fix(sync): bind a synced capsule to its chain-anchored root before it lands (and is announced)

[MichaelTaylor3d]

What changed

Closes DIG-Network/dig_ecosystem#1623.

Whole-store sync landed a capsule to disk and the backfill then announced this node as a DHT holder of it — without ever binding the bytes to a chain-confirmed root. sync_module_from only ever checked the served bytes were non-empty (download_capsule trusted want_root; the clone_whole_store fallback verified emptiness only). Because landing a capsule is what makes this node a discoverable holder (SPEC §14.1), the node advertised itself as a holder of content no chain confirmed — poisoning holder reputation and multiplying unverified copies through the reshare flywheel (#1576), regardless of the downstream read-serve gate.

The synced module is now bound to the store's chain-anchored generation before it lands, using the same verification the #1576 reshare leg applies at its own seam:

• New Node::verify_synced_capsule_is_chain_anchored — resolves the generation root through the chain (anchored_root_resolver, never from the serving peer), refuses a served root that is not the chain generation (a moved/forged head), then reuses ChainAnchoredModuleVerifier::for_generation + dig_download::ModuleAnchorVerifier::verify_module_anchor to re-hash the bytes against the anchor.
• Called in sync_module_from immediately before write_atomic. An unverified capsule never reaches disk, and since the announce (refresh_dht_inventory) fires only on a fresh land inside cache_fetch_and_cache, no-land ⇒ no-announce by construction.
• Fail-closed, matching #1576: no chain-confirmed generation, a chain-read failure, a moved head, or non-committing bytes all reject the sync (ModuleAnchor::Unavailable → Err).

Design decision — reject, don't cache

Reject outright, matching the reshare leg (which stages outside the cache and promotes only on success). The gate is central — production reaches sync only through cache_fetch_and_cache — so every sync caller is covered by one verification shape, and an unverified module never touches the cache whose mere presence is an announcement. This is defense-in-depth: verify at the seam that admits the artifact, not reliance on the downstream serve gate that may not run before an announce.

Blast radius

sync_module_from (lib.rs) is the single funnel every sync caller reaches through cache_fetch_and_cache; the new gate is a pre-write_atomic guard on that one path. The announce (refresh_dht_inventory) and the local-serve verify (content_serve.rs, untouched — it already verifies before decrypt) are unaffected. Reuses ChainAnchoredModuleVerifier / ModuleAnchorVerifier unchanged.

Verification

• New tests (mutation-verified):
  • a_capsule_whose_root_is_not_chain_confirmed_is_never_announced — installs an inventory-refresher spy; proves an unconfirmed capsule errs, does not land, and never announces. With the gate call removed the test FAILS for the right reason (Ok((93, "1010…")) — the capsule lands + announces); restoring it passes.
  • a_chain_confirmed_capsule_lands_and_is_announced — the fail-closed-not-fail-shut companion (a legitimate chain-confirmed capsule still lands + announces).
  • Pre-existing sync tests updated to build real chain-anchored .dig data sections (they had asserted the buggy "land unverified fixture bytes" behavior).
• cargo fmt --all -- --check → exit 0 · cargo clippy -p dig-node-core --all-targets --all-features -D warnings → clean · all 14 sync-path tests pass. (9 pre-existing port-binding/dual-stack env tests fail identically on a clean tree — not from this diff; they pass in CI.)
• SPEC.md §14.3 "Verify-before-announce invariant" + DEVELOPMENT_LOG.md entry added in the same unit of work.

Version

fix: (security bug fix, backwards-compatible) → patch bump [workspace.package].version 0.74.1 → 0.74.2.

---

Generated by Claude Code