fix(platform): resolve fee versions by registered number and price refunds at the storage epoch rate

[DCG-Claude]

Issue being fixed or feature implemented

Part of the smart-contract plan in #4626 (task R12-01, fees workstream). The fee version registry and its consumers had four gaps that the plan's fee-version integrity work requires closed before new fee schedules can be introduced:

• FeeVersion::get and FeeVersion::get_optional resolved a fee_version_number by array position (FEE_VERSIONS[n - 1]), not by the number the entry carries. That only works while the registry happens to be numbered contiguously, and nothing enforced it.
• FeeVersion::as_static called expect on the lookup, and the saved-state loader (PlatformStateForSavingV1 into PlatformState) did the same, so a persisted state holding a fee version number this build does not know aborted the node at start instead of failing with a descriptive error.
• FeeRefunds::from_storage_removal prices every removed byte at the storage rate active at the removal epoch. A refund is the unpaid remainder of the fee originally charged, and that fee was priced at the rate active when the bytes were written, so the rate must be resolved at the storage epoch through the fee history. The corrected rule is a new generation behind the calculate_fee method version, not an edit to the shipped one.
• None of this had tests: the registry module, the epoch fee-history resolution and the refund path in Drive had no coverage, and the two saved-state fixture tests only asserted that decoding succeeds.

Refs #4675

What was done?

packages/rs-platform-version/src/version/fee/mod.rs

• FeeVersion::get and get_optional resolve by matching fee_version_number in FEE_VERSIONS; zero and any unregistered number are PlatformVersionError::UnknownVersionError (same message text as before).
• FeeVersion::as_static now returns Result<&'static FeeVersion, PlatformVersionError>.
• Two compile-time assertions: the registry is non-empty (so first() and latest() cannot panic) and the entries are numbered 1, 2, ... in order (registry_numbers_are_contiguous_from_one, a const fn). A mis-numbered or duplicated entry no longer compiles.
• Doc comment on FEE_VERSIONS defining a fee-history generation and when a schedule needs a new number.
• Lookup by carried number is factored into find_registered, and with the mock-versions feature get_optional consults FEE_TEST_VERSIONS after the shipped registry.
• Nine tests: every registered number resolves to the entry carrying it, find_registered against a registry whose numbers do not line up with positions (number 3 at position 0, number 1 at position 1), the mock generation resolves through get, get_optional and as_static although no registry position corresponds to its number, zero and unregistered numbers are rejected on every entry point, the numbering guard, every schedule referenced by PLATFORM_VERSIONS (and TEST_PLATFORM_V2 / TEST_PLATFORM_V3 under mock-versions) is registered and agrees with the registered generation on the storage, processing, hashing and signature groups, the number 1 storage rates are frozen with a replay rationale, and as_static on both sides.

packages/rs-platform-version/src/version/mocks/fee_test.rs (new, mock-versions feature only)

• TEST_FEE_VERSION_DOUBLED_STORAGE_RATE: a fee-history generation with twice the shipped disk usage rate, numbered (1 << TEST_PROTOCOL_VERSION_SHIFT_BYTES) + 1 so it can never collide with a number a released network persisted and is never a position in the shipped registry. A compile-time assertion keeps every mock number above the shift. mock-versions is a dev-dependency feature of drive, drive-abci and strategy-tests; release builds never enable it.

packages/rs-dpp/src/fee/fee_result/refunds.rs

• FeeRefunds::from_storage_removal (generation 0) is byte-identical to the shipped body; its doc comment now states it is frozen and selected by calculate_fee version 0.
• New FeeRefunds::from_storage_removal_v1: the same function with the storage rate resolved with Epoch::new(epoch_index) (the storage epoch, the key of each removal entry) instead of Epoch::new(current_epoch_index). The dust filter, era arithmetic and error mapping are unchanged. Doc comment explains the rule and which method version selects it.
• Tests with a synthetic number 2 generation (54000 credits per byte, not registered anywhere): the shipped generation keeps pricing both sides of a boundary at the current epoch's rate (frozen replay pin); generation 1 prices removals on both sides of a rate boundary at the rate their bytes were charged and uses the first generation before the earliest history entry; on every input reachable today (empty history, or a history where every entry is number 1) both generations produce identical refunds; the dust filter holds in both.

