diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 7fe46e892d5..14ff10fba49 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,9 +1,11 @@
 # Custom labels carried by this repo's self-hosted runners. Without this,
-# actionlint flags `runs-on: [self-hosted, rust-ci]` as an unknown label
+# actionlint flags `runs-on: [self-hosted, <label>]` as an unknown label
 # because it can't resolve it against the GitHub-hosted runner names.
 #
 # `rust-ci` must be applied to every runner allowed to take the Rust workspace
-# test job (Settings -> Actions -> Runners -> <runner> -> Labels).
+# test job, and `kotlin-ci` to every runner allowed to take the Kotlin SDK job
+# (Settings -> Actions -> Runners -> <runner> -> Labels).
 self-hosted-runner:
   labels:
     - rust-ci
+    - kotlin-ci
diff --git a/.github/workflows/kotlin-sdk-build.yml b/.github/workflows/kotlin-sdk-build.yml
index 66cdff7cba2..496d5ae5fa6 100644
--- a/.github/workflows/kotlin-sdk-build.yml
+++ b/.github/workflows/kotlin-sdk-build.yml
@@ -24,6 +24,9 @@ on:
       - 'scripts/tests/**'
       - '.github/workflows/kotlin-sdk-build.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: kotlin-sdk-${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -31,45 +34,55 @@ concurrency:
 jobs:
   kotlin-sdk-build:
     name: Kotlin SDK build + tests (x86_64 emulator)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, kotlin-ci]
+    # Fork PRs must not execute on a persistent runner. Keep this guard in sync
+    # with tests-rs-workspace.yml.
+    if: >-
+      github.event_name != 'pull_request'
+      || github.event.pull_request.head.repo.full_name == github.repository
+      || github.event.pull_request.head.repo.owner.login == 'thepastaclaw'
     timeout-minutes: 120
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          # Preserve target/ and other untracked build outputs between runs.
+          clean: false
+
+      - name: Ensure runner dependencies
+        run: |
+          set -euo pipefail
+
+          MISSING=()
+          for pkg in build-essential cmake curl jq libgmp-dev libpulse0 libssl-dev libx11-xcb1 pkg-config python3 unzip zip; do
+            dpkg -s "$pkg" >/dev/null 2>&1 || MISSING+=("$pkg")
+          done
+          if [ ${#MISSING[@]} -gt 0 ]; then
+            echo "Installing: ${MISSING[*]}"
+            sudo apt-get update -qq
+            sudo apt-get install -qq --yes "${MISSING[@]}"
+          fi
+
+          if [ ! -x "$HOME/.cargo/bin/rustup" ]; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+              | sh -s -- -y --no-modify-path --default-toolchain none
+          fi
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Validate executable SDK parity manifest
         run: |
           python3 scripts/check_sdk_parity_manifest.py
           python3 -m unittest discover -s scripts/tests -p 'test_*.py'
 
-      - name: Free disk space
+      - name: Verify JDK 17
         run: |
-          # The API-35 x86_64 system image + the shielded .so's cargo target
-          # dir (halo2/Orchard) + gradle outputs overflow the ~21 GB free on
-          # the runner root fs, surfacing as "No space left on device" during
-          # system-image install (the emulator then never boots). Reclaim the
-          # large preinstalled toolchains we don't use before building. None of
-          # these are needed by this job (JDK via setup-java, Android SDK via
-          # setup-android, Rust via rustup, NDK reinstalled below).
-          echo "Before:"; df -h /
-          sudo rm -rf \
-            /usr/share/dotnet \
-            /usr/local/.ghcup \
-            /opt/ghc \
-            /opt/hostedtoolcache/CodeQL \
-            /usr/local/lib/android/sdk/ndk \
-            /usr/local/share/powershell \
-            /usr/share/swift \
-            /opt/microsoft 2>/dev/null || true
-          sudo docker image prune --all --force 2>/dev/null || true
-          echo "After:"; df -h /
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
+          JAVA_HOME_RESOLVED=$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")
+          JAVA_VERSION_OUTPUT=$("$JAVA_HOME_RESOLVED/bin/java" -version 2>&1)
+          printf '%s\n' "$JAVA_VERSION_OUTPUT"
+          printf '%s\n' "$JAVA_VERSION_OUTPUT" | grep -Eq 'version "17([.]|\")'
+          echo "JAVA_HOME=$JAVA_HOME_RESOLVED" >> "$GITHUB_ENV"
+          echo "$JAVA_HOME_RESOLVED/bin" >> "$GITHUB_PATH"
 
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
@@ -85,25 +98,30 @@ jobs:
         with:
           targets: x86_64-linux-android
 
-      - name: Restore cargo cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: kotlin-sdk-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            kotlin-sdk-cargo-
-
-      - name: Install cargo-ndk
-        run: cargo install cargo-ndk --locked
-
-      - name: Install protoc v32.0 (repo-standard; apt's 3.21 breaks tenderdash-proto)
+      # Pinned: this runner is persistent, so an unpinned `cargo install`
+      # leaves whatever version happened to be current on the day it first ran,
+      # and every later job silently builds with it. Assert after installing so
+      # a drifted host fails here instead of somewhere in the NDK build.
+      - name: Ensure cargo-ndk v4.1.2 is installed
+        run: |
+          set -euo pipefail
+          if ! cargo ndk --version 2>/dev/null | grep -qx 'cargo-ndk 4.1.2'; then
+            cargo install cargo-ndk --version 4.1.2 --locked --force
+          fi
+          cargo ndk --version
+          cargo ndk --version | grep -qx 'cargo-ndk 4.1.2'
+
+      - name: Ensure protoc v32.0 is installed (repo-standard; apt's 3.21 breaks tenderdash-proto)
         run: |
-          curl -fsSL -o /tmp/protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v32.0/protoc-32.0-linux-x86_64.zip
-          sudo unzip -o /tmp/protoc.zip -d /usr/local 'bin/protoc' 'include/*'
+          set -euo pipefail
+          if ! protoc --version 2>/dev/null | grep -qx 'libprotoc 32.0'; then
+            curl -fsSL -o /tmp/protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v32.0/protoc-32.0-linux-x86_64.zip
+            sudo unzip -o /tmp/protoc.zip -d /usr/local 'bin/protoc' 'include/*'
+          fi
           protoc --version
+          # A stale protoc earlier on PATH would shadow the one just unpacked
+          # into /usr/local; catch that here rather than in a codegen failure.
+          protoc --version | grep -qx 'libprotoc 32.0'
 
       - name: Build native library (x86_64, dev profile)
         working-directory: packages/kotlin-sdk
@@ -126,12 +144,12 @@ jobs:
         working-directory: packages/kotlin-sdk
         run: ./gradlew :sdk:compileDebugAndroidTestKotlin --stacktrace
 
-      - name: Enable KVM for emulator
+      - name: Verify KVM access
         run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
-            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
+          test -c /dev/kvm
+          test -r /dev/kvm
+          test -w /dev/kvm
+          ls -l /dev/kvm
 
       - name: Run instrumented FFI smoke test (API 35 emulator)
         uses: reactivecircus/android-emulator-runner@v2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a12f20c749..c19303897b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,277 @@
+## [4.2.0-dev.2](https://github.com/dashpay/platform/compare/v4.1.1...v4.2.0-dev.2) (2026-08-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* **drive:** count credit inflows against the daily withdrawal limit (#4486)
+* add time-range indexes for trending/leaderboard queries (#3740)
+* **platform:** required document fields via contract updates (requiredSince) (#4400)
+* **dashmate:** check the gateway certificate on update (#4440)
+* **dpp:** rebalance the shielded fee constants for protocol 14 (#4467)
+* **drive:** make the daily withdrawal limit 15% of the total credits held a day ago (#4457)
+* **drive:** raise the daily withdrawal limit to 4000 Dash (#4452)
+* **sdk:** three rs-sdk surfaces are source-incompatible for downstream crates.
+
+1. DocumentQuery's own methods (new, try_into_request_for_version, the TryFromPlatformVersioned associated error, and TryFrom into DriveDocumentQuery) now yield dash_platform_queries::Error rather than dash_sdk::Error. dash_sdk::Error: From<dash_platform_queries::Error> keeps `?` call sites working; explicit return types, direct variant matching, and function-pointer/associated-error bounds need an SdkError::from conversion.
+
+2. DocumentQuery::new_with_data_contract_id moved from an inherent method to the DocumentQuerySdk extension trait (an inherent impl is impossible from rs-sdk now that the type is foreign). Callers add `use dash_sdk::platform::DocumentQuerySdk;`.
+
+3. The blanket `impl Query<T> for T` is additionally bounded by the new dash_sdk::platform::WireQuery marker. Every in-workspace request proto implements it; a downstream crate with its own TransportRequest type adds `impl dash_sdk::platform::WireQuery for MyRequest {}`.
+
+Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
+* **drive:** unique index entries with null fields lost on document update (#4398)
+* **drive:** cursor pagination over multi-branch query levels dropped sibling-branch documents (#4396)
+* **drive:** multiple IN clauses on consecutive index properties in document queries (#4391)
+* **platform:** identity public key references (refersTo identityPublicKey) (#4397)
+* **platform:** permanent document references (refersTo permanentDocument) (#4390)
+* **platform:** reference validation for documents (refersTo) (#2993)
+* **dpp:** dashpay profile payment addresses for core and platform (#4380)
+
+### Features
+
+* add time-range indexes for trending/leaderboard queries ([#3740](https://github.com/dashpay/platform/issues/3740))
+* **dashmate:** check the gateway certificate on update ([#4440](https://github.com/dashpay/platform/issues/4440))
+* document-throughput load-test tool ([#4376](https://github.com/dashpay/platform/issues/4376))
+* **dpp:** dashpay profile payment addresses for core and platform ([#4380](https://github.com/dashpay/platform/issues/4380))
+* **dpp:** rebalance the shielded fee constants for protocol 14 ([#4467](https://github.com/dashpay/platform/issues/4467))
+* **drive:** boolean HAVING range queries on ranked index axes ([#4384](https://github.com/dashpay/platform/issues/4384))
+* **drive:** count credit inflows against the daily withdrawal limit ([#4486](https://github.com/dashpay/platform/issues/4486))
+* **drive:** make the daily withdrawal limit 15% of the total credits held a day ago ([#4457](https://github.com/dashpay/platform/issues/4457))
+* **drive:** multiple IN clauses on consecutive index properties in document queries ([#4391](https://github.com/dashpay/platform/issues/4391))
+* **drive:** per-prefix ranked aggregates on compound indexes ([#4393](https://github.com/dashpay/platform/issues/4393))
+* **drive:** raise the daily withdrawal limit to 4000 Dash ([#4452](https://github.com/dashpay/platform/issues/4452))
+* **drive:** support IN over pinned prefix properties in ranked and having-range queries ([#4401](https://github.com/dashpay/platform/issues/4401))
+* **kotlin-sdk:** coinjoin-drain shielded funding binding + typed asset-lock shortfall ([#4361](https://github.com/dashpay/platform/issues/4361))
+* **kotlin-sdk:** expose core_wallet_set_gap_limit to Kotlin (migrated-wallet address-window heal) ([#4377](https://github.com/dashpay/platform/issues/4377))
+* **platform-wallet:** claim masternode credits with the owner or payout key ([#4451](https://github.com/dashpay/platform/issues/4451))
+* **platform-wallet:** locate and track masternodes independently of any wallet ([#4465](https://github.com/dashpay/platform/issues/4465))
+* **platform-wallet:** secp256k1 primitives, identity-update parsing, and scoped signing keys for DashConnect ([#4273](https://github.com/dashpay/platform/issues/4273))
+* **platform-wallet:** shield Platform credits to an external Orchard recipient ([#4472](https://github.com/dashpay/platform/issues/4472))
+* **platform:** identity public key references (refersTo identityPublicKey) ([#4397](https://github.com/dashpay/platform/issues/4397))
+* **platform:** permanent document references (refersTo permanentDocument) ([#4390](https://github.com/dashpay/platform/issues/4390))
+* **platform:** reference validation for documents (refersTo) ([#2993](https://github.com/dashpay/platform/issues/2993))
+* **platform:** required document fields via contract updates (requiredSince) ([#4400](https://github.com/dashpay/platform/issues/4400))
+* register funded identities via a ChainLock asset lock ([#4399](https://github.com/dashpay/platform/issues/4399))
+* **sdk-ffi:** ask one evonode for its DAPI status; expose the platform HTTP port ([#4461](https://github.com/dashpay/platform/issues/4461))
+* **sdk-ffi:** expose the current epoch; fix Swift getCurrentEpoch ([#4453](https://github.com/dashpay/platform/issues/4453))
+* **swift-sdk:** add async off-main createWallet(mnemonic:) overload ([#4483](https://github.com/dashpay/platform/issues/4483))
+* **swift-sdk:** add async off-main loadFromPersistor() overload ([#4487](https://github.com/dashpay/platform/issues/4487))
+* **swift-sdk:** add async off-main wallet manager shutdown ([#4469](https://github.com/dashpay/platform/issues/4469))
+
+
+### Bug Fixes
+
+* **dashmate:** deliver renewed certificates to the running gateway ([#4421](https://github.com/dashpay/platform/issues/4421))
+* **dashmate:** detect and report gateway certificate problems ([#4420](https://github.com/dashpay/platform/issues/4420))
+* **dashmate:** handle nullable ZeroSSL expiry dates ([#4415](https://github.com/dashpay/platform/issues/4415))
+* **dashmate:** stop concurrent commands reverting each other's config changes ([#4248](https://github.com/dashpay/platform/issues/4248))
+* **dashmate:** use header authentication for ZeroSSL ([#4419](https://github.com/dashpay/platform/issues/4419))
+* **drive-abci:** mimic block time truncated to whole seconds ([#4477](https://github.com/dashpay/platform/issues/4477))
+* **drive-abci:** roll back dropped state transitions on the proposing path ([#4409](https://github.com/dashpay/platform/issues/4409))
+* **drive:** cursor pagination over multi-branch query levels dropped sibling-branch documents ([#4396](https://github.com/dashpay/platform/issues/4396))
+* **drive:** skip the ranked offset by counting instead of walking ([#4382](https://github.com/dashpay/platform/issues/4382))
+* **drive:** unique index entries with null fields lost on document update ([#4398](https://github.com/dashpay/platform/issues/4398))
+* **kotlin-sdk:** typed retryable device-locked keystore errors + createWallet fail-fast ([#4463](https://github.com/dashpay/platform/issues/4463))
+* parallel-test race on process-global platform version in contract to_value ([#4395](https://github.com/dashpay/platform/issues/4395))
+* **platform-wallet:** commit wallet events off the async runtime ([#4370](https://github.com/dashpay/platform/issues/4370))
+* **platform-wallet:** emit the real locking script for spent UTXOs ([#4257](https://github.com/dashpay/platform/issues/4257))
+* **platform-wallet:** estimate shielded fees at the network's active protocol version ([#4470](https://github.com/dashpay/platform/issues/4470))
+* **platform:** preserve tracked masternode ABI and persistence ([#4473](https://github.com/dashpay/platform/issues/4473))
+* restore four Swift-parity guards in the Kotlin SDK, plus two DPNS marketplace defects ([#4423](https://github.com/dashpay/platform/issues/4423))
+* **sdk-ffi:** carry the limit in the proposed-epoch-blocks range request ([#4456](https://github.com/dashpay/platform/issues/4456))
+* **sdk:** bound contested username loading
+* **sdk:** enforce the server's limit contract when lowering document queries ([#4434](https://github.com/dashpay/platform/issues/4434))
+* **sdk:** skip TLS-dead seed nodes + shielded-sync network diagnostics ([#4418](https://github.com/dashpay/platform/issues/4418))
+* **swift-sdk:** isolate blocking contest query
+* **swift-sdk:** preserve contest query lifetime
+
+
+### Build System
+
+* **docker:** add dash-platform-queries to Dockerfile COPY lists
+
+
+### Documentation
+
+* **dash-platform-queries:** correct migration notes in README
+* **dash-platform-queries:** deduplicate module docs and tighten phrasing
+* **sdk:** document the transport-free consumption path
+
+
+### Miscellaneous Chores
+
+* bump rust-dashcore pin for multilingual BIP-39 mnemonic parsing ([#4455](https://github.com/dashpay/platform/issues/4455))
+* bump rust-dashcore to the latest dev revision ([#4381](https://github.com/dashpay/platform/issues/4381))
+* bump rust-dashcore to the latest dev revision ([#4394](https://github.com/dashpay/platform/issues/4394))
+* bump rust-dashcore to the merged sync fixes, minus the sweep-event chain ([#4459](https://github.com/dashpay/platform/issues/4459))
+
+
+### Tests
+
+* **dashmate:** make ZeroSSL provider-change test deterministic ([#4482](https://github.com/dashpay/platform/issues/4482))
+* **drive-abci:** pin the mainnet shield-halt fix with regression and fault-injection tests ([#4408](https://github.com/dashpay/platform/issues/4408))
+* **drive:** pin the batch-transition cap and land the phantom-group evidence ([#4383](https://github.com/dashpay/platform/issues/4383))
+* **swift-sdk:** make resolver sign tests hermetic to CI keychain state ([#4386](https://github.com/dashpay/platform/issues/4386))
+
+
+### Continuous Integration
+
+* cover the transport-free feature cuts
+* **kotlin-sdk:** run tests on dedicated self-hosted runner ([#4468](https://github.com/dashpay/platform/issues/4468))
+* tolerate book preview comment permission errors ([#3635](https://github.com/dashpay/platform/issues/3635))
+
+
+### Code Refactoring
+
+* **dpp:** split document serialization formats into per-generation files ([#4484](https://github.com/dashpay/platform/issues/4484))
+* **sdk:** extract transport-free query core into dash-platform-queries
+
+## [4.2.0-dev.1](https://github.com/dashpay/platform/compare/v4.1.0...v4.2.0-dev.1) (2026-08-12)
+
+
+### ⚠ BREAKING CHANGES
+
+* **drive-abci:** cross-check the contested index of a prefunded voting balance at protocol v14 (#4281)
+* **kotlin-sdk:** keystore rework — policy-alias split, layered key recovery, durable repair, structured signer errors (stacked on #4191) (#4183)
+* **drive:** make shared-prefix aggregate indexes insertable at protocol v14 (#4265)
+* **dashmate:** record whether a platform image was chosen instead of deriving it (#4239)
+
+### Features
+
+* **dashmate:** record whether a platform image was chosen instead of deriving it ([#4239](https://github.com/dashpay/platform/issues/4239))
+* expose Platform-to-Shielded capacity preflight ([#4360](https://github.com/dashpay/platform/issues/4360))
+* **kotlin-sdk:** bind OP_RETURN, output-order and VIN0-change builder controls ([#4288](https://github.com/dashpay/platform/issues/4288))
+* **kotlin-sdk:** dashpay invitations — create, claim, reclaim, persistence (DIP-13) ([#4284](https://github.com/dashpay/platform/issues/4284))
+* **kotlin-sdk:** expose core_wallet_next_receive_address / next_change_address (Swift parity) ([#4260](https://github.com/dashpay/platform/issues/4260))
+* **kotlin-sdk:** keystore rework — policy-alias split, layered key recovery, durable repair, structured signer errors (stacked on [#4191](https://github.com/dashpay/platform/issues/4191)) ([#4183](https://github.com/dashpay/platform/issues/4183))
+* **kotlin-sdk:** split build/broadcast with reservation release for BIP70-style deferred submission ([#4308](https://github.com/dashpay/platform/issues/4308))
+* **kotlin-sdk:** tx-label & asset-lock-kind DAO resolver queries ([#4251](https://github.com/dashpay/platform/issues/4251))
+* **platform-wallet:** add encrypted txMetadata document support ([#4277](https://github.com/dashpay/platform/issues/4277))
+* **platform-wallet:** classic Dash message signing (signMessage) over FFI, JNI, Kotlin, and Swift, closes [#4259](https://github.com/dashpay/platform/issues/4259) [#4279](https://github.com/dashpay/platform/issues/4279)
+* **platform-wallet:** CoinJoin-drain asset-lock funding for the shielded pool ([#4327](https://github.com/dashpay/platform/issues/4327))
+* **platform-wallet:** derive owner/voting provider keys Rust-side ([#4338](https://github.com/dashpay/platform/issues/4338))
+* **platform-wallet:** expose an invitation's prospective identity id ([#4332](https://github.com/dashpay/platform/issues/4332))
+* **platform-wallet:** own the DashPay startup ordering instead of each client ([#4359](https://github.com/dashpay/platform/issues/4359))
+* **platform-wallet:** persist DashPay payment history through the persister callback ([#4326](https://github.com/dashpay/platform/issues/4326))
+* **platform-wallet:** pool BIP44 + BIP32 + DashPay receiving funds on the asset-lock path ([#4350](https://github.com/dashpay/platform/issues/4350))
+* **platform-wallet:** pool BIP44 + BIP32 + DashPay receiving funds on the send path ([#4329](https://github.com/dashpay/platform/issues/4329))
+* **platform-wallet:** rebuild tracked asset locks after restore; honest scan-derived shielded history ([#4342](https://github.com/dashpay/platform/issues/4342))
+* **platform-wallet:** reconstruct sent DashPay payments from tx history ([#4300](https://github.com/dashpay/platform/issues/4300))
+* **platform-wallet:** registry-owned coordinator lifecycle with Rust-owned FFI callback contexts ([#4268](https://github.com/dashpay/platform/issues/4268))
+* **platform-wallet:** wallet-level DPNS username marketplace with FFI and Swift wrappers ([#4348](https://github.com/dashpay/platform/issues/4348))
+* **platform:** introduce protocol version 14 ([#4267](https://github.com/dashpay/platform/issues/4267))
+* ranked aggregate indexes with provable top-K queries (protocol v14) ([#4266](https://github.com/dashpay/platform/issues/4266))
+* **rs-sdk:** own the masternode voting-key facts ([#4340](https://github.com/dashpay/platform/issues/4340))
+* **sdk:** add transport feature to dapi-grpc for types-only consumers ([#4344](https://github.com/dashpay/platform/issues/4344))
+* **sdk:** expose OP_RETURN, output-order and change-to-VIN0 controls ([#4286](https://github.com/dashpay/platform/issues/4286))
+* **sdk:** expose the label each contender actually requested ([#4331](https://github.com/dashpay/platform/issues/4331))
+* **sdk:** masternodes-by-voting-key lookup (contested-username voting post-cutover) ([#4258](https://github.com/dashpay/platform/issues/4258))
+* **swift-sdk:** expose watermark-freeze sync fault flag (syncFaultDetected) ([#4320](https://github.com/dashpay/platform/issues/4320))
+* **swift-sdk:** split build/broadcast with reservation release for BIP70-style deferred submission ([#4322](https://github.com/dashpay/platform/issues/4322))
+* **swift-sdk:** typed DPNS contested-name browsing for voters ([#4328](https://github.com/dashpay/platform/issues/4328))
+
+
+### Bug Fixes
+
+* **dashmate:** extend Core shutdown grace period ([#4307](https://github.com/dashpay/platform/issues/4307))
+* **docs:** point parity manifest at the renamed identity-resume test, closes [#4015](https://github.com/dashpay/platform/issues/4015)
+* **dpp:** derive deterministic names for unnamed document type indexes ([#4280](https://github.com/dashpay/platform/issues/4280))
+* **dpp:** make document type index update validation name-order independent ([#4291](https://github.com/dashpay/platform/issues/4291))
+* **dpp:** stop hard-erroring on index-order-only contract updates ([#4295](https://github.com/dashpay/platform/issues/4295))
+* **drive-abci:** cross-check the contested index of a prefunded voting balance at protocol v14 ([#4281](https://github.com/dashpay/platform/issues/4281))
+* **drive:** derive wasm-drive-verify platform version cap from rs-platform-version ([#4269](https://github.com/dashpay/platform/issues/4269))
+* **drive:** make shared-prefix aggregate indexes insertable at protocol v14 ([#4265](https://github.com/dashpay/platform/issues/4265))
+* **kotlin-sdk:** unmanaged-identity reads return absence + typed SigningKeyUnavailable (split from [#4183](https://github.com/dashpay/platform/issues/4183)) ([#4191](https://github.com/dashpay/platform/issues/4191))
+* **platform-wallet:** accept legacy dashj key purposes on inbound contact requests ([#4372](https://github.com/dashpay/platform/issues/4372))
+* **platform-wallet:** batch wallet-event persistence + expose sync_fault (watermark-freeze mitigations) ([#4314](https://github.com/dashpay/platform/issues/4314))
+* **platform-wallet:** finalize reconstructed asset locks as RecoveredFromChain, in-session ([#4347](https://github.com/dashpay/platform/issues/4347))
+* **platform-wallet:** fold fetched on-chain state into already-known identities on load ([#4374](https://github.com/dashpay/platform/issues/4374))
+* **platform-wallet:** gate candidate-address re-export behind shielded feature ([#4369](https://github.com/dashpay/platform/issues/4369))
+* **platform-wallet:** lossless mpsc persistence drain — root-cause fix for the sync-watermark freeze ([#4315](https://github.com/dashpay/platform/issues/4315))
+* **platform-wallet:** preserve reported-consumed asset-lock recovery ([#4357](https://github.com/dashpay/platform/issues/4357))
+* **platform-wallet:** raise the invitation cap to cover the contested username tier ([#4362](https://github.com/dashpay/platform/issues/4362))
+* **platform-wallet:** reject trailing bytes in persisted asset-lock proof blobs ([#4346](https://github.com/dashpay/platform/issues/4346))
+* **platform-wallet:** report an unanswered identity scan as incomplete, not empty ([#4352](https://github.com/dashpay/platform/issues/4352))
+* **platform-wallet:** stale-islock to chainlock fallback for the L1 invite claim ([#4364](https://github.com/dashpay/platform/issues/4364))
+* **platform-wallet:** stop a contact's watch-only chain from defining the persisted transaction row ([#4363](https://github.com/dashpay/platform/issues/4363))
+* **platform-wallet:** survive an ambiguous re-broadcast when resuming a Built asset lock ([#4367](https://github.com/dashpay/platform/issues/4367))
+* **platform-wallet:** type signer-reported missing key as MessageSigningKeyUnavailable ([#4321](https://github.com/dashpay/platform/issues/4321))
+* **release:** base changelog on the immediately-preceding release ([#4229](https://github.com/dashpay/platform/issues/4229))
+* **rs-sdk-ffi:** build the voter identifier from ProTxHash byte order ([#4333](https://github.com/dashpay/platform/issues/4333))
+* **sdk:** poll message signing on the big-stack worker, and throw on JNI string-allocation failure
+* **sdk:** restore proved current-epoch fetch with two-step explicit-start query ([#4231](https://github.com/dashpay/platform/issues/4231))
+* **swift-example-app:** gate identity resumes by funding type ([#4015](https://github.com/dashpay/platform/issues/4015))
+* **swift-sdk:** gate the ordered bring-up on the seed actually owning the wallet ([#4368](https://github.com/dashpay/platform/issues/4368))
+* **swift-sdk:** isLocal = mine-or-tracked; promote wallet identities, fix observed-entry mislinking ([#4375](https://github.com/dashpay/platform/issues/4375))
+* **test-suite:** stabilize platform e2e tests ([#4214](https://github.com/dashpay/platform/issues/4214))
+
+
+### Performance Improvements
+
+* **platform-wallet:** keep the contact fetch off the drain's repeating-rejection path ([#4373](https://github.com/dashpay/platform/issues/4373))
+
+
+### Documentation
+
+* **agents:** never commit working specs; enforce by discipline, not git plumbing
+* **kotlin-sdk:** cite the Swift source in the signMessage KDoc, closes [#4259](https://github.com/dashpay/platform/issues/4259)
+
+
+### Continuous Integration
+
+* install Rust lint components for workspace tests ([#4294](https://github.com/dashpay/platform/issues/4294))
+* keep coverage-instrumented build between runs ([#4296](https://github.com/dashpay/platform/issues/4296))
+* lint test targets with clippy --all-targets ([#4330](https://github.com/dashpay/platform/issues/4330))
+* release Kotlin and Swift SDKs with the platform release ([#4228](https://github.com/dashpay/platform/issues/4228))
+* remove the CodeRabbit/PastaClaw AI review gate ([#4292](https://github.com/dashpay/platform/issues/4292))
+* schedule Rust workspace tests on macOS or Linux self-hosted runners ([#4287](https://github.com/dashpay/platform/issues/4287))
+* skip shielded Rust tests on PRs without shielded changes ([#4293](https://github.com/dashpay/platform/issues/4293))
+
+
+### Code Refactoring
+
+* **dpp:** extract shared try_from_schema parsing helpers ([#4276](https://github.com/dashpay/platform/issues/4276))
+* **rs-sdk-ffi:** use the rs-sdk voting-key helpers instead of its own ([#4341](https://github.com/dashpay/platform/issues/4341))
+* **sdk:** drop the vestigial v2 suffix from the finalized-transaction surface ([#4325](https://github.com/dashpay/platform/issues/4325))
+* **sdk:** remove deprecated v1 split build/sign transaction surface ([#4323](https://github.com/dashpay/platform/issues/4323))
+
+
+### Tests
+
+* **drive-abci:** gate PR runs to one comprehensive chain simulation ([#4297](https://github.com/dashpay/platform/issues/4297))
+* **sdk:** add proof-vector regression corpus for drive-proof-verifier ([#4345](https://github.com/dashpay/platform/issues/4345))
+
+
+### Miscellaneous Chores
+
+* fix rustfmt drift on v4.2-dev ([#4278](https://github.com/dashpay/platform/issues/4278))
+* **platform-wallet:** bump key-wallet pin and migrate to new AddressState/asset-lock API ([#4305](https://github.com/dashpay/platform/issues/4305))
+* **release:** update changelog and bump version to 4.2.0-dev.1 ([#4379](https://github.com/dashpay/platform/issues/4379))
+* **swift-sdk:** remove Account.derivePrivateKeyWIF ([#4339](https://github.com/dashpay/platform/issues/4339))
+* update rust-dashcore to b056d07c ([#4343](https://github.com/dashpay/platform/issues/4343))
+
+### [4.1.1](https://github.com/dashpay/platform/compare/v4.2.0-dev.1...v4.1.1) (2026-08-18)
+
+
+### ⚠ BREAKING CHANGES
+
+* **dashmate:** pin Tenderdash to the 1.7 line and drop the removed Commit timeout overrides (#4411)
+
+### Bug Fixes
+
+* **drive-abci:** roll back dropped state transitions on the proposing path ([#4409](https://github.com/dashpay/platform/issues/4409))
+
+
+### Build System
+
+* **dashmate:** pin Tenderdash to the 1.7 line and drop the removed Commit timeout overrides ([#4411](https://github.com/dashpay/platform/issues/4411))
+* **dashmate:** track the floating Tenderdash 1.6 image tag ([#4410](https://github.com/dashpay/platform/issues/4410))
+
+
+### Miscellaneous Chores
+
+* **release:** update changelog and bump version to 4.1.1 ([#4413](https://github.com/dashpay/platform/issues/4413))
+
 ## [4.2.0-dev.1](https://github.com/dashpay/platform/compare/v4.1.0...v4.2.0-dev.1) (2026-08-12)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index 6c6a82ec807..8c6bfc1ab2a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -577,7 +577,7 @@ dependencies = [
  "bitflags 2.13.0",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "regex",
@@ -1064,7 +1064,7 @@ dependencies = [
 
 [[package]]
 name = "check-features"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "toml 0.8.23",
 ]
@@ -1552,7 +1552,7 @@ dependencies = [
 
 [[package]]
 name = "dapi-grpc"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "dash-platform-macros",
  "futures-core",
@@ -1639,7 +1639,7 @@ dependencies = [
 
 [[package]]
 name = "dash-async"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "futures",
  "thiserror 2.0.18",
@@ -1650,7 +1650,7 @@ dependencies = [
 
 [[package]]
 name = "dash-context-provider"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "dash-async",
  "dpp",
@@ -1663,7 +1663,7 @@ dependencies = [
 [[package]]
 name = "dash-network"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -1674,14 +1674,14 @@ dependencies = [
 [[package]]
 name = "dash-network-seeds"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "dash-network",
 ]
 
 [[package]]
 name = "dash-platform-balance-checker"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "anyhow",
  "clap",
@@ -1696,7 +1696,7 @@ dependencies = [
 
 [[package]]
 name = "dash-platform-macros"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "heck 0.5.0",
  "quote",
@@ -1705,7 +1705,7 @@ dependencies = [
 
 [[package]]
 name = "dash-platform-queries"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "dapi-grpc",
  "dash-context-provider",
@@ -1722,7 +1722,7 @@ dependencies = [
 
 [[package]]
 name = "dash-sdk"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "arc-swap",
  "assert_matches",
@@ -1769,7 +1769,7 @@ dependencies = [
 [[package]]
 name = "dash-spv"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "async-trait",
  "chrono",
@@ -1798,7 +1798,7 @@ dependencies = [
 [[package]]
 name = "dashcore"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "anyhow",
  "base64-compat",
@@ -1824,12 +1824,12 @@ dependencies = [
 [[package]]
 name = "dashcore-private"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 
 [[package]]
 name = "dashcore-rpc"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "dashcore-rpc-json",
  "hex",
@@ -1842,7 +1842,7 @@ dependencies = [
 [[package]]
 name = "dashcore-rpc-json"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "bincode",
  "dashcore",
@@ -1857,7 +1857,7 @@ dependencies = [
 [[package]]
 name = "dashcore_hashes"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "bincode",
  "dashcore-private",
@@ -1867,7 +1867,7 @@ dependencies = [
 
 [[package]]
 name = "dashpay-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -1877,7 +1877,7 @@ dependencies = [
 
 [[package]]
 name = "data-contracts"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "dashpay-contract",
  "document-history-contract",
@@ -2079,7 +2079,7 @@ dependencies = [
 
 [[package]]
 name = "document-history-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -2101,7 +2101,7 @@ checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
 
 [[package]]
 name = "dpns-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -2111,7 +2111,7 @@ dependencies = [
 
 [[package]]
 name = "dpp"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "anyhow",
  "assert_matches",
@@ -2169,7 +2169,7 @@ dependencies = [
 
 [[package]]
 name = "dpp-json-convertible-derive"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2178,7 +2178,7 @@ dependencies = [
 
 [[package]]
 name = "drive"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "arc-swap",
  "assert_matches",
@@ -2196,6 +2196,7 @@ dependencies = [
  "grovedb-costs",
  "grovedb-epoch-based-storage-flags",
  "grovedb-path",
+ "grovedb-query",
  "grovedb-storage",
  "grovedb-version",
  "hex",
@@ -2219,7 +2220,7 @@ dependencies = [
 
 [[package]]
 name = "drive-abci"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "arc-swap",
  "assert_matches",
@@ -2233,6 +2234,7 @@ dependencies = [
  "console-subscriber",
  "dapi-grpc",
  "dash-platform-macros",
+ "dash-platform-queries",
  "delegate",
  "derive_more 1.0.0",
  "dotenvy",
@@ -2280,7 +2282,7 @@ dependencies = [
 
 [[package]]
 name = "drive-proof-verifier"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "bincode",
  "dapi-grpc",
@@ -2924,7 +2926,7 @@ dependencies = [
 [[package]]
 name = "git-state"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 
 [[package]]
 name = "glob"
@@ -2974,7 +2976,7 @@ dependencies = [
 [[package]]
 name = "grovedb"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "axum 0.8.9",
  "bincode",
@@ -3013,7 +3015,7 @@ dependencies = [
 [[package]]
 name = "grovedb-bulk-append-tree"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "blake3",
@@ -3031,7 +3033,7 @@ dependencies = [
 [[package]]
 name = "grovedb-commitment-tree"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -3048,7 +3050,7 @@ dependencies = [
 [[package]]
 name = "grovedb-costs"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "integer-encoding",
  "intmap",
@@ -3058,7 +3060,7 @@ dependencies = [
 [[package]]
 name = "grovedb-dense-fixed-sized-merkle-tree"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "blake3",
@@ -3072,7 +3074,7 @@ dependencies = [
 [[package]]
 name = "grovedb-element"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -3088,7 +3090,7 @@ dependencies = [
 [[package]]
 name = "grovedb-epoch-based-storage-flags"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "grovedb-costs",
  "hex",
@@ -3100,7 +3102,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merk"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -3126,7 +3128,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merkle-mountain-range"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "blake3",
@@ -3139,7 +3141,7 @@ dependencies = [
 [[package]]
 name = "grovedb-path"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "hex",
 ]
@@ -3147,7 +3149,7 @@ dependencies = [
 [[package]]
 name = "grovedb-private-document-store"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -3160,7 +3162,7 @@ dependencies = [
 [[package]]
 name = "grovedb-query"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "bincode",
  "byteorder",
@@ -3176,7 +3178,7 @@ dependencies = [
 [[package]]
 name = "grovedb-storage"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "blake3",
  "grovedb-costs",
@@ -3195,7 +3197,7 @@ dependencies = [
 [[package]]
 name = "grovedb-version"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "thiserror 2.0.18",
  "versioned-feature-core 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -3204,7 +3206,7 @@ dependencies = [
 [[package]]
 name = "grovedb-visualize"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "hex",
  "itertools 0.14.0",
@@ -3213,7 +3215,7 @@ dependencies = [
 [[package]]
 name = "grovedbg-types"
 version = "5.0.1"
-source = "git+https://github.com/dashpay/grovedb?rev=753a11f14c9a4bc72bf2d5302751dd43d174621e#753a11f14c9a4bc72bf2d5302751dd43d174621e"
+source = "git+https://github.com/dashpay/grovedb?rev=6c882c3ee7d2c331f1feda2eb4223add9a6f0e45#6c882c3ee7d2c331f1feda2eb4223add9a6f0e45"
 dependencies = [
  "serde",
  "serde_with 3.21.0",
@@ -4062,7 +4064,7 @@ dependencies = [
 
 [[package]]
 name = "json-schema-compatibility-validator"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "assert_matches",
  "json-patch",
@@ -4136,7 +4138,7 @@ dependencies = [
 [[package]]
 name = "key-wallet"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "aes",
  "async-trait",
@@ -4165,7 +4167,7 @@ dependencies = [
 [[package]]
 name = "key-wallet-ffi"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "cbindgen 0.29.4",
  "dash-network",
@@ -4181,7 +4183,7 @@ dependencies = [
 [[package]]
 name = "key-wallet-manager"
 version = "0.45.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=a97b32c617c8b1fef5185bb806500b66faf8e8c4#a97b32c617c8b1fef5185bb806500b66faf8e8c4"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a#3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a"
 dependencies = [
  "async-trait",
  "bincode",
@@ -4205,7 +4207,7 @@ dependencies = [
 
 [[package]]
 name = "keyword-search-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "base58",
  "platform-value",
@@ -4394,7 +4396,7 @@ dependencies = [
 
 [[package]]
 name = "masternode-reward-shares-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -5156,7 +5158,7 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "platform-encryption"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "aes",
  "cbc",
@@ -5168,7 +5170,7 @@ dependencies = [
 
 [[package]]
 name = "platform-serialization"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "bincode",
  "platform-version",
@@ -5176,7 +5178,7 @@ dependencies = [
 
 [[package]]
 name = "platform-serialization-derive"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5186,7 +5188,7 @@ dependencies = [
 
 [[package]]
 name = "platform-value"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "base64 0.22.1",
  "bincode",
@@ -5205,7 +5207,7 @@ dependencies = [
 
 [[package]]
 name = "platform-value-convertible"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "quote",
  "syn 2.0.117",
@@ -5213,7 +5215,7 @@ dependencies = [
 
 [[package]]
 name = "platform-version"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "bincode",
  "grovedb-version",
@@ -5223,7 +5225,7 @@ dependencies = [
 
 [[package]]
 name = "platform-versioning"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5232,7 +5234,7 @@ dependencies = [
 
 [[package]]
 name = "platform-wallet"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -5272,7 +5274,7 @@ dependencies = [
 
 [[package]]
 name = "platform-wallet-ffi"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5300,7 +5302,7 @@ dependencies = [
 
 [[package]]
 name = "platform-wallet-storage"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "apple-native-keyring-store",
  "argon2",
@@ -5583,7 +5585,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
  "heck 0.4.1",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "petgraph",
@@ -5604,7 +5606,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5617,7 +5619,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -6311,7 +6313,7 @@ dependencies = [
 
 [[package]]
 name = "rs-dapi"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "async-trait",
  "axum 0.8.9",
@@ -6361,7 +6363,7 @@ dependencies = [
 
 [[package]]
 name = "rs-dapi-client"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "backon",
  "chrono",
@@ -6386,7 +6388,7 @@ dependencies = [
 
 [[package]]
 name = "rs-dash-event-bus"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "metrics",
  "tokio",
@@ -6419,7 +6421,7 @@ dependencies = [
 
 [[package]]
 name = "rs-sdk-ffi"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "async-trait",
  "bincode",
@@ -6454,7 +6456,7 @@ dependencies = [
 
 [[package]]
 name = "rs-sdk-trusted-context-provider"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "arc-swap",
  "dash-async",
@@ -6473,7 +6475,7 @@ dependencies = [
 
 [[package]]
 name = "rs-unified-sdk-ffi"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "dash-network",
  "key-wallet-ffi",
@@ -6483,7 +6485,7 @@ dependencies = [
 
 [[package]]
 name = "rs-unified-sdk-jni"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "android_logger",
  "dash-network",
@@ -7229,7 +7231,7 @@ checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "simple-signer"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -7237,6 +7239,7 @@ dependencies = [
  "dpp",
  "hex",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]
@@ -7365,7 +7368,7 @@ dependencies = [
 
 [[package]]
 name = "strategy-tests"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "bincode",
  "dpp",
@@ -7756,7 +7759,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "token-history-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -8604,7 +8607,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-utils-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "platform-value",
  "platform-version",
@@ -8747,7 +8750,7 @@ checksum = "a8145dd1593bf0fb137dbfa85b8be79ec560a447298955877804640e40c2d6ea"
 
 [[package]]
 name = "wasm-dpp"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8771,7 +8774,7 @@ dependencies = [
 
 [[package]]
 name = "wasm-dpp2"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8790,7 +8793,7 @@ dependencies = [
 
 [[package]]
 name = "wasm-drive-verify"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "base64 0.22.1",
  "bincode",
@@ -8845,7 +8848,7 @@ dependencies = [
 
 [[package]]
 name = "wasm-sdk"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "base64 0.22.1",
  "bip39",
@@ -9354,7 +9357,7 @@ dependencies = [
 
 [[package]]
 name = "withdrawals-contract"
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 dependencies = [
  "num_enum 0.5.11",
  "platform-value",
diff --git a/Cargo.toml b/Cargo.toml
index 3fc15cf0f3c..5cc7b246fc8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,14 +53,14 @@ members = [
 ]
 
 [workspace.dependencies]
-dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
-dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "a97b32c617c8b1fef5185bb806500b66faf8e8c4" }
+dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
+dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "3d13d9838c80fb5e67cf1f62cf5f3f4477bd5b9a" }
 
 tokio-metrics = "0.5"
 
@@ -138,5 +138,5 @@ opt-level = 3
 
 [workspace.package]
 
-version = "4.2.0-dev.1"
+version = "4.2.0-dev.2"
 rust-version = "1.92"
diff --git a/book/src/data-model/data-contracts.md b/book/src/data-model/data-contracts.md
index 0f53667ea26..21c4840a6c0 100644
--- a/book/src/data-model/data-contracts.md
+++ b/book/src/data-model/data-contracts.md
@@ -217,6 +217,32 @@ This intermediate format is important because serialization versions and code st
 
 There is also `versioned_limit_deserialize`, which imposes a size limit and always performs full validation -- this is used for data coming from untrusted sources (anything not from Drive's own storage).
 
+## Evolving a Contract: Adding Required Fields
+
+Contract updates are deliberately conservative: existing documents must stay valid and their stored bytes must stay readable, so most schema changes that would break either are rejected. Historically that froze the `required` set of a document type in both directions — requiredness is baked into the document wire format (required properties serialize raw, optional ones carry a presence flag), so changing it would desynchronize every stored document's bytes from the schema used to read them.
+
+From protocol v14, an update **may add a brand-new required property** by annotating it with `requiredSince` equal to the contract version the update creates:
+
+```json
+"properties": {
+  "newField": { "type": "string", "maxLength": 63, "position": 4, "requiredSince": 3 }
+},
+"required": ["existingField", "newField"]
+```
+
+The rules, enforced by consensus (`DataContractInvalidRequiredFieldsUpdateError`, code 10276, on violation):
+
+- The annotation must name **exactly the new contract version** — requiredness can be neither pre-scheduled for a future version nor backdated.
+- Only **brand-new properties** can become required. Promoting an existing (optional) property is still rejected, as is removing anything from `required` or touching an existing `requiredSince` annotation.
+- On contract **creation**, `requiredSince` may only be `1`.
+- Annotations sit on **top-level properties** listed in `required`; nested properties cannot carry them.
+
+What happens to data:
+
+- **Existing documents are grandfathered.** Each document carries a *contract version stamp* recording the contract version its bytes conform to (see [Document Serialization](../serialization/document-serialization.md)); a document stamped below a property's `requiredSince` may omit that property and still reads, transfers, and deletes normally.
+- **New writes are held to the new schema.** Creates must supply the property; replaces re-supply full content, so replacing a grandfathered document requires the new property and re-stamps the document at the current version — lazy migration, one document at a time.
+- **Indexes are unaffected** because index additions on update remain banned — a newly added required field cannot be indexed retroactively (there is no backfill).
+
 ## Rules and Guidelines
 
 **Do:**
diff --git a/book/src/data-model/documents.md b/book/src/data-model/documents.md
index 0b5d8f3a621..7ea45c75ff2 100644
--- a/book/src/data-model/documents.md
+++ b/book/src/data-model/documents.md
@@ -37,6 +37,7 @@ pub struct DocumentV0 {
     pub updated_at_core_block_height: Option<CoreBlockHeight>,
     pub transferred_at_core_block_height: Option<CoreBlockHeight>,
     pub creator_id: Option<Identifier>,
+    pub contract_version: Option<u32>,
 }
 ```
 
@@ -54,6 +55,8 @@ Let us walk through the key fields:
 
 - **`creator_id`**: The original creator of the document. This differs from `owner_id` when a document has been transferred to a new owner.
 
+- **`contract_version`**: The data contract version this document's bytes conform to — the *contract version stamp* (protocol v14+, document serialization format 3). Drive assigns it whenever document content is supplied (create and replace) and preserves it through transfers and purchases. `None` means the document was serialized before format 3, which predates every `requiredSince` annotation. The stamp resolves per-property byte layouts when a document type gains required properties through contract updates — see the [Document Serialization](../serialization/document-serialization.md) chapter.
+
 ## Document ID Generation
 
 Document IDs are not random -- they are derived deterministically. From `packages/rs-dpp/src/document/generate_document_id.rs`:
@@ -99,6 +102,7 @@ pub trait DocumentV0Getters {
     fn created_at_block_height(&self) -> Option<u64>;
     fn updated_at_block_height(&self) -> Option<u64>;
     fn creator_id(&self) -> Option<Identifier>;
+    fn contract_version(&self) -> Option<u32>;
     // ... and more
 }
 ```
diff --git a/book/src/drive/document-ranked-trees.md b/book/src/drive/document-ranked-trees.md
index 6197c622352..8a0343ceb40 100644
--- a/book/src/drive/document-ranked-trees.md
+++ b/book/src/drive/document-ranked-trees.md
@@ -91,7 +91,7 @@ One asymmetry is worth knowing when authoring: **the meta-schema demands the lit
 
 Two structural rules, both enforced at contract-parse time in rs-dpp:
 
-- **No aggregating index on a compound ranked index's full prefix.** Ranked flags are allowed on compound indexes, with **per-prefix** semantics: a ranked `[identityId, class]` puts the indexed tree at each prefix value's terminal `class` property-name level — one ordered secondary per `identityId`, each ranking only that identity's `class` groups. There is deliberately no global cross-prefix ordering; the query surfaces require every leading property to be pinned by an equality `where` clause. The one shape that stays impossible — and is rejected per document type, where all indexes are visible (`validate_no_ranked_prefix_overlap`) — is a countable/summable index terminating at exactly the compound's leading prefix: its aggregating value trees would demand the `NonCounted` / `NotSummed` shell around the ranked terminal tree, and the storage layer structurally rejects any wrapper around an indexed tree, because the wrapper would neutralise the very aggregates the secondaries order by. (Drive's fail-closed guard behind the parse-time check is `INDEXED_INNER_UNWRAPPABLE`.) Only the exact `n-1` prefix conflicts: an aggregating index at a shorter prefix wraps a plain intermediate tree, and one extending past the ranked terminal lives inside its value trees — both supported.
+- **No aggregating index on a compound ranked index's full prefix.** Ranked flags are allowed on compound indexes, with **per-prefix** semantics: a ranked `[identityId, class]` puts the indexed tree at each prefix value's terminal `class` property-name level — one ordered secondary per `identityId`, each ranking only that identity's `class` groups. There is deliberately no global cross-prefix ordering; the query surfaces require every leading property to be pinned by a `where` clause — equalities, plus at most one `IN` that fans out across prefix branches and merges deterministically. The one shape that stays impossible — and is rejected per document type, where all indexes are visible (`validate_no_ranked_prefix_overlap`) — is a countable/summable index terminating at exactly the compound's leading prefix: its aggregating value trees would demand the `NonCounted` / `NotSummed` shell around the ranked terminal tree, and the storage layer structurally rejects any wrapper around an indexed tree, because the wrapper would neutralise the very aggregates the secondaries order by. (Drive's fail-closed guard behind the parse-time check is `INDEXED_INNER_UNWRAPPABLE`.) Only the exact `n-1` prefix conflicts: an aggregating index at a shorter prefix wraps a plain intermediate tree, and one extending past the ranked terminal lives inside its value trees — both supported.
 - **Non-unique indexes only.** `ranked aggregates are not supported on unique indexes: each group of a unique index contains at most one document, so there is nothing meaningful to rank`. Contested indexes are covered transitively — a contested index is unique by construction, so it hits the same check rather than needing its own.
 
 ### Version Gate
@@ -231,7 +231,7 @@ Every ranked read — and, on the prove path, every ranked proof — is issued a
   / <last_index_property_name: utf-8>       // e.g. b"restaurantId"
 ```
 
-The children of that tree are the *groups*: one value tree per distinct value of the last index property, keyed by the raw index-key bytes of that value (for a `string` property, its UTF-8 bytes — e.g. `b"alpha"`). The secondary entries a top-k read returns are keyed by those same group keys. A compound index `[a, b]` inserts `<a> / <encoded pinned value of a>` between the doctype and the terminal `<b>` level — the value segment comes from the request's equality `where` pin on `a`, encoded with the same `serialize_value_for_key` the write path used to key that prefix's value tree, so the walk lands on **that prefix's own** indexed tree and secondary.
+The children of that tree are the *groups*: one value tree per distinct value of the last index property, keyed by the raw index-key bytes of that value (for a `string` property, its UTF-8 bytes — e.g. `b"alpha"`). The secondary entries a top-k read returns are keyed by those same group keys. A compound index `[a, b]` inserts `<a> / <encoded pinned value of a>` between the doctype and the terminal `<b>` level — the value segment comes from the request's `where` pin on `a` — an equality pin, or one element of the single permitted `IN` (one branch per element) — encoded with the same `serialize_value_for_key` the write path used to key that prefix's value tree, so the walk lands on **that prefix's own** indexed tree and secondary.
 
 Prover and verifier build this path through the same function, `DriveDocumentRankedQuery::indexed_property_name_tree_path` (with the pinned prefix values encoded by the shared resolver, `resolve_ranked_query_for_mode`), which is why they agree on the root hash by construction.
 
@@ -341,7 +341,7 @@ Note that the fixture puts each shape on its **own document type**. That's not a
 | Top / bottom K groups by sum of a property | `rankedSummable: true` on an index with `summable: "<prop>"` + `rangeSummable: true` |
 | Top / bottom K groups by average of a property | `rankedAverageable: true` on an index with `averageable: "<prop>"` + `rangeAverageable: true` (or the count+sum longhand) |
 | Two rankings on one index (e.g. by count *and* by average) | Both keywords. The tree is a PCPSIT carrying both axes in its TLV; you pay one secondary Merk per axis on every write. |
-| A ranking filtered by another property (`top 5 restaurants in London`) | A **compound ranked index** with the filter property leading: `[city, restaurantId]` with the ranked flags. Each city gets its own secondary; the query pins the prefix with an equality `where` (`WHERE city == "London" GROUP BY restaurantId ORDER BY <agg> DESC LIMIT 5`). Only equality pins — a range or `IN` on the prefix is rejected, and there is no cross-prefix (global) ordering on a compound ranked index. |
+| A ranking filtered by another property (`top 5 restaurants in London`) | A **compound ranked index** with the filter property leading: `[city, restaurantId]` with the ranked flags. Each city gets its own secondary; the query pins the prefix with an equality `where` (`WHERE city == "London" GROUP BY restaurantId ORDER BY <agg> DESC LIMIT 5`). Equality pins select one prefix; at most one pin may be an `IN` (2..=10 distinct elements; a never-written element — or one whose deeper pinned path was never written — contributes an empty branch), which walks one secondary per element and merges by `(aggregate, encoded prefix, group key)`, proved in one branched `PathQuery` envelope (shared ancestors proved once, per-element authenticated absence) — entries then carry `in_key`. A single-element `IN` normalizes to the equality pin; a `null` pin stays legal on its own but cannot combine with an `IN` (null addresses its prefix through an empty path segment the branched proof cannot express); a non-zero `OFFSET` is rejected together with `IN`; and branched proofs are generated from committed state only. A range operator on the prefix stays rejected, and there is still no global cross-prefix ordering beyond that merge. |
 | A ranking on a unique or contested index | Not available, and not meaningful: every group holds at most one document. |
 | Range aggregates without ranking (the 4.0 surface) | Just the `range*` flags. Ranking is strictly additive — adding it never changes what a range query returns. |
 | Nothing ranking-aware (default) | Don't set any `ranked*` flag. The terminal property-name tree keeps the type its range flags give it. |
diff --git a/book/src/error-handling/error-codes.md b/book/src/error-handling/error-codes.md
index 018dd014fd0..884dcfae15d 100644
--- a/book/src/error-handling/error-codes.md
+++ b/book/src/error-handling/error-codes.md
@@ -50,7 +50,7 @@ Error codes are organized into ranges that correspond to error categories and su
 |-------|----------|----------|
 | 10000-10099 | Versioning | `UnsupportedVersionError` (10000), `ProtocolVersionParsingError` (10001), `IncompatibleProtocolVersionError` (10004) |
 | 10100-10199 | Structure | `JsonSchemaCompilationError` (10100), `InvalidIdentifierError` (10102), `ValueError` (10103) |
-| 10200-10275 | Data Contract | `DataContractMaxDepthExceedError` (10200), `DuplicateIndexError` (10201), `InvalidDataContractIdError` (10204) |
+| 10200-10276 | Data Contract | `DataContractMaxDepthExceedError` (10200), `DuplicateIndexError` (10201), `InvalidDataContractIdError` (10204), `DataContractInvalidRequiredFieldsUpdateError` (10276) |
 | 10350-10359 | Groups | `GroupPositionDoesNotExistError` (10350), `GroupExceedsMaxMembersError` (10354) |
 | 10400-10418 | Documents | `DataContractNotPresentError` (10400), `DuplicateDocumentTransitionsWithIdsError` (10401) |
 | 10450-10460 | Tokens | `InvalidTokenIdError` (10450), `TokenTransferToOurselfError` (10456) |
diff --git a/book/src/serialization/document-serialization.md b/book/src/serialization/document-serialization.md
index a0b68c76b9e..8e24c32de44 100644
--- a/book/src/serialization/document-serialization.md
+++ b/book/src/serialization/document-serialization.md
@@ -11,7 +11,10 @@ Every serialized document follows this layout:
 ```text
 ┌──────────────────────┐
 │  Serialization       │  varint (1-2 bytes)
-│  Version             │  Currently: 0, 1, or 2
+│  Version             │  Currently: 0, 1, 2, or 3
+├──────────────────────┤
+│  Contract version    │  V3 only: varint
+│  stamp               │  (0 = unstamped)
 ├──────────────────────┤
 │  $id                 │  32 bytes
 ├──────────────────────┤
@@ -44,8 +47,9 @@ The first bytes of a serialized document are a **varint** encoding the serializa
 | 0 | Original format. All integers encoded as **i64** (8 bytes big-endian) regardless of their schema type. |
 | 1 | Integers encoded at their **native size** (u8 = 1 byte, u16 = 2 bytes, u32 = 4 bytes, etc.). Otherwise identical to v0. |
 | 2 | Same as v1, but adds **`$creatorId`** field after `$ownerId` for document types that support transfers or trading. |
+| 3 | Same as v2, but adds a **contract version stamp** varint immediately after the version varint (protocol v14+). The stamp selects each property's layout when the document type carries `requiredSince` annotations — see below. |
 
-The varint encoding uses the [`integer-encoding`](https://docs.rs/integer-encoding) crate's `VarInt` format. For values 0, 1, and 2, the varint is a single byte: `0x00`, `0x01`, or `0x02`.
+The varint encoding uses the [`integer-encoding`](https://docs.rs/integer-encoding) crate's `VarInt` format. For values 0 through 3, the varint is a single byte: `0x00`, `0x01`, `0x02`, or `0x03`.
 
 ```rust
 // Serialization version is written first
@@ -60,12 +64,36 @@ match serialized_version {
     0 => DocumentV0::from_bytes_v0(serialized_document, document_type, platform_version),
     1 => DocumentV0::from_bytes_v1(serialized_document, document_type, platform_version),
     2 => DocumentV0::from_bytes_v2(serialized_document, document_type, platform_version),
+    3 => DocumentV0::from_bytes_v3(serialized_document, document_type, platform_version),
     _ => Err(/* unknown version */),
 }
 ```
 
 Note: version 0 has a fallback — if deserialization as v0 (all i64) fails, it retries as v1 (native integer types). This handles edge cases from protocol versions 1–8 where the version byte was 0 but non-i64 integer types may have been used.
 
+## The contract version stamp (v3)
+
+Serialization version 3 (the default from protocol v14) writes one extra varint immediately after the version varint: the **contract version stamp** — the version of the data contract the document's bytes conform to. A value of `0` means *unstamped*: the document was originally serialized before format 3 existed and has merely been rewritten in the new envelope (for example by a transfer).
+
+The stamp exists because contract updates may add new **required** properties from a specific contract version onward, using the `requiredSince` schema keyword:
+
+```json
+"properties": {
+  "newField": { "type": "string", "maxLength": 63, "position": 4, "requiredSince": 3 }
+},
+"required": ["existingField", "newField"]
+```
+
+Requiredness is baked into the wire format — a required property serializes raw while an optional one carries a presence flag — so a property whose requiredness varies by contract version needs the stamp to resolve its layout. The rule, per property:
+
+> A property is encoded as **required** (no presence flag) if it is listed in `required` **and** either it has no `requiredSince` annotation, or the document's stamp is **at or above** the annotation. Otherwise it is encoded as optional (presence-flagged).
+
+An unstamped document (`0`) predates every `requiredSince` annotation, so only unconditionally required properties count as required for it. This means the **latest contract alone** reconstructs the byte layout of every document ever stored — no historical contract lookups are needed.
+
+The stamp is **platform-assigned**: Drive sets it to the current contract version whenever document content is supplied (create and replace), and preserves it untouched through server-side rewrites that do not re-supply content (transfer and purchase). A document created before a contract update therefore keeps its old stamp — and may legitimately omit properties the newest schema requires — until a replace re-supplies its content and re-stamps it. Clients can also use the stamp as a staleness signal: a document stamped above the client's cached contract version means the contract needs refetching.
+
+Formats 0–2 have no stamp; documents read from them deserialize with `contract_version = None`, equivalent to a `0` stamp.
+
 ## Field-by-field breakdown
 
 ### `$id` (32 bytes)
@@ -128,7 +156,7 @@ If the document type's `trade_mode` allows seller-set pricing:
 
 Properties are serialized **in schema position order** — each property in the data contract schema has a `position` field, and `document_type.properties()` returns an `IndexMap` sorted by that position. This is *not* alphabetical order.
 
-Each property is encoded based on its type and whether it is required:
+Each property is encoded based on its type and whether it is required. In serialization version 3, "required" means *required at the document's contract version stamp* (see above); in versions 0–2 — and for every property without a `requiredSince` annotation — it is simply whether the property is listed in `required`.
 
 **Required fields**: The value is written directly with no prefix byte.
 
@@ -255,3 +283,5 @@ See `packages/rs-scripts/README.md` for full usage details.
 5. **Optional fields have a presence byte.** If you forget to read the `0x00`/`0x01` prefix for optional fields, every subsequent field will be shifted by one byte.
 
