feat(rewards): durable funder-ownership registry (identity only)

[MichaelTaylor3d]

Refs #3285 — DO NOT MERGE, gate round in progress.

What this adds

crates/dig-node-core/src/rewards/funded.rs: the durable record of which reward distributors this node funds. rewards::port's module doc names this as blocker 2 of two — RewardsChainPort::funded_distributors has no identity set to start from, because there is no chain-wide "list every distributor and filter to mine" call.

Identity only, and there is nowhere to put an amount. A record is a launcher id plus the store id when the funding act knew it. No reserve, accrued, or paid-out figure, for two independent reasons: every money figure here is chain-derived (port::DistributorChainState is read, never stored) and goes stale the moment the chain moves; and dig_ecosystem#3286's rewards * withdrawal_share_bps wrapping u64 multiply upstream means a figure crossing this boundary can already be wrong, so durable storage would make a wrong number about someone's money permanent. The merkle root that DistributorRef also carries is deliberately not persisted either — it names one generation and is superseded on every update.

Persistence mirrors rewards_claim::engine::ClaimEngine: an optional state directory (None = inert, so tests and every default build need no disk), atomic temp-file-then-rename write, and a corrupt record is never overwritten — the same refusal persist_fee_window makes. The funded set is never cached on the registry: every read re-reads the file and every write is a read-modify-write, so the struct holds a path and nothing else. That is the engine's F16/F18 discipline, and it means an operator who repairs the file underneath a running node is observed on the very next read.

A failed read never renders as "funds nothing". FundedDistributorsRead is closed and names the legitimate empty case separately from every unknown:

outcome	meaning
Funded(set)	a record exists and names these (never empty)
FundsNothing	a record exists, intact, naming nobody — the ONE renderable empty answer
NotConfigured(NoStateDirectory / StateDirectoryMissing / NoRecordWritten)	UNKNOWN
PersistedStateCorrupt { path, quarantined_to }	exists, not trustworthy
IoFailed { path, error }	could not be read

determined() returns Some(&[]) only for FundsNothing and None for every non-answer, so a caller that renders dig.listRewardDistributors cannot collapse "unknown" into [] by accident. This is dig-rewards-coin SPEC §2.4 clause 1 ("absence is not silence") in the place it costs most: an empty list tells an operator it funds no distributors.

Quarantine is a COPY, and the corrupt record stays put. Moving it aside would leave the next read finding no file — i.e. NoRecordWritten and, one honest-looking render later, an empty list. So the bytes are copied to funded-distributors.json.corrupt for the operator and the original is left exactly as found, which keeps every subsequent read reporting corrupt until a human resolves it. A test asserts that second read.

Node carries it in a OnceLock slot (funded_distributors) with pub(crate) install_funded_distributor_registry / funded_distributor_registry / funded_distributors_read, mirroring mirror_pointers and reward_prover_statuses. A slot rather than a constructor argument for the same reason as those: the FFI/browser path has no state directory. A second install returns false and changes nothing.

On-disk format

<state_dir>/funded-distributors.json, hex ids so an operator can read and repair it by hand ([u8; 32] would serialize as 32 JSON numbers nobody can check by eye). An unknown version is corrupt, not empty.

{
  "version": 1,
  "distributors": [
    { "launcher_id": "abab…", "store_id": "cdcd…" },
    { "launcher_id": "0505…" }
  ]
}

Nothing constructs it in production yet

Nothing in dig-node funds a distributor today, and the startup loader belongs to #3268's files, which are read-only to this lane. The slot and its methods carry #[cfg_attr(not(test), allow(dead_code))] with docs naming the ticket that will supply the caller — the same marking register_reward_prover_status uses — rather than a clippy failure or an implication that it is live. Until #3268 wires it, funded_distributors_read() answers NotConfigured(NoStateDirectory): unknown, deliberately never empty.

