Task
autoseed::latch_ever_funded is wired, persistent and idempotent — but nothing calls it. No balance observer exists, so in the shipped build a funded auto-created wallet is still reported disposable.
SPEC.md §16.4 carries an explicit NOT YET SATISFIED block saying exactly this. This ticket closes that block.
Why a SPEC note is not enough on its own
The implementer raised this and is right: a SPEC that documents an unwired contract invites a future reader to implement against the paragraph and miss the caveat. The paragraph reads as a specification of behaviour; the caveat is one block away and easy to skim past.
It is also the pattern this ecosystem hit three separate times on 2026-08-20 — a conformance claim that passes because the thing it governs never occurs (Tier2Bribed has no producer; dig-sex §12 asserted profit-first conformance; this latch). CLAUDE.md now requires a conformance list to distinguish satisfied from vacuously satisfied. This is the tracked half of that requirement.
What the latch is for
ever_funded is monotonic and never clears. Once set, no surface may describe the wallet as disposable, whatever the current balance reads — a balance of zero is not evidence a wallet never mattered.
The wallet in question was created without the user asking, and its recovery phrase has never been shown to anyone. So "disposable" is the most dangerous thing a surface could say about it, and the latch is what stops that being said.
Scope
Call latch_ever_funded from wherever the node first observes a non-zero balance for the wallet. The observation point is the design question worth settling before writing: a wallet-sync callback, a periodic reconcile, or the status read — they differ in how quickly the latch is set after funds arrive, and a gap between "funded" and "latched" is a window where the wrong sentence can still be shown.
Fail toward latching. If it is unclear whether funds were observed, latch. The cost of latching a never-funded wallet is that it stops being called disposable; the cost of the reverse is a user losing money they could not recover.
Context
Evidence
A test that fails without the fix: observe a non-zero balance for an origin: auto wallet, restart, and assert is_disposable() is false. Today it stays true forever.
Delete the NOT YET SATISFIED block in the same unit of work — a stale caveat is worse than none, because the next reader trusts it.
Task
autoseed::latch_ever_fundedis wired, persistent and idempotent — but nothing calls it. No balance observer exists, so in the shipped build a funded auto-created wallet is still reported disposable.SPEC.md§16.4 carries an explicitNOT YET SATISFIEDblock saying exactly this. This ticket closes that block.Why a SPEC note is not enough on its own
The implementer raised this and is right: a SPEC that documents an unwired contract invites a future reader to implement against the paragraph and miss the caveat. The paragraph reads as a specification of behaviour; the caveat is one block away and easy to skim past.
It is also the pattern this ecosystem hit three separate times on 2026-08-20 — a conformance claim that passes because the thing it governs never occurs (
Tier2Bribedhas no producer; dig-sex §12 asserted profit-first conformance; this latch). CLAUDE.md now requires a conformance list to distinguish satisfied from vacuously satisfied. This is the tracked half of that requirement.What the latch is for
ever_fundedis monotonic and never clears. Once set, no surface may describe the wallet as disposable, whatever the current balance reads — a balance of zero is not evidence a wallet never mattered.The wallet in question was created without the user asking, and its recovery phrase has never been shown to anyone. So "disposable" is the most dangerous thing a surface could say about it, and the latch is what stops that being said.
Scope
Call
latch_ever_fundedfrom wherever the node first observes a non-zero balance for the wallet. The observation point is the design question worth settling before writing: a wallet-sync callback, a periodic reconcile, or the status read — they differ in how quickly the latch is set after funds arrive, and a gap between "funded" and "latched" is a window where the wrong sentence can still be shown.Fail toward latching. If it is unclear whether funds were observed, latch. The cost of latching a never-funded wallet is that it stops being called disposable; the cost of the reverse is a user losing money they could not recover.
Context
crates/dig-wallet/src/autoseed.rs—latch_ever_funded,is_disposable, and thewallet.meta.jsonsidecar.SPEC.md§16.4 — theNOT YET SATISFIEDblock this closes.#issuecomment-5358477734).Evidence
A test that fails without the fix: observe a non-zero balance for an
origin: autowallet, restart, and assertis_disposable()is false. Today it stays true forever.Delete the
NOT YET SATISFIEDblock in the same unit of work — a stale caveat is worse than none, because the next reader trusts it.