 6. **ByteArray encoding depends on size constraints.** Fixed-size byte arrays (where `minItems == maxItems` in the schema) have no length prefix. Variable-size byte arrays have a varint length prefix. Check the schema to know which encoding is used.
+
+7. **In version 3, the same document type can produce different property layouts.** A property annotated with `requiredSince` is presence-flagged in documents stamped below the annotation and raw in documents stamped at or above it. Two version-3 documents of the same type may therefore differ in layout — always read the stamp varint and resolve each property's requiredness against it before decoding the properties section.
diff --git a/package.json b/package.json
index 7e26b7af7ef..876f3bb0329 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/platform",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "private": true,
   "scripts": {
     "setup": "yarn install && yarn run build && yarn run configure",
diff --git a/packages/bench-suite/package.json b/packages/bench-suite/package.json
index ef0f8fa96b5..ac8912c5f52 100644
--- a/packages/bench-suite/package.json
+++ b/packages/bench-suite/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@dashevo/bench-suite",
   "private": true,
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Dash Platform benchmark tool",
   "scripts": {
     "bench": "node ./bin/bench.js",
diff --git a/packages/dapi-grpc/clients/drive/v0/nodejs/drive_pbjs.js b/packages/dapi-grpc/clients/drive/v0/nodejs/drive_pbjs.js
index 0d1e656f487..c20469451a8 100644
--- a/packages/dapi-grpc/clients/drive/v0/nodejs/drive_pbjs.js
+++ b/packages/dapi-grpc/clients/drive/v0/nodejs/drive_pbjs.js
@@ -20039,6 +20039,7 @@ $root.org = (function() {
                          * @property {number} BETWEEN_EXCLUDE_RIGHT=8 BETWEEN_EXCLUDE_RIGHT value
                          * @property {number} IN=9 IN value
                          * @property {number} STARTS_WITH=10 STARTS_WITH value
+                         * @property {number} IN_TIME_RANGE=11 IN_TIME_RANGE value
                          */
                         GetDocumentsRequest.WhereOperator = (function() {
                             var valuesById = {}, values = Object.create(valuesById);
@@ -20053,6 +20054,7 @@ $root.org = (function() {
                             values[valuesById[8] = "BETWEEN_EXCLUDE_RIGHT"] = 8;
                             values[valuesById[9] = "IN"] = 9;
                             values[valuesById[10] = "STARTS_WITH"] = 10;
+                            values[valuesById[11] = "IN_TIME_RANGE"] = 11;
                             return values;
                         })();
 
@@ -20870,6 +20872,7 @@ $root.org = (function() {
                                     case 8:
                                     case 9:
                                     case 10:
+                                    case 11:
                                         break;
                                     }
                                 if (message.value != null && message.hasOwnProperty("value")) {
@@ -20939,6 +20942,10 @@ $root.org = (function() {
                                 case 10:
                                     message.operator = 10;
                                     break;
+                                case "IN_TIME_RANGE":
+                                case 11:
+                                    message.operator = 11;
+                                    break;
                                 }
                                 if (object.value != null) {
                                     if (typeof object.value !== "object")
@@ -26727,6 +26734,7 @@ $root.org = (function() {
                                  * @property {number|Long|null} [count] RankedEntry count
                                  * @property {number|Long|null} [sum] RankedEntry sum
                                  * @property {number|null} [avg] RankedEntry avg
+                                 * @property {Uint8Array|null} [inKey] RankedEntry inKey
                                  */
 
                                 /**
@@ -26776,6 +26784,14 @@ $root.org = (function() {
                                  */
                                 RankedEntry.prototype.avg = 0;
 
+                                /**
+                                 * RankedEntry inKey.
+                                 * @member {Uint8Array} inKey
+                                 * @memberof org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry
+                                 * @instance
+                                 */
+                                RankedEntry.prototype.inKey = $util.newBuffer([]);
+
                                 // OneOf field names bound to virtual getters and setters
                                 var $oneOfFields;
 
@@ -26822,6 +26838,8 @@ $root.org = (function() {
                                         writer.uint32(/* id 3, wireType 0 =*/24).sint64(message.sum);
                                     if (message.avg != null && Object.hasOwnProperty.call(message, "avg"))
                                         writer.uint32(/* id 4, wireType 1 =*/33).double(message.avg);
+                                    if (message.inKey != null && Object.hasOwnProperty.call(message, "inKey"))
+                                        writer.uint32(/* id 5, wireType 2 =*/42).bytes(message.inKey);
                                     return writer;
                                 };
 
@@ -26868,6 +26886,9 @@ $root.org = (function() {
                                         case 4:
                                             message.avg = reader.double();
                                             break;
+                                        case 5:
+                                            message.inKey = reader.bytes();
+                                            break;
                                         default:
                                             reader.skipType(tag & 7);
                                             break;
@@ -26926,6 +26947,9 @@ $root.org = (function() {
                                         if (typeof message.avg !== "number")
                                             return "avg: number expected";
                                     }
+                                    if (message.inKey != null && message.hasOwnProperty("inKey"))
+                                        if (!(message.inKey && typeof message.inKey.length === "number" || $util.isString(message.inKey)))
+                                            return "inKey: buffer expected";
                                     return null;
                                 };
 
@@ -26966,6 +26990,11 @@ $root.org = (function() {
                                             message.sum = new $util.LongBits(object.sum.low >>> 0, object.sum.high >>> 0).toNumber();
                                     if (object.avg != null)
                                         message.avg = Number(object.avg);
+                                    if (object.inKey != null)
+                                        if (typeof object.inKey === "string")
+                                            $util.base64.decode(object.inKey, message.inKey = $util.newBuffer($util.base64.length(object.inKey)), 0);
+                                        else if (object.inKey.length >= 0)
+                                            message.inKey = object.inKey;
                                     return message;
                                 };
 
@@ -26982,7 +27011,7 @@ $root.org = (function() {
                                     if (!options)
                                         options = {};
                                     var object = {};
-                                    if (options.defaults)
+                                    if (options.defaults) {
                                         if (options.bytes === String)
                                             object.key = "";
                                         else {
@@ -26990,6 +27019,14 @@ $root.org = (function() {
                                             if (options.bytes !== Array)
                                                 object.key = $util.newBuffer(object.key);
                                         }
+                                        if (options.bytes === String)
+                                            object.inKey = "";
+                                        else {
+                                            object.inKey = [];
+                                            if (options.bytes !== Array)
+                                                object.inKey = $util.newBuffer(object.inKey);
+                                        }
+                                    }
                                     if (message.key != null && message.hasOwnProperty("key"))
                                         object.key = options.bytes === String ? $util.base64.encode(message.key, 0, message.key.length) : options.bytes === Array ? Array.prototype.slice.call(message.key) : message.key;
                                     if (message.count != null && message.hasOwnProperty("count")) {
@@ -27013,6 +27050,8 @@ $root.org = (function() {
                                         if (options.oneofs)
                                             object.value = "avg";
                                     }
+                                    if (message.inKey != null && message.hasOwnProperty("inKey"))
+                                        object.inKey = options.bytes === String ? $util.base64.encode(message.inKey, 0, message.inKey.length) : options.bytes === Array ? Array.prototype.slice.call(message.inKey) : message.inKey;
                                     return object;
                                 };
 
diff --git a/packages/dapi-grpc/clients/platform/v0/nodejs/platform_pbjs.js b/packages/dapi-grpc/clients/platform/v0/nodejs/platform_pbjs.js
index 978be7d0743..13eaebf2a58 100644
--- a/packages/dapi-grpc/clients/platform/v0/nodejs/platform_pbjs.js
+++ b/packages/dapi-grpc/clients/platform/v0/nodejs/platform_pbjs.js
@@ -19531,6 +19531,7 @@ $root.org = (function() {
                          * @property {number} BETWEEN_EXCLUDE_RIGHT=8 BETWEEN_EXCLUDE_RIGHT value
                          * @property {number} IN=9 IN value
                          * @property {number} STARTS_WITH=10 STARTS_WITH value
+                         * @property {number} IN_TIME_RANGE=11 IN_TIME_RANGE value
                          */
                         GetDocumentsRequest.WhereOperator = (function() {
                             var valuesById = {}, values = Object.create(valuesById);
@@ -19545,6 +19546,7 @@ $root.org = (function() {
                             values[valuesById[8] = "BETWEEN_EXCLUDE_RIGHT"] = 8;
                             values[valuesById[9] = "IN"] = 9;
                             values[valuesById[10] = "STARTS_WITH"] = 10;
+                            values[valuesById[11] = "IN_TIME_RANGE"] = 11;
                             return values;
                         })();
 
@@ -20362,6 +20364,7 @@ $root.org = (function() {
                                     case 8:
                                     case 9:
                                     case 10:
+                                    case 11:
                                         break;
                                     }
                                 if (message.value != null && message.hasOwnProperty("value")) {
@@ -20431,6 +20434,10 @@ $root.org = (function() {
                                 case 10:
                                     message.operator = 10;
                                     break;
+                                case "IN_TIME_RANGE":
+                                case 11:
+                                    message.operator = 11;
+                                    break;
                                 }
                                 if (object.value != null) {
                                     if (typeof object.value !== "object")
@@ -26219,6 +26226,7 @@ $root.org = (function() {
                                  * @property {number|Long|null} [count] RankedEntry count
                                  * @property {number|Long|null} [sum] RankedEntry sum
                                  * @property {number|null} [avg] RankedEntry avg
+                                 * @property {Uint8Array|null} [inKey] RankedEntry inKey
                                  */
 
                                 /**
@@ -26268,6 +26276,14 @@ $root.org = (function() {
                                  */
                                 RankedEntry.prototype.avg = 0;
 
+                                /**
+                                 * RankedEntry inKey.
+                                 * @member {Uint8Array} inKey
+                                 * @memberof org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry
+                                 * @instance
+                                 */
+                                RankedEntry.prototype.inKey = $util.newBuffer([]);
+
                                 // OneOf field names bound to virtual getters and setters
                                 var $oneOfFields;
 
@@ -26314,6 +26330,8 @@ $root.org = (function() {
                                         writer.uint32(/* id 3, wireType 0 =*/24).sint64(message.sum);
                                     if (message.avg != null && Object.hasOwnProperty.call(message, "avg"))
                                         writer.uint32(/* id 4, wireType 1 =*/33).double(message.avg);
+                                    if (message.inKey != null && Object.hasOwnProperty.call(message, "inKey"))
+                                        writer.uint32(/* id 5, wireType 2 =*/42).bytes(message.inKey);
                                     return writer;
                                 };
 
@@ -26360,6 +26378,9 @@ $root.org = (function() {
                                         case 4:
                                             message.avg = reader.double();
                                             break;
+                                        case 5:
+                                            message.inKey = reader.bytes();
+                                            break;
                                         default:
                                             reader.skipType(tag & 7);
                                             break;
@@ -26418,6 +26439,9 @@ $root.org = (function() {
                                         if (typeof message.avg !== "number")
                                             return "avg: number expected";
                                     }
+                                    if (message.inKey != null && message.hasOwnProperty("inKey"))
+                                        if (!(message.inKey && typeof message.inKey.length === "number" || $util.isString(message.inKey)))
+                                            return "inKey: buffer expected";
                                     return null;
                                 };
 
@@ -26458,6 +26482,11 @@ $root.org = (function() {
                                             message.sum = new $util.LongBits(object.sum.low >>> 0, object.sum.high >>> 0).toNumber();
                                     if (object.avg != null)
                                         message.avg = Number(object.avg);
+                                    if (object.inKey != null)
+                                        if (typeof object.inKey === "string")
+                                            $util.base64.decode(object.inKey, message.inKey = $util.newBuffer($util.base64.length(object.inKey)), 0);
+                                        else if (object.inKey.length >= 0)
+                                            message.inKey = object.inKey;
                                     return message;
                                 };
 
@@ -26474,7 +26503,7 @@ $root.org = (function() {
                                     if (!options)
                                         options = {};
                                     var object = {};
-                                    if (options.defaults)
+                                    if (options.defaults) {
                                         if (options.bytes === String)
                                             object.key = "";
                                         else {
@@ -26482,6 +26511,14 @@ $root.org = (function() {
                                             if (options.bytes !== Array)
                                                 object.key = $util.newBuffer(object.key);
                                         }
+                                        if (options.bytes === String)
+                                            object.inKey = "";
+                                        else {
+                                            object.inKey = [];
+                                            if (options.bytes !== Array)
+                                                object.inKey = $util.newBuffer(object.inKey);
+                                        }
+                                    }
                                     if (message.key != null && message.hasOwnProperty("key"))
                                         object.key = options.bytes === String ? $util.base64.encode(message.key, 0, message.key.length) : options.bytes === Array ? Array.prototype.slice.call(message.key) : message.key;
                                     if (message.count != null && message.hasOwnProperty("count")) {
@@ -26505,6 +26542,8 @@ $root.org = (function() {
                                         if (options.oneofs)
                                             object.value = "avg";
                                     }
+                                    if (message.inKey != null && message.hasOwnProperty("inKey"))
+                                        object.inKey = options.bytes === String ? $util.base64.encode(message.inKey, 0, message.inKey.length) : options.bytes === Array ? Array.prototype.slice.call(message.inKey) : message.inKey;
                                     return object;
                                 };
 
diff --git a/packages/dapi-grpc/clients/platform/v0/nodejs/platform_protoc.js b/packages/dapi-grpc/clients/platform/v0/nodejs/platform_protoc.js
index 10f2641e792..fb135455827 100644
--- a/packages/dapi-grpc/clients/platform/v0/nodejs/platform_protoc.js
+++ b/packages/dapi-grpc/clients/platform/v0/nodejs/platform_protoc.js
@@ -24389,7 +24389,8 @@ proto.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereOperator = {
   BETWEEN_EXCLUDE_LEFT: 7,
   BETWEEN_EXCLUDE_RIGHT: 8,
   IN: 9,
-  STARTS_WITH: 10
+  STARTS_WITH: 10,
+  IN_TIME_RANGE: 11
 };
 
 
@@ -30659,7 +30660,8 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
     key: msg.getKey_asB64(),
     count: jspb.Message.getFieldWithDefault(msg, 2, "0"),
     sum: jspb.Message.getFieldWithDefault(msg, 3, "0"),
-    avg: jspb.Message.getFloatingPointFieldWithDefault(msg, 4, 0.0)
+    avg: jspb.Message.getFloatingPointFieldWithDefault(msg, 4, 0.0),
+    inKey: msg.getInKey_asB64()
   };
 
   if (includeInstance) {
@@ -30712,6 +30714,10 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
       var value = /** @type {number} */ (reader.readDouble());
       msg.setAvg(value);
       break;
+    case 5:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setInKey(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -30769,6 +30775,13 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
       f
     );
   }
+  f = /** @type {!(string|Uint8Array)} */ (jspb.Message.getField(message, 5));
+  if (f != null) {
+    writer.writeBytes(
+      5,
+      f
+    );
+  }
 };
 
 
@@ -30922,6 +30935,66 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
 };
 
 
+/**
+ * optional bytes in_key = 5;
+ * @return {string}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 5, ""));
+};
+
+
+/**
+ * optional bytes in_key = 5;
+ * This is a type-conversion wrapper around `getInKey()`
+ * @return {string}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getInKey()));
+};
+
+
+/**
+ * optional bytes in_key = 5;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getInKey()`
+ * @return {!Uint8Array}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getInKey()));
+};
+
+
+/**
+ * @param {!(string|Uint8Array)} value
+ * @return {!proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry} returns this
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.setInKey = function(value) {
+  return jspb.Message.setField(this, 5, value);
+};
+
+
+/**
+ * Clears the field making it undefined.
+ * @return {!proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry} returns this
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.clearInKey = function() {
+  return jspb.Message.setField(this, 5, undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.hasInKey = function() {
+  return jspb.Message.getField(this, 5) != null;
+};
+
+
 
 /**
  * List of repeated fields within this message type.
diff --git a/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.h b/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.h
index c37388a2691..64fcd94d1db 100644
--- a/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.h
+++ b/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.h
@@ -385,6 +385,21 @@ typedef GPB_ENUM(GetDocumentsRequest_WhereOperator) {
   GetDocumentsRequest_WhereOperator_BetweenExcludeRight = 8,
   GetDocumentsRequest_WhereOperator_In = 9,
   GetDocumentsRequest_WhereOperator_StartsWith = 10,
+
+  /**
+   * Time-range bucket selection (v1 only; the v0 CBOR surface is
+   * unaffected). `field` names a timestamp covered by a `timeRange`
+   * index. Operand: `text` selector `"newest"`/`"oldest"` when one grid
+   * buckets the field, or `list` `[selector, range, step(, phase)]` in
+   * the contract's declared seconds to name one of several grids (zero
+   * phase is spelled by omission — one wire spelling per grid). The
+   * server resolves it to a bucket-start equality from current block
+   * time; the verifier re-derives the same bucket from the quorum-signed
+   * metadata time — an ordinary index/count proof. See `timeRange` in
+   * the document meta-schema and
+   * `drive::query::resolve_time_range_bucket_clause`.
+   **/
+  GetDocumentsRequest_WhereOperator_InTimeRange = 11,
 };
 
 GPBEnumDescriptor *GetDocumentsRequest_WhereOperator_EnumDescriptor(void);
@@ -2941,16 +2956,16 @@ typedef GPB_ENUM(GetDocumentsRequest_GetDocumentsRequestV1_Start_OneOfCase) {
  * - a is the In field AND b is the range field, in that order → existing compound distinct shape; entries carry both `in_key` (= a's value) and `key` (= b's value).
  *
  * `select=<COUNT(*)|SUM(f)|AVG(f)>, group_by=[p], order_by=[<the selected aggregate>]` (protocol v14+) — **ranked mode**:
- * - exactly one `group_by` property, exactly one `order_by` clause naming the select's aggregate (`f` for `SUM(f)` / `AVG(f)`, the `$count` sentinel for `COUNT(*)`), a `limit` in `1 ..= 100`, an optional `offset`, and no `having` / `start_at`, on an index declaring the matching `rankedCountable` / `rankedSummable` / `rankedAverageable` axis → ranked executor, answered in `ResultData.ranked`. On a single-property ranked index no `where` is accepted; on a compound ranked index every leading index property must be pinned with an `EQUAL` where clause (one per property, `group_by` names the trailing property), selecting which prefix's ranking is read.
+ * - exactly one `group_by` property, exactly one `order_by` clause naming the select's aggregate (`f` for `SUM(f)` / `AVG(f)`, the `$count` sentinel for `COUNT(*)`), a `limit` in `1 ..= 100`, an optional `offset`, and no `having` / `start_at`, on an index declaring the matching `rankedCountable` / `rankedSummable` / `rankedAverageable` axis → ranked executor, answered in `ResultData.ranked`. On a single-property ranked index no `where` is accepted; on a compound ranked index every leading index property must be pinned (one clause per property, `group_by` names the trailing property) — `EQUAL` pins one prefix, and **at most one** clause may be `IN` (2..=10 distinct elements, `null` legal; a single-element `IN` normalizes to the equality pin; an element whose prefix was never written — at any depth of its pinned chain — contributes an empty branch, union semantics), fanning the walk out across one prefix branch per element and merging by `(aggregate, encoded prefix, group key)`; merged entries carry `in_key`. A non-zero `offset` is rejected together with `IN` (rank-skip is per-secondary; `OFFSET 0` is the offset-free request).
  * - `DESC` is the "top n" reading (walk the axis from the largest aggregate down), `ASC` the "bottom n" reading. Worked example: `SELECT AVG(grade) GROUP BY restaurantId ORDER BY grade DESC LIMIT 1 OFFSET 4` is the 5th-best restaurant.
  *
  * `select=<COUNT(*)|SUM(f)|AVG(f)>, group_by=[p], having=[<the selected aggregate> <op> <value>]` (protocol v14+) — **having-range mode**:
- * - exactly one `group_by` property, exactly one `having` clause whose aggregate is the select's aggregate, an operator describing one contiguous range (`EQUAL`, `GREATER_THAN[_OR_EQUALS]`, `LESS_THAN[_OR_EQUALS]`, `BETWEEN*`; `NOT_EQUAL` / `IN` rejected), a `limit` in `1 ..= 100`, an optional `order_by` naming the same aggregate (walk direction; ascending by default), and no `offset` / `start_at` / `start_after`, on an index declaring the matching ranked axis → having-range executor, answered in `ResultData.ranked`. `where` follows the same rule as ranked mode: none on a single-property ranked index; exactly one `EQUAL` pin per leading index property on a compound ranked index.
+ * - exactly one `group_by` property, exactly one `having` clause whose aggregate is the select's aggregate, an operator describing one contiguous range (`EQUAL`, `GREATER_THAN[_OR_EQUALS]`, `LESS_THAN[_OR_EQUALS]`, `BETWEEN*`; `NOT_EQUAL` / `IN` rejected), a `limit` in `1 ..= 100`, an optional `order_by` naming the same aggregate (walk direction; ascending by default), and no `offset` / `start_at` / `start_after`, on an index declaring the matching ranked axis → having-range executor, answered in `ResultData.ranked`. `where` follows the same rule as ranked mode: none on a single-property ranked index; exactly one pin per leading index property on a compound ranked index, at most one of them an `IN` (2..=10 distinct elements) that fans the bound out across prefix branches and merges, entries carrying `in_key`.
  * - no offset or cursor pagination: a page cut at `limit` continues only by tightening the bound past the last *distinct* aggregate value seen; a cut inside a tie (several groups sharing the boundary aggregate) cannot be continued, so size `limit` above the widest expected tie.
  *
  * **Rejected shapes** (return `Unsupported`):
- * - any non-empty `having` on protocol v13 and earlier; at v14+, any `having` shape outside having-range mode above (multiple clauses, an aggregate other than the select's, `NOT_EQUAL` / `IN`, a `where` shape other than the compound-index equality pins above, or a carried `offset` / cursor).
- * - at v14+: a ranked-shaped request carrying a `where` shape other than the compound-index equality pins above (a non-`EQUAL` operator, a repeated or non-leading property, or a missing pin), a `start_at` / `start_after` cursor, more than one `order_by`, or an `order_by` naming anything but the selected aggregate.
+ * - any non-empty `having` on protocol v13 and earlier; at v14+, any `having` shape outside having-range mode above (multiple clauses, an aggregate other than the select's, `NOT_EQUAL` / `IN` as the having operator, a `where` shape other than the compound-index prefix pins above — equality pins plus at most one bounded `IN` — or a carried `offset` / cursor).
+ * - at v14+: a ranked-shaped request carrying a `where` shape other than the compound-index prefix pins above (an operator other than `EQUAL` or the one permitted `IN`, more than one `IN`, a `null` pin combined with an `IN`, a repeated or non-leading property, or a missing pin), a `start_at` / `start_after` cursor, more than one `order_by`, or an `order_by` naming anything but the selected aggregate.
  * - `select=DOCUMENTS` with non-empty `group_by`.
  * - `select=COUNT` with `group_by` on a field that is not constrained by an `In` or range where clause.
  * - `select=COUNT` with `group_by.len() > 2`.
@@ -3717,6 +3732,7 @@ typedef GPB_ENUM(GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNu
   GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNumber_Count = 2,
   GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNumber_Sum = 3,
   GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNumber_Avg = 4,
+  GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNumber_InKey = 5,
 };
 
 typedef GPB_ENUM(GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_Value_OneOfCase) {
@@ -3801,6 +3817,19 @@ GPB_FINAL @interface GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry : G
  **/
 @property(nonatomic, readwrite) double avg;
 
+/**
+ * The prefix branch this entry came from, set **only** on an
+ * `IN`-pinned request (see the supported-shape table): the
+ * encoded index-key bytes of the `IN` property's pinned value —
+ * empty bytes for the `null` (absent-value) branch. Absent on
+ * single-prefix responses. The same group key can legally appear
+ * under two prefixes, so `(in_key, key)` is the entry's identity
+ * on a merged page, exactly as on `CountEntry`.
+ **/
+@property(nonatomic, readwrite, copy, null_resettable) NSData *inKey;
+/** Test to see if @c inKey has been set. */
+@property(nonatomic, readwrite) BOOL hasInKey;
+
 @end
 
 /**
diff --git a/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.m b/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.m
index dd6f5cb79a7..ece0c15cfa6 100644
--- a/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.m
+++ b/packages/dapi-grpc/clients/platform/v0/objective-c/Platform.pbobjc.m
@@ -5155,7 +5155,7 @@ void GetDocumentsRequest_ClearVersionOneOfCase(GetDocumentsRequest *message) {
         "Equal\000GreaterThan\000GreaterThanOrEquals\000Le"
         "ssThan\000LessThanOrEquals\000Between\000BetweenE"
         "xcludeBounds\000BetweenExcludeLeft\000BetweenE"
-        "xcludeRight\000In\000StartsWith\000";
+        "xcludeRight\000In\000StartsWith\000InTimeRange\000";
     static const int32_t values[] = {
         GetDocumentsRequest_WhereOperator_Equal,
         GetDocumentsRequest_WhereOperator_GreaterThan,
@@ -5168,6 +5168,7 @@ void GetDocumentsRequest_ClearVersionOneOfCase(GetDocumentsRequest *message) {
         GetDocumentsRequest_WhereOperator_BetweenExcludeRight,
         GetDocumentsRequest_WhereOperator_In,
         GetDocumentsRequest_WhereOperator_StartsWith,
+        GetDocumentsRequest_WhereOperator_InTimeRange,
     };
     GPBEnumDescriptor *worker =
         [GPBEnumDescriptor allocDescriptorForName:GPBNSStringifySymbol(GetDocumentsRequest_WhereOperator)
@@ -5196,6 +5197,7 @@ BOOL GetDocumentsRequest_WhereOperator_IsValidValue(int32_t value__) {
     case GetDocumentsRequest_WhereOperator_BetweenExcludeRight:
     case GetDocumentsRequest_WhereOperator_In:
     case GetDocumentsRequest_WhereOperator_StartsWith:
+    case GetDocumentsRequest_WhereOperator_InTimeRange:
       return YES;
     default:
       return NO;
@@ -7164,10 +7166,12 @@ @implementation GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry
 @dynamic count;
 @dynamic sum;
 @dynamic avg;
+@dynamic hasInKey, inKey;
 
