A transient degraded source seals a permanently uncorrectable low collateral requirement — fix before #377

[MichaelTaylor3d]

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3173
Found by: the PR #401 security gate
Sequencing: this MUST be resolved before #377 lands.

The defect

A transient degraded chain read can write a permanently uncorrectable low collateral
requirement.

Three properties compose into it, each individually reasonable:

1. The census bypasses NC-12 corroboration that exists in the same struct. ChainTransport prefers
   peer_reads — agreement across concurrently-queried peers — for the wallet's own reads
   (chain.rs:343-352). The census instead goes through ChiaQueryProvider, whose
   peak_height/coin reads resolve coinset-first (coinset_fallback_enabled: true by default,
   sources.rs:116-118), degrading to an unagreed peer-tracked value when coinset is unreachable.
2. put is immutable and never lets a later record supersede a Censused one. That is deliberate
   and correct against a peer — it is what stops a lying peer overwriting a node's own census.
3. catch_up never re-censuses an epoch it has already recorded. Also deliberate: it is what makes
   the walk idempotent and cheap.

Together: a source that is briefly wrong writes a record that is wrong forever, and the two
mechanisms that would normally repair it are the same two mechanisms protecting it from a peer.

Why it is not gating PR #401, and why it becomes serious the moment #377 lands

Today every record is (stores: 0, owners: 0, locked: 0) and that is the correct answer — nothing
has ever minted a mirror coin in production, because the creation path is
#377, still an open draft PR. A degraded read that
produces zero today produces the same number a healthy read produces.

#377 is exactly what makes it exploitable. Once real mirror coins exist, a degraded read produces a
count lower than the truth, the requirement is derived from that count, and the record is sealed. That
is the down direction — the direction the user named explicitly as the threat this model must resist,
and the direction in which a wrong answer under-collateralises the network rather than over-charging it.

An attacker does not need to sustain the degradation. One badly-timed window per epoch is enough, and
epochs are seven days apart.

What a fix has to preserve

Any remedy must keep the two properties it is threading between:

• A peer must still never be able to supersede this node's own census. That protection is the entire
  point of the AdoptedFromPeers → Censused asymmetry, and it was itself a gating finding earlier in
  this family.
• The walk must stay idempotent and cheap. Re-censusing every epoch on every pass is the cold-start
  cost (Cold-start census walks every epoch since genesis — 103 epochs, ~11 minutes, and it grows weekly #404) multiplied by every run.

Three shapes worth considering, none decided:

1. Route the census through the same NC-12 corroboration the wallet uses, so a degraded source cannot
   produce a confident low count in the first place. Most direct; the cost is that census reads become
   as expensive as wallet reads.
2. Record the read's provenance in the record and permit a self-supersession when a later census
   ran against a strictly better-corroborated source. Preserves peer immutability, since only this node's
   own census may supersede — but "strictly better" needs a total order that does not currently exist.
3. Refuse to record at all when the source is degraded, leaving the epoch unknown. Fails closed and
   matches this family's established preference for an honest unknown over a confident figure — but an
   epoch left unrecorded interacts with the walk's no-gaps property and with retention.

Acceptance

A census run against a degraded or single-source chain view cannot seal a requirement that a healthy
run would have computed differently — either because it does not record, or because it can later be
superseded by this node's own better-corroborated census. Peer records still cannot supersede a
Censused record, and the walk stays idempotent.

Verify by probe, not by reading: the PR #401 gate demonstrated that a census result can be moved by
controlling the source, which is the same lever this defect uses. A test that degrades the source mid-walk
and asserts the outcome is the direct proof.

[MichaelTaylor3d]

Lane open. Branch loop/405-census-degraded-source, draft PR #406.

Shape chosen: (2) record provenance-aware self-supersession — narrowed to a one-bit, one-way ladder

Shapes (1) and (3) were rejected on measurement, not preference:

• (1) route the census through NC-12 corroboration — NOT IMPLEMENTABLE IN THIS REPO. The
  corroborated reads (chia_query::peer::OptAnswer) grade only the by-coin-id reads. The census's
  down-direction lever is the population read, coin_records_by_puzzle_hash, which
  chia-query 0.19 does not grade (router.rs:673 — peer_then_coinset, ungraded). And the
  node has no second independent chain view to corroborate against: its one fabric is oracle-first,
  so sources.rs::independence_group_for correctly classes it in coinset's group, and building a
  second pool is the dig_ecosystem#2761 defect. Shape (1) is therefore a chia-query change plus a
  release-first cascade — real work, but not this blocker.
• (3) refuse to record when the source is degraded — NO SIGNAL EXISTS, and the obvious one is a
  trap. The tempting signal is Exclusions::unreadable > 0, but reading dig-mirror-coin
census.rs:673-681 shows unreadable means "not a mirror coin at all / stranger dust at the
  shared puzzle hash", which is legitimate and constant. Refusing on it would deny the census forever
  on free noise. The genuinely degraded case it looks like — an absent creating spend — is
  already fail-closed upstream (Unauthenticated is an Err that ends the census). What remains
  is a source that omits coins coherently, which no in-census signal can see.

So: the seal is broken instead. EpochRecordStore::put now admits one further superseding pair —
this node's own Censused record replaced by its own later Censused census of the same epoch
at the same census height counting strictly more stores.

Why the upward direction only, and why that is not a total order. A source can OMIT a coin for
free; to add one, somebody must actually post the collateral on chain. So one direction is
unforgeable and the other is free, and admitting only the unforgeable one gives a strict monotone
ladder — no "which census was better" judgement had to be invented, which was the stated objection
to shape (2).