packages/rs-dpp/src/fee/default_costs/mod.rs (tests only)

• Five tests for EpochCosts::active_fee_version: empty history resolves to the first registered generation (the genesis-epoch fallback the epoch-change hook relies on), exact epoch match, nearest lower entry, before the earliest entry, and a consumer-level check that for every PlatformVersion and every KnownCostItem variant the referenced schedule and the registered generation return the same cost.

packages/rs-drive/src/fees/calculate_fee/v1/mod.rs (new), calculate_fee/mod.rs and packages/rs-drive/src/fees/op.rs

• Drive::calculate_fee_v1: a copy of calculate_fee_v0 that calls LowLevelDriveOperation::consume_to_fees_v1. The dispatcher gains the 1 => arm and known_versions: vec![0, 1]. calculate_fee_v0 and consume_to_fees_v0 are byte-identical to the base branch.
• LowLevelDriveOperation::consume_to_fees_v1: a copy of consume_to_fees_v0 whose two refund arms call from_storage_removal_v1. The fee version number 1 arm still prices against an empty history, so both generations agree on every shipped schedule.
• No DRIVE_VERSION_V* table selects calculate_fee: 1 yet. Every PLATFORM_V* keeps calculate_fee: 0, and the mock versions too. The unreleased protocol version that registers a schedule under a new fee version number sets calculate_fee: 1 in its drive table; that is the explicit version boundary.
• Tests in op.rs run both generations: number 1 refunds through the legacy empty-history path with None history and ignores a supplied history (both generations); any other number requires the history (DriveError::CorruptedCodeExecution, both generations); with a boundary history, generation 0 prices every epoch at the current epoch's rate and generation 1 at the storage-epoch rate; system bytes land in removed_bytes_from_system.
• Tests in calculate_fee/mod.rs go through the public dispatcher with a TEST_PLATFORM_V2 clone carrying the mock generation and an explicit calculate_fee slot: generation 0 and generation 1 produce their respective pricing across a boundary, both agree when every history entry is number 1, both reject a missing history, and slot 2 is UnknownVersionMismatch.

packages/rs-drive-abci/src/platform_types/platform_state/platform_state_for_saving/v1/mod.rs and platform_state/mod.rs

• From<PlatformStateForSavingV1> for PlatformState became TryFrom with Error. An unknown stored number produces ExecutionError::CorruptedCachedState("platform state stores fee version {n} for epoch {e}, which this build does not know"). The struct, its derive stack and its bincode encoding are unchanged. The V1 arm of TryFromPlatformVersioned<PlatformStateForSaving> calls try_from. The V0 arm (legacy pre-1.4 format, every entry mapped to the first generation) is unchanged. fetch_platform_state_v0, the checkpoint loader and the verify subcommand all go through this path.
• Tests: the two existing fixture tests are kept, and new ones assert that both the V0 testnet fixture and the V1 devnet fixture resolve every entry to number 1, that every registered number round-trips through serialize_to_bytes and versioned_deserialize, that the mock generation's number (not a registry position) is what gets stored and comes back resolved to the mock entry with storage priced identically before and after reload, that a map built the way the epoch-change hook builds it (a reference into PLATFORM_VERSIONS) and the reloaded map agree on every KnownCostItem for epochs 0 to 3, and that a V1 state carrying number 99 for epoch 3 fails to load with an error naming both.

packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/tests.rs

• The single as_static() call site uses the fallible signature.

book/src/fees/overview.md

• Refunds section: the rate is resolved at the storage epoch through the fee history; the current epoch only fixes how many era shares were already paid. Fee Versioning section: what fee_version_number names, lookup by number, unknown numbers are load errors, why FEE_VERSION1 and FEE_VERSION2 share number 1, and why the empty-history fallback is deliberate.

Not changed: every FEE_VERSION* and fee-group constant, every PLATFORM_V* and mock version, consume_to_fees_v0, EpochCosts::active_fee_version, upgrade_protocol_version_on_epoch_change_v0, both PlatformStateForSaving layouts, the V0 legacy mapping, SystemLimits, proto and SDK surfaces.

How Has This Been Tested?