 typedef struct GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry__storage_ {
   uint32_t _has_storage_[2];
   NSData *key;
+  NSData *inKey;
   uint64_t count;
   int64_t sum;
   double avg;
@@ -7215,6 +7219,15 @@ + (GPBDescriptor *)descriptor {
         .flags = GPBFieldOptional,
         .dataType = GPBDataTypeDouble,
       },
+      {
+        .name = "inKey",
+        .dataTypeSpecific.clazz = Nil,
+        .number = GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry_FieldNumber_InKey,
+        .hasIndex = 1,
+        .offset = (uint32_t)offsetof(GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry__storage_, inKey),
+        .flags = GPBFieldOptional,
+        .dataType = GPBDataTypeBytes,
+      },
     };
     GPBDescriptor *localDescriptor =
         [GPBDescriptor allocDescriptorForClass:[GetDocumentsResponse_GetDocumentsResponseV1_RankedEntry class]
diff --git a/packages/dapi-grpc/clients/platform/v0/python/platform_pb2.py b/packages/dapi-grpc/clients/platform/v0/python/platform_pb2.py
index 004bbbe6f33..d02d728b0cc 100644
--- a/packages/dapi-grpc/clients/platform/v0/python/platform_pb2.py
+++ b/packages/dapi-grpc/clients/platform/v0/python/platform_pb2.py
@@ -23,7 +23,7 @@
   syntax='proto3',
   serialized_options=None,
   create_key=_descriptor._internal_create_key,
-  serialized_pb=b'\n\x0eplatform.proto\x12\x19org.dash.platform.dapi.v0\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x81\x01\n\x05Proof\x12\x15\n\rgrovedb_proof\x18\x01 \x01(\x0c\x12\x13\n\x0bquorum_hash\x18\x02 \x01(\x0c\x12\x11\n\tsignature\x18\x03 \x01(\x0c\x12\r\n\x05round\x18\x04 \x01(\r\x12\x15\n\rblock_id_hash\x18\x05 \x01(\x0c\x12\x13\n\x0bquorum_type\x18\x06 \x01(\r\"\x98\x01\n\x10ResponseMetadata\x12\x12\n\x06height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12 \n\x18\x63ore_chain_locked_height\x18\x02 \x01(\r\x12\r\n\x05\x65poch\x18\x03 \x01(\r\x12\x13\n\x07time_ms\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x18\n\x10protocol_version\x18\x05 \x01(\r\x12\x10\n\x08\x63hain_id\x18\x06 \x01(\t\"L\n\x1dStateTransitionBroadcastError\x12\x0c\n\x04\x63ode\x18\x01 \x01(\r\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x0c\n\x04\x64\x61ta\x18\x03 \x01(\x0c\";\n\x1f\x42roadcastStateTransitionRequest\x12\x18\n\x10state_transition\x18\x01 \x01(\x0c\"\"\n BroadcastStateTransitionResponse\"\xa4\x01\n\x12GetIdentityRequest\x12P\n\x02v0\x18\x01 \x01(\x0b\x32\x42.org.dash.platform.dapi.v0.GetIdentityRequest.GetIdentityRequestV0H\x00\x1a\x31\n\x14GetIdentityRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xc1\x01\n\x17GetIdentityNonceRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetIdentityNonceRequest.GetIdentityNonceRequestV0H\x00\x1a?\n\x19GetIdentityNonceRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf6\x01\n\x1fGetIdentityContractNonceRequest\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentityContractNonceRequest.GetIdentityContractNonceRequestV0H\x00\x1a\\\n!GetIdentityContractNonceRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x13\n\x0b\x63ontract_id\x18\x02 \x01(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xc0\x01\n\x19GetIdentityBalanceRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetIdentityBalanceRequest.GetIdentityBalanceRequestV0H\x00\x1a\x38\n\x1bGetIdentityBalanceRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xec\x01\n$GetIdentityBalanceAndRevisionRequest\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionRequest.GetIdentityBalanceAndRevisionRequestV0H\x00\x1a\x43\n&GetIdentityBalanceAndRevisionRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9e\x02\n\x13GetIdentityResponse\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetIdentityResponse.GetIdentityResponseV0H\x00\x1a\xa7\x01\n\x15GetIdentityResponseV0\x12\x12\n\x08identity\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbc\x02\n\x18GetIdentityNonceResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetIdentityNonceResponse.GetIdentityNonceResponseV0H\x00\x1a\xb6\x01\n\x1aGetIdentityNonceResponseV0\x12\x1c\n\x0eidentity_nonce\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xe5\x02\n GetIdentityContractNonceResponse\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentityContractNonceResponse.GetIdentityContractNonceResponseV0H\x00\x1a\xc7\x01\n\"GetIdentityContractNonceResponseV0\x12%\n\x17identity_contract_nonce\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbd\x02\n\x1aGetIdentityBalanceResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetIdentityBalanceResponse.GetIdentityBalanceResponseV0H\x00\x1a\xb1\x01\n\x1cGetIdentityBalanceResponseV0\x12\x15\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb1\x04\n%GetIdentityBalanceAndRevisionResponse\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse.GetIdentityBalanceAndRevisionResponseV0H\x00\x1a\x84\x03\n\'GetIdentityBalanceAndRevisionResponseV0\x12\x9b\x01\n\x14\x62\x61lance_and_revision\x18\x01 \x01(\x0b\x32{.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse.GetIdentityBalanceAndRevisionResponseV0.BalanceAndRevisionH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a?\n\x12\x42\x61lanceAndRevision\x12\x13\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x14\n\x08revision\x18\x02 \x01(\x04\x42\x02\x30\x01\x42\x08\n\x06resultB\t\n\x07version\"\xd1\x01\n\x0eKeyRequestType\x12\x36\n\x08\x61ll_keys\x18\x01 \x01(\x0b\x32\".org.dash.platform.dapi.v0.AllKeysH\x00\x12@\n\rspecific_keys\x18\x02 \x01(\x0b\x32\'.org.dash.platform.dapi.v0.SpecificKeysH\x00\x12:\n\nsearch_key\x18\x03 \x01(\x0b\x32$.org.dash.platform.dapi.v0.SearchKeyH\x00\x42\t\n\x07request\"\t\n\x07\x41llKeys\"\x1f\n\x0cSpecificKeys\x12\x0f\n\x07key_ids\x18\x01 \x03(\r\"\xb6\x01\n\tSearchKey\x12I\n\x0bpurpose_map\x18\x01 \x03(\x0b\x32\x34.org.dash.platform.dapi.v0.SearchKey.PurposeMapEntry\x1a^\n\x0fPurposeMapEntry\x12\x0b\n\x03key\x18\x01 \x01(\r\x12:\n\x05value\x18\x02 \x01(\x0b\x32+.org.dash.platform.dapi.v0.SecurityLevelMap:\x02\x38\x01\"\xbf\x02\n\x10SecurityLevelMap\x12]\n\x12security_level_map\x18\x01 \x03(\x0b\x32\x41.org.dash.platform.dapi.v0.SecurityLevelMap.SecurityLevelMapEntry\x1aw\n\x15SecurityLevelMapEntry\x12\x0b\n\x03key\x18\x01 \x01(\r\x12M\n\x05value\x18\x02 \x01(\x0e\x32>.org.dash.platform.dapi.v0.SecurityLevelMap.KeyKindRequestType:\x02\x38\x01\"S\n\x12KeyKindRequestType\x12\x1f\n\x1b\x43URRENT_KEY_OF_KIND_REQUEST\x10\x00\x12\x1c\n\x18\x41LL_KEYS_OF_KIND_REQUEST\x10\x01\"\xda\x02\n\x16GetIdentityKeysRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetIdentityKeysRequest.GetIdentityKeysRequestV0H\x00\x1a\xda\x01\n\x18GetIdentityKeysRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12?\n\x0crequest_type\x18\x02 \x01(\x0b\x32).org.dash.platform.dapi.v0.KeyRequestType\x12+\n\x05limit\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x04 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\x99\x03\n\x17GetIdentityKeysResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetIdentityKeysResponse.GetIdentityKeysResponseV0H\x00\x1a\x96\x02\n\x19GetIdentityKeysResponseV0\x12\x61\n\x04keys\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetIdentityKeysResponse.GetIdentityKeysResponseV0.KeysH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1a\n\x04Keys\x12\x12\n\nkeys_bytes\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xef\x02\n GetIdentitiesContractKeysRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentitiesContractKeysRequest.GetIdentitiesContractKeysRequestV0H\x00\x1a\xd1\x01\n\"GetIdentitiesContractKeysRequestV0\x12\x16\n\x0eidentities_ids\x18\x01 \x03(\x0c\x12\x13\n\x0b\x63ontract_id\x18\x02 \x01(\x0c\x12\x1f\n\x12\x64ocument_type_name\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x37\n\x08purposes\x18\x04 \x03(\x0e\x32%.org.dash.platform.dapi.v0.KeyPurpose\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x15\n\x13_document_type_nameB\t\n\x07version\"\xdf\x06\n!GetIdentitiesContractKeysResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0H\x00\x1a\xbe\x05\n#GetIdentitiesContractKeysResponseV0\x12\x8a\x01\n\x0fidentities_keys\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.IdentitiesKeysH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aY\n\x0bPurposeKeys\x12\x36\n\x07purpose\x18\x01 \x01(\x0e\x32%.org.dash.platform.dapi.v0.KeyPurpose\x12\x12\n\nkeys_bytes\x18\x02 \x03(\x0c\x1a\x9f\x01\n\x0cIdentityKeys\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12z\n\x04keys\x18\x02 \x03(\x0b\x32l.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.PurposeKeys\x1a\x90\x01\n\x0eIdentitiesKeys\x12~\n\x07\x65ntries\x18\x01 \x03(\x0b\x32m.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.IdentityKeysB\x08\n\x06resultB\t\n\x07version\"\xa4\x02\n*GetEvonodesProposedEpochBlocksByIdsRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByIdsRequest.GetEvonodesProposedEpochBlocksByIdsRequestV0H\x00\x1ah\n,GetEvonodesProposedEpochBlocksByIdsRequestV0\x12\x12\n\x05\x65poch\x18\x01 \x01(\rH\x00\x88\x01\x01\x12\x0b\n\x03ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\x08\n\x06_epochB\t\n\x07version\"\x92\x06\n&GetEvonodesProposedEpochBlocksResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0H\x00\x1a\xe2\x04\n(GetEvonodesProposedEpochBlocksResponseV0\x12\xb1\x01\n#evonodes_proposed_block_counts_info\x18\x01 \x01(\x0b\x32\x81\x01.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0.EvonodesProposedBlocksH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a?\n\x15\x45vonodeProposedBlocks\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x02 \x01(\x04\x42\x02\x30\x01\x1a\xc4\x01\n\x16\x45vonodesProposedBlocks\x12\xa9\x01\n\x1e\x65vonodes_proposed_block_counts\x18\x01 \x03(\x0b\x32\x80\x01.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0.EvonodeProposedBlocksB\x08\n\x06resultB\t\n\x07version\"\xf2\x02\n,GetEvonodesProposedEpochBlocksByRangeRequest\x12\x84\x01\n\x02v0\x18\x01 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByRangeRequest.GetEvonodesProposedEpochBlocksByRangeRequestV0H\x00\x1a\xaf\x01\n.GetEvonodesProposedEpochBlocksByRangeRequestV0\x12\x12\n\x05\x65poch\x18\x01 \x01(\rH\x01\x88\x01\x01\x12\x12\n\x05limit\x18\x02 \x01(\rH\x02\x88\x01\x01\x12\x15\n\x0bstart_after\x18\x03 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x04 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x07\n\x05startB\x08\n\x06_epochB\x08\n\x06_limitB\t\n\x07version\"\xcd\x01\n\x1cGetIdentitiesBalancesRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetIdentitiesBalancesRequest.GetIdentitiesBalancesRequestV0H\x00\x1a<\n\x1eGetIdentitiesBalancesRequestV0\x12\x0b\n\x03ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9f\x05\n\x1dGetIdentitiesBalancesResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0H\x00\x1a\x8a\x04\n\x1fGetIdentitiesBalancesResponseV0\x12\x8a\x01\n\x13identities_balances\x18\x01 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0.IdentitiesBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aL\n\x0fIdentityBalance\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x18\n\x07\x62\x61lance\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\x8f\x01\n\x12IdentitiesBalances\x12y\n\x07\x65ntries\x18\x01 \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0.IdentityBalanceB\x08\n\x06resultB\t\n\x07version\"\xb4\x01\n\x16GetDataContractRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetDataContractRequest.GetDataContractRequestV0H\x00\x1a\x35\n\x18GetDataContractRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xb3\x02\n\x17GetDataContractResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetDataContractResponse.GetDataContractResponseV0H\x00\x1a\xb0\x01\n\x19GetDataContractResponseV0\x12\x17\n\rdata_contract\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb9\x01\n\x17GetDataContractsRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetDataContractsRequest.GetDataContractsRequestV0H\x00\x1a\x37\n\x19GetDataContractsRequestV0\x12\x0b\n\x03ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xcf\x04\n\x18GetDataContractsResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetDataContractsResponse.GetDataContractsResponseV0H\x00\x1a[\n\x11\x44\x61taContractEntry\x12\x12\n\nidentifier\x18\x01 \x01(\x0c\x12\x32\n\rdata_contract\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.BytesValue\x1au\n\rDataContracts\x12\x64\n\x15\x64\x61ta_contract_entries\x18\x01 \x03(\x0b\x32\x45.org.dash.platform.dapi.v0.GetDataContractsResponse.DataContractEntry\x1a\xf5\x01\n\x1aGetDataContractsResponseV0\x12[\n\x0e\x64\x61ta_contracts\x18\x01 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDataContractsResponse.DataContractsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc5\x02\n\x1dGetDataContractHistoryRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetDataContractHistoryRequest.GetDataContractHistoryRequestV0H\x00\x1a\xb0\x01\n\x1fGetDataContractHistoryRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12+\n\x05limit\x18\x02 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0bstart_at_ms\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\xb2\x05\n\x1eGetDataContractHistoryResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0H\x00\x1a\x9a\x04\n GetDataContractHistoryResponseV0\x12\x8f\x01\n\x15\x64\x61ta_contract_history\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0.DataContractHistoryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a;\n\x18\x44\x61taContractHistoryEntry\x12\x10\n\x04\x64\x61te\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05value\x18\x02 \x01(\x0c\x1a\xaa\x01\n\x13\x44\x61taContractHistory\x12\x92\x01\n\x15\x64\x61ta_contract_entries\x18\x01 \x03(\x0b\x32s.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0.DataContractHistoryEntryB\x08\n\x06resultB\t\n\x07version\"\xde\x15\n\x13GetDocumentsRequest\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV0H\x00\x12R\n\x02v1\x18\x02 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1H\x00\x1a\xfe\x02\n\x12\x44ocumentFieldValue\x12\x14\n\nbool_value\x18\x01 \x01(\x08H\x00\x12\x19\n\x0bint64_value\x18\x02 \x01(\x12\x42\x02\x30\x01H\x00\x12\x1a\n\x0cuint64_value\x18\x03 \x01(\x04\x42\x02\x30\x01H\x00\x12\x16\n\x0c\x64ouble_value\x18\x04 \x01(\x01H\x00\x12\x0e\n\x04text\x18\x05 \x01(\tH\x00\x12\x15\n\x0b\x62ytes_value\x18\x06 \x01(\x0cH\x00\x12[\n\x04list\x18\x07 \x01(\x0b\x32K.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValue.ValueListH\x00\x12\x14\n\nnull_value\x18\x08 \x01(\x08H\x00\x1a^\n\tValueList\x12Q\n\x06values\x18\x01 \x03(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValueB\t\n\x07variant\x1a\xbe\x01\n\x0bWhereClause\x12\r\n\x05\x66ield\x18\x01 \x01(\t\x12N\n\x08operator\x18\x02 \x01(\x0e\x32<.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereOperator\x12P\n\x05value\x18\x03 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValue\x1a\xa4\x01\n\x0fHavingAggregate\x12Y\n\x08\x66unction\x18\x01 \x01(\x0e\x32G.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregate.Function\x12\r\n\x05\x66ield\x18\x02 \x01(\t\"\'\n\x08\x46unction\x12\t\n\x05\x43OUNT\x10\x00\x12\x07\n\x03SUM\x10\x01\x12\x07\n\x03\x41VG\x10\x02\x1a\xf9\x03\n\x0cHavingClause\x12Q\n\taggregate\x18\x01 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregate\x12V\n\x08operator\x18\x02 \x01(\x0e\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingClause.Operator\x12R\n\x05value\x18\x03 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValueH\x00\"\xe0\x01\n\x08Operator\x12\t\n\x05\x45QUAL\x10\x00\x12\r\n\tNOT_EQUAL\x10\x01\x12\x10\n\x0cGREATER_THAN\x10\x02\x12\x1a\n\x16GREATER_THAN_OR_EQUALS\x10\x03\x12\r\n\tLESS_THAN\x10\x04\x12\x17\n\x13LESS_THAN_OR_EQUALS\x10\x05\x12\x0b\n\x07\x42\x45TWEEN\x10\x06\x12\x1a\n\x16\x42\x45TWEEN_EXCLUDE_BOUNDS\x10\x07\x12\x18\n\x14\x42\x45TWEEN_EXCLUDE_LEFT\x10\x08\x12\x19\n\x15\x42\x45TWEEN_EXCLUDE_RIGHT\x10\t\x12\x06\n\x02IN\x10\nB\x07\n\x05right\x1a\x90\x01\n\x0bOrderClause\x12\x0f\n\x05\x66ield\x18\x01 \x01(\tH\x00\x12S\n\taggregate\x18\x03 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregateH\x00\x12\x11\n\tascending\x18\x02 \x01(\x08\x42\x08\n\x06target\x1a\xbb\x01\n\x15GetDocumentsRequestV0\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x15\n\rdocument_type\x18\x02 \x01(\t\x12\r\n\x05where\x18\x03 \x01(\x0c\x12\x10\n\x08order_by\x18\x04 \x01(\x0c\x12\r\n\x05limit\x18\x05 \x01(\r\x12\x15\n\x0bstart_after\x18\x06 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x07 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x08 \x01(\x08\x42\x07\n\x05start\x1a\xf3\x05\n\x15GetDocumentsRequestV1\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x15\n\rdocument_type\x18\x02 \x01(\t\x12Q\n\rwhere_clauses\x18\x03 \x03(\x0b\x32:.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereClause\x12L\n\x08order_by\x18\x04 \x03(\x0b\x32:.org.dash.platform.dapi.v0.GetDocumentsRequest.OrderClause\x12\x12\n\x05limit\x18\x05 \x01(\rH\x01\x88\x01\x01\x12\x15\n\x0bstart_after\x18\x06 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x07 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x08 \x01(\x08\x12\\\n\x07selects\x18\t \x03(\x0b\x32K.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1.Select\x12\x10\n\x08group_by\x18\n \x03(\t\x12K\n\x06having\x18\x0b \x03(\x0b\x32;.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingClause\x12\x13\n\x06offset\x18\x0c \x01(\rH\x02\x88\x01\x01\x1a\xc9\x01\n\x06Select\x12\x66\n\x08\x66unction\x18\x01 \x01(\x0e\x32T.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1.Select.Function\x12\r\n\x05\x66ield\x18\x02 \x01(\t\"H\n\x08\x46unction\x12\r\n\tDOCUMENTS\x10\x00\x12\t\n\x05\x43OUNT\x10\x01\x12\x07\n\x03SUM\x10\x02\x12\x07\n\x03\x41VG\x10\x03\x12\x07\n\x03MIN\x10\x04\x12\x07\n\x03MAX\x10\x05\x42\x07\n\x05startB\x08\n\x06_limitB\t\n\x07_offset\"\xe7\x01\n\rWhereOperator\x12\t\n\x05\x45QUAL\x10\x00\x12\x10\n\x0cGREATER_THAN\x10\x01\x12\x1a\n\x16GREATER_THAN_OR_EQUALS\x10\x02\x12\r\n\tLESS_THAN\x10\x03\x12\x17\n\x13LESS_THAN_OR_EQUALS\x10\x04\x12\x0b\n\x07\x42\x45TWEEN\x10\x05\x12\x1a\n\x16\x42\x45TWEEN_EXCLUDE_BOUNDS\x10\x06\x12\x18\n\x14\x42\x45TWEEN_EXCLUDE_LEFT\x10\x07\x12\x19\n\x15\x42\x45TWEEN_EXCLUDE_RIGHT\x10\x08\x12\x06\n\x02IN\x10\t\x12\x0f\n\x0bSTARTS_WITH\x10\nB\t\n\x07version\"\xe7\x15\n\x14GetDocumentsResponse\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV0H\x00\x12T\n\x02v1\x18\x02 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1H\x00\x1a\x9b\x02\n\x16GetDocumentsResponseV0\x12\x65\n\tdocuments\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV0.DocumentsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1e\n\tDocuments\x12\x11\n\tdocuments\x18\x01 \x03(\x0c\x42\x08\n\x06result\x1a\xf9\x11\n\x16GetDocumentsResponseV1\x12\x61\n\x04\x64\x61ta\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.ResultDataH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1e\n\tDocuments\x12\x11\n\tdocuments\x18\x01 \x03(\x0c\x1aL\n\nCountEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x03 \x01(\x04\x42\x02\x30\x01\x42\t\n\x07_in_key\x1ar\n\x0c\x43ountEntries\x12\x62\n\x07\x65ntries\x18\x01 \x03(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountEntry\x1a\xa0\x01\n\x0c\x43ountResults\x12\x1d\n\x0f\x61ggregate_count\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x66\n\x07\x65ntries\x18\x02 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountEntriesH\x00\x42\t\n\x07variant\x1aH\n\x08SumEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x0f\n\x03sum\x18\x03 \x01(\x12\x42\x02\x30\x01\x42\t\n\x07_in_key\x1an\n\nSumEntries\x12`\n\x07\x65ntries\x18\x01 \x03(\x0b\x32O.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumEntry\x1a\x9a\x01\n\nSumResults\x12\x1b\n\raggregate_sum\x18\x01 \x01(\x12\x42\x02\x30\x01H\x00\x12\x64\n\x07\x65ntries\x18\x02 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumEntriesH\x00\x42\t\n\x07variant\x1a_\n\x0c\x41verageEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x03 \x01(\x04\x42\x02\x30\x01\x12\x0f\n\x03sum\x18\x04 \x01(\x12\x42\x02\x30\x01\x42\t\n\x07_in_key\x1av\n\x0e\x41verageEntries\x12\x64\n\x07\x65ntries\x18\x01 \x03(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageEntry\x1a\x36\n\x10\x41verageAggregate\x12\x11\n\x05\x63ount\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x0f\n\x03sum\x18\x02 \x01(\x12\x42\x02\x30\x01\x1a\xfb\x01\n\x0e\x41verageResults\x12t\n\x11\x61ggregate_average\x18\x01 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageAggregateH\x00\x12h\n\x07\x65ntries\x18\x02 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageEntriesH\x00\x42\t\n\x07variant\x1aZ\n\x0bRankedEntry\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x13\n\x05\x63ount\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x11\n\x03sum\x18\x03 \x01(\x12\x42\x02\x30\x01H\x00\x12\r\n\x03\x61vg\x18\x04 \x01(\x01H\x00\x42\x07\n\x05value\x1a\x9a\x01\n\rRankedEntries\x12\x63\n\x07\x65ntries\x18\x01 \x03(\x0b\x32R.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry\x12\x18\n\x07skipped\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x42\n\n\x08_skipped\x1a\x9b\x04\n\nResultData\x12\x65\n\tdocuments\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.DocumentsH\x00\x12\x65\n\x06\x63ounts\x18\x02 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountResultsH\x00\x12\x61\n\x04sums\x18\x03 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumResultsH\x00\x12i\n\x08\x61verages\x18\x04 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageResultsH\x00\x12\x66\n\x06ranked\x18\x05 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntriesH\x00\x42\t\n\x07variantB\x08\n\x06resultB\t\n\x07version\"\xf4\x02\n\x19GetDocumentHistoryRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentHistoryRequest.GetDocumentHistoryRequestV0H\x00\x1a\xeb\x01\n\x1bGetDocumentHistoryRequestV0\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x13\n\x0b\x64ocument_id\x18\x03 \x01(\x0c\x12+\n\x05limit\x18\x04 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x05 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0bstart_at_ms\x18\x06 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x07 \x01(\x08\x42\t\n\x07version\"\xf7\x04\n\x1aGetDocumentHistoryResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0H\x00\x1a\xeb\x03\n\x1cGetDocumentHistoryResponseV0\x12~\n\x10\x64ocument_history\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0.DocumentHistoryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x37\n\x14\x44ocumentHistoryEntry\x12\x10\n\x04\x64\x61te\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05value\x18\x02 \x01(\x0c\x1a\x95\x01\n\x0f\x44ocumentHistory\x12\x81\x01\n\x10\x64ocument_entries\x18\x01 \x03(\x0b\x32g.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0.DocumentHistoryEntryB\x08\n\x06resultB\t\n\x07version\"\xed\x01\n!GetIdentityByPublicKeyHashRequest\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashRequest.GetIdentityByPublicKeyHashRequestV0H\x00\x1aM\n#GetIdentityByPublicKeyHashRequestV0\x12\x17\n\x0fpublic_key_hash\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xda\x02\n\"GetIdentityByPublicKeyHashResponse\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashResponse.GetIdentityByPublicKeyHashResponseV0H\x00\x1a\xb6\x01\n$GetIdentityByPublicKeyHashResponseV0\x12\x12\n\x08identity\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbd\x02\n*GetIdentityByNonUniquePublicKeyHashRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashRequest.GetIdentityByNonUniquePublicKeyHashRequestV0H\x00\x1a\x80\x01\n,GetIdentityByNonUniquePublicKeyHashRequestV0\x12\x17\n\x0fpublic_key_hash\x18\x01 \x01(\x0c\x12\x18\n\x0bstart_after\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\x0e\n\x0c_start_afterB\t\n\x07version\"\xd6\x06\n+GetIdentityByNonUniquePublicKeyHashResponse\x12\x82\x01\n\x02v0\x18\x01 \x01(\x0b\x32t.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0H\x00\x1a\x96\x05\n-GetIdentityByNonUniquePublicKeyHashResponseV0\x12\x9a\x01\n\x08identity\x18\x01 \x01(\x0b\x32\x85\x01.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0.IdentityResponseH\x00\x12\x9d\x01\n\x05proof\x18\x02 \x01(\x0b\x32\x8b\x01.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0.IdentityProvedResponseH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x36\n\x10IdentityResponse\x12\x15\n\x08identity\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x42\x0b\n\t_identity\x1a\xa6\x01\n\x16IdentityProvedResponse\x12P\n&grovedb_identity_public_key_hash_proof\x18\x01 \x01(\x0b\x32 .org.dash.platform.dapi.v0.Proof\x12!\n\x14identity_proof_bytes\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x42\x17\n\x15_identity_proof_bytesB\x08\n\x06resultB\t\n\x07version\"\xfb\x01\n#WaitForStateTransitionResultRequest\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.WaitForStateTransitionResultRequest.WaitForStateTransitionResultRequestV0H\x00\x1aU\n%WaitForStateTransitionResultRequestV0\x12\x1d\n\x15state_transition_hash\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x99\x03\n$WaitForStateTransitionResultResponse\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.WaitForStateTransitionResultResponse.WaitForStateTransitionResultResponseV0H\x00\x1a\xef\x01\n&WaitForStateTransitionResultResponseV0\x12I\n\x05\x65rror\x18\x01 \x01(\x0b\x32\x38.org.dash.platform.dapi.v0.StateTransitionBroadcastErrorH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc4\x01\n\x19GetConsensusParamsRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetConsensusParamsRequest.GetConsensusParamsRequestV0H\x00\x1a<\n\x1bGetConsensusParamsRequestV0\x12\x0e\n\x06height\x18\x01 \x01(\x05\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9c\x04\n\x1aGetConsensusParamsResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetConsensusParamsResponse.GetConsensusParamsResponseV0H\x00\x1aP\n\x14\x43onsensusParamsBlock\x12\x11\n\tmax_bytes\x18\x01 \x01(\t\x12\x0f\n\x07max_gas\x18\x02 \x01(\t\x12\x14\n\x0ctime_iota_ms\x18\x03 \x01(\t\x1a\x62\n\x17\x43onsensusParamsEvidence\x12\x1a\n\x12max_age_num_blocks\x18\x01 \x01(\t\x12\x18\n\x10max_age_duration\x18\x02 \x01(\t\x12\x11\n\tmax_bytes\x18\x03 \x01(\t\x1a\xda\x01\n\x1cGetConsensusParamsResponseV0\x12Y\n\x05\x62lock\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetConsensusParamsResponse.ConsensusParamsBlock\x12_\n\x08\x65vidence\x18\x02 \x01(\x0b\x32M.org.dash.platform.dapi.v0.GetConsensusParamsResponse.ConsensusParamsEvidenceB\t\n\x07version\"\xe4\x01\n%GetProtocolVersionUpgradeStateRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateRequest.GetProtocolVersionUpgradeStateRequestV0H\x00\x1a\x38\n\'GetProtocolVersionUpgradeStateRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xb5\x05\n&GetProtocolVersionUpgradeStateResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0H\x00\x1a\x85\x04\n(GetProtocolVersionUpgradeStateResponseV0\x12\x87\x01\n\x08versions\x18\x01 \x01(\x0b\x32s.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0.VersionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x96\x01\n\x08Versions\x12\x89\x01\n\x08versions\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0.VersionEntry\x1a:\n\x0cVersionEntry\x12\x16\n\x0eversion_number\x18\x01 \x01(\r\x12\x12\n\nvote_count\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xa3\x02\n*GetProtocolVersionUpgradeVoteStatusRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusRequest.GetProtocolVersionUpgradeVoteStatusRequestV0H\x00\x1ag\n,GetProtocolVersionUpgradeVoteStatusRequestV0\x12\x19\n\x11start_pro_tx_hash\x18\x01 \x01(\x0c\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xef\x05\n+GetProtocolVersionUpgradeVoteStatusResponse\x12\x82\x01\n\x02v0\x18\x01 \x01(\x0b\x32t.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0H\x00\x1a\xaf\x04\n-GetProtocolVersionUpgradeVoteStatusResponseV0\x12\x98\x01\n\x08versions\x18\x01 \x01(\x0b\x32\x83\x01.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0.VersionSignalsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xaf\x01\n\x0eVersionSignals\x12\x9c\x01\n\x0fversion_signals\x18\x01 \x03(\x0b\x32\x82\x01.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0.VersionSignal\x1a\x35\n\rVersionSignal\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x0f\n\x07version\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xf5\x01\n\x14GetEpochsInfoRequest\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetEpochsInfoRequest.GetEpochsInfoRequestV0H\x00\x1a|\n\x16GetEpochsInfoRequestV0\x12\x31\n\x0bstart_epoch\x18\x01 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\x11\n\tascending\x18\x03 \x01(\x08\x12\r\n\x05prove\x18\x04 \x01(\x08\x42\t\n\x07version\"\x99\x05\n\x15GetEpochsInfoResponse\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0H\x00\x1a\x9c\x04\n\x17GetEpochsInfoResponseV0\x12\x65\n\x06\x65pochs\x18\x01 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0.EpochInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1au\n\nEpochInfos\x12g\n\x0b\x65poch_infos\x18\x01 \x03(\x0b\x32R.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0.EpochInfo\x1a\xa6\x01\n\tEpochInfo\x12\x0e\n\x06number\x18\x01 \x01(\r\x12\x1e\n\x12\x66irst_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x1f\n\x17\x66irst_core_block_height\x18\x03 \x01(\r\x12\x16\n\nstart_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x0e\x66\x65\x65_multiplier\x18\x05 \x01(\x01\x12\x18\n\x10protocol_version\x18\x06 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xbf\x02\n\x1dGetFinalizedEpochInfosRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetFinalizedEpochInfosRequest.GetFinalizedEpochInfosRequestV0H\x00\x1a\xaa\x01\n\x1fGetFinalizedEpochInfosRequestV0\x12\x19\n\x11start_epoch_index\x18\x01 \x01(\r\x12\"\n\x1astart_epoch_index_included\x18\x02 \x01(\x08\x12\x17\n\x0f\x65nd_epoch_index\x18\x03 \x01(\r\x12 \n\x18\x65nd_epoch_index_included\x18\x04 \x01(\x08\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\xbd\t\n\x1eGetFinalizedEpochInfosResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0H\x00\x1a\xa5\x08\n GetFinalizedEpochInfosResponseV0\x12\x80\x01\n\x06\x65pochs\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.FinalizedEpochInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xa4\x01\n\x13\x46inalizedEpochInfos\x12\x8c\x01\n\x15\x66inalized_epoch_infos\x18\x01 \x03(\x0b\x32m.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.FinalizedEpochInfo\x1a\x9f\x04\n\x12\x46inalizedEpochInfo\x12\x0e\n\x06number\x18\x01 \x01(\r\x12\x1e\n\x12\x66irst_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x1f\n\x17\x66irst_core_block_height\x18\x03 \x01(\r\x12\x1c\n\x10\x66irst_block_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x0e\x66\x65\x65_multiplier\x18\x05 \x01(\x01\x12\x18\n\x10protocol_version\x18\x06 \x01(\r\x12!\n\x15total_blocks_in_epoch\x18\x07 \x01(\x04\x42\x02\x30\x01\x12*\n\"next_epoch_start_core_block_height\x18\x08 \x01(\r\x12!\n\x15total_processing_fees\x18\t \x01(\x04\x42\x02\x30\x01\x12*\n\x1etotal_distributed_storage_fees\x18\n \x01(\x04\x42\x02\x30\x01\x12&\n\x1atotal_created_storage_fees\x18\x0b \x01(\x04\x42\x02\x30\x01\x12\x1e\n\x12\x63ore_block_rewards\x18\x0c \x01(\x04\x42\x02\x30\x01\x12\x81\x01\n\x0f\x62lock_proposers\x18\r \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.BlockProposer\x1a\x39\n\rBlockProposer\x12\x13\n\x0bproposer_id\x18\x01 \x01(\x0c\x12\x13\n\x0b\x62lock_count\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xde\x04\n\x1cGetContestedResourcesRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetContestedResourcesRequest.GetContestedResourcesRequestV0H\x00\x1a\xcc\x03\n\x1eGetContestedResourcesRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x1a\n\x12start_index_values\x18\x04 \x03(\x0c\x12\x18\n\x10\x65nd_index_values\x18\x05 \x03(\x0c\x12\x89\x01\n\x13start_at_value_info\x18\x06 \x01(\x0b\x32g.org.dash.platform.dapi.v0.GetContestedResourcesRequest.GetContestedResourcesRequestV0.StartAtValueInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x07 \x01(\rH\x01\x88\x01\x01\x12\x17\n\x0forder_ascending\x18\x08 \x01(\x08\x12\r\n\x05prove\x18\t \x01(\x08\x1a\x45\n\x10StartAtValueInfo\x12\x13\n\x0bstart_value\x18\x01 \x01(\x0c\x12\x1c\n\x14start_value_included\x18\x02 \x01(\x08\x42\x16\n\x14_start_at_value_infoB\x08\n\x06_countB\t\n\x07version\"\x88\x04\n\x1dGetContestedResourcesResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetContestedResourcesResponse.GetContestedResourcesResponseV0H\x00\x1a\xf3\x02\n\x1fGetContestedResourcesResponseV0\x12\x95\x01\n\x19\x63ontested_resource_values\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetContestedResourcesResponse.GetContestedResourcesResponseV0.ContestedResourceValuesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a<\n\x17\x43ontestedResourceValues\x12!\n\x19\x63ontested_resource_values\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xd2\x05\n\x1cGetVotePollsByEndDateRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0H\x00\x1a\xc0\x04\n\x1eGetVotePollsByEndDateRequestV0\x12\x84\x01\n\x0fstart_time_info\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0.StartAtTimeInfoH\x00\x88\x01\x01\x12\x80\x01\n\rend_time_info\x18\x02 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0.EndAtTimeInfoH\x01\x88\x01\x01\x12\x12\n\x05limit\x18\x03 \x01(\rH\x02\x88\x01\x01\x12\x13\n\x06offset\x18\x04 \x01(\rH\x03\x88\x01\x01\x12\x11\n\tascending\x18\x05 \x01(\x08\x12\r\n\x05prove\x18\x06 \x01(\x08\x1aI\n\x0fStartAtTimeInfo\x12\x19\n\rstart_time_ms\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x13start_time_included\x18\x02 \x01(\x08\x1a\x43\n\rEndAtTimeInfo\x12\x17\n\x0b\x65nd_time_ms\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x19\n\x11\x65nd_time_included\x18\x02 \x01(\x08\x42\x12\n\x10_start_time_infoB\x10\n\x0e_end_time_infoB\x08\n\x06_limitB\t\n\x07_offsetB\t\n\x07version\"\x83\x06\n\x1dGetVotePollsByEndDateResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0H\x00\x1a\xee\x04\n\x1fGetVotePollsByEndDateResponseV0\x12\x9c\x01\n\x18vote_polls_by_timestamps\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0.SerializedVotePollsByTimestampsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aV\n\x1eSerializedVotePollsByTimestamp\x12\x15\n\ttimestamp\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1d\n\x15serialized_vote_polls\x18\x02 \x03(\x0c\x1a\xd7\x01\n\x1fSerializedVotePollsByTimestamps\x12\x99\x01\n\x18vote_polls_by_timestamps\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0.SerializedVotePollsByTimestamp\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x42\x08\n\x06resultB\t\n\x07version\"\xff\x06\n$GetContestedResourceVoteStateRequest\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0H\x00\x1a\xd5\x05\n&GetContestedResourceVoteStateRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x14\n\x0cindex_values\x18\x04 \x03(\x0c\x12\x86\x01\n\x0bresult_type\x18\x05 \x01(\x0e\x32q.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0.ResultType\x12\x36\n.allow_include_locked_and_abstaining_vote_tally\x18\x06 \x01(\x08\x12\xa3\x01\n\x18start_at_identifier_info\x18\x07 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0.StartAtIdentifierInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x08 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\t \x01(\x08\x1aT\n\x15StartAtIdentifierInfo\x12\x18\n\x10start_identifier\x18\x01 \x01(\x0c\x12!\n\x19start_identifier_included\x18\x02 \x01(\x08\"I\n\nResultType\x12\r\n\tDOCUMENTS\x10\x00\x12\x0e\n\nVOTE_TALLY\x10\x01\x12\x1c\n\x18\x44OCUMENTS_AND_VOTE_TALLY\x10\x02\x42\x1b\n\x19_start_at_identifier_infoB\x08\n\x06_countB\t\n\x07version\"\x94\x0c\n%GetContestedResourceVoteStateResponse\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0H\x00\x1a\xe7\n\n\'GetContestedResourceVoteStateResponseV0\x12\xae\x01\n\x1d\x63ontested_resource_contenders\x18\x01 \x01(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.ContestedResourceContendersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xda\x03\n\x10\x46inishedVoteInfo\x12\xad\x01\n\x15\x66inished_vote_outcome\x18\x01 \x01(\x0e\x32\x8d\x01.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.FinishedVoteInfo.FinishedVoteOutcome\x12\x1f\n\x12won_by_identity_id\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12$\n\x18\x66inished_at_block_height\x18\x03 \x01(\x04\x42\x02\x30\x01\x12%\n\x1d\x66inished_at_core_block_height\x18\x04 \x01(\r\x12%\n\x19\x66inished_at_block_time_ms\x18\x05 \x01(\x04\x42\x02\x30\x01\x12\x19\n\x11\x66inished_at_epoch\x18\x06 \x01(\r\"O\n\x13\x46inishedVoteOutcome\x12\x14\n\x10TOWARDS_IDENTITY\x10\x00\x12\n\n\x06LOCKED\x10\x01\x12\x16\n\x12NO_PREVIOUS_WINNER\x10\x02\x42\x15\n\x13_won_by_identity_id\x1a\xc4\x03\n\x1b\x43ontestedResourceContenders\x12\x86\x01\n\ncontenders\x18\x01 \x03(\x0b\x32r.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.Contender\x12\x1f\n\x12\x61\x62stain_vote_tally\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x1c\n\x0flock_vote_tally\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\x9a\x01\n\x12\x66inished_vote_info\x18\x04 \x01(\x0b\x32y.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.FinishedVoteInfoH\x02\x88\x01\x01\x42\x15\n\x13_abstain_vote_tallyB\x12\n\x10_lock_vote_tallyB\x15\n\x13_finished_vote_info\x1ak\n\tContender\x12\x12\n\nidentifier\x18\x01 \x01(\x0c\x12\x17\n\nvote_count\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x15\n\x08\x64ocument\x18\x03 \x01(\x0cH\x01\x88\x01\x01\x42\r\n\x0b_vote_countB\x0b\n\t_documentB\x08\n\x06resultB\t\n\x07version\"\xd5\x05\n,GetContestedResourceVotersForIdentityRequest\x12\x84\x01\n\x02v0\x18\x01 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest.GetContestedResourceVotersForIdentityRequestV0H\x00\x1a\x92\x04\n.GetContestedResourceVotersForIdentityRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x14\n\x0cindex_values\x18\x04 \x03(\x0c\x12\x15\n\rcontestant_id\x18\x05 \x01(\x0c\x12\xb4\x01\n\x18start_at_identifier_info\x18\x06 \x01(\x0b\x32\x8c\x01.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest.GetContestedResourceVotersForIdentityRequestV0.StartAtIdentifierInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x07 \x01(\rH\x01\x88\x01\x01\x12\x17\n\x0forder_ascending\x18\x08 \x01(\x08\x12\r\n\x05prove\x18\t \x01(\x08\x1aT\n\x15StartAtIdentifierInfo\x12\x18\n\x10start_identifier\x18\x01 \x01(\x0c\x12!\n\x19start_identifier_included\x18\x02 \x01(\x08\x42\x1b\n\x19_start_at_identifier_infoB\x08\n\x06_countB\t\n\x07version\"\xf1\x04\n-GetContestedResourceVotersForIdentityResponse\x12\x86\x01\n\x02v0\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse.GetContestedResourceVotersForIdentityResponseV0H\x00\x1a\xab\x03\n/GetContestedResourceVotersForIdentityResponseV0\x12\xb6\x01\n\x19\x63ontested_resource_voters\x18\x01 \x01(\x0b\x32\x90\x01.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse.GetContestedResourceVotersForIdentityResponseV0.ContestedResourceVotersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x43\n\x17\x43ontestedResourceVoters\x12\x0e\n\x06voters\x18\x01 \x03(\x0c\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x42\x08\n\x06resultB\t\n\x07version\"\xad\x05\n(GetContestedResourceIdentityVotesRequest\x12|\n\x02v0\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest.GetContestedResourceIdentityVotesRequestV0H\x00\x1a\xf7\x03\n*GetContestedResourceIdentityVotesRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12+\n\x05limit\x18\x02 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0forder_ascending\x18\x04 \x01(\x08\x12\xae\x01\n\x1astart_at_vote_poll_id_info\x18\x05 \x01(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest.GetContestedResourceIdentityVotesRequestV0.StartAtVotePollIdInfoH\x00\x88\x01\x01\x12\r\n\x05prove\x18\x06 \x01(\x08\x1a\x61\n\x15StartAtVotePollIdInfo\x12 \n\x18start_at_poll_identifier\x18\x01 \x01(\x0c\x12&\n\x1estart_poll_identifier_included\x18\x02 \x01(\x08\x42\x1d\n\x1b_start_at_vote_poll_id_infoB\t\n\x07version\"\xc8\n\n)GetContestedResourceIdentityVotesResponse\x12~\n\x02v0\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0H\x00\x1a\x8f\t\n+GetContestedResourceIdentityVotesResponseV0\x12\xa1\x01\n\x05votes\x18\x01 \x01(\x0b\x32\x8f\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ContestedResourceIdentityVotesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xf7\x01\n\x1e\x43ontestedResourceIdentityVotes\x12\xba\x01\n!contested_resource_identity_votes\x18\x01 \x03(\x0b\x32\x8e\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ContestedResourceIdentityVote\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x1a\xad\x02\n\x12ResourceVoteChoice\x12\xad\x01\n\x10vote_choice_type\x18\x01 \x01(\x0e\x32\x92\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ResourceVoteChoice.VoteChoiceType\x12\x18\n\x0bidentity_id\x18\x02 \x01(\x0cH\x00\x88\x01\x01\"=\n\x0eVoteChoiceType\x12\x14\n\x10TOWARDS_IDENTITY\x10\x00\x12\x0b\n\x07\x41\x42STAIN\x10\x01\x12\x08\n\x04LOCK\x10\x02\x42\x0e\n\x0c_identity_id\x1a\x95\x02\n\x1d\x43ontestedResourceIdentityVote\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\'\n\x1fserialized_index_storage_values\x18\x03 \x03(\x0c\x12\x99\x01\n\x0bvote_choice\x18\x04 \x01(\x0b\x32\x83\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ResourceVoteChoiceB\x08\n\x06resultB\t\n\x07version\"\xf0\x01\n%GetPrefundedSpecializedBalanceRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceRequest.GetPrefundedSpecializedBalanceRequestV0H\x00\x1a\x44\n\'GetPrefundedSpecializedBalanceRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xed\x02\n&GetPrefundedSpecializedBalanceResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceResponse.GetPrefundedSpecializedBalanceResponseV0H\x00\x1a\xbd\x01\n(GetPrefundedSpecializedBalanceResponseV0\x12\x15\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xd0\x01\n GetTotalCreditsInPlatformRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformRequest.GetTotalCreditsInPlatformRequestV0H\x00\x1a\x33\n\"GetTotalCreditsInPlatformRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xd9\x02\n!GetTotalCreditsInPlatformResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformResponse.GetTotalCreditsInPlatformResponseV0H\x00\x1a\xb8\x01\n#GetTotalCreditsInPlatformResponseV0\x12\x15\n\x07\x63redits\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc4\x01\n\x16GetPathElementsRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetPathElementsRequest.GetPathElementsRequestV0H\x00\x1a\x45\n\x18GetPathElementsRequestV0\x12\x0c\n\x04path\x18\x01 \x03(\x0c\x12\x0c\n\x04keys\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xa3\x03\n\x17GetPathElementsResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetPathElementsResponse.GetPathElementsResponseV0H\x00\x1a\xa0\x02\n\x19GetPathElementsResponseV0\x12i\n\x08\x65lements\x18\x01 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetPathElementsResponse.GetPathElementsResponseV0.ElementsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1c\n\x08\x45lements\x12\x10\n\x08\x65lements\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\x81\x01\n\x10GetStatusRequest\x12L\n\x02v0\x18\x01 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetStatusRequest.GetStatusRequestV0H\x00\x1a\x14\n\x12GetStatusRequestV0B\t\n\x07version\"\xe4\x10\n\x11GetStatusResponse\x12N\n\x02v0\x18\x01 \x01(\x0b\x32@.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0H\x00\x1a\xf3\x0f\n\x13GetStatusResponseV0\x12Y\n\x07version\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version\x12S\n\x04node\x18\x02 \x01(\x0b\x32\x45.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Node\x12U\n\x05\x63hain\x18\x03 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Chain\x12Y\n\x07network\x18\x04 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Network\x12^\n\nstate_sync\x18\x05 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.StateSync\x12S\n\x04time\x18\x06 \x01(\x0b\x32\x45.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Time\x1a\x82\x05\n\x07Version\x12\x63\n\x08software\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Software\x12\x63\n\x08protocol\x18\x02 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol\x1a^\n\x08Software\x12\x0c\n\x04\x64\x61pi\x18\x01 \x01(\t\x12\x12\n\x05\x64rive\x18\x02 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ntenderdash\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x08\n\x06_driveB\r\n\x0b_tenderdash\x1a\xcc\x02\n\x08Protocol\x12p\n\ntenderdash\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol.Tenderdash\x12\x66\n\x05\x64rive\x18\x02 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol.Drive\x1a(\n\nTenderdash\x12\x0b\n\x03p2p\x18\x01 \x01(\r\x12\r\n\x05\x62lock\x18\x02 \x01(\r\x1a<\n\x05\x44rive\x12\x0e\n\x06latest\x18\x03 \x01(\r\x12\x0f\n\x07\x63urrent\x18\x04 \x01(\r\x12\x12\n\nnext_epoch\x18\x05 \x01(\r\x1a\x7f\n\x04Time\x12\x11\n\x05local\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x05\x62lock\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x12\x18\n\x07genesis\x18\x03 \x01(\x04\x42\x02\x30\x01H\x01\x88\x01\x01\x12\x12\n\x05\x65poch\x18\x04 \x01(\rH\x02\x88\x01\x01\x42\x08\n\x06_blockB\n\n\x08_genesisB\x08\n\x06_epoch\x1a<\n\x04Node\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\x18\n\x0bpro_tx_hash\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x42\x0e\n\x0c_pro_tx_hash\x1a\xb3\x02\n\x05\x43hain\x12\x13\n\x0b\x63\x61tching_up\x18\x01 \x01(\x08\x12\x19\n\x11latest_block_hash\x18\x02 \x01(\x0c\x12\x17\n\x0flatest_app_hash\x18\x03 \x01(\x0c\x12\x1f\n\x13latest_block_height\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x13\x65\x61rliest_block_hash\x18\x05 \x01(\x0c\x12\x19\n\x11\x65\x61rliest_app_hash\x18\x06 \x01(\x0c\x12!\n\x15\x65\x61rliest_block_height\x18\x07 \x01(\x04\x42\x02\x30\x01\x12!\n\x15max_peer_block_height\x18\t \x01(\x04\x42\x02\x30\x01\x12%\n\x18\x63ore_chain_locked_height\x18\n \x01(\rH\x00\x88\x01\x01\x42\x1b\n\x19_core_chain_locked_height\x1a\x43\n\x07Network\x12\x10\n\x08\x63hain_id\x18\x01 \x01(\t\x12\x13\n\x0bpeers_count\x18\x02 \x01(\r\x12\x11\n\tlistening\x18\x03 \x01(\x08\x1a\x85\x02\n\tStateSync\x12\x1d\n\x11total_synced_time\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1a\n\x0eremaining_time\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x17\n\x0ftotal_snapshots\x18\x03 \x01(\r\x12\"\n\x16\x63hunk_process_avg_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x0fsnapshot_height\x18\x05 \x01(\x04\x42\x02\x30\x01\x12!\n\x15snapshot_chunks_count\x18\x06 \x01(\x04\x42\x02\x30\x01\x12\x1d\n\x11\x62\x61\x63kfilled_blocks\x18\x07 \x01(\x04\x42\x02\x30\x01\x12!\n\x15\x62\x61\x63kfill_blocks_total\x18\x08 \x01(\x04\x42\x02\x30\x01\x42\t\n\x07version\"\xb1\x01\n\x1cGetCurrentQuorumsInfoRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoRequest.GetCurrentQuorumsInfoRequestV0H\x00\x1a \n\x1eGetCurrentQuorumsInfoRequestV0B\t\n\x07version\"\xa1\x05\n\x1dGetCurrentQuorumsInfoResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.GetCurrentQuorumsInfoResponseV0H\x00\x1a\x46\n\x0bValidatorV0\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x0f\n\x07node_ip\x18\x02 \x01(\t\x12\x11\n\tis_banned\x18\x03 \x01(\x08\x1a\xaf\x01\n\x0eValidatorSetV0\x12\x13\n\x0bquorum_hash\x18\x01 \x01(\x0c\x12\x13\n\x0b\x63ore_height\x18\x02 \x01(\r\x12U\n\x07members\x18\x03 \x03(\x0b\x32\x44.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.ValidatorV0\x12\x1c\n\x14threshold_public_key\x18\x04 \x01(\x0c\x1a\x92\x02\n\x1fGetCurrentQuorumsInfoResponseV0\x12\x15\n\rquorum_hashes\x18\x01 \x03(\x0c\x12\x1b\n\x13\x63urrent_quorum_hash\x18\x02 \x01(\x0c\x12_\n\x0evalidator_sets\x18\x03 \x03(\x0b\x32G.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.ValidatorSetV0\x12\x1b\n\x13last_block_proposer\x18\x04 \x01(\x0c\x12=\n\x08metadata\x18\x05 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\t\n\x07version\"\xf4\x01\n\x1fGetIdentityTokenBalancesRequest\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentityTokenBalancesRequest.GetIdentityTokenBalancesRequestV0H\x00\x1aZ\n!GetIdentityTokenBalancesRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x11\n\ttoken_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xad\x05\n GetIdentityTokenBalancesResponse\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0H\x00\x1a\x8f\x04\n\"GetIdentityTokenBalancesResponseV0\x12\x86\x01\n\x0etoken_balances\x18\x01 \x01(\x0b\x32l.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0.TokenBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aG\n\x11TokenBalanceEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x07\x62\x61lance\x18\x02 \x01(\x04H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\x9a\x01\n\rTokenBalances\x12\x88\x01\n\x0etoken_balances\x18\x01 \x03(\x0b\x32p.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0.TokenBalanceEntryB\x08\n\x06resultB\t\n\x07version\"\xfc\x01\n!GetIdentitiesTokenBalancesRequest\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesRequest.GetIdentitiesTokenBalancesRequestV0H\x00\x1a\\\n#GetIdentitiesTokenBalancesRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x0cidentity_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xf2\x05\n\"GetIdentitiesTokenBalancesResponse\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0H\x00\x1a\xce\x04\n$GetIdentitiesTokenBalancesResponseV0\x12\x9b\x01\n\x17identity_token_balances\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0.IdentityTokenBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aR\n\x19IdentityTokenBalanceEntry\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x14\n\x07\x62\x61lance\x18\x02 \x01(\x04H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\xb7\x01\n\x15IdentityTokenBalances\x12\x9d\x01\n\x17identity_token_balances\x18\x01 \x03(\x0b\x32|.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0.IdentityTokenBalanceEntryB\x08\n\x06resultB\t\n\x07version\"\xe8\x01\n\x1cGetIdentityTokenInfosRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetIdentityTokenInfosRequest.GetIdentityTokenInfosRequestV0H\x00\x1aW\n\x1eGetIdentityTokenInfosRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x11\n\ttoken_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\x98\x06\n\x1dGetIdentityTokenInfosResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0H\x00\x1a\x83\x05\n\x1fGetIdentityTokenInfosResponseV0\x12z\n\x0btoken_infos\x18\x01 \x01(\x0b\x32\x63.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a(\n\x16TokenIdentityInfoEntry\x12\x0e\n\x06\x66rozen\x18\x01 \x01(\x08\x1a\xb0\x01\n\x0eTokenInfoEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x82\x01\n\x04info\x18\x02 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenIdentityInfoEntryH\x00\x88\x01\x01\x42\x07\n\x05_info\x1a\x8a\x01\n\nTokenInfos\x12|\n\x0btoken_infos\x18\x01 \x03(\x0b\x32g.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xf0\x01\n\x1eGetIdentitiesTokenInfosRequest\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosRequest.GetIdentitiesTokenInfosRequestV0H\x00\x1aY\n GetIdentitiesTokenInfosRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x0cidentity_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xca\x06\n\x1fGetIdentitiesTokenInfosResponse\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0H\x00\x1a\xaf\x05\n!GetIdentitiesTokenInfosResponseV0\x12\x8f\x01\n\x14identity_token_infos\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.IdentityTokenInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a(\n\x16TokenIdentityInfoEntry\x12\x0e\n\x06\x66rozen\x18\x01 \x01(\x08\x1a\xb7\x01\n\x0eTokenInfoEntry\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x86\x01\n\x04info\x18\x02 \x01(\x0b\x32s.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.TokenIdentityInfoEntryH\x00\x88\x01\x01\x42\x07\n\x05_info\x1a\x97\x01\n\x12IdentityTokenInfos\x12\x80\x01\n\x0btoken_infos\x18\x01 \x03(\x0b\x32k.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.TokenInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xbf\x01\n\x17GetTokenStatusesRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetTokenStatusesRequest.GetTokenStatusesRequestV0H\x00\x1a=\n\x19GetTokenStatusesRequestV0\x12\x11\n\ttoken_ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xe7\x04\n\x18GetTokenStatusesResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0H\x00\x1a\xe1\x03\n\x1aGetTokenStatusesResponseV0\x12v\n\x0etoken_statuses\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0.TokenStatusesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x44\n\x10TokenStatusEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x13\n\x06paused\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\t\n\x07_paused\x1a\x88\x01\n\rTokenStatuses\x12w\n\x0etoken_statuses\x18\x01 \x03(\x0b\x32_.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0.TokenStatusEntryB\x08\n\x06resultB\t\n\x07version\"\xef\x01\n#GetTokenDirectPurchasePricesRequest\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesRequest.GetTokenDirectPurchasePricesRequestV0H\x00\x1aI\n%GetTokenDirectPurchasePricesRequestV0\x12\x11\n\ttoken_ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x8b\t\n$GetTokenDirectPurchasePricesResponse\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0H\x00\x1a\xe1\x07\n&GetTokenDirectPurchasePricesResponseV0\x12\xa9\x01\n\x1ctoken_direct_purchase_prices\x18\x01 \x01(\x0b\x32\x80\x01.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.TokenDirectPurchasePricesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x33\n\x10PriceForQuantity\x12\x10\n\x08quantity\x18\x01 \x01(\x04\x12\r\n\x05price\x18\x02 \x01(\x04\x1a\xa7\x01\n\x0fPricingSchedule\x12\x93\x01\n\x12price_for_quantity\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.PriceForQuantity\x1a\xe4\x01\n\x1dTokenDirectPurchasePriceEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x15\n\x0b\x66ixed_price\x18\x02 \x01(\x04H\x00\x12\x90\x01\n\x0evariable_price\x18\x03 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.PricingScheduleH\x00\x42\x07\n\x05price\x1a\xc8\x01\n\x19TokenDirectPurchasePrices\x12\xaa\x01\n\x1btoken_direct_purchase_price\x18\x01 \x03(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.TokenDirectPurchasePriceEntryB\x08\n\x06resultB\t\n\x07version\"\xce\x01\n\x1bGetTokenContractInfoRequest\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetTokenContractInfoRequest.GetTokenContractInfoRequestV0H\x00\x1a@\n\x1dGetTokenContractInfoRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xfb\x03\n\x1cGetTokenContractInfoResponse\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetTokenContractInfoResponse.GetTokenContractInfoResponseV0H\x00\x1a\xe9\x02\n\x1eGetTokenContractInfoResponseV0\x12|\n\x04\x64\x61ta\x18\x01 \x01(\x0b\x32l.org.dash.platform.dapi.v0.GetTokenContractInfoResponse.GetTokenContractInfoResponseV0.TokenContractInfoDataH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aM\n\x15TokenContractInfoData\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17token_contract_position\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xef\x04\n)GetTokenPreProgrammedDistributionsRequest\x12~\n\x02v0\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest.GetTokenPreProgrammedDistributionsRequestV0H\x00\x1a\xb6\x03\n+GetTokenPreProgrammedDistributionsRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x98\x01\n\rstart_at_info\x18\x02 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest.GetTokenPreProgrammedDistributionsRequestV0.StartAtInfoH\x00\x88\x01\x01\x12\x12\n\x05limit\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x04 \x01(\x08\x1a\x9a\x01\n\x0bStartAtInfo\x12\x15\n\rstart_time_ms\x18\x01 \x01(\x04\x12\x1c\n\x0fstart_recipient\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12%\n\x18start_recipient_included\x18\x03 \x01(\x08H\x01\x88\x01\x01\x42\x12\n\x10_start_recipientB\x1b\n\x19_start_recipient_includedB\x10\n\x0e_start_at_infoB\x08\n\x06_limitB\t\n\x07version\"\xec\x07\n*GetTokenPreProgrammedDistributionsResponse\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0H\x00\x1a\xaf\x06\n,GetTokenPreProgrammedDistributionsResponseV0\x12\xa5\x01\n\x13token_distributions\x18\x01 \x01(\x0b\x32\x85\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenDistributionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a>\n\x16TokenDistributionEntry\x12\x14\n\x0crecipient_id\x18\x01 \x01(\x0c\x12\x0e\n\x06\x61mount\x18\x02 \x01(\x04\x1a\xd4\x01\n\x1bTokenTimedDistributionEntry\x12\x11\n\ttimestamp\x18\x01 \x01(\x04\x12\xa1\x01\n\rdistributions\x18\x02 \x03(\x0b\x32\x89\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenDistributionEntry\x1a\xc3\x01\n\x12TokenDistributions\x12\xac\x01\n\x13token_distributions\x18\x01 \x03(\x0b\x32\x8e\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenTimedDistributionEntryB\x08\n\x06resultB\t\n\x07version\"\x82\x04\n-GetTokenPerpetualDistributionLastClaimRequest\x12\x86\x01\n\x02v0\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest.GetTokenPerpetualDistributionLastClaimRequestV0H\x00\x1aI\n\x11\x43ontractTokenInfo\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17token_contract_position\x18\x02 \x01(\r\x1a\xf1\x01\n/GetTokenPerpetualDistributionLastClaimRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12v\n\rcontract_info\x18\x02 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest.ContractTokenInfoH\x00\x88\x01\x01\x12\x13\n\x0bidentity_id\x18\x04 \x01(\x0c\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x10\n\x0e_contract_infoB\t\n\x07version\"\x93\x05\n.GetTokenPerpetualDistributionLastClaimResponse\x12\x88\x01\n\x02v0\x18\x01 \x01(\x0b\x32z.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse.GetTokenPerpetualDistributionLastClaimResponseV0H\x00\x1a\xca\x03\n0GetTokenPerpetualDistributionLastClaimResponseV0\x12\x9f\x01\n\nlast_claim\x18\x01 \x01(\x0b\x32\x88\x01.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse.GetTokenPerpetualDistributionLastClaimResponseV0.LastClaimInfoH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1ax\n\rLastClaimInfo\x12\x1a\n\x0ctimestamp_ms\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x1a\n\x0c\x62lock_height\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x0f\n\x05\x65poch\x18\x03 \x01(\rH\x00\x12\x13\n\traw_bytes\x18\x04 \x01(\x0cH\x00\x42\t\n\x07paid_atB\x08\n\x06resultB\t\n\x07version\"\xca\x01\n\x1aGetTokenTotalSupplyRequest\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetTokenTotalSupplyRequest.GetTokenTotalSupplyRequestV0H\x00\x1a?\n\x1cGetTokenTotalSupplyRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xaf\x04\n\x1bGetTokenTotalSupplyResponse\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse.GetTokenTotalSupplyResponseV0H\x00\x1a\xa0\x03\n\x1dGetTokenTotalSupplyResponseV0\x12\x88\x01\n\x12token_total_supply\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse.GetTokenTotalSupplyResponseV0.TokenTotalSupplyEntryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1ax\n\x15TokenTotalSupplyEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x30\n(total_aggregated_amount_in_user_accounts\x18\x02 \x01(\x04\x12\x1b\n\x13total_system_amount\x18\x03 \x01(\x04\x42\x08\n\x06resultB\t\n\x07version\"\xd2\x01\n\x13GetGroupInfoRequest\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetGroupInfoRequest.GetGroupInfoRequestV0H\x00\x1a\\\n\x15GetGroupInfoRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xd4\x05\n\x14GetGroupInfoResponse\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0H\x00\x1a\xda\x04\n\x16GetGroupInfoResponseV0\x12\x66\n\ngroup_info\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupInfoH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x04 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x34\n\x10GroupMemberEntry\x12\x11\n\tmember_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\x98\x01\n\x0eGroupInfoEntry\x12h\n\x07members\x18\x01 \x03(\x0b\x32W.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupMemberEntry\x12\x1c\n\x14group_required_power\x18\x02 \x01(\r\x1a\x8a\x01\n\tGroupInfo\x12n\n\ngroup_info\x18\x01 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupInfoEntryH\x00\x88\x01\x01\x42\r\n\x0b_group_infoB\x08\n\x06resultB\t\n\x07version\"\xed\x03\n\x14GetGroupInfosRequest\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetGroupInfosRequest.GetGroupInfosRequestV0H\x00\x1au\n\x1cStartAtGroupContractPosition\x12%\n\x1dstart_group_contract_position\x18\x01 \x01(\r\x12.\n&start_group_contract_position_included\x18\x02 \x01(\x08\x1a\xfc\x01\n\x16GetGroupInfosRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12{\n start_at_group_contract_position\x18\x02 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetGroupInfosRequest.StartAtGroupContractPositionH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x04 \x01(\x08\x42#\n!_start_at_group_contract_positionB\x08\n\x06_countB\t\n\x07version\"\xff\x05\n\x15GetGroupInfosResponse\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0H\x00\x1a\x82\x05\n\x17GetGroupInfosResponseV0\x12j\n\x0bgroup_infos\x18\x01 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x04 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x34\n\x10GroupMemberEntry\x12\x11\n\tmember_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\xc3\x01\n\x16GroupPositionInfoEntry\x12\x1f\n\x17group_contract_position\x18\x01 \x01(\r\x12j\n\x07members\x18\x02 \x03(\x0b\x32Y.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupMemberEntry\x12\x1c\n\x14group_required_power\x18\x03 \x01(\r\x1a\x82\x01\n\nGroupInfos\x12t\n\x0bgroup_infos\x18\x01 \x03(\x0b\x32_.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupPositionInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xbe\x04\n\x16GetGroupActionsRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetGroupActionsRequest.GetGroupActionsRequestV0H\x00\x1aL\n\x0fStartAtActionId\x12\x17\n\x0fstart_action_id\x18\x01 \x01(\x0c\x12 \n\x18start_action_id_included\x18\x02 \x01(\x08\x1a\xc8\x02\n\x18GetGroupActionsRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12N\n\x06status\x18\x03 \x01(\x0e\x32>.org.dash.platform.dapi.v0.GetGroupActionsRequest.ActionStatus\x12\x62\n\x12start_at_action_id\x18\x04 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetGroupActionsRequest.StartAtActionIdH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x05 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x06 \x01(\x08\x42\x15\n\x13_start_at_action_idB\x08\n\x06_count\"&\n\x0c\x41\x63tionStatus\x12\n\n\x06\x41\x43TIVE\x10\x00\x12\n\n\x06\x43LOSED\x10\x01\x42\t\n\x07version\"\xd6\x1e\n\x17GetGroupActionsResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0H\x00\x1a\xd3\x1d\n\x19GetGroupActionsResponseV0\x12r\n\rgroup_actions\x18\x01 \x01(\x0b\x32Y.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a[\n\tMintEvent\x12\x0e\n\x06\x61mount\x18\x01 \x01(\x04\x12\x14\n\x0crecipient_id\x18\x02 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a[\n\tBurnEvent\x12\x0e\n\x06\x61mount\x18\x01 \x01(\x04\x12\x14\n\x0c\x62urn_from_id\x18\x02 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1aJ\n\x0b\x46reezeEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1aL\n\rUnfreezeEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\x66\n\x17\x44\x65stroyFrozenFundsEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x0e\n\x06\x61mount\x18\x02 \x01(\x04\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\x64\n\x13SharedEncryptedNote\x12\x18\n\x10sender_key_index\x18\x01 \x01(\r\x12\x1b\n\x13recipient_key_index\x18\x02 \x01(\r\x12\x16\n\x0e\x65ncrypted_data\x18\x03 \x01(\x0c\x1a{\n\x15PersonalEncryptedNote\x12!\n\x19root_encryption_key_index\x18\x01 \x01(\r\x12\'\n\x1f\x64\x65rivation_encryption_key_index\x18\x02 \x01(\r\x12\x16\n\x0e\x65ncrypted_data\x18\x03 \x01(\x0c\x1a\xe9\x01\n\x14\x45mergencyActionEvent\x12\x81\x01\n\x0b\x61\x63tion_type\x18\x01 \x01(\x0e\x32l.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.EmergencyActionEvent.ActionType\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\"#\n\nActionType\x12\t\n\x05PAUSE\x10\x00\x12\n\n\x06RESUME\x10\x01\x42\x0e\n\x0c_public_note\x1a\x64\n\x16TokenConfigUpdateEvent\x12 \n\x18token_config_update_item\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\xe6\x03\n\x1eUpdateDirectPurchasePriceEvent\x12\x15\n\x0b\x66ixed_price\x18\x01 \x01(\x04H\x00\x12\x95\x01\n\x0evariable_price\x18\x02 \x01(\x0b\x32{.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEvent.PricingScheduleH\x00\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x01\x88\x01\x01\x1a\x33\n\x10PriceForQuantity\x12\x10\n\x08quantity\x18\x01 \x01(\x04\x12\r\n\x05price\x18\x02 \x01(\x04\x1a\xac\x01\n\x0fPricingSchedule\x12\x98\x01\n\x12price_for_quantity\x18\x01 \x03(\x0b\x32|.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEvent.PriceForQuantityB\x07\n\x05priceB\x0e\n\x0c_public_note\x1a\xfc\x02\n\x10GroupActionEvent\x12n\n\x0btoken_event\x18\x01 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.TokenEventH\x00\x12t\n\x0e\x64ocument_event\x18\x02 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DocumentEventH\x00\x12t\n\x0e\x63ontract_event\x18\x03 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.ContractEventH\x00\x42\x0c\n\nevent_type\x1a\x8b\x01\n\rDocumentEvent\x12r\n\x06\x63reate\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DocumentCreateEventH\x00\x42\x06\n\x04type\x1a/\n\x13\x44ocumentCreateEvent\x12\x18\n\x10\x63reated_document\x18\x01 \x01(\x0c\x1a/\n\x13\x43ontractUpdateEvent\x12\x18\n\x10updated_contract\x18\x01 \x01(\x0c\x1a\x8b\x01\n\rContractEvent\x12r\n\x06update\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.ContractUpdateEventH\x00\x42\x06\n\x04type\x1a\xd1\x07\n\nTokenEvent\x12\x66\n\x04mint\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.MintEventH\x00\x12\x66\n\x04\x62urn\x18\x02 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.BurnEventH\x00\x12j\n\x06\x66reeze\x18\x03 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.FreezeEventH\x00\x12n\n\x08unfreeze\x18\x04 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UnfreezeEventH\x00\x12\x84\x01\n\x14\x64\x65stroy_frozen_funds\x18\x05 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DestroyFrozenFundsEventH\x00\x12}\n\x10\x65mergency_action\x18\x06 \x01(\x0b\x32\x61.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.EmergencyActionEventH\x00\x12\x82\x01\n\x13token_config_update\x18\x07 \x01(\x0b\x32\x63.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.TokenConfigUpdateEventH\x00\x12\x83\x01\n\x0cupdate_price\x18\x08 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEventH\x00\x42\x06\n\x04type\x1a\x93\x01\n\x10GroupActionEntry\x12\x11\n\taction_id\x18\x01 \x01(\x0c\x12l\n\x05\x65vent\x18\x02 \x01(\x0b\x32].org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionEvent\x1a\x84\x01\n\x0cGroupActions\x12t\n\rgroup_actions\x18\x01 \x03(\x0b\x32].org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionEntryB\x08\n\x06resultB\t\n\x07version\"\x88\x03\n\x1cGetGroupActionSignersRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionSignersRequest.GetGroupActionSignersRequestV0H\x00\x1a\xce\x01\n\x1eGetGroupActionSignersRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12T\n\x06status\x18\x03 \x01(\x0e\x32\x44.org.dash.platform.dapi.v0.GetGroupActionSignersRequest.ActionStatus\x12\x11\n\taction_id\x18\x04 \x01(\x0c\x12\r\n\x05prove\x18\x05 \x01(\x08\"&\n\x0c\x41\x63tionStatus\x12\n\n\x06\x41\x43TIVE\x10\x00\x12\n\n\x06\x43LOSED\x10\x01\x42\t\n\x07version\"\x8b\x05\n\x1dGetGroupActionSignersResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0H\x00\x1a\xf6\x03\n\x1fGetGroupActionSignersResponseV0\x12\x8b\x01\n\x14group_action_signers\x18\x01 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0.GroupActionSignersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x35\n\x11GroupActionSigner\x12\x11\n\tsigner_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\x91\x01\n\x12GroupActionSigners\x12{\n\x07signers\x18\x01 \x03(\x0b\x32j.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0.GroupActionSignerB\x08\n\x06resultB\t\n\x07version\"\xb5\x01\n\x15GetAddressInfoRequest\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetAddressInfoRequest.GetAddressInfoRequestV0H\x00\x1a\x39\n\x17GetAddressInfoRequestV0\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x85\x01\n\x10\x41\x64\x64ressInfoEntry\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12J\n\x11\x62\x61lance_and_nonce\x18\x02 \x01(\x0b\x32*.org.dash.platform.dapi.v0.BalanceAndNonceH\x00\x88\x01\x01\x42\x14\n\x12_balance_and_nonce\"1\n\x0f\x42\x61lanceAndNonce\x12\x0f\n\x07\x62\x61lance\x18\x01 \x01(\x04\x12\r\n\x05nonce\x18\x02 \x01(\r\"_\n\x12\x41\x64\x64ressInfoEntries\x12I\n\x14\x61\x64\x64ress_info_entries\x18\x01 \x03(\x0b\x32+.org.dash.platform.dapi.v0.AddressInfoEntry\"m\n\x14\x41\x64\x64ressBalanceChange\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\x19\n\x0bset_balance\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x1c\n\x0e\x61\x64\x64_to_balance\x18\x03 \x01(\x04\x42\x02\x30\x01H\x00\x42\x0b\n\toperation\"x\n\x1a\x42lockAddressBalanceChanges\x12\x18\n\x0c\x62lock_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12@\n\x07\x63hanges\x18\x02 \x03(\x0b\x32/.org.dash.platform.dapi.v0.AddressBalanceChange\"k\n\x1b\x41\x64\x64ressBalanceUpdateEntries\x12L\n\rblock_changes\x18\x01 \x03(\x0b\x32\x35.org.dash.platform.dapi.v0.BlockAddressBalanceChanges\"\xe1\x02\n\x16GetAddressInfoResponse\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetAddressInfoResponse.GetAddressInfoResponseV0H\x00\x1a\xe1\x01\n\x18GetAddressInfoResponseV0\x12I\n\x12\x61\x64\x64ress_info_entry\x18\x01 \x01(\x0b\x32+.org.dash.platform.dapi.v0.AddressInfoEntryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc3\x01\n\x18GetAddressesInfosRequest\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetAddressesInfosRequest.GetAddressesInfosRequestV0H\x00\x1a>\n\x1aGetAddressesInfosRequestV0\x12\x11\n\taddresses\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf1\x02\n\x19GetAddressesInfosResponse\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetAddressesInfosResponse.GetAddressesInfosResponseV0H\x00\x1a\xe8\x01\n\x1bGetAddressesInfosResponseV0\x12M\n\x14\x61\x64\x64ress_info_entries\x18\x01 \x01(\x0b\x32-.org.dash.platform.dapi.v0.AddressInfoEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb5\x01\n\x1dGetAddressesTrunkStateRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetAddressesTrunkStateRequest.GetAddressesTrunkStateRequestV0H\x00\x1a!\n\x1fGetAddressesTrunkStateRequestV0B\t\n\x07version\"\xaa\x02\n\x1eGetAddressesTrunkStateResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetAddressesTrunkStateResponse.GetAddressesTrunkStateResponseV0H\x00\x1a\x92\x01\n GetAddressesTrunkStateResponseV0\x12/\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.Proof\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\t\n\x07version\"\xf0\x01\n\x1eGetAddressesBranchStateRequest\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetAddressesBranchStateRequest.GetAddressesBranchStateRequestV0H\x00\x1aY\n GetAddressesBranchStateRequestV0\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x64\x65pth\x18\x02 \x01(\r\x12\x19\n\x11\x63heckpoint_height\x18\x03 \x01(\x04\x42\t\n\x07version\"\xd1\x01\n\x1fGetAddressesBranchStateResponse\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetAddressesBranchStateResponse.GetAddressesBranchStateResponseV0H\x00\x1a\x37\n!GetAddressesBranchStateResponseV0\x12\x12\n\nmerk_proof\x18\x02 \x01(\x0c\x42\t\n\x07version\"\x9e\x02\n%GetRecentAddressBalanceChangesRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesRequest.GetRecentAddressBalanceChangesRequestV0H\x00\x1ar\n\'GetRecentAddressBalanceChangesRequestV0\x12\x18\n\x0cstart_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x02 \x01(\x08\x12\x1e\n\x16start_height_exclusive\x18\x03 \x01(\x08\x42\t\n\x07version\"\xb8\x03\n&GetRecentAddressBalanceChangesResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesResponse.GetRecentAddressBalanceChangesResponseV0H\x00\x1a\x88\x02\n(GetRecentAddressBalanceChangesResponseV0\x12`\n\x1e\x61\x64\x64ress_balance_update_entries\x18\x01 \x01(\x0b\x32\x36.org.dash.platform.dapi.v0.AddressBalanceUpdateEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"G\n\x16\x42lockHeightCreditEntry\x12\x18\n\x0c\x62lock_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x13\n\x07\x63redits\x18\x02 \x01(\x04\x42\x02\x30\x01\"\xb0\x01\n\x1d\x43ompactedAddressBalanceChange\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\x19\n\x0bset_credits\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12V\n\x19\x61\x64\x64_to_credits_operations\x18\x03 \x01(\x0b\x32\x31.org.dash.platform.dapi.v0.AddToCreditsOperationsH\x00\x42\x0b\n\toperation\"\\\n\x16\x41\x64\x64ToCreditsOperations\x12\x42\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x31.org.dash.platform.dapi.v0.BlockHeightCreditEntry\"\xae\x01\n#CompactedBlockAddressBalanceChanges\x12\x1e\n\x12start_block_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1c\n\x10\x65nd_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12I\n\x07\x63hanges\x18\x03 \x03(\x0b\x32\x38.org.dash.platform.dapi.v0.CompactedAddressBalanceChange\"\x87\x01\n$CompactedAddressBalanceUpdateEntries\x12_\n\x17\x63ompacted_block_changes\x18\x01 \x03(\x0b\x32>.org.dash.platform.dapi.v0.CompactedBlockAddressBalanceChanges\"\xa9\x02\n.GetRecentCompactedAddressBalanceChangesRequest\x12\x88\x01\n\x02v0\x18\x01 \x01(\x0b\x32z.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesRequest.GetRecentCompactedAddressBalanceChangesRequestV0H\x00\x1a\x61\n0GetRecentCompactedAddressBalanceChangesRequestV0\x12\x1e\n\x12start_block_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf0\x03\n/GetRecentCompactedAddressBalanceChangesResponse\x12\x8a\x01\n\x02v0\x18\x01 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesResponse.GetRecentCompactedAddressBalanceChangesResponseV0H\x00\x1a\xa4\x02\n1GetRecentCompactedAddressBalanceChangesResponseV0\x12s\n(compacted_address_balance_update_entries\x18\x01 \x01(\x0b\x32?.org.dash.platform.dapi.v0.CompactedAddressBalanceUpdateEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xf4\x01\n GetShieldedEncryptedNotesRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesRequest.GetShieldedEncryptedNotesRequestV0H\x00\x1aW\n\"GetShieldedEncryptedNotesRequestV0\x12\x13\n\x0bstart_index\x18\x01 \x01(\x04\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xbc\x05\n!GetShieldedEncryptedNotesResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0H\x00\x1a\x9b\x04\n#GetShieldedEncryptedNotesResponseV0\x12\x8a\x01\n\x0f\x65ncrypted_notes\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0.EncryptedNotesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aW\n\rEncryptedNote\x12\x11\n\tnullifier\x18\x01 \x01(\x0c\x12\x0b\n\x03\x63mx\x18\x02 \x01(\x0c\x12\x16\n\x0e\x65ncrypted_note\x18\x03 \x01(\x0c\x12\x0e\n\x06\x63v_net\x18\x04 \x01(\x0c\x1a\x91\x01\n\x0e\x45ncryptedNotes\x12\x7f\n\x07\x65ntries\x18\x01 \x03(\x0b\x32n.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0.EncryptedNoteB\x08\n\x06resultB\t\n\x07version\"\xb4\x01\n\x19GetShieldedAnchorsRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetShieldedAnchorsRequest.GetShieldedAnchorsRequestV0H\x00\x1a,\n\x1bGetShieldedAnchorsRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xb1\x03\n\x1aGetShieldedAnchorsResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse.GetShieldedAnchorsResponseV0H\x00\x1a\xa5\x02\n\x1cGetShieldedAnchorsResponseV0\x12m\n\x07\x61nchors\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse.GetShieldedAnchorsResponseV0.AnchorsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1a\n\x07\x41nchors\x12\x0f\n\x07\x61nchors\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xd8\x01\n\"GetMostRecentShieldedAnchorRequest\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorRequest.GetMostRecentShieldedAnchorRequestV0H\x00\x1a\x35\n$GetMostRecentShieldedAnchorRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xdc\x02\n#GetMostRecentShieldedAnchorResponse\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorResponse.GetMostRecentShieldedAnchorResponseV0H\x00\x1a\xb5\x01\n%GetMostRecentShieldedAnchorResponseV0\x12\x10\n\x06\x61nchor\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbc\x01\n\x1bGetShieldedPoolStateRequest\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetShieldedPoolStateRequest.GetShieldedPoolStateRequestV0H\x00\x1a.\n\x1dGetShieldedPoolStateRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xcb\x02\n\x1cGetShieldedPoolStateResponse\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedPoolStateResponse.GetShieldedPoolStateResponseV0H\x00\x1a\xb9\x01\n\x1eGetShieldedPoolStateResponseV0\x12\x1b\n\rtotal_balance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc0\x01\n\x1cGetShieldedNotesCountRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedNotesCountRequest.GetShieldedNotesCountRequestV0H\x00\x1a/\n\x1eGetShieldedNotesCountRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xd3\x02\n\x1dGetShieldedNotesCountResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetShieldedNotesCountResponse.GetShieldedNotesCountResponseV0H\x00\x1a\xbe\x01\n\x1fGetShieldedNotesCountResponseV0\x12\x1f\n\x11total_notes_count\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xd4\x01\n\x1cGetShieldedNullifiersRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedNullifiersRequest.GetShieldedNullifiersRequestV0H\x00\x1a\x43\n\x1eGetShieldedNullifiersRequestV0\x12\x12\n\nnullifiers\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x86\x05\n\x1dGetShieldedNullifiersResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0H\x00\x1a\xf1\x03\n\x1fGetShieldedNullifiersResponseV0\x12\x88\x01\n\x12nullifier_statuses\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0.NullifierStatusesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x36\n\x0fNullifierStatus\x12\x11\n\tnullifier\x18\x01 \x01(\x0c\x12\x10\n\x08is_spent\x18\x02 \x01(\x08\x1a\x8e\x01\n\x11NullifierStatuses\x12y\n\x07\x65ntries\x18\x01 \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0.NullifierStatusB\x08\n\x06resultB\t\n\x07version*Z\n\nKeyPurpose\x12\x12\n\x0e\x41UTHENTICATION\x10\x00\x12\x0e\n\nENCRYPTION\x10\x01\x12\x0e\n\nDECRYPTION\x10\x02\x12\x0c\n\x08TRANSFER\x10\x03\x12\n\n\x06VOTING\x10\x05\x32\xce\x44\n\x08Platform\x12\x93\x01\n\x18\x62roadcastStateTransition\x12:.org.dash.platform.dapi.v0.BroadcastStateTransitionRequest\x1a;.org.dash.platform.dapi.v0.BroadcastStateTransitionResponse\x12l\n\x0bgetIdentity\x12-.org.dash.platform.dapi.v0.GetIdentityRequest\x1a..org.dash.platform.dapi.v0.GetIdentityResponse\x12x\n\x0fgetIdentityKeys\x12\x31.org.dash.platform.dapi.v0.GetIdentityKeysRequest\x1a\x32.org.dash.platform.dapi.v0.GetIdentityKeysResponse\x12\x96\x01\n\x19getIdentitiesContractKeys\x12;.org.dash.platform.dapi.v0.GetIdentitiesContractKeysRequest\x1a<.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse\x12{\n\x10getIdentityNonce\x12\x32.org.dash.platform.dapi.v0.GetIdentityNonceRequest\x1a\x33.org.dash.platform.dapi.v0.GetIdentityNonceResponse\x12\x93\x01\n\x18getIdentityContractNonce\x12:.org.dash.platform.dapi.v0.GetIdentityContractNonceRequest\x1a;.org.dash.platform.dapi.v0.GetIdentityContractNonceResponse\x12\x81\x01\n\x12getIdentityBalance\x12\x34.org.dash.platform.dapi.v0.GetIdentityBalanceRequest\x1a\x35.org.dash.platform.dapi.v0.GetIdentityBalanceResponse\x12\x8a\x01\n\x15getIdentitiesBalances\x12\x37.org.dash.platform.dapi.v0.GetIdentitiesBalancesRequest\x1a\x38.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse\x12\xa2\x01\n\x1dgetIdentityBalanceAndRevision\x12?.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionRequest\x1a@.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse\x12\xaf\x01\n#getEvonodesProposedEpochBlocksByIds\x12\x45.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByIdsRequest\x1a\x41.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse\x12\xb3\x01\n%getEvonodesProposedEpochBlocksByRange\x12G.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByRangeRequest\x1a\x41.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse\x12x\n\x0fgetDataContract\x12\x31.org.dash.platform.dapi.v0.GetDataContractRequest\x1a\x32.org.dash.platform.dapi.v0.GetDataContractResponse\x12\x8d\x01\n\x16getDataContractHistory\x12\x38.org.dash.platform.dapi.v0.GetDataContractHistoryRequest\x1a\x39.org.dash.platform.dapi.v0.GetDataContractHistoryResponse\x12{\n\x10getDataContracts\x12\x32.org.dash.platform.dapi.v0.GetDataContractsRequest\x1a\x33.org.dash.platform.dapi.v0.GetDataContractsResponse\x12\x81\x01\n\x12getDocumentHistory\x12\x34.org.dash.platform.dapi.v0.GetDocumentHistoryRequest\x1a\x35.org.dash.platform.dapi.v0.GetDocumentHistoryResponse\x12o\n\x0cgetDocuments\x12..org.dash.platform.dapi.v0.GetDocumentsRequest\x1a/.org.dash.platform.dapi.v0.GetDocumentsResponse\x12\x99\x01\n\x1agetIdentityByPublicKeyHash\x12<.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashRequest\x1a=.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashResponse\x12\xb4\x01\n#getIdentityByNonUniquePublicKeyHash\x12\x45.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashRequest\x1a\x46.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse\x12\x9f\x01\n\x1cwaitForStateTransitionResult\x12>.org.dash.platform.dapi.v0.WaitForStateTransitionResultRequest\x1a?.org.dash.platform.dapi.v0.WaitForStateTransitionResultResponse\x12\x81\x01\n\x12getConsensusParams\x12\x34.org.dash.platform.dapi.v0.GetConsensusParamsRequest\x1a\x35.org.dash.platform.dapi.v0.GetConsensusParamsResponse\x12\xa5\x01\n\x1egetProtocolVersionUpgradeState\x12@.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateRequest\x1a\x41.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse\x12\xb4\x01\n#getProtocolVersionUpgradeVoteStatus\x12\x45.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusRequest\x1a\x46.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse\x12r\n\rgetEpochsInfo\x12/.org.dash.platform.dapi.v0.GetEpochsInfoRequest\x1a\x30.org.dash.platform.dapi.v0.GetEpochsInfoResponse\x12\x8d\x01\n\x16getFinalizedEpochInfos\x12\x38.org.dash.platform.dapi.v0.GetFinalizedEpochInfosRequest\x1a\x39.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse\x12\x8a\x01\n\x15getContestedResources\x12\x37.org.dash.platform.dapi.v0.GetContestedResourcesRequest\x1a\x38.org.dash.platform.dapi.v0.GetContestedResourcesResponse\x12\xa2\x01\n\x1dgetContestedResourceVoteState\x12?.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest\x1a@.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse\x12\xba\x01\n%getContestedResourceVotersForIdentity\x12G.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest\x1aH.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse\x12\xae\x01\n!getContestedResourceIdentityVotes\x12\x43.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest\x1a\x44.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse\x12\x8a\x01\n\x15getVotePollsByEndDate\x12\x37.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest\x1a\x38.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse\x12\xa5\x01\n\x1egetPrefundedSpecializedBalance\x12@.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceRequest\x1a\x41.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceResponse\x12\x96\x01\n\x19getTotalCreditsInPlatform\x12;.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformRequest\x1a<.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformResponse\x12x\n\x0fgetPathElements\x12\x31.org.dash.platform.dapi.v0.GetPathElementsRequest\x1a\x32.org.dash.platform.dapi.v0.GetPathElementsResponse\x12\x66\n\tgetStatus\x12+.org.dash.platform.dapi.v0.GetStatusRequest\x1a,.org.dash.platform.dapi.v0.GetStatusResponse\x12\x8a\x01\n\x15getCurrentQuorumsInfo\x12\x37.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoRequest\x1a\x38.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse\x12\x93\x01\n\x18getIdentityTokenBalances\x12:.org.dash.platform.dapi.v0.GetIdentityTokenBalancesRequest\x1a;.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse\x12\x99\x01\n\x1agetIdentitiesTokenBalances\x12<.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesRequest\x1a=.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse\x12\x8a\x01\n\x15getIdentityTokenInfos\x12\x37.org.dash.platform.dapi.v0.GetIdentityTokenInfosRequest\x1a\x38.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse\x12\x90\x01\n\x17getIdentitiesTokenInfos\x12\x39.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosRequest\x1a:.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse\x12{\n\x10getTokenStatuses\x12\x32.org.dash.platform.dapi.v0.GetTokenStatusesRequest\x1a\x33.org.dash.platform.dapi.v0.GetTokenStatusesResponse\x12\x9f\x01\n\x1cgetTokenDirectPurchasePrices\x12>.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesRequest\x1a?.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse\x12\x87\x01\n\x14getTokenContractInfo\x12\x36.org.dash.platform.dapi.v0.GetTokenContractInfoRequest\x1a\x37.org.dash.platform.dapi.v0.GetTokenContractInfoResponse\x12\xb1\x01\n\"getTokenPreProgrammedDistributions\x12\x44.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest\x1a\x45.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse\x12\xbd\x01\n&getTokenPerpetualDistributionLastClaim\x12H.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest\x1aI.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse\x12\x84\x01\n\x13getTokenTotalSupply\x12\x35.org.dash.platform.dapi.v0.GetTokenTotalSupplyRequest\x1a\x36.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse\x12o\n\x0cgetGroupInfo\x12..org.dash.platform.dapi.v0.GetGroupInfoRequest\x1a/.org.dash.platform.dapi.v0.GetGroupInfoResponse\x12r\n\rgetGroupInfos\x12/.org.dash.platform.dapi.v0.GetGroupInfosRequest\x1a\x30.org.dash.platform.dapi.v0.GetGroupInfosResponse\x12x\n\x0fgetGroupActions\x12\x31.org.dash.platform.dapi.v0.GetGroupActionsRequest\x1a\x32.org.dash.platform.dapi.v0.GetGroupActionsResponse\x12\x8a\x01\n\x15getGroupActionSigners\x12\x37.org.dash.platform.dapi.v0.GetGroupActionSignersRequest\x1a\x38.org.dash.platform.dapi.v0.GetGroupActionSignersResponse\x12u\n\x0egetAddressInfo\x12\x30.org.dash.platform.dapi.v0.GetAddressInfoRequest\x1a\x31.org.dash.platform.dapi.v0.GetAddressInfoResponse\x12~\n\x11getAddressesInfos\x12\x33.org.dash.platform.dapi.v0.GetAddressesInfosRequest\x1a\x34.org.dash.platform.dapi.v0.GetAddressesInfosResponse\x12\x8d\x01\n\x16getAddressesTrunkState\x12\x38.org.dash.platform.dapi.v0.GetAddressesTrunkStateRequest\x1a\x39.org.dash.platform.dapi.v0.GetAddressesTrunkStateResponse\x12\x90\x01\n\x17getAddressesBranchState\x12\x39.org.dash.platform.dapi.v0.GetAddressesBranchStateRequest\x1a:.org.dash.platform.dapi.v0.GetAddressesBranchStateResponse\x12\xa5\x01\n\x1egetRecentAddressBalanceChanges\x12@.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesRequest\x1a\x41.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesResponse\x12\xc0\x01\n\'getRecentCompactedAddressBalanceChanges\x12I.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesRequest\x1aJ.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesResponse\x12\x96\x01\n\x19getShieldedEncryptedNotes\x12;.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesRequest\x1a<.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse\x12\x81\x01\n\x12getShieldedAnchors\x12\x34.org.dash.platform.dapi.v0.GetShieldedAnchorsRequest\x1a\x35.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse\x12\x9c\x01\n\x1bgetMostRecentShieldedAnchor\x12=.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorRequest\x1a>.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorResponse\x12\x87\x01\n\x14getShieldedPoolState\x12\x36.org.dash.platform.dapi.v0.GetShieldedPoolStateRequest\x1a\x37.org.dash.platform.dapi.v0.GetShieldedPoolStateResponse\x12\x8a\x01\n\x15getShieldedNotesCount\x12\x37.org.dash.platform.dapi.v0.GetShieldedNotesCountRequest\x1a\x38.org.dash.platform.dapi.v0.GetShieldedNotesCountResponse\x12\x8a\x01\n\x15getShieldedNullifiers\x12\x37.org.dash.platform.dapi.v0.GetShieldedNullifiersRequest\x1a\x38.org.dash.platform.dapi.v0.GetShieldedNullifiersResponseb\x06proto3'