Both preserved invariants, and how. Peer immutability: both sides must carry Censused, and
collateral_sync::adopt stamps every network-reachable record AdoptedFromPeers, so no peer
satisfies the arm (asserted directly). Walk cheapness: catch_up re-censuses only its target
epoch, never an earlier one — history is still computed exactly once, so #404's cold-start cost is
untouched. The steady state changes from zero chain reads to one census of one epoch per pass; that
is the price, and it is stated in SPEC §24.8a rather than glossed.

Effect on the attack. It no longer needs one badly-timed window per seven-day epoch. Because a
lower re-census cannot supersede a higher one, the degradation must be sustained for the whole
epoch.

Status

• Fix + SPEC §24.8/§24.8a/§24.10 sweep + store-layer tests: committed, pushed (f73306a).
• Degrade-mid-walk probe (tests/collateral_census_degraded_source.rs) written, using
  dig-mirror-coin 0.7.0's published tests/support/mod.rs verbatim so every coin comes from a
  genuine CAT spend. Not yet executed.

BLOCKER, machine-level: ENOSPC

C: is at 100% — 519 MB free of 1.9 T when the first build failed (os error 112). I reclaimed my
own worktree's target/ (6.6 G) per CLAUDE.md §1.6 and did not touch any sibling lane's. That leaves
~7.1 G, which may not survive a cold rebuild of this crate plus its new dev-deps. Cross-repo reclaim
is the orchestrator's call (loop-disk-reclaimer), not this lane's.

Next action: cold cargo test -p dig-node-service on the pushed branch; if it ENOSPCs again the lane
stops there and reports.

[MichaelTaylor3d]

Lane state: work pushed, UNVERIFIED — blocked on machine ENOSPC

Branch loop/405-census-degraded-source @ 6e3876e, draft PR
#406 (9 files, +865). The PR body carries the full
argument, the blast radius, and the rejected shapes.

Nothing has been compiled or run. C: reached 0 bytes free (os error 112) mid-build. I
reclaimed this lane's own target/ twice per §1.6 and touched no sibling's; ~6.2 G is free now and a
cold rebuild of this crate needs roughly 7 G — it got as far as dig-wallet before the disk hit
zero. Cross-repo reclaim is the orchestrator's call (loop-disk-reclaimer), not a lane's, so
this lane stops here rather than raiding another repo's cache.

Resume point, for whoever picks this up after the disk is reclaimed

1. cd /c/tmp/worktrees/dig-node-405 && cargo test -p dig-node-service --lib collateral
2. cargo test -p dig-node-service --test collateral_census_degraded_source
3. Prove each test load-bearing by reverting ONLY its fix — commit first, then git stash (never
   git checkout <path>).
4. Re-check the 0.167.0 bump against main, which a peer merges into from another machine.
5. Then the gate round; the PR stays DRAFT until the verdicts return.

The shape, in one paragraph

put admits exactly one new superseding pair — this node's own Censused record replaced by its
own LATER census of the same epoch at the SAME census height counting STRICTLY MORE stores — and
catch_up re-censuses its target epoch and no earlier one, which turns that admission into a live
repair path rather than a dormant mechanism. A source can omit a coin for free but cannot invent
one, so the upward direction is unforgeable and the downward one is free; admitting only the
unforgeable one is a strict monotone ladder and needs no total order over records. Peers still
cannot supersede (both sides must be Censused, and adopt stamps AdoptedFromPeers); history is
still computed exactly once, so #404's cold start is untouched. The cost is one census of one epoch
per pass in the steady state, where it used to be zero, and the attacker's cost goes from one
badly-timed window per seven-day epoch to sustained degradation for the whole epoch.

[MichaelTaylor3d]

Recorded so the next lane does not re-pick it: shape (3) has no implementable signal

This ticket's third suggested shape — "refuse to record at all when the source is degraded, leaving
the epoch unknown" — reads as the safest of the three and matches this family's established
preference for an honest unknown over a confident figure. It cannot be built, and the nearest
available signal means the opposite of what it looks like.

The tempting signal is Exclusions::unreadable > 0, and it is a trap. Read
dig-mirror-coin 0.7.0 src/census.rs:129-136 and :673-711: unreadable is rule C1/C6 — "not
a mirror coin at all, or its memos could not be read: a sibling collateral coin, a stranger's dust,
collateral in some other asset". It is the count of free noise at a shared, world-writable puzzle
hash, which anybody can drive arbitrarily high for approximately nothing. A census that refused to
record whenever it was non-zero would deny the requirement permanently, on demand, for the cost of
one dust spend — converting a fail-closed guard into a censorship primitive.

The genuinely degraded case it resembles is ALREADY fail-closed, one layer up. An absent creating
spend does not land in unreadable; qualify returns Err and the whole census ends
(census.rs:673-685, whose own comment says "Folding it into unreadable would let a pruned source
silently report a smaller network, which is the direction that lowers the requirement for everyone,
with no attacker involved. A census is complete or absent."). So the one degradation the census can
see is already handled, and handled correctly.

What is left is the case no in-census signal can see: a source that omits coins coherently —
every candidate it does show authenticates perfectly, and the population is simply smaller than the
chain's. Nothing inside a single census distinguishes that from a smaller network. Only corroboration
across independent views can, which is shape (1), and shape (1) is not implementable in this repo
today for the reason now tracked as DIG-Network/chia-query#47 —
coin_records_by_puzzle_hash is ungraded while the by-coin-id reads are corroborated.

Hence #406 is a repair (a degraded record can be superseded by this node's own better census)
rather than a prevention (refusing to write one). Prevention becomes available once chia-query#47
lands, and the two compose: a corroborated population read would let the census refuse, and the
repair path would still exist for records written before it.