None of dig.listRewardDistributors / dig.getRewardDistributor / dig.listRewardDistributorCommitments is touched — they stay -32601 with no stub.

Tests

Executed, against real tempfile::TempDir directories, no filesystem mock. Round-trip; simulated restart (the writing registry is dropped in a scope, then a fresh registry is constructed over the same directory — exactly what a new process starts from, since nothing is cached); corrupt-quarantine including the follow-up read and the byte-for-byte preservation of both files; malformed id and unknown version as corrupt rather than skipped/empty; refusal to overwrite a corrupt record; missing state directory; existing directory with no record; genuinely-empty record; idempotent re-record and store-id refinement; a contradicting store id as a conflict that overwrites nothing; and the two Node-level reads.

🤖 Generated with Claude Code

[MichaelTaylor3d]

Adversarial leg (loop-decider) — dig_ecosystem#3285 — head ee01f44a

Verdict: MERGE-WITH-CONDITIONS. Two conditions, both ticket-side, both checkable before the squash; no code change required at this SHA.

1. Does the prover-status precedent (#595) transfer?

Only half of it. The half that transfers: this registry is writer-agnostic. record() takes {launcher_id, Option<store_id>} and nothing in the on-disk shape assumes the writer is a fund transaction; an operator declaration, a startup config sync, or a future fund path can all feed it, and the IdentityConflict / IdentityRefined arms are exactly what a declaration writer needs. So merging does not lock a shape the undecided writer could contradict — that was my main attack and it did not land.

The half that does NOT transfer: #595's "honest-empty now, honest-populated later" argument was warranted because the writer had a named ticket (#3265). Here the writer has none, and the PR's own docs paper over that by saying "#3268 wires the install" — but #3268's PR#605 is already green and contains no call to install_funded_distributor_registry, and #3268's scope is the claim loop, not this registry. As written, after #3267, #3268 and this PR all merge, the slot is still OnceLock::new() forever and funded_distributors_read() answers NotConfigured(NoStateDirectory) on every production node. That is honest, but it is honest about a hole nobody owns. Precedent reused past its warrant unless the conditions below restore it.

2. Does it deliver anything with no caller?

No observable behaviour changes. That is acceptable groundwork here for a specific reason: the decision this PR embeds (durable local record; UNKNOWN is never []; corrupt record stays put and is copied, not moved; identity only) is the part that would be re-litigated if the file were written later by whichever lane ships the writer. Landing it now with 16 real-disk tests fixes the failure table before the writer exists. If it waited, it should wait for exactly one thing: a named writer ticket — and that is a ticket, not code, so the wait costs nothing. Hence a condition, not DO-NOT-MERGE.

3. The un-ticketed hole — what should the writer be?

Yes, this is a third prerequisite and it must be filed. Shape: an operator-facing declaration, not a fund path in dig-node. Launching and funding a distributor spends a reserve CAT from a user wallet (dig-rewards-coin launch/fund, driven from dig-app/Sage); the node never holds those keys and cannot observe that act. A "fund path in dig-node" would either require user custody in the node (the identity boundary this ecosystem refuses) or never happen. A declaration (dig.registerFundedDistributor on the local RPC and/or a config list) is the only writer that can exist, and this PR's hand-editable hex JSON is already the right store for it.

One consequence the writer ticket must carry so it does not become a fourth prerequisite: a declared launcher id is a claim, not a fact. The consumer (RewardsChainPort::funded_distributors) must read each declared id through the #3267 reader — it needs the root for DistributorRef anyway — and a declared id the reader reports Malformed/unavailable for must render as an error entry, never be dropped from the list (dropping it recreates the "funded distributor became invisible" failure this module exists to prevent).

4. Identity-only — safe side or prescribed defect?

Safe side, and the distinction from the deleted money type is exact: that type carried a partial money figure a consumer would render as whole. This record carries none, and the only place a consumer can derive an amount is the chain via dig-rewards-coin — which is also where #3286's authoritative restatement is going. There is no "somewhere worse" to push a consumer toward; the worse place would have been this file. The unpersisted root is the same reasoning applied correctly. Also checked: store_id: Option here vs the required store_id: Bytes32 on DistributorRef means a None record cannot become a DistributorRef without a chain read — correct, since the root requires one regardless.

