two-host harness has no refund or abort phase — each role can reach funded-but-unrecoverable

[Zyrtnin]

scripts/eth_swap_two_host.py and scripts/btc_swap_two_host.py dispatch exactly five phases each:

(taker, intro) (taker, fund) (taker, claim) (maker, envelope) (maker, lock-claim)

There is no refund and no abort phase in either. Consequences, traced:

• Taker funds the counter leg → maker stalls → nothing drives mutual_refund.
• Maker locks the Radiant covenant → taker never claims → nothing drives the CSV refund, and the maker's rxd_leg is built with a _NoFeeSource() unless --fee-* was passed, which raises SystemExit on any spend attempt.

So each role can reach funded-but-unrecoverable within the harness. The hostile-counterparty scenarios the harness's own docstring names as its reason to exist are precisely the ones it cannot execute.

This matters more than an ordinary gap because the two-party adversarial run is the project's stated hard gate before real value. A run conducted with these scripts exercises the happy path and the claim race; it cannot exercise either unwind, so it cannot evidence the recovery behaviour the safety argument depends on.

Related, same file

• --asset-locked-at-height defaulted to 0 with no validation, so the reorg gate read SQUEEZED at any realistic tip and the finality wait was never observed. Fixed on feat/erc20-usdc-leg.
• eth_swap_two_host built its CrossClockMargin without eth_finality_stall_tolerance_s (defaulting to 0) and exposed no flag for it, while eth_swap_run refuses < 3600 for a real-value token leg. Flag added on the same branch.

What would close this

--phase refund and --phase abort for both roles, driving mutual_refund and the CSV refund respectively, with the fee source wired so the spend can actually be built. Neither is exercised by any test today — see the fund-moving paths listed in the branch's review notes.

[Zyrtnin]

Tracker audit — the main finding is STILL OPEN and accurate; the two "Related, same file" items have landed. Verified against origin/main (558e49e).

Unchanged — the harness still cannot drive either unwind

btc_swap_two_host.py:955   --phase choices=["intro", "fund", "claim", "envelope", "lock-claim"]
eth_swap_two_host.py:1021  --phase choices=["intro", "envelope", "fund", "lock-claim", "claim"]

Neither has a refund or an abort phase. Both roles can still reach funded-but-unrecoverable inside the harness, so the hostile-counterparty scenarios the scripts' own docstrings name remain unexecutable.

Landed — both "Related" items

• --asset-locked-at-height is now resolved through resolve_asset_locked_at_height in both scripts, with a negative-value refusal (btc_swap_two_host.py:1033-1035). The default=0-validated-nowhere case is closed.
• eth_swap_two_host now exposes --eth-finality-stall-tolerance-s and threads it into the CrossClockMargin (:211, :1076).

Cross-reference

#519 is the other half of this for the two-party adversarial run: this issue is "the harness cannot drive an attended recovery", #519 is "no unattended actor can perform one either".

[Zyrtnin]

One more asymmetry in the same file, found during the tracker audit and verified on origin/main (558e49e). Filing it here rather than separately: it is the same script, and the same shape — a guard the single-host runner has and the two-host harness does not.

--eth-finality-stall-tolerance-s now exists on both runners, but only one enforces it:

eth_swap_run.py:175       if args.eth_finality_stall_tolerance_s < 3600: raise SystemExit(...)
eth_swap_two_host.py:1076 default=0, and no check anywhere — the only other reference is
                          the pass-through at :211

The two-host help text says it plainly:

0 is the regtest/anvil default; a real-value parameterisation needs >= 3600, which is what eth_swap_run.py enforces.

A guard documented by pointing at a different program's guard is not a guard. _token_leg_is_real gates the refusal in eth_swap_run, so the single-host path cannot be run against a real token leg with a 0 stall budget; the two-host path can, silently, at the default — and the two-host path is the one the two-party adversarial run is meant to use.

Cheap to close: lift the same _token_leg_is_real + >= 3600 refusal into eth_swap_two_host's argument validation.