1. Yes, all phases are disconnected at the network layer.
2. Yes it's signed with SIGHASH ACP | ALL in phase 2
3. Yes they are linkable ring signatures
4. Phase 3 and 4 will only happen if one of the...
Ah, i see. By using all|acp you have the 'crowdfunding' workflow, so the output set can be ... set ... in advance of the input set, so people can send their signed inputs independently of the other ones.
There's one complicated detail I see: in your example you have Carol fail-to-deliver on the inputs, and then the re-start with the other two, and the ring sigs allow them to demonstrate they were part of the original set, right. But in the case where the coordination fails, not because of failure-to-deliver but because of inputs not matching with outputs, you have the problem of not knowing who is at fault, right. Not saying you *have* to solve that problem, not sure, maybe.
There's one complicated detail I see: in your example you have Carol fail-to-deliver on the inputs, and then the re-start with the other two, and the ring sigs allow them to demonstrate they were part of the original set, right. But in the case where the coordination fails, not because of failure-to-deliver but because of inputs not matching with outputs, you have the problem of not knowing who is at fault, right. Not saying you *have* to solve that problem, not sure, maybe.