Merge origin/v4.2-dev: renumber the conflict verdicts to 47/48

Merged #4451 claimed code 42 (ErrorMasternodeWithdrawalUnconfirmed) and
#4465 claimed 46 while this PR was open, and open #4313 reserves 43-45,
so the registry frontier is 47: ErrorAssetLockInputConflict moves 42→47
and ErrorAssetLockInputContested 43→48 across Rust, Swift, and Kotlin
(values, mapping arms, pin tests, and every numeric doc mention). Both
sides' additive arms are kept in the FFI From impl, the shielded
funding-result wrapper (and its test, under the base's broader name),
the Kotlin error hierarchy, and the recovery tests module.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: QuantumExplorer

.github/actionlint.yaml

@@ -1,9 +1,11 @@
 # Custom labels carried by this repo's self-hosted runners. Without this,
-# actionlint flags `runs-on: [self-hosted, rust-ci]` as an unknown label
+# actionlint flags `runs-on: [self-hosted, <label>]` as an unknown label
 # because it can't resolve it against the GitHub-hosted runner names.
 #
 # `rust-ci` must be applied to every runner allowed to take the Rust workspace
-# test job (Settings -> Actions -> Runners -> <runner> -> Labels).
+# test job, and `kotlin-ci` to every runner allowed to take the Kotlin SDK job
+# (Settings -> Actions -> Runners -> <runner> -> Labels).
 self-hosted-runner:
   labels:
     - rust-ci
+    - kotlin-ci

.github/actions/rust/action.yaml

@@ -123,7 +123,7 @@ runs:
       shell: bash
       if: runner.os == 'Linux'
       run: |
-        sudo apt update -qq
+        sudo apt update
         # snappy is required by rust rocksdb
         sudo apt install -qq --yes clang llvm libsnappy-dev
         sudo update-alternatives --set cc /usr/bin/clang

.github/package-filters/rs-packages-direct.yml

@@ -115,6 +115,9 @@ rs-dapi-client:
 platform-encryption:
   - packages/rs-platform-encryption/**
 
+dash-platform-queries:
+  - packages/dash-platform-queries/**
+
 dash-sdk:
   - packages/rs-sdk/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -127,9 +127,13 @@ rs-dapi-client: &dapi_client
 platform-encryption: &platform_encryption
   - packages/rs-platform-encryption/**
 
+dash-platform-queries: &platform_queries
+  - packages/dash-platform-queries/**
+
 dash-sdk: &sdk
   - packages/rs-drive-proof-verifier/**
   - packages/rs-sdk/**
+  - *platform_queries
   - *dash_async
   - *context_provider
   - *sdk_trusted_context_provider

.github/package-filters/rs-packages.yml

@@ -151,10 +151,15 @@ platform-encryption: &platform_encryption
   - .github/workflows/tests*
   - packages/rs-platform-encryption/**
 
+dash-platform-queries: &platform_queries
+  - .github/workflows/tests*
+  - packages/dash-platform-queries/**
+
 dash-sdk: &sdk
   - .github/workflows/tests*
   - packages/rs-drive-proof-verifier/**
   - packages/rs-sdk/**
+  - *platform_queries
   - *dash_async
   - *context_provider
   - *sdk_trusted_context_provider

.github/workflows/book-preview.yml

@@ -42,6 +42,8 @@ jobs:
           retention-days: 30
 
       - name: Post preview link
+        # Fork PRs run with a read-only token that cannot post comments
+        if: github.event.pull_request.head.repo.full_name == github.repository
         uses: actions/github-script@v7
         with:
           script: |

