harden(dig-wallet): chain.rs:111 with_sources is dead code that builds a single-source peak_height path

[MichaelTaylor3d]

Task

chain.rs:111 with_sources is dead code that constructs peer_reads: None — a ChainTransport
whose peak_height therefore takes the oracle-first router path instead of the peer round.

Either delete it, or make it take the peer reads, before anyone calls it.

Why this is worth a ticket rather than a comment

The NC-12 property being enforced elsewhere in this crate is that a chain fact is agreed across several
concurrently-queried, independently-held peer sessions — never determined by a single source.

service.rs:173 is the only production ChainTransport construction, and it attaches
with_peer_reads, so chain.rs:200 always short-circuits into the peer round; an empty draw returns
None rather than falling back to an oracle read. That is the property, and it holds today only
because the other constructor is unused.

with_sources is a loaded gun with the safety off. The first caller who reaches for it gets a
transport that silently answers peak_height from one endpoint, with nothing in its name or signature
saying so — and it will look like the obvious constructor to use.

This is the same shape as the defect the NC-12 work just fixed one layer up: two "independence groups"
that both resolved to api.coinset.org, so a 2-of-2 quorum was satisfiable by one endpoint with zero
peers. A guard is only as good as the paths that cannot route around it.

Context

• crates/dig-wallet/src/sage/chain.rs:111 — with_sources, the dead constructor
• crates/dig-wallet/src/sage/chain.rs:200 — the peer-round short-circuit that peer_reads: Some(..) reaches
• crates/dig-node-service/src/service.rs:173 — the only production construction, which does it correctly
• router.rs:711-717 — get_blockchain_state, whose first line is "Try coinset first for full state"
• Parent: https://github.com/DIG-Network/dig_ecosystem/issues/2790 · epic https://github.com/DIG-Network/dig_ecosystem/issues/2760
• Found by the security gate on fix(wallet): make the provider registry real, and stop reporting a third party's peak #354 as non-gating item 5

Done condition

Either with_sources no longer exists, or it cannot produce a transport with peer_reads: None —
plus a test that fails if a future edit reintroduces a single-source peak_height path.

Prefer deletion. A constructor kept "in case someone needs it" is exactly how this returns.

Scope

Only this constructor. Do not widen into the rest of chain.rs.

Effort

Low — but the decision (delete vs. require peer reads) is worth a moment, because deleting is only
correct if genuinely nothing needs a source-only transport. Grep before deciding.

[MichaelTaylor3d]

Lane claimed. Branch loop/360-367-batch, draft PR #368 (batched with #360 #361 #363 #364 #367). Base 4efa57f, v0.154.0 -> 0.155.0. Will comment the outcome here.

[MichaelTaylor3d]

Shipped on #368 (b6df2bc)

Deleted, per the ticket's preference. Grepped first: with_sources had zero callers anywhere
in the workspace, and the only production ChainTransport construction (sage/service.rs:173)
already chains with_peer_reads -- so nothing needed a source-only transport.

The done condition's second half ("a test that fails if a future edit reintroduces a single-source
peak_height path") is a fail-closed closed enumeration: the constructors permitted to build
peer_reads: None are exactly new and the #[cfg(test)] with_client, and a third one fails the
suite by name. Three design points, because each is where this kind of guard usually goes
vacuous:

• The needle is assembled at run time from two fragments, so the guard cannot match itself.
• It matches the struct-literal FIELD form (trailing comma), not the prose form -- the first version
  matched the doc comments that discuss this shape and reported a site inside a test's own doc
  block.
• It asserts the scan matched something at all, so a needle that stops describing how an
  oracle-first transport is written is a failure rather than a silent pass.

Load-bearing: reintroducing with_sources gives
... are not on the closed list ["new", "with_client"]: ["with_sources"].

dig-wallet 0.35.0 -> 0.36.0: removing a pub fn breaks the crate's surface even with no callers.

Scope respected -- nothing else in chain.rs was touched.