"handicap_dig_base_units":4000,
 "required_per_store_dig_base_units":1000,"census_height":9196171,"provenance":{"kind":"censused"}}

provenance: censused, census_height: 9196171 — a real mainnet height. The node walked epochs
2 → 104 in one pass, each at its own derived census height.

The figure differs from this family's earlier evidence, and that is the point. The epic's
3.780 DIG per store, from 17 advertisement(s) across 820 collateralised owner(s) rendered a
hand-placed record. A real census of mainnet finds zero collateralised stores and zero owners,
so the requirement sits at the floor, 1.000 DIG. The arithmetic was always right; the inputs were
invented, and are now measured.

The §2.0 check that sized the ticket

chia-query already implements dig_chainsource_interface::ChainSource — ChiaQueryProvider,
chia-query/src/provider_registry/chia_query_provider.rs:62. No ChainSource was owed, so this was a
wiring job. It also settled which client: dig-node holds exactly one ChiaQuery, in dig-wallet's
ChainTransport; this takes a VIEW of it rather than building a second (dig_ecosystem#2761).

What could NOT be done here, stated rather than claimed

PR #398's note asks for the collected set to be capped at plan.sample_size at the collection site.
There is no collection site: dig.getCollateralEpoch is served and never requested, and adopt is
called only from its own tests. Truncating inside adopt would keep a prefix of a set the attacker
contributed to — the exact thing PopulationExceeded refuses to do. What landed is the obligation,
stated at the refusal it protects, naming explicitly that no collector exists yet. The cap belongs with
the requesting half.