invert the HTLC timelock direction (#482)

[Zyrtnin]

Closes #482.

t_rxd must exceed t_btc, not the reverse. The maker holds the preimage p, locks the Radiant leg and claims the counter leg, so the leg it locks carries the longer timeout (Herlihy, arXiv:1801.09515 §1). Built the old way, the maker can let its own leg mature, refund it, and still claim the counter leg with p — taking both.

Full CI gate green: 10,505 passed, 90.42% coverage, security coverage 100%, mypy clean.

The published conformance vectors taught the exploitable direction

The most serious finding, and it is not in the source. conformance/htlc-handshake-vectors.json exists so a second implementation can check its bytes against pyrxd. It encoded the inverted rule in three places:

notes.timelock_ordering: "t_btc MUST exceed t_rxd by at least the verifier's own
margin. The taker locks first and holds the LONGER refund."

margin-ok-gap-40-margin-36   t_btc 60 / t_rxd 20  -> ACCEPT
margin-inverted-ordering     t_btc 20 / t_rxd 60  -> REJECT

The second is the correct ordering, published under the name "inverted-ordering" and marked reject. An implementer who got the direction right would fail conformance and be told — with the authority of a spec and a passing run — to swap it to the vulnerable layout.

Every vector is regenerated from the builders, not hand-edited: the covenant SPK commits to refund_csv = t_rxd and the BTC taptree commits to t_btc, so both sets of bytes move with the swap.

Five production sites built the exploitable ordering

file	was
scripts/dust_swap_run.py:132	t_btc = t_rxd + margin + 4
scripts/eth_swap_run.py:719	t_btc = t_rxd + margin + 4
scripts/eth_swap_two_host.py:249	t_btc = t_rxd + margin + 4
scripts/watchtower_dust_run.py:237	CLI guard + defaults enforcing --t-btc > --t-rxd
scripts/btc_swap_two_host.py:855	self-check terms t_rxd=20 / t_btc=60

The watchtower one enforced it at the command line, with "(BTC is the longer leg)" in the refusal — an operator following the message built the vulnerable layout.

Found by grepping every t_btc = construction as a set after the first turned up, not by fixing the one the failing test named.

Defects the inversion itself introduced or exposed

Each was caught by a test, and each is the kind that survives review because the old direction made it the safe one.

1. The expired-deadline refusal silently vanished. It used to fall out of the old arithmetic; inverted, a close deadline is the easy case, so both covering tests went green-by-vacuity. Now asserted directly by assert_eth_deadline_is_claimable. A requirement that holds only as a side effect is one refactor away from gone.

2. The ordering gate compared against a window the maker had already spent. t_rxd is a relative CSV from covenant mining; the gate anchored at now and the covenant was locked earlier. The maker picks that gap by locking early and presenting late. Overstating the window was conservative under the old relation and is the theft direction under this one. New step 7 re-checks against the remaining window where cov_confs is known — the [MEDIUM] pre_btc_lock_check 3b uses the negotiated t_rxd, not the remaining window — it admits swaps that are SQUEEZED at the earliest possible claim #531 conflation, one gate over. Proved by planting: the attack test fails without the subtraction, the honest-path test still passes.

3. The sizer searched away from the gate. I inverted budget_s and left ceil(x) - 1 with a step-down loop against what is now a lower bound. Every step moved further from acceptance; 50 tests failed with "the sizer and the gate disagree", a message about float rounding for a reversed inequality.

4. The sizer then overshot by a block, because ceil is the exact minimum only in exact arithmetic and an upward-only search cannot recover. Starts one below now.

5. The runner's feasible set was squeezed between a floor and a cap. Bound B is a floor now, every bound is a floor, and the only ceiling is the BIP68 field width — so the L-15 empty-set class (two bounds algebraically equal rounding one apart) and the L-17 derivation-gap class are unrepresentable, not fixed. The 3-hour deadline from the incident that burned two funded covenants is simply fine: (497, 65535).

6. The infeasibility remedy reversed. _smallest_workable_eth_timeout_s searched upward for more time. Upward now walks away from feasibility, and had it found anything it would have advised lengthening a deadline already too long.

Tests: re-derived, not renumbered

543 failures. The mechanical swap was wrong in most of them, and several would have asserted a bug had the numbers just been updated:

• both two-host self-checks built a "hostile envelope" that, written the old way, no longer constructs — so the margin check never ran and the test passed on an exception from the ordering guard instead. A refusal triggered by the wrong thing looks identical to success.
• the vulnerable-window floor was probed one below the derived value; the deadline floor dominates now, so the probe still satisfies it and the assertion was vacuous.
• the resume check was a cap that fell as the deadline approached. The floor falls too, so a window long enough at the start is always still long enough — demanding a refusal would strand the swap the check exists to save.
• test_swap_invariants I5 is a property test over a generated domain; the old form asserted the exploitable ordering across all of it.

Where a hardcoded value could collide with a caller's, fixtures now derive (t_rxd from t_btc, t_btc from the covenant's own CSV). Where constants hang off one side, the other side moved instead. Historical defect rows are kept and inverted rather than deleted — they are the evidence those specific inputs are fixed.

Not done

• The post-confirm recheck (_assert_eth_lock_timing_still_safe) no longer discriminates much: a late maker lock is now safe, and it does not read the covenant's actual depth. Step 7 covers the pre-fund case; the recheck deserves its own follow-up.
• Swaps remain UNAUDITED. External audit is still the hard gate before real value.