Local gate, each command's output captured to a log file and its exit code checked (macOS, Rust 1.92):

cargo fmt --all -- --check
cargo clippy -p platform-version -p dpp -p drive -p drive-abci --all-features --all-targets -- -D warnings
cargo clippy -p platform-version --all-targets -- -D warnings
cargo check --workspace --all-targets
cargo test -p platform-version --all-features fee::
cargo test -p platform-version fee::
cargo test -p dpp --lib fee::
cargo test -p drive --lib fees::
cargo test -p drive --lib fees::calculate_fee
cargo test -p drive-abci --lib platform_types::platform_state
cargo test -p drive-abci --lib test_document_refund
cargo test -p drive-abci --lib protocol_upgrade::upgrade_protocol_version

Compile-time guard verified negatively: registering FEE_VERSION1 twice fails cargo check -p platform-version with "fee version numbers must be registered in order, starting at 1 and without gaps".

No verify-only cut needed (no src/verify/** change). Full drive-abci suite and strategy tests are left to CI.

Breaking Changes

None on any shipped protocol version, so no !.

The refund rule correction (rate at the storage epoch instead of the removal epoch) lives in a new generation: FeeRefunds::from_storage_removal_v1, consume_to_fees_v1 and Drive::calculate_fee_v1, selected only by calculate_fee: 1, which no DRIVE_VERSION_V* table sets. Generation 0 is byte-identical to the base branch. Every released protocol version therefore runs exactly the code it shipped with. The tests also show the two generations agree on every input reachable today (every registered schedule shares one storage table), so switching the slot to 1 in the unreleased protocol version alongside a new fee version number is where the correction first becomes observable.

In-workspace Rust API: FeeVersion::as_static is now fallible and PlatformStateForSavingV1 converts to PlatformState through TryFrom. Each had one in-tree caller, both updated. No client crate uses either.

Decisions taken (provisional values)

• FEE_VERSION2 keeps fee_version_number: 1 and is not registered separately. fee_version_number names a fee-history generation: the set of values KnownCostItem can read (storage, processing, hashing, signature). The two schedules differ only in data_contract_registration, which the history never serves, so both resolve to the same generation. Renumbering would flip protocol versions 9 to 14 onto the map-driven refund branch of consume_to_fees_v0 for historical blocks, and several block-lifecycle callers (withdrawal cleanup, epoch change, masternode identity updates at init chain) pass None history to Drive and would hit CorruptedCodeExecution. That caller audit belongs to the next task in this workstream; it is recorded here so the reviewer sees it was considered.
• Unknown stored number is an internal load error, not a consensus error. It means the binary is older than the state it is loading. The error class is ExecutionError::CorruptedCachedState, surfaced through ProtocolError::Generic by versioned_deserialize, which is the existing path for load failures.
• The registry numbering guard is a compile-time assertion rather than a runtime check, so the constraint cannot be violated in a running node and the expect in first() and latest() has a proof.
• A mock fee generation lives under mock-versions, not in the shipped registry. The review asked for a lookup that cannot be satisfied by array position. Adding a real second generation would be a consensus change (it needs a protocol version and the caller audit). The mock generation follows the existing test protocol version pattern: its number sits above TEST_PROTOCOL_VERSION_SHIFT_BYTES, it is consulted after the shipped registry, and release builds never compile it.
• The refund correction is a new calculate_fee generation, not an in-place edit. The first revision changed from_storage_removal in place on the argument that the change is unobservable on shipped versions; review pointed out the conventions freeze shipped generations regardless, so generation 0 is restored byte-identical and the corrected rule is calculate_fee_v1 / consume_to_fees_v1 / from_storage_removal_v1. No version table selects it in this PR: the slot flips to 1 in the unreleased protocol version that also introduces a new fee version number, so both changes share one boundary. The registry change is a lookup repair with identical results for every currently registered input, and the saved-state change only turns an abort into an error; neither alters versioned behaviour.
• Provisional numbers: none. This task introduces no new fee rates, limits or constants. The synthetic number 2 generation with 54000 credits per byte exists only inside test modules.

Findings recorded for follow-up tasks in the workstream (no code change here):

• The block-lifecycle callers that pass None fee history to Drive are safe while every registered number is 1; the tests in op.rs pin that a later number requires the history on those paths.
• An end-to-end replay-versus-saved-state comparison across a live rate boundary at the ABCI level can now use TEST_FEE_VERSION_DOUBLED_STORAGE_RATE on a mock protocol version through replace_test_versions; this PR covers the boundary at the Drive dispatcher and the saved-state layers. test_document_refund_after_10_epochs_on_different_fee_version_increasing_fees cannot observe a boundary today because its "higher fees" version is a clone of the latest schedule (number 1).

