From d711c42e249ded70798128117d536774f4da9d72 Mon Sep 17 00:00:00 2001 From: Ivan Shumkov Date: Tue, 6 Oct 2026 10:17:53 +0700 Subject: [PATCH] docs(platform): give token pools a unique PV14 change number Move the unchanged token pool paragraph from the duplicate item 31 to item 82, preserving typed-array references and reserving item 81 for the paid Shield failure change. Verification: byte-for-byte paragraph/rest-of-file comparisons, rustfmt and whitespace checks; two independent reviews clean. Behavioral regression tests omitted because only documentation changes. --- .../rs-platform-version/src/version/v14.rs | 98 +++++++++---------- 1 file changed, 49 insertions(+), 49 deletions(-) diff --git a/packages/rs-platform-version/src/version/v14.rs b/packages/rs-platform-version/src/version/v14.rs index a78074591e8..8273b096b39 100644 --- a/packages/rs-platform-version/src/version/v14.rs +++ b/packages/rs-platform-version/src/version/v14.rs @@ -759,55 +759,6 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14; /// document. A changed /// element `refersTo` is an incompatible schema change on update. /// -/// 31. **Token shielded pools**: a token configuration in format version 1 -/// (`TokenConfiguration::V1`, admitted by `CONTRACT_VERSIONS_V6`'s -/// `token_configuration_format` bounds) can set `hasShieldedPool`, which -/// gives the token its own Orchard pool under -/// `[Tokens, TOKEN_SHIELDED_POOLS_KEY, token_id]` laid out like the credit -/// pool. A pooled token must leave its freeze, unfreeze and destroy-frozen- -/// funds rules unassigned, since notes have no owner to freeze. Seven batch -/// token transitions (`TokenShield`, `TokenUnshield`, -/// `TokenShieldedTransfer`, `TokenMintToPool`, `TokenBurnFromPool`, -/// `TokenClaimToPool` and `TokenDirectPurchaseToPool`, validated through -/// `DRIVE_ABCI_VALIDATION_VERSIONS_V10` and gated by -/// `TOKEN_SHIELDED_POOL_INITIAL_PROTOCOL_VERSION`) move tokens between an -/// identity balance, the supply and the pool or inside it; the identity -/// signs and pays the fee in credits, and every bundle binds its pool into -/// the Orchard sighash, since all pools share the empty-tree anchor an -/// unbound bundle would verify against: a spend bundle binds the token id -/// and the batch owner (a burn binds the burner: the batch owner, or the -/// proposer of a group action), plus the recipient and amount where tokens -/// leave the pool; an outputs-only bundle (`TokenShield`, -/// `TokenMintToPool`, `TokenClaimToPool`, `TokenDirectPurchaseToPool`), -/// whose anchor is never checked against a pool, binds a per-kind tag, -/// the token id and the batch owner (for a group action mint, the -/// proposer). -/// A batch carrying any of these bundles, or a document whose token cost -/// is paid out of a pool, has to hold the compute fee the bundles will be -/// charged (`compute_shielded_verification_fee` per bundle-carrying -/// sub-transition): the batch minimum balance pre-check v1 -/// (`identity_minimum_balance_pre_check`) reserves it on top of the flat -/// per-sub-transition minimum, which is orders of magnitude smaller. A -/// batch without a bundle is asked for the flat minimum, unchanged, and -/// one that asks the contract owner to pay its gas is asked for its -/// principal alone as in item 11, the compute fee being gas. The floor -/// refuses only what fee validation would refuse later, but it refuses it -/// before the Halo 2 work: `TokenClaimToPool`'s proof is skipped in check -/// tx, since its claimable amount is only known against state, so without -/// the floor a signer between the two numbers cleared the mempool with no -/// verification run and every validator then did the verification inside -/// block validation, only to refuse the batch unpaid, leaving the same -/// bytes replayable. The same holds for the bundle of a group action's -/// non-proposing signer, whose proof check tx also skips. -/// The pool balances are a term of the token conservation check -/// (`calculate_total_tokens_balance` v1 in `DRIVE_TOKEN_METHOD_VERSIONS_V2`). -/// `record_token_shielded_pool_anchors` -/// (`DRIVE_ABCI_METHOD_VERSIONS_V10`) records and prunes