.github/workflows/kotlin-sdk-build.yml

@@ -24,52 +24,65 @@ on:
       - 'scripts/tests/**'
       - '.github/workflows/kotlin-sdk-build.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: kotlin-sdk-${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
   kotlin-sdk-build:
     name: Kotlin SDK build + tests (x86_64 emulator)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, kotlin-ci]
+    # Fork PRs must not execute on a persistent runner. Keep this guard in sync
+    # with tests-rs-workspace.yml.
+    if: >-
+      github.event_name != 'pull_request'
+      || github.event.pull_request.head.repo.full_name == github.repository
+      || github.event.pull_request.head.repo.owner.login == 'thepastaclaw'
     timeout-minutes: 120
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          # Preserve target/ and other untracked build outputs between runs.
+          clean: false
+
+      - name: Ensure runner dependencies
+        run: |
+          set -euo pipefail
+
+          MISSING=()
+          for pkg in build-essential cmake curl jq libgmp-dev libpulse0 libssl-dev libx11-xcb1 pkg-config python3 unzip zip; do
+            dpkg -s "$pkg" >/dev/null 2>&1 || MISSING+=("$pkg")
+          done
+          if [ ${#MISSING[@]} -gt 0 ]; then
+            echo "Installing: ${MISSING[*]}"
+            sudo apt-get update -qq
+            sudo apt-get install -qq --yes "${MISSING[@]}"
+          fi
+
+          if [ ! -x "$HOME/.cargo/bin/rustup" ]; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+              | sh -s -- -y --no-modify-path --default-toolchain none
+          fi
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Validate executable SDK parity manifest
         run: |
           python3 scripts/check_sdk_parity_manifest.py
           python3 -m unittest discover -s scripts/tests -p 'test_*.py'
 
-      - name: Free disk space
+      - name: Verify JDK 17
         run: |
-          # The API-35 x86_64 system image + the shielded .so's cargo target
-          # dir (halo2/Orchard) + gradle outputs overflow the ~21 GB free on
-          # the runner root fs, surfacing as "No space left on device" during
-          # system-image install (the emulator then never boots). Reclaim the
-          # large preinstalled toolchains we don't use before building. None of
-          # these are needed by this job (JDK via setup-java, Android SDK via
-          # setup-android, Rust via rustup, NDK reinstalled below).
-          echo "Before:"; df -h /
-          sudo rm -rf \
-            /usr/share/dotnet \
-            /usr/local/.ghcup \
-            /opt/ghc \
-            /opt/hostedtoolcache/CodeQL \
-            /usr/local/lib/android/sdk/ndk \
-            /usr/local/share/powershell \
-            /usr/share/swift \
-            /opt/microsoft 2>/dev/null || true
-          sudo docker image prune --all --force 2>/dev/null || true
-          echo "After:"; df -h /
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
+          JAVA_HOME_RESOLVED=$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")
+          JAVA_VERSION_OUTPUT=$("$JAVA_HOME_RESOLVED/bin/java" -version 2>&1)
+          printf '%s\n' "$JAVA_VERSION_OUTPUT"
+          printf '%s\n' "$JAVA_VERSION_OUTPUT" | grep -Eq 'version "17([.]|\")'
+          echo "JAVA_HOME=$JAVA_HOME_RESOLVED" >> "$GITHUB_ENV"
+          echo "$JAVA_HOME_RESOLVED/bin" >> "$GITHUB_PATH"
 
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
@@ -85,25 +98,30 @@ jobs:
         with:
           targets: x86_64-linux-android
 
-      - name: Restore cargo cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: kotlin-sdk-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            kotlin-sdk-cargo-
-
-      - name: Install cargo-ndk
-        run: cargo install cargo-ndk --locked
-
-      - name: Install protoc v32.0 (repo-standard; apt's 3.21 breaks tenderdash-proto)
+      # Pinned: this runner is persistent, so an unpinned `cargo install`
+      # leaves whatever version happened to be current on the day it first ran,
+      # and every later job silently builds with it. Assert after installing so
+      # a drifted host fails here instead of somewhere in the NDK build.
+      - name: Ensure cargo-ndk v4.1.2 is installed
+        run: |
+          set -euo pipefail
+          if ! cargo ndk --version 2>/dev/null | grep -qx 'cargo-ndk 4.1.2'; then
+            cargo install cargo-ndk --version 4.1.2 --locked --force
+          fi
+          cargo ndk --version
+          cargo ndk --version | grep -qx 'cargo-ndk 4.1.2'
+
+      - name: Ensure protoc v32.0 is installed (repo-standard; apt's 3.21 breaks tenderdash-proto)
         run: |
-          curl -fsSL -o /tmp/protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v32.0/protoc-32.0-linux-x86_64.zip
-          sudo unzip -o /tmp/protoc.zip -d /usr/local 'bin/protoc' 'include/*'
+          set -euo pipefail
+          if ! protoc --version 2>/dev/null | grep -qx 'libprotoc 32.0'; then
+            curl -fsSL -o /tmp/protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v32.0/protoc-32.0-linux-x86_64.zip
+            sudo unzip -o /tmp/protoc.zip -d /usr/local 'bin/protoc' 'include/*'
+          fi
           protoc --version
+          # A stale protoc earlier on PATH would shadow the one just unpacked
+          # into /usr/local; catch that here rather than in a codegen failure.
+          protoc --version | grep -qx 'libprotoc 32.0'
 