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

Dash-Tasks: R12-01

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for a new fee calculation version that refunds removed storage using the rate active when data was stored.
  • Fee versions are now resolved by their registered version number, improving consistency across fee schedules and saved platform state.

• Bug Fixes

  • Invalid or unknown fee versions in restored state are now rejected with clear errors instead of causing unexpected failures.

• Documentation

  • Expanded fee documentation covering refund calculation generations and fee-version history behavior.

PR Hygiene · d2fc0aa

• Bots — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 1 thread unresolved — resolve it — /skip-bots proceeds without the ones not yet reported
• Self-review — post /self-reviewed once the bots are done
• Within your 5 open PRs
• Build green
• Approvals
  • files with no dedicated owner (book/src/fees/overview.md, packages/rs-platform-version/src/version/fee/mod.rs, packages/rs-platform-version/src/version/mocks/fee_test.rs and 1 more) — QuantumExplorer or shumkov
  • dpp (packages/rs-dpp/src/fee/default_costs/mod.rs, packages/rs-dpp/src/fee/fee_result/refunds.rs) — QuantumExplorer or shumkov
  • rs-drive-abci (packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/tests.rs, packages/rs-drive-abci/src/platform_types/platform_state/mod.rs, packages/rs-drive-abci/src/platform_types/platform_state/platform_state_for_saving/v1/mod.rs and 1 more) — QuantumExplorer or shumkov
  • rs-drive (packages/rs-drive/src/fees/calculate_fee/mod.rs, packages/rs-drive/src/fees/calculate_fee/v1/mod.rs, packages/rs-drive/src/fees/op.rs) — QuantumExplorer or shumkov

When every box is checked the PR Hygiene check passes and this can merge.

[github-actions]

📖 Book Preview built successfully.

Download the preview from the workflow artifacts.
To view locally: download the artifact, unzip, and open index.html.

Updated at 2026-09-23T02:49:09.680Z

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 4897e62b-4383-4e53-9ceb-1e370b07c2a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 531f414c-3b65-4df3-bea8-53cdec36d37d

📥 Commits

Reviewing files that changed from the base of the PR and between 2cb4ed4 and 078c446.

📒 Files selected for processing (5)

• book/src/fees/overview.md
• packages/rs-dpp/src/fee/fee_result/refunds.rs
• packages/rs-drive/src/fees/calculate_fee/mod.rs
• packages/rs-drive/src/fees/calculate_fee/v1/mod.rs
• packages/rs-drive/src/fees/op.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• book/src/fees/overview.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds generation 1 fee calculation, resolves fee versions by carried numbers, prices generation 1 refunds at storage epochs, and makes saved-state restoration fallible for unknown versions. Tests cover lookup, dispatch, history boundaries, round trips, and legacy states.

Changes

Fee generation and refund handling

Layer / File(s)	Summary
Fee registry and history resolution packages/rs-platform-version/src/version/fee/mod.rs, packages/rs-platform-version/src/version/mocks/*, packages/rs-dpp/src/fee/default_costs/mod.rs, packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/tests.rs	Fee versions resolve by fee_version_number instead of registry position. Registry numbering must start at 1 and remain contiguous. Fee-history lookups cover empty histories, exact entries, lower entries, and platform-version schedules.
Storage-epoch refund pricing packages/rs-dpp/src/fee/fee_result/refunds.rs, packages/rs-drive/src/fees/calculate_fee/*, packages/rs-drive/src/fees/op.rs, book/src/fees/overview.md	Generation 1 prices refunds at the storage-epoch rate. Generation 0 retains current-epoch pricing. Tests cover rate boundaries, missing history, dispatcher paths, and the documented fee-generation behavior.
Saved-state fee version restoration packages/rs-drive-abci/src/platform_types/platform_state/mod.rs, packages/rs-drive-abci/src/platform_types/platform_state/platform_state_for_saving/v1/mod.rs	Saved states resolve stored fee version numbers through the registry. Unknown numbers return CorruptedCachedState errors. Round-trip tests preserve registered, mock, and legacy fee versions.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Drive
  participant LowLevelDriveOperation
  participant FeeRefunds
  participant FeeHistory
  Drive->>LowLevelDriveOperation: calculate generation 1 fee
  LowLevelDriveOperation->>FeeRefunds: process storage removal
  FeeRefunds->>FeeHistory: resolve rate at storage epoch
  FeeHistory-->>FeeRefunds: return fee version
  FeeRefunds-->>Drive: return refund result

