Backfill-on-miss config fails OPEN on a malformed value while the sibling switch fails CLOSED

[MichaelTaylor3d]

Task

crates/dig-node-core/src/download.rs:170 -- resolve_backfill_on_miss fails open on a malformed configuration value: an unrecognised setting enables read-triggered backfill.

dig-sex's equivalent switch parser fails closed by design (discovery.rs:93-98), on the stated ground that a typo must never be able to enable a path that spends resources.

Nothing reconciles the two, and they are in the same ecosystem answering the same kind of question.

Why fail-closed is right here too

Backfill-on-miss makes a single content read pull an entire store. That is a large, disk- and bandwidth-consuming action, and a typo in a config file should not be able to turn it on. The general rule the ecosystem already applies to the recursion switch applies for the same reason: an unrecognised value means the operator's intent is unknown, and the safe reading of unknown intent is not "do the expensive thing".

Context

• crates/dig-node-core/src/download.rs:163,170 -- the switch and its parser.
• dig-sex discovery.rs:93-98 -- parse_enabled, the fail-closed reference implementation. Only explicitly affirmative values enable.
• crates/dig-node-core/src/seams/capsule/capsule_store.rs:422-459 -- dig-node's inline backfill decision, which this switch gates.

Scope

Make the failure direction consistent, and say in the doc comment which direction it fails and why -- the current behaviour is not written down anywhere, which is how the divergence survived.

Evidence

A test that fails without the fix: a malformed value leaves backfill disabled. Today it enables it.

Parent

Orchestrator epic: https://github.com/DIG-Network/dig_ecosystem/issues/3138

[MichaelTaylor3d]

Parent epic (rival-implementation centralization): https://github.com/DIG-Network/dig_ecosystem/issues/3140

[MichaelTaylor3d]

Adopted as a child of https://github.com/DIG-Network/dig_ecosystem/issues/3128 (recursive hop-by-hop
.dig discovery + end-to-end download), which measured the recursive-ask implementations on 2026-08-24.

You are the last surviving instance of the rival-disagreement class in this family. The measurement
found two implementations of the recursive ask — dig-node and dig-sex — and dig-sex is
authoritative. Half the disagreement is already resolved in its favour: dig-node#281 is closed, and
forwarded_ask.rs now delegates the depth bound, the breadth bound and the unreadable-budget
refusal to dig-sex rather than re-deriving them.

This ticket is the other half, and it is the same inversion one layer over: backfill-on-miss fails
OPEN on a malformed value while its sibling fails CLOSED. Two guards in one subsystem disagreeing about
what an unreadable config means is not a style difference — one of them is wrong, and the one that fails
open is the one that ships a bypass.

Fix direction: adopt the sibling's behaviour (refuse), do not re-derive a third. Centralize the
decision in dig-sex alongside the budget refusal, so a future reader cannot find two answers.

Parent: https://github.com/DIG-Network/dig_ecosystem/issues/3128
Sibling already resolved: #281

[MichaelTaylor3d]

Owned by loop lane dn-secpeer, branch loop/batch-secpeer, worked as a batch on draft PR #453 (which Closes this ticket on merge). Base origin/main = 3e480dd. Progress logged on the PR.