chore!: merge v4.2-dev into v4.3-dev

[PastaPastaPasta]

Issue being fixed or feature implemented

Forward-merge v4.2-dev into v4.3-dev. Replaces #5148. That PR's head was a plain snapshot of v4.2-dev, so it left the conflict and a PV15 build break unresolved, and it came from a fork, so self-hosted CI was skipped.

This also brings the self-hosted runner / prebaked Android SDK workflow fix (#4702) into v4.3-dev. Kotlin CI on v4.3-dev PRs (e.g. #5146) currently fails with cannot create cmdline-tools — Permission denied.

What was done?

A real merge commit (parents v4.3-dev 67340ad82 + v4.2-dev 1464314a7; 33 target-only / 118 source-only commits), with two resolutions. Follow-up merges bring in v4.2-dev up to eefca92aa, all clean: a02b14607 (#5155, runner image controller pin), 5a3fa4a1c (#5156 runner candidate status fix, #5153 document type GroveDB layout, #5147 WASM release optimization) 6f552ea18 (#5157, runner controller pin) 955eeaa3b (#5159, document create cost for the SDKs) and e6742339b (#5163, contest fund for hand-built document creates). The original merge has two resolutions:

1. Conflict: rs-platform-wallet/src/wallet/identity/network/dpns.rs (import block only)

   • fix(platform-wallet): select available signing keys across identity operations #4764 (v4.3) replaced IdentityGettersV0 with super::signing_key::AvailableSigningKey.
   • fix(platform)!: contenders state the most they pay and are charged the join price (PV14) #5039 (v4.2) added dpp::fee::Credits on the neighbouring line for the new contest_fund parameters.
   • Kept AvailableSigningKey and Credits. IdentityGettersV0 is no longer used.

2. Semantic break, not flagged by git: rs-platform-version/src/version/v15.rs

   • feat(platform): introduce protocol version 15 #5043 (v4.3) introduced PLATFORM_V15 as a copy of v14, using DRIVE_ABCI_QUERY_VERSIONS_V3.
   • refactor(platform): fold DRIVE_ABCI_QUERY_VERSIONS_V3 into V2 #5057 (v4.2) folded DRIVE_ABCI_QUERY_VERSIONS_V3 into V2 and deleted v3.rs, so the merged tree did not compile.
   • Pointed v15 at DRIVE_ABCI_QUERY_VERSIONS_V2. Checked that PLATFORM_V15's component tables now match PLATFORM_V14 exactly (apart from protocol_version), as feat(platform): introduce protocol version 15 #5043 intends ("v15 == v14 until a follow-up bumps a table").

Everything else auto-merged. The other files changed on both sides were .github/workflows/pr-review-policy.yml (the same re-pin on both sides), ManagedPlatformWallet.swift, and the platform-wallet crypto/invitation.rs, contact_requests.rs, document.rs, invitation.rs and profile.rs. All merged without conflict markers and compile.

How Has This Been Tested?

Run locally on the merge result (macOS arm64):

• cargo check --tests -p platform-version -p platform-wallet -p platform-wallet-ffi -p dash-sdk -p rs-unified-sdk-jni -p drive-abci: passes.
• cargo test --lib -p platform-version -p platform-wallet: 23 + 1181 passed.
• rustfmt --check on the two edited files: clean.
• The Swift SDK was not built locally. The v4.2 Swift change (maxContestFund on registerDpnsName / document create) auto-merged, so it relies on CI.

Breaking Changes

None of its own. It carries the breaking (PV14) changes already on v4.2-dev into v4.3-dev.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed
• If I added or changed GroveDB structure, I described it in the area's structure.rs, regenerated grovedb-structure.json, and checked the structure viewer link posted on this pull request

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

Merge with a merge commit (not squash/rebase) to preserve ancestry between the branches.