5. Precedent — two registries with no writer

Two is a pattern and the pattern has a cost: this PR's doc already contains a born-false ownership claim ("belongs to #3268") because the author had to name some future caller. Rule for the third: a new rewards/ module gated entirely behind cfg_attr(not(test), allow(dead_code)) does not merge unless the PR body links an OPEN ticket that names the exact function it will call — no "the startup path will wire it". The writer/installer being un-ticketed is the tell that a lane is designing ahead of the family plan; the fix is to file the ticket in the same unit, not to hold the code.

Conditions (both pre-squash, both checkable by URL)

• C1 — writer ticket filed and linked. An open dig_ecosystem issue for the operator declaration writer (dig.registerFundedDistributor and/or config), scoped to call FundedDistributorRegistry::record, carrying the §3 verification consequence above, cross-linked from #3285 and this PR body.
• C2 — installer owned. Either #3268 is amended (comment on the issue, and PR#605 must not close it) to include calling Node::install_funded_distributor_registry with the node's state dir at startup, or a child ticket is filed for it. Whichever ticket owns the install also owns correcting the "belongs to #3268" sentences in lib.rs field/method docs and funded.rs if they turn out false.

Code-level notes for the other two legs, none blocking: read() on a corrupt file has a side effect (quarantine copy, overwritten on every read — benign since the original is preserved); std::fs::rename over an existing target replaces on Windows, so the atomic write is sound cross-platform; record() refines store_id None -> Some from any writer without verification, which is correct for a declaration store and must stay a consumer-side check.

[MichaelTaylor3d]

Security audit — PASS

Head SHA audited: ee01f44a784d308b60585adf2775eb9006119e59 (confirmed via gh pr view --json headRefOid and git log -1 in a fresh worktree — matches).

Scope: crates/dig-node-core/src/rewards/funded.rs (new, 848 lines), rewards/mod.rs (+1), src/lib.rs (+126, Node slot + accessors + tests). Diffed against origin/develop merge-base 56f398d1 — +975/-0 across exactly those 3 files, matching the brief.

Severity context, stated up front: nothing constructs this registry in production. install_funded_distributor_registry / funded_distributors_read are #[cfg_attr(not(test), allow(dead_code))], called only from tests; dig.listRewardDistributors still returns -32601 (out of scope, confirmed by crates/dig-node-core/tests/reward_methods_tier_guard.rs, which also proves every *Reward* method is Tier::Control and NOT peer-reachable — so even once wired, the errors this registry can produce reach only the loopback/admin caller, i.e. the operator's own view of their own machine, never a remote peer). This is real severity-limiting context, not an excuse to skip the audit.

1. Path handling — clear

record_path() always joins the operator-supplied state_dir with the compile-time constant FUNDED_DISTRIBUTORS_FILE; the quarantine target is likewise the compile-time constant FUNDED_DISTRIBUTORS_QUARANTINE_FILE (funded.rs:53-59,188-192,335). No parsed record content, launcher id, or store id ever contributes to a path — there is no traversal surface, hostile or otherwise, because the file name is never derived from data. Symlink-following on read (std::fs::read_to_string, funded.rs:265) and on the quarantine copy (std::fs::copy, funded.rs:336) is real but requires the operator's own state directory to already contain a hostile symlink — same trust boundary as the operator who configured state_dir in the first place; not attacker-reachable. TOCTOU between corrupt-detection and quarantine-copy (funded.rs:210-220 to funded.rs:334-348) requires the caller to already have write access to the state directory, at which point they do not need a race. PathBuf/error: String in PersistedStateCorrupt/IoFailed surface only through Tier::Control, loopback-only, per above — no leak to a stranger.

