Nothing supplies a MirrorCoinPointers in production, so every provider record publishes None

[MichaelTaylor3d]

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166
Sibling: #422 (which plumbs the pointer this ticket injects)

Task

#422 plumbs unverified_mirror_coin_id through the DHT provider announce and proves the epoch
re-announce. Nothing in production supplies a pointer. DhtHandle::new publishes none, so on a
real node every provider record carries None. Wire a real MirrorCoinPointers so the node
publishes the coin ids it actually holds.

Why this is a separate ticket and not a gap in #422

It is a layering boundary, not an oversight. dig-node-core holds no collateral-epoch
knowledge — constructing a real pointer source needs the mirror observation, which lives in
dig-node-service (server.rs, mirror/). #422 correctly stopped at the seam rather than reaching
up a layer, and no surface claims the pointer is published, so the dormant state is honest rather
than a false capability.

Filing it because a dormant producer is exactly the thing that stays dormant: #422's acceptance —
a peer discovering this node's bond through the DHT — is not met by that merge alone, and without
a named ticket the gap lives only in a PR comment.

What must stay true when it is wired

• The pointer is UNTRUSTED (NC-12). It tells a verifier where to look, never what the coin is.
  A receiving peer must still accept a coin only on the coin's own evidence — at the mirror puzzle
  hash, genuinely $DIG with the asset id re-derived from the creating spend, carrying the declared
  collateral, and MirrorCoin::advertises(store, root, epoch) passing. Publishing a real pointer must
  not tempt anything downstream into treating it as proof.
• Its absence must keep meaning nothing is wrong. Nodes without a bond, and nodes that have not
  observed one yet, publish None forever. That must remain an ordinary provider record, never a
  fault and never a discovery penalty.
• Re-announce on epoch rollover. dig-dht has no clock and republish re-attaches whatever was
  recorded at announce time, so an un-refreshed pointer is wrong one epoch after publication and a
  correctly-collateralised node reads as uncollateralised. Attach unverified_mirror_coin_id at the DHT announce (blocked on the dig-dht 0.15 cascade) #422 built and proved this machinery;
  this ticket must feed it fresh values rather than bypass it.

Blocked on, and the order

The pointer can only name a coin the node actually holds, so this needs the observation to be real on
a live node. Today it is not: #433 —
dign mirror bond-states answers chain_unreadable on a synced node — and
#424, since nothing can create a bond until a
broadcaster exists.

Do not wire this against a fabricated or optimistic source. A published pointer naming a coin this
node does not hold is a claim about money on a public DHT, and it is worse than publishing nothing.

Acceptance

On a real node holding a mirror coin, its DHT provider record carries that coin's id, and after an
epoch rollover the re-announced record carries the new epoch's coin — verified by reading the
record from a second node, not from the publishing node's own logs.

[MichaelTaylor3d]

Blockers cleared — but HELD on a file conflict, not on a dependency

This ticket named two blockers and both are now gone:

• mirror bond-states answers chain_unreadable on a synced node with 8 peers, while balances read fine #433 — closed. It was a stale-measurement
  artifact: bond-states had been measured on 0.172.0, which predates the observation commit
  entirely. On 0.179.0 the verb returns {"state":"known", …, "epoch":104} and, with a served .dig,
  a real row: [{store_id:4e904b3f…, root:6b420246…, bond_state:"pending"}].
• The mirror lifecycle has no production broadcaster, so no reclaim can reach chain #424 — merged (9eb8fbd4). The broadcaster is
  wired and confirmed live on a real node.

What holds this ticket now is single-writer, not a dependency. Injecting a real
MirrorCoinPointers reaches server.rs's spawn_mirror_passes, and
#440 owns server.rs in a live lane. This starts when
that merges.

One thing that changed the shape of the work

The observation now produces a real bond row on a real machine, so a pointer source has something
true to publish for the first time. That was not the case when this ticket was written.

The warning in the ticket stands and matters more now, not less: do not wire this against a
fabricated or optimistic source. A published pointer naming a coin this node does not hold is a claim
about money on a public DHT, and worse than publishing nothing. Right now the bond is pending and
no coin exists on chain — every create is being refused by the mempool
(#441). So a pointer source built today must publish
None for a pending bond and only name a coin once one is confirmed.

That is the property worth a test regardless of when this lands: pending must not publish a
pointer.

[MichaelTaylor3d]

Owned by lane loop/batch-mirror (dig-node worktree dn-mirror), DRAFT PR #457, base 3e480dd.

Worked as one batch with #435, #429, #427. Progress lands on the PR.

[MichaelTaylor3d]

Implemented on branch loop/batch-mirror, DRAFT PR #457 (head a72b06d), version 0.190.0.

The per-ticket reasoning, the tests and their revert-proofs, and the blast radius are stated in full on the PR body. Awaiting the triple gate; not merged by this lane.