fix(platform-wallet): act on swept transactions at the persistence seam

Cargo.toml

@@ -52,14 +52,14 @@ members = [
 ]
 
 [workspace.dependencies]
-dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
-dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "173ffac0fdc0c73dda0626cf385bbcfcf2437aeb" }
+dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
+dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "51eafd8c82371ba88305ceb35b4c1604062bc6c8" }
 
 tokio-metrics = "0.5"
 

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/ffi/NativePersistenceBridge.kt

@@ -294,6 +294,35 @@ abstract class NativePersistenceBridge {
     /** Close the current account bucket. Descriptor `([BI)I`. */
     open fun onWalletChangesetAccountEnd(walletId: ByteArray, accountIndex: Int): Int = 0
 
+    /**
+     * Transactions the wallet removed this round, as raw 32-byte txids,
+     * each paired by index with the transaction that settled its inputs,
+     * plus the outpoints the removals actually freed. Fired once after the
+     * per-account decomposition, and only when the round swept something.
+     * Descriptor `([B[[B[[B[[B)I`.
+     *
+     * Each removed transaction was a recorded spend that its winner beat to
+     * one of its inputs, so it can never confirm. Every other slot on this
+     * bus is additive; this is the only removal, and an implementation that
+     * ignores it keeps dead rows that are handed back at the next load and
+     * re-create a balance the wallet has already corrected.
+     *
+     * [releasedOutpoints] holds 36-byte keys (raw txid followed by a
+     * little-endian vout) and is wallet-scoped, not attributed per removal:
+     * an implementation holds every input of every row it deletes, so it
+     * only needs to know which of them came free. Everything else it holds
+     * was taken by the transaction that won those inputs and must stay
+     * spent. The set cannot be inferred from [supersededBy] — that
+     * transaction may pay entirely to outside addresses and never be
+     * reported here at all.
+     */
+    open fun onWalletChangesetTransactionsSwept(
+        walletId: ByteArray,
+        txids: Array<ByteArray>,
+        supersededBy: Array<ByteArray>,
+        releasedOutpoints: Array<ByteArray>,
+    ): Int = 0
+
     // ── Identities ────────────────────────────────────────────────────
 
     /**

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/persistence/PlatformWalletPersistenceHandler.kt

@@ -921,7 +921,15 @@ class PlatformWalletPersistenceHandler(
                 isConfirmed = isConfirmed,
                 isInstantLocked = isInstantLocked,
                 isLocked = isLocked,
-                isSpent = existing?.isSpent ?: false,
+                // The wallet is handing this outpoint over as a UTXO, so it
+                // holds it unspent — authoritative, and the only thing that
+                // lifts a mark with no spender behind it. The sweep path
+                // parks the inputs it cannot resolve in exactly that state
+                // (`holdSpentWithoutSpender`); a rescan re-delivering the
+                // coin lands here and frees it. A row whose spend is still
+                // on record keeps its flag — the pending drain below owns
+                // that transition.
+                isSpent = existing?.isSpent == true && existing.spendingTxid != null,
                 walletId = walletId,
                 txid = txid,
                 spendingTxid = existing?.spendingTxid,
@@ -985,6 +993,67 @@ class PlatformWalletPersistenceHandler(
 
     override fun onWalletChangesetAccountEnd(walletId: ByteArray, accountIndex: Int): Int = 0
 