2. Quarantine as a write primitive — clear, and better than the brief worried

quarantine() copies to the fixed filename FUNDED_DISTRIBUTORS_QUARANTINE_FILE every time (funded.rs:334-348); fs::copy overwrites its destination. Repeated reads of the same corrupt record overwrite the same quarantine file — one file, not one-per-read. No unbounded growth, no ENOSPC amplification. Confirmed by a_corrupt_record_reports_corrupt_and_quarantines_and_is_never_empty (funded.rs:620-671), which reads twice and asserts the second read is still PersistedStateCorrupt.

3. Deserialization — clear

serde_json::from_str over a string loaded whole via read_to_string (funded.rs:264-271): a huge or deeply-nested hostile file could cost memory/stack, but only if the attacker already has write access to the operator's state directory — same trust boundary as above, not a new hole this PR opens. Unknown format version is refused, not best-effort: funded.rs:272-277 rejects any record.version != RECORD_FORMAT_VERSION as LoadFailure::Corrupt before any distributor is parsed. an_unknown_format_version_is_corrupt_not_empty (funded.rs:695-708) verified passing in CI (see test count below) and by inspection actually asserts PersistedStateCorrupt and determined() == None — it does refuse, not best-effort.

4. Honesty property — clear, verified both structurally and by test

funded_distributors_read() with no installed registry returns NotConfigured(NoStateDirectory), never FundsNothing (lib.rs new code, Node::funded_distributors_read). Every fault path in funded.rs::read() (NotConfigured x3 reasons, PersistedStateCorrupt, IoFailed) is disjoint from FundsNothing, which requires an intact record that parses to an empty vec (funded.rs:210-219). determined() returns None for every not-an-answer variant, Some(&[]) only for the one legitimate case (funded.rs:114-131), and every_not_an_answer_outcome_is_undetermined (funded.rs:824-847) enumerates all five undetermined variants and checks each.

One structural gap, not exploitable today, worth a ticket: FundedDistributorsRead::Funded(Vec<FundedDistributor>) is a plain public variant over a plain Vec — the type system does not forbid constructing Funded(vec![]) from outside this module the way the doc comment claims ("Never empty"). Every current construction site (funded.rs:213) guards it correctly with if set.is_empty() first, and no other code in this diff constructs the variant. This is defense-in-depth, not a live vulnerability — recommend a ticket to make the empty case unconstructible at the type level (e.g. a private field or a smart constructor) before more callers than this module ever build the variant directly.

5. Write integrity — clear; write IS atomic

save() writes to path.with_extension("json.tmp") then std::fs::renames over the real path (funded.rs:285-298) — temp-file-plus-rename, and std::fs::rename replaces the destination atomically on both POSIX and Windows. A corrupt record is never overwritten: record() returns refuse_corrupt(...) before ever calling save() when the existing file fails to load (funded.rs:229-236), verified by a_corrupt_record_is_never_overwritten_by_a_new_funding_record (funded.rs:713-734, asserts the on-disk bytes are byte-identical to what was seeded). merge() never removes an entry — a conflicting offer returns Err(IdentityConflict) before mutating set, so record() returns before save() and the prior file is untouched, verified by a_contradicting_store_id_is_a_conflict_and_overwrites_nothing (funded.rs:588-614, asserts the read-back set still holds only the originally recorded identity). A partial/interrupted write cannot produce a smaller valid set: the write path is one serde_json::to_string_pretty of the entire in-memory set to a temp file, then one atomic rename — there is no path that renames a partially-written temp file into place, and no in-place truncate-and-rewrite of the real file at any point.

Genuine but out-of-reach-today concern: record() does load-merge-save with no locking (funded.rs:225-250). Two concurrent record() calls against the same registry could both load the same base state and the second save() would silently clobber the first's addition — a real non-clobber gap for concurrent writers. Not exploitable now because no production caller exists yet (the sole caller today is tests, one at a time); flag for #3268, which will decide whether funding acts can occur concurrently. Defense-in-depth, not a gate blocker for this PR.

