fix(swift-sdk): act on swept transactions in the SwiftData store - #4589

…ouched

`cargo fmt --check --all` is a CI gate and the collapsed
`Mnemonic::from_phrase` calls left two of them wrapped.

Review nits, all documentation.

`parse_mnemonic_any_language`'s doc still said `key_wallet::Mnemonic`
"only exposes language-tagged constructors" and that callers "must walk
the language list themselves" — precisely what rust-dashcore#981
removed, and it contradicted the inline comment three lines below. The
wrapper is kept: 20 call sites narrow upstream's error to the
`&'static str` they report, and that narrowing is now what the doc says
it does.

The sweep gate's recovery note read as if a capable backend might appear
mid-session. It cannot: the persister does not change under a running
adapter, so a host without the slot stays frozen until it ships one and
relaunches. Freezing is the point.

`last_processed_height` is now documented as deliberately NOT stripped
beside `synced_height`, matching the #4069 guard: `synced_height` is the
durable "scanned AND persisted" claim that must not outrun an unapplied
removal, while `last_processed_height` is the adapter's own progress
marker whose retention makes nothing safer.

And the asset-lock test's `DASHPAY_PAYMENTS` attestation no longer
describes an overlay this PR writes — nothing here stages
`dashpay_payments_overlay`; the bit is declared so the fixture still
describes a fully capable backend once #4442 lands.

Not taken: de-indenting the vestigial block in `commit_wallet`. It spans
152 lines, so removing it would bury the reviewable diff under a
whitespace-only change and force another rebase of the four PRs stacked
above this one.

…reason

CI lints these crates with `-D warnings`, so clippy's seven-argument
threshold is an error, and the #4370 merge gave `commit_wallet` an
eighth: the `settled` set the panic arm in `run_wallet_event_adapter`
reads back to decide which wallets have an unknown outcome. Every
parameter is a distinct piece of drain state this function reads and
writes, and the borrow split is what keeps them separately mutable —
bundling them would rename the same eight.

The SwiftData mirror of the storage contract, complicated by two things
SQLite does not have: rows shared across wallets, and a round that now
spans two callbacks.

Shared rows are why a sweep marks rather than deletes. A transaction row
can belong to several wallets, so the first wallet's callback cannot
remove it — it sets `isGloballySwept`, which excludes the row and its
outputs from every restore and enumeration path, and the physical delete
is left to housekeeping once every wallet's scoped cleanup has landed. A
tombstone must likewise outlive its loser: detach it and the consumed
coin reads unspent again.

Held inputs become pending-input tombstones carrying the winner and,
when it was mined, its height; a chained sweep repoints an earlier
tombstone at the new winner rather than stacking a second hold. The
release pass is outpoint-keyed, the drain gives tombstones precedence
over ordinary observations, and `isSpent` stays monotonic against them:
a hold the sweep proved consumed is never downgraded by a later record —
not even the winner's own, which can arrive IS-locked, a context below
in-block.

`autosaveEnabled` goes off on the round context. Sweeps travel in their
own callback, so the round spans two calls, and an autosave landing
between them would make the watermark and the additive rows durable
while the removal is still unstaged — with `rollback()` unable to take
back a save that already happened. The handler attests
`ATOMIC_CHANGESETS`, and Rust now relies on that to trust the split
transport, so the guarantee has to be real. The handler declares
`CORE_SWEEP_REMOVAL` and `DASHPAY_PAYMENTS`; before this commit it
published the legacy `struct_size`, the negotiated slot read `None`, and
Rust fail-closed.

The four models that gain a column — `PersistentTransaction`,
`PersistentTxo`, `PersistentPendingInput`, `PersistentWallet` — were
still referenced live by `DashSchemaV1/V2/V3`. Adding a property to a
live model mutates those released versions' checksums in place, so a
store written by a shipped binary would match no registered schema and
fail to open with Cocoa 134504 instead of migrating. That is exactly the
defect `DashSchemaFrozenModels.swift` was introduced to prevent, and its
instruction is to freeze the model you change.

Freezing those four alone is not possible: a frozen model declares its
relationships against frozen counterparts (an `inverse:` key path is
typed on the destination model), and following relationships in both
directions closes over 24 of the 35 models — one type per entity name is
all a schema can hold, so the component travels together. All 24 are
frozen here at their V3 shape, shared by V1, V2 and V3, none of which
changed any of them. The eleven models outside the component are still
live-referenced and still carry the latent defect, unchanged by this.

`DashSchemaV4` then registers the live models with a lightweight V3→V4
stage: every new column is additive with a default or optional, so
existing rows migrate as not-swept, unsuperseded, ordinary unstamped
claims, and a wallet with no chainlock boundary yet.

`reconcileSpendObservation` stays the single spend verdict, extended
with one sweep term — a stamped hold outranks any observation — and its
oldest-first pending-row reconciliation stays, under a
tombstone-precedence branch. One correction the merge forced: the "never
displace confirmed evidence" rule refused the link when `isSpent` was
true with NO spender linked, which is precisely the sweep-hold shape, so
the winner's own record could never supply the attribution the hold
lacked. With no link there is nothing to displace, so it is adopted.

One gap neither PR covered is closed here:
`buildUnresolvedAssetLockTxRecordBuffer` now skips globally-swept rows,
so the double-spend screen can never be handed a swept loser as the
settled spender of a lock's input.

Also carries the `ChangesetRoundIndex` per-round fetch cache — the
reviewed-but-untested fix for the quadratic SwiftData fetch that put
~99% of CPU on the serial queue. Sweep paths deliberately opt out of it,
since they key on mutable columns the index cannot answer stale.

Tests: `SweptTransactionPersistTests` (38) — shared losers, detached
tombstones with a missing winner row, chained tombstones, cross-round
reinstatement, released-pending deadlock, co-swept twins, the
throwing-lookup round failure, and the winner's late record against a
stamped hold. `DashModelMigrationTests` gains the V3→V4 stage and reads
V1/V2 rows through the frozen types. Full suite: 437 tests, the only
failures being two `KeychainSignerAdditionalSigningKeysTests` cases that
fail identically on an unmodified checkout (the test host cannot write
to the keychain).

Brings in the squash-merged producer (#4560) this branch was stacked on,
plus #4584. Conflicts in changeset.rs and core_bridge.rs were this
branch's copies of the producer commits against their squash; this
branch never touched either file, so the base version was taken and the
tree outside packages/swift-sdk is identical to v4.2-dev.

…406-5-swift