🤖 Generated with Claude Code

PR Hygiene · e674233

• Bots — coderabbitai not yet · thepastaclaw not yet — /skip-bots proceeds without the ones not yet reported
• Self-review — post /self-reviewed once the bots are done
• Within your 5 open PRs — this one is beyond the limit; it waits until one merges
• Build running
• Approvals
  • files with no dedicated owner (.claude/skills/pr-description/SKILL.md, .editorconfig, .github/NPM_RUNNER.md and 226 more) — QuantumExplorer or shumkov
  • dashmate (packages/dashmate/package.json) — ktechmidas or shumkov
  • system-contracts (packages/dashpay-contract/README.md, packages/dashpay-contract/package.json, packages/document-history-contract/package.json and 6 more) — QuantumExplorer or shumkov
  • js-wasm-sdk (packages/js-dash-sdk/package.json, packages/js-evo-sdk/README.md, packages/js-evo-sdk/package.json and 25 more) — shumkov
  • kotlin-sdk (packages/kotlin-sdk/CLAUDE.md, packages/kotlin-sdk/KotlinExampleApp/TEST_PLAN.md, packages/kotlin-sdk/KotlinExampleApp/app/src/main/java/org/dashfoundation/example/ui/contracts/CreateDocumentScreen.kt and 18 more) — HashEngineering
  • dpp (packages/rs-dpp/schema/meta_schemas/document/v3/document-meta.json, packages/rs-dpp/src/address_funds/fee_strategy/mod.rs, packages/rs-dpp/src/address_funds/platform_address.rs and 129 more) — QuantumExplorer or shumkov
  • rs-drive-abci (packages/rs-drive-abci/src/abci/app/check_tx.rs, packages/rs-drive-abci/src/abci/app/consensus.rs, packages/rs-drive-abci/src/abci/app/full.rs and 97 more) — QuantumExplorer or shumkov
  • rs-drive (packages/rs-drive/Cargo.toml, packages/rs-drive/grovedb-structure.json, packages/rs-drive/src/config.rs and 156 more) — QuantumExplorer or shumkov
  • rs-platform-wallet-ffi (packages/rs-platform-wallet-ffi/src/document.rs, packages/rs-platform-wallet-ffi/src/dpns.rs, packages/rs-platform-wallet-ffi/src/identity_keys_from_mnemonic.rs) — HashEngineering or ZocoLini or llbartekll or romchornyi
  • rs-platform-wallet (packages/rs-platform-wallet/PERSISTENCE_REDESIGN.md, packages/rs-platform-wallet/PLAN.md, packages/rs-platform-wallet/docs/DASHPAY_MIGRATION_PLAN.md and 25 more) — HashEngineering or ZocoLini or llbartekll or romchornyi
  • rust-sdk-ffi (packages/rs-sdk-ffi/src/data_contract/mod.rs, packages/rs-sdk-ffi/src/data_contract/property_constraints.rs, packages/rs-sdk-ffi/src/data_contract/put.rs and 30 more) — lklimek or shumkov
  • rust-sdk (packages/rs-sdk/src/platform/documents/contest_fund.rs, packages/rs-sdk/src/platform/documents/mod.rs, packages/rs-sdk/src/platform/documents/transitions/create.rs and 5 more) — lklimek or shumkov
  • swift-sdk (packages/swift-sdk/CLAUDE.md, packages/swift-sdk/Sources/SwiftDashSDK/Core/Utils/DocumentPropertyConstraints.swift, packages/swift-sdk/Sources/SwiftDashSDK/Core/Wallet/WalletStorage.swift and 62 more) — llbartekll or romchornyi

When every box is checked the PR Hygiene check passes and this can merge.

[github-actions]

📖 Book Preview built successfully.

Download the preview from the workflow artifacts.
To view locally: download the artifact, unzip, and open index.html.

Updated at 2026-09-29T00:48:21.494Z

[thepastaclaw]

🕓 Queued for automated review — 7th in line, estimated start in ~50 min (commit e674233)
Estimated review time once started: ~30 min (two-phase automated review; median of recent runs).

• Request priority review — click to move this review to the front of the queue.

[thepastaclaw]

Final validation — Phase 1 + Phase 2

The two manual merge resolutions are consistent with the surrounding code, and PV15's component tables match PV14's. Verification confirmed one historical-protocol parsing change that needs version gating and one mobile API conversion that discards an explicit zero spending cap. All 23 platform-version tests and a focused PV13 parser reproduction passed; temporary test changes were removed and the working tree is clean.

🔴 1 blocking | 🟡 1 suggestion(s)

2 finding(s) not shown inline (GitHub refused the PR diff as too large)

🔴 Blocking: Gate the UTF-8 parsing change to the new parser generation
packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs:320-322

This shared helper changes behavior under historical protocol versions, not just PV14/PV15. A focused reproduction with PlatformVersion::get(13), full_validation=true, an object property named profile, and required: ["profile", "profileé"] succeeds at this head; the base implementation's key[property_key.len() + 1..] panics inside the UTF-8 encoding of é. The PV13 meta-schema permits this required entry, and CONTRACT_VERSIONS_V5 still dispatches through parser generation 2 into this helper. Consequently, upgraded nodes accept a schema that unupgraded nodes abort on at the same active protocol version, contradicting the comment's output-equivalence justification. Isolate the corrected required/transient matching in the new parser generation selected by PV14/PV15, and add regression coverage across the historical/new-generation boundary.