6. No amounts — clear, verified structurally (stronger than the test)

FundedDistributor has exactly two fields, launcher_id: Bytes32 and store_id: Option<Bytes32> (funded.rs:69-75) — there is no numeric field anywhere in the type for a money figure (wrapped or otherwise) to occupy; PersistedDistributor mirrors this with two string fields (funded.rs:393-398). This is a compile-time guarantee, not merely a runtime test — #3286's u64-wrap concern in withdraw_incentives.rs cannot reach this boundary because there is no slot to receive it. the_persisted_record_is_hex_and_carries_no_amount (funded.rs:520-548) additionally greps the serialized text for amount/mojos/base_units/reserve/accrued/paid_out/balance and passed in CI.

CI evidence (executed count, not the checkmark)

Test + coverage job (run 34476390827, job 102868075855): nextest summary line —
Summary [ 949.120s] 3375 tests run: 3375 passed (17 slow), 4 skipped — 0 failed, all 3375 executed, including every rewards::funded::tests::* test named in the brief (a_corrupt_record_is_never_overwritten_by_a_new_funding_record, a_contradicting_store_id_is_a_conflict_and_overwrites_nothing, an_unknown_format_version_is_corrupt_not_empty, the_persisted_record_is_hex_and_carries_no_amount, all confirmed PASS by grepping the raw job log). Fail-fast/retries (#3287) did not mask anything here since the run completed with 0 failures.

Findings summary

No LIVE vulnerability. Two defense-in-depth notes (not gating): (a) FundedDistributorsRead::Funded(vec![]) is type-constructible though never constructed today — recommend a ticket to close it structurally before more call sites exist; (b) record() has no lock across concurrent callers — recommend #3268 decide whether concurrent funding acts are possible before wiring a caller.

Out of scope, not audited

crates/dig-node-service/** and the startup path (#3268/PR#605), the three unserved reward RPC methods (-32601), dig-rewards-coin.

Worktree note

Created D:\worktrees\dig-node-606-audit (fetched pull/606/head) for read-only diffing against origin/develop; no files modified, nothing pushed.

[MichaelTaylor3d]

Verdict: PASS

Head SHA reviewed: ee01f44a784d308b60585adf2775eb9006119e59 (matches the SHA I was asked to gate; PR is currently draft).

Properties 1-5

1. Corrupt/unconfigured/failed never renders as "funds nothing" — verified. FundedDistributorsRead::Funded is only constructed from a non-empty parsed set (funded.rs read(): Ok(set) if set.is_empty() => FundsNothing, Ok(set) => Funded(set)), so Funded(vec![]) is unreachable by construction — nothing in the module builds it, and into_distributors() only returns Ok with the full parsed set or Err (corrupt). Every fault path (NotConfigured, PersistedStateCorrupt, IoFailed) is a distinct variant; determined() maps only Funded/FundsNothing to Some. Confirmed by 6 tests (no_state_directory_reports_not_configured_never_empty, a_missing_state_directory_..., an_existing_directory_with_no_record_is_not_configured_not_empty, a_corrupt_record_reports_corrupt_and_quarantines_and_is_never_empty, a_malformed_id_inside_a_parseable_record_is_corrupt_not_a_skipped_entry, an_unknown_format_version_is_corrupt_not_empty) all asserting read.determined() == None and read != FundsNothing.

2. determined() is the only accessor and is exhaustive — partially verified, one finding. determined()'s match has no wildcard arm — it names all 5 variants explicitly, so the compiler forces a decision when a 6th variant is added. That is a real completeness mechanism, but it lives in production code, not the test. every_not_an_answer_outcome_is_undetermined (funded.rs:825) is a hand-built array of the 5 current variants, not derived from the enum. See inline finding — its own doc claims it "catches ... a future variant" determined mis-reports, which is false: a 6th variant added with a wrong (Some) arm in determined() would compile and this test would still pass unchanged, because nothing forces the new variant into the array.