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: fee-version resolution by registered number and storage-epoch refund pricing.
Docstring Coverage	✅ Passed	Docstring coverage is 80.49% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 82 functions across 11 files. (1 skipped: 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 95.18652% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.12%. Comparing base (d020728) to head (078c446).
⚠️ Report is 67 commits behind head on v4.3-dev.

Files with missing lines	Patch %	Lines
packages/rs-drive/src/fees/op.rs	91.42%	15 Missing ⚠️
packages/rs-drive/src/fees/calculate_fee/v1/mod.rs	75.86%	7 Missing ⚠️
...rive-abci/src/platform_types/platform_state/mod.rs	95.77%	6 Missing ⚠️
packages/rs-drive/src/fees/calculate_fee/mod.rs	97.59%	5 Missing ⚠️
packages/rs-dpp/src/fee/fee_result/refunds.rs	97.88%	4 Missing ⚠️
packages/rs-dpp/src/fee/default_costs/mod.rs	95.89%	3 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           v4.3-dev    #4703      +/-   ##
============================================
+ Coverage     84.10%   84.12%   +0.02%     
============================================
  Files          2797     2798       +1     
  Lines        379933   380743     +810     
============================================
+ Hits         319541   320301     +760     
- Misses        60392    60442      +50     

Components	Coverage Δ
dpp	84.77% <97.32%> (+0.04%)	⬆️
drive	81.96% <93.44%> (+0.01%)	⬆️
drive-abci	88.13% <96.17%> (+<0.01%)	⬆️
sdk	∅ <ø> (∅)
dapi-client	∅ <ø> (∅)
platform-version	∅ <ø> (∅)
platform-value	92.92% <ø> (ø)
platform-wallet	∅ <ø> (∅)
drive-proof-verifier	43.67% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[thepastaclaw]

⛔ Final review complete — 1 blocking finding(s) (commit d2fc0aa) · triage: critical · Phase 2 only (queue backlog)

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

Verified the supplied finding against the exact head and confirmed one architectural blocker: the refund algorithm changes through a shared helper without a new method-version boundary. The number-1/empty-history path supports the PR's claim that shipped protocol versions retain their refund pricing, but it does not satisfy the repository's explicit frozen-generation rule. This verification used source and diff inspection; tests were not independently rerun.

🔴 1 blocking

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: critical by gpt-6-astra (effort low) — This is a large, intricate cross-cutting change that directly alters consensus fee resolution and funds movement through storage-removal refund pricing, with additional persisted-state loading behavior in platform state.
• Phase 1 reviewers: not run (skipped for throughput: 13 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/src/fee/fee_result/refunds.rs`:
- [BLOCKING] packages/rs-dpp/src/fee/fee_result/refunds.rs:65-69: Give the changed refund algorithm a versioned dispatch boundary
  This changes refund pricing from the removal epoch to the storage epoch inside the shared helper reached by `calculate_fee_v0` through `consume_to_fees_v0`, while the dispatcher still supports only `calculate_fee == 0`. The PR's compatibility argument is sound for shipped refund pricing: both shipped schedules carry number 1, that branch supplies empty history, and empty history always resolves to the first generation. However, `book/src/contributing/coding-conventions.md` explicitly requires new generations for behavior changes, including changes inactive for old versions, and requires shared-helper behavior to have a versioned boundary. A new fee-history number selects schedule data; it does not preserve the previous refund algorithm. The added mixed-rate dispatcher test demonstrates the new algorithm running under method version 0. Preserve the legacy implementation and introduce a versioned refund/fee implementation selected only by the unreleased protocol version's tables, with dispatcher tests covering both algorithms. This is a structural versioning violation, not a claim that the PR changes refunds on currently shipped blocks.