_{source: gpt-6-astra (phase2-reviewer: general, architecture-layering, ffi-engineer, platform-versioning)}

🟡 Suggestion: Preserve an explicit zero contest cap across the mobile boundary
packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift:1740-1741

The public API defines maxContestFund as the maximum contribution and reserves nil for automatic pricing, but maxContestFund: 0 and nil both become zero here. The Rust FFI then converts zero to None, and with_contest_fund_to_join substitutes the current contest price before signing. A caller setting a zero cap can therefore authorize a positive contest contribution. The document-create wrappers and Kotlin APIs have the same conversion; Kotlin explicitly accepts zero. Preserve presence separately across FFI, or reject an explicitly supplied zero in the public mobile wrappers before calling native code. Rust's Some(0) already remains distinct from automatic pricing.

_{source: gpt-6-astra (phase2-reviewer: general, architecture-layering, ffi-engineer, platform-versioning)}

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: muse-spark-1.3-contributor (agent: phase1-reviewer, role: architecture-layering); reviewer 3: muse-spark-1.3-contributor (agent: phase1-reviewer, role: ffi-engineer); reviewer 4: muse-spark-1.3-contributor (agent: phase1-reviewer, role: platform-versioning); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 6: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 7: gpt-6-astra (agent: phase2-reviewer, role: ffi-engineer); reviewer 8: gpt-6-astra (agent: phase2-reviewer, role: platform-versioning); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: critical by gpt-6-astra (effort low) — This large forward-merge changes consensus-enforced document property constraints in packages/rs-dpp/src/data_contract/document_type/property_constraints/mod.rs and state-dependent aggregate validation in packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/transformer/v0/property_constraint_aggregates.rs, meeting both the intricacy and critical-surface criteria
• Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — architecture-layering (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — ffi-engineer (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — platform-versioning (completed, effort xhigh); agent phase1-reviewer
• Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — platform-versioning (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs`:
- [BLOCKING] packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs:320-322: Gate the UTF-8 parsing change to the new parser generation
  This shared helper changes behavior under historical protocol versions, not just PV14/PV15. A focused reproduction with PlatformVersion::get(13), full_validation=true, an object property named `profile`, and `required: ["profile", "profileé"]` succeeds at this head; the base implementation's `key[property_key.len() + 1..]` panics inside the UTF-8 encoding of `é`. The PV13 meta-schema permits this required entry, and CONTRACT_VERSIONS_V5 still dispatches through parser generation 2 into this helper. Consequently, upgraded nodes accept a schema that unupgraded nodes abort on at the same active protocol version, contradicting the comment's output-equivalence justification. Isolate the corrected required/transient matching in the new parser generation selected by PV14/PV15, and add regression coverage across the historical/new-generation boundary.

In `packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift`:
- [SUGGESTION] packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift:1740-1741: Preserve an explicit zero contest cap across the mobile boundary
  The public API defines maxContestFund as the maximum contribution and reserves nil for automatic pricing, but `maxContestFund: 0` and nil both become zero here. The Rust FFI then converts zero to None, and `with_contest_fund_to_join` substitutes the current contest price before signing. A caller setting a zero cap can therefore authorize a positive contest contribution. The document-create wrappers and Kotlin APIs have the same conversion; Kotlin explicitly accepts zero. Preserve presence separately across FFI, or reject an explicitly supplied zero in the public mobile wrappers before calling native code. Rust's Some(0) already remains distinct from automatic pricing.

[PastaPastaPasta]

Re the review above: both findings are about code that came in unchanged from v4.2-dev. The merge resolutions (dpns.rs imports, the PV15 query-version pointer) don't touch either one, so I'm not changing them in this forward-merge.

• 🔴 UTF-8 required/transient matching in try_from_schema/mod.rs: comes from fix(dpp): parse nested required and transient entries by prefix #5050 (3e6e2584d). The file is byte-identical to v4.2-dev. If this reproduces, it's a historical-protocol consensus concern on v4.2-dev itself, and the fix (version-gating it into the new parser generation) should land there first, then flow forward.
• 🟡 Swift maxContestFund: 0 collapsing to automatic pricing: comes from fix(platform)!: contenders state the most they pay and are charged the join price (PV14) #5039 (eeed935bd). It should be fixed in v4.2-dev too.

@QuantumExplorer, flagging these for you since both came from your PRs.

---

🤖 Posted autonomously by Codex on behalf of pasta.

[QuantumExplorer]

No, I do this manually. Too easy for someone to make a mistake here and squash.