3. No money persisted — verified against bytes, not a struct. the_persisted_record_is_hex_and_carries_no_amount reads the file with std::fs::read_to_string and asserts on the JSON text: hex ids present, and none of amount|mojos|base_units|reserve|accrued|paid_out|balance appear anywhere in the file. That is a real bytes-level pin — a field added later to PersistedDistributor would have to dodge every one of those substrings to pass, which a real amount field practically can't.

4. Corrupt records never destroyed — verified. record() checks load() first; on LoadFailure::Corrupt it returns refuse_corrupt (a PersistedStateCorrupt outcome) before ever calling save() — no code path reaches save() after a corrupt load. a_corrupt_record_is_never_overwritten_by_a_new_funding_record proves the original bytes are untouched after a record() call. quarantine() copies (not moves) so the original stays in place and the next read is still PersistedStateCorrupt, not NoRecordWritten -> eventually-empty; quarantined_to: None on a failed copy still returns the PersistedStateCorrupt verdict (verdict does not depend on the copy succeeding).

5. No transient state on the struct — verified. FundedDistributorRegistry holds only state_dir: Option<PathBuf>. Every read()/record() call does its own load()/save() from disk; nothing is cached across calls, matching the claim-engine F16/F18 discipline the module doc cites.

Non-vacuity spot checks

• a_malformed_id_inside_a_parseable_record_is_corrupt_not_a_skipped_entry: into_distributors() uses .map(...).collect::<Result<_,_>>(), i.e. short-circuits to Err on the first bad id rather than .filter_map — reverting to filter_map (silently skipping) would make this test go RED (it currently expects PersistedStateCorrupt). Real.
• an_unknown_format_version_is_corrupt_not_empty: load() explicitly checks record.version != RECORD_FORMAT_VERSION before returning Ok(Some(record)); deleting that check would parse {"version":2,"distributors":[]} successfully to an empty vec -> FundsNothing, and the test's assert!(matches!(read, PersistedStateCorrupt{..})) would fail. Real.
• a_fresh_registry_over_the_same_directory_still_sees_the_set: writer registry is dropped (explicit scope) before a second with_state_dir reads — genuinely exercises "no cached state," would fail if a future change added an in-memory cache field. Real.
• a_contradicting_store_id_is_a_conflict_and_overwrites_nothing: merge()'s (Some(recorded), Some(offered)) if recorded != offered => Err(IdentityConflict) arm is the only thing stopping a silent overwrite; removing that guard (falling to the _ => Ok(AlreadyRecorded) catch-all) would silently keep the OLD value instead of reporting conflict, which the test's explicit IdentityConflict{recorded,offered} assertion would catch. Real.
• every_not_an_answer_outcome_is_undetermined: see finding below — real for the 5 named variants (would fail if e.g. IoFailed regressed to Some), but does not, and cannot as written, catch a mis-handled new variant. Its own docstring overclaims this.

Test + coverage job (run 34476390827, job 102868075855)

Summary [949.120s] 3375 tests run: 3375 passed (17 slow), 4 skipped — no failures, ran to completion (not truncated by fail-fast). All 16 of this PR's tests present and PASS: 14 in rewards::funded::tests, plus lib.rs's a_node_with_no_installed_funder_registry_reads_not_configured and a_node_reads_through_the_installed_funder_registry.