+  serialized_pb=b'\n\x0eplatform.proto\x12\x19org.dash.platform.dapi.v0\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x81\x01\n\x05Proof\x12\x15\n\rgrovedb_proof\x18\x01 \x01(\x0c\x12\x13\n\x0bquorum_hash\x18\x02 \x01(\x0c\x12\x11\n\tsignature\x18\x03 \x01(\x0c\x12\r\n\x05round\x18\x04 \x01(\r\x12\x15\n\rblock_id_hash\x18\x05 \x01(\x0c\x12\x13\n\x0bquorum_type\x18\x06 \x01(\r\"\x98\x01\n\x10ResponseMetadata\x12\x12\n\x06height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12 \n\x18\x63ore_chain_locked_height\x18\x02 \x01(\r\x12\r\n\x05\x65poch\x18\x03 \x01(\r\x12\x13\n\x07time_ms\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x18\n\x10protocol_version\x18\x05 \x01(\r\x12\x10\n\x08\x63hain_id\x18\x06 \x01(\t\"L\n\x1dStateTransitionBroadcastError\x12\x0c\n\x04\x63ode\x18\x01 \x01(\r\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x0c\n\x04\x64\x61ta\x18\x03 \x01(\x0c\";\n\x1f\x42roadcastStateTransitionRequest\x12\x18\n\x10state_transition\x18\x01 \x01(\x0c\"\"\n BroadcastStateTransitionResponse\"\xa4\x01\n\x12GetIdentityRequest\x12P\n\x02v0\x18\x01 \x01(\x0b\x32\x42.org.dash.platform.dapi.v0.GetIdentityRequest.GetIdentityRequestV0H\x00\x1a\x31\n\x14GetIdentityRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xc1\x01\n\x17GetIdentityNonceRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetIdentityNonceRequest.GetIdentityNonceRequestV0H\x00\x1a?\n\x19GetIdentityNonceRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf6\x01\n\x1fGetIdentityContractNonceRequest\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentityContractNonceRequest.GetIdentityContractNonceRequestV0H\x00\x1a\\\n!GetIdentityContractNonceRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x13\n\x0b\x63ontract_id\x18\x02 \x01(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xc0\x01\n\x19GetIdentityBalanceRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetIdentityBalanceRequest.GetIdentityBalanceRequestV0H\x00\x1a\x38\n\x1bGetIdentityBalanceRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xec\x01\n$GetIdentityBalanceAndRevisionRequest\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionRequest.GetIdentityBalanceAndRevisionRequestV0H\x00\x1a\x43\n&GetIdentityBalanceAndRevisionRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9e\x02\n\x13GetIdentityResponse\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetIdentityResponse.GetIdentityResponseV0H\x00\x1a\xa7\x01\n\x15GetIdentityResponseV0\x12\x12\n\x08identity\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbc\x02\n\x18GetIdentityNonceResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetIdentityNonceResponse.GetIdentityNonceResponseV0H\x00\x1a\xb6\x01\n\x1aGetIdentityNonceResponseV0\x12\x1c\n\x0eidentity_nonce\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xe5\x02\n GetIdentityContractNonceResponse\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentityContractNonceResponse.GetIdentityContractNonceResponseV0H\x00\x1a\xc7\x01\n\"GetIdentityContractNonceResponseV0\x12%\n\x17identity_contract_nonce\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbd\x02\n\x1aGetIdentityBalanceResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetIdentityBalanceResponse.GetIdentityBalanceResponseV0H\x00\x1a\xb1\x01\n\x1cGetIdentityBalanceResponseV0\x12\x15\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb1\x04\n%GetIdentityBalanceAndRevisionResponse\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse.GetIdentityBalanceAndRevisionResponseV0H\x00\x1a\x84\x03\n\'GetIdentityBalanceAndRevisionResponseV0\x12\x9b\x01\n\x14\x62\x61lance_and_revision\x18\x01 \x01(\x0b\x32{.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse.GetIdentityBalanceAndRevisionResponseV0.BalanceAndRevisionH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a?\n\x12\x42\x61lanceAndRevision\x12\x13\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x14\n\x08revision\x18\x02 \x01(\x04\x42\x02\x30\x01\x42\x08\n\x06resultB\t\n\x07version\"\xd1\x01\n\x0eKeyRequestType\x12\x36\n\x08\x61ll_keys\x18\x01 \x01(\x0b\x32\".org.dash.platform.dapi.v0.AllKeysH\x00\x12@\n\rspecific_keys\x18\x02 \x01(\x0b\x32\'.org.dash.platform.dapi.v0.SpecificKeysH\x00\x12:\n\nsearch_key\x18\x03 \x01(\x0b\x32$.org.dash.platform.dapi.v0.SearchKeyH\x00\x42\t\n\x07request\"\t\n\x07\x41llKeys\"\x1f\n\x0cSpecificKeys\x12\x0f\n\x07key_ids\x18\x01 \x03(\r\"\xb6\x01\n\tSearchKey\x12I\n\x0bpurpose_map\x18\x01 \x03(\x0b\x32\x34.org.dash.platform.dapi.v0.SearchKey.PurposeMapEntry\x1a^\n\x0fPurposeMapEntry\x12\x0b\n\x03key\x18\x01 \x01(\r\x12:\n\x05value\x18\x02 \x01(\x0b\x32+.org.dash.platform.dapi.v0.SecurityLevelMap:\x02\x38\x01\"\xbf\x02\n\x10SecurityLevelMap\x12]\n\x12security_level_map\x18\x01 \x03(\x0b\x32\x41.org.dash.platform.dapi.v0.SecurityLevelMap.SecurityLevelMapEntry\x1aw\n\x15SecurityLevelMapEntry\x12\x0b\n\x03key\x18\x01 \x01(\r\x12M\n\x05value\x18\x02 \x01(\x0e\x32>.org.dash.platform.dapi.v0.SecurityLevelMap.KeyKindRequestType:\x02\x38\x01\"S\n\x12KeyKindRequestType\x12\x1f\n\x1b\x43URRENT_KEY_OF_KIND_REQUEST\x10\x00\x12\x1c\n\x18\x41LL_KEYS_OF_KIND_REQUEST\x10\x01\"\xda\x02\n\x16GetIdentityKeysRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetIdentityKeysRequest.GetIdentityKeysRequestV0H\x00\x1a\xda\x01\n\x18GetIdentityKeysRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12?\n\x0crequest_type\x18\x02 \x01(\x0b\x32).org.dash.platform.dapi.v0.KeyRequestType\x12+\n\x05limit\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x04 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\x99\x03\n\x17GetIdentityKeysResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetIdentityKeysResponse.GetIdentityKeysResponseV0H\x00\x1a\x96\x02\n\x19GetIdentityKeysResponseV0\x12\x61\n\x04keys\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetIdentityKeysResponse.GetIdentityKeysResponseV0.KeysH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1a\n\x04Keys\x12\x12\n\nkeys_bytes\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xef\x02\n GetIdentitiesContractKeysRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentitiesContractKeysRequest.GetIdentitiesContractKeysRequestV0H\x00\x1a\xd1\x01\n\"GetIdentitiesContractKeysRequestV0\x12\x16\n\x0eidentities_ids\x18\x01 \x03(\x0c\x12\x13\n\x0b\x63ontract_id\x18\x02 \x01(\x0c\x12\x1f\n\x12\x64ocument_type_name\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x37\n\x08purposes\x18\x04 \x03(\x0e\x32%.org.dash.platform.dapi.v0.KeyPurpose\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x15\n\x13_document_type_nameB\t\n\x07version\"\xdf\x06\n!GetIdentitiesContractKeysResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0H\x00\x1a\xbe\x05\n#GetIdentitiesContractKeysResponseV0\x12\x8a\x01\n\x0fidentities_keys\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.IdentitiesKeysH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aY\n\x0bPurposeKeys\x12\x36\n\x07purpose\x18\x01 \x01(\x0e\x32%.org.dash.platform.dapi.v0.KeyPurpose\x12\x12\n\nkeys_bytes\x18\x02 \x03(\x0c\x1a\x9f\x01\n\x0cIdentityKeys\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12z\n\x04keys\x18\x02 \x03(\x0b\x32l.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.PurposeKeys\x1a\x90\x01\n\x0eIdentitiesKeys\x12~\n\x07\x65ntries\x18\x01 \x03(\x0b\x32m.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse.GetIdentitiesContractKeysResponseV0.IdentityKeysB\x08\n\x06resultB\t\n\x07version\"\xa4\x02\n*GetEvonodesProposedEpochBlocksByIdsRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByIdsRequest.GetEvonodesProposedEpochBlocksByIdsRequestV0H\x00\x1ah\n,GetEvonodesProposedEpochBlocksByIdsRequestV0\x12\x12\n\x05\x65poch\x18\x01 \x01(\rH\x00\x88\x01\x01\x12\x0b\n\x03ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\x08\n\x06_epochB\t\n\x07version\"\x92\x06\n&GetEvonodesProposedEpochBlocksResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0H\x00\x1a\xe2\x04\n(GetEvonodesProposedEpochBlocksResponseV0\x12\xb1\x01\n#evonodes_proposed_block_counts_info\x18\x01 \x01(\x0b\x32\x81\x01.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0.EvonodesProposedBlocksH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a?\n\x15\x45vonodeProposedBlocks\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x02 \x01(\x04\x42\x02\x30\x01\x1a\xc4\x01\n\x16\x45vonodesProposedBlocks\x12\xa9\x01\n\x1e\x65vonodes_proposed_block_counts\x18\x01 \x03(\x0b\x32\x80\x01.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse.GetEvonodesProposedEpochBlocksResponseV0.EvonodeProposedBlocksB\x08\n\x06resultB\t\n\x07version\"\xf2\x02\n,GetEvonodesProposedEpochBlocksByRangeRequest\x12\x84\x01\n\x02v0\x18\x01 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByRangeRequest.GetEvonodesProposedEpochBlocksByRangeRequestV0H\x00\x1a\xaf\x01\n.GetEvonodesProposedEpochBlocksByRangeRequestV0\x12\x12\n\x05\x65poch\x18\x01 \x01(\rH\x01\x88\x01\x01\x12\x12\n\x05limit\x18\x02 \x01(\rH\x02\x88\x01\x01\x12\x15\n\x0bstart_after\x18\x03 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x04 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x07\n\x05startB\x08\n\x06_epochB\x08\n\x06_limitB\t\n\x07version\"\xcd\x01\n\x1cGetIdentitiesBalancesRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetIdentitiesBalancesRequest.GetIdentitiesBalancesRequestV0H\x00\x1a<\n\x1eGetIdentitiesBalancesRequestV0\x12\x0b\n\x03ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9f\x05\n\x1dGetIdentitiesBalancesResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0H\x00\x1a\x8a\x04\n\x1fGetIdentitiesBalancesResponseV0\x12\x8a\x01\n\x13identities_balances\x18\x01 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0.IdentitiesBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aL\n\x0fIdentityBalance\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x18\n\x07\x62\x61lance\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\x8f\x01\n\x12IdentitiesBalances\x12y\n\x07\x65ntries\x18\x01 \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse.GetIdentitiesBalancesResponseV0.IdentityBalanceB\x08\n\x06resultB\t\n\x07version\"\xb4\x01\n\x16GetDataContractRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetDataContractRequest.GetDataContractRequestV0H\x00\x1a\x35\n\x18GetDataContractRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xb3\x02\n\x17GetDataContractResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetDataContractResponse.GetDataContractResponseV0H\x00\x1a\xb0\x01\n\x19GetDataContractResponseV0\x12\x17\n\rdata_contract\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb9\x01\n\x17GetDataContractsRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetDataContractsRequest.GetDataContractsRequestV0H\x00\x1a\x37\n\x19GetDataContractsRequestV0\x12\x0b\n\x03ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xcf\x04\n\x18GetDataContractsResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetDataContractsResponse.GetDataContractsResponseV0H\x00\x1a[\n\x11\x44\x61taContractEntry\x12\x12\n\nidentifier\x18\x01 \x01(\x0c\x12\x32\n\rdata_contract\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.BytesValue\x1au\n\rDataContracts\x12\x64\n\x15\x64\x61ta_contract_entries\x18\x01 \x03(\x0b\x32\x45.org.dash.platform.dapi.v0.GetDataContractsResponse.DataContractEntry\x1a\xf5\x01\n\x1aGetDataContractsResponseV0\x12[\n\x0e\x64\x61ta_contracts\x18\x01 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDataContractsResponse.DataContractsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc5\x02\n\x1dGetDataContractHistoryRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetDataContractHistoryRequest.GetDataContractHistoryRequestV0H\x00\x1a\xb0\x01\n\x1fGetDataContractHistoryRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12+\n\x05limit\x18\x02 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0bstart_at_ms\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\xb2\x05\n\x1eGetDataContractHistoryResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0H\x00\x1a\x9a\x04\n GetDataContractHistoryResponseV0\x12\x8f\x01\n\x15\x64\x61ta_contract_history\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0.DataContractHistoryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a;\n\x18\x44\x61taContractHistoryEntry\x12\x10\n\x04\x64\x61te\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05value\x18\x02 \x01(\x0c\x1a\xaa\x01\n\x13\x44\x61taContractHistory\x12\x92\x01\n\x15\x64\x61ta_contract_entries\x18\x01 \x03(\x0b\x32s.org.dash.platform.dapi.v0.GetDataContractHistoryResponse.GetDataContractHistoryResponseV0.DataContractHistoryEntryB\x08\n\x06resultB\t\n\x07version\"\xf1\x15\n\x13GetDocumentsRequest\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV0H\x00\x12R\n\x02v1\x18\x02 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1H\x00\x1a\xfe\x02\n\x12\x44ocumentFieldValue\x12\x14\n\nbool_value\x18\x01 \x01(\x08H\x00\x12\x19\n\x0bint64_value\x18\x02 \x01(\x12\x42\x02\x30\x01H\x00\x12\x1a\n\x0cuint64_value\x18\x03 \x01(\x04\x42\x02\x30\x01H\x00\x12\x16\n\x0c\x64ouble_value\x18\x04 \x01(\x01H\x00\x12\x0e\n\x04text\x18\x05 \x01(\tH\x00\x12\x15\n\x0b\x62ytes_value\x18\x06 \x01(\x0cH\x00\x12[\n\x04list\x18\x07 \x01(\x0b\x32K.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValue.ValueListH\x00\x12\x14\n\nnull_value\x18\x08 \x01(\x08H\x00\x1a^\n\tValueList\x12Q\n\x06values\x18\x01 \x03(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValueB\t\n\x07variant\x1a\xbe\x01\n\x0bWhereClause\x12\r\n\x05\x66ield\x18\x01 \x01(\t\x12N\n\x08operator\x18\x02 \x01(\x0e\x32<.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereOperator\x12P\n\x05value\x18\x03 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValue\x1a\xa4\x01\n\x0fHavingAggregate\x12Y\n\x08\x66unction\x18\x01 \x01(\x0e\x32G.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregate.Function\x12\r\n\x05\x66ield\x18\x02 \x01(\t\"\'\n\x08\x46unction\x12\t\n\x05\x43OUNT\x10\x00\x12\x07\n\x03SUM\x10\x01\x12\x07\n\x03\x41VG\x10\x02\x1a\xf9\x03\n\x0cHavingClause\x12Q\n\taggregate\x18\x01 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregate\x12V\n\x08operator\x18\x02 \x01(\x0e\x32\x44.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingClause.Operator\x12R\n\x05value\x18\x03 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetDocumentsRequest.DocumentFieldValueH\x00\"\xe0\x01\n\x08Operator\x12\t\n\x05\x45QUAL\x10\x00\x12\r\n\tNOT_EQUAL\x10\x01\x12\x10\n\x0cGREATER_THAN\x10\x02\x12\x1a\n\x16GREATER_THAN_OR_EQUALS\x10\x03\x12\r\n\tLESS_THAN\x10\x04\x12\x17\n\x13LESS_THAN_OR_EQUALS\x10\x05\x12\x0b\n\x07\x42\x45TWEEN\x10\x06\x12\x1a\n\x16\x42\x45TWEEN_EXCLUDE_BOUNDS\x10\x07\x12\x18\n\x14\x42\x45TWEEN_EXCLUDE_LEFT\x10\x08\x12\x19\n\x15\x42\x45TWEEN_EXCLUDE_RIGHT\x10\t\x12\x06\n\x02IN\x10\nB\x07\n\x05right\x1a\x90\x01\n\x0bOrderClause\x12\x0f\n\x05\x66ield\x18\x01 \x01(\tH\x00\x12S\n\taggregate\x18\x03 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingAggregateH\x00\x12\x11\n\tascending\x18\x02 \x01(\x08\x42\x08\n\x06target\x1a\xbb\x01\n\x15GetDocumentsRequestV0\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x15\n\rdocument_type\x18\x02 \x01(\t\x12\r\n\x05where\x18\x03 \x01(\x0c\x12\x10\n\x08order_by\x18\x04 \x01(\x0c\x12\r\n\x05limit\x18\x05 \x01(\r\x12\x15\n\x0bstart_after\x18\x06 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x07 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x08 \x01(\x08\x42\x07\n\x05start\x1a\xf3\x05\n\x15GetDocumentsRequestV1\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x15\n\rdocument_type\x18\x02 \x01(\t\x12Q\n\rwhere_clauses\x18\x03 \x03(\x0b\x32:.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereClause\x12L\n\x08order_by\x18\x04 \x03(\x0b\x32:.org.dash.platform.dapi.v0.GetDocumentsRequest.OrderClause\x12\x12\n\x05limit\x18\x05 \x01(\rH\x01\x88\x01\x01\x12\x15\n\x0bstart_after\x18\x06 \x01(\x0cH\x00\x12\x12\n\x08start_at\x18\x07 \x01(\x0cH\x00\x12\r\n\x05prove\x18\x08 \x01(\x08\x12\\\n\x07selects\x18\t \x03(\x0b\x32K.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1.Select\x12\x10\n\x08group_by\x18\n \x03(\t\x12K\n\x06having\x18\x0b \x03(\x0b\x32;.org.dash.platform.dapi.v0.GetDocumentsRequest.HavingClause\x12\x13\n\x06offset\x18\x0c \x01(\rH\x02\x88\x01\x01\x1a\xc9\x01\n\x06Select\x12\x66\n\x08\x66unction\x18\x01 \x01(\x0e\x32T.org.dash.platform.dapi.v0.GetDocumentsRequest.GetDocumentsRequestV1.Select.Function\x12\r\n\x05\x66ield\x18\x02 \x01(\t\"H\n\x08\x46unction\x12\r\n\tDOCUMENTS\x10\x00\x12\t\n\x05\x43OUNT\x10\x01\x12\x07\n\x03SUM\x10\x02\x12\x07\n\x03\x41VG\x10\x03\x12\x07\n\x03MIN\x10\x04\x12\x07\n\x03MAX\x10\x05\x42\x07\n\x05startB\x08\n\x06_limitB\t\n\x07_offset\"\xfa\x01\n\rWhereOperator\x12\t\n\x05\x45QUAL\x10\x00\x12\x10\n\x0cGREATER_THAN\x10\x01\x12\x1a\n\x16GREATER_THAN_OR_EQUALS\x10\x02\x12\r\n\tLESS_THAN\x10\x03\x12\x17\n\x13LESS_THAN_OR_EQUALS\x10\x04\x12\x0b\n\x07\x42\x45TWEEN\x10\x05\x12\x1a\n\x16\x42\x45TWEEN_EXCLUDE_BOUNDS\x10\x06\x12\x18\n\x14\x42\x45TWEEN_EXCLUDE_LEFT\x10\x07\x12\x19\n\x15\x42\x45TWEEN_EXCLUDE_RIGHT\x10\x08\x12\x06\n\x02IN\x10\t\x12\x0f\n\x0bSTARTS_WITH\x10\n\x12\x11\n\rIN_TIME_RANGE\x10\x0b\x42\t\n\x07version\"\x87\x16\n\x14GetDocumentsResponse\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV0H\x00\x12T\n\x02v1\x18\x02 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1H\x00\x1a\x9b\x02\n\x16GetDocumentsResponseV0\x12\x65\n\tdocuments\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV0.DocumentsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1e\n\tDocuments\x12\x11\n\tdocuments\x18\x01 \x03(\x0c\x42\x08\n\x06result\x1a\x99\x12\n\x16GetDocumentsResponseV1\x12\x61\n\x04\x64\x61ta\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.ResultDataH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1e\n\tDocuments\x12\x11\n\tdocuments\x18\x01 \x03(\x0c\x1aL\n\nCountEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x03 \x01(\x04\x42\x02\x30\x01\x42\t\n\x07_in_key\x1ar\n\x0c\x43ountEntries\x12\x62\n\x07\x65ntries\x18\x01 \x03(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountEntry\x1a\xa0\x01\n\x0c\x43ountResults\x12\x1d\n\x0f\x61ggregate_count\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x66\n\x07\x65ntries\x18\x02 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountEntriesH\x00\x42\t\n\x07variant\x1aH\n\x08SumEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x0f\n\x03sum\x18\x03 \x01(\x12\x42\x02\x30\x01\x42\t\n\x07_in_key\x1an\n\nSumEntries\x12`\n\x07\x65ntries\x18\x01 \x03(\x0b\x32O.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumEntry\x1a\x9a\x01\n\nSumResults\x12\x1b\n\raggregate_sum\x18\x01 \x01(\x12\x42\x02\x30\x01H\x00\x12\x64\n\x07\x65ntries\x18\x02 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumEntriesH\x00\x42\t\n\x07variant\x1a_\n\x0c\x41verageEntry\x12\x13\n\x06in_key\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x12\x0b\n\x03key\x18\x02 \x01(\x0c\x12\x11\n\x05\x63ount\x18\x03 \x01(\x04\x42\x02\x30\x01\x12\x0f\n\x03sum\x18\x04 \x01(\x12\x42\x02\x30\x01\x42\t\n\x07_in_key\x1av\n\x0e\x41verageEntries\x12\x64\n\x07\x65ntries\x18\x01 \x03(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageEntry\x1a\x36\n\x10\x41verageAggregate\x12\x11\n\x05\x63ount\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x0f\n\x03sum\x18\x02 \x01(\x12\x42\x02\x30\x01\x1a\xfb\x01\n\x0e\x41verageResults\x12t\n\x11\x61ggregate_average\x18\x01 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageAggregateH\x00\x12h\n\x07\x65ntries\x18\x02 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageEntriesH\x00\x42\t\n\x07variant\x1az\n\x0bRankedEntry\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x13\n\x05\x63ount\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x11\n\x03sum\x18\x03 \x01(\x12\x42\x02\x30\x01H\x00\x12\r\n\x03\x61vg\x18\x04 \x01(\x01H\x00\x12\x13\n\x06in_key\x18\x05 \x01(\x0cH\x01\x88\x01\x01\x42\x07\n\x05valueB\t\n\x07_in_key\x1a\x9a\x01\n\rRankedEntries\x12\x63\n\x07\x65ntries\x18\x01 \x03(\x0b\x32R.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry\x12\x18\n\x07skipped\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x42\n\n\x08_skipped\x1a\x9b\x04\n\nResultData\x12\x65\n\tdocuments\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.DocumentsH\x00\x12\x65\n\x06\x63ounts\x18\x02 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.CountResultsH\x00\x12\x61\n\x04sums\x18\x03 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.SumResultsH\x00\x12i\n\x08\x61verages\x18\x04 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.AverageResultsH\x00\x12\x66\n\x06ranked\x18\x05 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntriesH\x00\x42\t\n\x07variantB\x08\n\x06resultB\t\n\x07version\"\xf4\x02\n\x19GetDocumentHistoryRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetDocumentHistoryRequest.GetDocumentHistoryRequestV0H\x00\x1a\xeb\x01\n\x1bGetDocumentHistoryRequestV0\x12\x18\n\x10\x64\x61ta_contract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x13\n\x0b\x64ocument_id\x18\x03 \x01(\x0c\x12+\n\x05limit\x18\x04 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x05 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0bstart_at_ms\x18\x06 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x07 \x01(\x08\x42\t\n\x07version\"\xf7\x04\n\x1aGetDocumentHistoryResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0H\x00\x1a\xeb\x03\n\x1cGetDocumentHistoryResponseV0\x12~\n\x10\x64ocument_history\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0.DocumentHistoryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x37\n\x14\x44ocumentHistoryEntry\x12\x10\n\x04\x64\x61te\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05value\x18\x02 \x01(\x0c\x1a\x95\x01\n\x0f\x44ocumentHistory\x12\x81\x01\n\x10\x64ocument_entries\x18\x01 \x03(\x0b\x32g.org.dash.platform.dapi.v0.GetDocumentHistoryResponse.GetDocumentHistoryResponseV0.DocumentHistoryEntryB\x08\n\x06resultB\t\n\x07version\"\xed\x01\n!GetIdentityByPublicKeyHashRequest\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashRequest.GetIdentityByPublicKeyHashRequestV0H\x00\x1aM\n#GetIdentityByPublicKeyHashRequestV0\x12\x17\n\x0fpublic_key_hash\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xda\x02\n\"GetIdentityByPublicKeyHashResponse\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashResponse.GetIdentityByPublicKeyHashResponseV0H\x00\x1a\xb6\x01\n$GetIdentityByPublicKeyHashResponseV0\x12\x12\n\x08identity\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbd\x02\n*GetIdentityByNonUniquePublicKeyHashRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashRequest.GetIdentityByNonUniquePublicKeyHashRequestV0H\x00\x1a\x80\x01\n,GetIdentityByNonUniquePublicKeyHashRequestV0\x12\x17\n\x0fpublic_key_hash\x18\x01 \x01(\x0c\x12\x18\n\x0bstart_after\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\x0e\n\x0c_start_afterB\t\n\x07version\"\xd6\x06\n+GetIdentityByNonUniquePublicKeyHashResponse\x12\x82\x01\n\x02v0\x18\x01 \x01(\x0b\x32t.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0H\x00\x1a\x96\x05\n-GetIdentityByNonUniquePublicKeyHashResponseV0\x12\x9a\x01\n\x08identity\x18\x01 \x01(\x0b\x32\x85\x01.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0.IdentityResponseH\x00\x12\x9d\x01\n\x05proof\x18\x02 \x01(\x0b\x32\x8b\x01.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse.GetIdentityByNonUniquePublicKeyHashResponseV0.IdentityProvedResponseH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x36\n\x10IdentityResponse\x12\x15\n\x08identity\x18\x01 \x01(\x0cH\x00\x88\x01\x01\x42\x0b\n\t_identity\x1a\xa6\x01\n\x16IdentityProvedResponse\x12P\n&grovedb_identity_public_key_hash_proof\x18\x01 \x01(\x0b\x32 .org.dash.platform.dapi.v0.Proof\x12!\n\x14identity_proof_bytes\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x42\x17\n\x15_identity_proof_bytesB\x08\n\x06resultB\t\n\x07version\"\xfb\x01\n#WaitForStateTransitionResultRequest\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.WaitForStateTransitionResultRequest.WaitForStateTransitionResultRequestV0H\x00\x1aU\n%WaitForStateTransitionResultRequestV0\x12\x1d\n\x15state_transition_hash\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x99\x03\n$WaitForStateTransitionResultResponse\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.WaitForStateTransitionResultResponse.WaitForStateTransitionResultResponseV0H\x00\x1a\xef\x01\n&WaitForStateTransitionResultResponseV0\x12I\n\x05\x65rror\x18\x01 \x01(\x0b\x32\x38.org.dash.platform.dapi.v0.StateTransitionBroadcastErrorH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc4\x01\n\x19GetConsensusParamsRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetConsensusParamsRequest.GetConsensusParamsRequestV0H\x00\x1a<\n\x1bGetConsensusParamsRequestV0\x12\x0e\n\x06height\x18\x01 \x01(\x05\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x9c\x04\n\x1aGetConsensusParamsResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetConsensusParamsResponse.GetConsensusParamsResponseV0H\x00\x1aP\n\x14\x43onsensusParamsBlock\x12\x11\n\tmax_bytes\x18\x01 \x01(\t\x12\x0f\n\x07max_gas\x18\x02 \x01(\t\x12\x14\n\x0ctime_iota_ms\x18\x03 \x01(\t\x1a\x62\n\x17\x43onsensusParamsEvidence\x12\x1a\n\x12max_age_num_blocks\x18\x01 \x01(\t\x12\x18\n\x10max_age_duration\x18\x02 \x01(\t\x12\x11\n\tmax_bytes\x18\x03 \x01(\t\x1a\xda\x01\n\x1cGetConsensusParamsResponseV0\x12Y\n\x05\x62lock\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetConsensusParamsResponse.ConsensusParamsBlock\x12_\n\x08\x65vidence\x18\x02 \x01(\x0b\x32M.org.dash.platform.dapi.v0.GetConsensusParamsResponse.ConsensusParamsEvidenceB\t\n\x07version\"\xe4\x01\n%GetProtocolVersionUpgradeStateRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateRequest.GetProtocolVersionUpgradeStateRequestV0H\x00\x1a\x38\n\'GetProtocolVersionUpgradeStateRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xb5\x05\n&GetProtocolVersionUpgradeStateResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0H\x00\x1a\x85\x04\n(GetProtocolVersionUpgradeStateResponseV0\x12\x87\x01\n\x08versions\x18\x01 \x01(\x0b\x32s.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0.VersionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x96\x01\n\x08Versions\x12\x89\x01\n\x08versions\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse.GetProtocolVersionUpgradeStateResponseV0.VersionEntry\x1a:\n\x0cVersionEntry\x12\x16\n\x0eversion_number\x18\x01 \x01(\r\x12\x12\n\nvote_count\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xa3\x02\n*GetProtocolVersionUpgradeVoteStatusRequest\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusRequest.GetProtocolVersionUpgradeVoteStatusRequestV0H\x00\x1ag\n,GetProtocolVersionUpgradeVoteStatusRequestV0\x12\x19\n\x11start_pro_tx_hash\x18\x01 \x01(\x0c\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xef\x05\n+GetProtocolVersionUpgradeVoteStatusResponse\x12\x82\x01\n\x02v0\x18\x01 \x01(\x0b\x32t.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0H\x00\x1a\xaf\x04\n-GetProtocolVersionUpgradeVoteStatusResponseV0\x12\x98\x01\n\x08versions\x18\x01 \x01(\x0b\x32\x83\x01.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0.VersionSignalsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xaf\x01\n\x0eVersionSignals\x12\x9c\x01\n\x0fversion_signals\x18\x01 \x03(\x0b\x32\x82\x01.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse.GetProtocolVersionUpgradeVoteStatusResponseV0.VersionSignal\x1a\x35\n\rVersionSignal\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x0f\n\x07version\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xf5\x01\n\x14GetEpochsInfoRequest\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetEpochsInfoRequest.GetEpochsInfoRequestV0H\x00\x1a|\n\x16GetEpochsInfoRequestV0\x12\x31\n\x0bstart_epoch\x18\x01 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\x11\n\tascending\x18\x03 \x01(\x08\x12\r\n\x05prove\x18\x04 \x01(\x08\x42\t\n\x07version\"\x99\x05\n\x15GetEpochsInfoResponse\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0H\x00\x1a\x9c\x04\n\x17GetEpochsInfoResponseV0\x12\x65\n\x06\x65pochs\x18\x01 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0.EpochInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1au\n\nEpochInfos\x12g\n\x0b\x65poch_infos\x18\x01 \x03(\x0b\x32R.org.dash.platform.dapi.v0.GetEpochsInfoResponse.GetEpochsInfoResponseV0.EpochInfo\x1a\xa6\x01\n\tEpochInfo\x12\x0e\n\x06number\x18\x01 \x01(\r\x12\x1e\n\x12\x66irst_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x1f\n\x17\x66irst_core_block_height\x18\x03 \x01(\r\x12\x16\n\nstart_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x0e\x66\x65\x65_multiplier\x18\x05 \x01(\x01\x12\x18\n\x10protocol_version\x18\x06 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xbf\x02\n\x1dGetFinalizedEpochInfosRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetFinalizedEpochInfosRequest.GetFinalizedEpochInfosRequestV0H\x00\x1a\xaa\x01\n\x1fGetFinalizedEpochInfosRequestV0\x12\x19\n\x11start_epoch_index\x18\x01 \x01(\r\x12\"\n\x1astart_epoch_index_included\x18\x02 \x01(\x08\x12\x17\n\x0f\x65nd_epoch_index\x18\x03 \x01(\r\x12 \n\x18\x65nd_epoch_index_included\x18\x04 \x01(\x08\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\t\n\x07version\"\xbd\t\n\x1eGetFinalizedEpochInfosResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0H\x00\x1a\xa5\x08\n GetFinalizedEpochInfosResponseV0\x12\x80\x01\n\x06\x65pochs\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.FinalizedEpochInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xa4\x01\n\x13\x46inalizedEpochInfos\x12\x8c\x01\n\x15\x66inalized_epoch_infos\x18\x01 \x03(\x0b\x32m.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.FinalizedEpochInfo\x1a\x9f\x04\n\x12\x46inalizedEpochInfo\x12\x0e\n\x06number\x18\x01 \x01(\r\x12\x1e\n\x12\x66irst_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x1f\n\x17\x66irst_core_block_height\x18\x03 \x01(\r\x12\x1c\n\x10\x66irst_block_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x0e\x66\x65\x65_multiplier\x18\x05 \x01(\x01\x12\x18\n\x10protocol_version\x18\x06 \x01(\r\x12!\n\x15total_blocks_in_epoch\x18\x07 \x01(\x04\x42\x02\x30\x01\x12*\n\"next_epoch_start_core_block_height\x18\x08 \x01(\r\x12!\n\x15total_processing_fees\x18\t \x01(\x04\x42\x02\x30\x01\x12*\n\x1etotal_distributed_storage_fees\x18\n \x01(\x04\x42\x02\x30\x01\x12&\n\x1atotal_created_storage_fees\x18\x0b \x01(\x04\x42\x02\x30\x01\x12\x1e\n\x12\x63ore_block_rewards\x18\x0c \x01(\x04\x42\x02\x30\x01\x12\x81\x01\n\x0f\x62lock_proposers\x18\r \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse.GetFinalizedEpochInfosResponseV0.BlockProposer\x1a\x39\n\rBlockProposer\x12\x13\n\x0bproposer_id\x18\x01 \x01(\x0c\x12\x13\n\x0b\x62lock_count\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xde\x04\n\x1cGetContestedResourcesRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetContestedResourcesRequest.GetContestedResourcesRequestV0H\x00\x1a\xcc\x03\n\x1eGetContestedResourcesRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x1a\n\x12start_index_values\x18\x04 \x03(\x0c\x12\x18\n\x10\x65nd_index_values\x18\x05 \x03(\x0c\x12\x89\x01\n\x13start_at_value_info\x18\x06 \x01(\x0b\x32g.org.dash.platform.dapi.v0.GetContestedResourcesRequest.GetContestedResourcesRequestV0.StartAtValueInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x07 \x01(\rH\x01\x88\x01\x01\x12\x17\n\x0forder_ascending\x18\x08 \x01(\x08\x12\r\n\x05prove\x18\t \x01(\x08\x1a\x45\n\x10StartAtValueInfo\x12\x13\n\x0bstart_value\x18\x01 \x01(\x0c\x12\x1c\n\x14start_value_included\x18\x02 \x01(\x08\x42\x16\n\x14_start_at_value_infoB\x08\n\x06_countB\t\n\x07version\"\x88\x04\n\x1dGetContestedResourcesResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetContestedResourcesResponse.GetContestedResourcesResponseV0H\x00\x1a\xf3\x02\n\x1fGetContestedResourcesResponseV0\x12\x95\x01\n\x19\x63ontested_resource_values\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetContestedResourcesResponse.GetContestedResourcesResponseV0.ContestedResourceValuesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a<\n\x17\x43ontestedResourceValues\x12!\n\x19\x63ontested_resource_values\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xd2\x05\n\x1cGetVotePollsByEndDateRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0H\x00\x1a\xc0\x04\n\x1eGetVotePollsByEndDateRequestV0\x12\x84\x01\n\x0fstart_time_info\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0.StartAtTimeInfoH\x00\x88\x01\x01\x12\x80\x01\n\rend_time_info\x18\x02 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest.GetVotePollsByEndDateRequestV0.EndAtTimeInfoH\x01\x88\x01\x01\x12\x12\n\x05limit\x18\x03 \x01(\rH\x02\x88\x01\x01\x12\x13\n\x06offset\x18\x04 \x01(\rH\x03\x88\x01\x01\x12\x11\n\tascending\x18\x05 \x01(\x08\x12\r\n\x05prove\x18\x06 \x01(\x08\x1aI\n\x0fStartAtTimeInfo\x12\x19\n\rstart_time_ms\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x13start_time_included\x18\x02 \x01(\x08\x1a\x43\n\rEndAtTimeInfo\x12\x17\n\x0b\x65nd_time_ms\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x19\n\x11\x65nd_time_included\x18\x02 \x01(\x08\x42\x12\n\x10_start_time_infoB\x10\n\x0e_end_time_infoB\x08\n\x06_limitB\t\n\x07_offsetB\t\n\x07version\"\x83\x06\n\x1dGetVotePollsByEndDateResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0H\x00\x1a\xee\x04\n\x1fGetVotePollsByEndDateResponseV0\x12\x9c\x01\n\x18vote_polls_by_timestamps\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0.SerializedVotePollsByTimestampsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aV\n\x1eSerializedVotePollsByTimestamp\x12\x15\n\ttimestamp\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1d\n\x15serialized_vote_polls\x18\x02 \x03(\x0c\x1a\xd7\x01\n\x1fSerializedVotePollsByTimestamps\x12\x99\x01\n\x18vote_polls_by_timestamps\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse.GetVotePollsByEndDateResponseV0.SerializedVotePollsByTimestamp\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x42\x08\n\x06resultB\t\n\x07version\"\xff\x06\n$GetContestedResourceVoteStateRequest\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0H\x00\x1a\xd5\x05\n&GetContestedResourceVoteStateRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x14\n\x0cindex_values\x18\x04 \x03(\x0c\x12\x86\x01\n\x0bresult_type\x18\x05 \x01(\x0e\x32q.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0.ResultType\x12\x36\n.allow_include_locked_and_abstaining_vote_tally\x18\x06 \x01(\x08\x12\xa3\x01\n\x18start_at_identifier_info\x18\x07 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest.GetContestedResourceVoteStateRequestV0.StartAtIdentifierInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x08 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\t \x01(\x08\x1aT\n\x15StartAtIdentifierInfo\x12\x18\n\x10start_identifier\x18\x01 \x01(\x0c\x12!\n\x19start_identifier_included\x18\x02 \x01(\x08\"I\n\nResultType\x12\r\n\tDOCUMENTS\x10\x00\x12\x0e\n\nVOTE_TALLY\x10\x01\x12\x1c\n\x18\x44OCUMENTS_AND_VOTE_TALLY\x10\x02\x42\x1b\n\x19_start_at_identifier_infoB\x08\n\x06_countB\t\n\x07version\"\x94\x0c\n%GetContestedResourceVoteStateResponse\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0H\x00\x1a\xe7\n\n\'GetContestedResourceVoteStateResponseV0\x12\xae\x01\n\x1d\x63ontested_resource_contenders\x18\x01 \x01(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.ContestedResourceContendersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xda\x03\n\x10\x46inishedVoteInfo\x12\xad\x01\n\x15\x66inished_vote_outcome\x18\x01 \x01(\x0e\x32\x8d\x01.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.FinishedVoteInfo.FinishedVoteOutcome\x12\x1f\n\x12won_by_identity_id\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12$\n\x18\x66inished_at_block_height\x18\x03 \x01(\x04\x42\x02\x30\x01\x12%\n\x1d\x66inished_at_core_block_height\x18\x04 \x01(\r\x12%\n\x19\x66inished_at_block_time_ms\x18\x05 \x01(\x04\x42\x02\x30\x01\x12\x19\n\x11\x66inished_at_epoch\x18\x06 \x01(\r\"O\n\x13\x46inishedVoteOutcome\x12\x14\n\x10TOWARDS_IDENTITY\x10\x00\x12\n\n\x06LOCKED\x10\x01\x12\x16\n\x12NO_PREVIOUS_WINNER\x10\x02\x42\x15\n\x13_won_by_identity_id\x1a\xc4\x03\n\x1b\x43ontestedResourceContenders\x12\x86\x01\n\ncontenders\x18\x01 \x03(\x0b\x32r.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.Contender\x12\x1f\n\x12\x61\x62stain_vote_tally\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x1c\n\x0flock_vote_tally\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\x9a\x01\n\x12\x66inished_vote_info\x18\x04 \x01(\x0b\x32y.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse.GetContestedResourceVoteStateResponseV0.FinishedVoteInfoH\x02\x88\x01\x01\x42\x15\n\x13_abstain_vote_tallyB\x12\n\x10_lock_vote_tallyB\x15\n\x13_finished_vote_info\x1ak\n\tContender\x12\x12\n\nidentifier\x18\x01 \x01(\x0c\x12\x17\n\nvote_count\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x15\n\x08\x64ocument\x18\x03 \x01(\x0cH\x01\x88\x01\x01\x42\r\n\x0b_vote_countB\x0b\n\t_documentB\x08\n\x06resultB\t\n\x07version\"\xd5\x05\n,GetContestedResourceVotersForIdentityRequest\x12\x84\x01\n\x02v0\x18\x01 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest.GetContestedResourceVotersForIdentityRequestV0H\x00\x1a\x92\x04\n.GetContestedResourceVotersForIdentityRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\x12\n\nindex_name\x18\x03 \x01(\t\x12\x14\n\x0cindex_values\x18\x04 \x03(\x0c\x12\x15\n\rcontestant_id\x18\x05 \x01(\x0c\x12\xb4\x01\n\x18start_at_identifier_info\x18\x06 \x01(\x0b\x32\x8c\x01.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest.GetContestedResourceVotersForIdentityRequestV0.StartAtIdentifierInfoH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x07 \x01(\rH\x01\x88\x01\x01\x12\x17\n\x0forder_ascending\x18\x08 \x01(\x08\x12\r\n\x05prove\x18\t \x01(\x08\x1aT\n\x15StartAtIdentifierInfo\x12\x18\n\x10start_identifier\x18\x01 \x01(\x0c\x12!\n\x19start_identifier_included\x18\x02 \x01(\x08\x42\x1b\n\x19_start_at_identifier_infoB\x08\n\x06_countB\t\n\x07version\"\xf1\x04\n-GetContestedResourceVotersForIdentityResponse\x12\x86\x01\n\x02v0\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse.GetContestedResourceVotersForIdentityResponseV0H\x00\x1a\xab\x03\n/GetContestedResourceVotersForIdentityResponseV0\x12\xb6\x01\n\x19\x63ontested_resource_voters\x18\x01 \x01(\x0b\x32\x90\x01.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse.GetContestedResourceVotersForIdentityResponseV0.ContestedResourceVotersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x43\n\x17\x43ontestedResourceVoters\x12\x0e\n\x06voters\x18\x01 \x03(\x0c\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x42\x08\n\x06resultB\t\n\x07version\"\xad\x05\n(GetContestedResourceIdentityVotesRequest\x12|\n\x02v0\x18\x01 \x01(\x0b\x32n.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest.GetContestedResourceIdentityVotesRequestV0H\x00\x1a\xf7\x03\n*GetContestedResourceIdentityVotesRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12+\n\x05limit\x18\x02 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12,\n\x06offset\x18\x03 \x01(\x0b\x32\x1c.google.protobuf.UInt32Value\x12\x17\n\x0forder_ascending\x18\x04 \x01(\x08\x12\xae\x01\n\x1astart_at_vote_poll_id_info\x18\x05 \x01(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest.GetContestedResourceIdentityVotesRequestV0.StartAtVotePollIdInfoH\x00\x88\x01\x01\x12\r\n\x05prove\x18\x06 \x01(\x08\x1a\x61\n\x15StartAtVotePollIdInfo\x12 \n\x18start_at_poll_identifier\x18\x01 \x01(\x0c\x12&\n\x1estart_poll_identifier_included\x18\x02 \x01(\x08\x42\x1d\n\x1b_start_at_vote_poll_id_infoB\t\n\x07version\"\xc8\n\n)GetContestedResourceIdentityVotesResponse\x12~\n\x02v0\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0H\x00\x1a\x8f\t\n+GetContestedResourceIdentityVotesResponseV0\x12\xa1\x01\n\x05votes\x18\x01 \x01(\x0b\x32\x8f\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ContestedResourceIdentityVotesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\xf7\x01\n\x1e\x43ontestedResourceIdentityVotes\x12\xba\x01\n!contested_resource_identity_votes\x18\x01 \x03(\x0b\x32\x8e\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ContestedResourceIdentityVote\x12\x18\n\x10\x66inished_results\x18\x02 \x01(\x08\x1a\xad\x02\n\x12ResourceVoteChoice\x12\xad\x01\n\x10vote_choice_type\x18\x01 \x01(\x0e\x32\x92\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ResourceVoteChoice.VoteChoiceType\x12\x18\n\x0bidentity_id\x18\x02 \x01(\x0cH\x00\x88\x01\x01\"=\n\x0eVoteChoiceType\x12\x14\n\x10TOWARDS_IDENTITY\x10\x00\x12\x0b\n\x07\x41\x42STAIN\x10\x01\x12\x08\n\x04LOCK\x10\x02\x42\x0e\n\x0c_identity_id\x1a\x95\x02\n\x1d\x43ontestedResourceIdentityVote\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1a\n\x12\x64ocument_type_name\x18\x02 \x01(\t\x12\'\n\x1fserialized_index_storage_values\x18\x03 \x03(\x0c\x12\x99\x01\n\x0bvote_choice\x18\x04 \x01(\x0b\x32\x83\x01.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse.GetContestedResourceIdentityVotesResponseV0.ResourceVoteChoiceB\x08\n\x06resultB\t\n\x07version\"\xf0\x01\n%GetPrefundedSpecializedBalanceRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceRequest.GetPrefundedSpecializedBalanceRequestV0H\x00\x1a\x44\n\'GetPrefundedSpecializedBalanceRequestV0\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xed\x02\n&GetPrefundedSpecializedBalanceResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceResponse.GetPrefundedSpecializedBalanceResponseV0H\x00\x1a\xbd\x01\n(GetPrefundedSpecializedBalanceResponseV0\x12\x15\n\x07\x62\x61lance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xd0\x01\n GetTotalCreditsInPlatformRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformRequest.GetTotalCreditsInPlatformRequestV0H\x00\x1a\x33\n\"GetTotalCreditsInPlatformRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xd9\x02\n!GetTotalCreditsInPlatformResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformResponse.GetTotalCreditsInPlatformResponseV0H\x00\x1a\xb8\x01\n#GetTotalCreditsInPlatformResponseV0\x12\x15\n\x07\x63redits\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc4\x01\n\x16GetPathElementsRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetPathElementsRequest.GetPathElementsRequestV0H\x00\x1a\x45\n\x18GetPathElementsRequestV0\x12\x0c\n\x04path\x18\x01 \x03(\x0c\x12\x0c\n\x04keys\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xa3\x03\n\x17GetPathElementsResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetPathElementsResponse.GetPathElementsResponseV0H\x00\x1a\xa0\x02\n\x19GetPathElementsResponseV0\x12i\n\x08\x65lements\x18\x01 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetPathElementsResponse.GetPathElementsResponseV0.ElementsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1c\n\x08\x45lements\x12\x10\n\x08\x65lements\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\x81\x01\n\x10GetStatusRequest\x12L\n\x02v0\x18\x01 \x01(\x0b\x32>.org.dash.platform.dapi.v0.GetStatusRequest.GetStatusRequestV0H\x00\x1a\x14\n\x12GetStatusRequestV0B\t\n\x07version\"\xe4\x10\n\x11GetStatusResponse\x12N\n\x02v0\x18\x01 \x01(\x0b\x32@.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0H\x00\x1a\xf3\x0f\n\x13GetStatusResponseV0\x12Y\n\x07version\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version\x12S\n\x04node\x18\x02 \x01(\x0b\x32\x45.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Node\x12U\n\x05\x63hain\x18\x03 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Chain\x12Y\n\x07network\x18\x04 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Network\x12^\n\nstate_sync\x18\x05 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.StateSync\x12S\n\x04time\x18\x06 \x01(\x0b\x32\x45.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Time\x1a\x82\x05\n\x07Version\x12\x63\n\x08software\x18\x01 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Software\x12\x63\n\x08protocol\x18\x02 \x01(\x0b\x32Q.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol\x1a^\n\x08Software\x12\x0c\n\x04\x64\x61pi\x18\x01 \x01(\t\x12\x12\n\x05\x64rive\x18\x02 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ntenderdash\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x08\n\x06_driveB\r\n\x0b_tenderdash\x1a\xcc\x02\n\x08Protocol\x12p\n\ntenderdash\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol.Tenderdash\x12\x66\n\x05\x64rive\x18\x02 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetStatusResponse.GetStatusResponseV0.Version.Protocol.Drive\x1a(\n\nTenderdash\x12\x0b\n\x03p2p\x18\x01 \x01(\r\x12\r\n\x05\x62lock\x18\x02 \x01(\r\x1a<\n\x05\x44rive\x12\x0e\n\x06latest\x18\x03 \x01(\r\x12\x0f\n\x07\x63urrent\x18\x04 \x01(\r\x12\x12\n\nnext_epoch\x18\x05 \x01(\r\x1a\x7f\n\x04Time\x12\x11\n\x05local\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x16\n\x05\x62lock\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x88\x01\x01\x12\x18\n\x07genesis\x18\x03 \x01(\x04\x42\x02\x30\x01H\x01\x88\x01\x01\x12\x12\n\x05\x65poch\x18\x04 \x01(\rH\x02\x88\x01\x01\x42\x08\n\x06_blockB\n\n\x08_genesisB\x08\n\x06_epoch\x1a<\n\x04Node\x12\n\n\x02id\x18\x01 \x01(\x0c\x12\x18\n\x0bpro_tx_hash\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x42\x0e\n\x0c_pro_tx_hash\x1a\xb3\x02\n\x05\x43hain\x12\x13\n\x0b\x63\x61tching_up\x18\x01 \x01(\x08\x12\x19\n\x11latest_block_hash\x18\x02 \x01(\x0c\x12\x17\n\x0flatest_app_hash\x18\x03 \x01(\x0c\x12\x1f\n\x13latest_block_height\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x13\x65\x61rliest_block_hash\x18\x05 \x01(\x0c\x12\x19\n\x11\x65\x61rliest_app_hash\x18\x06 \x01(\x0c\x12!\n\x15\x65\x61rliest_block_height\x18\x07 \x01(\x04\x42\x02\x30\x01\x12!\n\x15max_peer_block_height\x18\t \x01(\x04\x42\x02\x30\x01\x12%\n\x18\x63ore_chain_locked_height\x18\n \x01(\rH\x00\x88\x01\x01\x42\x1b\n\x19_core_chain_locked_height\x1a\x43\n\x07Network\x12\x10\n\x08\x63hain_id\x18\x01 \x01(\t\x12\x13\n\x0bpeers_count\x18\x02 \x01(\r\x12\x11\n\tlistening\x18\x03 \x01(\x08\x1a\x85\x02\n\tStateSync\x12\x1d\n\x11total_synced_time\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1a\n\x0eremaining_time\x18\x02 \x01(\x04\x42\x02\x30\x01\x12\x17\n\x0ftotal_snapshots\x18\x03 \x01(\r\x12\"\n\x16\x63hunk_process_avg_time\x18\x04 \x01(\x04\x42\x02\x30\x01\x12\x1b\n\x0fsnapshot_height\x18\x05 \x01(\x04\x42\x02\x30\x01\x12!\n\x15snapshot_chunks_count\x18\x06 \x01(\x04\x42\x02\x30\x01\x12\x1d\n\x11\x62\x61\x63kfilled_blocks\x18\x07 \x01(\x04\x42\x02\x30\x01\x12!\n\x15\x62\x61\x63kfill_blocks_total\x18\x08 \x01(\x04\x42\x02\x30\x01\x42\t\n\x07version\"\xb1\x01\n\x1cGetCurrentQuorumsInfoRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoRequest.GetCurrentQuorumsInfoRequestV0H\x00\x1a \n\x1eGetCurrentQuorumsInfoRequestV0B\t\n\x07version\"\xa1\x05\n\x1dGetCurrentQuorumsInfoResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.GetCurrentQuorumsInfoResponseV0H\x00\x1a\x46\n\x0bValidatorV0\x12\x13\n\x0bpro_tx_hash\x18\x01 \x01(\x0c\x12\x0f\n\x07node_ip\x18\x02 \x01(\t\x12\x11\n\tis_banned\x18\x03 \x01(\x08\x1a\xaf\x01\n\x0eValidatorSetV0\x12\x13\n\x0bquorum_hash\x18\x01 \x01(\x0c\x12\x13\n\x0b\x63ore_height\x18\x02 \x01(\r\x12U\n\x07members\x18\x03 \x03(\x0b\x32\x44.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.ValidatorV0\x12\x1c\n\x14threshold_public_key\x18\x04 \x01(\x0c\x1a\x92\x02\n\x1fGetCurrentQuorumsInfoResponseV0\x12\x15\n\rquorum_hashes\x18\x01 \x03(\x0c\x12\x1b\n\x13\x63urrent_quorum_hash\x18\x02 \x01(\x0c\x12_\n\x0evalidator_sets\x18\x03 \x03(\x0b\x32G.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse.ValidatorSetV0\x12\x1b\n\x13last_block_proposer\x18\x04 \x01(\x0c\x12=\n\x08metadata\x18\x05 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\t\n\x07version\"\xf4\x01\n\x1fGetIdentityTokenBalancesRequest\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentityTokenBalancesRequest.GetIdentityTokenBalancesRequestV0H\x00\x1aZ\n!GetIdentityTokenBalancesRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x11\n\ttoken_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xad\x05\n GetIdentityTokenBalancesResponse\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0H\x00\x1a\x8f\x04\n\"GetIdentityTokenBalancesResponseV0\x12\x86\x01\n\x0etoken_balances\x18\x01 \x01(\x0b\x32l.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0.TokenBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aG\n\x11TokenBalanceEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x07\x62\x61lance\x18\x02 \x01(\x04H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\x9a\x01\n\rTokenBalances\x12\x88\x01\n\x0etoken_balances\x18\x01 \x03(\x0b\x32p.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse.GetIdentityTokenBalancesResponseV0.TokenBalanceEntryB\x08\n\x06resultB\t\n\x07version\"\xfc\x01\n!GetIdentitiesTokenBalancesRequest\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesRequest.GetIdentitiesTokenBalancesRequestV0H\x00\x1a\\\n#GetIdentitiesTokenBalancesRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x0cidentity_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xf2\x05\n\"GetIdentitiesTokenBalancesResponse\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0H\x00\x1a\xce\x04\n$GetIdentitiesTokenBalancesResponseV0\x12\x9b\x01\n\x17identity_token_balances\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0.IdentityTokenBalancesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aR\n\x19IdentityTokenBalanceEntry\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x14\n\x07\x62\x61lance\x18\x02 \x01(\x04H\x00\x88\x01\x01\x42\n\n\x08_balance\x1a\xb7\x01\n\x15IdentityTokenBalances\x12\x9d\x01\n\x17identity_token_balances\x18\x01 \x03(\x0b\x32|.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse.GetIdentitiesTokenBalancesResponseV0.IdentityTokenBalanceEntryB\x08\n\x06resultB\t\n\x07version\"\xe8\x01\n\x1cGetIdentityTokenInfosRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetIdentityTokenInfosRequest.GetIdentityTokenInfosRequestV0H\x00\x1aW\n\x1eGetIdentityTokenInfosRequestV0\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x11\n\ttoken_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\x98\x06\n\x1dGetIdentityTokenInfosResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0H\x00\x1a\x83\x05\n\x1fGetIdentityTokenInfosResponseV0\x12z\n\x0btoken_infos\x18\x01 \x01(\x0b\x32\x63.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a(\n\x16TokenIdentityInfoEntry\x12\x0e\n\x06\x66rozen\x18\x01 \x01(\x08\x1a\xb0\x01\n\x0eTokenInfoEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x82\x01\n\x04info\x18\x02 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenIdentityInfoEntryH\x00\x88\x01\x01\x42\x07\n\x05_info\x1a\x8a\x01\n\nTokenInfos\x12|\n\x0btoken_infos\x18\x01 \x03(\x0b\x32g.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse.GetIdentityTokenInfosResponseV0.TokenInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xf0\x01\n\x1eGetIdentitiesTokenInfosRequest\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosRequest.GetIdentitiesTokenInfosRequestV0H\x00\x1aY\n GetIdentitiesTokenInfosRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x14\n\x0cidentity_ids\x18\x02 \x03(\x0c\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xca\x06\n\x1fGetIdentitiesTokenInfosResponse\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0H\x00\x1a\xaf\x05\n!GetIdentitiesTokenInfosResponseV0\x12\x8f\x01\n\x14identity_token_infos\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.IdentityTokenInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a(\n\x16TokenIdentityInfoEntry\x12\x0e\n\x06\x66rozen\x18\x01 \x01(\x08\x1a\xb7\x01\n\x0eTokenInfoEntry\x12\x13\n\x0bidentity_id\x18\x01 \x01(\x0c\x12\x86\x01\n\x04info\x18\x02 \x01(\x0b\x32s.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.TokenIdentityInfoEntryH\x00\x88\x01\x01\x42\x07\n\x05_info\x1a\x97\x01\n\x12IdentityTokenInfos\x12\x80\x01\n\x0btoken_infos\x18\x01 \x03(\x0b\x32k.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse.GetIdentitiesTokenInfosResponseV0.TokenInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xbf\x01\n\x17GetTokenStatusesRequest\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetTokenStatusesRequest.GetTokenStatusesRequestV0H\x00\x1a=\n\x19GetTokenStatusesRequestV0\x12\x11\n\ttoken_ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xe7\x04\n\x18GetTokenStatusesResponse\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0H\x00\x1a\xe1\x03\n\x1aGetTokenStatusesResponseV0\x12v\n\x0etoken_statuses\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0.TokenStatusesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x44\n\x10TokenStatusEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x13\n\x06paused\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\t\n\x07_paused\x1a\x88\x01\n\rTokenStatuses\x12w\n\x0etoken_statuses\x18\x01 \x03(\x0b\x32_.org.dash.platform.dapi.v0.GetTokenStatusesResponse.GetTokenStatusesResponseV0.TokenStatusEntryB\x08\n\x06resultB\t\n\x07version\"\xef\x01\n#GetTokenDirectPurchasePricesRequest\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesRequest.GetTokenDirectPurchasePricesRequestV0H\x00\x1aI\n%GetTokenDirectPurchasePricesRequestV0\x12\x11\n\ttoken_ids\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x8b\t\n$GetTokenDirectPurchasePricesResponse\x12t\n\x02v0\x18\x01 \x01(\x0b\x32\x66.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0H\x00\x1a\xe1\x07\n&GetTokenDirectPurchasePricesResponseV0\x12\xa9\x01\n\x1ctoken_direct_purchase_prices\x18\x01 \x01(\x0b\x32\x80\x01.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.TokenDirectPurchasePricesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x33\n\x10PriceForQuantity\x12\x10\n\x08quantity\x18\x01 \x01(\x04\x12\r\n\x05price\x18\x02 \x01(\x04\x1a\xa7\x01\n\x0fPricingSchedule\x12\x93\x01\n\x12price_for_quantity\x18\x01 \x03(\x0b\x32w.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.PriceForQuantity\x1a\xe4\x01\n\x1dTokenDirectPurchasePriceEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x15\n\x0b\x66ixed_price\x18\x02 \x01(\x04H\x00\x12\x90\x01\n\x0evariable_price\x18\x03 \x01(\x0b\x32v.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.PricingScheduleH\x00\x42\x07\n\x05price\x1a\xc8\x01\n\x19TokenDirectPurchasePrices\x12\xaa\x01\n\x1btoken_direct_purchase_price\x18\x01 \x03(\x0b\x32\x84\x01.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse.GetTokenDirectPurchasePricesResponseV0.TokenDirectPurchasePriceEntryB\x08\n\x06resultB\t\n\x07version\"\xce\x01\n\x1bGetTokenContractInfoRequest\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetTokenContractInfoRequest.GetTokenContractInfoRequestV0H\x00\x1a@\n\x1dGetTokenContractInfoRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xfb\x03\n\x1cGetTokenContractInfoResponse\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetTokenContractInfoResponse.GetTokenContractInfoResponseV0H\x00\x1a\xe9\x02\n\x1eGetTokenContractInfoResponseV0\x12|\n\x04\x64\x61ta\x18\x01 \x01(\x0b\x32l.org.dash.platform.dapi.v0.GetTokenContractInfoResponse.GetTokenContractInfoResponseV0.TokenContractInfoDataH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aM\n\x15TokenContractInfoData\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17token_contract_position\x18\x02 \x01(\rB\x08\n\x06resultB\t\n\x07version\"\xef\x04\n)GetTokenPreProgrammedDistributionsRequest\x12~\n\x02v0\x18\x01 \x01(\x0b\x32p.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest.GetTokenPreProgrammedDistributionsRequestV0H\x00\x1a\xb6\x03\n+GetTokenPreProgrammedDistributionsRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x98\x01\n\rstart_at_info\x18\x02 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest.GetTokenPreProgrammedDistributionsRequestV0.StartAtInfoH\x00\x88\x01\x01\x12\x12\n\x05limit\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x04 \x01(\x08\x1a\x9a\x01\n\x0bStartAtInfo\x12\x15\n\rstart_time_ms\x18\x01 \x01(\x04\x12\x1c\n\x0fstart_recipient\x18\x02 \x01(\x0cH\x00\x88\x01\x01\x12%\n\x18start_recipient_included\x18\x03 \x01(\x08H\x01\x88\x01\x01\x42\x12\n\x10_start_recipientB\x1b\n\x19_start_recipient_includedB\x10\n\x0e_start_at_infoB\x08\n\x06_limitB\t\n\x07version\"\xec\x07\n*GetTokenPreProgrammedDistributionsResponse\x12\x80\x01\n\x02v0\x18\x01 \x01(\x0b\x32r.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0H\x00\x1a\xaf\x06\n,GetTokenPreProgrammedDistributionsResponseV0\x12\xa5\x01\n\x13token_distributions\x18\x01 \x01(\x0b\x32\x85\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenDistributionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a>\n\x16TokenDistributionEntry\x12\x14\n\x0crecipient_id\x18\x01 \x01(\x0c\x12\x0e\n\x06\x61mount\x18\x02 \x01(\x04\x1a\xd4\x01\n\x1bTokenTimedDistributionEntry\x12\x11\n\ttimestamp\x18\x01 \x01(\x04\x12\xa1\x01\n\rdistributions\x18\x02 \x03(\x0b\x32\x89\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenDistributionEntry\x1a\xc3\x01\n\x12TokenDistributions\x12\xac\x01\n\x13token_distributions\x18\x01 \x03(\x0b\x32\x8e\x01.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse.GetTokenPreProgrammedDistributionsResponseV0.TokenTimedDistributionEntryB\x08\n\x06resultB\t\n\x07version\"\x82\x04\n-GetTokenPerpetualDistributionLastClaimRequest\x12\x86\x01\n\x02v0\x18\x01 \x01(\x0b\x32x.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest.GetTokenPerpetualDistributionLastClaimRequestV0H\x00\x1aI\n\x11\x43ontractTokenInfo\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17token_contract_position\x18\x02 \x01(\r\x1a\xf1\x01\n/GetTokenPerpetualDistributionLastClaimRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12v\n\rcontract_info\x18\x02 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest.ContractTokenInfoH\x00\x88\x01\x01\x12\x13\n\x0bidentity_id\x18\x04 \x01(\x0c\x12\r\n\x05prove\x18\x05 \x01(\x08\x42\x10\n\x0e_contract_infoB\t\n\x07version\"\x93\x05\n.GetTokenPerpetualDistributionLastClaimResponse\x12\x88\x01\n\x02v0\x18\x01 \x01(\x0b\x32z.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse.GetTokenPerpetualDistributionLastClaimResponseV0H\x00\x1a\xca\x03\n0GetTokenPerpetualDistributionLastClaimResponseV0\x12\x9f\x01\n\nlast_claim\x18\x01 \x01(\x0b\x32\x88\x01.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse.GetTokenPerpetualDistributionLastClaimResponseV0.LastClaimInfoH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1ax\n\rLastClaimInfo\x12\x1a\n\x0ctimestamp_ms\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x1a\n\x0c\x62lock_height\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x0f\n\x05\x65poch\x18\x03 \x01(\rH\x00\x12\x13\n\traw_bytes\x18\x04 \x01(\x0cH\x00\x42\t\n\x07paid_atB\x08\n\x06resultB\t\n\x07version\"\xca\x01\n\x1aGetTokenTotalSupplyRequest\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetTokenTotalSupplyRequest.GetTokenTotalSupplyRequestV0H\x00\x1a?\n\x1cGetTokenTotalSupplyRequestV0\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xaf\x04\n\x1bGetTokenTotalSupplyResponse\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse.GetTokenTotalSupplyResponseV0H\x00\x1a\xa0\x03\n\x1dGetTokenTotalSupplyResponseV0\x12\x88\x01\n\x12token_total_supply\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse.GetTokenTotalSupplyResponseV0.TokenTotalSupplyEntryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1ax\n\x15TokenTotalSupplyEntry\x12\x10\n\x08token_id\x18\x01 \x01(\x0c\x12\x30\n(total_aggregated_amount_in_user_accounts\x18\x02 \x01(\x04\x12\x1b\n\x13total_system_amount\x18\x03 \x01(\x04\x42\x08\n\x06resultB\t\n\x07version\"\xd2\x01\n\x13GetGroupInfoRequest\x12R\n\x02v0\x18\x01 \x01(\x0b\x32\x44.org.dash.platform.dapi.v0.GetGroupInfoRequest.GetGroupInfoRequestV0H\x00\x1a\\\n\x15GetGroupInfoRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xd4\x05\n\x14GetGroupInfoResponse\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0H\x00\x1a\xda\x04\n\x16GetGroupInfoResponseV0\x12\x66\n\ngroup_info\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupInfoH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x04 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x34\n\x10GroupMemberEntry\x12\x11\n\tmember_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\x98\x01\n\x0eGroupInfoEntry\x12h\n\x07members\x18\x01 \x03(\x0b\x32W.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupMemberEntry\x12\x1c\n\x14group_required_power\x18\x02 \x01(\r\x1a\x8a\x01\n\tGroupInfo\x12n\n\ngroup_info\x18\x01 \x01(\x0b\x32U.org.dash.platform.dapi.v0.GetGroupInfoResponse.GetGroupInfoResponseV0.GroupInfoEntryH\x00\x88\x01\x01\x42\r\n\x0b_group_infoB\x08\n\x06resultB\t\n\x07version\"\xed\x03\n\x14GetGroupInfosRequest\x12T\n\x02v0\x18\x01 \x01(\x0b\x32\x46.org.dash.platform.dapi.v0.GetGroupInfosRequest.GetGroupInfosRequestV0H\x00\x1au\n\x1cStartAtGroupContractPosition\x12%\n\x1dstart_group_contract_position\x18\x01 \x01(\r\x12.\n&start_group_contract_position_included\x18\x02 \x01(\x08\x1a\xfc\x01\n\x16GetGroupInfosRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12{\n start_at_group_contract_position\x18\x02 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetGroupInfosRequest.StartAtGroupContractPositionH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x03 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x04 \x01(\x08\x42#\n!_start_at_group_contract_positionB\x08\n\x06_countB\t\n\x07version\"\xff\x05\n\x15GetGroupInfosResponse\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0H\x00\x1a\x82\x05\n\x17GetGroupInfosResponseV0\x12j\n\x0bgroup_infos\x18\x01 \x01(\x0b\x32S.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupInfosH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x04 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x34\n\x10GroupMemberEntry\x12\x11\n\tmember_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\xc3\x01\n\x16GroupPositionInfoEntry\x12\x1f\n\x17group_contract_position\x18\x01 \x01(\r\x12j\n\x07members\x18\x02 \x03(\x0b\x32Y.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupMemberEntry\x12\x1c\n\x14group_required_power\x18\x03 \x01(\r\x1a\x82\x01\n\nGroupInfos\x12t\n\x0bgroup_infos\x18\x01 \x03(\x0b\x32_.org.dash.platform.dapi.v0.GetGroupInfosResponse.GetGroupInfosResponseV0.GroupPositionInfoEntryB\x08\n\x06resultB\t\n\x07version\"\xbe\x04\n\x16GetGroupActionsRequest\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetGroupActionsRequest.GetGroupActionsRequestV0H\x00\x1aL\n\x0fStartAtActionId\x12\x17\n\x0fstart_action_id\x18\x01 \x01(\x0c\x12 \n\x18start_action_id_included\x18\x02 \x01(\x08\x1a\xc8\x02\n\x18GetGroupActionsRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12N\n\x06status\x18\x03 \x01(\x0e\x32>.org.dash.platform.dapi.v0.GetGroupActionsRequest.ActionStatus\x12\x62\n\x12start_at_action_id\x18\x04 \x01(\x0b\x32\x41.org.dash.platform.dapi.v0.GetGroupActionsRequest.StartAtActionIdH\x00\x88\x01\x01\x12\x12\n\x05\x63ount\x18\x05 \x01(\rH\x01\x88\x01\x01\x12\r\n\x05prove\x18\x06 \x01(\x08\x42\x15\n\x13_start_at_action_idB\x08\n\x06_count\"&\n\x0c\x41\x63tionStatus\x12\n\n\x06\x41\x43TIVE\x10\x00\x12\n\n\x06\x43LOSED\x10\x01\x42\t\n\x07version\"\xd6\x1e\n\x17GetGroupActionsResponse\x12Z\n\x02v0\x18\x01 \x01(\x0b\x32L.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0H\x00\x1a\xd3\x1d\n\x19GetGroupActionsResponseV0\x12r\n\rgroup_actions\x18\x01 \x01(\x0b\x32Y.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a[\n\tMintEvent\x12\x0e\n\x06\x61mount\x18\x01 \x01(\x04\x12\x14\n\x0crecipient_id\x18\x02 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a[\n\tBurnEvent\x12\x0e\n\x06\x61mount\x18\x01 \x01(\x04\x12\x14\n\x0c\x62urn_from_id\x18\x02 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1aJ\n\x0b\x46reezeEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1aL\n\rUnfreezeEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\x66\n\x17\x44\x65stroyFrozenFundsEvent\x12\x11\n\tfrozen_id\x18\x01 \x01(\x0c\x12\x0e\n\x06\x61mount\x18\x02 \x01(\x04\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\x64\n\x13SharedEncryptedNote\x12\x18\n\x10sender_key_index\x18\x01 \x01(\r\x12\x1b\n\x13recipient_key_index\x18\x02 \x01(\r\x12\x16\n\x0e\x65ncrypted_data\x18\x03 \x01(\x0c\x1a{\n\x15PersonalEncryptedNote\x12!\n\x19root_encryption_key_index\x18\x01 \x01(\r\x12\'\n\x1f\x64\x65rivation_encryption_key_index\x18\x02 \x01(\r\x12\x16\n\x0e\x65ncrypted_data\x18\x03 \x01(\x0c\x1a\xe9\x01\n\x14\x45mergencyActionEvent\x12\x81\x01\n\x0b\x61\x63tion_type\x18\x01 \x01(\x0e\x32l.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.EmergencyActionEvent.ActionType\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\"#\n\nActionType\x12\t\n\x05PAUSE\x10\x00\x12\n\n\x06RESUME\x10\x01\x42\x0e\n\x0c_public_note\x1a\x64\n\x16TokenConfigUpdateEvent\x12 \n\x18token_config_update_item\x18\x01 \x01(\x0c\x12\x18\n\x0bpublic_note\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_public_note\x1a\xe6\x03\n\x1eUpdateDirectPurchasePriceEvent\x12\x15\n\x0b\x66ixed_price\x18\x01 \x01(\x04H\x00\x12\x95\x01\n\x0evariable_price\x18\x02 \x01(\x0b\x32{.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEvent.PricingScheduleH\x00\x12\x18\n\x0bpublic_note\x18\x03 \x01(\tH\x01\x88\x01\x01\x1a\x33\n\x10PriceForQuantity\x12\x10\n\x08quantity\x18\x01 \x01(\x04\x12\r\n\x05price\x18\x02 \x01(\x04\x1a\xac\x01\n\x0fPricingSchedule\x12\x98\x01\n\x12price_for_quantity\x18\x01 \x03(\x0b\x32|.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEvent.PriceForQuantityB\x07\n\x05priceB\x0e\n\x0c_public_note\x1a\xfc\x02\n\x10GroupActionEvent\x12n\n\x0btoken_event\x18\x01 \x01(\x0b\x32W.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.TokenEventH\x00\x12t\n\x0e\x64ocument_event\x18\x02 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DocumentEventH\x00\x12t\n\x0e\x63ontract_event\x18\x03 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.ContractEventH\x00\x42\x0c\n\nevent_type\x1a\x8b\x01\n\rDocumentEvent\x12r\n\x06\x63reate\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DocumentCreateEventH\x00\x42\x06\n\x04type\x1a/\n\x13\x44ocumentCreateEvent\x12\x18\n\x10\x63reated_document\x18\x01 \x01(\x0c\x1a/\n\x13\x43ontractUpdateEvent\x12\x18\n\x10updated_contract\x18\x01 \x01(\x0c\x1a\x8b\x01\n\rContractEvent\x12r\n\x06update\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.ContractUpdateEventH\x00\x42\x06\n\x04type\x1a\xd1\x07\n\nTokenEvent\x12\x66\n\x04mint\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.MintEventH\x00\x12\x66\n\x04\x62urn\x18\x02 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.BurnEventH\x00\x12j\n\x06\x66reeze\x18\x03 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.FreezeEventH\x00\x12n\n\x08unfreeze\x18\x04 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UnfreezeEventH\x00\x12\x84\x01\n\x14\x64\x65stroy_frozen_funds\x18\x05 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.DestroyFrozenFundsEventH\x00\x12}\n\x10\x65mergency_action\x18\x06 \x01(\x0b\x32\x61.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.EmergencyActionEventH\x00\x12\x82\x01\n\x13token_config_update\x18\x07 \x01(\x0b\x32\x63.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.TokenConfigUpdateEventH\x00\x12\x83\x01\n\x0cupdate_price\x18\x08 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.UpdateDirectPurchasePriceEventH\x00\x42\x06\n\x04type\x1a\x93\x01\n\x10GroupActionEntry\x12\x11\n\taction_id\x18\x01 \x01(\x0c\x12l\n\x05\x65vent\x18\x02 \x01(\x0b\x32].org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionEvent\x1a\x84\x01\n\x0cGroupActions\x12t\n\rgroup_actions\x18\x01 \x03(\x0b\x32].org.dash.platform.dapi.v0.GetGroupActionsResponse.GetGroupActionsResponseV0.GroupActionEntryB\x08\n\x06resultB\t\n\x07version\"\x88\x03\n\x1cGetGroupActionSignersRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetGroupActionSignersRequest.GetGroupActionSignersRequestV0H\x00\x1a\xce\x01\n\x1eGetGroupActionSignersRequestV0\x12\x13\n\x0b\x63ontract_id\x18\x01 \x01(\x0c\x12\x1f\n\x17group_contract_position\x18\x02 \x01(\r\x12T\n\x06status\x18\x03 \x01(\x0e\x32\x44.org.dash.platform.dapi.v0.GetGroupActionSignersRequest.ActionStatus\x12\x11\n\taction_id\x18\x04 \x01(\x0c\x12\r\n\x05prove\x18\x05 \x01(\x08\"&\n\x0c\x41\x63tionStatus\x12\n\n\x06\x41\x43TIVE\x10\x00\x12\n\n\x06\x43LOSED\x10\x01\x42\t\n\x07version\"\x8b\x05\n\x1dGetGroupActionSignersResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0H\x00\x1a\xf6\x03\n\x1fGetGroupActionSignersResponseV0\x12\x8b\x01\n\x14group_action_signers\x18\x01 \x01(\x0b\x32k.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0.GroupActionSignersH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x35\n\x11GroupActionSigner\x12\x11\n\tsigner_id\x18\x01 \x01(\x0c\x12\r\n\x05power\x18\x02 \x01(\r\x1a\x91\x01\n\x12GroupActionSigners\x12{\n\x07signers\x18\x01 \x03(\x0b\x32j.org.dash.platform.dapi.v0.GetGroupActionSignersResponse.GetGroupActionSignersResponseV0.GroupActionSignerB\x08\n\x06resultB\t\n\x07version\"\xb5\x01\n\x15GetAddressInfoRequest\x12V\n\x02v0\x18\x01 \x01(\x0b\x32H.org.dash.platform.dapi.v0.GetAddressInfoRequest.GetAddressInfoRequestV0H\x00\x1a\x39\n\x17GetAddressInfoRequestV0\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x85\x01\n\x10\x41\x64\x64ressInfoEntry\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12J\n\x11\x62\x61lance_and_nonce\x18\x02 \x01(\x0b\x32*.org.dash.platform.dapi.v0.BalanceAndNonceH\x00\x88\x01\x01\x42\x14\n\x12_balance_and_nonce\"1\n\x0f\x42\x61lanceAndNonce\x12\x0f\n\x07\x62\x61lance\x18\x01 \x01(\x04\x12\r\n\x05nonce\x18\x02 \x01(\r\"_\n\x12\x41\x64\x64ressInfoEntries\x12I\n\x14\x61\x64\x64ress_info_entries\x18\x01 \x03(\x0b\x32+.org.dash.platform.dapi.v0.AddressInfoEntry\"m\n\x14\x41\x64\x64ressBalanceChange\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\x19\n\x0bset_balance\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12\x1c\n\x0e\x61\x64\x64_to_balance\x18\x03 \x01(\x04\x42\x02\x30\x01H\x00\x42\x0b\n\toperation\"x\n\x1a\x42lockAddressBalanceChanges\x12\x18\n\x0c\x62lock_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12@\n\x07\x63hanges\x18\x02 \x03(\x0b\x32/.org.dash.platform.dapi.v0.AddressBalanceChange\"k\n\x1b\x41\x64\x64ressBalanceUpdateEntries\x12L\n\rblock_changes\x18\x01 \x03(\x0b\x32\x35.org.dash.platform.dapi.v0.BlockAddressBalanceChanges\"\xe1\x02\n\x16GetAddressInfoResponse\x12X\n\x02v0\x18\x01 \x01(\x0b\x32J.org.dash.platform.dapi.v0.GetAddressInfoResponse.GetAddressInfoResponseV0H\x00\x1a\xe1\x01\n\x18GetAddressInfoResponseV0\x12I\n\x12\x61\x64\x64ress_info_entry\x18\x01 \x01(\x0b\x32+.org.dash.platform.dapi.v0.AddressInfoEntryH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc3\x01\n\x18GetAddressesInfosRequest\x12\\\n\x02v0\x18\x01 \x01(\x0b\x32N.org.dash.platform.dapi.v0.GetAddressesInfosRequest.GetAddressesInfosRequestV0H\x00\x1a>\n\x1aGetAddressesInfosRequestV0\x12\x11\n\taddresses\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf1\x02\n\x19GetAddressesInfosResponse\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetAddressesInfosResponse.GetAddressesInfosResponseV0H\x00\x1a\xe8\x01\n\x1bGetAddressesInfosResponseV0\x12M\n\x14\x61\x64\x64ress_info_entries\x18\x01 \x01(\x0b\x32-.org.dash.platform.dapi.v0.AddressInfoEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xb5\x01\n\x1dGetAddressesTrunkStateRequest\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetAddressesTrunkStateRequest.GetAddressesTrunkStateRequestV0H\x00\x1a!\n\x1fGetAddressesTrunkStateRequestV0B\t\n\x07version\"\xaa\x02\n\x1eGetAddressesTrunkStateResponse\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetAddressesTrunkStateResponse.GetAddressesTrunkStateResponseV0H\x00\x1a\x92\x01\n GetAddressesTrunkStateResponseV0\x12/\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.Proof\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\t\n\x07version\"\xf0\x01\n\x1eGetAddressesBranchStateRequest\x12h\n\x02v0\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetAddressesBranchStateRequest.GetAddressesBranchStateRequestV0H\x00\x1aY\n GetAddressesBranchStateRequestV0\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x64\x65pth\x18\x02 \x01(\r\x12\x19\n\x11\x63heckpoint_height\x18\x03 \x01(\x04\x42\t\n\x07version\"\xd1\x01\n\x1fGetAddressesBranchStateResponse\x12j\n\x02v0\x18\x01 \x01(\x0b\x32\\.org.dash.platform.dapi.v0.GetAddressesBranchStateResponse.GetAddressesBranchStateResponseV0H\x00\x1a\x37\n!GetAddressesBranchStateResponseV0\x12\x12\n\nmerk_proof\x18\x02 \x01(\x0c\x42\t\n\x07version\"\x9e\x02\n%GetRecentAddressBalanceChangesRequest\x12v\n\x02v0\x18\x01 \x01(\x0b\x32h.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesRequest.GetRecentAddressBalanceChangesRequestV0H\x00\x1ar\n\'GetRecentAddressBalanceChangesRequestV0\x12\x18\n\x0cstart_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x02 \x01(\x08\x12\x1e\n\x16start_height_exclusive\x18\x03 \x01(\x08\x42\t\n\x07version\"\xb8\x03\n&GetRecentAddressBalanceChangesResponse\x12x\n\x02v0\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesResponse.GetRecentAddressBalanceChangesResponseV0H\x00\x1a\x88\x02\n(GetRecentAddressBalanceChangesResponseV0\x12`\n\x1e\x61\x64\x64ress_balance_update_entries\x18\x01 \x01(\x0b\x32\x36.org.dash.platform.dapi.v0.AddressBalanceUpdateEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"G\n\x16\x42lockHeightCreditEntry\x12\x18\n\x0c\x62lock_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x13\n\x07\x63redits\x18\x02 \x01(\x04\x42\x02\x30\x01\"\xb0\x01\n\x1d\x43ompactedAddressBalanceChange\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\x0c\x12\x19\n\x0bset_credits\x18\x02 \x01(\x04\x42\x02\x30\x01H\x00\x12V\n\x19\x61\x64\x64_to_credits_operations\x18\x03 \x01(\x0b\x32\x31.org.dash.platform.dapi.v0.AddToCreditsOperationsH\x00\x42\x0b\n\toperation\"\\\n\x16\x41\x64\x64ToCreditsOperations\x12\x42\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x31.org.dash.platform.dapi.v0.BlockHeightCreditEntry\"\xae\x01\n#CompactedBlockAddressBalanceChanges\x12\x1e\n\x12start_block_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\x1c\n\x10\x65nd_block_height\x18\x02 \x01(\x04\x42\x02\x30\x01\x12I\n\x07\x63hanges\x18\x03 \x03(\x0b\x32\x38.org.dash.platform.dapi.v0.CompactedAddressBalanceChange\"\x87\x01\n$CompactedAddressBalanceUpdateEntries\x12_\n\x17\x63ompacted_block_changes\x18\x01 \x03(\x0b\x32>.org.dash.platform.dapi.v0.CompactedBlockAddressBalanceChanges\"\xa9\x02\n.GetRecentCompactedAddressBalanceChangesRequest\x12\x88\x01\n\x02v0\x18\x01 \x01(\x0b\x32z.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesRequest.GetRecentCompactedAddressBalanceChangesRequestV0H\x00\x1a\x61\n0GetRecentCompactedAddressBalanceChangesRequestV0\x12\x1e\n\x12start_block_height\x18\x01 \x01(\x04\x42\x02\x30\x01\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\xf0\x03\n/GetRecentCompactedAddressBalanceChangesResponse\x12\x8a\x01\n\x02v0\x18\x01 \x01(\x0b\x32|.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesResponse.GetRecentCompactedAddressBalanceChangesResponseV0H\x00\x1a\xa4\x02\n1GetRecentCompactedAddressBalanceChangesResponseV0\x12s\n(compacted_address_balance_update_entries\x18\x01 \x01(\x0b\x32?.org.dash.platform.dapi.v0.CompactedAddressBalanceUpdateEntriesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xf4\x01\n GetShieldedEncryptedNotesRequest\x12l\n\x02v0\x18\x01 \x01(\x0b\x32^.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesRequest.GetShieldedEncryptedNotesRequestV0H\x00\x1aW\n\"GetShieldedEncryptedNotesRequestV0\x12\x13\n\x0bstart_index\x18\x01 \x01(\x04\x12\r\n\x05\x63ount\x18\x02 \x01(\r\x12\r\n\x05prove\x18\x03 \x01(\x08\x42\t\n\x07version\"\xbc\x05\n!GetShieldedEncryptedNotesResponse\x12n\n\x02v0\x18\x01 \x01(\x0b\x32`.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0H\x00\x1a\x9b\x04\n#GetShieldedEncryptedNotesResponseV0\x12\x8a\x01\n\x0f\x65ncrypted_notes\x18\x01 \x01(\x0b\x32o.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0.EncryptedNotesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1aW\n\rEncryptedNote\x12\x11\n\tnullifier\x18\x01 \x01(\x0c\x12\x0b\n\x03\x63mx\x18\x02 \x01(\x0c\x12\x16\n\x0e\x65ncrypted_note\x18\x03 \x01(\x0c\x12\x0e\n\x06\x63v_net\x18\x04 \x01(\x0c\x1a\x91\x01\n\x0e\x45ncryptedNotes\x12\x7f\n\x07\x65ntries\x18\x01 \x03(\x0b\x32n.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse.GetShieldedEncryptedNotesResponseV0.EncryptedNoteB\x08\n\x06resultB\t\n\x07version\"\xb4\x01\n\x19GetShieldedAnchorsRequest\x12^\n\x02v0\x18\x01 \x01(\x0b\x32P.org.dash.platform.dapi.v0.GetShieldedAnchorsRequest.GetShieldedAnchorsRequestV0H\x00\x1a,\n\x1bGetShieldedAnchorsRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xb1\x03\n\x1aGetShieldedAnchorsResponse\x12`\n\x02v0\x18\x01 \x01(\x0b\x32R.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse.GetShieldedAnchorsResponseV0H\x00\x1a\xa5\x02\n\x1cGetShieldedAnchorsResponseV0\x12m\n\x07\x61nchors\x18\x01 \x01(\x0b\x32Z.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse.GetShieldedAnchorsResponseV0.AnchorsH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x1a\n\x07\x41nchors\x12\x0f\n\x07\x61nchors\x18\x01 \x03(\x0c\x42\x08\n\x06resultB\t\n\x07version\"\xd8\x01\n\"GetMostRecentShieldedAnchorRequest\x12p\n\x02v0\x18\x01 \x01(\x0b\x32\x62.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorRequest.GetMostRecentShieldedAnchorRequestV0H\x00\x1a\x35\n$GetMostRecentShieldedAnchorRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xdc\x02\n#GetMostRecentShieldedAnchorResponse\x12r\n\x02v0\x18\x01 \x01(\x0b\x32\x64.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorResponse.GetMostRecentShieldedAnchorResponseV0H\x00\x1a\xb5\x01\n%GetMostRecentShieldedAnchorResponseV0\x12\x10\n\x06\x61nchor\x18\x01 \x01(\x0cH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xbc\x01\n\x1bGetShieldedPoolStateRequest\x12\x62\n\x02v0\x18\x01 \x01(\x0b\x32T.org.dash.platform.dapi.v0.GetShieldedPoolStateRequest.GetShieldedPoolStateRequestV0H\x00\x1a.\n\x1dGetShieldedPoolStateRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xcb\x02\n\x1cGetShieldedPoolStateResponse\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedPoolStateResponse.GetShieldedPoolStateResponseV0H\x00\x1a\xb9\x01\n\x1eGetShieldedPoolStateResponseV0\x12\x1b\n\rtotal_balance\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xc0\x01\n\x1cGetShieldedNotesCountRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedNotesCountRequest.GetShieldedNotesCountRequestV0H\x00\x1a/\n\x1eGetShieldedNotesCountRequestV0\x12\r\n\x05prove\x18\x01 \x01(\x08\x42\t\n\x07version\"\xd3\x02\n\x1dGetShieldedNotesCountResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetShieldedNotesCountResponse.GetShieldedNotesCountResponseV0H\x00\x1a\xbe\x01\n\x1fGetShieldedNotesCountResponseV0\x12\x1f\n\x11total_notes_count\x18\x01 \x01(\x04\x42\x02\x30\x01H\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadataB\x08\n\x06resultB\t\n\x07version\"\xd4\x01\n\x1cGetShieldedNullifiersRequest\x12\x64\n\x02v0\x18\x01 \x01(\x0b\x32V.org.dash.platform.dapi.v0.GetShieldedNullifiersRequest.GetShieldedNullifiersRequestV0H\x00\x1a\x43\n\x1eGetShieldedNullifiersRequestV0\x12\x12\n\nnullifiers\x18\x01 \x03(\x0c\x12\r\n\x05prove\x18\x02 \x01(\x08\x42\t\n\x07version\"\x86\x05\n\x1dGetShieldedNullifiersResponse\x12\x66\n\x02v0\x18\x01 \x01(\x0b\x32X.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0H\x00\x1a\xf1\x03\n\x1fGetShieldedNullifiersResponseV0\x12\x88\x01\n\x12nullifier_statuses\x18\x01 \x01(\x0b\x32j.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0.NullifierStatusesH\x00\x12\x31\n\x05proof\x18\x02 \x01(\x0b\x32 .org.dash.platform.dapi.v0.ProofH\x00\x12=\n\x08metadata\x18\x03 \x01(\x0b\x32+.org.dash.platform.dapi.v0.ResponseMetadata\x1a\x36\n\x0fNullifierStatus\x12\x11\n\tnullifier\x18\x01 \x01(\x0c\x12\x10\n\x08is_spent\x18\x02 \x01(\x08\x1a\x8e\x01\n\x11NullifierStatuses\x12y\n\x07\x65ntries\x18\x01 \x03(\x0b\x32h.org.dash.platform.dapi.v0.GetShieldedNullifiersResponse.GetShieldedNullifiersResponseV0.NullifierStatusB\x08\n\x06resultB\t\n\x07version*Z\n\nKeyPurpose\x12\x12\n\x0e\x41UTHENTICATION\x10\x00\x12\x0e\n\nENCRYPTION\x10\x01\x12\x0e\n\nDECRYPTION\x10\x02\x12\x0c\n\x08TRANSFER\x10\x03\x12\n\n\x06VOTING\x10\x05\x32\xce\x44\n\x08Platform\x12\x93\x01\n\x18\x62roadcastStateTransition\x12:.org.dash.platform.dapi.v0.BroadcastStateTransitionRequest\x1a;.org.dash.platform.dapi.v0.BroadcastStateTransitionResponse\x12l\n\x0bgetIdentity\x12-.org.dash.platform.dapi.v0.GetIdentityRequest\x1a..org.dash.platform.dapi.v0.GetIdentityResponse\x12x\n\x0fgetIdentityKeys\x12\x31.org.dash.platform.dapi.v0.GetIdentityKeysRequest\x1a\x32.org.dash.platform.dapi.v0.GetIdentityKeysResponse\x12\x96\x01\n\x19getIdentitiesContractKeys\x12;.org.dash.platform.dapi.v0.GetIdentitiesContractKeysRequest\x1a<.org.dash.platform.dapi.v0.GetIdentitiesContractKeysResponse\x12{\n\x10getIdentityNonce\x12\x32.org.dash.platform.dapi.v0.GetIdentityNonceRequest\x1a\x33.org.dash.platform.dapi.v0.GetIdentityNonceResponse\x12\x93\x01\n\x18getIdentityContractNonce\x12:.org.dash.platform.dapi.v0.GetIdentityContractNonceRequest\x1a;.org.dash.platform.dapi.v0.GetIdentityContractNonceResponse\x12\x81\x01\n\x12getIdentityBalance\x12\x34.org.dash.platform.dapi.v0.GetIdentityBalanceRequest\x1a\x35.org.dash.platform.dapi.v0.GetIdentityBalanceResponse\x12\x8a\x01\n\x15getIdentitiesBalances\x12\x37.org.dash.platform.dapi.v0.GetIdentitiesBalancesRequest\x1a\x38.org.dash.platform.dapi.v0.GetIdentitiesBalancesResponse\x12\xa2\x01\n\x1dgetIdentityBalanceAndRevision\x12?.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionRequest\x1a@.org.dash.platform.dapi.v0.GetIdentityBalanceAndRevisionResponse\x12\xaf\x01\n#getEvonodesProposedEpochBlocksByIds\x12\x45.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByIdsRequest\x1a\x41.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse\x12\xb3\x01\n%getEvonodesProposedEpochBlocksByRange\x12G.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksByRangeRequest\x1a\x41.org.dash.platform.dapi.v0.GetEvonodesProposedEpochBlocksResponse\x12x\n\x0fgetDataContract\x12\x31.org.dash.platform.dapi.v0.GetDataContractRequest\x1a\x32.org.dash.platform.dapi.v0.GetDataContractResponse\x12\x8d\x01\n\x16getDataContractHistory\x12\x38.org.dash.platform.dapi.v0.GetDataContractHistoryRequest\x1a\x39.org.dash.platform.dapi.v0.GetDataContractHistoryResponse\x12{\n\x10getDataContracts\x12\x32.org.dash.platform.dapi.v0.GetDataContractsRequest\x1a\x33.org.dash.platform.dapi.v0.GetDataContractsResponse\x12\x81\x01\n\x12getDocumentHistory\x12\x34.org.dash.platform.dapi.v0.GetDocumentHistoryRequest\x1a\x35.org.dash.platform.dapi.v0.GetDocumentHistoryResponse\x12o\n\x0cgetDocuments\x12..org.dash.platform.dapi.v0.GetDocumentsRequest\x1a/.org.dash.platform.dapi.v0.GetDocumentsResponse\x12\x99\x01\n\x1agetIdentityByPublicKeyHash\x12<.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashRequest\x1a=.org.dash.platform.dapi.v0.GetIdentityByPublicKeyHashResponse\x12\xb4\x01\n#getIdentityByNonUniquePublicKeyHash\x12\x45.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashRequest\x1a\x46.org.dash.platform.dapi.v0.GetIdentityByNonUniquePublicKeyHashResponse\x12\x9f\x01\n\x1cwaitForStateTransitionResult\x12>.org.dash.platform.dapi.v0.WaitForStateTransitionResultRequest\x1a?.org.dash.platform.dapi.v0.WaitForStateTransitionResultResponse\x12\x81\x01\n\x12getConsensusParams\x12\x34.org.dash.platform.dapi.v0.GetConsensusParamsRequest\x1a\x35.org.dash.platform.dapi.v0.GetConsensusParamsResponse\x12\xa5\x01\n\x1egetProtocolVersionUpgradeState\x12@.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateRequest\x1a\x41.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeStateResponse\x12\xb4\x01\n#getProtocolVersionUpgradeVoteStatus\x12\x45.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusRequest\x1a\x46.org.dash.platform.dapi.v0.GetProtocolVersionUpgradeVoteStatusResponse\x12r\n\rgetEpochsInfo\x12/.org.dash.platform.dapi.v0.GetEpochsInfoRequest\x1a\x30.org.dash.platform.dapi.v0.GetEpochsInfoResponse\x12\x8d\x01\n\x16getFinalizedEpochInfos\x12\x38.org.dash.platform.dapi.v0.GetFinalizedEpochInfosRequest\x1a\x39.org.dash.platform.dapi.v0.GetFinalizedEpochInfosResponse\x12\x8a\x01\n\x15getContestedResources\x12\x37.org.dash.platform.dapi.v0.GetContestedResourcesRequest\x1a\x38.org.dash.platform.dapi.v0.GetContestedResourcesResponse\x12\xa2\x01\n\x1dgetContestedResourceVoteState\x12?.org.dash.platform.dapi.v0.GetContestedResourceVoteStateRequest\x1a@.org.dash.platform.dapi.v0.GetContestedResourceVoteStateResponse\x12\xba\x01\n%getContestedResourceVotersForIdentity\x12G.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityRequest\x1aH.org.dash.platform.dapi.v0.GetContestedResourceVotersForIdentityResponse\x12\xae\x01\n!getContestedResourceIdentityVotes\x12\x43.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesRequest\x1a\x44.org.dash.platform.dapi.v0.GetContestedResourceIdentityVotesResponse\x12\x8a\x01\n\x15getVotePollsByEndDate\x12\x37.org.dash.platform.dapi.v0.GetVotePollsByEndDateRequest\x1a\x38.org.dash.platform.dapi.v0.GetVotePollsByEndDateResponse\x12\xa5\x01\n\x1egetPrefundedSpecializedBalance\x12@.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceRequest\x1a\x41.org.dash.platform.dapi.v0.GetPrefundedSpecializedBalanceResponse\x12\x96\x01\n\x19getTotalCreditsInPlatform\x12;.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformRequest\x1a<.org.dash.platform.dapi.v0.GetTotalCreditsInPlatformResponse\x12x\n\x0fgetPathElements\x12\x31.org.dash.platform.dapi.v0.GetPathElementsRequest\x1a\x32.org.dash.platform.dapi.v0.GetPathElementsResponse\x12\x66\n\tgetStatus\x12+.org.dash.platform.dapi.v0.GetStatusRequest\x1a,.org.dash.platform.dapi.v0.GetStatusResponse\x12\x8a\x01\n\x15getCurrentQuorumsInfo\x12\x37.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoRequest\x1a\x38.org.dash.platform.dapi.v0.GetCurrentQuorumsInfoResponse\x12\x93\x01\n\x18getIdentityTokenBalances\x12:.org.dash.platform.dapi.v0.GetIdentityTokenBalancesRequest\x1a;.org.dash.platform.dapi.v0.GetIdentityTokenBalancesResponse\x12\x99\x01\n\x1agetIdentitiesTokenBalances\x12<.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesRequest\x1a=.org.dash.platform.dapi.v0.GetIdentitiesTokenBalancesResponse\x12\x8a\x01\n\x15getIdentityTokenInfos\x12\x37.org.dash.platform.dapi.v0.GetIdentityTokenInfosRequest\x1a\x38.org.dash.platform.dapi.v0.GetIdentityTokenInfosResponse\x12\x90\x01\n\x17getIdentitiesTokenInfos\x12\x39.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosRequest\x1a:.org.dash.platform.dapi.v0.GetIdentitiesTokenInfosResponse\x12{\n\x10getTokenStatuses\x12\x32.org.dash.platform.dapi.v0.GetTokenStatusesRequest\x1a\x33.org.dash.platform.dapi.v0.GetTokenStatusesResponse\x12\x9f\x01\n\x1cgetTokenDirectPurchasePrices\x12>.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesRequest\x1a?.org.dash.platform.dapi.v0.GetTokenDirectPurchasePricesResponse\x12\x87\x01\n\x14getTokenContractInfo\x12\x36.org.dash.platform.dapi.v0.GetTokenContractInfoRequest\x1a\x37.org.dash.platform.dapi.v0.GetTokenContractInfoResponse\x12\xb1\x01\n\"getTokenPreProgrammedDistributions\x12\x44.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsRequest\x1a\x45.org.dash.platform.dapi.v0.GetTokenPreProgrammedDistributionsResponse\x12\xbd\x01\n&getTokenPerpetualDistributionLastClaim\x12H.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimRequest\x1aI.org.dash.platform.dapi.v0.GetTokenPerpetualDistributionLastClaimResponse\x12\x84\x01\n\x13getTokenTotalSupply\x12\x35.org.dash.platform.dapi.v0.GetTokenTotalSupplyRequest\x1a\x36.org.dash.platform.dapi.v0.GetTokenTotalSupplyResponse\x12o\n\x0cgetGroupInfo\x12..org.dash.platform.dapi.v0.GetGroupInfoRequest\x1a/.org.dash.platform.dapi.v0.GetGroupInfoResponse\x12r\n\rgetGroupInfos\x12/.org.dash.platform.dapi.v0.GetGroupInfosRequest\x1a\x30.org.dash.platform.dapi.v0.GetGroupInfosResponse\x12x\n\x0fgetGroupActions\x12\x31.org.dash.platform.dapi.v0.GetGroupActionsRequest\x1a\x32.org.dash.platform.dapi.v0.GetGroupActionsResponse\x12\x8a\x01\n\x15getGroupActionSigners\x12\x37.org.dash.platform.dapi.v0.GetGroupActionSignersRequest\x1a\x38.org.dash.platform.dapi.v0.GetGroupActionSignersResponse\x12u\n\x0egetAddressInfo\x12\x30.org.dash.platform.dapi.v0.GetAddressInfoRequest\x1a\x31.org.dash.platform.dapi.v0.GetAddressInfoResponse\x12~\n\x11getAddressesInfos\x12\x33.org.dash.platform.dapi.v0.GetAddressesInfosRequest\x1a\x34.org.dash.platform.dapi.v0.GetAddressesInfosResponse\x12\x8d\x01\n\x16getAddressesTrunkState\x12\x38.org.dash.platform.dapi.v0.GetAddressesTrunkStateRequest\x1a\x39.org.dash.platform.dapi.v0.GetAddressesTrunkStateResponse\x12\x90\x01\n\x17getAddressesBranchState\x12\x39.org.dash.platform.dapi.v0.GetAddressesBranchStateRequest\x1a:.org.dash.platform.dapi.v0.GetAddressesBranchStateResponse\x12\xa5\x01\n\x1egetRecentAddressBalanceChanges\x12@.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesRequest\x1a\x41.org.dash.platform.dapi.v0.GetRecentAddressBalanceChangesResponse\x12\xc0\x01\n\'getRecentCompactedAddressBalanceChanges\x12I.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesRequest\x1aJ.org.dash.platform.dapi.v0.GetRecentCompactedAddressBalanceChangesResponse\x12\x96\x01\n\x19getShieldedEncryptedNotes\x12;.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesRequest\x1a<.org.dash.platform.dapi.v0.GetShieldedEncryptedNotesResponse\x12\x81\x01\n\x12getShieldedAnchors\x12\x34.org.dash.platform.dapi.v0.GetShieldedAnchorsRequest\x1a\x35.org.dash.platform.dapi.v0.GetShieldedAnchorsResponse\x12\x9c\x01\n\x1bgetMostRecentShieldedAnchor\x12=.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorRequest\x1a>.org.dash.platform.dapi.v0.GetMostRecentShieldedAnchorResponse\x12\x87\x01\n\x14getShieldedPoolState\x12\x36.org.dash.platform.dapi.v0.GetShieldedPoolStateRequest\x1a\x37.org.dash.platform.dapi.v0.GetShieldedPoolStateResponse\x12\x8a\x01\n\x15getShieldedNotesCount\x12\x37.org.dash.platform.dapi.v0.GetShieldedNotesCountRequest\x1a\x38.org.dash.platform.dapi.v0.GetShieldedNotesCountResponse\x12\x8a\x01\n\x15getShieldedNullifiers\x12\x37.org.dash.platform.dapi.v0.GetShieldedNullifiersRequest\x1a\x38.org.dash.platform.dapi.v0.GetShieldedNullifiersResponseb\x06proto3'
   ,
   dependencies=[google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,google_dot_protobuf_dot_struct__pb2.DESCRIPTOR,google_dot_protobuf_dot_timestamp__pb2.DESCRIPTOR,])
 