       - name: Build native library (x86_64, dev profile)
         working-directory: packages/kotlin-sdk
@@ -126,12 +144,12 @@ jobs:
         working-directory: packages/kotlin-sdk
         run: ./gradlew :sdk:compileDebugAndroidTestKotlin --stacktrace
 
-      - name: Enable KVM for emulator
+      - name: Verify KVM access
         run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
-            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
+          test -c /dev/kvm
+          test -r /dev/kvm
+          test -w /dev/kvm
+          ls -l /dev/kvm
 
       - name: Run instrumented FFI smoke test (API 35 emulator)
         uses: reactivecircus/android-emulator-runner@v2

.github/workflows/release-swift-sdk.yml

@@ -127,6 +127,10 @@ jobs:
         uses: arduino/setup-protoc@v3
         with:
           version: '32.x'
+          # Without a token the action resolves the protoc release
+          # unauthenticated, and the shared macOS-runner egress IP burns
+          # through the 60 req/h anonymous limit.
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build DashSDKFFI.xcframework and install into Swift package
         run: |

.github/workflows/tests-rs-nightly-long-running.yml

@@ -21,7 +21,16 @@ jobs:
       fail-fast: false
       matrix:
         package:
-          [dash-sdk, rs-dapi-client, rs-dapi, dapi-grpc, dpp, drive-abci, drive-proof-verifier]
+          [
+            dash-sdk,
+            rs-dapi-client,
+            rs-dapi,
+            dapi-grpc,
+            dpp,
+            drive-abci,
+            drive-proof-verifier,
+            dash-platform-queries,
+          ]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4

.github/workflows/tests-rs-workspace.yml

@@ -193,20 +193,29 @@ jobs:
           cargo install cargo-machete 2>/dev/null || true
           cargo machete
 
-      # The transport-free cut is how embedders with their own networking
+      # The transport-free cuts are how embedders with their own networking
       # (Dash Core's platform GUI, explorers) consume verification: feature
-      # unification hides transport regressions in whole-workspace builds, so
-      # check the standalone graphs and assert the networking stack stays out
-      # of the proof-verification tree (native) and out of wasm builds.
-      - name: Check transport-free feature cut
+      # unification hides regressions in whole-workspace builds, so check the
+      # standalone graphs and assert the networking stack stays out of the
+      # proof-verification tree (native) and out of wasm builds.
+      - name: Check transport-free feature cuts
         run: |
           cargo check -p dapi-grpc --no-default-features --features core,platform,client --locked
           cargo check -p drive-proof-verifier --locked
-          for banned in hyper rustls tower; do
-            if cargo tree -p drive-proof-verifier -e normal -i "$banned" 2>/dev/null | grep -q .; then
-              echo "::error::$banned leaked into drive-proof-verifier's dependency tree"
-              exit 1
-            fi
+          cargo check -p dash-platform-queries --locked
+          # Native graphs: assert the networking transport stack stays out.
+          # `tonic` itself is present (dapi-grpc's generated client types) but
+          # without its transport feature — which is exactly what the absence
+          # of hyper/rustls/tower proves. tokio is deliberately NOT asserted
+          # absent: dash-context-provider depends on dash-async, which uses it
+          # on native targets, and that edge predates the queries-crate split.
+          for native_package in drive-proof-verifier dash-platform-queries; do
+            for banned in hyper rustls tower; do
+              if cargo tree -p "$native_package" -e normal -i "$banned" 2>/dev/null | grep -q .; then
+                echo "::error::$banned leaked into $native_package's dependency tree"
+                exit 1
+              fi
+            done
           done
           for banned in hyper rustls tower mio; do
             for wasm_package in dash-sdk wasm-sdk; do