Task
Two readers are intentionally infallible over a locator that is now fallible, and nothing stops a
future caller from using either to decide an absence. The doc comments say so; no test does. Make the
obligation enforceable.
crates/dig-node-core/src/seams/dig_peer/module_transport.rs — discovered_candidatesNodeContent::find_providers
Why this specific gap, and not a general "add tests" ticket
This is the exact shape that just cost three rounds on PR #292. A failed DHT walk was swallowed into
Ok(vec![]) two layers below the fix, so the node answered absence_established: true for content that
exists — no forged message required, and worse on a stock node because recursion ships OFF, making that
conjunct the entire search.
Rounds 1 and 2 each wrote a correct Err arm, and both were unreachable. The defect was fixed at the
swallowing layers in round 3 (union_locator.rs, capsule_fallback.rs).
These two readers are the remaining infallible consumers. They are correct today — they do not
decide absence. The gap is that nothing prevents tomorrow's caller from using one that way, and the
failure would be silent in exactly the manner that took three rounds to see: a plausible-looking absence
claim, no red anywhere, and a hop relaying it onward.
What "done" looks like
Make the misuse unexpressible rather than merely documented, if the type system can carry it — a
distinct return type for "candidates I found" versus "an answer you may conclude absence from" is worth
more than any assertion. Construction beats care, and this ecosystem has repeatedly measured that a
comment asking future readers to be careful does not hold.
If that is too invasive, a test that fails when either reader is used to produce a conclusive absence is
acceptable — but it must genuinely discriminate. A test that passes because the condition cannot arise in
the fixture is the failure mode already recorded across this codebase.
The rule to encode is the one round 3 settled on: best-effort for FINDING, strict for ABSENCE. A
non-empty result is not an absence claim and stays Ok; an empty result carrying a source failure is not
an absence and must not read as one.
Scope
Not a live defect — both readers are correct as written. Filed because it is the residue of a defect that
was genuinely hard to see, and the next instance would be equally hard.
Parent
https://github.com/DIG-Network/dig_ecosystem/issues/3128
Task
Two readers are intentionally infallible over a locator that is now fallible, and nothing stops a
future caller from using either to decide an absence. The doc comments say so; no test does. Make the
obligation enforceable.
crates/dig-node-core/src/seams/dig_peer/module_transport.rs—discovered_candidatesNodeContent::find_providersWhy this specific gap, and not a general "add tests" ticket
This is the exact shape that just cost three rounds on PR #292. A failed DHT walk was swallowed into
Ok(vec![])two layers below the fix, so the node answeredabsence_established: truefor content thatexists — no forged message required, and worse on a stock node because recursion ships OFF, making that
conjunct the entire search.
Rounds 1 and 2 each wrote a correct
Errarm, and both were unreachable. The defect was fixed at theswallowing layers in round 3 (
union_locator.rs,capsule_fallback.rs).These two readers are the remaining infallible consumers. They are correct today — they do not
decide absence. The gap is that nothing prevents tomorrow's caller from using one that way, and the
failure would be silent in exactly the manner that took three rounds to see: a plausible-looking absence
claim, no red anywhere, and a hop relaying it onward.
What "done" looks like
Make the misuse unexpressible rather than merely documented, if the type system can carry it — a
distinct return type for "candidates I found" versus "an answer you may conclude absence from" is worth
more than any assertion. Construction beats care, and this ecosystem has repeatedly measured that a
comment asking future readers to be careful does not hold.
If that is too invasive, a test that fails when either reader is used to produce a conclusive absence is
acceptable — but it must genuinely discriminate. A test that passes because the condition cannot arise in
the fixture is the failure mode already recorded across this codebase.
The rule to encode is the one round 3 settled on: best-effort for FINDING, strict for ABSENCE. A
non-empty result is not an absence claim and stays
Ok; an empty result carrying a source failure is notan absence and must not read as one.
Scope
Not a live defect — both readers are correct as written. Filed because it is the residue of a defect that
was genuinely hard to see, and the next instance would be equally hard.
Parent
https://github.com/DIG-Network/dig_ecosystem/issues/3128