@@ -62,8 +62,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=65780,
-  serialized_end=65870,
+  serialized_start=65831,
+  serialized_end=65921,
 )
 _sym_db.RegisterEnumDescriptor(_KEYPURPOSE)
 
@@ -307,11 +307,16 @@
       serialized_options=None,
       type=None,
       create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='IN_TIME_RANGE', index=11, number=11,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
   ],
   containing_type=None,
   serialized_options=None,
   serialized_start=13436,
-  serialized_end=13667,
+  serialized_end=13686,
 )
 _sym_db.RegisterEnumDescriptor(_GETDOCUMENTSREQUEST_WHEREOPERATOR)
 
@@ -340,8 +345,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=28490,
-  serialized_end=28563,
+  serialized_start=28541,
+  serialized_end=28614,
 )
 _sym_db.RegisterEnumDescriptor(_GETCONTESTEDRESOURCEVOTESTATEREQUEST_GETCONTESTEDRESOURCEVOTESTATEREQUESTV0_RESULTTYPE)
 
@@ -370,8 +375,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=29485,
-  serialized_end=29564,
+  serialized_start=29536,
+  serialized_end=29615,
 )
 _sym_db.RegisterEnumDescriptor(_GETCONTESTEDRESOURCEVOTESTATERESPONSE_GETCONTESTEDRESOURCEVOTESTATERESPONSEV0_FINISHEDVOTEINFO_FINISHEDVOTEOUTCOME)
 
@@ -400,8 +405,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=33193,
-  serialized_end=33254,
+  serialized_start=33244,
+  serialized_end=33305,
 )
 _sym_db.RegisterEnumDescriptor(_GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSE_GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSEV0_RESOURCEVOTECHOICE_VOTECHOICETYPE)
 
@@ -425,8 +430,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=51818,
-  serialized_end=51856,
+  serialized_start=51869,
+  serialized_end=51907,
 )
 _sym_db.RegisterEnumDescriptor(_GETGROUPACTIONSREQUEST_ACTIONSTATUS)
 
@@ -450,8 +455,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=53103,
-  serialized_end=53138,
+  serialized_start=53154,
+  serialized_end=53189,
 )
 _sym_db.RegisterEnumDescriptor(_GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_EMERGENCYACTIONEVENT_ACTIONTYPE)
 
@@ -475,8 +480,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=51818,
-  serialized_end=51856,
+  serialized_start=51869,
+  serialized_end=51907,
 )
 _sym_db.RegisterEnumDescriptor(_GETGROUPACTIONSIGNERSREQUEST_ACTIONSTATUS)
 
@@ -4155,7 +4160,7 @@
     fields=[]),
   ],
   serialized_start=10896,
-  serialized_end=13678,
+  serialized_end=13697,
 )
 
 
@@ -4186,8 +4191,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14121,
-  serialized_end=14151,
+  serialized_start=14140,
+  serialized_end=14170,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV0 = _descriptor.Descriptor(
@@ -4236,8 +4241,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=13878,
-  serialized_end=14161,
+  serialized_start=13897,
+  serialized_end=14180,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_DOCUMENTS = _descriptor.Descriptor(
@@ -4267,8 +4272,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14121,
-  serialized_end=14151,
+  serialized_start=14140,
+  serialized_end=14170,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_COUNTENTRY = _descriptor.Descriptor(
@@ -4317,8 +4322,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=14435,
-  serialized_end=14511,
+  serialized_start=14454,
+  serialized_end=14530,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_COUNTENTRIES = _descriptor.Descriptor(
@@ -4348,8 +4353,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14513,
-  serialized_end=14627,
+  serialized_start=14532,
+  serialized_end=14646,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_COUNTRESULTS = _descriptor.Descriptor(
@@ -4391,8 +4396,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=14630,
-  serialized_end=14790,
+  serialized_start=14649,
+  serialized_end=14809,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_SUMENTRY = _descriptor.Descriptor(
@@ -4441,8 +4446,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=14792,
-  serialized_end=14864,
+  serialized_start=14811,
+  serialized_end=14883,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_SUMENTRIES = _descriptor.Descriptor(
@@ -4472,8 +4477,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14866,
-  serialized_end=14976,
+  serialized_start=14885,
+  serialized_end=14995,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_SUMRESULTS = _descriptor.Descriptor(
@@ -4515,8 +4520,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=14979,
-  serialized_end=15133,
+  serialized_start=14998,
+  serialized_end=15152,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_AVERAGEENTRY = _descriptor.Descriptor(
@@ -4572,8 +4577,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=15135,
-  serialized_end=15230,
+  serialized_start=15154,
+  serialized_end=15249,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_AVERAGEENTRIES = _descriptor.Descriptor(
@@ -4603,8 +4608,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=15232,
-  serialized_end=15350,
+  serialized_start=15251,
+  serialized_end=15369,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_AVERAGEAGGREGATE = _descriptor.Descriptor(
@@ -4641,8 +4646,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=15352,
-  serialized_end=15406,
+  serialized_start=15371,
+  serialized_end=15425,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_AVERAGERESULTS = _descriptor.Descriptor(
@@ -4684,8 +4689,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=15409,
-  serialized_end=15660,
+  serialized_start=15428,
+  serialized_end=15679,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY = _descriptor.Descriptor(
@@ -4724,6 +4729,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='in_key', full_name='org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.in_key', index=4,
+      number=5, type=12, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"",
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -4740,9 +4752,14 @@
       index=0, containing_type=None,
       create_key=_descriptor._internal_create_key,
     fields=[]),
+    _descriptor.OneofDescriptor(
+      name='_in_key', full_name='org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry._in_key',
+      index=1, containing_type=None,
+      create_key=_descriptor._internal_create_key,
+    fields=[]),
   ],
-  serialized_start=15662,
-  serialized_end=15752,
+  serialized_start=15681,
+  serialized_end=15803,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRIES = _descriptor.Descriptor(
@@ -4784,8 +4801,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=15755,
-  serialized_end=15909,
+  serialized_start=15806,
+  serialized_end=15960,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RESULTDATA = _descriptor.Descriptor(
@@ -4848,8 +4865,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=15912,
-  serialized_end=16451,
+  serialized_start=15963,
+  serialized_end=16502,
 )
 
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1 = _descriptor.Descriptor(
@@ -4898,8 +4915,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=14164,
-  serialized_end=16461,
+  serialized_start=14183,
+  serialized_end=16512,
 )
 
 _GETDOCUMENTSRESPONSE = _descriptor.Descriptor(
@@ -4941,8 +4958,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=13681,
-  serialized_end=16472,
+  serialized_start=13700,
+  serialized_end=16523,
 )
 
 
@@ -5015,8 +5032,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=16601,
-  serialized_end=16836,
+  serialized_start=16652,
+  serialized_end=16887,
 )
 
 _GETDOCUMENTHISTORYREQUEST = _descriptor.Descriptor(
@@ -5051,8 +5068,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=16475,
-  serialized_end=16847,
+  serialized_start=16526,
+  serialized_end=16898,
 )
 
 
@@ -5090,8 +5107,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=17253,
-  serialized_end=17308,
+  serialized_start=17304,
+  serialized_end=17359,
 )
 
 _GETDOCUMENTHISTORYRESPONSE_GETDOCUMENTHISTORYRESPONSEV0_DOCUMENTHISTORY = _descriptor.Descriptor(
@@ -5121,8 +5138,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=17311,
-  serialized_end=17460,
+  serialized_start=17362,
+  serialized_end=17511,
 )
 
 _GETDOCUMENTHISTORYRESPONSE_GETDOCUMENTHISTORYRESPONSEV0 = _descriptor.Descriptor(
@@ -5171,8 +5188,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=16979,
-  serialized_end=17470,
+  serialized_start=17030,
+  serialized_end=17521,
 )
 
 _GETDOCUMENTHISTORYRESPONSE = _descriptor.Descriptor(
@@ -5207,8 +5224,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=16850,
-  serialized_end=17481,
+  serialized_start=16901,
+  serialized_end=17532,
 )
 
 
@@ -5246,8 +5263,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=17633,
-  serialized_end=17710,
+  serialized_start=17684,
+  serialized_end=17761,
 )
 
 _GETIDENTITYBYPUBLICKEYHASHREQUEST = _descriptor.Descriptor(
@@ -5282,8 +5299,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=17484,
-  serialized_end=17721,
+  serialized_start=17535,
+  serialized_end=17772,
 )
 
 
@@ -5333,8 +5350,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=17877,
-  serialized_end=18059,
+  serialized_start=17928,
+  serialized_end=18110,
 )
 
 _GETIDENTITYBYPUBLICKEYHASHRESPONSE = _descriptor.Descriptor(
@@ -5369,8 +5386,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=17724,
-  serialized_end=18070,
+  serialized_start=17775,
+  serialized_end=18121,
 )
 
 
@@ -5420,8 +5437,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=18251,
-  serialized_end=18379,
+  serialized_start=18302,
+  serialized_end=18430,
 )
 
 _GETIDENTITYBYNONUNIQUEPUBLICKEYHASHREQUEST = _descriptor.Descriptor(
@@ -5456,8 +5473,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=18073,
-  serialized_end=18390,
+  serialized_start=18124,
+  serialized_end=18441,
 )
 
 
@@ -5493,8 +5510,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19003,
-  serialized_end=19057,
+  serialized_start=19054,
+  serialized_end=19108,
 )
 
 _GETIDENTITYBYNONUNIQUEPUBLICKEYHASHRESPONSE_GETIDENTITYBYNONUNIQUEPUBLICKEYHASHRESPONSEV0_IDENTITYPROVEDRESPONSE = _descriptor.Descriptor(
@@ -5536,8 +5553,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19060,
-  serialized_end=19226,
+  serialized_start=19111,
+  serialized_end=19277,
 )
 
 _GETIDENTITYBYNONUNIQUEPUBLICKEYHASHRESPONSE_GETIDENTITYBYNONUNIQUEPUBLICKEYHASHRESPONSEV0 = _descriptor.Descriptor(
@@ -5586,8 +5603,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=18574,
-  serialized_end=19236,
+  serialized_start=18625,
+  serialized_end=19287,
 )
 
 _GETIDENTITYBYNONUNIQUEPUBLICKEYHASHRESPONSE = _descriptor.Descriptor(
@@ -5622,8 +5639,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=18393,
-  serialized_end=19247,
+  serialized_start=18444,
+  serialized_end=19298,
 )
 
 
@@ -5661,8 +5678,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=19405,
-  serialized_end=19490,
+  serialized_start=19456,
+  serialized_end=19541,
 )
 
 _WAITFORSTATETRANSITIONRESULTREQUEST = _descriptor.Descriptor(
@@ -5697,8 +5714,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19250,
-  serialized_end=19501,
+  serialized_start=19301,
+  serialized_end=19552,
 )
 
 
@@ -5748,8 +5765,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19663,
-  serialized_end=19902,
+  serialized_start=19714,
+  serialized_end=19953,
 )
 
 _WAITFORSTATETRANSITIONRESULTRESPONSE = _descriptor.Descriptor(
@@ -5784,8 +5801,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19504,
-  serialized_end=19913,
+  serialized_start=19555,
+  serialized_end=19964,
 )
 
 
@@ -5823,8 +5840,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=20041,
-  serialized_end=20101,
+  serialized_start=20092,
+  serialized_end=20152,
 )
 
 _GETCONSENSUSPARAMSREQUEST = _descriptor.Descriptor(
@@ -5859,8 +5876,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=19916,
-  serialized_end=20112,
+  serialized_start=19967,
+  serialized_end=20163,
 )
 
 
@@ -5905,8 +5922,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=20243,
-  serialized_end=20323,
+  serialized_start=20294,
+  serialized_end=20374,
 )
 
 _GETCONSENSUSPARAMSRESPONSE_CONSENSUSPARAMSEVIDENCE = _descriptor.Descriptor(
@@ -5950,8 +5967,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=20325,
-  serialized_end=20423,
+  serialized_start=20376,
+  serialized_end=20474,
 )
 
 _GETCONSENSUSPARAMSRESPONSE_GETCONSENSUSPARAMSRESPONSEV0 = _descriptor.Descriptor(
@@ -5988,8 +6005,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=20426,
-  serialized_end=20644,
+  serialized_start=20477,
+  serialized_end=20695,
 )
 
 _GETCONSENSUSPARAMSRESPONSE = _descriptor.Descriptor(
@@ -6024,8 +6041,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=20115,
-  serialized_end=20655,
+  serialized_start=20166,
+  serialized_end=20706,
 )
 
 
@@ -6056,8 +6073,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=20819,
-  serialized_end=20875,
+  serialized_start=20870,
+  serialized_end=20926,
 )
 
 _GETPROTOCOLVERSIONUPGRADESTATEREQUEST = _descriptor.Descriptor(
@@ -6092,8 +6109,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=20658,
-  serialized_end=20886,
+  serialized_start=20709,
+  serialized_end=20937,
 )
 
 
@@ -6124,8 +6141,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=21351,
-  serialized_end=21501,
+  serialized_start=21402,
+  serialized_end=21552,
 )
 
 _GETPROTOCOLVERSIONUPGRADESTATERESPONSE_GETPROTOCOLVERSIONUPGRADESTATERESPONSEV0_VERSIONENTRY = _descriptor.Descriptor(
@@ -6162,8 +6179,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=21503,
-  serialized_end=21561,
+  serialized_start=21554,
+  serialized_end=21612,
 )
 
 _GETPROTOCOLVERSIONUPGRADESTATERESPONSE_GETPROTOCOLVERSIONUPGRADESTATERESPONSEV0 = _descriptor.Descriptor(
@@ -6212,8 +6229,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=21054,
-  serialized_end=21571,
+  serialized_start=21105,
+  serialized_end=21622,
 )
 
 _GETPROTOCOLVERSIONUPGRADESTATERESPONSE = _descriptor.Descriptor(
@@ -6248,8 +6265,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=20889,
-  serialized_end=21582,
+  serialized_start=20940,
+  serialized_end=21633,
 )
 
 
@@ -6294,8 +6311,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=21762,
-  serialized_end=21865,
+  serialized_start=21813,
+  serialized_end=21916,
 )
 
 _GETPROTOCOLVERSIONUPGRADEVOTESTATUSREQUEST = _descriptor.Descriptor(
@@ -6330,8 +6347,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=21585,
-  serialized_end=21876,
+  serialized_start=21636,
+  serialized_end=21927,
 )
 
 
@@ -6362,8 +6379,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=22379,
-  serialized_end=22554,
+  serialized_start=22430,
+  serialized_end=22605,
 )
 
 _GETPROTOCOLVERSIONUPGRADEVOTESTATUSRESPONSE_GETPROTOCOLVERSIONUPGRADEVOTESTATUSRESPONSEV0_VERSIONSIGNAL = _descriptor.Descriptor(
@@ -6400,8 +6417,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=22556,
-  serialized_end=22609,
+  serialized_start=22607,
+  serialized_end=22660,
 )
 
 _GETPROTOCOLVERSIONUPGRADEVOTESTATUSRESPONSE_GETPROTOCOLVERSIONUPGRADEVOTESTATUSRESPONSEV0 = _descriptor.Descriptor(
@@ -6450,8 +6467,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=22060,
-  serialized_end=22619,
+  serialized_start=22111,
+  serialized_end=22670,
 )
 
 _GETPROTOCOLVERSIONUPGRADEVOTESTATUSRESPONSE = _descriptor.Descriptor(
@@ -6486,8 +6503,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=21879,
-  serialized_end=22630,
+  serialized_start=21930,
+  serialized_end=22681,
 )
 
 
@@ -6539,8 +6556,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=22743,
-  serialized_end=22867,
+  serialized_start=22794,
+  serialized_end=22918,
 )
 
 _GETEPOCHSINFOREQUEST = _descriptor.Descriptor(
@@ -6575,8 +6592,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=22633,
-  serialized_end=22878,
+  serialized_start=22684,
+  serialized_end=22929,
 )
 
 
@@ -6607,8 +6624,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=23239,
-  serialized_end=23356,
+  serialized_start=23290,
+  serialized_end=23407,
 )
 
 _GETEPOCHSINFORESPONSE_GETEPOCHSINFORESPONSEV0_EPOCHINFO = _descriptor.Descriptor(
@@ -6673,8 +6690,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=23359,
-  serialized_end=23525,
+  serialized_start=23410,
+  serialized_end=23576,
 )
 
 _GETEPOCHSINFORESPONSE_GETEPOCHSINFORESPONSEV0 = _descriptor.Descriptor(
@@ -6723,8 +6740,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=22995,
-  serialized_end=23535,
+  serialized_start=23046,
+  serialized_end=23586,
 )
 
 _GETEPOCHSINFORESPONSE = _descriptor.Descriptor(
@@ -6759,8 +6776,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=22881,
-  serialized_end=23546,
+  serialized_start=22932,
+  serialized_end=23597,
 )
 
 
@@ -6819,8 +6836,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=23687,
-  serialized_end=23857,
+  serialized_start=23738,
+  serialized_end=23908,
 )
 
 _GETFINALIZEDEPOCHINFOSREQUEST = _descriptor.Descriptor(
@@ -6855,8 +6872,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=23549,
-  serialized_end=23868,
+  serialized_start=23600,
+  serialized_end=23919,
 )
 
 
@@ -6887,8 +6904,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=24294,
-  serialized_end=24458,
+  serialized_start=24345,
+  serialized_end=24509,
 )
 
 _GETFINALIZEDEPOCHINFOSRESPONSE_GETFINALIZEDEPOCHINFOSRESPONSEV0_FINALIZEDEPOCHINFO = _descriptor.Descriptor(
@@ -7002,8 +7019,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=24461,
-  serialized_end=25004,
+  serialized_start=24512,
+  serialized_end=25055,
 )
 
 _GETFINALIZEDEPOCHINFOSRESPONSE_GETFINALIZEDEPOCHINFOSRESPONSEV0_BLOCKPROPOSER = _descriptor.Descriptor(
@@ -7040,8 +7057,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=25006,
-  serialized_end=25063,
+  serialized_start=25057,
+  serialized_end=25114,
 )
 
 _GETFINALIZEDEPOCHINFOSRESPONSE_GETFINALIZEDEPOCHINFOSRESPONSEV0 = _descriptor.Descriptor(
@@ -7090,8 +7107,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=24012,
-  serialized_end=25073,
+  serialized_start=24063,
+  serialized_end=25124,
 )
 
 _GETFINALIZEDEPOCHINFOSRESPONSE = _descriptor.Descriptor(
@@ -7126,8 +7143,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=23871,
-  serialized_end=25084,
+  serialized_start=23922,
+  serialized_end=25135,
 )
 
 
@@ -7165,8 +7182,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=25579,
-  serialized_end=25648,
+  serialized_start=25630,
+  serialized_end=25699,
 )
 
 _GETCONTESTEDRESOURCESREQUEST_GETCONTESTEDRESOURCESREQUESTV0 = _descriptor.Descriptor(
@@ -7262,8 +7279,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=25222,
-  serialized_end=25682,
+  serialized_start=25273,
+  serialized_end=25733,
 )
 
 _GETCONTESTEDRESOURCESREQUEST = _descriptor.Descriptor(
@@ -7298,8 +7315,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=25087,
-  serialized_end=25693,
+  serialized_start=25138,
+  serialized_end=25744,
 )
 
 
@@ -7330,8 +7347,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=26135,
-  serialized_end=26195,
+  serialized_start=26186,
+  serialized_end=26246,
 )
 
 _GETCONTESTEDRESOURCESRESPONSE_GETCONTESTEDRESOURCESRESPONSEV0 = _descriptor.Descriptor(
@@ -7380,8 +7397,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=25834,
-  serialized_end=26205,
+  serialized_start=25885,
+  serialized_end=26256,
 )
 
 _GETCONTESTEDRESOURCESRESPONSE = _descriptor.Descriptor(
@@ -7416,8 +7433,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=25696,
-  serialized_end=26216,
+  serialized_start=25747,
+  serialized_end=26267,
 )
 
 
@@ -7455,8 +7472,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=26729,
-  serialized_end=26802,
+  serialized_start=26780,
+  serialized_end=26853,
 )
 
 _GETVOTEPOLLSBYENDDATEREQUEST_GETVOTEPOLLSBYENDDATEREQUESTV0_ENDATTIMEINFO = _descriptor.Descriptor(
@@ -7493,8 +7510,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=26804,
-  serialized_end=26871,
+  serialized_start=26855,
+  serialized_end=26922,
 )
 
 _GETVOTEPOLLSBYENDDATEREQUEST_GETVOTEPOLLSBYENDDATEREQUESTV0 = _descriptor.Descriptor(
@@ -7579,8 +7596,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=26354,
-  serialized_end=26930,
+  serialized_start=26405,
+  serialized_end=26981,
 )
 
 _GETVOTEPOLLSBYENDDATEREQUEST = _descriptor.Descriptor(
@@ -7615,8 +7632,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=26219,
-  serialized_end=26941,
+  serialized_start=26270,
+  serialized_end=26992,
 )
 
 
@@ -7654,8 +7671,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=27390,
-  serialized_end=27476,
+  serialized_start=27441,
+  serialized_end=27527,
 )
 
 _GETVOTEPOLLSBYENDDATERESPONSE_GETVOTEPOLLSBYENDDATERESPONSEV0_SERIALIZEDVOTEPOLLSBYTIMESTAMPS = _descriptor.Descriptor(
@@ -7692,8 +7709,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=27479,
-  serialized_end=27694,
+  serialized_start=27530,
+  serialized_end=27745,
 )
 
 _GETVOTEPOLLSBYENDDATERESPONSE_GETVOTEPOLLSBYENDDATERESPONSEV0 = _descriptor.Descriptor(
@@ -7742,8 +7759,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=27082,
-  serialized_end=27704,
+  serialized_start=27133,
+  serialized_end=27755,
 )
 
 _GETVOTEPOLLSBYENDDATERESPONSE = _descriptor.Descriptor(
@@ -7778,8 +7795,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=26944,
-  serialized_end=27715,
+  serialized_start=26995,
+  serialized_end=27766,
 )
 
 
@@ -7817,8 +7834,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=28404,
-  serialized_end=28488,
+  serialized_start=28455,
+  serialized_end=28539,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATEREQUEST_GETCONTESTEDRESOURCEVOTESTATEREQUESTV0 = _descriptor.Descriptor(
@@ -7915,8 +7932,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=27877,
-  serialized_end=28602,
+  serialized_start=27928,
+  serialized_end=28653,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATEREQUEST = _descriptor.Descriptor(
@@ -7951,8 +7968,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=27718,
-  serialized_end=28613,
+  serialized_start=27769,
+  serialized_end=28664,
 )
 
 
@@ -8024,8 +8041,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=29113,
-  serialized_end=29587,
+  serialized_start=29164,
+  serialized_end=29638,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATERESPONSE_GETCONTESTEDRESOURCEVOTESTATERESPONSEV0_CONTESTEDRESOURCECONTENDERS = _descriptor.Descriptor(
@@ -8091,8 +8108,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=29590,
-  serialized_end=30042,
+  serialized_start=29641,
+  serialized_end=30093,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATERESPONSE_GETCONTESTEDRESOURCEVOTESTATERESPONSEV0_CONTENDER = _descriptor.Descriptor(
@@ -8146,8 +8163,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=30044,
-  serialized_end=30151,
+  serialized_start=30095,
+  serialized_end=30202,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATERESPONSE_GETCONTESTEDRESOURCEVOTESTATERESPONSEV0 = _descriptor.Descriptor(
@@ -8196,8 +8213,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=28778,
-  serialized_end=30161,
+  serialized_start=28829,
+  serialized_end=30212,
 )
 
 _GETCONTESTEDRESOURCEVOTESTATERESPONSE = _descriptor.Descriptor(
@@ -8232,8 +8249,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=28616,
-  serialized_end=30172,
+  serialized_start=28667,
+  serialized_end=30223,
 )
 
 
@@ -8271,8 +8288,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=28404,
-  serialized_end=28488,
+  serialized_start=28455,
+  serialized_end=28539,
 )
 
 _GETCONTESTEDRESOURCEVOTERSFORIDENTITYREQUEST_GETCONTESTEDRESOURCEVOTERSFORIDENTITYREQUESTV0 = _descriptor.Descriptor(
@@ -8368,8 +8385,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=30359,
-  serialized_end=30889,
+  serialized_start=30410,
+  serialized_end=30940,
 )
 
 _GETCONTESTEDRESOURCEVOTERSFORIDENTITYREQUEST = _descriptor.Descriptor(
@@ -8404,8 +8421,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=30175,
-  serialized_end=30900,
+  serialized_start=30226,
+  serialized_end=30951,
 )
 
 
@@ -8443,8 +8460,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=31440,
-  serialized_end=31507,
+  serialized_start=31491,
+  serialized_end=31558,
 )
 
 _GETCONTESTEDRESOURCEVOTERSFORIDENTITYRESPONSE_GETCONTESTEDRESOURCEVOTERSFORIDENTITYRESPONSEV0 = _descriptor.Descriptor(
@@ -8493,8 +8510,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=31090,
-  serialized_end=31517,
+  serialized_start=31141,
+  serialized_end=31568,
 )
 
 _GETCONTESTEDRESOURCEVOTERSFORIDENTITYRESPONSE = _descriptor.Descriptor(
@@ -8529,8 +8546,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=30903,
-  serialized_end=31528,
+  serialized_start=30954,
+  serialized_end=31579,
 )
 
 
@@ -8568,8 +8585,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=32077,
-  serialized_end=32174,
+  serialized_start=32128,
+  serialized_end=32225,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESREQUEST_GETCONTESTEDRESOURCEIDENTITYVOTESREQUESTV0 = _descriptor.Descriptor(
@@ -8639,8 +8656,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=31702,
-  serialized_end=32205,
+  serialized_start=31753,
+  serialized_end=32256,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESREQUEST = _descriptor.Descriptor(
@@ -8675,8 +8692,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=31531,
-  serialized_end=32216,
+  serialized_start=31582,
+  serialized_end=32267,
 )
 
 
@@ -8714,8 +8731,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=32719,
-  serialized_end=32966,
+  serialized_start=32770,
+  serialized_end=33017,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSE_GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSEV0_RESOURCEVOTECHOICE = _descriptor.Descriptor(
@@ -8758,8 +8775,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=32969,
-  serialized_end=33270,
+  serialized_start=33020,
+  serialized_end=33321,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSE_GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSEV0_CONTESTEDRESOURCEIDENTITYVOTE = _descriptor.Descriptor(
@@ -8810,8 +8827,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=33273,
-  serialized_end=33550,
+  serialized_start=33324,
+  serialized_end=33601,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSE_GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSEV0 = _descriptor.Descriptor(
@@ -8860,8 +8877,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=32393,
-  serialized_end=33560,
+  serialized_start=32444,
+  serialized_end=33611,
 )
 
 _GETCONTESTEDRESOURCEIDENTITYVOTESRESPONSE = _descriptor.Descriptor(
@@ -8896,8 +8913,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=32219,
-  serialized_end=33571,
+  serialized_start=32270,
+  serialized_end=33622,
 )
 
 
@@ -8935,8 +8952,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=33735,
-  serialized_end=33803,
+  serialized_start=33786,
+  serialized_end=33854,
 )
 
 _GETPREFUNDEDSPECIALIZEDBALANCEREQUEST = _descriptor.Descriptor(
@@ -8971,8 +8988,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=33574,
-  serialized_end=33814,
+  serialized_start=33625,
+  serialized_end=33865,
 )
 
 
@@ -9022,8 +9039,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=33982,
-  serialized_end=34171,
+  serialized_start=34033,
+  serialized_end=34222,
 )
 
 _GETPREFUNDEDSPECIALIZEDBALANCERESPONSE = _descriptor.Descriptor(
@@ -9058,8 +9075,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=33817,
-  serialized_end=34182,
+  serialized_start=33868,
+  serialized_end=34233,
 )
 
 
@@ -9090,8 +9107,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=34331,
-  serialized_end=34382,
+  serialized_start=34382,
+  serialized_end=34433,
 )
 
 _GETTOTALCREDITSINPLATFORMREQUEST = _descriptor.Descriptor(
@@ -9126,8 +9143,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=34185,
-  serialized_end=34393,
+  serialized_start=34236,
+  serialized_end=34444,
 )
 
 
@@ -9177,8 +9194,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=34546,
-  serialized_end=34730,
+  serialized_start=34597,
+  serialized_end=34781,
 )
 
 _GETTOTALCREDITSINPLATFORMRESPONSE = _descriptor.Descriptor(
@@ -9213,8 +9230,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=34396,
-  serialized_end=34741,
+  serialized_start=34447,
+  serialized_end=34792,
 )
 
 
@@ -9259,8 +9276,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=34860,
-  serialized_end=34929,
+  serialized_start=34911,
+  serialized_end=34980,
 )
 
 _GETPATHELEMENTSREQUEST = _descriptor.Descriptor(
@@ -9295,8 +9312,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=34744,
-  serialized_end=34940,
+  serialized_start=34795,
+  serialized_end=34991,
 )
 
 
@@ -9327,8 +9344,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=35313,
-  serialized_end=35341,
+  serialized_start=35364,
+  serialized_end=35392,
 )
 
 _GETPATHELEMENTSRESPONSE_GETPATHELEMENTSRESPONSEV0 = _descriptor.Descriptor(
@@ -9377,8 +9394,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=35063,
-  serialized_end=35351,
+  serialized_start=35114,
+  serialized_end=35402,
 )
 
 _GETPATHELEMENTSRESPONSE = _descriptor.Descriptor(
@@ -9413,8 +9430,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=34943,
-  serialized_end=35362,
+  serialized_start=34994,
+  serialized_end=35413,
 )
 
 
@@ -9438,8 +9455,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=35463,
-  serialized_end=35483,
+  serialized_start=35514,
+  serialized_end=35534,
 )
 
 _GETSTATUSREQUEST = _descriptor.Descriptor(
@@ -9474,8 +9491,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=35365,
-  serialized_end=35494,
+  serialized_start=35416,
+  serialized_end=35545,
 )
 
 
@@ -9530,8 +9547,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=36371,
-  serialized_end=36465,
+  serialized_start=36422,
+  serialized_end=36516,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_VERSION_PROTOCOL_TENDERDASH = _descriptor.Descriptor(
@@ -9568,8 +9585,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=36698,
-  serialized_end=36738,
+  serialized_start=36749,
+  serialized_end=36789,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_VERSION_PROTOCOL_DRIVE = _descriptor.Descriptor(
@@ -9613,8 +9630,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=36740,
-  serialized_end=36800,
+  serialized_start=36791,
+  serialized_end=36851,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_VERSION_PROTOCOL = _descriptor.Descriptor(
@@ -9651,8 +9668,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=36468,
-  serialized_end=36800,
+  serialized_start=36519,
+  serialized_end=36851,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_VERSION = _descriptor.Descriptor(
@@ -9689,8 +9706,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=36158,
-  serialized_end=36800,
+  serialized_start=36209,
+  serialized_end=36851,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_TIME = _descriptor.Descriptor(
@@ -9756,8 +9773,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=36802,
-  serialized_end=36929,
+  serialized_start=36853,
+  serialized_end=36980,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_NODE = _descriptor.Descriptor(
@@ -9799,8 +9816,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=36931,
-  serialized_end=36991,
+  serialized_start=36982,
+  serialized_end=37042,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_CHAIN = _descriptor.Descriptor(
@@ -9891,8 +9908,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=36994,
-  serialized_end=37301,
+  serialized_start=37045,
+  serialized_end=37352,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_NETWORK = _descriptor.Descriptor(
@@ -9936,8 +9953,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=37303,
-  serialized_end=37370,
+  serialized_start=37354,
+  serialized_end=37421,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0_STATESYNC = _descriptor.Descriptor(
@@ -10016,8 +10033,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=37373,
-  serialized_end=37634,
+  serialized_start=37424,
+  serialized_end=37685,
 )
 
 _GETSTATUSRESPONSE_GETSTATUSRESPONSEV0 = _descriptor.Descriptor(
@@ -10082,8 +10099,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=35599,
-  serialized_end=37634,
+  serialized_start=35650,
+  serialized_end=37685,
 )
 
 _GETSTATUSRESPONSE = _descriptor.Descriptor(
@@ -10118,8 +10135,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=35497,
-  serialized_end=37645,
+  serialized_start=35548,
+  serialized_end=37696,
 )
 
 
@@ -10143,8 +10160,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=37782,
-  serialized_end=37814,
+  serialized_start=37833,
+  serialized_end=37865,
 )
 
 _GETCURRENTQUORUMSINFOREQUEST = _descriptor.Descriptor(
@@ -10179,8 +10196,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=37648,
-  serialized_end=37825,
+  serialized_start=37699,
+  serialized_end=37876,
 )
 
 
@@ -10225,8 +10242,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=37965,
-  serialized_end=38035,
+  serialized_start=38016,
+  serialized_end=38086,
 )
 
 _GETCURRENTQUORUMSINFORESPONSE_VALIDATORSETV0 = _descriptor.Descriptor(
@@ -10277,8 +10294,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=38038,
-  serialized_end=38213,
+  serialized_start=38089,
+  serialized_end=38264,
 )
 
 _GETCURRENTQUORUMSINFORESPONSE_GETCURRENTQUORUMSINFORESPONSEV0 = _descriptor.Descriptor(
@@ -10336,8 +10353,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=38216,
-  serialized_end=38490,
+  serialized_start=38267,
+  serialized_end=38541,
 )
 
 _GETCURRENTQUORUMSINFORESPONSE = _descriptor.Descriptor(
@@ -10372,8 +10389,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=37828,
-  serialized_end=38501,
+  serialized_start=37879,
+  serialized_end=38552,
 )
 
 
@@ -10418,8 +10435,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=38647,
-  serialized_end=38737,
+  serialized_start=38698,
+  serialized_end=38788,
 )
 
 _GETIDENTITYTOKENBALANCESREQUEST = _descriptor.Descriptor(
@@ -10454,8 +10471,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=38504,
-  serialized_end=38748,
+  serialized_start=38555,
+  serialized_end=38799,
 )
 
 
@@ -10498,8 +10515,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=39187,
-  serialized_end=39258,
+  serialized_start=39238,
+  serialized_end=39309,
 )
 
 _GETIDENTITYTOKENBALANCESRESPONSE_GETIDENTITYTOKENBALANCESRESPONSEV0_TOKENBALANCES = _descriptor.Descriptor(
@@ -10529,8 +10546,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=39261,
-  serialized_end=39415,
+  serialized_start=39312,
+  serialized_end=39466,
 )
 
 _GETIDENTITYTOKENBALANCESRESPONSE_GETIDENTITYTOKENBALANCESRESPONSEV0 = _descriptor.Descriptor(
@@ -10579,8 +10596,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=38898,
-  serialized_end=39425,
+  serialized_start=38949,
+  serialized_end=39476,
 )
 
 _GETIDENTITYTOKENBALANCESRESPONSE = _descriptor.Descriptor(
@@ -10615,8 +10632,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=38751,
-  serialized_end=39436,
+  serialized_start=38802,
+  serialized_end=39487,
 )
 
 
@@ -10661,8 +10678,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=39588,
-  serialized_end=39680,
+  serialized_start=39639,
+  serialized_end=39731,
 )
 
 _GETIDENTITIESTOKENBALANCESREQUEST = _descriptor.Descriptor(
@@ -10697,8 +10714,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=39439,
-  serialized_end=39691,
+  serialized_start=39490,
+  serialized_end=39742,
 )
 
 
@@ -10741,8 +10758,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=40159,
-  serialized_end=40241,
+  serialized_start=40210,
+  serialized_end=40292,
 )
 
 _GETIDENTITIESTOKENBALANCESRESPONSE_GETIDENTITIESTOKENBALANCESRESPONSEV0_IDENTITYTOKENBALANCES = _descriptor.Descriptor(
@@ -10772,8 +10789,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=40244,
-  serialized_end=40427,
+  serialized_start=40295,
+  serialized_end=40478,
 )
 
 _GETIDENTITIESTOKENBALANCESRESPONSE_GETIDENTITIESTOKENBALANCESRESPONSEV0 = _descriptor.Descriptor(
@@ -10822,8 +10839,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=39847,
-  serialized_end=40437,
+  serialized_start=39898,
+  serialized_end=40488,
 )
 
 _GETIDENTITIESTOKENBALANCESRESPONSE = _descriptor.Descriptor(
@@ -10858,8 +10875,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=39694,
-  serialized_end=40448,
+  serialized_start=39745,
+  serialized_end=40499,
 )
 
 
@@ -10904,8 +10921,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=40585,
-  serialized_end=40672,
+  serialized_start=40636,
+  serialized_end=40723,
 )
 
 _GETIDENTITYTOKENINFOSREQUEST = _descriptor.Descriptor(
@@ -10940,8 +10957,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=40451,
-  serialized_end=40683,
+  serialized_start=40502,
+  serialized_end=40734,
 )
 
 
@@ -10972,8 +10989,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=41097,
-  serialized_end=41137,
+  serialized_start=41148,
+  serialized_end=41188,
 )
 
 _GETIDENTITYTOKENINFOSRESPONSE_GETIDENTITYTOKENINFOSRESPONSEV0_TOKENINFOENTRY = _descriptor.Descriptor(
@@ -11015,8 +11032,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=41140,
-  serialized_end=41316,
+  serialized_start=41191,
+  serialized_end=41367,
 )
 
 _GETIDENTITYTOKENINFOSRESPONSE_GETIDENTITYTOKENINFOSRESPONSEV0_TOKENINFOS = _descriptor.Descriptor(
@@ -11046,8 +11063,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=41319,
-  serialized_end=41457,
+  serialized_start=41370,
+  serialized_end=41508,
 )
 
 _GETIDENTITYTOKENINFOSRESPONSE_GETIDENTITYTOKENINFOSRESPONSEV0 = _descriptor.Descriptor(
@@ -11096,8 +11113,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=40824,
-  serialized_end=41467,
+  serialized_start=40875,
+  serialized_end=41518,
 )
 
 _GETIDENTITYTOKENINFOSRESPONSE = _descriptor.Descriptor(
@@ -11132,8 +11149,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=40686,
-  serialized_end=41478,
+  serialized_start=40737,
+  serialized_end=41529,
 )
 
 
@@ -11178,8 +11195,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=41621,
-  serialized_end=41710,
+  serialized_start=41672,
+  serialized_end=41761,
 )
 
 _GETIDENTITIESTOKENINFOSREQUEST = _descriptor.Descriptor(
@@ -11214,8 +11231,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=41481,
-  serialized_end=41721,
+  serialized_start=41532,
+  serialized_end=41772,
 )
 
 
@@ -11246,8 +11263,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=41097,
-  serialized_end=41137,
+  serialized_start=41148,
+  serialized_end=41188,
 )
 
 _GETIDENTITIESTOKENINFOSRESPONSE_GETIDENTITIESTOKENINFOSRESPONSEV0_TOKENINFOENTRY = _descriptor.Descriptor(
@@ -11289,8 +11306,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=42208,
-  serialized_end=42391,
+  serialized_start=42259,
+  serialized_end=42442,
 )
 
 _GETIDENTITIESTOKENINFOSRESPONSE_GETIDENTITIESTOKENINFOSRESPONSEV0_IDENTITYTOKENINFOS = _descriptor.Descriptor(
@@ -11320,8 +11337,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=42394,
-  serialized_end=42545,
+  serialized_start=42445,
+  serialized_end=42596,
 )
 
 _GETIDENTITIESTOKENINFOSRESPONSE_GETIDENTITIESTOKENINFOSRESPONSEV0 = _descriptor.Descriptor(
@@ -11370,8 +11387,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=41868,
-  serialized_end=42555,
+  serialized_start=41919,
+  serialized_end=42606,
 )
 
 _GETIDENTITIESTOKENINFOSRESPONSE = _descriptor.Descriptor(
@@ -11406,8 +11423,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=41724,
-  serialized_end=42566,
+  serialized_start=41775,
+  serialized_end=42617,
 )
 
 
@@ -11445,8 +11462,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=42688,
-  serialized_end=42749,
+  serialized_start=42739,
+  serialized_end=42800,
 )
 
 _GETTOKENSTATUSESREQUEST = _descriptor.Descriptor(
@@ -11481,8 +11498,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=42569,
-  serialized_end=42760,
+  serialized_start=42620,
+  serialized_end=42811,
 )
 
 
@@ -11525,8 +11542,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=43150,
-  serialized_end=43218,
+  serialized_start=43201,
+  serialized_end=43269,
 )
 
 _GETTOKENSTATUSESRESPONSE_GETTOKENSTATUSESRESPONSEV0_TOKENSTATUSES = _descriptor.Descriptor(
@@ -11556,8 +11573,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=43221,
-  serialized_end=43357,
+  serialized_start=43272,
+  serialized_end=43408,
 )
 
 _GETTOKENSTATUSESRESPONSE_GETTOKENSTATUSESRESPONSEV0 = _descriptor.Descriptor(
@@ -11606,8 +11623,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=42886,
-  serialized_end=43367,
+  serialized_start=42937,
+  serialized_end=43418,
 )
 
 _GETTOKENSTATUSESRESPONSE = _descriptor.Descriptor(
@@ -11642,8 +11659,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=42763,
-  serialized_end=43378,
+  serialized_start=42814,
+  serialized_end=43429,
 )
 
 
@@ -11681,8 +11698,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=43536,
-  serialized_end=43609,
+  serialized_start=43587,
+  serialized_end=43660,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESREQUEST = _descriptor.Descriptor(
@@ -11717,8 +11734,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=43381,
-  serialized_end=43620,
+  serialized_start=43432,
+  serialized_end=43671,
 )
 
 
@@ -11756,8 +11773,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=44110,
-  serialized_end=44161,
+  serialized_start=44161,
+  serialized_end=44212,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESRESPONSE_GETTOKENDIRECTPURCHASEPRICESRESPONSEV0_PRICINGSCHEDULE = _descriptor.Descriptor(
@@ -11787,8 +11804,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=44164,
-  serialized_end=44331,
+  serialized_start=44215,
+  serialized_end=44382,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESRESPONSE_GETTOKENDIRECTPURCHASEPRICESRESPONSEV0_TOKENDIRECTPURCHASEPRICEENTRY = _descriptor.Descriptor(
@@ -11837,8 +11854,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=44334,
-  serialized_end=44562,
+  serialized_start=44385,
+  serialized_end=44613,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESRESPONSE_GETTOKENDIRECTPURCHASEPRICESRESPONSEV0_TOKENDIRECTPURCHASEPRICES = _descriptor.Descriptor(
@@ -11868,8 +11885,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=44565,
-  serialized_end=44765,
+  serialized_start=44616,
+  serialized_end=44816,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESRESPONSE_GETTOKENDIRECTPURCHASEPRICESRESPONSEV0 = _descriptor.Descriptor(
@@ -11918,8 +11935,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=43782,
-  serialized_end=44775,
+  serialized_start=43833,
+  serialized_end=44826,
 )
 
 _GETTOKENDIRECTPURCHASEPRICESRESPONSE = _descriptor.Descriptor(
@@ -11954,8 +11971,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=43623,
-  serialized_end=44786,
+  serialized_start=43674,
+  serialized_end=44837,
 )
 
 
@@ -11993,8 +12010,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=44920,
-  serialized_end=44984,
+  serialized_start=44971,
+  serialized_end=45035,
 )
 
 _GETTOKENCONTRACTINFOREQUEST = _descriptor.Descriptor(
@@ -12029,8 +12046,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=44789,
-  serialized_end=44995,
+  serialized_start=44840,
+  serialized_end=45046,
 )
 
 
@@ -12068,8 +12085,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=45407,
-  serialized_end=45484,
+  serialized_start=45458,
+  serialized_end=45535,
 )
 
 _GETTOKENCONTRACTINFORESPONSE_GETTOKENCONTRACTINFORESPONSEV0 = _descriptor.Descriptor(
@@ -12118,8 +12135,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=45133,
-  serialized_end=45494,
+  serialized_start=45184,
+  serialized_end=45545,
 )
 
 _GETTOKENCONTRACTINFORESPONSE = _descriptor.Descriptor(
@@ -12154,8 +12171,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=44998,
-  serialized_end=45505,
+  serialized_start=45049,
+  serialized_end=45556,
 )
 
 
@@ -12210,8 +12227,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=45938,
-  serialized_end=46092,
+  serialized_start=45989,
+  serialized_end=46143,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSREQUEST_GETTOKENPREPROGRAMMEDDISTRIBUTIONSREQUESTV0 = _descriptor.Descriptor(
@@ -12272,8 +12289,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=45682,
-  serialized_end=46120,
+  serialized_start=45733,
+  serialized_end=46171,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSREQUEST = _descriptor.Descriptor(
@@ -12308,8 +12325,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=45508,
-  serialized_end=46131,
+  serialized_start=45559,
+  serialized_end=46182,
 )
 
 
@@ -12347,8 +12364,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=46642,
-  serialized_end=46704,
+  serialized_start=46693,
+  serialized_end=46755,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSE_GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSEV0_TOKENTIMEDDISTRIBUTIONENTRY = _descriptor.Descriptor(
@@ -12385,8 +12402,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=46707,
-  serialized_end=46919,
+  serialized_start=46758,
+  serialized_end=46970,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSE_GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSEV0_TOKENDISTRIBUTIONS = _descriptor.Descriptor(
@@ -12416,8 +12433,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=46922,
-  serialized_end=47117,
+  serialized_start=46973,
+  serialized_end=47168,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSE_GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSEV0 = _descriptor.Descriptor(
@@ -12466,8 +12483,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=46312,
-  serialized_end=47127,
+  serialized_start=46363,
+  serialized_end=47178,
 )
 
 _GETTOKENPREPROGRAMMEDDISTRIBUTIONSRESPONSE = _descriptor.Descriptor(
@@ -12502,8 +12519,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=46134,
-  serialized_end=47138,
+  serialized_start=46185,
+  serialized_end=47189,
 )
 
 
@@ -12541,8 +12558,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=47327,
-  serialized_end=47400,
+  serialized_start=47378,
+  serialized_end=47451,
 )
 
 _GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMREQUEST_GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMREQUESTV0 = _descriptor.Descriptor(
@@ -12598,8 +12615,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=47403,
-  serialized_end=47644,
+  serialized_start=47454,
+  serialized_end=47695,
 )
 
 _GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMREQUEST = _descriptor.Descriptor(
@@ -12634,8 +12651,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=47141,
-  serialized_end=47655,
+  serialized_start=47192,
+  serialized_end=47706,
 )
 
 
@@ -12692,8 +12709,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=48176,
-  serialized_end=48296,
+  serialized_start=48227,
+  serialized_end=48347,
 )
 
 _GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMRESPONSE_GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMRESPONSEV0 = _descriptor.Descriptor(
@@ -12742,8 +12759,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=47848,
-  serialized_end=48306,
+  serialized_start=47899,
+  serialized_end=48357,
 )
 
 _GETTOKENPERPETUALDISTRIBUTIONLASTCLAIMRESPONSE = _descriptor.Descriptor(
@@ -12778,8 +12795,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=47658,
-  serialized_end=48317,
+  serialized_start=47709,
+  serialized_end=48368,
 )
 
 
@@ -12817,8 +12834,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=48448,
-  serialized_end=48511,
+  serialized_start=48499,
+  serialized_end=48562,
 )
 
 _GETTOKENTOTALSUPPLYREQUEST = _descriptor.Descriptor(
@@ -12853,8 +12870,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=48320,
-  serialized_end=48522,
+  serialized_start=48371,
+  serialized_end=48573,
 )
 
 
@@ -12899,8 +12916,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=48943,
-  serialized_end=49063,
+  serialized_start=48994,
+  serialized_end=49114,
 )
 
 _GETTOKENTOTALSUPPLYRESPONSE_GETTOKENTOTALSUPPLYRESPONSEV0 = _descriptor.Descriptor(
@@ -12949,8 +12966,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=48657,
-  serialized_end=49073,
+  serialized_start=48708,
+  serialized_end=49124,
 )
 
 _GETTOKENTOTALSUPPLYRESPONSE = _descriptor.Descriptor(
@@ -12985,8 +13002,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=48525,
-  serialized_end=49084,
+  serialized_start=48576,
+  serialized_end=49135,
 )
 
 
@@ -13031,8 +13048,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=49194,
-  serialized_end=49286,
+  serialized_start=49245,
+  serialized_end=49337,
 )
 
 _GETGROUPINFOREQUEST = _descriptor.Descriptor(
@@ -13067,8 +13084,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=49087,
-  serialized_end=49297,
+  serialized_start=49138,
+  serialized_end=49348,
 )
 
 
@@ -13106,8 +13123,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=49655,
-  serialized_end=49707,
+  serialized_start=49706,
+  serialized_end=49758,
 )
 
 _GETGROUPINFORESPONSE_GETGROUPINFORESPONSEV0_GROUPINFOENTRY = _descriptor.Descriptor(
@@ -13144,8 +13161,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=49710,
-  serialized_end=49862,
+  serialized_start=49761,
+  serialized_end=49913,
 )
 
 _GETGROUPINFORESPONSE_GETGROUPINFORESPONSEV0_GROUPINFO = _descriptor.Descriptor(
@@ -13180,8 +13197,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=49865,
-  serialized_end=50003,
+  serialized_start=49916,
+  serialized_end=50054,
 )
 
 _GETGROUPINFORESPONSE_GETGROUPINFORESPONSEV0 = _descriptor.Descriptor(
@@ -13230,8 +13247,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=49411,
-  serialized_end=50013,
+  serialized_start=49462,
+  serialized_end=50064,
 )
 
 _GETGROUPINFORESPONSE = _descriptor.Descriptor(
@@ -13266,8 +13283,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=49300,
-  serialized_end=50024,
+  serialized_start=49351,
+  serialized_end=50075,
 )
 
 
@@ -13305,8 +13322,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=50137,
-  serialized_end=50254,
+  serialized_start=50188,
+  serialized_end=50305,
 )
 
 _GETGROUPINFOSREQUEST_GETGROUPINFOSREQUESTV0 = _descriptor.Descriptor(
@@ -13367,8 +13384,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=50257,
-  serialized_end=50509,
+  serialized_start=50308,
+  serialized_end=50560,
 )
 
 _GETGROUPINFOSREQUEST = _descriptor.Descriptor(
@@ -13403,8 +13420,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=50027,
-  serialized_end=50520,
+  serialized_start=50078,
+  serialized_end=50571,
 )
 
 
@@ -13442,8 +13459,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=49655,
-  serialized_end=49707,
+  serialized_start=49706,
+  serialized_end=49758,
 )
 
 _GETGROUPINFOSRESPONSE_GETGROUPINFOSRESPONSEV0_GROUPPOSITIONINFOENTRY = _descriptor.Descriptor(
@@ -13487,8 +13504,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=50941,
-  serialized_end=51136,
+  serialized_start=50992,
+  serialized_end=51187,
 )
 
 _GETGROUPINFOSRESPONSE_GETGROUPINFOSRESPONSEV0_GROUPINFOS = _descriptor.Descriptor(
@@ -13518,8 +13535,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=51139,
-  serialized_end=51269,
+  serialized_start=51190,
+  serialized_end=51320,
 )
 
 _GETGROUPINFOSRESPONSE_GETGROUPINFOSRESPONSEV0 = _descriptor.Descriptor(
@@ -13568,8 +13585,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=50637,
-  serialized_end=51279,
+  serialized_start=50688,
+  serialized_end=51330,
 )
 
 _GETGROUPINFOSRESPONSE = _descriptor.Descriptor(
@@ -13604,8 +13621,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=50523,
-  serialized_end=51290,
+  serialized_start=50574,
+  serialized_end=51341,
 )
 
 
@@ -13643,8 +13660,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=51409,
-  serialized_end=51485,
+  serialized_start=51460,
+  serialized_end=51536,
 )
 
 _GETGROUPACTIONSREQUEST_GETGROUPACTIONSREQUESTV0 = _descriptor.Descriptor(
@@ -13719,8 +13736,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=51488,
-  serialized_end=51816,
+  serialized_start=51539,
+  serialized_end=51867,
 )
 
 _GETGROUPACTIONSREQUEST = _descriptor.Descriptor(
@@ -13756,8 +13773,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=51293,
-  serialized_end=51867,
+  serialized_start=51344,
+  serialized_end=51918,
 )
 