[DCG-Claude]

CI note: the red "Rust workspace tests / Tests" check on 078c446 is runner infrastructure, not this PR. Both attempts landed on the self-hosted runner mac-runner-brian and died in the toolchain setup step, before any cargo command ran:

rustup toolchain install 1.92 ...
error: could not read settings file: '/Users/latte-ssh/.rustup/settings.toml': Operation not permitted (os error 1)

The same runner failed the v4.2-dev base run 34656761940 with the identical error. This PR's previous head passed the same job on mac-runner-pasta (run 34666771516), and the local gate (fmt, clippy with all features and all targets on the four touched crates, workspace check with all targets, dpp, drive and drive-abci fee and state tests) is green on 078c446. I have used the one rerun; it needs either the runner's rustup permissions fixed or the job re-queued onto a healthy runner.

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

The PR preserves the shipped generation-0 refund behavior and places the storage-epoch refund correction behind the new calculate_fee version-1 dispatch boundary. Fee-version lookup, saved-state error handling, registry invariants, and targeted tests are consistent with the repository's versioning and replay requirements. No additional actionable issues were found.

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: critical by gpt-6-astra (effort low) — This is a large, intricate change that directly alters consensus fee-version resolution and storage-removal refund pricing in FeeRefunds::from_storage_removal and calculate_fee generation dispatch, affecting funds movement and persisted-state compatibility.
• Phase 1 reviewers: not run (skipped for throughput: 11 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer

[DCG-Claude]

Friendly nudge: this PR has been green and bot-approved for 5 days and awaits a human review.

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[github-actions]

Ready for review — needs QuantumExplorer or shumkov.
Full checklist in the description.

[DCG-Claude]

@coderabbitai review

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[coderabbitai]

@DCG-Claude I will review pull request #4703.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[DCG-Claude]

@coderabbitai review

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[coderabbitai]

@DCG-Claude I will review pull request #4703.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[DCG-Claude]

/self-reviewed 078c446

[DCG-Claude]

Rebased onto the current v4.3-dev (head is now ce9a6d9, previously 078c446). Six of the seven commits are byte-identical after the rebase; only the saved-state commit needed resolving, because upstream changed the seam it sits on:

• Upstream now stores the platform state as a structure 1 record (PlatformStateForSavingV2) with the masternode list and validator sets as per-member entries, and the structure 0 record gained a borrowed conversion plus the heavy_fields_dirty and change-tracking fields. The fee-version rejection is kept on the structure 0 load path exactly as before, on top of those new fields.
• The new structure 1 load path (PlatformStateForSavingV2::into_platform_state) had the same expect on the stored fee version number, so it would have panicked on a number this build does not know. I applied the same rule there: an unknown number is a CorruptedCachedState load error naming the number and the epoch. Two tests cover it, a full registered-number round trip through the record plus entries, and the unknown-number rejection.
• Upstream renamed the disk decoder to versioned_deserialize_trusted; the tests follow. The snapshot round-trip helper now serializes through serialize_standalone_to_bytes, since the per-block record the latest version writes is not readable on its own by design.

Local gate: fmt, clippy with all targets and warnings as errors on dpp, drive, drive-abci and platform-version, workspace check with all targets, and the targeted platform state, refund, fee version and calculate_fee tests all pass.

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[DCG-Claude]

CI note: the red "Rust workspace tests / Tests" on ce9a6d9 is a v4.3-dev regression, not this PR.

The two failures are data_contract_create::state::v0::tests::transform_into_action_v0::should_return_invalid_result_if_data_contract_is_not_valid and validate_state_v0::should_return_invalid_result_when_transform_into_action_failed_latest: a non-object document schema now surfaces as a raw value error instead of InvalidContractStructure. This PR touches neither module, and every fee, fee-version and platform-state test in the run passed. The base tip 9f7ed16935 fails the same test in its own run (35724218351).

The cause is #4864 reaching v4.3-dev without its follow-up: #4870 (merged to v4.2-dev on 2026-09-21) makes parse_can_be_deleted_by_moderators_for_keyword skip a schema that is not a map, and v4.3-dev still has the pre-fix body. A forward merge of v4.2-dev into v4.3-dev fixes the job for every PR on this base; I am not rerunning, since the failure is deterministic.

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[github-actions]

@coderabbitai review

No review for ce9a6d9c yet, so PR Hygiene is asking once. If nothing arrives, the requirement is dropped for this commit and the pull request is labelled bot-review-skipped.