+    /**
+     * Delete the mirror of transactions the wallet swept.
+     *
+     * Each was a recorded spend that its winner beat to one of its inputs,
+     * so it can never confirm and Rust has already dropped it. Keeping the
+     * rows would hand them back at the next load and re-create a balance the
+     * wallet has already corrected.
+     *
+     * The TXOs the transaction created go with it (`txos.txid` cascades).
+     * The ones it *spent* split in two, and [releasedOutpoints] is the
+     * authority on which is which: an outpoint named there came free, and
+     * every other input the loser claimed was taken by the transaction that
+     * beat it and is gone for good.
+     *
+     * That split cannot be worked out here. A swept loser is always
+     * unconfirmed upstream, and this store flips `isSpent` only for a
+     * spender that reached a block, so the loser holds its inputs by link
+     * alone at `isSpent = 0`; deleting the row nils the link and every one
+     * of those coins would return to the restore set, the winner's
+     * included. Nor can the winner's own row settle it — it may pay only to
+     * outside addresses and never be recorded here, and even a relevant one
+     * is not guaranteed to land in the same round as the sweep.
+     *
+     * Both updates run before the delete: the foreign key nulls
+     * `spendingTxid` on delete, and after that nothing finds those rows.
+     *
+     * Transaction rows are keyed by txid alone, shared across wallets by
+     * design, and a sweep is a statement about the transaction rather than
+     * about one wallet's view of it — so the row goes without narrowing to
+     * the emitting wallet.
+     */
+    override fun onWalletChangesetTransactionsSwept(
+        walletId: ByteArray,
+        txids: Array<ByteArray>,
+        supersededBy: Array<ByteArray>,
+        releasedOutpoints: Array<ByteArray>,
+    ): Int = guarded {
+        stage(walletId) { db ->
+            if (db.walletDao().getByWalletId(walletId) == null) return@stage
+            // Hold every input first, then free the ones upstream named: the
+            // released set is wallet-scoped across the round's removals, so
+            // it is applied once rather than per transaction.
+            //
+            // The order is load-bearing, not cosmetic. Holding detaches the
+            // rows this round's removals still claim, and the release only
+            // touches detached rows — so a coin some later transaction in the
+            // same round already re-claimed keeps that claim instead of being
+            // freed out from under it.
+            for (txid in txids) {
+                db.txoDao().holdSpentWithoutSpender(txid)
+            }
+            for (outpoint in releasedOutpoints) {
+                db.txoDao().releaseByOutpoint(outpoint)
+            }
+            for (txid in txids) {
+                db.transactionDao().deleteByTxid(txid)
+            }
+        }
+        0
+    }
+
     // ── Identities ────────────────────────────────────────────────────
 
     override fun onPersistIdentityUpsert(

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/persistence/dao/TxoDao.kt

@@ -43,6 +43,47 @@ interface TxoDao {
     @Query("SELECT * FROM txos WHERE spendingTxid = :spendingTxid AND isSpent = 0")
     suspend fun getUnspentBySpendingTxid(spendingTxid: ByteArray): List<TxoEntity>
 
+    /**
+     * Hold every coin [spendingTxid] claimed out of the restore set, without
+     * naming a spender for them.
+     *
+     * Used when [spendingTxid] was swept: it can never confirm, so its claim
+     * is not a spend, but most of the coins it named really were taken — by
+     * the transaction that beat it. A swept transaction is always
+     * unconfirmed, so its inputs sit at `isSpent = 0`, and deleting it would
+     * otherwise return all of them, the consumed one included.
+     *
+     * Run this *before* deleting the transaction, while the link that
+     * identifies those rows is still there — the foreign key nulls
+     * `spendingTxid` on delete, and afterwards nothing finds them. Then
+     * clear the genuinely free ones with [releaseByOutpoint].
+     */
+    @Query("UPDATE txos SET isSpent = 1, spendingTxid = NULL, spendingInputIndex = NULL WHERE spendingTxid = :spendingTxid")
+    suspend fun holdSpentWithoutSpender(spendingTxid: ByteArray)
+
+    /**
+     * Mark one outpoint unspent again — a coin a sweep released, meaning no
+     * surviving transaction spent it *at the time the sweep was computed*.
+     *
+     * Keyed by outpoint rather than by spender because that is how upstream
+     * reports it: the transaction that took the other inputs may never be
+     * recorded here at all, so the released set is the only authority on
+     * which coins came free.
+     *
+     * `spendingTxid IS NULL` is what keeps that from overreaching. A round
+     * can carry both a release and a later transaction that legitimately
+     * spends the freed coin — merging folds several events together, and
+     * every record is written before sweeps are processed — so by the time
+     * this runs the coin may already be claimed again. Only rows
+     * [holdSpentWithoutSpender] just detached qualify; anything a live
+     * transaction still claims keeps that claim.
+     */
+    @Query(
+        "UPDATE txos SET isSpent = 0, spendingInputIndex = NULL " +
+            "WHERE outpoint = :outpoint AND spendingTxid IS NULL",
+    )
+    suspend fun releaseByOutpoint(outpoint: ByteArray)
+
     @Upsert
     suspend fun upsert(txo: TxoEntity)