sec(key-mgmt): two at-rest reads carry the no-mint rule incidentally — read_legacy's ? swapped for .ok() mints over a locked seed and deletes it

[MichaelTaylor3d]

Task

Three follow-ups from the security gate on PR #342 (05a480a3, machine-key sealing). None gated that
PR. The first is the one that matters.

N-A — two at-rest reads carry the no-mint rule INCIDENTALLY, not by name

read_legacy:508 and unseal_stored:391 are safe because of a ? and an early return
respectively, not because of a named arm — and neither is tested.

read_legacy:508 is the one worth a battery row. The gate's stated exploit:

swap its ? for .ok() and it mints over a present-but-locked plaintext seed — and then deletes
it.

That is the same destructive class the PR spent three rounds closing on the device-key read, surviving in
a place nobody looked because the ? happens to do the right thing. A rule enforced by an operator
rather than by an arm is a rule one refactor away from being gone, and the lane's own retrospective
named this shape: "a rule applied twice is not a rule applied."

Fix: give both reads an explicit named arm, and add a battery row for each — specifically one that
swaps read_legacy's ? for .ok() and proves a named test fails.

N-B — a zero-length device.key stub permanently blocks the first mint

And its message asserts an identity that does not exist. Fails closed and is recoverable, so it is not
urgent — but the message should say what is known and what is undetermined, per dig-keystore
SPEC.md §17.5b's discipline, rather than naming a cause it cannot establish.

N-C — crates/dig-node-core/src/lib.rs:4423 says "tracked separately" with no URL

The gate looked and found no ticket. Either cite this one by URL or delete the phrase. A dangling
"tracked separately" is worse than silence: it tells a reader the work is owned when it is not.

Related but SEPARATE — do not fold in

N1 from the same gate: presence() reports an unreachable Windows path as Absent, contradicting
SPEC.md §18.25's MUST. Measured: //dig-no-such-host/share/… -> presence=Ok(Absent).

It is not a regression and it is not attacker-steerable — every traced path still fails closed,
because the sibling device dir is on the same unreachable tree and the write fails first. Only the
CLAIM is new. So the honest fix is one clause in §18.25 scoping the MUST to what try_exists can
actually determine, not a code change. Worth its own ticket if it is not folded into N-A's pass.

Evidence

• Prove the negative for N-A: the .ok() mutation must make a named test fail, and it must fail
  for the right reason rather than as a compile error.
• Every mutation asserts its patch applied — a replace that matched nothing prints a pass and reads as
  "the guard never fires", the exact inverse of the truth.
• Parse the test result: line, never stderr — cargo test prints error: test failed on a
  legitimately red run.
• One cargo process at a time in the worktree; concurrent invocations sharing a target/ produce
  non-reproducible failures.
• Read passed-counts, never ok. Baseline at merge: machine_key 20 passed / 0 failed.
• Never print a seed, device key, or mnemonic.

Cross-references

From: #342 (eco#2168), merged 05a480a3
Related, still open: #343 (the derived BLS key is at rest unsealed at
peer-net/identity/node.key, which bounds what #342 can claim about copy-resistance) ·
dig_ecosystem#2177 (assert the dig-keystore custody feature never enables — Cargo unifies features
across a workspace, so custody OFF is a fail-closed default, not an invariant)

[MichaelTaylor3d]

Owned by the key-custody/pairing/authz batch lane.

• branch: loop/batch-seckey (worktree dn-seckey, based on origin/main 3e480dd)
• draft PR: fix(security): gate the wallet transport and make the no-mint rule structural #452 (closes this ticket)

Progress will be logged here at each increment.

[MichaelTaylor3d]

Fix landed on loop/batch-seckey (PR #452)

N-A — the no-mint rule is now a named arm, in both reads.

read_legacy returns a three-valued LegacySeed instead of Option<_>. The two safe answers are
VARIANTS; every unsafe answer is an Err:

• LegacySeed::ConfirmedAbsent is constructed in exactly one place, from a Presence::Absent
  verdict. A failed read cannot produce it.
• A present-but-unreadable path takes an explicitly named Err arm with the rule stated at the
  point it is enforced.

load_or_create is now a match over seed_presence() with both arms named, and the mint moved
into mint_or_migrate, whose doc says it is the only path that can create an identity or delete
the plaintext. The delete is guarded by if let (LegacySeed::Found(_), Some(dir)) — both
conditions now visible in the pattern rather than one carried by an operator.

Revert-proof (measured), using the ticket's own stated exploit. Replacing the named arm with
Err(_) => Ok(LegacySeed::ConfirmedAbsent) — the .ok() relaxation — makes two named tests fail
for the right reason: 22 passed; 2 failed.

• an_unreadable_legacy_seed_is_never_minted_over_or_deleted — asserts the refusal, that the
  legacy file still exists, and that nothing was sealed. Under the mutation it mints over the
  seed and deletes it.
• read_legacy_reports_confirmed_absence_only_for_a_determined_absence — asserts on the read
  itself, because the destructive consequence is two calls away and a consequence-only test cannot
  say which decision was wrong.
• a_readable_legacy_seed_is_adopted_and_then_removed is the control: without it, an
  implementation that refused every legacy path would pass the refusal test while breaking
  migration.

The fixture is a DIRECTORY at the legacy seed path, not a chmod. It is the one shape that is
Present to try_exists and unreadable to fs::read on every platform, and it cannot silently
stop discriminating under root — which is #355's defect, and it would have been reintroduced here.

Baseline machine_key was 20 passed; it is now 24 passed / 0 failed (3 here + 1 for #343).

N-B — not addressed in this PR. The zero-length device.key stub message is fail-closed and
recoverable, and rewording it is a separate, non-security change; leaving it rather than folding it
in keeps this diff to the destructive class. Flagged as an open residual.

N-C — done. dig-node-core/src/lib.rs now cites this ticket by full URL instead of the
dangling "tracked separately".

N1 (the presence() Windows claim) — deliberately NOT folded in, per the ticket.