fix(dig-node): guard remaining inline background loops against panic-death (#2068)

[MichaelTaylor3d]

Closes dig_ecosystem#2068. Follow-up to #2067 — extends the same crate::shared::catch_iteration(loop_name, fut) combinator (no new mechanism) to the deferred long-lived background loops, conservatively scoped to the ones that extract cleanly with low blast radius.

Guarded (2) — both in seams/dig_peer/holdings.rs

1. run_first_peer_announcer — the per-pool-event re-state is wrapped in catch_iteration("first_peer_announce", restate_holdings(...)). To make the iteration testable, restate_holdings now takes transport: &dyn AnnounceTransport (the seam announce_all_holdings already consumes) instead of &GossipHandle — a private fn, 2 call sites both in this file. events.recv().await stays at the loop top, so a persistently-panicking re-state cannot hot-spin.
   • AssertUnwindSafe soundness — SOUND: the guarded iteration carries only &dyn seam refs; no std::sync::MutexGuard crosses the catch boundary (the broadcaster seq is an AtomicU64, not a guard).
2. run_holdings_ingest — the per-frame apply body (canonicalize + accept + log) was extracted into apply_inbound_announcement(...) and wrapped in catch_iteration("holdings_ingest", ...). inbound.recv().await stays at the loop top (natural throttle, no hot-spin); the Lagged/Closed control-flow arms stay OUTSIDE the guard.
   • AssertUnwindSafe soundness — SOUND: no lock held across the boundary; the ingress state is a tokio (async, non-poisoning) Mutex taken + released inside accept, never held by the loop across iterations.

Neither change masks real errors — the guard catches only panics; each loop's Result/Rejected handling is unchanged. A caught panic abandons that iteration's work (fail-closed) and the loop continues — it never bypasses the accept/signature gates (those run inside apply_inbound_announcement, so a caught panic drops the frame, it does not land it unverified).

Deferred (with reasons — per the conservative scope, → follow-up)

• pex.rs spawn_pool_feeder and download.rs spawn_gc — iterate over concrete handles/filesystem with no injectable panic seam; a non-vacuous test needs an invasive seam.
• peer.rs inline bring-up loops (selector-registry feed, DHT-routing feed, pool-stats, relay-acceptor) — extracting testable helpers + seams in central, high-fan-in peer.rs is exactly the invasive restructuring #2068 says to defer. No peer.rs edits made (kept the PR small).

These need injectable seams to get genuine per-loop panic tests — a further hardening follow-up sized above this scope.

Note: run_first_peer_announcer's initial (pre-loop) re-state is intentionally left UNGUARDED — one-shot at bring-up, where task-death is the correct fail-safe; only the long-lived loop iteration is guarded.

How verified (TDD)

• holdings::a_panicking_re_state_is_caught_and_does_not_propagate — drives the real restate_holdings via catch_iteration against a PanickingInventory + a real signed broadcaster; asserts None.
• holdings::a_panicking_frame_application_is_caught_and_does_not_propagate — builds a genuinely-signed announcement (real P-256 identity; passes every accept gate) and drives apply_inbound_announcement against a PanickingSink; asserts None. Non-vacuous — the panic is raised by the real apply path reaching the sink, so removing catch_unwind aborts the test.
• cargo test -p dig-node-core --lib → 664 passed, 0 failed (662 baseline + 2). fmt + clippy -D warnings clean; both crates build.

Blast radius

No peer.rs edits. Only restate_holdings changed signature — private, 2 in-file call sites. The two public loop fns kept their signatures (callers in peer.rs/integration tests unaffected). 3 files, +200/−30.

Version

root [workspace.package].version 0.93.6 → 0.93.7 (patch, fix:); Cargo.lock regenerated.

---

Generated by Claude Code