the anchors of the -/// pools a block touched. The pools root tree is inserted by -/// `transition_to_version_14` and by `create_initial_state_structure` v4; -/// the six shielded queries accept an optional `token_id` to target a token -/// pool. -/// /// 32. **Document references resolved through a unique index**: a /// `permanentDocument` `refersTo`, on an identifier property or on the /// elements of a typed array (item 31), may carry a `lookup` @@ -2019,6 +1970,55 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14; /// tables of every earlier version select generation 0, the code it called /// before. /// +/// 82. **Token shielded pools**: a token configuration in format version 1 +/// (`TokenConfiguration::V1`, admitted by `CONTRACT_VERSIONS_V6`'s +/// `token_configuration_format` bounds) can set `hasShieldedPool`, which +/// gives the token its own Orchard pool under +/// `[Tokens, TOKEN_SHIELDED_POOLS_KEY, token_id]` laid out like the credit +/// pool. A pooled token must leave its freeze, unfreeze and destroy-frozen- +/// funds rules unassigned, since notes have no owner to freeze. Seven batch +/// token transitions (`TokenShield`, `TokenUnshield`, +/// `TokenShieldedTransfer`, `TokenMintToPool`, `TokenBurnFromPool`, +/// `TokenClaimToPool` and `TokenDirectPurchaseToPool`, validated through +/// `DRIVE_ABCI_VALIDATION_VERSIONS_V10` and gated by +/// `TOKEN_SHIELDED_POOL_INITIAL_PROTOCOL_VERSION`) move tokens between an +/// identity balance, the supply and the pool or inside it; the identity +/// signs and pays the fee in credits, and every bundle binds its pool into +/// the Orchard sighash, since all pools share the empty-tree anchor an +/// unbound bundle would verify against: a spend bundle binds the token id +/// and the batch owner (a burn binds the burner: the batch owner, or the +/// proposer of a group action), plus the recipient and amount where tokens +/// leave the pool; an outputs-only bundle (`TokenShield`, +/// `TokenMintToPool`, `TokenClaimToPool`, `TokenDirectPurchaseToPool`), +/// whose anchor is never checked against a pool, binds a per-kind tag, +/// the token id and the batch owner (for a group action mint, the +/// proposer). +/// A batch carrying any of these bundles, or a document whose token cost +/// is paid out of a pool, has to hold the compute fee the bundles will be +/// charged (`compute_shielded_verification_fee` per bundle-carrying +/// sub-transition): the batch minimum balance pre-check v1 +/// (`identity_minimum_balance_pre_check`) reserves it on top of the flat +/// per-sub-transition minimum, which is orders of magnitude smaller. A +/// batch without a bundle is asked for the flat minimum, unchanged, and +/// one that asks the contract owner to pay its gas is asked for its +/// principal alone as in item 11, the compute fee being gas. The floor +/// refuses only what fee validation would refuse later, but it refuses it +/// before the Halo 2 work: `TokenClaimToPool`'s proof is skipped in check +/// tx, since its claimable amount is only known against state, so without +/// the floor a signer between the two numbers cleared the mempool with no +/// verification run and every validator then did the verification inside +/// block validation, only to refuse the batch unpaid, leaving the same +/// bytes replayable. The same holds for the bundle of a group action's +/// non-proposing signer, whose proof check tx also skips. +/// The pool balances are a term of the token conservation check +/// (`calculate_total_tokens_balance` v1 in `DRIVE_TOKEN_METHOD_VERSIONS_V2`). +/// `record_token_shielded_pool_anchors` +/// (`DRIVE_ABCI_METHOD_VERSIONS_V10`) records and prunes the anchors of the +/// pools a block touched. The pools root tree is inserted by +/// `transition_to_version_14` and by `create_initial_state_structure` v4; +/// the six shielded queries accept an optional `token_id` to target a token +/// pool. +/// /// The app-connect system contract (`SystemDataContract::AppConnect`, schema v1) /// carries only the wallet's `loginKeyResponse`: a flat indexOnly entry keyed by /// the app's ephemeral key hash and the responding identity, with the wallet's