 
@@ -13807,8 +13824,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52249,
-  serialized_end=52340,
+  serialized_start=52300,
+  serialized_end=52391,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_BURNEVENT = _descriptor.Descriptor(
@@ -13857,8 +13874,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52342,
-  serialized_end=52433,
+  serialized_start=52393,
+  serialized_end=52484,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_FREEZEEVENT = _descriptor.Descriptor(
@@ -13900,8 +13917,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52435,
-  serialized_end=52509,
+  serialized_start=52486,
+  serialized_end=52560,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_UNFREEZEEVENT = _descriptor.Descriptor(
@@ -13943,8 +13960,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52511,
-  serialized_end=52587,
+  serialized_start=52562,
+  serialized_end=52638,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_DESTROYFROZENFUNDSEVENT = _descriptor.Descriptor(
@@ -13993,8 +14010,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52589,
-  serialized_end=52691,
+  serialized_start=52640,
+  serialized_end=52742,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_SHAREDENCRYPTEDNOTE = _descriptor.Descriptor(
@@ -14038,8 +14055,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=52693,
-  serialized_end=52793,
+  serialized_start=52744,
+  serialized_end=52844,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_PERSONALENCRYPTEDNOTE = _descriptor.Descriptor(
@@ -14083,8 +14100,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=52795,
-  serialized_end=52918,
+  serialized_start=52846,
+  serialized_end=52969,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_EMERGENCYACTIONEVENT = _descriptor.Descriptor(
@@ -14127,8 +14144,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=52921,
-  serialized_end=53154,
+  serialized_start=52972,
+  serialized_end=53205,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_TOKENCONFIGUPDATEEVENT = _descriptor.Descriptor(
@@ -14170,8 +14187,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=53156,
-  serialized_end=53256,
+  serialized_start=53207,
+  serialized_end=53307,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_UPDATEDIRECTPURCHASEPRICEEVENT_PRICEFORQUANTITY = _descriptor.Descriptor(
@@ -14208,8 +14225,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=44110,
-  serialized_end=44161,
+  serialized_start=44161,
+  serialized_end=44212,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_UPDATEDIRECTPURCHASEPRICEEVENT_PRICINGSCHEDULE = _descriptor.Descriptor(
@@ -14239,8 +14256,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=53548,
-  serialized_end=53720,
+  serialized_start=53599,
+  serialized_end=53771,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_UPDATEDIRECTPURCHASEPRICEEVENT = _descriptor.Descriptor(
@@ -14294,8 +14311,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=53259,
-  serialized_end=53745,
+  serialized_start=53310,
+  serialized_end=53796,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_GROUPACTIONEVENT = _descriptor.Descriptor(
@@ -14344,8 +14361,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=53748,
-  serialized_end=54128,
+  serialized_start=53799,
+  serialized_end=54179,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_DOCUMENTEVENT = _descriptor.Descriptor(
@@ -14380,8 +14397,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=54131,
-  serialized_end=54270,
+  serialized_start=54182,
+  serialized_end=54321,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_DOCUMENTCREATEEVENT = _descriptor.Descriptor(
@@ -14411,8 +14428,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=54272,
-  serialized_end=54319,
+  serialized_start=54323,
+  serialized_end=54370,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_CONTRACTUPDATEEVENT = _descriptor.Descriptor(
@@ -14442,8 +14459,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=54321,
-  serialized_end=54368,
+  serialized_start=54372,
+  serialized_end=54419,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_CONTRACTEVENT = _descriptor.Descriptor(
@@ -14478,8 +14495,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=54371,
-  serialized_end=54510,
+  serialized_start=54422,
+  serialized_end=54561,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_TOKENEVENT = _descriptor.Descriptor(
@@ -14563,8 +14580,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=54513,
-  serialized_end=55490,
+  serialized_start=54564,
+  serialized_end=55541,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_GROUPACTIONENTRY = _descriptor.Descriptor(
@@ -14601,8 +14618,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=55493,
-  serialized_end=55640,
+  serialized_start=55544,
+  serialized_end=55691,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0_GROUPACTIONS = _descriptor.Descriptor(
@@ -14632,8 +14649,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=55643,
-  serialized_end=55775,
+  serialized_start=55694,
+  serialized_end=55826,
 )
 
 _GETGROUPACTIONSRESPONSE_GETGROUPACTIONSRESPONSEV0 = _descriptor.Descriptor(
@@ -14682,8 +14699,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=51990,
-  serialized_end=55785,
+  serialized_start=52041,
+  serialized_end=55836,
 )
 
 _GETGROUPACTIONSRESPONSE = _descriptor.Descriptor(
@@ -14718,8 +14735,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=51870,
-  serialized_end=55796,
+  serialized_start=51921,
+  serialized_end=55847,
 )
 
 
@@ -14778,8 +14795,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=55934,
-  serialized_end=56140,
+  serialized_start=55985,
+  serialized_end=56191,
 )
 
 _GETGROUPACTIONSIGNERSREQUEST = _descriptor.Descriptor(
@@ -14815,8 +14832,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=55799,
-  serialized_end=56191,
+  serialized_start=55850,
+  serialized_end=56242,
 )
 
 
@@ -14854,8 +14871,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=56623,
-  serialized_end=56676,
+  serialized_start=56674,
+  serialized_end=56727,
 )
 
 _GETGROUPACTIONSIGNERSRESPONSE_GETGROUPACTIONSIGNERSRESPONSEV0_GROUPACTIONSIGNERS = _descriptor.Descriptor(
@@ -14885,8 +14902,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=56679,
-  serialized_end=56824,
+  serialized_start=56730,
+  serialized_end=56875,
 )
 
 _GETGROUPACTIONSIGNERSRESPONSE_GETGROUPACTIONSIGNERSRESPONSEV0 = _descriptor.Descriptor(
@@ -14935,8 +14952,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=56332,
-  serialized_end=56834,
+  serialized_start=56383,
+  serialized_end=56885,
 )
 
 _GETGROUPACTIONSIGNERSRESPONSE = _descriptor.Descriptor(
@@ -14971,8 +14988,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=56194,
-  serialized_end=56845,
+  serialized_start=56245,
+  serialized_end=56896,
 )
 
 
@@ -15010,8 +15027,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=56961,
-  serialized_end=57018,
+  serialized_start=57012,
+  serialized_end=57069,
 )
 
 _GETADDRESSINFOREQUEST = _descriptor.Descriptor(
@@ -15046,8 +15063,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=56848,
-  serialized_end=57029,
+  serialized_start=56899,
+  serialized_end=57080,
 )
 
 
@@ -15090,8 +15107,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=57032,
-  serialized_end=57165,
+  serialized_start=57083,
+  serialized_end=57216,
 )
 
 
@@ -15129,8 +15146,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=57167,
-  serialized_end=57216,
+  serialized_start=57218,
+  serialized_end=57267,
 )
 
 
@@ -15161,8 +15178,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=57218,
-  serialized_end=57313,
+  serialized_start=57269,
+  serialized_end=57364,
 )
 
 
@@ -15212,8 +15229,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=57315,
-  serialized_end=57424,
+  serialized_start=57366,
+  serialized_end=57475,
 )
 
 
@@ -15251,8 +15268,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=57426,
-  serialized_end=57546,
+  serialized_start=57477,
+  serialized_end=57597,
 )
 
 
@@ -15283,8 +15300,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=57548,
-  serialized_end=57655,
+  serialized_start=57599,
+  serialized_end=57706,
 )
 
 
@@ -15334,8 +15351,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=57775,
-  serialized_end=58000,
+  serialized_start=57826,
+  serialized_end=58051,
 )
 
 _GETADDRESSINFORESPONSE = _descriptor.Descriptor(
@@ -15370,8 +15387,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=57658,
-  serialized_end=58011,
+  serialized_start=57709,
+  serialized_end=58062,
 )
 
 
@@ -15409,8 +15426,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=58136,
-  serialized_end=58198,
+  serialized_start=58187,
+  serialized_end=58249,
 )
 
 _GETADDRESSESINFOSREQUEST = _descriptor.Descriptor(
@@ -15445,8 +15462,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=58014,
-  serialized_end=58209,
+  serialized_start=58065,
+  serialized_end=58260,
 )
 
 
@@ -15496,8 +15513,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=58338,
-  serialized_end=58570,
+  serialized_start=58389,
+  serialized_end=58621,
 )
 
 _GETADDRESSESINFOSRESPONSE = _descriptor.Descriptor(
@@ -15532,8 +15549,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=58212,
-  serialized_end=58581,
+  serialized_start=58263,
+  serialized_end=58632,
 )
 
 
@@ -15557,8 +15574,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=58721,
-  serialized_end=58754,
+  serialized_start=58772,
+  serialized_end=58805,
 )
 
 _GETADDRESSESTRUNKSTATEREQUEST = _descriptor.Descriptor(
@@ -15593,8 +15610,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=58584,
-  serialized_end=58765,
+  serialized_start=58635,
+  serialized_end=58816,
 )
 
 
@@ -15632,8 +15649,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=58909,
-  serialized_end=59055,
+  serialized_start=58960,
+  serialized_end=59106,
 )
 
 _GETADDRESSESTRUNKSTATERESPONSE = _descriptor.Descriptor(
@@ -15668,8 +15685,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=58768,
-  serialized_end=59066,
+  serialized_start=58819,
+  serialized_end=59117,
 )
 
 
@@ -15714,8 +15731,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=59209,
-  serialized_end=59298,
+  serialized_start=59260,
+  serialized_end=59349,
 )
 
 _GETADDRESSESBRANCHSTATEREQUEST = _descriptor.Descriptor(
@@ -15750,8 +15767,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=59069,
-  serialized_end=59309,
+  serialized_start=59120,
+  serialized_end=59360,
 )
 
 
@@ -15782,8 +15799,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=59455,
-  serialized_end=59510,
+  serialized_start=59506,
+  serialized_end=59561,
 )
 
 _GETADDRESSESBRANCHSTATERESPONSE = _descriptor.Descriptor(
@@ -15818,8 +15835,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=59312,
-  serialized_end=59521,
+  serialized_start=59363,
+  serialized_end=59572,
 )
 
 
@@ -15864,8 +15881,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=59685,
-  serialized_end=59799,
+  serialized_start=59736,
+  serialized_end=59850,
 )
 
 _GETRECENTADDRESSBALANCECHANGESREQUEST = _descriptor.Descriptor(
@@ -15900,8 +15917,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=59524,
-  serialized_end=59810,
+  serialized_start=59575,
+  serialized_end=59861,
 )
 
 
@@ -15951,8 +15968,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=59978,
-  serialized_end=60242,
+  serialized_start=60029,
+  serialized_end=60293,
 )
 
 _GETRECENTADDRESSBALANCECHANGESRESPONSE = _descriptor.Descriptor(
@@ -15987,8 +16004,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=59813,
-  serialized_end=60253,
+  serialized_start=59864,
+  serialized_end=60304,
 )
 
 
@@ -16026,8 +16043,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=60255,
-  serialized_end=60326,
+  serialized_start=60306,
+  serialized_end=60377,
 )
 
 
@@ -16077,8 +16094,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=60329,
-  serialized_end=60505,
+  serialized_start=60380,
+  serialized_end=60556,
 )
 
 
@@ -16109,8 +16126,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=60507,
-  serialized_end=60599,
+  serialized_start=60558,
+  serialized_end=60650,
 )
 
 
@@ -16155,8 +16172,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=60602,
-  serialized_end=60776,
+  serialized_start=60653,
+  serialized_end=60827,
 )
 
 
@@ -16187,8 +16204,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=60779,
-  serialized_end=60914,
+  serialized_start=60830,
+  serialized_end=60965,
 )
 
 
@@ -16226,8 +16243,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=61106,
-  serialized_end=61203,
+  serialized_start=61157,
+  serialized_end=61254,
 )
 
 _GETRECENTCOMPACTEDADDRESSBALANCECHANGESREQUEST = _descriptor.Descriptor(
@@ -16262,8 +16279,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=60917,
-  serialized_end=61214,
+  serialized_start=60968,
+  serialized_end=61265,
 )
 
 
@@ -16313,8 +16330,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=61410,
-  serialized_end=61702,
+  serialized_start=61461,
+  serialized_end=61753,
 )
 
 _GETRECENTCOMPACTEDADDRESSBALANCECHANGESRESPONSE = _descriptor.Descriptor(
@@ -16349,8 +16366,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=61217,
-  serialized_end=61713,
+  serialized_start=61268,
+  serialized_end=61764,
 )
 
 
@@ -16395,8 +16412,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=61862,
-  serialized_end=61949,
+  serialized_start=61913,
+  serialized_end=62000,
 )
 
 _GETSHIELDEDENCRYPTEDNOTESREQUEST = _descriptor.Descriptor(
@@ -16431,8 +16448,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=61716,
-  serialized_end=61960,
+  serialized_start=61767,
+  serialized_end=62011,
 )
 
 
@@ -16484,8 +16501,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=62407,
-  serialized_end=62494,
+  serialized_start=62458,
+  serialized_end=62545,
 )
 
 _GETSHIELDEDENCRYPTEDNOTESRESPONSE_GETSHIELDEDENCRYPTEDNOTESRESPONSEV0_ENCRYPTEDNOTES = _descriptor.Descriptor(
@@ -16515,8 +16532,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=62497,
-  serialized_end=62642,
+  serialized_start=62548,
+  serialized_end=62693,
 )
 
 _GETSHIELDEDENCRYPTEDNOTESRESPONSE_GETSHIELDEDENCRYPTEDNOTESRESPONSEV0 = _descriptor.Descriptor(
@@ -16565,8 +16582,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=62113,
-  serialized_end=62652,
+  serialized_start=62164,
+  serialized_end=62703,
 )
 
 _GETSHIELDEDENCRYPTEDNOTESRESPONSE = _descriptor.Descriptor(
@@ -16601,8 +16618,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=61963,
-  serialized_end=62663,
+  serialized_start=62014,
+  serialized_end=62714,
 )
 
 
@@ -16633,8 +16650,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=62791,
-  serialized_end=62835,
+  serialized_start=62842,
+  serialized_end=62886,
 )
 
 _GETSHIELDEDANCHORSREQUEST = _descriptor.Descriptor(
@@ -16669,8 +16686,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=62666,
-  serialized_end=62846,
+  serialized_start=62717,
+  serialized_end=62897,
 )
 
 
@@ -16701,8 +16718,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=63235,
-  serialized_end=63261,
+  serialized_start=63286,
+  serialized_end=63312,
 )
 
 _GETSHIELDEDANCHORSRESPONSE_GETSHIELDEDANCHORSRESPONSEV0 = _descriptor.Descriptor(
@@ -16751,8 +16768,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=62978,
-  serialized_end=63271,
+  serialized_start=63029,
+  serialized_end=63322,
 )
 
 _GETSHIELDEDANCHORSRESPONSE = _descriptor.Descriptor(
@@ -16787,8 +16804,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=62849,
-  serialized_end=63282,
+  serialized_start=62900,
+  serialized_end=63333,
 )
 
 
@@ -16819,8 +16836,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=63437,
-  serialized_end=63490,
+  serialized_start=63488,
+  serialized_end=63541,
 )
 
 _GETMOSTRECENTSHIELDEDANCHORREQUEST = _descriptor.Descriptor(
@@ -16855,8 +16872,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=63285,
-  serialized_end=63501,
+  serialized_start=63336,
+  serialized_end=63552,
 )
 
 
@@ -16906,8 +16923,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=63660,
-  serialized_end=63841,
+  serialized_start=63711,
+  serialized_end=63892,
 )
 
 _GETMOSTRECENTSHIELDEDANCHORRESPONSE = _descriptor.Descriptor(
@@ -16942,8 +16959,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=63504,
-  serialized_end=63852,
+  serialized_start=63555,
+  serialized_end=63903,
 )
 
 
@@ -16974,8 +16991,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=63986,
-  serialized_end=64032,
+  serialized_start=64037,
+  serialized_end=64083,
 )
 
 _GETSHIELDEDPOOLSTATEREQUEST = _descriptor.Descriptor(
@@ -17010,8 +17027,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=63855,
-  serialized_end=64043,
+  serialized_start=63906,
+  serialized_end=64094,
 )
 
 
@@ -17061,8 +17078,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64181,
-  serialized_end=64366,
+  serialized_start=64232,
+  serialized_end=64417,
 )
 
 _GETSHIELDEDPOOLSTATERESPONSE = _descriptor.Descriptor(
@@ -17097,8 +17114,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64046,
-  serialized_end=64377,
+  serialized_start=64097,
+  serialized_end=64428,
 )
 
 
@@ -17129,8 +17146,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=64514,
-  serialized_end=64561,
+  serialized_start=64565,
+  serialized_end=64612,
 )
 
 _GETSHIELDEDNOTESCOUNTREQUEST = _descriptor.Descriptor(
@@ -17165,8 +17182,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64380,
-  serialized_end=64572,
+  serialized_start=64431,
+  serialized_end=64623,
 )
 
 
@@ -17216,8 +17233,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64713,
-  serialized_end=64903,
+  serialized_start=64764,
+  serialized_end=64954,
 )
 
 _GETSHIELDEDNOTESCOUNTRESPONSE = _descriptor.Descriptor(
@@ -17252,8 +17269,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64575,
-  serialized_end=64914,
+  serialized_start=64626,
+  serialized_end=64965,
 )
 
 
@@ -17291,8 +17308,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=65051,
-  serialized_end=65118,
+  serialized_start=65102,
+  serialized_end=65169,
 )
 
 _GETSHIELDEDNULLIFIERSREQUEST = _descriptor.Descriptor(
@@ -17327,8 +17344,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=64917,
-  serialized_end=65129,
+  serialized_start=64968,
+  serialized_end=65180,
 )
 
 
@@ -17366,8 +17383,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=65558,
-  serialized_end=65612,
+  serialized_start=65609,
+  serialized_end=65663,
 )
 
 _GETSHIELDEDNULLIFIERSRESPONSE_GETSHIELDEDNULLIFIERSRESPONSEV0_NULLIFIERSTATUSES = _descriptor.Descriptor(
@@ -17397,8 +17414,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=65615,
-  serialized_end=65757,
+  serialized_start=65666,
+  serialized_end=65808,
 )
 
 _GETSHIELDEDNULLIFIERSRESPONSE_GETSHIELDEDNULLIFIERSRESPONSEV0 = _descriptor.Descriptor(
@@ -17447,8 +17464,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=65270,
-  serialized_end=65767,
+  serialized_start=65321,
+  serialized_end=65818,
 )
 
 _GETSHIELDEDNULLIFIERSRESPONSE = _descriptor.Descriptor(
@@ -17483,8 +17500,8 @@
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=65132,
-  serialized_end=65778,
+  serialized_start=65183,
+  serialized_end=65829,
 )
 
 _GETIDENTITYREQUEST_GETIDENTITYREQUESTV0.containing_type = _GETIDENTITYREQUEST
@@ -17934,6 +17951,9 @@
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.oneofs_by_name['value'].fields.append(
   _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.fields_by_name['avg'])
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.fields_by_name['avg'].containing_oneof = _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.oneofs_by_name['value']
+_GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.oneofs_by_name['_in_key'].fields.append(
+  _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.fields_by_name['in_key'])
+_GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.fields_by_name['in_key'].containing_oneof = _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY.oneofs_by_name['_in_key']
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRIES.fields_by_name['entries'].message_type = _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRY
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRIES.containing_type = _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1
 _GETDOCUMENTSRESPONSE_GETDOCUMENTSRESPONSEV1_RANKEDENTRIES.oneofs_by_name['_skipped'].fields.append(
@@ -22475,8 +22495,8 @@
   index=0,
   serialized_options=None,
   create_key=_descriptor._internal_create_key,
-  serialized_start=65873,
-  serialized_end=74655,
+  serialized_start=65924,
+  serialized_end=74706,
   methods=[
   _descriptor.MethodDescriptor(
     name='broadcastStateTransition',
diff --git a/packages/dapi-grpc/clients/platform/v0/web/platform_pb.d.ts b/packages/dapi-grpc/clients/platform/v0/web/platform_pb.d.ts
index c394bd38fe9..fa2743f5ff4 100644
--- a/packages/dapi-grpc/clients/platform/v0/web/platform_pb.d.ts
+++ b/packages/dapi-grpc/clients/platform/v0/web/platform_pb.d.ts
@@ -2739,6 +2739,7 @@ export namespace GetDocumentsRequest {
     BETWEEN_EXCLUDE_RIGHT: 8;
     IN: 9;
     STARTS_WITH: 10;
+    IN_TIME_RANGE: 11;
   }
 
   export const WhereOperator: WhereOperatorMap;
@@ -3223,6 +3224,13 @@ export namespace GetDocumentsResponse {
       getAvg(): number;
       setAvg(value: number): void;
 
+      hasInKey(): boolean;
+      clearInKey(): void;
+      getInKey(): Uint8Array | string;
+      getInKey_asU8(): Uint8Array;
+      getInKey_asB64(): string;
+      setInKey(value: Uint8Array | string): void;
+
       getValueCase(): RankedEntry.ValueCase;
       serializeBinary(): Uint8Array;
       toObject(includeInstance?: boolean): RankedEntry.AsObject;
@@ -3240,6 +3248,7 @@ export namespace GetDocumentsResponse {
         count: string,
         sum: string,
         avg: number,
+        inKey: Uint8Array | string,
       }
 
       export enum ValueCase {
diff --git a/packages/dapi-grpc/clients/platform/v0/web/platform_pb.js b/packages/dapi-grpc/clients/platform/v0/web/platform_pb.js
index 10f2641e792..fb135455827 100644
--- a/packages/dapi-grpc/clients/platform/v0/web/platform_pb.js
+++ b/packages/dapi-grpc/clients/platform/v0/web/platform_pb.js
@@ -24389,7 +24389,8 @@ proto.org.dash.platform.dapi.v0.GetDocumentsRequest.WhereOperator = {
   BETWEEN_EXCLUDE_LEFT: 7,
   BETWEEN_EXCLUDE_RIGHT: 8,
   IN: 9,
-  STARTS_WITH: 10
+  STARTS_WITH: 10,
+  IN_TIME_RANGE: 11
 };
 
 
@@ -30659,7 +30660,8 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
     key: msg.getKey_asB64(),
     count: jspb.Message.getFieldWithDefault(msg, 2, "0"),
     sum: jspb.Message.getFieldWithDefault(msg, 3, "0"),
-    avg: jspb.Message.getFloatingPointFieldWithDefault(msg, 4, 0.0)
+    avg: jspb.Message.getFloatingPointFieldWithDefault(msg, 4, 0.0),
+    inKey: msg.getInKey_asB64()
   };
 
   if (includeInstance) {
@@ -30712,6 +30714,10 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
       var value = /** @type {number} */ (reader.readDouble());
       msg.setAvg(value);
       break;
+    case 5:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setInKey(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -30769,6 +30775,13 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
       f
     );
   }
+  f = /** @type {!(string|Uint8Array)} */ (jspb.Message.getField(message, 5));
+  if (f != null) {
+    writer.writeBytes(
+      5,
+      f
+    );
+  }
 };
 
 
@@ -30922,6 +30935,66 @@ proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.Rank
 };
 
 
+/**
+ * optional bytes in_key = 5;
+ * @return {string}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 5, ""));
+};
+
+
+/**
+ * optional bytes in_key = 5;
+ * This is a type-conversion wrapper around `getInKey()`
+ * @return {string}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getInKey()));
+};
+
+
+/**
+ * optional bytes in_key = 5;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getInKey()`
+ * @return {!Uint8Array}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.getInKey_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getInKey()));
+};
+
+
+/**
+ * @param {!(string|Uint8Array)} value
+ * @return {!proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry} returns this
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.setInKey = function(value) {
+  return jspb.Message.setField(this, 5, value);
+};
+
+
+/**
+ * Clears the field making it undefined.
+ * @return {!proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry} returns this
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.clearInKey = function() {
+  return jspb.Message.setField(this, 5, undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.org.dash.platform.dapi.v0.GetDocumentsResponse.GetDocumentsResponseV1.RankedEntry.prototype.hasInKey = function() {
+  return jspb.Message.getField(this, 5) != null;
+};
+
+
 
 /**
  * List of repeated fields within this message type.
diff --git a/packages/dapi-grpc/package.json b/packages/dapi-grpc/package.json
index 97b698990e5..c799a802c78 100644
--- a/packages/dapi-grpc/package.json
+++ b/packages/dapi-grpc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/dapi-grpc",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "DAPI GRPC definition file and generated clients",
   "browser": "browser.js",
   "main": "node.js",
diff --git a/packages/dapi-grpc/protos/platform/v0/platform.proto b/packages/dapi-grpc/protos/platform/v0/platform.proto
index 0ad3a197fd0..8ba1b18a812 100644
--- a/packages/dapi-grpc/protos/platform/v0/platform.proto
+++ b/packages/dapi-grpc/protos/platform/v0/platform.proto
@@ -594,6 +594,18 @@ message GetDocumentsRequest {
     BETWEEN_EXCLUDE_RIGHT = 8;
     IN = 9;
     STARTS_WITH = 10;
+    // Time-range bucket selection (v1 only; the v0 CBOR surface is
+    // unaffected). `field` names a timestamp covered by a `timeRange`
+    // index. Operand: `text` selector `"newest"`/`"oldest"` when one grid
+    // buckets the field, or `list` `[selector, range, step(, phase)]` in
+    // the contract's declared seconds to name one of several grids (zero
+    // phase is spelled by omission — one wire spelling per grid). The
+    // server resolves it to a bucket-start equality from current block
+    // time; the verifier re-derives the same bucket from the quorum-signed
+    // metadata time — an ordinary index/count proof. See `timeRange` in
+    // the document meta-schema and
+    // `drive::query::resolve_time_range_bucket_clause`.
+    IN_TIME_RANGE = 11;
   }
 
   // Tagged scalar (or list) operand for a `WhereClause`. The
@@ -893,16 +905,16 @@ message GetDocumentsRequest {
   // - a is the In field AND b is the range field, in that order → existing compound distinct shape; entries carry both `in_key` (= a's value) and `key` (= b's value).
   //
   // `select=<COUNT(*)|SUM(f)|AVG(f)>, group_by=[p], order_by=[<the selected aggregate>]` (protocol v14+) — **ranked mode**:
-  // - exactly one `group_by` property, exactly one `order_by` clause naming the select's aggregate (`f` for `SUM(f)` / `AVG(f)`, the `$count` sentinel for `COUNT(*)`), a `limit` in `1 ..= 100`, an optional `offset`, and no `having` / `start_at`, on an index declaring the matching `rankedCountable` / `rankedSummable` / `rankedAverageable` axis → ranked executor, answered in `ResultData.ranked`. On a single-property ranked index no `where` is accepted; on a compound ranked index every leading index property must be pinned with an `EQUAL` where clause (one per property, `group_by` names the trailing property), selecting which prefix's ranking is read.
+  // - exactly one `group_by` property, exactly one `order_by` clause naming the select's aggregate (`f` for `SUM(f)` / `AVG(f)`, the `$count` sentinel for `COUNT(*)`), a `limit` in `1 ..= 100`, an optional `offset`, and no `having` / `start_at`, on an index declaring the matching `rankedCountable` / `rankedSummable` / `rankedAverageable` axis → ranked executor, answered in `ResultData.ranked`. On a single-property ranked index no `where` is accepted; on a compound ranked index every leading index property must be pinned (one clause per property, `group_by` names the trailing property) — `EQUAL` pins one prefix, and **at most one** clause may be `IN` (2..=10 distinct elements, `null` legal; a single-element `IN` normalizes to the equality pin; an element whose prefix was never written — at any depth of its pinned chain — contributes an empty branch, union semantics), fanning the walk out across one prefix branch per element and merging by `(aggregate, encoded prefix, group key)`; merged entries carry `in_key`. A non-zero `offset` is rejected together with `IN` (rank-skip is per-secondary; `OFFSET 0` is the offset-free request).
   // - `DESC` is the "top n" reading (walk the axis from the largest aggregate down), `ASC` the "bottom n" reading. Worked example: `SELECT AVG(grade) GROUP BY restaurantId ORDER BY grade DESC LIMIT 1 OFFSET 4` is the 5th-best restaurant.
   //
   // `select=<COUNT(*)|SUM(f)|AVG(f)>, group_by=[p], having=[<the selected aggregate> <op> <value>]` (protocol v14+) — **having-range mode**:
-  // - exactly one `group_by` property, exactly one `having` clause whose aggregate is the select's aggregate, an operator describing one contiguous range (`EQUAL`, `GREATER_THAN[_OR_EQUALS]`, `LESS_THAN[_OR_EQUALS]`, `BETWEEN*`; `NOT_EQUAL` / `IN` rejected), a `limit` in `1 ..= 100`, an optional `order_by` naming the same aggregate (walk direction; ascending by default), and no `offset` / `start_at` / `start_after`, on an index declaring the matching ranked axis → having-range executor, answered in `ResultData.ranked`. `where` follows the same rule as ranked mode: none on a single-property ranked index; exactly one `EQUAL` pin per leading index property on a compound ranked index.
+  // - exactly one `group_by` property, exactly one `having` clause whose aggregate is the select's aggregate, an operator describing one contiguous range (`EQUAL`, `GREATER_THAN[_OR_EQUALS]`, `LESS_THAN[_OR_EQUALS]`, `BETWEEN*`; `NOT_EQUAL` / `IN` rejected), a `limit` in `1 ..= 100`, an optional `order_by` naming the same aggregate (walk direction; ascending by default), and no `offset` / `start_at` / `start_after`, on an index declaring the matching ranked axis → having-range executor, answered in `ResultData.ranked`. `where` follows the same rule as ranked mode: none on a single-property ranked index; exactly one pin per leading index property on a compound ranked index, at most one of them an `IN` (2..=10 distinct elements; a never-written element contributes an empty branch) that fans the bound out across prefix branches and merges, entries carrying `in_key`.
   // - no offset or cursor pagination: a page cut at `limit` continues only by tightening the bound past the last *distinct* aggregate value seen; a cut inside a tie (several groups sharing the boundary aggregate) cannot be continued, so size `limit` above the widest expected tie.
   //
   // **Rejected shapes** (return `Unsupported`):
-  // - any non-empty `having` on protocol v13 and earlier; at v14+, any `having` shape outside having-range mode above (multiple clauses, an aggregate other than the select's, `NOT_EQUAL` / `IN`, a `where` shape other than the compound-index equality pins above, or a carried `offset` / cursor).
-  // - at v14+: a ranked-shaped request carrying a `where` shape other than the compound-index equality pins above (a non-`EQUAL` operator, a repeated or non-leading property, or a missing pin), a `start_at` / `start_after` cursor, more than one `order_by`, or an `order_by` naming anything but the selected aggregate.
+  // - any non-empty `having` on protocol v13 and earlier; at v14+, any `having` shape outside having-range mode above (multiple clauses, an aggregate other than the select's, `NOT_EQUAL` / `IN` as the having operator, a `where` shape other than the compound-index prefix pins above — equality pins plus at most one bounded `IN` — or a carried `offset` / cursor).
+  // - at v14+: a ranked-shaped request carrying a `where` shape other than the compound-index prefix pins above (an operator other than `EQUAL` or the one permitted `IN`, more than one `IN`, a `null` pin combined with an `IN`, a repeated or non-leading property, or a missing pin), a `start_at` / `start_after` cursor, more than one `order_by`, or an `order_by` naming anything but the selected aggregate.
   // - `select=DOCUMENTS` with non-empty `group_by`.
   // - `select=COUNT` with `group_by` on a field that is not constrained by an `In` or range where clause.
   // - `select=COUNT` with `group_by.len() > 2`.
@@ -1394,6 +1406,14 @@ message GetDocumentsResponse {
         // than hardcoding the literal.
         double avg = 4;
       }
+      // The prefix branch this entry came from, set **only** on an
+      // `IN`-pinned request (see the supported-shape table): the
+      // encoded index-key bytes of the `IN` property's pinned value —
+      // empty bytes for the `null` (absent-value) branch. Absent on
+      // single-prefix responses. The same group key can legally appear
+      // under two prefixes, so `(in_key, key)` is the entry's identity
+      // on a merged page, exactly as on `CountEntry`.
+      optional bytes in_key = 5;
     }
 
     // Ranked result entries. **Entry order IS the ranking order** —
diff --git a/packages/dapi/package.json b/packages/dapi/package.json
index e6b2889034d..0d8a24d77d7 100644
--- a/packages/dapi/package.json
+++ b/packages/dapi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@dashevo/dapi",
   "private": true,
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "A decentralized API for the Dash network",
   "scripts": {
     "api": "node scripts/api.js",
diff --git a/packages/dash-platform-queries/src/documents/average_proof_helpers.rs b/packages/dash-platform-queries/src/documents/average_proof_helpers.rs
index 5ab4e9bf77a..d0e99c5acf2 100644
--- a/packages/dash-platform-queries/src/documents/average_proof_helpers.rs
+++ b/packages/dash-platform-queries/src/documents/average_proof_helpers.rs
@@ -19,6 +19,7 @@
 //! [`DocumentAverage`]: drive_proof_verifier::DocumentAverage
 //! [`DocumentSplitAverages`]: drive_proof_verifier::DocumentSplitAverages
 
+use crate::documents::document_query::normalize_time_range_clauses_with_metadata_time;
 use crate::documents::document_query::DocumentQuery;
 use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
 use dapi_grpc::platform::VersionedGrpcResponse;
@@ -33,6 +34,7 @@ use drive::query::drive_document_sum_query::index_picker::{
 };
 use drive::query::drive_document_sum_query::mode_detection::detect_sum_mode_from_inputs;
 use drive::query::drive_document_sum_query::{DocumentSumMode, DriveDocumentSumQuery, SumMode};
+use drive::query::validate_and_canonicalize_where_clauses;
 use drive::query::{SelectFunction, WhereOperator};
 use drive_proof_verifier::{
     verify_aggregate_count_and_sum_proof, verify_carrier_aggregate_count_and_sum_proof,
@@ -96,11 +98,43 @@ pub(super) fn assert_select_is_avg(
 ///   that should be unreachable here (`prove = true`); reject as
 ///   `RequestError` if they bubble through.
 pub(super) fn verify_average_query(
-    request: DocumentQuery,
+    mut request: DocumentQuery,
     response: GetDocumentsResponse,
     platform_version: &PlatformVersion,
     provider: &dyn ContextProvider,
 ) -> Result<(Option<Vec<AverageEntry>>, ResponseMetadata, Proof), drive_proof_verifier::Error> {
+    let proof = response
+        .proof()
+        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
+    let mtd = response
+        .metadata()
+        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
+    let contract_id = request.data_contract.id().to_buffer();
+    let sum_property = request.select.field.clone();
+
+    // Resolve any pending time-range (`IN_TIME_RANGE`) selections into
+    // concrete bucket-equality clauses using the quorum-signed metadata
+    // block time — BEFORE mode detection and covering-index selection
+    // below, which read `request.where_clauses`; the prover routed on
+    // the resolved shape.
+    // ...and enforce the same provenance-vs-shape contract the server
+    // dispatchers do, through the one shared normalization helper.
+    let resolved_time_ranges =
+        normalize_time_range_clauses_with_metadata_time(&mut request, mtd.time_ms)?;
+
+    // Canonicalize exactly as the server dispatcher does (the shared step
+    // in `drive::query::canonicalize`): the prover merged `[f > A, f < B]`
+    // pairs into one `between*` clause before its mode detection, so mode
+    // detection here must run over the same canonical shape or a valid
+    // proof is rejected.
+    request.where_clauses = validate_and_canonicalize_where_clauses(
+        std::mem::take(&mut request.where_clauses),
+        platform_version,
+    )
+    .map_err(|e| drive_proof_verifier::Error::RequestError {
+        error: format!("where-clause canonicalization failed: {e}"),
+    })?;
+
     let document_type = request
         .data_contract
         .document_type_for_name(&request.document_type_name)
@@ -110,14 +144,6 @@ pub(super) fn verify_average_query(
                 request.document_type_name, e
             ),
         })?;
-    let proof = response
-        .proof()
-        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
-    let mtd = response
-        .metadata()
-        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
-    let contract_id = request.data_contract.id().to_buffer();
-    let sum_property = request.select.field.clone();
 
     // Resolve the SQL-shape `SumMode` the request implies — AVG
     // shares the routing table with SUM (see module docstring), so
@@ -174,6 +200,7 @@ pub(super) fn verify_average_query(
             document_type.indexes(),
             &request.where_clauses,
             &sum_property,
+            &resolved_time_ranges,
         )
         .filter(|idx| idx.range_countable)
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
@@ -189,6 +216,7 @@ pub(super) fn verify_average_query(
             document_type.indexes(),
             &request.where_clauses,
             &sum_property,
+            &resolved_time_ranges,
         )
         .filter(|idx| idx.countable.is_countable())
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
diff --git a/packages/dash-platform-queries/src/documents/count_proof_helpers.rs b/packages/dash-platform-queries/src/documents/count_proof_helpers.rs
index e19e9074f53..cf060ecff31 100644
--- a/packages/dash-platform-queries/src/documents/count_proof_helpers.rs
+++ b/packages/dash-platform-queries/src/documents/count_proof_helpers.rs
@@ -13,6 +13,7 @@
 //! [`DocumentCount`]: drive_proof_verifier::DocumentCount
 //! [`DocumentSplitCounts`]: drive_proof_verifier::DocumentSplitCounts
 
+use crate::documents::document_query::normalize_time_range_clauses_with_metadata_time;
 use crate::documents::document_query::DocumentQuery;
 use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
 use dapi_grpc::platform::VersionedGrpcResponse;
@@ -22,6 +23,7 @@ use dpp::{
     data_contract::accessors::v0::DataContractV0Getters,
     data_contract::document_type::accessors::{DocumentTypeV0Getters, DocumentTypeV2Getters},
 };
+use drive::query::validate_and_canonicalize_where_clauses;
 use drive::query::{
     CountMode, DocumentCountMode, DriveDocumentCountQuery, SelectFunction, WhereOperator,
 };
@@ -138,11 +140,41 @@ fn limit_to_u16_or_default(limit: u32) -> Result<u16, drive_proof_verifier::Erro
 /// [`DocumentCount`]: drive_proof_verifier::DocumentCount
 /// [`DocumentSplitCounts`]: drive_proof_verifier::DocumentSplitCounts
 pub(super) fn verify_count_query(
-    request: DocumentQuery,
+    mut request: DocumentQuery,
     response: GetDocumentsResponse,
     platform_version: &PlatformVersion,
     provider: &dyn ContextProvider,
 ) -> Result<(Option<Vec<SplitCountEntry>>, ResponseMetadata, Proof), drive_proof_verifier::Error> {
+    let proof = response
+        .proof()
+        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
+    let mtd = response
+        .metadata()
+        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
+
+    // Resolve any pending time-range (`IN_TIME_RANGE`) selections into
+    // concrete bucket-equality clauses using the quorum-signed metadata
+    // block time — BEFORE mode detection and covering-index selection
+    // below, which read `request.where_clauses`; the prover routed on
+    // the resolved shape.
+    // ...and enforce the same provenance-vs-shape contract the server
+    // dispatchers do, through the one shared normalization helper.
+    let resolved_time_ranges =
+        normalize_time_range_clauses_with_metadata_time(&mut request, mtd.time_ms)?;
+
+    // Canonicalize exactly as the server dispatcher does (the shared step
+    // in `drive::query::canonicalize`): the prover merged `[f > A, f < B]`
+    // pairs into one `between*` clause before its mode detection, so mode
+    // detection here must run over the same canonical shape or a valid
+    // proof is rejected.
+    request.where_clauses = validate_and_canonicalize_where_clauses(
+        std::mem::take(&mut request.where_clauses),
+        platform_version,
+    )
+    .map_err(|e| drive_proof_verifier::Error::RequestError {
+        error: format!("where-clause canonicalization failed: {e}"),
+    })?;
+
     let document_type = request
         .data_contract
         .document_type_for_name(&request.document_type_name)
@@ -152,12 +184,6 @@ pub(super) fn verify_count_query(
                 request.document_type_name, e
             ),
         })?;
-    let proof = response
-        .proof()
-        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
-    let mtd = response
-        .metadata()
-        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
 
     // Resolve the SQL-shape `CountMode` the request implies. Same
     // decision tree as `validate_and_route` in the abci handler —
@@ -224,6 +250,7 @@ pub(super) fn verify_count_query(
         DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             document_type.indexes(),
             &request.where_clauses,
+            &resolved_time_ranges,
         )
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
             error: "range count requires a `range_countable: true` index whose last \
@@ -234,6 +261,7 @@ pub(super) fn verify_count_query(
         DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             &request.where_clauses,
+            &resolved_time_ranges,
         )
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
             error: "prove count requires a `countable: true` index whose properties \
@@ -406,3 +434,301 @@ fn single_empty_key_entry(count: u64) -> Vec<SplitCountEntry> {
         count: Some(count),
     }]
 }
+
+#[cfg(test)]
+mod tests {
+    //! Offline tests for the client half of a time-range
+    //! (`IN_TIME_RANGE`) query: where the bucket comes from, what
+    //! provenance the resolution hands back, and how the count
+    //! surface behaves when a response cannot be verified. Nothing
+    //! here touches a proof — this crate builds drive with `verify`
+    //! only, so no Drive exists to prove against. The prove→verify
+    //! round trips (overlapping-window counts, a tampered signed
+    //! time, the documents route) live in rs-drive-abci's
+    //! `time_range_proof_verification`, where a populated platform
+    //! does.
+    //!
+    //! The property under test throughout is that the bucket is a
+    //! function of the **quorum-signed** metadata time and of the
+    //! contract's declared window, and of nothing else the client
+    //! could pick: a client-local clock would let a node answer with
+    //! whatever bucket it liked and still verify.
+
+    use super::*;
+    use crate::documents::document_query::resolve_time_range_clauses_with_metadata_time;
+    use dapi_grpc::platform::v0::get_documents_response::get_documents_response_v1::{
+        count_results, result_data, CountResults, ResultData,
+    };
+    use dapi_grpc::platform::v0::get_documents_response::{
+        get_documents_response_v1, GetDocumentsResponseV1, Version as ResponseVersion,
+    };
+    use dash_context_provider::ContextProviderError;
+    use dpp::data_contract::{DataContractFactory, TokenConfiguration};
+    use dpp::platform_value::platform_value;
+    use dpp::prelude::{CoreBlockHeight, DataContract, Identifier};
+    use drive::query::{SelectProjection, TimeRangeSelector, WhereClause};
+    use std::sync::Arc;
+
+    const DOCUMENT_TYPE: &str = "post";
+    const CREATED_AT: &str = "$createdAt";
+    const BUCKETED_INDEX: &str = "trending";
+    /// Six-hour windows sliding every two hours — overlap factor 3, the
+    /// shape a trending leaderboard actually declares.
+    const RANGE_SECONDS: u64 = 6 * 3_600;
+    const STEP_SECONDS: u64 = 2 * 3_600;
+    const STEP_MS: u64 = STEP_SECONDS * 1_000;
+    /// An exact multiple of the two-hour step, so on the `phase: 0` grid it
+    /// is itself a bucket start.
+    const BUCKET_START_MS: u64 = 1_755_000_000_000;
+    /// A one-hour phase — strictly less than the step, as validation
+    /// requires — for the epoch-sliver refusal test.
+    const PHASE_SECONDS: u64 = 3_600;
+    const PHASE_MS: u64 = PHASE_SECONDS * 1_000;
+
+    fn platform_version() -> &'static PlatformVersion {
+        PlatformVersion::latest()
+    }
+
+    /// Never consulted by these tests — every one of them fails (or is
+    /// asserted) before a proof reaches the tenderdash binding. It exists
+    /// because [`verify_count_query`] takes a provider by reference.
+    struct UnusedProvider;
+
+    impl ContextProvider for UnusedProvider {
+        fn get_data_contract(
+            &self,
+            _id: &Identifier,
+            _platform_version: &PlatformVersion,
+        ) -> Result<Option<Arc<DataContract>>, ContextProviderError> {
+            Ok(None)
+        }
+
+        fn get_token_configuration(
+            &self,
+            _token_id: &Identifier,
+        ) -> Result<Option<TokenConfiguration>, ContextProviderError> {
+            Ok(None)
+        }
+
+        fn get_quorum_public_key(
+            &self,
+            _quorum_type: u32,
+            _quorum_hash: [u8; 32],
+            _core_chain_locked_height: u32,
+        ) -> Result<[u8; 48], ContextProviderError> {
+            Ok([0u8; 48])
+        }
+
+        fn get_platform_activation_height(&self) -> Result<CoreBlockHeight, ContextProviderError> {
+            Ok(1)
+        }
+    }
+
+    /// A contract whose `post` doctype carries a `countable` bucketed index
+    /// over `(timeRange($createdAt), hashtag)`. `phase_seconds` is a
+    /// parameter because the epoch-sliver refusal is one of the behaviours
+    /// under test.
+    fn trending_contract(phase_seconds: u64) -> Arc<DataContract> {
+        let schemas = platform_value!({
+            "post": {
+                "type": "object",
+                "properties": {
+                    "hashtag": { "type": "string", "maxLength": 63, "position": 0 },
+                },
+                "indices": [
+                    {
+                        "name": "trending",
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "countable": true,
+                        "timeRange": {
+                            "on": "$createdAt",
+                            "range": RANGE_SECONDS,
+                            "step": STEP_SECONDS,
+                            "phase": phase_seconds,
+                        },
+                    },
+                ],
+                "required": ["$createdAt", "hashtag"],
+                "additionalProperties": false,
+            }
+        });
+        let contract = DataContractFactory::new(platform_version().protocol_version)
+            .expect("expected a factory")
+            .create_with_value_config(Identifier::new([7u8; 32]), 0, schemas, None, None)
+            .expect("the trending contract is well-formed")
+            .data_contract_owned();
+        Arc::new(contract)
+    }
+
+    /// The bucket start the contract's own transform puts `time_ms` in —
+    /// the expectation is derived from the declared window rather than
+    /// restated as a literal, so a fixture edit cannot leave it behind.
+    fn expected_bucket(contract: &DataContract, time_ms: u64) -> u64 {
+        contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists")
+            .indexes()
+            .get(BUCKETED_INDEX)
+            .expect("the bucketed index survives contract creation")
+            .time_range
+            .as_ref()
+            .expect("the bucketed index carries its transform")
+            .newest_active_start(time_ms)
+            .expect("the metadata time is inside an active range")
+    }
+
+    fn newest_bucket_query(contract: Arc<DataContract>) -> DocumentQuery {
+        DocumentQuery::new(contract, DOCUMENT_TYPE)
+            .expect("the fixture has this document type")
+            .with_time_range(CREATED_AT, TimeRangeSelector::Newest)
+    }
+
+    fn resolved_equality(request: &DocumentQuery) -> &WhereClause {
+        let matching: Vec<_> = request
+            .where_clauses
+            .iter()
+            .filter(|clause| clause.field == CREATED_AT)
+            .collect();
+        assert_eq!(
+            matching.len(),
+            1,
+            "resolution must push exactly one clause on the bucketed field"
+        );
+        matching[0]
+    }
+
+    /// The whole contract of the resolution step: the pending selector is
+    /// consumed, an ordinary equality on the bucketed field appears in its
+    /// place, and the field name comes back as provenance — which is the
+    /// only thing that will later keep index selection on the bucketed
+    /// index, since the pushed clause is indistinguishable from a
+    /// hand-written raw-timestamp lookup.
+    #[test]
+    fn the_newest_selector_resolves_to_the_bucket_containing_the_metadata_time() {
+        let contract = trending_contract(0);
+        let mut request = newest_bucket_query(Arc::clone(&contract));
+        let metadata_time_ms = BUCKET_START_MS + 3_600_000;
+
+        let resolutions =
+            resolve_time_range_clauses_with_metadata_time(&mut request, metadata_time_ms)
+                .expect("a metadata time inside an active range resolves");
+
+        assert_eq!(resolutions.len(), 1);
+        assert_eq!(resolutions[0].field(), CREATED_AT);
+        assert_eq!(
+            resolutions[0].transform.range_seconds, RANGE_SECONDS,
+            "the provenance must carry the exact grid the resolution used"
+        );
+        assert_eq!(resolutions[0].transform.step_seconds, STEP_SECONDS);
+        assert!(
+            request.time_range_clauses.is_empty(),
+            "the pending selector must be drained, not left to be encoded twice"
+        );
+        let clause = resolved_equality(&request);
+        assert_eq!(clause.operator, WhereOperator::Equal);
+        assert_eq!(
+            clause.value,
+            dpp::platform_value::Value::U64(expected_bucket(&contract, metadata_time_ms))
+        );
+        assert_eq!(
+            clause.value,
+            dpp::platform_value::Value::U64(BUCKET_START_MS),
+            "one hour past a bucket start is still inside that bucket"
+        );
+    }
+
+    /// The same query against a metadata time one full step later resolves
+    /// one bucket later — pinning that the bucket is derived from the signed
+    /// time rather than from anything the client holds. If the resolution
+    /// ever started reading a local clock this assertion is what breaks.
+    #[test]
+    fn a_metadata_time_one_step_later_resolves_to_the_next_bucket() {
+        let contract = trending_contract(0);
+        let earlier_time_ms = BUCKET_START_MS + 3_600_000;
+
+        let mut earlier = newest_bucket_query(Arc::clone(&contract));
+        resolve_time_range_clauses_with_metadata_time(&mut earlier, earlier_time_ms)
+            .expect("a metadata time inside an active range resolves");
+
+        let mut later = newest_bucket_query(Arc::clone(&contract));
+        resolve_time_range_clauses_with_metadata_time(&mut later, earlier_time_ms + STEP_MS)
+            .expect("a metadata time inside an active range resolves");
+
+        let earlier_bucket = resolved_equality(&earlier)
+            .value
+            .to_integer::<u64>()
+            .expect("a bucket start is a millisecond timestamp");
+        let later_bucket = resolved_equality(&later)
+            .value
+            .to_integer::<u64>()
+            .expect("a bucket start is a millisecond timestamp");
+        assert_eq!(
+            later_bucket,
+            earlier_bucket + STEP_MS,
+            "one step of signed time must move the resolution exactly one bucket"
+        );
+    }
+
+    /// A metadata time inside the epoch sliver before the grid's phase
+    /// anchor belongs to no range at all. No real block time reaches it, but
+    /// the client must refuse rather than invent a bucket, mirroring the
+    /// server, which refuses the same request at resolution time — so the
+    /// two sides cannot disagree about whether the query was answerable.
+    #[test]
+    fn a_metadata_time_in_the_epoch_sliver_refuses_to_resolve() {
+        let contract = trending_contract(PHASE_SECONDS);
+        let mut request = newest_bucket_query(contract);
+
+        let error = resolve_time_range_clauses_with_metadata_time(&mut request, PHASE_MS - 1)
+            .expect_err("a time predating every range has no honest bucket");
+
+        match error {
+            drive_proof_verifier::Error::RequestError { error } => assert!(
+                error.contains("phase"),
+                "expected the epoch-sliver refusal, got: {error}"
+            ),
+            other => panic!("expected a request error, got: {other:?}"),
+        }
+    }
+
+    /// A node that answers a `prove = true` time-range count with data
+    /// instead of a proof must be rejected as an unproven response, not
+    /// mistaken for a query the client failed to reconstruct: the proof
+    /// check is the first gate in [`verify_count_query`], ahead of the
+    /// time-range resolution and the provenance-shape guard. Callers
+    /// therefore get `NoProofInResult` — "this node did not prove it" —
+    /// rather than a resolution error that would send them looking at their
+    /// own query.
+    #[test]
+    fn a_count_response_carrying_no_proof_is_rejected_as_unproven() {
+        let contract = trending_contract(0);
+        let request = newest_bucket_query(contract)
+            .with_select(SelectProjection::count_star())
+            .with_where(WhereClause {
+                field: "hashtag".to_string(),
+                operator: WhereOperator::Equal,
+                value: dpp::platform_value::Value::Text("ibiza".to_string()),
+            });
+
+        let response = GetDocumentsResponse {
+            version: Some(ResponseVersion::V1(GetDocumentsResponseV1 {
+                result: Some(get_documents_response_v1::Result::Data(ResultData {
+                    variant: Some(result_data::Variant::Counts(CountResults {
+                        variant: Some(count_results::Variant::AggregateCount(2)),
+                    })),
+                })),
+                metadata: Some(ResponseMetadata {
+                    time_ms: BUCKET_START_MS + 3_600_000,
+                    ..Default::default()
+                }),
+            })),
+        };
+
+        let error = verify_count_query(request, response, platform_version(), &UnusedProvider)
+            .expect_err("an unproven response must not be accepted");
+        assert!(
+            matches!(error, drive_proof_verifier::Error::NoProofInResult),
+            "expected NoProofInResult, got: {error:?}"
+        );
+    }
+}
diff --git a/packages/dash-platform-queries/src/documents/document_having_entries.rs b/packages/dash-platform-queries/src/documents/document_having_entries.rs
index 33b4997895f..e4d88a9f335 100644
--- a/packages/dash-platform-queries/src/documents/document_having_entries.rs
+++ b/packages/dash-platform-queries/src/documents/document_having_entries.rs
@@ -22,10 +22,16 @@
 //! a contiguous-range operator (`=`, `>`, `>=`, `<`, `<=`, `BETWEEN*` —
 //! `!=` and `IN` are rejected), and a `LIMIT`. `ORDER BY` is optional:
 //! omitted means ascending by the aggregate; naming the selected
-//! aggregate sets the direction. `where` clauses are equality pins on a
-//! covering compound ranked index's leading properties (one per leading
+//! aggregate sets the direction. `where` clauses are pins on a covering
+//! compound ranked index's leading properties (one per leading
 //! property, selecting which prefix's groups the bound reads) — absent
-//! for a single-property index. No `offset`, no `start_at`.
+//! for a single-property index. Each pin is an equality, except that
+//! **at most one** may be an `IN` of 2..=10 distinct elements: the
+//! bound fans out across one prefix branch per element and merges,
+//! entries carrying the encoded branch segment in `in_key` (unset on
+//! single-branch responses; a single-element `IN` normalizes to the
+//! equality pin; a `null` pin on another property cannot combine with
+//! the `IN`). No `offset`, no `start_at`.
 //!
 //! ## Contract prerequisites
 //!
@@ -33,7 +39,8 @@
 //! `rankedCountable` / `rankedSummable` / `rankedAverageable`
 //! (meta-schema v3, **protocol version 14+**). The index may be
 //! single-property (`group_by` its property, no `where`) or compound
-//! (`group_by` its trailing property, equality-pin every leading one).
+//! (`group_by` its trailing property, pin every leading one — equality
+//! pins, at most one of them an `IN`).
 //! Against a pre-v14 node the request is refused with "HAVING clause
 //! is not yet implemented" — the intended activation gate.
 //!
@@ -306,8 +313,9 @@ mod tests {
 
     /// HAVING limits are a hard inclusive range, `1..=100`: `0` (the
     /// unset sentinel) and anything above `MAX_HAVING_LIMIT` are
-    /// rejected client side rather than clamped, because the limit is
-    /// echoed in the proof envelope and re-checked by the verifier.
+    /// rejected client side rather than clamped, because the limit
+    /// bounds the coverage the verifier's rebuilt `PathQuery` demands
+    /// of the proof.
     #[test]
     fn limit_is_required_and_capped_client_side() {
         for limit in [0u32, 101] {
diff --git a/packages/dash-platform-queries/src/documents/document_query.rs b/packages/dash-platform-queries/src/documents/document_query.rs
index d7c7bf95908..cd710ddf40e 100644
--- a/packages/dash-platform-queries/src/documents/document_query.rs
+++ b/packages/dash-platform-queries/src/documents/document_query.rs
@@ -33,14 +33,33 @@ use dpp::{
 use drive::config::DEFAULT_QUERY_LIMIT;
 use drive::query::drive_document_ranked_query::mode_detection::ranked_order_key;
 use drive::query::{
+    resolve_time_range_bucket_clause, validate_resolved_time_range_clause_shapes,
     DriveDocumentQuery, HavingAggregate, HavingAggregateFunction, HavingClause, HavingOperator,
-    HavingRightOperand, InternalClauses, OrderClause, SelectFunction, SelectProjection,
-    WhereClause, WhereOperator,
+    HavingRightOperand, InternalClauses, OrderClause, ResolvedTimeRange, SelectFunction,
+    SelectProjection, TimeRangeGridSpec, TimeRangeSelector, WhereClause, WhereOperator,
 };
 use drive_proof_verifier::{types::Documents, FromProof};
 
 // TODO: remove DocumentQuery once ContextProvider that provides data contracts is merged.
 
+/// One pending `IN_TIME_RANGE` selection: the timestamp field, the
+/// `"newest"` / `"oldest"` selector, and — when the contract buckets the
+/// field with more than one `timeRange` grid — the grid it targets (`None`
+/// means the field's sole grid, and the server rejects the bare form on a
+/// multi-grid field as ambiguous).
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[cfg_attr(feature = "mocks", derive(serde::Serialize, serde::Deserialize))]
+pub struct TimeRangeClause {
+    /// The bucketed timestamp field the selection is on.
+    pub field: String,
+    /// Which active window to resolve to.
+    pub selector: TimeRangeSelector,
+    /// The grid targeted, in the contract's declared seconds; `None` when
+    /// the field carries a single grid.
+    #[cfg_attr(feature = "mocks", serde(default))]
+    pub grid: Option<TimeRangeGridSpec>,
+}
+
 /// Request that is used to query documents from the Dash Platform.
 ///
 /// This is an abstraction layer built on top of [GetDocumentsRequest] to address issues with missing details
@@ -74,6 +93,15 @@ pub struct DocumentQuery {
     pub document_type_name: String,
     /// `where` clauses for the query
     pub where_clauses: Vec<WhereClause>,
+    /// Time-range (`IN_TIME_RANGE`) selections on a timestamp field covered
+    /// by a `timeRange` index. These are emitted as `IN_TIME_RANGE` clauses
+    /// on the v1 wire and resolved server-side from the current block time;
+    /// the verifier re-derives the same bucket from the quorum-signed
+    /// response metadata time. v1-only (the v0 wire has no `IN_TIME_RANGE`
+    /// operator). See [`Self::with_time_range`] and
+    /// [`Self::with_time_range_grid`].
+    #[cfg_attr(feature = "mocks", serde(default))]
+    pub time_range_clauses: Vec<TimeRangeClause>,
     /// SQL `GROUP BY` field names, in left-to-right order. Empty =
     /// no explicit grouping (aggregate count for `select=Count`).
     /// Only meaningful when `select=Count`; non-empty with
@@ -175,6 +203,7 @@ impl DocumentQuery {
             data_contract: Arc::clone(&contract),
             document_type_name: document_type_name.to_string(),
             where_clauses: vec![],
+            time_range_clauses: vec![],
             group_by: Vec::new(),
             having: Vec::new(),
             order_by_clauses: vec![],
@@ -185,8 +214,14 @@ impl DocumentQuery {
     }
 
     /// Create new document query based on a [DriveDocumentQuery].
-    pub fn new_with_drive_query(d: &DriveDocumentQuery) -> Self {
-        Self::from(d)
+    ///
+    /// Fails when the drive query carries time-range resolution provenance
+    /// (`resolved_time_ranges`): the resolved bucket equality cannot be
+    /// represented without it — see the `TryFrom` impl. Build the query
+    /// with [`Self::with_time_range`] / [`Self::with_time_range_grid`]
+    /// instead for time-range selections.
+    pub fn new_with_drive_query(d: &DriveDocumentQuery) -> Result<Self, crate::error::Error> {
+        Self::try_from(d)
     }
 
     /// Point to a specific document ID.
@@ -209,6 +244,53 @@ impl DocumentQuery {
         self
     }
 
+    /// Restrict the query to a single time-range bucket of `field`
+    /// (a timestamp covered by a `timeRange` index), selecting either the
+    /// [`TimeRangeSelector::Newest`] or [`TimeRangeSelector::Oldest`] currently
+    /// active range. Emitted as an `IN_TIME_RANGE` clause on the v1 wire and
+    /// resolved server-side from the current block time; the proof verifier
+    /// re-derives the identical bucket from the quorum-signed response
+    /// metadata time. Requires protocol version 14+ — the first version
+    /// whose contract grammar hosts `timeRange` indexes.
+    ///
+    /// The bare selector is unambiguous only while exactly one grid buckets
+    /// `field`; when the contract declares several grids over it, use
+    /// [`Self::with_time_range_grid`] to name one.
+    ///
+    /// Existing time-range selections are preserved.
+    pub fn with_time_range(
+        mut self,
+        field: impl Into<String>,
+        selector: TimeRangeSelector,
+    ) -> Self {
+        self.time_range_clauses.push(TimeRangeClause {
+            field: field.into(),
+            selector,
+            grid: None,
+        });
+        self
+    }
+
+    /// [`Self::with_time_range`] naming a specific grid — required when the
+    /// contract buckets `field` with more than one `timeRange` grid. The
+    /// spec's `range` / `step` / `phase` are the contract's own declared
+    /// seconds, verbatim.
+    ///
+    /// Existing time-range selections are preserved.
+    pub fn with_time_range_grid(
+        mut self,
+        field: impl Into<String>,
+        selector: TimeRangeSelector,
+        grid: TimeRangeGridSpec,
+    ) -> Self {
+        self.time_range_clauses.push(TimeRangeClause {
+            field: field.into(),
+            selector,
+            grid: Some(grid),
+        });
+        self
+    }
+
     /// Add order by clause to the query.
     ///
     /// Existing order by clauses will be preserved.
@@ -444,13 +526,43 @@ impl FromProof<DocumentQuery> for drive_proof_verifier::types::Documents {
     where
         Self: Sized + 'a,
     {
-        let request: Self::Request = request.into();
-        let drive_query: DriveDocumentQuery =
+        let mut request: Self::Request = request.into();
+        let response: Self::Response = response.into();
+
+        // A time-range (`IN_TIME_RANGE`) selection is resolved to a concrete
+        // bucket using the **quorum-signed** response metadata time — the same
+        // authoritative block time the server used to resolve it — so the
+        // reconstructed query matches the proof exactly. Resolve (and run the
+        // provenance-vs-shape guard, via the one shared normalization helper
+        // the aggregate verifiers also use) before the `DriveDocumentQuery`
+        // conversion so the engine sees ordinary equality clauses.
+        let mut resolved_time_ranges = Vec::new();
+        if !request.time_range_clauses.is_empty() {
+            // The generated `VersionedGrpcResponse::metadata()` handles both
+            // response envelopes (and any future one), so no hand-written
+            // version match is needed here.
+            use dapi_grpc::platform::VersionedGrpcResponse;
+            let time_ms = response
+                .metadata()
+                .map(|metadata| metadata.time_ms)
+                .map_err(|_| drive_proof_verifier::Error::ResponseDecodeError {
+                    error: "time range query proof response is missing block-time metadata"
+                        .to_string(),
+                })?;
+            resolved_time_ranges =
+                normalize_time_range_clauses_with_metadata_time(&mut request, time_ms)?;
+        }
+
+        let mut drive_query: DriveDocumentQuery =
             (&request)
                 .try_into()
                 .map_err(|e| drive_proof_verifier::Error::RequestError {
                     error: format!("Failed to convert DocumentQuery to DriveQuery: {}", e),
                 })?;
+        // The conversion cannot recover which equalities came from resolution,
+        // so the provenance is carried across here; index selection reads it
+        // to pin the query to the index that buckets the field.
+        drive_query.resolved_time_ranges = resolved_time_ranges;
 
         <drive_proof_verifier::types::Documents as FromProof<DriveDocumentQuery>>::maybe_from_proof_with_metadata(
             drive_query,
@@ -462,6 +574,81 @@ impl FromProof<DocumentQuery> for drive_proof_verifier::types::Documents {
     }
 }
 
+/// Resolve a request's pending time-range (`IN_TIME_RANGE`) selections into
+/// concrete bucket-equality clauses on `request.where_clauses`, using the
+/// **quorum-signed** response metadata block time — the same authoritative
+/// time the server used — so the reconstructed query matches the proof
+/// exactly.
+///
+/// Every proof-verification path that rebuilds a drive query from a
+/// [`DocumentQuery`] must call this (or perform the identical resolution)
+/// *before* reading `request.where_clauses` for mode detection, covering-index
+/// selection, or query reconstruction: the documents path does it inline in
+/// its `FromProof` impl, and the count / sum / average aggregate helpers call
+/// this before resolving their mode. Skipping it would rebuild the query from
+/// a different shape than the prover used.
+///
+/// Returns the resolution provenance — one [`ResolvedTimeRange`] (field +
+/// exact grid) per selection, whose pushed clause is a bucket equality
+/// rather than a raw-timestamp one. Callers must carry them into index
+/// selection (`DriveDocumentQuery::resolved_time_ranges`, or the
+/// `resolved_time_ranges` argument of the aggregate index pickers):
+/// the pushed clause is an ordinary equality and nothing downstream can
+/// otherwise tell that it must be matched against the resolved grid's
+/// bucket starts.
+/// [`resolve_time_range_clauses_with_metadata_time`] followed immediately by
+/// the provenance-vs-shape guard — the two-step normalization every
+/// proof-verification path must run, in this order, before mode detection,
+/// covering-index selection, or query reconstruction. One definition so a
+/// future verifier path cannot omit either step or run them out of order:
+/// the aggregate paths once omitted the resolution entirely (valid proofs
+/// were rejected), and a path that resolved without the guard would let a
+/// caller-provided `In`/range clause on the resolved field reach the index
+/// pickers as if its raw values were bucket starts.
+pub(super) fn normalize_time_range_clauses_with_metadata_time(
+    request: &mut DocumentQuery,
+    time_ms: u64,
+) -> Result<Vec<ResolvedTimeRange>, drive_proof_verifier::Error> {
+    let resolved_time_ranges = resolve_time_range_clauses_with_metadata_time(request, time_ms)?;
+    validate_resolved_time_range_clause_shapes(&request.where_clauses, &resolved_time_ranges)
+        .map_err(|e| drive_proof_verifier::Error::RequestError {
+            error: format!("invalid time range query shape: {}", e),
+        })?;
+    Ok(resolved_time_ranges)
+}
+
+pub(super) fn resolve_time_range_clauses_with_metadata_time(
+    request: &mut DocumentQuery,
+    time_ms: u64,
+) -> Result<Vec<ResolvedTimeRange>, drive_proof_verifier::Error> {
+    if request.time_range_clauses.is_empty() {
+        return Ok(Vec::new());
+    }
+    let data_contract = Arc::clone(&request.data_contract);
+    let document_type = data_contract
+        .document_type_for_name(&request.document_type_name)
+        .map_err(|e| drive_proof_verifier::Error::RequestError {
+            error: format!("document type not found for time range query: {}", e),
+        })?;
+    let time_range_clauses = std::mem::take(&mut request.time_range_clauses);
+    let mut resolved_time_ranges = Vec::with_capacity(time_range_clauses.len());
+    for TimeRangeClause {
+        field,
+        selector,
+        grid,
+    } in time_range_clauses
+    {
+        let (clause, resolved) =
+            resolve_time_range_bucket_clause(&field, selector, grid, document_type, time_ms)
+                .map_err(|e| drive_proof_verifier::Error::RequestError {
+                    error: format!("failed to resolve time range clause: {}", e),
+                })?;
+        request.where_clauses.push(clause);
+        resolved_time_ranges.push(resolved);
+    }
+    Ok(resolved_time_ranges)
+}
+
 /// Version-aware encoder. The dispatch is driven by the
 /// `drive_abci.query.document_query` feature-version on
 /// [`PlatformVersion`]: `0` → V0 wire (used by v3.0 testnet), `1` →
@@ -470,7 +657,8 @@ impl FromProof<DocumentQuery> for drive_proof_verifier::types::Documents {
 /// V0 lacks `selects` / `group_by` / `having` / `offset` and the
 /// optional-limit semantics — callers that set those features get
 /// `Error::Config` with a clear "requires Platform v3.1+" message
-/// rather than a silently-truncated request.
+/// rather than a silently-truncated request. Time-range clauses are
+/// additionally gated on the v14 contract grammar — see the `1 =>` arm.
 impl TryFromPlatformVersioned<DocumentQuery> for GetDocumentsRequest {
     type Error = Error;
 
