Zone ID namespace mismatch breaks K-anonymity spatial dilution

[cursor]

Summary

Tokens, query matching, and K-anonymity spatial dilution use inconsistent zone identifiers. Agents emit tokens with neighborhood_id, but the aggregator passes that value into SpatialGrid.dilated_zone(), which expects a grid cell ID (0 … n_cells-1).

Affected code

• src/garland/agents.py — CitizenAgent.observe_and_detect() sets zone_id=self.neighborhood_id
• src/garland/agents.py — NetworkAggregator.evaluate_and_broadcast() calls spatial_dilate_fn(zone_id, k_min)
• src/garland/simulation.py — query responses match agent.neighborhood_id in query.zone_cells
• src/garland/spatial.py — dilated_zone(center_cell, k_min) operates on cell indices

Impact

• Dilated zones may target the wrong geography (neighborhood ID 5 ≠ cell 5)
• Broadcast queries may miss agents who reported anomalies, or include unrelated agents
• K-anonymity guarantees described in the README may not hold in simulation runs
• Unit tests for dilution use real cell IDs and do not catch this integration bug

Suggested fix

Use a single spatial namespace throughout the protocol, e.g. grid.cell_of(agent.idx) when creating tokens and when matching agents to broadcast queries.

Acceptance criteria

• Token zone_id and dilated zone_cells use the same spatial index (grid cell IDs)
• Agents in a dilated zone correctly receive and respond to broadcast queries
• Integration test verifies token → threshold → dilution → broadcast → response for a clustered anomaly