Blast radius / scope

Diff touches exactly crates/dig-node-core/src/lib.rs, .../rewards/funded.rs (new), .../rewards/mod.rs (one pub mod funded; line) — matches the brief. No touch to dig-node-service/**, rewards_claim/**, service.rs, entrypoint.rs, main.rs, service_control.rs, tests/dependency_tree.rs, or any RPC dispatch file — the three reward RPC methods are untouched, still falling through to -32601, no stub added. lib.rs gains only the funded_distributors: OnceLock<...> slot plus install_funded_distributor_registry/funded_distributor_registry/funded_distributors_read, mirroring reward_prover_statuses's existing accessor shape — no second convention invented.

allow(dead_code) markers

install_funded_distributor_registry's doc names #3268 as the future caller. The field doc on funded_distributors also names #3268/#3285. The remaining allow(dead_code) sites (funded_distributor_registry, funded_distributors_read, FundedDistributorRegistry::with_state_dir, read, record, determined) do not each individually cite a ticket number in their own doc comment — non-blocking, noted below, since the module doc they sit under already carries the full context and a rustdoc reader lands there first.

What I did not run

Did not build/test locally (relied on the CI job log, read line-by-line); did not execute the RPC surface end-to-end (out of scope, confirmed by diff scope alone).

For your report

• What's persisted: identity only — a launcher id and an optional store id, both as lowercase hex strings, in PersistedRecord { version: u32, distributors: Vec<{ launcher_id: String, store_id: Option<String> }> }.
• Format: JSON (serde_json::to_string_pretty), atomic write (.json.tmp + rename), file funded-distributors.json inside the registry's state dir.
• Restart-survival proof: a_fresh_registry_over_the_same_directory_still_sees_the_set — writes via one registry, drops it, constructs a new FundedDistributorRegistry::with_state_dir over the same directory, and asserts the read matches.

Inline findings below; only one is non-trivial (the completeness-test overclaim) and it is non-blocking for this PASS given the underlying compiler-enforced exhaustiveness in determined() — but the docstring should be corrected so it does not misrepresent what the test proves.

[MichaelTaylor3d]

Adversarial gate conditions satisfied — both ticket-only, no code change at ee01f44a

The adversarial leg returned MERGE-WITH-CONDITIONS with two conditions, both checkable by URL:

• C1 — the writer. Filed as #3291. The writer must be an operator declaration (dig.registerFundedDistributor or config), not a fund path, because funding spends a reserve CAT from a user wallet the node never holds — so dig-node can never observe the funding act directly. That ticket carries the consequence the gate required: a declared id is a claim, so an id that reads Malformed or whose chain read is unavailable must render as an error entry, never be silently dropped. Dropping it would defeat this PR's own guard from the other side.
• C2 — the installer, and a doc claim that is false as merged. Filed as #3292. The doc sentences in crates/dig-node-core/src/lib.rs and crates/dig-node-core/src/rewards/funded.rs attribute the startup call to #3268, but PR#605 contains no such call and #3268's scope is the claim loop. Without an installer the slot stays empty on every production node even after #3267, #3268 and #3285 all merge, while the code reads as finished. #3292 owns both the installer and correcting those sentences.

Standing rule adopted from this gate

This is the second allow(dead_code)-gated module landed in rewards/ (after the prover-status registry in #595). Two is a pattern, so the rule going forward: no fully allow(dead_code)-gated rewards/ module merges without an OPEN ticket naming the exact function it will call. #3291 and #3292 are what satisfy that here.

On the precedent I reused, and where it did not reach

I justified this the way I justified the prover-status registry in #595: reading a real registry is honest-empty now and honest-populated when a writer appears, whereas a hardcoded empty would be honest today and a SPEC §2.4 clause 1 lie later. The gate's correction is that the precedent transfers only half — #595's warrant was a named writer ticket, and this had none until now. The registry itself is writer-agnostic (record() takes { launcher_id, Option<store_id> }, and the identity-conflict / identity-refinement arms suit a declaration writer as readily as a fund path), so merging locks no shape the undecided writer could contradict.

Non-blocking notes recorded rather than actioned, since fixing them would move a thrice-gated SHA: Funded(vec![]) is type-constructible though never constructed; record() takes no lock across concurrent callers (unreachable today, no production caller); read() on a corrupt file has a benign side effect in the quarantine copy.