@@ -483,6 +671,7 @@ impl TryFromPlatformVersioned<DocumentQuery> for GetDocumentsRequest {
             data_contract,
             document_type_name,
             where_clauses,
+            time_range_clauses,
             group_by,
             having,
             order_by_clauses,
@@ -505,30 +694,63 @@ impl TryFromPlatformVersioned<DocumentQuery> for GetDocumentsRequest {
         );
 
         match feature_version {
-            0 => encode_v0(
-                data_contract.id().to_vec(),
-                document_type_name,
-                where_clauses,
-                order_by_clauses,
-                limit,
-                offset,
-                start,
-                &select,
-                &group_by,
-                &having,
-            ),
-            1 => encode_v1(
-                data_contract.id().to_vec(),
-                document_type_name,
-                where_clauses,
-                order_by_clauses,
-                limit,
-                offset,
-                start,
-                select,
-                group_by,
-                having,
-            ),
+            0 => {
+                if !time_range_clauses.is_empty() {
+                    return Err(Error::Config(
+                        "time range (IN_TIME_RANGE) queries require protocol version 14+; the \
+                         v0 getDocuments wire has no time-range operator"
+                            .to_string(),
+                    ));
+                }
+                encode_v0(
+                    data_contract.id().to_vec(),
+                    document_type_name,
+                    where_clauses,
+                    order_by_clauses,
+                    limit,
+                    offset,
+                    start,
+                    &select,
+                    &group_by,
+                    &having,
+                )
+            }
+            1 => {
+                // The v1 wire predates time-range indexes: protocol
+                // versions 12 and 13 also serve it, but their contract
+                // grammar (document meta-schema generations 1 and 2)
+                // cannot host a `timeRange` index. Gate on the grammar
+                // generation — the same table the server's parser reads —
+                // rather than emitting an operator a pre-v14 server
+                // rejects as an unknown discriminant.
+                let grammar_generation = platform_version
+                    .dpp
+                    .contract_versions
+                    .document_type_versions
+                    .schema
+                    .document_type_schema;
+                if !time_range_clauses.is_empty() && grammar_generation < 3 {
+                    return Err(Error::Config(format!(
+                        "time range (IN_TIME_RANGE) queries require protocol version 14+ — the \
+                         first version whose contract grammar hosts `timeRange` indexes; this \
+                         network runs protocol version {}",
+                        platform_version.protocol_version
+                    )));
+                }
+                encode_v1(
+                    data_contract.id().to_vec(),
+                    document_type_name,
+                    where_clauses,
+                    time_range_clauses,
+                    order_by_clauses,
+                    limit,
+                    offset,
+                    start,
+                    select,
+                    group_by,
+                    having,
+                )
+            }
             n => Err(Error::Config(format!(
                 "GetDocumentsRequest wire encoder does not support feature_version={n} \
                  (drive_abci.query.document_query) on PlatformVersion v{}",
@@ -543,6 +765,7 @@ fn encode_v1(
     data_contract_id: Vec<u8>,
     document_type: String,
     where_clauses: Vec<WhereClause>,
+    time_range_clauses: Vec<TimeRangeClause>,
     order_by_clauses: Vec<OrderClause>,
     limit: u32,
     offset: Option<u32>,
@@ -551,10 +774,57 @@ fn encode_v1(
     group_by: Vec<String>,
     having: Vec<HavingClause>,
 ) -> Result<GetDocumentsRequest, Error> {
-    let where_clauses = where_clauses
+    let mut where_clauses = where_clauses
         .into_iter()
         .map(where_clause_to_proto)
         .collect::<Result<Vec<_>, _>>()?;
+    // Append time-range selections as `IN_TIME_RANGE` clauses. A grid-less
+    // selection rides as the bare `"newest"`/`"oldest"` text operand; a
+    // grid-targeted one as the list operand `[selector, range, step]` /
+    // `[selector, range, step, phase]` in the contract's declared seconds
+    // (zero phase spelled by omission — one wire spelling per grid, the
+    // same rule the contract grammar and the storage key follow). The
+    // server resolves them to a concrete bucket from current block time;
+    // the verifier re-derives the same bucket from the signed response
+    // metadata time.
+    for TimeRangeClause {
+        field,
+        selector,
+        grid,
+    } in time_range_clauses
+    {
+        let selector_value = ProtoDocumentFieldValue {
+            variant: Some(document_field_value::Variant::Text(
+                selector.as_str().to_string(),
+            )),
+        };
+        let operand = match grid {
+            None => selector_value,
+            Some(spec) => {
+                let uint = |n: u64| ProtoDocumentFieldValue {
+                    variant: Some(document_field_value::Variant::Uint64Value(n)),
+                };
+                let mut values = vec![
+                    selector_value,
+                    uint(spec.range_seconds),
+                    uint(spec.step_seconds),
+                ];
+                if spec.phase_seconds != 0 {
+                    values.push(uint(spec.phase_seconds));
+                }
+                ProtoDocumentFieldValue {
+                    variant: Some(document_field_value::Variant::List(
+                        document_field_value::ValueList { values },
+                    )),
+                }
+            }
+        };
+        where_clauses.push(ProtoWhereClause {
+            field,
+            operator: ProtoWhereOperator::InTimeRange as i32,
+            value: Some(operand),
+        });
+    }
     let order_by = order_by_clauses
         .into_iter()
         .map(order_clause_to_proto)
@@ -704,8 +974,28 @@ fn encode_v0(
     })
 }
 
-impl<'a> From<&'a DriveDocumentQuery<'a>> for DocumentQuery {
-    fn from(value: &'a DriveDocumentQuery<'a>) -> Self {
+impl<'a> TryFrom<&'a DriveDocumentQuery<'a>> for DocumentQuery {
+    type Error = crate::error::Error;
+
+    /// Fallible by necessity: a drive query carrying `resolved_time_ranges`
+    /// holds bucket-start equalities whose meaning lives in the provenance,
+    /// and `DocumentQuery` has no field to carry it — the original
+    /// `IN_TIME_RANGE` selector cannot be reconstructed from the resolved
+    /// query. Serializing such a query would silently demote the bucket
+    /// equality to a raw-timestamp predicate: a transformed-index-only
+    /// contract then rejects the request, while a contract with a competing
+    /// plain index returns a different — but validly proven — result.
+    fn try_from(value: &'a DriveDocumentQuery<'a>) -> Result<Self, Self::Error> {
+        if !value.resolved_time_ranges.is_empty() {
+            return Err(Error::Config(
+                "a drive query carrying time-range resolution provenance cannot be \
+                 converted to a DocumentQuery: the resolved bucket equality would be \
+                 demoted to a raw-timestamp predicate. Build the DocumentQuery with \
+                 `with_time_range` / `with_time_range_grid` instead, so the selector \
+                 is resolved against the signed response metadata"
+                    .to_string(),
+            ));
+        }
         let data_contract = value.contract.clone();
         let document_type_name = value.document_type.name();
         let where_clauses = value.internal_clauses.clone().into();
@@ -722,57 +1012,32 @@ impl<'a> From<&'a DriveDocumentQuery<'a>> for DocumentQuery {
             None
         };
 
-        Self {
-            // `DriveDocumentQuery` has no SELECT/GROUP BY/HAVING
+        Ok(Self {
+            // `DriveDocumentQuery` has no SELECT/GROUP BY/HAVING/time-range
             // concept — it's a documents-only query. Default to the
             // v1 documents shape.
             select: SelectProjection::documents(),
             data_contract: Arc::new(data_contract),
             document_type_name: document_type_name.to_string(),
             where_clauses,
+            time_range_clauses: Vec::new(),
             group_by: Vec::new(),
             having: Vec::new(),
             order_by_clauses,
             limit,
             offset,
             start,
-        }
+        })
     }
 }
 
-impl<'a> From<DriveDocumentQuery<'a>> for DocumentQuery {
-    fn from(value: DriveDocumentQuery<'a>) -> Self {
-        let data_contract = value.contract.clone();
-        let document_type_name = value.document_type.name();
-        let where_clauses = value.internal_clauses.clone().into();
-        let order_by_clauses = value.order_by.iter().map(|(_, v)| v.clone()).collect();
-        let limit = value.limit.unwrap_or(0) as u32;
-        let offset = value.offset.map(u32::from);
-
-        let start = if let Some(start_at) = value.start_at {
-            match value.start_at_included {
-                true => Some(Start::StartAt(start_at.to_vec())),
-                false => Some(Start::StartAfter(start_at.to_vec())),
-            }
-        } else {
-            None
-        };
+impl<'a> TryFrom<DriveDocumentQuery<'a>> for DocumentQuery {
+    type Error = crate::error::Error;
 
-        Self {
-            // `DriveDocumentQuery` has no SELECT/GROUP BY/HAVING
-            // concept — it's a documents-only query. Default to the
-            // v1 documents shape.
-            select: SelectProjection::documents(),
-            data_contract: Arc::new(data_contract),
-            document_type_name: document_type_name.to_string(),
-            where_clauses,
-            group_by: Vec::new(),
-            having: Vec::new(),
-            order_by_clauses,
-            limit,
-            offset,
-            start,
-        }
+    /// By-value twin of the by-reference conversion above — same
+    /// provenance rejection, same rationale.
+    fn try_from(value: DriveDocumentQuery<'a>) -> Result<Self, Self::Error> {
+        DocumentQuery::try_from(&value)
     }
 }
 
@@ -780,6 +1045,22 @@ impl<'a> TryFrom<&'a DocumentQuery> for DriveDocumentQuery<'a> {
     type Error = crate::error::Error;
 
     fn try_from(request: &'a DocumentQuery) -> Result<Self, Self::Error> {
+        // A pending (unresolved) time-range selection MUST be resolved into a
+        // concrete bucket-equality clause before a drive query can be built —
+        // see `resolve_time_range_clauses_with_metadata_time`. Silently
+        // dropping it here would rebuild (and verify against) a strictly
+        // broader query than the prover ran, so refuse instead: this makes
+        // "forgot to resolve" a loud error on every present and future call
+        // path rather than a silent verification hole.
+        if !request.time_range_clauses.is_empty() {
+            return Err(Error::Config(
+                "the query's time range (IN_TIME_RANGE) selections have not been resolved into \
+                 bucket equalities; resolve them against the response's quorum-signed metadata \
+                 time before building a drive query"
+                    .to_string(),
+            ));
+        }
+
         // let data_contract = request.data_contract.clone();
         let document_type = request
             .data_contract
@@ -872,6 +1153,12 @@ impl<'a> TryFrom<&'a DocumentQuery> for DriveDocumentQuery<'a> {
             start_at,
             start_at_included,
             block_time_ms: None,
+            // A `DocumentQuery` reaching here carries no unresolved
+            // time-range selection (rejected above) and cannot tell which of
+            // its equalities came from resolution. Callers that resolved
+            // selections assign the fields they resolved onto the returned
+            // query; everything else is a raw query.
+            resolved_time_ranges: vec![],
         };
 
         Ok(query)
@@ -1100,3 +1387,95 @@ fn value_to_proto_at_depth(value: Value, depth: u8) -> Result<ProtoDocumentField
         variant: Some(variant),
     })
 }
+
+#[cfg(test)]
+mod encode_version_gate_tests {
+    //! The `IN_TIME_RANGE` operator is emitted only for protocol versions
+    //! whose contract grammar hosts `timeRange` indexes (document
+    //! meta-schema generation 3, first pinned by protocol version 14).
+    //! Protocol versions 12 and 13 serve the same v1 getDocuments wire but
+    //! predate the grammar — encoding for them must refuse up front
+    //! instead of sending an operator the server rejects as an unknown
+    //! discriminant.
+
+    use super::*;
+    use dpp::data_contract::DataContractFactory;
+    use dpp::platform_value::platform_value;
+    use dpp::prelude::{DataContract, Identifier};
+    use drive::query::TimeRangeSelector;
+
+    fn post_contract() -> Arc<DataContract> {
+        let schemas = platform_value!({
+            "post": {
+                "type": "object",
+                "properties": {
+                    "hashtag": { "type": "string", "maxLength": 63, "position": 0 },
+                },
+                "required": ["hashtag"],
+                "additionalProperties": false,
+            }
+        });
+        let contract = DataContractFactory::new(PlatformVersion::latest().protocol_version)
+            .expect("expected a factory")
+            .create_with_value_config(Identifier::new([7u8; 32]), 0, schemas, None, None)
+            .expect("the post contract is well-formed")
+            .data_contract_owned();
+        Arc::new(contract)
+    }
+
+    fn newest_time_range_query() -> DocumentQuery {
+        DocumentQuery::new(post_contract(), "post")
+            .expect("the fixture has this document type")
+            .with_time_range("$createdAt", TimeRangeSelector::Newest)
+    }
+
+    #[test]
+    fn a_time_range_query_refuses_to_encode_for_protocol_version_13() {
+        let platform_version = PlatformVersion::get(13).expect("protocol version 13 exists");
+        let error = GetDocumentsRequest::try_from_platform_versioned(
+            newest_time_range_query(),
+            platform_version,
+        )
+        .expect_err("protocol version 13's contract grammar has no timeRange indexes");
+        let message = match error {
+            Error::Config(message) => message,
+            other => panic!("expected Error::Config, got {other:?}"),
+        };
+        assert!(
+            message.contains("protocol version 14"),
+            "the refusal must name the real version floor, got: {message}"
+        );
+    }
+
+    #[test]
+    fn a_time_range_query_encodes_the_operator_for_protocol_version_14() {
+        let platform_version = PlatformVersion::get(14).expect("protocol version 14 exists");
+        let request = GetDocumentsRequest::try_from_platform_versioned(
+            newest_time_range_query(),
+            platform_version,
+        )
+        .expect("protocol version 14 hosts timeRange indexes");
+        let Some(V1(v1)) = request.version else {
+            panic!("protocol version 14 encodes on the v1 wire");
+        };
+        let operators: Vec<i32> = v1
+            .where_clauses
+            .iter()
+            .map(|clause| clause.operator)
+            .collect();
+        assert_eq!(
+            operators,
+            vec![ProtoWhereOperator::InTimeRange as i32],
+            "the pending selector must ride as exactly one IN_TIME_RANGE clause"
+        );
+    }
+
+    #[test]
+    fn a_query_without_time_range_clauses_still_encodes_for_protocol_version_13() {
+        let platform_version = PlatformVersion::get(13).expect("protocol version 13 exists");
+        let query = DocumentQuery::new(post_contract(), "post")
+            .expect("the fixture has this document type");
+        GetDocumentsRequest::try_from_platform_versioned(query, platform_version)
+            .expect("the gate only refuses queries that carry a time-range selection");
+    }
+}
diff --git a/packages/dash-platform-queries/src/documents/document_ranked_entries.rs b/packages/dash-platform-queries/src/documents/document_ranked_entries.rs
index 1f351f2c4b9..1b382da45f9 100644
--- a/packages/dash-platform-queries/src/documents/document_ranked_entries.rs
+++ b/packages/dash-platform-queries/src/documents/document_ranked_entries.rs
@@ -18,13 +18,19 @@
 //!
 //! Exactly one aggregate `select`, exactly one `group_by` property,
 //! exactly one `ORDER BY` clause naming that select's aggregate, and a
-//! `LIMIT` — plus an optional `OFFSET`. `where` clauses are equality
-//! pins on a covering compound ranked index's leading properties (one
-//! per leading property, selecting which prefix's own ranking the walk
-//! reads) — absent for a single-property index. No `having`, no
-//! `start_at`: each of those is rejected rather than ignored, on both
-//! sides, because a ranked walk cannot honour them and silently
-//! answering a different question is worse than an error.
+//! `LIMIT` — plus an optional `OFFSET`. `where` clauses are pins on a
+//! covering compound ranked index's leading properties (one per leading
+//! property, selecting which prefix's own ranking the walk reads) —
+//! absent for a single-property index. Each pin is an equality, except
+//! that **at most one** may be an `IN` of 2..=10 distinct elements: one
+//! walk per element, merged by `(aggregate, encoded pin, group key)`,
+//! with each merged entry carrying the encoded branch segment in
+//! `in_key` (unset on single-branch responses; a single-element `IN`
+//! normalizes to the equality pin). A non-zero `OFFSET` cannot combine
+//! with the `IN`, nor can a `null` pin on another property. No
+//! `having`, no `start_at`: each of those is rejected rather than
+//! ignored, on both sides, because a ranked walk cannot honour them and
+//! silently answering a different question is worse than an error.
 //!
 //! [`DocumentQuery::order_by_selected_aggregate`] builds the ordering
 //! clause, deriving the ordered field from the `select` through
@@ -37,8 +43,9 @@
 //! The index must opt in with `rankedCountable` / `rankedSummable` /
 //! `rankedAverageable` (meta-schema v3, **protocol version 14+**). The
 //! index may be single-property (`group_by` its property, no `where`)
-//! or compound (`group_by` its trailing property, equality-pin every
-//! leading one). Against a protocol-version-13
+//! or compound (`group_by` its trailing property, pin every leading one
+//! — equality pins, at most one of them an `IN`, as above). Against a
+//! protocol-version-13
 //! node the request is refused — v13's query table has no ranked path
 //! and rejects the ordering as `Unsupported`. That is the intended
 //! activation gate, not a bug: a v13 node and a v14 node must disagree
@@ -494,9 +501,9 @@ mod tests {
     }
 
     /// The ranking's `n` rides `limit`, and an out-of-range one is
-    /// rejected rather than clamped: `k` is echoed inside the proof
-    /// envelope and re-checked by the verifier, so a silent clamp would
-    /// produce a proof the client's own reconstruction rejects.
+    /// rejected rather than clamped: `k` is part of the traversal the
+    /// client rebuilds to verify, so a silent clamp would produce a
+    /// page the client's reconstruction did not ask for.
     #[test]
     fn assert_ranked_shape_rejects_an_out_of_range_limit() {
         // `0` is `DocumentQuery`'s "unset" sentinel, and a ranking with
diff --git a/packages/dash-platform-queries/src/documents/having_proof_helpers.rs b/packages/dash-platform-queries/src/documents/having_proof_helpers.rs
index c751e30ca09..8d1ee4c0b0a 100644
--- a/packages/dash-platform-queries/src/documents/having_proof_helpers.rs
+++ b/packages/dash-platform-queries/src/documents/having_proof_helpers.rs
@@ -16,6 +16,7 @@
 //!
 //! [`DocumentHavingEntries`]: drive_proof_verifier::DocumentHavingEntries
 
+use crate::documents::document_query::normalize_time_range_clauses_with_metadata_time;
 use crate::documents::document_query::DocumentQuery;
 use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
 use dapi_grpc::platform::VersionedGrpcResponse;
@@ -71,8 +72,10 @@ pub(super) fn assert_having_shape(
              `.with_having(<one clause bounding the selected aggregate with a range \
              operator>)` and `.with_limit(n)`, optionally \
              `.order_by_selected_aggregate(<direction>)`, with no offset and no start_at; \
-             where clauses, when present, must be equality pins on the covering compound \
-             index's leading properties."
+             where clauses, when present, pin the covering compound index's leading \
+             properties — one equality pin per property, of which at most one may instead \
+             be an `IN` of 2..=10 elements (merged entries then carry `in_key`; a null pin \
+             on another property is rejected with `IN`)."
         ),
     })
 }
@@ -88,11 +91,41 @@ pub(super) fn assert_having_shape(
 /// quorum-signed app hash happens inside [`verify_having_range_proof`]
 /// and cannot be skipped through this helper.
 pub(super) fn verify_having_query(
-    request: DocumentQuery,
+    mut request: DocumentQuery,
     response: GetDocumentsResponse,
     platform_version: &PlatformVersion,
     provider: &dyn ContextProvider,
 ) -> Result<(Option<Vec<RankedEntry>>, ResponseMetadata, Proof), drive_proof_verifier::Error> {
+    let proof = response
+        .proof()
+        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
+    let mtd = response
+        .metadata()
+        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
+
+    // Resolve any pending time-range selection through the shared
+    // normalization helper, then reject the request outright if anything
+    // resolved — mirroring the server-side rejection in drive's
+    // `execute_document_having_request`. HAVING accepts equality prefixes
+    // on compound ranked indexes (which exclude transformed indexes), so a
+    // resolved bucket-start equality would pin a *plain* ranked index on
+    // the same timestamp field, and a malicious node could return a valid
+    // proof over raw-timestamp matches at the bucket boundary instead of
+    // the requested window. Without this guard the verifier would
+    // authenticate a request shape honest servers refuse.
+    let resolved_time_ranges =
+        normalize_time_range_clauses_with_metadata_time(&mut request, mtd.time_ms)?;
+    if !resolved_time_ranges.is_empty() {
+        return Err(drive_proof_verifier::Error::RequestError {
+            error: "a HAVING query cannot carry a time-range (IN_TIME_RANGE) selection: its \
+                    equality prefixes pin plain ranked indexes, so a resolved bucket-start \
+                    equality would authenticate raw-timestamp matches at the bucket boundary \
+                    instead of window membership — the server rejects this request and the \
+                    verifier must not authenticate a proof for it"
+                .to_string(),
+        });
+    }
+
     let document_type = request
         .data_contract
         .document_type_for_name(&request.document_type_name)
@@ -102,12 +135,6 @@ pub(super) fn verify_having_query(
                 request.document_type_name, e
             ),
         })?;
-    let proof = response
-        .proof()
-        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
-    let mtd = response
-        .metadata()
-        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
 
     let mode = assert_having_shape(&request, platform_version)?;
 
@@ -128,7 +155,8 @@ pub(super) fn verify_having_query(
             "document type `{}` cannot serve this having-range query: {e}. Ranked indexes \
              are opt-in contract grammar (meta-schema v3, protocol version 14+); a pinned \
              (compound-index) bound additionally needs every leading index property pinned \
-             by an equality where clause.",
+             by a where clause — equality pins, of which at most one may be an `IN` of \
+             2..=10 elements.",
             request.document_type_name,
         ),
     })?;
diff --git a/packages/dash-platform-queries/src/documents/ranked_proof_helpers.rs b/packages/dash-platform-queries/src/documents/ranked_proof_helpers.rs
index f442842fb4c..754c0f4c50a 100644
--- a/packages/dash-platform-queries/src/documents/ranked_proof_helpers.rs
+++ b/packages/dash-platform-queries/src/documents/ranked_proof_helpers.rs
@@ -12,13 +12,14 @@
 //! `(axis, k, descending, offset)` tuple by construction rather than by
 //! two copies of a grammar agreeing.
 //!
-//! Unlike the count helper there is no per-shape dispatch: the ranked
-//! surface has exactly one proof primitive
-//! (`prove_indexed_axis_top_k_paginated`), and all of a request's
-//! variation is carried *inside* the query struct.
+//! Unlike the count helper there is no per-shape dispatch: every
+//! ranked request proves as one `RankedPage` axis traversal through
+//! grovedb's unified `prove_query`, and all of a request's variation is
+//! carried *inside* the query struct.
 //!
 //! [`DocumentRankedEntries`]: drive_proof_verifier::DocumentRankedEntries
 
+use crate::documents::document_query::normalize_time_range_clauses_with_metadata_time;
 use crate::documents::document_query::DocumentQuery;
 use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
 use dapi_grpc::platform::VersionedGrpcResponse;
@@ -88,8 +89,10 @@ pub(super) fn assert_ranked_shape(
              `.with_select(<COUNT(*)|SUM(f)|AVG(f)>)`, `.with_group_by(<property>)`, \
              `.order_by_selected_aggregate(<Descending|Ascending>)` and `.with_limit(n)`, \
              optionally `.with_offset(m)`, with no having and no start_at; where clauses, \
-             when present, must be equality pins on the covering compound index's leading \
-             properties."
+             when present, pin the covering compound index's leading properties — one \
+             equality pin per property, of which at most one may instead be an `IN` of \
+             2..=10 elements (merged entries then carry `in_key`; a non-zero offset and a \
+             null pin on another property are rejected with `IN`)."
         ),
     })
 }
@@ -116,11 +119,43 @@ pub(super) fn assert_ranked_shape(
 /// metadata before returning. There is no path through this helper
 /// that yields entries without that check having run.
 pub(super) fn verify_ranked_query(
-    request: DocumentQuery,
+    mut request: DocumentQuery,
     response: GetDocumentsResponse,
     platform_version: &PlatformVersion,
     provider: &dyn ContextProvider,
 ) -> Result<(Option<RankedPage>, ResponseMetadata, Proof), drive_proof_verifier::Error> {
+    let proof = response
+        .proof()
+        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
+    let mtd = response
+        .metadata()
+        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
+
+    // Resolve any pending time-range (`IN_TIME_RANGE`) selections through
+    // the shared normalization helper, then reject the request outright if
+    // anything resolved — mirroring the server, whose
+    // `execute_document_ranked_request` refuses non-empty provenance. The
+    // rejection is load-bearing, not a shape formality: ranked mode accepts
+    // equality pins on compound ranked indexes, and the ranked picker
+    // excludes transformed indexes, so a resolved bucket-start equality
+    // would pin a *plain* ranked index on the same timestamp field. A
+    // malicious node could then return a valid proof over that subtree —
+    // documents whose raw timestamp equals the bucket boundary, not the
+    // requested window — and without this guard the verifier would
+    // authenticate it even though an honest server rejects the request.
+    let resolved_time_ranges =
+        normalize_time_range_clauses_with_metadata_time(&mut request, mtd.time_ms)?;
+    if !resolved_time_ranges.is_empty() {
+        return Err(drive_proof_verifier::Error::RequestError {
+            error: "a ranked query cannot carry a time-range (IN_TIME_RANGE) selection: \
+                    ranking groups by an index's own property, a document belongs to every \
+                    bucket containing its timestamp, and the resolved bucket-start equality \
+                    could only pin a plain index over raw timestamps — the server rejects \
+                    this request and the verifier must not authenticate a proof for it"
+                .to_string(),
+        });
+    }
+
     let document_type = request
         .data_contract
         .document_type_for_name(&request.document_type_name)
@@ -130,12 +165,6 @@ pub(super) fn verify_ranked_query(
                 request.document_type_name, e
             ),
         })?;
-    let proof = response
-        .proof()
-        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
-    let mtd = response
-        .metadata()
-        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
 
     let mode = assert_ranked_shape(&request, platform_version)?;
 
@@ -159,7 +188,8 @@ pub(super) fn verify_ranked_query(
             "document type `{}` cannot serve this ranked query: {e}. Ranked indexes are \
              opt-in contract grammar (meta-schema v3, protocol version 14+); a pinned \
              (compound-index) ranking additionally needs every leading index property \
-             pinned by an equality where clause.",
+             pinned by a where clause — equality pins, of which at most one may be an \
+             `IN` of 2..=10 elements.",
             request.document_type_name,
         ),
     })?;
diff --git a/packages/dash-platform-queries/src/documents/sum_proof_helpers.rs b/packages/dash-platform-queries/src/documents/sum_proof_helpers.rs
index fadfd00cfd8..a91d8d83b93 100644
--- a/packages/dash-platform-queries/src/documents/sum_proof_helpers.rs
+++ b/packages/dash-platform-queries/src/documents/sum_proof_helpers.rs
@@ -19,6 +19,7 @@
 //! [`DocumentSum`]: drive_proof_verifier::DocumentSum
 //! [`DocumentSplitSums`]: drive_proof_verifier::DocumentSplitSums
 
+use crate::documents::document_query::normalize_time_range_clauses_with_metadata_time;
 use crate::documents::document_query::DocumentQuery;
 use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
 use dapi_grpc::platform::VersionedGrpcResponse;
@@ -33,6 +34,7 @@ use drive::query::drive_document_sum_query::index_picker::{
 };
 use drive::query::drive_document_sum_query::mode_detection::detect_sum_mode_from_inputs;
 use drive::query::drive_document_sum_query::{DocumentSumMode, DriveDocumentSumQuery, SumMode};
+use drive::query::validate_and_canonicalize_where_clauses;
 use drive::query::{SelectFunction, WhereOperator};
 use drive_proof_verifier::{
     verify_aggregate_sum_proof, verify_carrier_aggregate_sum_proof, verify_distinct_sum_proof,
@@ -89,11 +91,43 @@ pub(super) fn assert_select_is_sum(
 ///   that should be unreachable here (`prove = true`); reject as
 ///   `RequestError` if they bubble through.
 pub(super) fn verify_sum_query(
-    request: DocumentQuery,
+    mut request: DocumentQuery,
     response: GetDocumentsResponse,
     platform_version: &PlatformVersion,
     provider: &dyn ContextProvider,
 ) -> Result<(Option<Vec<SumEntry>>, ResponseMetadata, Proof), drive_proof_verifier::Error> {
+    let proof = response
+        .proof()
+        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
+    let mtd = response
+        .metadata()
+        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
+    let contract_id = request.data_contract.id().to_buffer();
+    let sum_property = request.select.field.clone();
+
+    // Resolve any pending time-range (`IN_TIME_RANGE`) selections into
+    // concrete bucket-equality clauses using the quorum-signed metadata
+    // block time — BEFORE mode detection and covering-index selection
+    // below, which read `request.where_clauses`; the prover routed on
+    // the resolved shape.
+    // ...and enforce the same provenance-vs-shape contract the server
+    // dispatchers do, through the one shared normalization helper.
+    let resolved_time_ranges =
+        normalize_time_range_clauses_with_metadata_time(&mut request, mtd.time_ms)?;
+
+    // Canonicalize exactly as the server dispatcher does (the shared step
+    // in `drive::query::canonicalize`): the prover merged `[f > A, f < B]`
+    // pairs into one `between*` clause before its mode detection, so mode
+    // detection here must run over the same canonical shape or a valid
+    // proof is rejected.
+    request.where_clauses = validate_and_canonicalize_where_clauses(
+        std::mem::take(&mut request.where_clauses),
+        platform_version,
+    )
+    .map_err(|e| drive_proof_verifier::Error::RequestError {
+        error: format!("where-clause canonicalization failed: {e}"),
+    })?;
+
     let document_type = request
         .data_contract
         .document_type_for_name(&request.document_type_name)
@@ -103,14 +137,6 @@ pub(super) fn verify_sum_query(
                 request.document_type_name, e
             ),
         })?;
-    let proof = response
-        .proof()
-        .or(Err(drive_proof_verifier::Error::NoProofInResult))?;
-    let mtd = response
-        .metadata()
-        .or(Err(drive_proof_verifier::Error::EmptyResponseMetadata))?;
-    let contract_id = request.data_contract.id().to_buffer();
-    let sum_property = request.select.field.clone();
 
     // Resolve the SQL-shape `SumMode` the request implies. Same
     // decision tree as `validate_and_route` in the abci handler —
@@ -171,6 +197,7 @@ pub(super) fn verify_sum_query(
             document_type.indexes(),
             &request.where_clauses,
             &sum_property,
+            &resolved_time_ranges,
         )
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
             error: "prove range SUM requires a `rangeSummable: true` index whose last \
@@ -183,6 +210,7 @@ pub(super) fn verify_sum_query(
             document_type.indexes(),
             &request.where_clauses,
             &sum_property,
+            &resolved_time_ranges,
         )
         .ok_or_else(|| drive_proof_verifier::Error::RequestError {
             error: "prove SUM requires a `summable: \"<prop>\"` index whose properties \
diff --git a/packages/dash-spv/package.json b/packages/dash-spv/package.json
index a695d0c671f..7bd40b12dc8 100644
--- a/packages/dash-spv/package.json
+++ b/packages/dash-spv/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/dash-spv",
-  "version": "5.2.0-dev.1",
+  "version": "5.2.0-dev.2",
   "description": "Repository containing SPV functions used by @dashevo",
   "main": "index.js",
   "scripts": {
diff --git a/packages/dashmate/package.json b/packages/dashmate/package.json
index 9601d8b899c..a7569ba3b5f 100644
--- a/packages/dashmate/package.json
+++ b/packages/dashmate/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dashmate",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Distribution package for Dash node installation",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js b/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
index daf60c9ba9a..4d4cda32172 100644
--- a/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
+++ b/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
@@ -160,7 +160,12 @@ describe('scheduleRenewZeroSslCertificateFactory', () => {
       expect(onConfigurationChanged).to.have.been.calledOnceWith(config);
       expect(obtainZeroSSLCertificateTask).to.not.have.been.called();
 
-      await clock.tickAsync(64 * 24 * 60 * 60 * 1000);
+      // The handoff must leave nothing armed for ZeroSSL, so running every
+      // remaining timer proves the old renewal can never fire. Ticking a blanket
+      // 64 days here instead would replay ~92k config-refresh firings (one real
+      // event-loop hop each) whenever a poll timer survives, blowing the test
+      // timeout on a slow runner rather than failing on the assertion below.
+      await clock.runAllAsync();
 
       expect(onConfigurationChanged).to.have.been.calledOnce();
       expect(obtainZeroSSLCertificateTask).to.not.have.been.called();
diff --git a/packages/dashpay-contract/package.json b/packages/dashpay-contract/package.json
index 6a00455ded9..91a8d177c4f 100644
--- a/packages/dashpay-contract/package.json
+++ b/packages/dashpay-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/dashpay-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Reference contract of the DashPay DPA on Dash Evolution",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/document-history-contract/package.json b/packages/document-history-contract/package.json
index 832e843a68f..3ce75a97f57 100644
--- a/packages/document-history-contract/package.json
+++ b/packages/document-history-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/document-history-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "The document history contract",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/dpns-contract/package.json b/packages/dpns-contract/package.json
index dd0f382af3e..50233d910a2 100644
--- a/packages/dpns-contract/package.json
+++ b/packages/dpns-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/dpns-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "A contract and helper scripts for DPNS DApp",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/js-dapi-client/package.json b/packages/js-dapi-client/package.json
index e0eee688ebf..d70882105f8 100644
--- a/packages/js-dapi-client/package.json
+++ b/packages/js-dapi-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/dapi-client",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Client library used to access Dash DAPI endpoints",
   "main": "lib/index.js",
   "contributors": [
diff --git a/packages/js-dash-sdk/package.json b/packages/js-dash-sdk/package.json
index 5c0c2857763..38d248d5b7d 100644
--- a/packages/js-dash-sdk/package.json
+++ b/packages/js-dash-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dash",
-  "version": "7.2.0-dev.1",
+  "version": "7.2.0-dev.2",
   "description": "Dash library for JavaScript/TypeScript ecosystem (Wallet, DAPI, Primitives, BLS, ...)",
   "main": "build/index.js",
   "unpkg": "dist/dash.min.js",
diff --git a/packages/js-evo-sdk/package.json b/packages/js-evo-sdk/package.json
index af2f9eef24f..c6acaef2abb 100644
--- a/packages/js-evo-sdk/package.json
+++ b/packages/js-evo-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/evo-sdk",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "type": "module",
   "main": "./dist/evo-sdk.module.js",
   "types": "./dist/sdk.d.ts",
diff --git a/packages/js-grpc-common/package.json b/packages/js-grpc-common/package.json
index 9fadf269237..8c43dad4eb2 100644
--- a/packages/js-grpc-common/package.json
+++ b/packages/js-grpc-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/grpc-common",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Common GRPC library",
   "main": "index.js",
   "scripts": {
diff --git a/packages/keyword-search-contract/package.json b/packages/keyword-search-contract/package.json
index 2caedd6c074..78e3ee42594 100644
--- a/packages/keyword-search-contract/package.json
+++ b/packages/keyword-search-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/keyword-search-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "A contract that allows searching for contracts",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/errors/DashSdkError.kt b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/errors/DashSdkError.kt
index ce763889348..6b6623fdbcc 100644
--- a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/errors/DashSdkError.kt
+++ b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/errors/DashSdkError.kt
@@ -115,6 +115,33 @@ sealed class DashSdkError(
         class AssetLockFundingMismatch(message: String, cause: Throwable? = null) :
             PlatformWallet(message, cause)
 
+        /**
+         * `ErrorAssetLockInsufficientFunds` (native code 29). Asset-lock coin
+         * selection came up short over the build's *permitted funding set*.
+         * What that set is depends on the funding form: an exact-amount build
+         * POOLS the default source list (the BIP44 and BIP32 accounts plus
+         * every DashPay contact-receiving account), so its shortfall
+         * describes that whole union rather than any single account; only a
+         * whole-account *drain* build — CoinJoin's only form, since mixed
+         * coins are never pooled with transparent ones — names a single
+         * account's shortfall.
+         *
+         * Distinct from [CoreInsufficientFunds] (22), which is the atomic
+         * Core-send selector rather than the asset-lock builder. The shortfall
+         * figures travel in [message] as `available {n} duffs, required {n}
+         * duffs` — the native result is ABI-frozen to code + message, so there
+         * are no structured fields to read.
+         *
+         * Raised by
+         * [shieldedFundFromCoinJoinDrain][org.dashfoundation.dashsdk.wallet.PlatformWalletManager.shieldedFundFromCoinJoinDrain]
+         * when the CoinJoin account has nothing to drain (single-account
+         * drain), and by
+         * [shieldedFundFromAssetLock][org.dashfoundation.dashsdk.wallet.PlatformWalletManager.shieldedFundFromAssetLock]
+         * when the pooled funding sources cannot cover the requested lock.
+         */
+        class AssetLockInsufficientFunds(message: String, cause: Throwable? = null) :
+            PlatformWallet(message, cause)
+
         /**
          * `ErrorShieldedNoRecordedAnchor` (native code 19). A shielded spend
          * could not be built against a Platform-recorded anchor because the
@@ -504,10 +531,11 @@ sealed class DashSdkError(
             24 -> PlatformWallet.AssetLockAlreadyConsumed(message, cause) // ErrorAssetLockAlreadyConsumed
             25 -> PlatformWallet.AssetLockFundingMismatch(message, cause) // ErrorAssetLockFundingMismatch
             26 -> PlatformWallet.TransactionBroadcastRejected(message, cause) // ErrorTransactionBroadcastRejected
+            29 -> PlatformWallet.AssetLockInsufficientFunds(message, cause) // ErrorAssetLockInsufficientFunds
             // The deferred-token trio sits at the contiguous block 34-36 because
             // 27-33 are claimed elsewhere: 27 ErrorShutdownIncomplete
             // (dashpay/platform#4268, merged), 29 ErrorAssetLockInsufficientFunds
-            // (#4184), 31 ErrorSigningKeyUnavailable (#4183/#4259), 32
+            // (mapped above), 31 ErrorSigningKeyUnavailable (#4183/#4259), 32
             // ErrorTransactionBuild (#4247/#4256), 33 ErrorTransactionSigning
             // (#4256). See packages/rs-platform-wallet-ffi/ERROR_CODE_REGISTRY.md.
             34 -> PlatformWallet.StaleReservationToken(message, cause) // ErrorStaleReservationToken
diff --git a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/ffi/FundingNative.kt b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/ffi/FundingNative.kt
index b769c5158a2..c1f9a6803d5 100644
--- a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/ffi/FundingNative.kt
+++ b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/ffi/FundingNative.kt
@@ -65,6 +65,26 @@ internal object FundingNative {
         coreSignerHandle: Long,
     )
 
+    /**
+     * Fund the shielded pool by DRAINING the wallet's CoinJoin account into a
+     * single asset lock (bridges
+     * `platform_wallet_manager_shielded_fund_from_asset_lock_coinjoin_drain`).
+     * Sibling of [shieldedFundFromAssetLock] with drain funding: there is no
+     * amount (the lock value is `Σ inputs − L1 fee`, computed Rust-side) and no
+     * surplus output (the single-recipient remainder flow pins it to zero).
+     * [coinJoinAccountIndex] selects the CoinJoin account to drain;
+     * [recipientRaw43] is the 43-byte raw Orchard address; [coreSignerHandle]
+     * is the manager's `MnemonicResolverHandle`. Blocks for the ~30s Halo 2
+     * proof; the note arrives on the next shielded sync.
+     */
+    external fun shieldedFundFromCoinJoinDrain(
+        managerHandle: Long,
+        walletId: ByteArray,
+        coinJoinAccountIndex: Int,
+        recipientRaw43: ByteArray,
+        coreSignerHandle: Long,
+    )
+
     /**
      * Resume a stuck shielded fund-from-asset-lock by outpoint (bridges
      * `platform_wallet_manager_shielded_resume_fund_from_asset_lock`).
diff --git a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/wallet/PlatformWalletManager.kt b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/wallet/PlatformWalletManager.kt
index 32cd4f83407..d8f0cf26b6f 100644
--- a/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/wallet/PlatformWalletManager.kt
+++ b/packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/wallet/PlatformWalletManager.kt
@@ -1526,6 +1526,54 @@ class PlatformWalletManager(
         }
     }
 
+    /**
+     * Fund a wallet's shielded (Orchard) pool by DRAINING its CoinJoin account
+     * (`m/9'/coinType'/4'/coinJoinAccountIndex'`) into a single asset lock —
+     * port of Swift's `shieldedFundFromCoinJoinDrain`.
+     *
+     * Sibling of [shieldedFundFromAssetLock] with drain funding, which is what
+     * makes this the CoinJoin → Shielded migration path: every final mixed-coin
+     * UTXO is consumed and the lock value is `Σ inputs − L1 fee`, computed
+     * Rust-side, so the mixed coins never hop through a transparent BIP44
+     * address on the way in. Hence no amount parameter, and no surplus output
+     * (the single-recipient remainder flow pins the consensus surplus to zero).
+     *
+     * The recipient receives `lockValue − poolFee` credits. The Rust preflight
+     * rejects a drain whose balance could not clear the Type 18 pool fee, so an
+     * unrecoverable dust lock is never broadcast; a drain of an empty account
+     * fails with the typed asset-lock shortfall
+     * ([org.dashfoundation.dashsdk.errors.DashSdkError.PlatformWallet.AssetLockInsufficientFunds]).
+     * A stuck lock resumes via [shieldedResumeFundFromAssetLock] exactly like a
+     * BIP44-funded one.
+     *
+     * Blocks for the ~30s Halo 2 proof; the shielded note itself arrives on the
+     * next shielded sync pass, so nothing is returned.
+     *
+     * @param walletId the 32-byte wallet id.
+     * @param recipientRaw43 the 43-byte raw Orchard payment address
+     *   (11-byte diversifier + 32-byte pk_d).
+     * @param coinJoinAccountIndex the CoinJoin account whose whole balance
+     *   funds the asset lock (account 0 for every current wallet).
+     */
+    suspend fun shieldedFundFromCoinJoinDrain(
+        walletId: ByteArray,
+        recipientRaw43: ByteArray,
+        coinJoinAccountIndex: Int = 0,
+    ): Unit = teardownGate.op {
+        require(coinJoinAccountIndex >= 0) {
+            "coinJoinAccountIndex must be non-negative, got $coinJoinAccountIndex"
+        }
+        mapNativeErrors {
+            FundingNative.shieldedFundFromCoinJoinDrain(
+                managerHandle,
+                walletId,
+                coinJoinAccountIndex,
+                recipientRaw43,
+                mnemonicResolverHandle,
+            )
+        }
+    }
+
     /**
      * Shield from Platform balance (Type 15) — port of Swift's
      * `shieldedShield`. Spends [amount] credits from the wallet's
diff --git a/packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/errors/DashSdkErrorTest.kt b/packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/errors/DashSdkErrorTest.kt
index 37169cc094c..94cc410285e 100644
--- a/packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/errors/DashSdkErrorTest.kt
+++ b/packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/errors/DashSdkErrorTest.kt
@@ -100,6 +100,33 @@ class DashSdkErrorTest {
             DashSdkError.fromNative(DashSDKException(offset + 22, "inputs reserved"))
         assertTrue(coreInsufficientFunds is DashSdkError.PlatformWallet.CoreInsufficientFunds)
 
+        // The asset-lock coin-selection shortfall (29) must reach callers as its
+        // own type rather than Generic, and must stay DISTINCT from the atomic
+        // Core-send shortfall (22) — the two selectors report over different
+        // funding sets (the asset-lock figures span the pooled sources on an
+        // exact-amount build and exactly one account on a drain), so hosts
+        // message the two differently. Its available/required duffs ride the
+        // message, which must survive verbatim.
+        val assetLockShort = DashSdkError.fromNative(
+            DashSDKException(
+                offset + 29,
+                "asset lock coin selection is short: available 18000000 duffs, " +
+                    "required 100000000 duffs",
+            ),
+        )
+        assertTrue(
+            "code 29 must not fall through to Generic",
+            assetLockShort is DashSdkError.PlatformWallet.AssetLockInsufficientFunds,
+        )
+        assertFalse(
+            "the asset-lock shortfall must not be conflated with the Core-send one",
+            assetLockShort is DashSdkError.PlatformWallet.CoreInsufficientFunds,
+        )
+        assertTrue(
+            "shortfall amounts must survive in the message",
+            assetLockShort.message!!.contains("available 18000000 duffs"),
+        )
+
         val recoveryCodes = mapOf(
             23 to DashSdkError.PlatformWallet.AssetLockNotTracked::class,
             24 to DashSdkError.PlatformWallet.AssetLockAlreadyConsumed::class,
diff --git a/packages/masternode-reward-shares-contract/package.json b/packages/masternode-reward-shares-contract/package.json
index 4f9c2e736a7..5863fd2198f 100644
--- a/packages/masternode-reward-shares-contract/package.json
+++ b/packages/masternode-reward-shares-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/masternode-reward-shares-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "A contract and helper scripts for reward sharing",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/platform-test-suite/package.json b/packages/platform-test-suite/package.json
index 74fe1bf50b2..800190b5d7d 100644
--- a/packages/platform-test-suite/package.json
+++ b/packages/platform-test-suite/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@dashevo/platform-test-suite",
   "private": true,
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Dash Network end-to-end tests",
   "scripts": {
     "test": "yarn exec bin/test.sh",
diff --git a/packages/platform-test-suite/test/e2e/contacts.spec.js b/packages/platform-test-suite/test/e2e/contacts.spec.js
index 664b927495d..4689961a5d4 100644
--- a/packages/platform-test-suite/test/e2e/contacts.spec.js
+++ b/packages/platform-test-suite/test/e2e/contacts.spec.js
@@ -157,7 +157,11 @@ describe('e2e', () => {
           { where: [['$id', '==', profile.getId()]] },
         );
 
-        expect(fetchedProfile.toObject()).to.be.deep.equal(profile.toObject());
+        const fetchedProfileObject = fetchedProfile.toObject();
+        // Drive stamps the contract version on stored documents (protocol v14+)
+        delete fetchedProfileObject.$contractVersion;
+
+        expect(fetchedProfileObject).to.be.deep.equal(profile.toObject());
       });
 
       it('should add encryption and decryption keys to the identity', async () => {
@@ -256,7 +260,11 @@ describe('e2e', () => {
           { where: [['$id', '==', aliceProfile.getId()]] },
         );
 
-        expect(fetchedProfile.toObject()).to.be.deep.equal(aliceProfile.toObject());
+        const fetchedProfileObject = fetchedProfile.toObject();
+        // Drive stamps the contract version on stored documents (protocol v14+)
+        delete fetchedProfileObject.$contractVersion;
+
+        expect(fetchedProfileObject).to.be.deep.equal(aliceProfile.toObject());
       });
 
       it('should be able to update her profile', async () => {
@@ -279,6 +287,8 @@ describe('e2e', () => {
 
         const fetchedProfileObject = fetchedProfile.toObject();
         delete fetchedProfileObject.$updatedAt;
+        // Drive stamps the contract version on stored documents (protocol v14+)
+        delete fetchedProfileObject.$contractVersion;
 
         const aliceObject = aliceProfile.toObject();
         delete aliceObject.$updatedAt;
@@ -311,7 +321,11 @@ describe('e2e', () => {
           { where: [['$id', '==', bobContactRequest.getId()]] },
         );
 
-        expect(fetchedContactRequest.toObject()).to.be.deep.equal(bobContactRequest.toObject());
+        const fetchedContactRequestObject = fetchedContactRequest.toObject();
+        // Drive stamps the contract version on stored documents (protocol v14+)
+        delete fetchedContactRequestObject.$contractVersion;
+
+        expect(fetchedContactRequestObject).to.be.deep.equal(bobContactRequest.toObject());
       });
     });
 
@@ -336,7 +350,11 @@ describe('e2e', () => {
           { where: [['$id', '==', aliceContactAcceptance.getId()]] },
         );
 
-        expect(fetchedAliceContactAcceptance.toObject()).to.be.deep.equal(
+        const fetchedAcceptanceObject = fetchedAliceContactAcceptance.toObject();
+        // Drive stamps the contract version on stored documents (protocol v14+)
+        delete fetchedAcceptanceObject.$contractVersion;
+
+        expect(fetchedAcceptanceObject).to.be.deep.equal(
           aliceContactAcceptance.toObject(),
         );
       });
diff --git a/packages/platform-test-suite/test/e2e/dpns.spec.js b/packages/platform-test-suite/test/e2e/dpns.spec.js
index b9c6444682a..4fb56dd7e81 100644
--- a/packages/platform-test-suite/test/e2e/dpns.spec.js
+++ b/packages/platform-test-suite/test/e2e/dpns.spec.js
@@ -153,6 +153,7 @@ describe('DPNS', () => {
       delete rawDocument.$transferredAtCoreBlockHeight;
       delete rawDocument.$transferredAtBlockHeight;
       delete rawDocument.$creatorId;
+      delete rawDocument.$contractVersion;
       delete rawDocument.preorderSalt;
 
       const rawRegisteredDomain = registeredDomain.toObject();
@@ -167,6 +168,7 @@ describe('DPNS', () => {
       delete rawRegisteredDomain.$transferredAtCoreBlockHeight;
       delete rawRegisteredDomain.$transferredAtBlockHeight;
       delete rawRegisteredDomain.$creatorId;
+      delete rawRegisteredDomain.$contractVersion;
       delete rawRegisteredDomain.preorderSalt;
 
       expect(rawDocument).to.deep.equal(rawRegisteredDomain);
@@ -187,6 +189,7 @@ describe('DPNS', () => {
       delete rawDocument.$transferredAtCoreBlockHeight;
       delete rawDocument.$transferredAtBlockHeight;
       delete rawDocument.$creatorId;
+      delete rawDocument.$contractVersion;
       delete rawDocument.preorderSalt;
 
       const rawRegisteredDomain = registeredDomain.toObject();
@@ -201,6 +204,7 @@ describe('DPNS', () => {
       delete rawRegisteredDomain.$transferredAtCoreBlockHeight;
       delete rawRegisteredDomain.$transferredAtBlockHeight;
       delete rawRegisteredDomain.$creatorId;
+      delete rawRegisteredDomain.$contractVersion;
       delete rawRegisteredDomain.preorderSalt;
 
       expect(rawDocument).to.deep.equal(rawRegisteredDomain);
@@ -224,6 +228,7 @@ describe('DPNS', () => {
       delete rawDocument.$transferredAtCoreBlockHeight;
       delete rawDocument.$transferredAtBlockHeight;
       delete rawDocument.$creatorId;
+      delete rawDocument.$contractVersion;
       delete rawDocument.preorderSalt;
 
       const rawRegisteredDomain = registeredDomain.toObject();
@@ -238,6 +243,7 @@ describe('DPNS', () => {
       delete rawRegisteredDomain.$transferredAtCoreBlockHeight;
       delete rawRegisteredDomain.$transferredAtBlockHeight;
       delete rawRegisteredDomain.$creatorId;
+      delete rawRegisteredDomain.$contractVersion;
       delete rawRegisteredDomain.preorderSalt;
 
       expect(rawDocument).to.deep.equal(rawRegisteredDomain);
diff --git a/packages/platform-test-suite/test/functional/platform/Document.spec.js b/packages/platform-test-suite/test/functional/platform/Document.spec.js
index f30c7b4feb4..4c6f31ccbdd 100644
--- a/packages/platform-test-suite/test/functional/platform/Document.spec.js
+++ b/packages/platform-test-suite/test/functional/platform/Document.spec.js
@@ -25,6 +25,10 @@ const getDocumentObject = (document) => {
   delete documentObject.$createdAt;
   delete documentObject.$updatedAt;
 
+  // Drive stamps the contract version on stored documents (protocol v14+),
+  // so a fetched document carries it while a locally created one does not
+  delete documentObject.$contractVersion;
+
   return documentObject;
 };
 
diff --git a/packages/rs-dpp/Cargo.toml b/packages/rs-dpp/Cargo.toml
index 0759b188069..e72bbd77413 100644
--- a/packages/rs-dpp/Cargo.toml
+++ b/packages/rs-dpp/Cargo.toml
@@ -71,7 +71,7 @@ strum = { version = "0.26", features = ["derive"] }
 json-schema-compatibility-validator = { path = '../rs-json-schema-compatibility-validator', optional = true }
 once_cell = "1.19.0"
 tracing = { version = "0.1.41" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.40", features = ["full"] }
diff --git a/packages/rs-dpp/schema/meta_schemas/document/v3/document-meta.json b/packages/rs-dpp/schema/meta_schemas/document/v3/document-meta.json
index f5fb020a8b6..6e7d82fdd98 100644
--- a/packages/rs-dpp/schema/meta_schemas/document/v3/document-meta.json
+++ b/packages/rs-dpp/schema/meta_schemas/document/v3/document-meta.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/dashpay/platform/blob/master/packages/rs-dpp/schema/meta_schemas/document/v1/document-meta.json",
-  "$comment": "EDITABLE UNTIL THE RELEASE CARRYING PROTOCOL V14 SHIPS — FROZEN AFTER. This v3 document meta-schema activates with protocol v14 (CONTRACT_VERSIONS_V6). It is v2 plus the ranked index keywords (rankedCountable, rankedSummable, rankedAverageable) and the refersTo reference keyword on identifier properties, and admits every v14+ contract written to disk. v2 stays in place for protocol v13, where those keys still fail an index entry's `additionalProperties: false`. Once the release carrying protocol v14 ships, mutating it would change historical validation results and break consensus replay. After release, any new top-level property or rule MUST go in a newer meta-schema version (v4+). The $id above deliberately still names the v1 path: v1, v2 and v3 all share that identity, and it is the exact string `enrich_with_base_schema` injects as every PV12+ document schema's `$schema`, so bumping it here would be a wire-visible change rather than a documentation fix.",
+  "$comment": "EDITABLE UNTIL THE RELEASE CARRYING PROTOCOL V14 SHIPS — FROZEN AFTER. This v3 document meta-schema activates with protocol v14 (CONTRACT_VERSIONS_V6). It is v2 plus the ranked index keywords (rankedCountable, rankedSummable, rankedAverageable), the refersTo reference keyword on identifier properties, the requiredSince property keyword (the contract version a property is required from), and the timeRange index transform, and admits every v14+ contract written to disk. v2 stays in place for protocol v13, where those keys still fail an index entry's `additionalProperties: false`. Once the release carrying protocol v14 ships, mutating it would change historical validation results and break consensus replay. After release, any new top-level property or rule MUST go in a newer meta-schema version (v4+). The $id above deliberately still names the v1 path: v1, v2 and v3 all share that identity, and it is the exact string `enrich_with_base_schema` injects as every PV12+ document schema's `$schema`, so bumping it here would be a wire-visible change rather than a documentation fix.",
   "type": "object",
   "$defs": {
     "documentProperties": {
@@ -224,6 +224,11 @@
         "position": {
           "type": "integer",
           "minimum": 0
+        },
+        "requiredSince": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 4294967295
         }
       },
       "dependentSchemas": {
@@ -588,6 +593,41 @@
           "rankedAverageable": {
             "type": "boolean",
             "description": "When true, the index's terminal property-name tree also carries an ordered secondary tree keyed by each group's average (count + sum pair) of the `averageable` property, so \"top / bottom K groups by average\" queries are O(log n + k) with proofs. Requires `rangeAverageable: true` (which itself implies `rangeCountable` + `rangeSummable`). Adds the Avg ranking axis only — it does NOT imply `rankedCountable` or `rankedSummable`; each ranking axis costs its own secondary tree and is opted into separately."
+          },
+          "timeRange": {
+            "type": "object",
+            "properties": {
+              "on": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Name of the timestamp index property to bucket. Must be this index's first property and name one of the system timestamps ($createdAt, $updatedAt or $transferredAt). A timeRange index may be unique only when range equals step (non-overlapping windows) and `on` is $createdAt."
+              },
+              "range": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "Length of each time range window, in seconds. Must be an exact multiple of `step`."
+              },
+              "step": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "Interval between successive range starts, in seconds. When `range` > `step` the ranges overlap and a document is indexed under `range / step` bucket-start values, bounded by a protocol-versioned cap (24 at protocol version 14)."
+              },
+              "phase": {
+                "type": "integer",
+                "minimum": 0,
+                "description": "Grid alignment phase, in seconds. Range starts are `phase + k * step`; must be strictly less than `step` (a larger value would be a redundant spelling of `phase % step`) and strictly less than one year (31536000 — a phase further out could sit past current block time on a huge step, leaving valid timestamps before the grid's first bucket). A pure alignment offset — it moves where window boundaries fall (e.g. daily windows cut at 06:00 UTC instead of midnight) and never excludes any real timestamp. Defaults to 0."
+              }
+            },
+            "required": ["on", "range", "step"],
+            "additionalProperties": false,
+            "description": "Buckets the first index property's timestamp into fixed-length, regularly-spaced (possibly overlapping) time ranges. The window parameters (`range`, `step`, `phase`) are declared in seconds, since a bucket is selected from block time and the target block interval is five seconds; the stored key is the range start as a u64 millisecond timestamp, so it stays directly comparable to the source timestamp it buckets. Enables trending/leaderboard queries within the newest/oldest active range. A system-timestamp source must be listed in the document type's required fields. Several indexes may bucket the same timestamp with different grids — each grid gets its own index subtree, keyed by the property name qualified with the grid parameters. Available from protocol version 14."
+          },
+          "terminal": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "Only on indexOnly document types: names the property whose value is this index entry's member key — the docId-analog terminal key under the index's storage marker, stored as an Item instead of a Reference because there is no primary-storage row. Either \"$ownerId\" (the default when omitted) or an identifier property carrying a refersTo declaration (identity, contract, token, or permanentDocument). Must not repeat one of the index's listed properties. Available from protocol version 14."
           }
         },
         "required": [
@@ -732,6 +772,10 @@
       "type": "boolean",
       "description": "Syntactic sugar: `rangeAverageable: true` is shorthand for `rangeCountable: true` + `rangeSummable: true`. Requires `documentsAverageable` to be set. Same caveat as `rangeSummable` — rarely useful on the primary key; per-index `rangeAverageable` is what most callers want."
     },
+    "indexOnly": {
+      "type": "boolean",
+      "description": "When true, documents of this type are never written to primary storage: the index entries are the rows, each terminating in an Item keyed by the index's `terminal` property instead of a Reference keyed by the document id. Only what is in the indexes exists and is recoverable. Requires: every property required and appearing in at least one index, $ownerId in at least one index (as a property or terminal), documentsMutable: false, no transfers/trading/history/transient properties, and no doctype-level aggregate keywords (use the index-level count flags). Available from protocol version 14."
+    },
     "tokenCost": {
       "type": "object",
       "properties": {
diff --git a/packages/rs-dpp/src/data_contract/document_type/accessors/mod.rs b/packages/rs-dpp/src/data_contract/document_type/accessors/mod.rs
index 2a3049427db..6ea4e0cb2a8 100644
--- a/packages/rs-dpp/src/data_contract/document_type/accessors/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/accessors/mod.rs
@@ -972,6 +972,14 @@ impl DocumentTypeV2Getters for DocumentType {
             DocumentType::V2(v2) => v2.range_summable(),
         }
     }
+
+    fn index_only(&self) -> bool {
+        match self {
+            DocumentType::V0(_) => false,
+            DocumentType::V1(_) => false,
+            DocumentType::V2(v2) => v2.index_only(),
+        }
+    }
 }
 
 impl DocumentTypeV2Setters for DocumentType {
@@ -1040,6 +1048,14 @@ impl DocumentTypeV2Getters for DocumentTypeRef<'_> {
             DocumentTypeRef::V2(v2) => v2.range_summable(),
         }
     }
+
+    fn index_only(&self) -> bool {
+        match self {
+            DocumentTypeRef::V0(_) => false,
+            DocumentTypeRef::V1(_) => false,
+            DocumentTypeRef::V2(v2) => v2.index_only(),
+        }
+    }
 }
 
 impl DocumentTypeV2Getters for DocumentTypeMutRef<'_> {
@@ -1074,6 +1090,14 @@ impl DocumentTypeV2Getters for DocumentTypeMutRef<'_> {
             DocumentTypeMutRef::V2(v2) => v2.range_summable(),
         }
     }
+
+    fn index_only(&self) -> bool {
+        match self {
+            DocumentTypeMutRef::V0(_) => false,
+            DocumentTypeMutRef::V1(_) => false,
+            DocumentTypeMutRef::V2(v2) => v2.index_only(),
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/packages/rs-dpp/src/data_contract/document_type/accessors/v2/mod.rs b/packages/rs-dpp/src/data_contract/document_type/accessors/v2/mod.rs
index 0daa6754690..68017106e45 100644
--- a/packages/rs-dpp/src/data_contract/document_type/accessors/v2/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/accessors/v2/mod.rs
@@ -24,6 +24,12 @@ pub trait DocumentTypeV2Getters {
     /// true, the primary-key sum tree is a `ProvableSumTree` (per-node
     /// aggregated sums). Implies [`Self::documents_summable`] is `Some`.
     fn range_summable(&self) -> bool;
+
+    /// Returns whether this document type is **indexOnly**: documents are
+    /// never written to primary storage — the index entries are the rows,
+    /// each terminating in an `Item` keyed by the index's `terminal`
+    /// property. Only what is in the indexes exists and is recoverable.
+    fn index_only(&self) -> bool;
 }
 
 /// Trait providing setters for DocumentTypeV2-specific fields.
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/mod.rs
new file mode 100644
index 00000000000..5e09e394782
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/mod.rs
@@ -0,0 +1,40 @@
+use std::collections::BTreeMap;
+
+use platform_value::Value;
+use platform_version::version::PlatformVersion;
+
+use crate::data_contract::errors::DataContractError;
+
+mod v0;
+
+/// Parses the `requiredSince` keyword: the contract version from which the
+/// property is required. Only meaningful on top-level required properties —
+/// the document wire format encodes a required property without a presence
+/// flag, so requiredness that varies by contract version must be resolvable
+/// per property from the current schema alone (see the per-document contract
+/// version stamp in document serialization format 3).
+///
+/// Versioned on `apply_required_since` in the platform version's document
+/// type schema versions. `None` selects the behavior of the versions that
+/// predate the keyword: it is ignored entirely, so their parses stay
+/// byte-for-byte identical to what they always produced.
+pub(crate) fn apply_required_since(
+    inner_properties: &BTreeMap<String, &Value>,
+    is_required: bool,
+    is_top_level: bool,
+    platform_version: &PlatformVersion,
+) -> Result<Option<u32>, DataContractError> {
+    match platform_version
+        .dpp
+        .contract_versions
+        .document_type_versions
+        .schema
+        .apply_required_since
+    {
+        None => Ok(None),
+        Some(0) => v0::apply_required_since_v0(inner_properties, is_required, is_top_level),
+        Some(version) => Err(DataContractError::Unsupported(format!(
+            "apply_required_since version {version} is not supported"
+        ))),
+    }
+}
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/v0/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/v0/mod.rs
new file mode 100644
index 00000000000..0932523d7ed
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/apply_required_since/v0/mod.rs
@@ -0,0 +1,43 @@
+use std::collections::BTreeMap;
+
+use platform_value::Value;
+
+use crate::data_contract::document_type::property_names;
+use crate::data_contract::errors::DataContractError;
+
+/// Generation 0 parse rules: the keyword is admitted only on a top-level
+/// property listed in `required`, and its value is a contract version of at
+/// least 1 fitting in a u32.
+pub(super) fn apply_required_since_v0(
+    inner_properties: &BTreeMap<String, &Value>,
+    is_required: bool,
+    is_top_level: bool,
+) -> Result<Option<u32>, DataContractError> {
+    let Some(required_since_value) = inner_properties.get(property_names::REQUIRED_SINCE) else {
+        return Ok(None);
+    };
+
+    if !is_top_level {
+        return Err(DataContractError::InvalidContractStructure(
+            "requiredSince is only allowed on top-level properties".to_string(),
+        ));
+    }
+
+    if !is_required {
+        return Err(DataContractError::InvalidContractStructure(
+            "requiredSince is only allowed on properties listed in required".to_string(),
+        ));
+    }
+
+    let required_since: u32 = required_since_value
+        .to_integer()
+        .map_err(|e| DataContractError::ValueWrongType(e.to_string()))?;
+
+    if required_since == 0 {
+        return Err(DataContractError::InvalidContractStructure(
+            "requiredSince must be a contract version of at least 1".to_string(),
+        ));
+    }
+
+    Ok(Some(required_since))
+}
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/mod.rs
index 48b129985a4..0fa5e3e27a7 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/mod.rs
@@ -1,3 +1,4 @@
+use crate::consensus::basic::data_contract::DataContractInvalidRequiredFieldsUpdateError;
 #[cfg(feature = "validation")]
 use crate::consensus::basic::BasicError;
 #[cfg(feature = "validation")]
@@ -5,6 +6,7 @@ use crate::consensus::ConsensusError;
 use crate::data_contract::errors::DataContractError;
 use crate::ProtocolError;
 
+pub(crate) mod apply_required_since;
 mod create_document_types_from_document_schemas;
 mod should_use_creator_id;
 mod system_properties;
@@ -26,6 +28,27 @@ pub(crate) fn consensus_or_protocol_data_contract_error(
     }
 }
 
+#[inline]
+pub(crate) fn consensus_or_protocol_required_fields_error(
+    error: DataContractInvalidRequiredFieldsUpdateError,
+) -> ProtocolError {
+    #[cfg(feature = "validation")]
+    {
+        ProtocolError::ConsensusError(
+            ConsensusError::BasicError(BasicError::DataContractInvalidRequiredFieldsUpdateError(
+                error,
+            ))
+            .into(),
+        )
+    }
+    #[cfg(not(feature = "validation"))]
+    {
+        ProtocolError::DataContractError(DataContractError::InvalidContractStructure(
+            error.to_string(),
+        ))
+    }
+}
+
 #[inline]
 pub(crate) fn consensus_or_protocol_value_error(
     platform_value_error: platform_value::Error,
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/common/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/common/mod.rs
index c334f4b586f..021ebe197d7 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/common/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/common/mod.rs
@@ -27,9 +27,9 @@ use crate::data_contract::document_type::property::DocumentProperty;
 use crate::data_contract::document_type::property::DocumentPropertyType;
 use crate::data_contract::document_type::property_names::{
     CAN_BE_DELETED, CREATION_RESTRICTION_MODE, DOCUMENTS_AVERAGEABLE, DOCUMENTS_COUNTABLE,
-    DOCUMENTS_KEEP_HISTORY, DOCUMENTS_MUTABLE, DOCUMENTS_SUMMABLE, KEEPS_PRICING_HISTORY,
-    KEEPS_PURCHASE_HISTORY, KEEPS_TRANSFER_HISTORY, RANGE_AVERAGEABLE, RANGE_COUNTABLE,
-    RANGE_SUMMABLE, TRADE_MODE, TRANSFERABLE,
+    DOCUMENTS_KEEP_HISTORY, DOCUMENTS_MUTABLE, DOCUMENTS_SUMMABLE, INDEX_ONLY,
+    KEEPS_PRICING_HISTORY, KEEPS_PURCHASE_HISTORY, KEEPS_TRANSFER_HISTORY, RANGE_AVERAGEABLE,
+    RANGE_COUNTABLE, RANGE_SUMMABLE, TRADE_MODE, TRANSFERABLE,
 };
 use crate::data_contract::document_type::restricted_creation::CreationRestrictionMode;
 use crate::data_contract::document_type::token_costs::v0::TokenCostsV0;
@@ -192,6 +192,23 @@ pub(super) struct ParserGeneration {
     pub ranked_index_key_length_check: RankedIndexKeyLengthCheck,
     /// See [`RankedIndexStructureCheck`].
     pub ranked_index_structure_check: RankedIndexStructureCheck,
+
+    // ---- TIME RANGE: the other generation-3 addition ----
+    /// Whether the index grammar admits the `timeRange` keyword. Forwarded to
+    /// [`Index::try_from_value_map`] exactly like `admit_ranked`: when `false`
+    /// the key falls through to the unknown-key arm and is rejected as any
+    /// pre-generation-3 node rejected it.
+    pub admit_time_range: bool,
+
+    // ---- INDEX ONLY: the third generation-3 addition ----
+    /// Whether the index grammar admits the `terminal` keyword (indexOnly
+    /// document types). Forwarded to [`Index::try_from_value_map`] exactly
+    /// like `admit_ranked` and `admit_time_range`. The doc-type-level
+    /// `indexOnly` keyword needs no admission flag of its own: it is read
+    /// only by the generation-3 driver (`parse_index_only_keyword`), so
+    /// earlier generations ignore it exactly as they ignore every other
+    /// doctype-level keyword they predate.
+    pub admit_index_terminal: bool,
 }
 
