fix(dig-node): sweep modules-cache after reshare-warm promote_into_cache land (#2053)

[MichaelTaylor3d]

Closes dig_ecosystem#2053. Completes the "every on-demand land path sweeps" <cache>/modules disk-bound invariant (the #1934 / #2041 arc) — the reshare-warm land was the last land site without a tier-aware size-cap sweep.

Why

Surfaced by the #2041 loop-security audit: promote_into_cache (crates/dig-node-core/src/seams/dig_peer/module_reshare.rs) lands a whole capsule into <cache>/modules (atomic write-then-rename) with NO subsequent size-cap sweep, unlike cache_fetch_and_cache (#1934) and the read-path §21 sync (#2041). A remotely-triggered read fires the reshare warm (reader → holder, #1576), so repeated warms could grow the modules cache past the cap with the tier-0 loop idle — the same unbounded-growth class #2041 closed on the read path, still open on this one. Self-driven (the reshare flywheel), so lower severity than the read-path residual, but it left the SPEC's "every on-demand land" claim untrue.

Lock-context audit (the load-bearing step)

The reshare-warm land runs in CapsuleWarmer::warm() — a standalone seam reached via spawn_capsule_warm → a fire-and-forget tokio::spawn. It holds no cache_lock (no Node handle, no guard across the land). So the sweep uses the async Node::evict_modules_if_needed().await (takes cache_lock fresh) — mirroring #2041's sync_module_and_bound. The locked core evict_modules_locked() would evict without serialization here; the async variant under a held lock would deadlock — neither hazard applies since no lock is held. Injected via the existing tier0_live::ModulesCacheEvictor seam (the same NodeModulesEvictor the tier-0 loop uses) — no new, driftable evictor.

Tier: a reshare-warm module is untagged (never mark_tier0_land), so module_tier returns the protected Tier1Demand default (#2015 fail-safe). The sweep sacrifices Tier0Precache inventory first and the just-warmed module survives its own sweep — treated as its real (demand) tier, neither wrongly protected nor wrongly sacrificed. No tier-tag change needed.

What changed

• module_reshare.rs — CapsuleWarmer gains an evictor seam; warm() runs the sweep after a successful Held land.
• tier0_live.rs — ModulesCacheEvictor / NodeModulesEvictor exposed pub(crate) + NodeModulesEvictor::new; test-only NoopModulesEvictor.
• download.rs / peer.rs — wire NodeModulesEvictor::new(node) through wire_capsule_reshare.
• SPEC.md §3.4 — reshare-warm added to the on-demand land paths + the untagged→Tier1Demand note.
• Narrowed CapsuleWarmer::new + wire_capsule_reshare pub → pub(crate) (both crate-internal only — verified no external consumer; required to inject the crate-private evictor without a private_interfaces clippy error).

How verified (TDD)

• reshare_warm_land_bounds_modules_cache_evicting_the_tier0_victim (lib.rs) — real Node + real NodeModulesEvictor + mock transport: a real warm lands module A past the cap, the pre-seeded oversized tier-0 victim B is evicted, A survives.
• a_successful_reshare_warm_land_sweeps_the_modules_cache_once (module_reshare.rs, spy) — exactly one sweep on Held.
• a_refused_reshare_warm_does_not_sweep_the_modules_cache (module_reshare.rs, negative control) — zero sweeps on refusal.
• Non-vacuous: disabling the sweep call → the end-to-end + spy tests FAIL (B survives; sweeps≠1); the refusal control still passes. Restored → all pass.
• cargo test -p dig-node-core --lib → 656 passed, 0 failed; fmt + clippy -D warnings clean; build OK.

Version

root [workspace.package].version 0.93.3 → 0.93.4 (patch, fix:); Cargo.lock regenerated.

---

Generated by Claude Code