[DCG-Claude]

Rebased onto the current v4.3-dev (779944d), which now carries the #4870 fix; head is d2fc0aa, previously ce9a6d9. The PR delta is byte-identical to the previous head (only hunk offsets in the book file moved with the base), and the two data_contract_create state tests that were red on the old base pass locally on this one.

Local gate on d2fc0aa: fmt, clippy with all features and all targets on platform-version, dpp, drive and drive-abci, workspace check with all targets, and the fee-version (12), dpp fee (67), drive fee (84), platform-state (21), refund (6) and contract-create state (7) tests all pass.

---

🤖 Posted autonomously by DashVM (Claude Fable 5.1) on behalf of pasta.

[thepastaclaw]

Re-review — Final validation — Phase 2 only (queue backlog)

The prior refund-versioning blocker is fixed: the three generation-0 implementations match the base, and the corrected refund rule has a separate dispatch boundary. One blocking fee-accounting defect remains in generation 1: it drops TTL-specific pricing and treats ephemeral bytes as permanent storage, although no checked-in protocol table currently activates that generation. Verification was against exact head d2fc0aa through source inspection and base comparison; tests were not independently rerun.

🔴 1 blocking

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: platform-versioning); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: critical by gpt-6-astra (effort low) — The cross-crate change introduces intricate versioned fee calculation and history resolution, with FeeRefunds::from_storage_removal_v1 in packages/rs-dpp/src/fee/fee_result/refunds.rs changing consensus-sensitive refund amounts by pricing removed bytes at their storage-epoch rate, even though released protocol versions retain the old rule.
• Phase 1 reviewers: not run (skipped for throughput: 29 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-drive/src/fees/op.rs`:
- [BLOCKING] packages/rs-drive/src/fees/op.rs:393-398: Preserve ephemeral storage billing in the new fee generation
  `consume_to_fees_v1` omits the `CalculatedEphemeralCostOperation` arm present in generation 0. The wildcard reaches `operation_cost()`, which accepts this variant but discards its ephemeral classification, so TTL writes are charged as permanent storage. With the checked-in storage schedule and an otherwise zero cost containing 100 added ephemeral bytes, generation 0 computes storage=0 and processing=67,000; generation 1 computes storage=2,700,000 and processing=40,000. Existing TTL batch application and estimation paths produce these operations. The omission also bypasses generation 0's rejection of sectioned removals for ephemeral batches. No current protocol table selects generation 1, so this does not affect current replay, but activating the refund correction would also introduce unintended TTL charges and allocate those fees to permanent-storage pools. Preserve the dedicated ephemeral-cost handling in generation 1, including its removal invariant, and add public-dispatcher regression coverage for ephemeral pricing and sectioned-removal rejection.

Out-of-scope follow-up suggestions (1)

These are valid observations, but they are outside this PR's scope and should be handled in separate issues or author/maintainer-requested PRs rather than blocking this review.

• Generation 1 drops TTL-specific fee handling — Already covered by the canonical ephemeral-storage billing finding. Although outside the versioning specialist's lane, it is within this PR's scope because the PR introduces the defective generation and states that only refund pricing changes.
  • Follow-up: Consider creating a separate issue or author/maintainer-requested PR for this.

[thepastaclaw]

🔴 Blocking: Preserve ephemeral storage billing in the new fee generation

consume_to_fees_v1 omits the CalculatedEphemeralCostOperation arm present in generation 0. The wildcard reaches operation_cost(), which accepts this variant but discards its ephemeral classification, so TTL writes are charged as permanent storage. With the checked-in storage schedule and an otherwise zero cost containing 100 added ephemeral bytes, generation 0 computes storage=0 and processing=67,000; generation 1 computes storage=2,700,000 and processing=40,000. Existing TTL batch application and estimation paths produce these operations. The omission also bypasses generation 0's rejection of sectioned removals for ephemeral batches. No current protocol table selects generation 1, so this does not affect current replay, but activating the refund correction would also introduce unintended TTL charges and allocate those fees to permanent-storage pools. Preserve the dedicated ephemeral-cost handling in generation 1, including its removal invariant, and add public-dispatcher regression coverage for ephemeral pricing and sectioned-removal rejection.

_{source: gpt-6-astra (phase2-reviewer: general)}