fix(utxo): register dual-write transfer outputs as account-mirror provenance (danaher #2819 receiver residual)

[Scottcjn]

Closes the receiver-provenance residual of the danaher-j cross-model double-spend (#2819). Found by a GPT-6 Astra audit of the UTXO transfer path and source-verified against the full mirror model.

The model (verified)

Under UTXO_DUAL_WRITE=1, balances (account) is the primary/total ledger (every epoch reward credits it); UTXO boxes are its shadow. account_mirror_boxes records which UTXO boxes back account value, with the consensus invariant mirror ≤ balance. For the two models not to double-count, every UTXO box representing account value must be mirror-tagged — so it can't be spent via the UTXO path independently of the account balance.

The residual

The mirror-input exclusion (spending an existing mirror box via UTXO) was already fixed and made unconditional. But a /utxo/transfer under dual-write:

• credits the receiver's account balance (balances += amount), and
• creates a spendable UTXO output box for the receiver via apply_transaction,

…and never registered that output as mirror provenance. So the receiver held amount in both models — spendable via /utxo/transfer (the untagged box) and via /wallet/transfer/signed (the account credit) = the same value spent twice. A total-only integrity check stays models_agree=True throughout.

Latent today (prod runs UTXO_DUAL_WRITE=0); arms on any dual-write enablement.

Fix

• utxo_db.apply_transaction exposes the authoritative tx_id on the caller's tx dict (tx['tx_id']) so the endpoint can find the boxes it created.
• The dual-write branch of /utxo/transfer registers every output box of the transfer (receiver idx 0, change idx 1) into account_mirror_boxes → the unconditional mirror-input exclusion then blocks re-spending them via UTXO; the value moves via the account path (which consumes the mirror on settle).
• Fail-closed per-wallet mirror ≤ balance assertion (compared in nRTC: value_nrtc vs amount_i64 × (UNIT//ACCOUNT_UNIT) — mirror boxes are nano-RTC, account is micro-RTC); a violation rolls back rather than committing money that exists twice.

Tests (node/test_utxo_dualwrite_receiver_provenance.py)

• receiver output is registered as mirror provenance;
• receiver box is excluded from UTXO spendable candidates (double-spend closed);
• mirror ≤ balance holds after transfer.

All 3 fail on origin/main and pass with this change. Existing UTXO suites: 154 passed, no new failures (the 17 pre-existing POC/isolation failures are identical on origin/main).

⚠️ Related, NOT fixed here (flagged for follow-up)

The epoch mining-reward dual-write path (rustchain_v2_integrated_...:~5698) likewise creates UTXO reward boxes without account_mirror_boxes provenance — same bug class, same latency behind UTXO_DUAL_WRITE=0. Keep UTXO_DUAL_WRITE=0 on prod until both are resolved. Recommend danaher-j review; bounty for #2819 remains held pending payout destination.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbyXP4eiiRYEa8GsQtQPhR

[github-actions]

⚠️ BCOS v2 Scan Results

Metric	Value
Trust Score	36/100
Certificate ID	BCOS-a201b126
Tier	L1 (not met)

What does this mean?

The BCOS (Beacon Certified Open Source) engine scans for:

• SPDX license header compliance
• Known CVE vulnerabilities (OSV database)
• Static analysis findings (Semgrep)
• SBOM completeness
• Dependency freshness
• Test infrastructure evidence
• Review attestation tier

Full report | What is BCOS?

---

BCOS v2 Engine - Free & Open Source (MIT) - Elyan Labs