 /// Reject a document type whose name is not a non-empty ASCII
@@ -487,6 +504,7 @@ pub(super) fn parse_document_type_core(
         schema_map,
         &flags,
         &properties.flattened_document_properties,
+        &properties.required_fields,
         validation_operations,
     )?;
 
@@ -745,6 +763,7 @@ fn parse_document_properties(
             &mut document_properties,
             &required_fields,
             &transient_fields,
+            true,
             property_key,
             property_value,
             root_schema,
@@ -777,6 +796,7 @@ fn parse_indices(
     schema_map: &[(Value, Value)],
     flags: &DocumentTypeFlags,
     flattened_document_properties: &IndexMap<String, DocumentProperty>,
+    required_fields: &BTreeSet<String>,
     validation_operations: &mut impl Extend<ProtocolValidationOperation>,
 ) -> Result<(BTreeMap<String, Index>, IndexLevel), ProtocolError> {
     // Initialize indices
@@ -814,7 +834,11 @@ fn parse_indices(
                             .to_map()
                             .map_err(consensus_or_protocol_value_error)?
                             .as_slice(),
-                        ctx.generation.admit_ranked,
+                        crate::data_contract::document_type::index::IndexGrammarAdmissions {
+                            ranked: ctx.generation.admit_ranked,
+                            time_range: ctx.generation.admit_time_range,
+                            terminal: ctx.generation.admit_index_terminal,
+                        },
                     )
                     .map_err(consensus_or_protocol_data_contract_error)?;
 
@@ -845,6 +869,95 @@ fn parse_indices(
                             )));
                         }
 
+                        // TIME RANGE: the source must be a millisecond
+                        // timestamp — a system timestamp ($createdAt /
+                        // $updatedAt / $transferredAt) or a user `Date`
+                        // property. Structural checks (first-property,
+                        // range % step, the uniqueness rules — unique only
+                        // over non-overlapping windows on `$createdAt` —
+                        // and non-contested) already happened in `Index`
+                        // parsing; the checks here need the document schema
+                        // or the platform version, so they live here. A
+                        // generation without the `timeRange` grammar never
+                        // parses a transform, so this is a no-op there.
+                        if let Some(transform) = &index.time_range {
+                            // The overlap factor is the number of index
+                            // entries a single document produces on this
+                            // index — its write amplification — so its cap
+                            // is a versioned system limit rather than a
+                            // structural constant: retuning it is a
+                            // protocol-version decision, not a code edit.
+                            // `None` means a protocol version predating
+                            // time-range indexes, which cannot reach here
+                            // because the keyword does not parse there.
+                            if let Some(max_overlap_factor) = ctx
+                                .platform_version
+                                .system_limits
+                                .max_time_range_overlap_factor
+                            {
+                                let overlap = transform.overlap_factor();
+                                if overlap > max_overlap_factor {
+                                    return Err(consensus_or_protocol_data_contract_error(
+                                        DataContractError::InvalidContractStructure(format!(
+                                            "timeRange overlap factor (range / step = {}) \
+                                             exceeds the maximum of {}; a smaller window or a \
+                                             larger step is required to bound per-document \
+                                             index entries",
+                                            overlap, max_overlap_factor
+                                        )),
+                                    ));
+                                }
+                            }
+                            let source = transform.source.as_str();
+                            let is_system_timestamp = matches!(
+                                source,
+                                property_names::CREATED_AT
+                                    | property_names::UPDATED_AT
+                                    | property_names::TRANSFERRED_AT
+                            );
+                            // A system timestamp is only ever populated when
+                            // the schema *requires* it. Without this check a
+                            // contract could declare `timeRange.on:
+                            // "$createdAt"` on a doctype that never sets
+                            // $createdAt: every document would take the null
+                            // branch, the index would hold nothing but null
+                            // entries, and — the transform being immutable —
+                            // the owner could never fix it.
+                            if is_system_timestamp && !required_fields.contains(source) {
+                                return Err(consensus_or_protocol_data_contract_error(
+                                    DataContractError::InvalidContractStructure(format!(
+                                        "timeRange.on (\"{}\") names a system timestamp the \
+                                         document type does not require; add it to the \
+                                         document type's required fields so documents actually \
+                                         carry it",
+                                        source
+                                    )),
+                                ));
+                            }
+                            // Only the system timestamps can be a source. A
+                            // user property cannot: the document-schema
+                            // grammar has no type that parses to
+                            // `DocumentPropertyType::Date` (`type: "string"`
+                            // with `format: "date-time"` stays `String`, and
+                            // the meta-schema's `type` enum has no `"date"`),
+                            // so accepting `Date`-typed user properties here
+                            // would be a dead branch advertising a source no
+                            // valid contract can declare. Lift this together
+                            // with a reachable millisecond-timestamp property
+                            // representation, not before.
+                            if !is_system_timestamp {
+                                return Err(consensus_or_protocol_data_contract_error(
+                                    DataContractError::InvalidContractStructure(format!(
+                                        "timeRange.on (\"{}\") must name one of the system \
+                                         timestamps ($createdAt, $updatedAt or $transferredAt); \
+                                         user-defined properties are not supported as a \
+                                         time-range source",
+                                        source
+                                    )),
+                                ));
+                            }
+                        }
+
                         validation_operations.extend(std::iter::once(
                             ProtocolValidationOperation::DocumentTypeSchemaIndexValidation(
                                 index.properties.len() as u64,
@@ -976,6 +1089,14 @@ fn parse_indices(
     // core never branches on a version.
     (ctx.generation.ranked_index_structure_check)(&indices)?;
 
+    // TIME RANGE: indices that share a first property may bucket it with
+    // different grids (or not at all) — each grid forks into its own index
+    // level, keyed by the property name qualified with the grid parameters
+    // (`TimeRangeTransform::storage_key`), so a bucketed level never shares
+    // a keyspace with a plain level or with another grid's level. No
+    // cross-index agreement rule is needed; identical grids simply share
+    // one level.
+
     let index_structure =
         IndexLevel::try_from_indices(indices.values(), ctx.name, ctx.platform_version)?;
 
@@ -1712,3 +1833,389 @@ pub(super) fn apply_doctype_aggregates(
 
     Ok(())
 }
+
+/// Read the doctype-level `indexOnly` keyword off the raw schema.
+///
+/// Runs before the core parse because the core takes `schema` by value —
+/// same shape as [`parse_doctype_aggregate_keywords`]. Only the generation-3
+/// driver calls this; earlier generations ignore the keyword exactly as they
+/// ignore every doctype-level keyword they predate (their meta-schemas still
+/// reject it under `full_validation`).
+pub(super) fn parse_index_only_keyword(schema: &Value) -> Result<bool, ProtocolError> {
+    let schema_map_opt = schema.to_map().ok();
+
+    Ok(schema_map_opt
+        .as_ref()
+        .and_then(|schema_map| {
+            Value::inner_optional_bool_value(schema_map, INDEX_ONLY)
+                .map_err(consensus_or_protocol_value_error)
+                .transpose()
+        })
+        .transpose()?
+        .unwrap_or(false))
+}
+
+/// Write the `indexOnly` flag onto the parsed document type, normalize each
+/// index's `terminal` (an omitted terminal defaults to `$ownerId`), and run
+/// the structural cross-checks the index-only on-disk layout depends on.
+///
+/// An indexOnly document type has no primary-storage row: the index entries
+/// ARE the rows, each terminating in an `Item` keyed by the index's terminal
+/// property. Only what is in the indexes exists and is recoverable, which is
+/// why every check below is a storage-layout invariant rather than a schema
+/// lint. Like [`apply_doctype_aggregates`], this runs regardless of
+/// `full_validation`: this function sits on the untrusted-contract boundary,
+/// and admitting a malformed indexOnly type through a non-validating parse
+/// would brick the first document insert or make deletes unauthorizable.
+///
+/// Must run AFTER [`apply_doctype_aggregates`] — it rejects the doctype-level
+/// aggregate flags, which describe the primary-key tree an indexOnly type
+/// does not have.
+pub(super) fn apply_index_only(
+    document_type: &mut DocumentTypeV2,
+    index_only: bool,
+    name: &str,
+) -> Result<(), ProtocolError> {
+    use crate::document::property_names::{CREATED_AT, OWNER_ID};
+
+    let structure_error = |message: String| {
+        ProtocolError::DataContractError(DataContractError::InvalidContractStructure(message))
+    };
+
+    if !index_only {
+        // `terminal` is only meaningful on indexOnly document types: it names
+        // the member key that replaces the document id, and a non-indexOnly
+        // index keys its members by document id unconditionally.
+        if let Some((index_name, _)) = document_type
+            .indices
+            .iter()
+            .find(|(_, index)| index.terminal.is_some())
+        {
+            return Err(structure_error(format!(
+                "index \"{}\" on document type \"{}\" declares `terminal`, which is only \
+                 allowed on indexOnly document types (set `indexOnly: true` on the document \
+                 type, or remove the terminal)",
+                index_name, name,
+            )));
+        }
+        return Ok(());
+    }
+
+    document_type.index_only = true;
+
+    // ---- doctype-level flags -------------------------------------------
+    // Every rejection here names the flag the author must change: silently
+    // overriding a flag would emit a document type whose declared behavior
+    // and on-disk layout disagree.
+    if document_type.documents_mutable {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" must set documentsMutable: false: there is no \
+             stored row (and no revision) to mutate",
+            name,
+        )));
+    }
+    if document_type.documents_transferable != Transferable::Never {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" must not be transferable: ownership is embedded \
+             in the index entries themselves and cannot be reassigned",
+            name,
+        )));
+    }
+    if document_type.trade_mode != TradeMode::None {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" must set tradeMode to none: there is no stored \
+             row to trade",
+            name,
+        )));
+    }
+    if document_type.documents_keep_history
+        || document_type.documents_keep_transfer_history
+        || document_type.documents_keep_purchase_history
+        || document_type.documents_keep_pricing_history
+    {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" cannot keep history (documentsKeepHistory / \
+             keepsTransferHistory / keepsPurchaseHistory / keepsPricingHistory): documents \
+             of this type are only ever created and deleted, and have no stored body to \
+             version",
+            name,
+        )));
+    }
+    if !document_type.transient_fields.is_empty() {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" cannot declare transient properties: on an \
+             indexOnly type only indexed values exist, and a transient property is by \
+             definition not stored — the two declarations contradict each other",
+            name,
+        )));
+    }
+    if document_type.documents_countable
+        || document_type.range_countable
+        || document_type.documents_summable.is_some()
+        || document_type.range_summable
+    {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" cannot use the doctype-level aggregate keywords \
+             (documentsCountable / rangeCountable / documentsSummable / rangeSummable / \
+             the averageable sugar): they describe the primary-key tree, which an indexOnly \
+             type does not have. Use the index-level `countable` / `rangeCountable` / \
+             `rankedCountable` flags instead",
+            name,
+        )));
+    }
+
+    if document_type.indices.is_empty() {
+        return Err(structure_error(format!(
+            "indexOnly document type \"{}\" must declare at least one index: the indexes \
+             are the storage",
+            name,
+        )));
+    }
+
+    // ---- terminal normalization ----------------------------------------
+    // An omitted terminal defaults to `$ownerId`. Normalizing here (rather
+    // than leaving `None` to mean the default) keeps every downstream
+    // consumer — the walkers, the query planner, the update-immutability
+    // comparison — reading one canonical spelling, and both spellings of the
+    // same index parse to equal `Index` values.
+    for index in document_type.indices.values_mut() {
+        if index.terminal.is_none() {
+            index.terminal = Some(OWNER_ID.to_string());
+        }
+    }
+
+    // ---- per-index rules ------------------------------------------------
+    for (index_name, index) in document_type.indices.iter() {
+        if index.properties.is_empty() {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" has no properties: an \
+                 indexOnly entry is `[…property values, 0, terminal value]`, so at least \
+                 one prefix property is required above the terminal",
+                index_name, name,
+            )));
+        }
+        if index.unique {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" cannot be unique: \
+                 uniqueness is structural on an indexOnly type — one entry per value tuple \
+                 and terminal, enforced at insert — and an index without $ownerId already \
+                 enforces global uniqueness of its value tuple",
+                index_name, name,
+            )));
+        }
+        if index.contested_index.is_some() {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" cannot be contested: the \
+                 contested-resource machinery is document-based",
+                index_name, name,
+            )));
+        }
+        if !index.null_searchable {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" cannot set nullSearchable: \
+                 false: every property of an indexOnly type is required, so no null entries \
+                 exist to suppress",
+                index_name, name,
+            )));
+        }
+        if index.time_range.is_some() {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" cannot declare a timeRange: \
+                 bucketed indexOnly indexes are not yet supported",
+                index_name, name,
+            )));
+        }
+        if index.summable.is_some() || index.ranked_summable || index.ranked_averageable {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" cannot use the sum axes \
+                 (summable / rangeSummable / rankedSummable / rankedAverageable / the \
+                 averageable sugar): indexOnly terminals are plain Items carrying no sum \
+                 contribution; only the count axes (countable / rangeCountable / \
+                 rankedCountable) are supported",
+                index_name, name,
+            )));
+        }
+
+        let terminal = index.terminal.as_deref().expect("normalized to Some above");
+
+        if index
+            .properties
+            .iter()
+            .any(|property| property.name == terminal)
+        {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" repeats its terminal \
+                 (\"{}\") in its properties: the terminal is the member key below the \
+                 listed properties, so listing it again would index the same dimension \
+                 twice",
+                index_name, name, terminal,
+            )));
+        }
+
+        // The terminal is the member key — it must be a referable entity id:
+        // the owner identity, or a property carrying a refersTo declaration
+        // whose value alone IS the referenced entity's id (identity,
+        // contract, token, or permanent document — all kinds that can never
+        // dangle). `identityPublicKey` is deliberately NOT admitted: it is a
+        // compound reference — this property carries the identity id while a
+        // separate `keyIdProperty` carries the key id — so a terminal keyed
+        // by it would conflate references to different keys of the same
+        // identity.
+        if terminal != OWNER_ID {
+            use crate::data_contract::document_type::property::DocumentPropertyReferenceTarget;
+            match document_type.flattened_properties.get(terminal) {
+                Some(property)
+                    if matches!(
+                        property.property_type,
+                        DocumentPropertyType::IdentifierWithReference(
+                            DocumentPropertyReferenceTarget::Identity
+                                | DocumentPropertyReferenceTarget::Contract
+                                | DocumentPropertyReferenceTarget::Token
+                                | DocumentPropertyReferenceTarget::PermanentDocument { .. }
+                        )
+                    ) => {}
+                Some(_) => {
+                    return Err(structure_error(format!(
+                        "terminal \"{}\" of index \"{}\" on indexOnly document type \"{}\" \
+                         must be \"$ownerId\" or an identifier property with a refersTo \
+                         declaration targeting identity, contract, token, or \
+                         permanentDocument: the terminal is the entry's member key and must \
+                         alone be a referable entity id (an identityPublicKey reference is \
+                         compound — its key id lives in a separate property — and is not \
+                         admitted)",
+                        terminal, index_name, name,
+                    )));
+                }
+                None => {
+                    return Err(structure_error(format!(
+                        "terminal \"{}\" of index \"{}\" on indexOnly document type \"{}\" \
+                         does not name a property of the document type",
+                        terminal, index_name, name,
+                    )));
+                }
+            }
+        }
+
+        // Prefix properties: schema properties plus exactly two system
+        // properties — `$ownerId` (ownership) and `$createdAt` (assigned
+        // from block time at create, recoverable from the path). Every
+        // other system property either cannot exist on an immutable type
+        // ($updatedAt and friends) or has no stored home ($revision &co).
+        for property in index.properties.iter() {
+            if property.name.starts_with('$')
+                && property.name != OWNER_ID
+                && property.name != CREATED_AT
+            {
+                return Err(structure_error(format!(
+                    "index \"{}\" on indexOnly document type \"{}\" indexes system property \
+                     \"{}\": only $ownerId and $createdAt may be indexed on an indexOnly \
+                     type (documents are immutable, so no other system property can carry \
+                     information)",
+                    index_name, name, property.name,
+                )));
+            }
+        }
+
+        // EVERY index must embed `$ownerId` (as a prefix property or the
+        // terminal). This is what makes each entry self-authorizing: a
+        // delete recomputes entries with owner = signer, so an entry the
+        // signer does not own is simply not there. With an owner-less
+        // index, a crafted delete could splice values from two different
+        // documents — its own owner-bearing row and a victim's owner-less
+        // row — and remove an entry it never created; binding every entry
+        // to its owner closes that, at the cost of the (unneeded) global-
+        // uniqueness-without-owner shape.
+        if terminal != OWNER_ID
+            && !index
+                .properties
+                .iter()
+                .any(|property| property.name == OWNER_ID)
+        {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" must include $ownerId (as \
+                 a property or as the terminal): every entry must be bound to its owner so \
+                 deletes can only ever remove the signer's own entries",
+                index_name, name,
+            )));
+        }
+
+        // `$createdAt` in an index is only coherent when the document
+        // actually carries a timestamp — and document creation assigns
+        // `created_at` only when `$createdAt` is in `required`. Without
+        // this, an indexed `$createdAt` would silently take the missing-
+        // value branch instead of storing block time.
+        if (terminal == CREATED_AT
+            || index
+                .properties
+                .iter()
+                .any(|property| property.name == CREATED_AT))
+            && !document_type.required_fields.contains(CREATED_AT)
+        {
+            return Err(structure_error(format!(
+                "index \"{}\" on indexOnly document type \"{}\" involves $createdAt, so \
+                 \"$createdAt\" must be listed in `required`: document creation only \
+                 assigns the timestamp for required system times, and an indexOnly entry \
+                 cannot represent a missing value",
+                index_name, name,
+            )));
+        }
+    }
+
+    // ---- coverage and requiredness --------------------------------------
+    // The index content IS the document: a property in no index would not
+    // exist, and an optional property would need the null-layout machinery
+    // this mode deliberately sidesteps.
+    for (property_name, property) in document_type.flattened_properties.iter() {
+        if matches!(property.property_type, DocumentPropertyType::Object(_)) {
+            // Containers are covered through their flattened leaves.
+            continue;
+        }
+        let covered = document_type.indices.values().any(|index| {
+            index.terminal.as_deref() == Some(property_name.as_str())
+                || index
+                    .properties
+                    .iter()
+                    .any(|index_property| index_property.name == *property_name)
+        });
+        if !covered {
+            return Err(structure_error(format!(
+                "property \"{}\" on indexOnly document type \"{}\" does not appear in any \
+                 index (as a property or terminal): on an indexOnly type only indexed \
+                 values exist and are recoverable, so an unindexed property would be \
+                 silently dropped",
+                property_name, name,
+            )));
+        }
+        if !document_type.required_fields.contains(property_name) {
+            return Err(structure_error(format!(
+                "property \"{}\" on indexOnly document type \"{}\" must be listed in \
+                 `required`: the index path is the storage, and an absent value would need \
+                 the null index layout this mode deliberately has no equivalent of",
+                property_name, name,
+            )));
+        }
+
+        // A required nested leaf inside an OPTIONAL ancestor object is only
+        // conditionally present — `required: ["targetId"]` inside an
+        // unrequired `profile` lets a valid document omit the whole object.
+        // Every ancestor path of an indexed dotted property must therefore
+        // be required too, or the no-null invariant silently breaks.
+        let mut ancestor = String::new();
+        for segment in property_name.split('.') {
+            if !ancestor.is_empty() {
+                if !document_type.required_fields.contains(&ancestor) {
+                    return Err(structure_error(format!(
+                        "property \"{}\" on indexOnly document type \"{}\" sits inside \
+                         \"{}\", which is not listed in `required`: a valid document could \
+                         omit the whole object, leaving the indexed leaf absent",
+                        property_name, name, ancestor,
+                    )));
+                }
+                ancestor.push('.');
+            }
+            ancestor.push_str(segment);
+        }
+    }
+
+    Ok(())
+}
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs
index db391c3456e..bd45f698359 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/mod.rs
@@ -1,4 +1,5 @@
 use crate::data_contract::config::DataContractConfig;
+use crate::data_contract::document_type::class_methods::apply_required_since::apply_required_since;
 use crate::data_contract::document_type::v0::DocumentTypeV0;
 use crate::data_contract::document_type::v1::DocumentTypeV1;
 use crate::data_contract::document_type::{
@@ -128,6 +129,7 @@ fn insert_values(
         vec![(prefix, property_key, property_value)];
 
     while let Some((prefix, property_key, property_value)) = to_visit.pop() {
+        let is_top_level = prefix.is_none();
         let prefixed_property_key = match prefix {
             None => property_key,
             Some(prefix) => [prefix, property_key].join(".").to_owned(),
@@ -143,6 +145,12 @@ fn insert_values(
 
         let is_required = known_required.contains(&prefixed_property_key);
         let is_transient = known_transient.contains(&prefixed_property_key);
+        let required_since = apply_required_since(
+            &inner_properties,
+            is_required,
+            is_top_level,
+            platform_version,
+        )?;
 
         match DocumentPropertyType::try_from_value_map(&inner_properties, &config.into())? {
             DocumentPropertyType::Object(_) => {
@@ -179,6 +187,7 @@ fn insert_values(
                         property_type,
                         required: is_required,
                         transient: is_transient,
+                        required_since,
                     },
                 );
             }
@@ -194,6 +203,7 @@ fn insert_values_nested(
     document_properties: &mut IndexMap<String, DocumentProperty>,
     known_required: &BTreeSet<String>,
     known_transient: &BTreeSet<String>,
+    is_top_level: bool,
     property_key: String,
     property_value: &Value,
     root_schema: &Value,
@@ -212,6 +222,13 @@ fn insert_values_nested(
 
     let is_transient = known_transient.contains(&property_key);
 
+    let required_since = apply_required_since(
+        &inner_properties,
+        is_required,
+        is_top_level,
+        platform_version,
+    )?;
+
     let property_type =
         match DocumentPropertyType::try_from_value_map(&inner_properties, &config.into())? {
             DocumentPropertyType::Object(_) => {
@@ -271,6 +288,7 @@ fn insert_values_nested(
                             &mut nested_properties,
                             &stripped_required,
                             &stripped_transient,
+                            false,
                             object_property_string,
                             object_property_value,
                             root_schema,
@@ -294,6 +312,7 @@ fn insert_values_nested(
             property_type,
             required: is_required,
             transient: is_transient,
+            required_since,
         },
     );
 
@@ -413,6 +432,7 @@ mod tests {
     use super::*;
     use crate::data_contract::config::DataContractConfig;
     use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+    use crate::data_contract::document_type::validate_required_since_within_contract_version;
     use platform_value::string_encoding::Encoding;
     use serde_json::json;
 
@@ -422,6 +442,33 @@ mod tests {
         try_document_type_from_schema_on_version(schema, PlatformVersion::latest())
     }
 
+    /// Same as [`try_document_type_from_schema`] but with `full_validation`
+    /// on — the index validations (the timeRange source rules among them)
+    /// only run on the validating parse.
+    fn try_document_type_from_schema_full_validation(
+        schema: serde_json::Value,
+    ) -> Result<DocumentType, ProtocolError> {
+        let platform_version = PlatformVersion::latest();
+        let config =
+            DataContractConfig::default_for_version(platform_version).expect("config should build");
+
+        let value = platform_value::to_value(schema).expect("schema should convert");
+
+        DocumentType::try_from_schema(
+            Identifier::random(),
+            0,
+            config.version(),
+            "msg",
+            value,
+            None,
+            &BTreeMap::new(),
+            &config,
+            true,
+            &mut vec![],
+            platform_version,
+        )
+    }
+
     fn try_document_type_from_schema_on_version(
         schema: serde_json::Value,
         platform_version: &PlatformVersion,
@@ -804,4 +851,339 @@ mod tests {
         )
         .expect("a parse predating refersTo should ignore the keyword entirely");
     }
+
+    // ================================================================
+    //  requiredSince
+    // ================================================================
+
+    #[test]
+    fn should_parse_required_since_on_top_level_required_property() {
+        let document_type = try_document_type_from_schema(json!({
+            "type": "object",
+            "properties": {
+                "a": {"type": "string", "position": 0, "maxLength": 60},
+                "b": {"type": "string", "position": 1, "maxLength": 60, "requiredSince": 3},
+            },
+            "required": ["a", "b"],
+            "additionalProperties": false
+        }))
+        .expect("should parse");
+
+        let properties = document_type.as_ref().flattened_properties().clone();
+        assert_eq!(properties.get("a").unwrap().required_since, None);
+        assert_eq!(properties.get("b").unwrap().required_since, Some(3));
+        assert!(properties.get("b").unwrap().required);
+    }
+
+    #[test]
+    fn should_reject_required_since_on_optional_property() {
+        let result = try_document_type_from_schema(json!({
+            "type": "object",
+            "properties": {
+                "a": {"type": "string", "position": 0, "maxLength": 60, "requiredSince": 2},
+            },
+            "required": [],
+            "additionalProperties": false
+        }));
+
+        assert!(
+            result.is_err(),
+            "requiredSince on a property not listed in required must be rejected"
+        );
+    }
+
+    #[test]
+    fn should_reject_required_since_on_nested_property() {
+        let result = try_document_type_from_schema(json!({
+            "type": "object",
+            "properties": {
+                "outer": {
+                    "type": "object",
+                    "position": 0,
+                    "properties": {
+                        "inner": {"type": "string", "position": 0, "maxLength": 60, "requiredSince": 2},
+                    },
+                    "required": ["inner"],
+                    "additionalProperties": false
+                },
+            },
+            "required": [],
+            "additionalProperties": false
+        }));
+
+        assert!(
+            result.is_err(),
+            "requiredSince on a nested property must be rejected"
+        );
+    }
+
+    #[test]
+    fn should_reject_required_since_above_u32_max() {
+        // The meta-schema caps the value at u32::MAX too; this pins the
+        // parser-side rejection so it does not depend on meta-schema
+        // coverage (parses without full validation skip the meta-schema)
+        let result = try_document_type_from_schema(json!({
+            "type": "object",
+            "properties": {
+                "a": {"type": "string", "position": 0, "maxLength": 60, "requiredSince": 4_294_967_296_u64},
+            },
+            "required": ["a"],
+            "additionalProperties": false
+        }));
+
+        assert!(
+            result.is_err(),
+            "requiredSince above u32::MAX must be rejected"
+        );
+    }
+
+    #[test]
+    fn should_reject_required_since_of_zero() {
+        let result = try_document_type_from_schema(json!({
+            "type": "object",
+            "properties": {
+                "a": {"type": "string", "position": 0, "maxLength": 60, "requiredSince": 0},
+            },
+            "required": ["a"],
+            "additionalProperties": false
+        }));
+
+        assert!(
+            result.is_err(),
+            "requiredSince of 0 must be rejected (contract versions start at 1)"
+        );
+    }
+
+    #[test]
+    fn should_parse_required_since_reached_through_a_ref() {
+        // A `$ref`'d property resolves to its `$defs` entry before keywords
+        // are read, so an annotation hidden behind a reference is parsed
+        // exactly like a direct one — any validation that only scans raw
+        // property JSON would miss it, which is why the
+        // `requiredSince <= contract version` invariant is enforced on
+        // parsed properties (validate_required_since_within_contract_version)
+        let platform_version = PlatformVersion::latest();
+        let config =
+            DataContractConfig::default_for_version(platform_version).expect("config should build");
+
+        let schema_defs: BTreeMap<String, Value> = [(
+            "annotated".to_string(),
+            platform_value::to_value(json!({
+                "type": "string", "maxLength": 60, "requiredSince": 2
+            }))
+            .expect("defs should convert"),
+        )]
+        .into_iter()
+        .collect();
+
+        let schema = platform_value::to_value(json!({
+            "type": "object",
+            "properties": {
+                "a": {"type": "string", "position": 0, "maxLength": 60},
+                "b": {"$ref": "#/$defs/annotated", "position": 1},
+            },
+            "required": ["a", "b"],
+            "additionalProperties": false
+        }))
+        .expect("schema should convert");
+
+        let document_type = DocumentType::try_from_schema(
+            Identifier::random(),
+            0,
+            config.version(),
+            "msg",
+            schema,
+            Some(&schema_defs),
+            &BTreeMap::new(),
+            &config,
+            false,
+            &mut vec![],
+            platform_version,
+        )
+        .expect("should parse");
+
+        let properties = document_type.as_ref().flattened_properties().clone();
+        assert_eq!(properties.get("b").unwrap().required_since, Some(2));
+
+        // The parsed-property invariant check sees the annotation the raw
+        // JSON hides: version 1 (too old for requiredSince 2) rejects,
+        // version 2 accepts
+        let mut document_types = BTreeMap::new();
+        document_types.insert("msg".to_string(), document_type);
+
+        assert!(
+            validate_required_since_within_contract_version(&document_types, 1).is_err(),
+            "requiredSince 2 must be rejected on a version 1 contract even through $ref"
+        );
+        assert!(validate_required_since_within_contract_version(&document_types, 2).is_ok());
+    }
+
+    #[test]
+    fn should_ignore_required_since_on_platform_versions_predating_it() {
+        // Platform versions whose tables carry `apply_required_since: None`
+        // predate the keyword: even if it appears in a schema they parse
+        // (only possible without full validation — their meta-schemas reject
+        // it), they must ignore it and keep producing the plain required
+        // property they always produced.
+        let platform_version = PlatformVersion::get(13).expect("platform version 13 should exist");
+
+        let document_type = try_document_type_from_schema_on_version(
+            json!({
+                "type": "object",
+                "properties": {
+                    "a": {"type": "string", "position": 0, "maxLength": 60, "requiredSince": 3},
+                },
+                "required": ["a"],
+                "additionalProperties": false
+            }),
+            platform_version,
+        )
+        .expect("a parse predating requiredSince should ignore the keyword entirely");
+
+        let properties = document_type.as_ref().flattened_properties().clone();
+        assert_eq!(properties.get("a").unwrap().required_since, None);
+        assert!(properties.get("a").unwrap().required);
+    }
+    #[test]
+    fn should_reject_time_range_on_user_defined_property() {
+        // No user property type parses to a millisecond timestamp — `type:
+        // "string"` with `format: "date-time"` stays `String` — so a
+        // user-defined time-range source must be rejected rather than
+        // accepted as an index that could never bucket anything meaningful.
+        let err = try_document_type_from_schema_full_validation(json!({
+            "type": "object",
+            "properties": {
+                "eventAt": {
+                    "type": "string",
+                    "maxLength": 63,
+                    "position": 0
+                }
+            },
+            "indices": [
+                {
+                    "name": "byEventTime",
+                    "properties": [{ "eventAt": "asc" }],
+                    "timeRange": { "on": "eventAt", "range": 21_600u64, "step": 7_200u64 }
+                }
+            ],
+            "required": ["eventAt"],
+            "additionalProperties": false
+        }))
+        .expect_err("a user-defined time-range source must be rejected");
+
+        assert!(
+            err.to_string().contains("system timestamps"),
+            "expected the system-timestamp restriction, got: {err}"
+        );
+    }
+
+    #[test]
+    fn should_parse_time_range_on_required_system_timestamp() {
+        try_document_type_from_schema_full_validation(json!({
+            "type": "object",
+            "properties": {
+                "hashtag": {
+                    "type": "string",
+                    "maxLength": 63,
+                    "position": 0
+                }
+            },
+            "indices": [
+                {
+                    "name": "trending",
+                    "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                    "timeRange": { "on": "$createdAt", "range": 21_600u64, "step": 7_200u64 }
+                }
+            ],
+            "required": ["$createdAt", "hashtag"],
+            "additionalProperties": false
+        }))
+        .expect("a required system timestamp is the supported time-range source");
+    }
+
+    /// The overlap-factor cap is a versioned system limit
+    /// (`SystemLimits::max_time_range_overlap_factor`), enforced at
+    /// registration rather than at parse; both sides of the boundary are
+    /// pinned here through the versioned dispatch. 24 is a day-long window
+    /// sliding hourly — the natural worst case the cap is sized for.
+    #[test]
+    fn should_enforce_the_versioned_time_range_overlap_factor_cap() {
+        let time_range_schema = |range_seconds: u64| {
+            json!({
+                "type": "object",
+                "properties": {
+                    "hashtag": {
+                        "type": "string",
+                        "maxLength": 63,
+                        "position": 0
+                    }
+                },
+                "indices": [
+                    {
+                        "name": "trending",
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "timeRange": { "on": "$createdAt", "range": range_seconds, "step": 3_600u64 }
+                    }
+                ],
+                "required": ["$createdAt", "hashtag"],
+                "additionalProperties": false
+            })
+        };
+
+        try_document_type_from_schema_full_validation(time_range_schema(24 * 3_600))
+            .expect("an overlap factor at the cap must register");
+
+        let err = try_document_type_from_schema_full_validation(time_range_schema(25 * 3_600))
+            .expect_err("an overlap factor over the cap must be rejected at registration");
+        assert!(
+            err.to_string().contains("overlap factor"),
+            "expected the overlap-factor rejection, got: {err}"
+        );
+    }
+
+    #[test]
+    fn should_parse_unique_time_range_index_with_non_overlapping_windows_on_created_at() {
+        // "one report per author per day": `range == step` makes the buckets a
+        // partition, and `$createdAt` is immutable, which is exactly the pair
+        // of conditions a unique bucketed index needs. Asserted through the
+        // full-validation parse so the doctype-level checks (unique-index
+        // limit, required system timestamp) run too.
+        const ONE_DAY_SECONDS: u64 = 24 * 3_600;
+        let document_type = try_document_type_from_schema_full_validation(json!({
+            "type": "object",
+            "properties": {
+                "author": {
+                    "type": "string",
+                    "maxLength": 63,
+                    "position": 0
+                }
+            },
+            "indices": [
+                {
+                    "name": "dailyReport",
+                    "properties": [{ "$createdAt": "asc" }, { "author": "asc" }],
+                    "unique": true,
+                    "timeRange": { "on": "$createdAt", "range": ONE_DAY_SECONDS, "step": ONE_DAY_SECONDS }
+                }
+            ],
+            "required": ["$createdAt", "author"],
+            "additionalProperties": false
+        }))
+        .expect("a non-overlapping $createdAt bucketing may be unique");
+
+        let index = document_type
+            .as_ref()
+            .indexes()
+            .get("dailyReport")
+            .expect("the index should be registered")
+            .clone();
+        assert!(index.unique);
+        assert_eq!(
+            index
+                .time_range
+                .expect("the transform should survive the schema parse")
+                .overlap_factor(),
+            1
+        );
+    }
 }
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v0/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v0/mod.rs
index 686b8a42e76..fc41f482429 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v0/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v0/mod.rs
@@ -254,6 +254,7 @@ impl DocumentTypeV0 {
                 &mut document_properties,
                 &required_fields,
                 &transient_fields,
+                true,
                 property_key,
                 property_value,
                 &root_schema,
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v1/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v1/mod.rs
index 86107721e1f..53c6af29886 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v1/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v1/mod.rs
@@ -96,10 +96,16 @@ impl DocumentTypeV1 {
                 meta_schema_method_name: "DocumentTypeV1::try_from_schema (document_type_schema)",
                 // RANKED: generation 1 predates the ranked aggregates entirely
                 // — its index grammar has no `ranked*` keywords, and it
-                // therefore has no ranked key ceiling to enforce.
+                // therefore has no ranked key ceiling to enforce. Both
+                // admissions are always `false` below generation 3; see the
+                // shared mapping `IndexGrammarAdmissions::for_schema_generation`.
                 admit_ranked: false,
                 ranked_index_key_length_check: common::no_ranked_index_key_length_check,
                 ranked_index_structure_check: common::no_ranked_index_structure_check,
+                // TIME RANGE: also a generation-3 keyword; not in this grammar.
+                admit_time_range: false,
+                // INDEX ONLY: also a generation-3 keyword; not in this grammar.
+                admit_index_terminal: false,
             },
             platform_version,
         )
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/index_only_tests.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/index_only_tests.rs
new file mode 100644
index 00000000000..3a66c31bdc2
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/index_only_tests.rs
@@ -0,0 +1,580 @@
+//! indexOnly document types — parser-generation gating and the structural
+//! constraint matrix.
+//!
+//! The `indexOnly` doctype keyword and the `terminal` index keyword joined
+//! the grammar at generation 3 (meta-schema v3, protocol version 14), like
+//! the ranked keywords next door. The same two-sided gating has to hold on
+//! the pre-PV14 side:
+//!
+//!   * `terminal` (index-level, strict grammar): rejected as an unknown key
+//!     on BOTH validation modes below generation 3.
+//!   * `indexOnly` (doctype-level, loose grammar): ignored by earlier
+//!     generations on the non-validating path — exactly how every
+//!     doctype-level keyword they predate behaves — and rejected by their
+//!     meta-schemas under `full_validation`.
+//!
+//! The constraint matrix itself (`apply_index_only`) runs regardless of
+//! `full_validation` because the on-disk layout depends on it, so every
+//! rejection test here goes through the non-validating parse — the
+//! smuggling path — and the happy path is additionally exercised under full
+//! validation to pin the meta-schema admission.
+
+use super::*;
+use crate::data_contract::document_type::accessors::DocumentTypeV2Getters;
+use crate::data_contract::errors::DataContractError;
+use platform_value::platform_value;
+
+/// Parse through this generation with validation mode spelled out.
+fn parse_with(
+    schema: Value,
+    platform_version: &PlatformVersion,
+    full_validation: bool,
+) -> Result<DocumentTypeV2, ProtocolError> {
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("default config available on this platform version");
+    try_from_schema_generation_3(
+        Identifier::new([1; 32]),
+        1,
+        config.version(),
+        "like",
+        schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        full_validation,
+        &mut vec![],
+        platform_version,
+    )
+}
+
+/// Parse through the real dispatcher, which picks the parser generation out
+/// of the platform version's `try_from_schema` table value (generation 2 at
+/// PV13, generation 3 at PV14).
+fn parse_dispatched(
+    schema: Value,
+    platform_version: &PlatformVersion,
+    full_validation: bool,
+) -> Result<DocumentType, ProtocolError> {
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("default config available on this platform version");
+    DocumentType::try_from_schema(
+        Identifier::new([1; 32]),
+        1,
+        config.version(),
+        "like",
+        schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        full_validation,
+        &mut vec![],
+        platform_version,
+    )
+}
+
+/// The worked example from the design: a Yappr-style `like` type. Two
+/// schema properties (`hashtag`, `postId` — the latter a refersTo-typed
+/// identifier), three indexes:
+///
+///   * `byHashtagPost` — ranked per-hashtag top posts, terminal `$ownerId`
+///   * `byPost` — global ranking + one-like-per-(post, owner) constraint;
+///     terminal omitted to exercise the `$ownerId` default
+///   * `byLiker` — "what did I like", `$ownerId` prefix, `postId` terminal
+fn likes_schema() -> Value {
+    platform_value!({
+        "type": "object",
+        "indexOnly": true,
+        "documentsMutable": false,
+        "properties": {
+            "hashtag": {
+                "type": "string",
+                "maxLength": 63,
+                "position": 0
+            },
+            "postId": {
+                "type": "array",
+                "byteArray": true,
+                "minItems": 32,
+                "maxItems": 32,
+                "contentMediaType": "application/x.dash.dpp.identifier",
+                "refersTo": { "type": "identity" },
+                "position": 1
+            }
+        },
+        "required": ["hashtag", "postId"],
+        "indices": [
+            {
+                "name": "byHashtagPost",
+                "properties": [{ "hashtag": "asc" }, { "postId": "asc" }],
+                "terminal": "$ownerId",
+                "countable": true,
+                "rangeCountable": true,
+                "rankedCountable": true
+            },
+            {
+                "name": "byPost",
+                "properties": [{ "postId": "asc" }],
+                "countable": true,
+                "rangeCountable": true,
+                "rankedCountable": true
+            },
+            {
+                "name": "byLiker",
+                "properties": [{ "$ownerId": "asc" }],
+                "terminal": "postId"
+            }
+        ],
+        "additionalProperties": false
+    })
+}
+
+/// The base schema with one doctype-level key set (added or replaced).
+fn likes_schema_with(key: &str, value: Value) -> Value {
+    let mut schema = likes_schema();
+    schema.set_value(key, value).expect("doctype key applies");
+    schema
+}
+
+/// The base schema with one key set (added or replaced) on the index at
+/// `index_position` (0 = byHashtagPost, 1 = byPost, 2 = byLiker).
+fn likes_schema_with_index_key(index_position: usize, key: &str, value: Value) -> Value {
+    let mut schema = likes_schema();
+    schema
+        .get_mut("indices")
+        .expect("indices accessible")
+        .expect("indices present")
+        .as_array_mut()
+        .expect("indices is an array")
+        .get_mut(index_position)
+        .expect("index exists")
+        .set_value(key, value)
+        .expect("index key applies");
+    schema
+}
+
+fn expect_structure_error(result: Result<DocumentTypeV2, ProtocolError>, needle: &str) {
+    match result {
+        Err(ProtocolError::DataContractError(DataContractError::InvalidContractStructure(
+            message,
+        ))) => {
+            assert!(
+                message.contains(needle),
+                "expected structure error containing {needle:?}, got: {message}"
+            );
+        }
+        Err(other) => {
+            panic!("expected InvalidContractStructure containing {needle:?}, got {other}")
+        }
+        Ok(_) => panic!("expected rejection containing {needle:?}, but the schema parsed"),
+    }
+}
+
+// ── the happy path ──────────────────────────────────────────────────────
+
+#[test]
+fn likes_schema_parses_on_both_validation_modes() {
+    let platform_version = PlatformVersion::latest();
+
+    for full_validation in [false, true] {
+        let document_type = parse_with(likes_schema(), platform_version, full_validation)
+            .unwrap_or_else(|error| {
+                panic!("likes schema should parse (full_validation: {full_validation}): {error}")
+            });
+
+        assert!(document_type.index_only());
+        assert!(!document_type.documents_mutable);
+        assert_eq!(document_type.indices.len(), 3);
+    }
+}
+
+#[test]
+fn terminal_defaults_to_owner_id() {
+    let document_type =
+        parse_with(likes_schema(), PlatformVersion::latest(), false).expect("should parse");
+
+    // `byPost` omits its terminal; normalization spells it out, so the
+    // omitted and explicit forms parse to equal indexes.
+    assert_eq!(
+        document_type.indices["byPost"].terminal.as_deref(),
+        Some("$ownerId")
+    );
+    assert_eq!(
+        document_type.indices["byHashtagPost"].terminal.as_deref(),
+        Some("$ownerId")
+    );
+    assert_eq!(
+        document_type.indices["byLiker"].terminal.as_deref(),
+        Some("postId")
+    );
+}
+
+// ── doctype-level constraint matrix (non-validating parse: the checks are
+//    structural, not meta-schema lints) ─────────────────────────────────
+
+#[test]
+fn rejects_mutable_documents() {
+    let schema = likes_schema_with("documentsMutable", Value::Bool(true));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "documentsMutable: false",
+    );
+}
+
+#[test]
+fn rejects_transferable_documents() {
+    let schema = likes_schema_with("transferable", Value::U8(1));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "must not be transferable",
+    );
+}
+
+#[test]
+fn rejects_keep_history() {
+    let schema = likes_schema_with("documentsKeepHistory", Value::Bool(true));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "cannot keep history",
+    );
+}
+
+#[test]
+fn rejects_transient_properties() {
+    let schema = likes_schema_with("transient", platform_value!(["hashtag"]));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "transient",
+    );
+}
+
+#[test]
+fn rejects_doctype_level_aggregates() {
+    let schema = likes_schema_with("documentsCountable", Value::Bool(true));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "doctype-level aggregate keywords",
+    );
+}
+
+#[test]
+fn rejects_missing_indices() {
+    let schema = likes_schema_with("indices", platform_value!([]));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "at least one index",
+    );
+}
+
+// ── per-index constraint matrix ─────────────────────────────────────────
+
+#[test]
+fn rejects_unique_indexes() {
+    let schema = likes_schema_with_index_key(2, "unique", Value::Bool(true));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "cannot be unique",
+    );
+}
+
+#[test]
+fn rejects_null_searchable_false() {
+    let schema = likes_schema_with_index_key(2, "nullSearchable", Value::Bool(false));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "nullSearchable",
+    );
+}
+
+#[test]
+fn rejects_sum_axes() {
+    // The summable declaration itself has to survive the aggregate
+    // cross-checks (integer type, required) so that the indexOnly-specific
+    // rejection is the one that fires.
+    let mut schema = likes_schema_with_index_key(2, "summable", platform_value!("likeWeight"));
+    schema
+        .get_mut("properties")
+        .expect("properties accessible")
+        .expect("properties present")
+        .set_value(
+            "likeWeight",
+            platform_value!({ "type": "integer", "minimum": 0, "maximum": 100, "position": 2 }),
+        )
+        .expect("property applies");
+    schema
+        .set_value(
+            "required",
+            platform_value!(["hashtag", "postId", "likeWeight"]),
+        )
+        .expect("required applies");
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "sum axes",
+    );
+}
+
+#[test]
+fn rejects_terminal_repeating_an_index_property() {
+    // byLiker's prefix is [$ownerId]; making $ownerId its terminal too
+    // indexes the same dimension twice.
+    let schema = likes_schema_with_index_key(2, "terminal", platform_value!("$ownerId"));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "repeats its terminal",
+    );
+}
+
+#[test]
+fn rejects_terminal_without_refers_to() {
+    // `hashtag` is a plain string — not `$ownerId`, not a refersTo-typed
+    // identifier — so it cannot be a member key.
+    let schema = likes_schema_with_index_key(2, "terminal", platform_value!("hashtag"));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "refersTo",
+    );
+}
+
+#[test]
+fn rejects_terminal_naming_unknown_property() {
+    let schema = likes_schema_with_index_key(2, "terminal", platform_value!("nonsense"));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "does not name a property",
+    );
+}
+
+#[test]
+fn rejects_disallowed_system_properties_in_prefix() {
+    let schema =
+        likes_schema_with_index_key(2, "properties", platform_value!([{ "$updatedAt": "asc" }]));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "$ownerId and $createdAt",
+    );
+}
+
+#[test]
+fn accepts_created_at_in_prefix_when_required() {
+    // `$createdAt` is assigned from block time at create (only when it is
+    // required — which indexing it therefore demands) and recoverable from
+    // the entry path — the one system property besides `$ownerId` an
+    // indexOnly index may carry.
+    let mut schema = likes_schema_with_index_key(
+        2,
+        "properties",
+        platform_value!([{ "$ownerId": "asc" }, { "$createdAt": "asc" }]),
+    );
+    schema
+        .set_value(
+            "required",
+            platform_value!(["hashtag", "postId", "$createdAt"]),
+        )
+        .expect("required applies");
+    parse_with(schema, PlatformVersion::latest(), false)
+        .expect("$createdAt in an index prefix should be accepted when required");
+}
+
+#[test]
+fn rejects_indexed_created_at_that_is_not_required() {
+    // Document creation assigns `created_at` only for a REQUIRED
+    // $createdAt; indexing an unrequired one would silently take the
+    // missing-value branch instead of storing block time.
+    let schema = likes_schema_with_index_key(
+        2,
+        "properties",
+        platform_value!([{ "$ownerId": "asc" }, { "$createdAt": "asc" }]),
+    );
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "\"$createdAt\" must be listed in `required`",
+    );
+}
+
+#[test]
+fn rejects_identity_public_key_reference_terminals() {
+    // identityPublicKey is a compound reference (identity id here, key id
+    // in a companion property) — the member key alone cannot identify the
+    // referenced key, so it is not a legal terminal.
+    let mut schema = likes_schema_with_index_key(2, "terminal", platform_value!("keyRef"));
+    schema
+        .get_mut("properties")
+        .expect("properties accessible")
+        .expect("properties present")
+        .set_value(
+            "keyRef",
+            platform_value!({
+                "type": "array",
+                "byteArray": true,
+                "minItems": 32,
+                "maxItems": 32,
+                "contentMediaType": "application/x.dash.dpp.identifier",
+                "refersTo": { "type": "identityPublicKey", "keyIdProperty": "keyId" },
+                "position": 2
+            }),
+        )
+        .expect("property applies");
+    schema
+        .get_mut("properties")
+        .expect("properties accessible")
+        .expect("properties present")
+        .set_value(
+            "keyId",
+            platform_value!({ "type": "integer", "minimum": 0, "maximum": 100, "position": 3 }),
+        )
+        .expect("property applies");
+    schema
+        .set_value(
+            "required",
+            platform_value!(["hashtag", "postId", "keyRef", "keyId"]),
+        )
+        .expect("required applies");
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "identityPublicKey",
+    );
+}
+
+#[test]
+fn rejects_owner_less_indexes() {
+    // Every index must be bound to its owner: an owner-less index would
+    // let a crafted delete splice a victim's row in with the signer's own
+    // owner-bearing row.
+    let schema =
+        likes_schema_with_index_key(2, "properties", platform_value!([{ "hashtag": "asc" }]));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "must include $ownerId",
+    );
+}
+
+// ── coverage, requiredness, ownership ───────────────────────────────────
+
+#[test]
+fn rejects_unindexed_property() {
+    // Drop the compound index entirely: `hashtag` then appears in no
+    // index and would be silently unrecoverable.
+    let schema = likes_schema_with(
+        "indices",
+        platform_value!([
+            {
+                "name": "byPost",
+                "properties": [{ "postId": "asc" }],
+                "countable": true,
+                "rangeCountable": true,
+                "rankedCountable": true
+            },
+            {
+                "name": "byLiker",
+                "properties": [{ "$ownerId": "asc" }],
+                "terminal": "postId"
+            }
+        ]),
+    );
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "does not appear in any index",
+    );
+}
+
+#[test]
+fn rejects_optional_property() {
+    let schema = likes_schema_with("required", platform_value!(["postId"]));
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "must be listed in `required`",
+    );
+}
+
+#[test]
+fn rejects_missing_owner_id() {
+    // An index carrying no $ownerId anywhere is refused outright — every
+    // entry must be self-authorizing for deletes.
+    let schema = likes_schema_with(
+        "indices",
+        platform_value!([
+            {
+                "name": "byHashtag",
+                "properties": [{ "hashtag": "asc" }],
+                "terminal": "postId"
+            }
+        ]),
+    );
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "must include $ownerId",
+    );
+}
+
+// ── terminal without indexOnly ──────────────────────────────────────────
+
+#[test]
+fn rejects_terminal_on_non_index_only_type() {
+    let mut schema = likes_schema();
+    schema
+        .remove_optional_value("indexOnly")
+        .expect("removal applies");
+    // Without indexOnly the doctype-flag constraints don't apply, but the
+    // dangling `terminal` declarations must be rejected.
+    expect_structure_error(
+        parse_with(schema, PlatformVersion::latest(), false),
+        "declares `terminal`",
+    );
+}
+
+// ── cross-generation gating ─────────────────────────────────────────────
+
+#[test]
+fn terminal_keyword_is_rejected_below_generation_3_on_both_modes() {
+    let platform_version_13 = PlatformVersion::get(13).expect("PV13 exists");
+
+    for full_validation in [false, true] {
+        let result = parse_dispatched(likes_schema(), platform_version_13, full_validation);
+        assert!(
+            result.is_err(),
+            "PV13 must reject the likes schema (full_validation: {full_validation}): \
+             `terminal` is not part of generation 2's index grammar"
+        );
+    }
+}
+
+#[test]
+fn index_only_keyword_is_inert_below_generation_3_without_validation() {
+    let platform_version_13 = PlatformVersion::get(13).expect("PV13 exists");
+
+    // A doctype-level `indexOnly` with no `terminal` keywords: generation 2
+    // ignores unknown doctype keys on the non-validating path — exactly how
+    // it treats every keyword it predates — so the parse succeeds and the
+    // flag is NOT set.
+    let mut schema = likes_schema();
+    for index_value in schema
+        .get_mut("indices")
+        .expect("indices accessible")
+        .expect("indices present")
+        .as_array_mut()
+        .expect("indices is an array")
+    {
+        // Strip the generation-3 index grammar so only `indexOnly` remains.
+        let _ = index_value.remove_optional_value("terminal");
+        let _ = index_value.remove_optional_value("rankedCountable");
+    }
+
+    let document_type = parse_dispatched(schema.clone(), platform_version_13, false)
+        .expect("generation 2 ignores unknown doctype-level keywords when not validating");
+    assert!(
+        !document_type.index_only(),
+        "generation 2 must not set index_only"
+    );
+
+    // Under full validation the v2 meta-schema rejects the unknown key.
+    assert!(
+        parse_dispatched(schema, platform_version_13, true).is_err(),
+        "meta-schema v2 must reject the indexOnly keyword"
+    );
+}
+
+#[test]
+fn index_only_flag_survives_the_dispatcher_at_latest() {
+    let document_type = parse_dispatched(likes_schema(), PlatformVersion::latest(), true)
+        .expect("likes schema parses through the dispatcher at PV14");
+    assert!(document_type.index_only());
+}
diff --git a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/mod.rs b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/mod.rs
index 1f449468155..749d9b55ea9 100644
--- a/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/class_methods/try_from_schema/v3/mod.rs
@@ -15,9 +15,10 @@
 //! index-key length ceilings, and the constants they are derived from.
 
 use crate::data_contract::config::DataContractConfig;
-// Only the ranked key-length rule below names these, and it is validation-only.
+// Only the ranked key-length rule below names `Index`, and it is validation-only.
 #[cfg(feature = "validation")]
 use crate::data_contract::document_type::index::Index;
+use crate::data_contract::document_type::index::IndexGrammarAdmissions;
 #[cfg(feature = "validation")]
 use crate::data_contract::document_type::property::DocumentPropertyType;
 use crate::data_contract::document_type::v2::DocumentTypeV2;
@@ -225,8 +226,10 @@ fn try_from_schema_generation_3(
     validation_operations: &mut impl Extend<ProtocolValidationOperation>,
     platform_version: &PlatformVersion,
 ) -> Result<DocumentTypeV2, ProtocolError> {
-    // Read the aggregate keywords before the core parser consumes `schema`.
+    // Read the aggregate and indexOnly keywords before the core parser
+    // consumes `schema`.
     let aggregates = common::parse_doctype_aggregate_keywords(&schema, name)?;
+    let index_only = common::parse_index_only_keyword(&schema)?;
 
     let v1 = common::parse_document_type_core(
         data_contract_id,
@@ -255,16 +258,27 @@ fn try_from_schema_generation_3(
             // generation is far past that boundary.
             admit_count_indexes: true,
             meta_schema_method_name: "DocumentType::try_from_schema_v3 (document_type_schema)",
-            // RANKED: the constants that make this generation 3.
-            admit_ranked: true,
+            // RANKED / TIME RANGE: the keyword admissions that make this
+            // generation 3, read from the shared generation → admission
+            // mapping so the registration-cost re-parse can never drift
+            // from what this parser accepts.
+            admit_ranked: IndexGrammarAdmissions::for_schema_generation(3).ranked,
             ranked_index_key_length_check: RANKED_INDEX_KEY_LENGTH_CHECK,
             ranked_index_structure_check: validate_no_ranked_prefix_overlap,
+            admit_time_range: IndexGrammarAdmissions::for_schema_generation(3).time_range,
+            // INDEX ONLY: the `terminal` index keyword, admitted from the
+            // same shared generation → admission mapping as the two above.
+            admit_index_terminal: IndexGrammarAdmissions::for_schema_generation(3).terminal,
         },
         platform_version,
     )?;
 
     let mut v2: DocumentTypeV2 = v1.into();
     common::apply_doctype_aggregates(&mut v2, aggregates, name)?;
+    // After the aggregates: `apply_index_only` rejects the doctype-level
+    // aggregate flags (they describe the primary-key tree, which an
+    // indexOnly type does not have), so it has to see them already applied.
+    common::apply_index_only(&mut v2, index_only, name)?;
 
     Ok(v2)
 }
@@ -302,6 +316,9 @@ impl DocumentType {
     }
 }
 
+#[cfg(test)]
+mod index_only_tests;
+
 #[cfg(test)]
 mod tests {
     //! Ranked aggregate index keywords — parser-generation gating.
diff --git a/packages/rs-dpp/src/data_contract/document_type/index/mod.rs b/packages/rs-dpp/src/data_contract/document_type/index/mod.rs
index 2f099c93014..6d69b1d1ba3 100644
--- a/packages/rs-dpp/src/data_contract/document_type/index/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/index/mod.rs
@@ -15,6 +15,7 @@ use crate::data_contract::errors::DataContractError;
 use crate::ProtocolError;
 use anyhow::anyhow;
 
+use crate::data_contract::document_type::property_names;
 use crate::data_contract::document_type::ContestedIndexResolution::MasternodeVote;
 #[cfg(feature = "validation")]
 use crate::data_contract::errors::DataContractError::RegexError;
@@ -25,6 +26,9 @@ use std::sync::OnceLock;
 use std::{collections::BTreeMap, convert::TryFrom};
 
 pub mod random_index;
+pub mod time_range;
+
+pub use time_range::TimeRangeTransform;
 
 /// Index-level keyword opting the index's terminal property-name tree into the
 /// **Count** ranking axis: an ordered secondary tree keyed by each group's
@@ -46,6 +50,34 @@ pub const RANKED_SUMMABLE: &str = "rankedSummable";
 /// costs its own secondary tree, so `rankedAverageable` adds the Avg axis and
 /// nothing else.
 pub const RANKED_AVERAGEABLE: &str = "rankedAverageable";
+/// Index-level keyword bucketing the index's first property (a millisecond
+/// timestamp) into fixed-length, regularly-spaced, possibly overlapping time
+/// ranges whose window is declared in seconds; a document is indexed under
+/// every range containing its timestamp. See [`TimeRangeTransform`].
+/// Meta-schema v3+ (protocol version 14).
+pub const TIME_RANGE: &str = "timeRange";
+/// Upper bound (exclusive) on `timeRange.phase`, in seconds: one 365-day
+/// year. The phase aligns window boundaries within one step, and combined
+/// with `phase < step` this cap is what makes the uncovered region before
+/// the grid's first bucket (`[0, phase)` on the millisecond timeline)
+/// unreachable: it stays strictly inside 1970–1971, decades before any
+/// Platform block time, so a required system timestamp — which consensus
+/// validates against block time — can never fall outside every window.
+/// Without the cap, a sub-step phase on a huge step could sit years in the
+/// future, silently unindexing valid documents and bypassing unique
+/// time-range constraints until it passed. A structural rule (like
+/// `range % step == 0`), not a versioned limit: it is part of what makes a
+/// transform well-formed at all.
+pub const MAX_TIME_RANGE_PHASE_SECONDS: u64 = 31_536_000;
+/// Index-level keyword naming the property whose value is the index entry's
+/// **member key** on an `indexOnly` document type — the docId-analog terminal
+/// key stored under the `0` storage marker, where a normal index stores the
+/// document id. `"$ownerId"` (the default) or a refersTo-typed identifier
+/// property (identity, contract, token, or permanent document — the permanent
+/// kinds `refersTo` targets). Only allowed on indexOnly document types; the
+/// doc-type-level validation rejects it elsewhere. Meta-schema v3+ (protocol
+/// version 14).
+pub const TERMINAL: &str = "terminal";
 
 #[repr(u8)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Ord, PartialOrd)]
@@ -476,6 +508,92 @@ pub struct Index {
     /// `book/src/drive/ranked-index-examples.md` for the worked example.
     #[cfg_attr(feature = "serde-conversion", serde(default))]
     pub ranked_averageable: bool,
+    /// When set, the index's first property is a timestamp that is bucketed
+    /// into fixed-length, regularly-spaced (possibly overlapping) time
+    /// ranges. The stored key for that property is the range *start* (a
+    /// `u64` millisecond timestamp), and a single document is indexed under
+    /// every range whose window contains its timestamp. See
+    /// [`TimeRangeTransform`]. The named source must be this index's first
+    /// property. Part of the meta-schema-v3 grammar (protocol version 14 and
+    /// later).
+    //
+    // `serde(default)`: same reasoning as the ranked axes above — the key was
+    // added after the struct's serde shape was in the wild, so pre-existing
+    // JSON must still deserialize.
+    #[cfg_attr(feature = "serde-conversion", serde(default))]
+    pub time_range: Option<TimeRangeTransform>,
+    /// On an `indexOnly` document type, the property whose value is this
+    /// index's member key: the terminal key under the `0` storage marker,
+    /// sitting exactly where a normal index stores the document id — except
+    /// the element is an `Item` instead of a `Reference`, because there is no
+    /// primary-storage row to reference. `"$ownerId"` or a refersTo-typed
+    /// identifier property; the doc-type-level validation
+    /// (`apply_index_only`) normalizes an omitted value to `"$ownerId"` and
+    /// rejects the keyword entirely on non-indexOnly document types, so on a
+    /// parsed non-indexOnly type this is always `None`.
+    //
+    // `serde(default)`: added after the struct's serde shape was in the wild
+    // (see the note on `countable` above), so pre-existing JSON must still
+    // deserialize.
+    #[cfg_attr(feature = "serde-conversion", serde(default))]
+    pub terminal: Option<String>,
+}
+
+/// Which grammar keywords a document meta-schema generation admits for
+/// indexes — the single source of the generation → admission mapping.
+/// Both consumers of [`Index::try_from_value_map`]'s admission flags read
+/// it: the schema parsers (`try_from_schema`'s per-generation modules)
+/// and the registration-cost re-parse. Deriving the flags anywhere else
+/// invites the two to drift, and then an index the validator parses is
+/// billed nothing (or a rejected one is billed).
+#[derive(Clone, Copy)]
+pub(crate) struct IndexGrammarAdmissions {
+    /// The `ranked*` keyword family (generation 3 and later).
+    pub(crate) ranked: bool,
+    /// The `timeRange` keyword (generation 3 and later).
+    pub(crate) time_range: bool,
+    /// The `terminal` keyword (indexOnly document types; generation 3 and
+    /// later).
+    pub(crate) terminal: bool,
+}
+
+impl IndexGrammarAdmissions {
+    /// The admissions for a `document_type_schema` generation. The two
+    /// flags currently move together; they stay separate fields because
+    /// they are separate grammar admissions — a future generation may
+    /// admit one without the other, and then only this mapping changes.
+    pub(crate) fn for_schema_generation(generation: u16) -> Self {
+        Self {
+            ranked: generation >= 3,
+            time_range: generation >= 3,
+            terminal: generation >= 3,
+        }
+    }
+}
+
+/// Whether two values of a bucketed timestamp property occupy a common
+/// index slot. The stored key for such a property is the bucket *start*,
+/// so two different timestamps conflict exactly when they share a
+/// containing bucket (a validated unique time-range index has overlap
+/// factor 1, so each timestamp has at most one). An epoch-sliver
+/// timestamp produces no index entries and so shares no slot; a
+/// non-timestamp value is stored under its raw key, so raw equality
+/// applies.
+fn bucketed_timestamps_conflict(
+    transform: &TimeRangeTransform,
+    value1: &Value,
+    value2: &Value,
+) -> bool {
+    match (value1.as_integer::<u64>(), value2.as_integer::<u64>()) {
+        (Some(timestamp1), Some(timestamp2)) => {
+            let buckets2 = transform.containing_buckets(timestamp2);
+            transform
+                .containing_buckets(timestamp1)
+                .iter()
+                .any(|bucket| buckets2.contains(bucket))
+        }
+        _ => value1 == value2,
+    }
 }
 
 impl Index {
@@ -492,7 +610,12 @@ impl Index {
             let Some(value2) = Value::get_optional_from_map(object2, property.name.as_str()) else {
                 return false;
             };
-            value1 == value2
+            match self.time_range.as_ref() {
+                Some(transform) if property.name == transform.source => {
+                    bucketed_timestamps_conflict(transform, value1, value2)
+                }
+                _ => value1 == value2,
+            }
         })
     }
     /// The field names of the index
@@ -503,6 +626,37 @@ impl Index {
             .collect()
     }
 
+    /// The GroveDB index-level key for `property_name` at `position` in this
+    /// index's property list. The first property of a time-range index is
+    /// keyed by [`TimeRangeTransform::storage_key`] — the name qualified with
+    /// the grid, so several grids over one timestamp fork into sibling
+    /// subtrees; every other property keeps its bare name.
+    ///
+    /// Every place that turns this index's properties into GroveDB path
+    /// segments — contract setup, the document walkers (via `IndexLevel`,
+    /// which stores these same keys), query path derivation, the uniqueness
+    /// probe and proof verification — must derive the segment through this
+    /// rule, or one logical index splits into two trees.
+    pub fn level_key(&self, position: usize, property_name: &str) -> String {
+        match (&self.time_range, position) {
+            (Some(transform), 0) => transform.storage_key(property_name),
+            _ => property_name.to_string(),
+        }
+    }
+
+    /// Name-keyed variant of [`Self::level_key`] for callers that hold a
+    /// property name rather than its position: the transform's source is
+    /// validated to be the index's first property, so matching the name
+    /// against `time_range.source` identifies the grid-qualified level.
+    pub fn level_key_for_property(&self, property_name: &str) -> String {
+        match &self.time_range {
+            Some(transform) if transform.source == property_name => {
+                transform.storage_key(property_name)
+            }
+            _ => property_name.to_string(),
+        }
+    }
+
     /// Get values
     pub fn extract_values(&self, data: &BTreeMap<String, Value>) -> Vec<Value> {
         self.properties
@@ -644,7 +798,14 @@ impl TryFrom<&[(Value, Value)]> for Index {
     /// `document_type_schema` version must go through
     /// [`Index::try_from_value_map`] instead so PV14+ contracts can use them.
     fn try_from(index_type_value_map: &[(Value, Value)]) -> Result<Self, Self::Error> {
-        Index::try_from_value_map(index_type_value_map, false)
+        Index::try_from_value_map(
+            index_type_value_map,
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: false,
+                terminal: false,
+            },
+        )
     }
 }
 
@@ -663,10 +824,24 @@ impl Index {
     /// The meta-schema is the other half of this gate — v2 rejects the keys via
     /// `additionalProperties: false` — but it only runs under
     /// `full_validation`, which is why the grammar itself is version-gated too.
-    pub fn try_from_value_map(
+    ///
+    /// `time_range_allowed` gates the `timeRange` keyword exactly the same
+    /// way: it also joined the grammar at meta-schema v3 (protocol version
+    /// 14). The flags are separate parameters because they are separate
+    /// grammar admissions — a future generation may admit one without the
+    /// other.
+    ///
+    /// `terminal_allowed` gates the `terminal` keyword (indexOnly document
+    /// types), which also joined the grammar at meta-schema v3.
+    pub(crate) fn try_from_value_map(
         index_type_value_map: &[(Value, Value)],
-        ranked_aggregates_allowed: bool,
+        admissions: IndexGrammarAdmissions,
     ) -> Result<Self, DataContractError> {
+        let IndexGrammarAdmissions {
+            ranked: ranked_aggregates_allowed,
+            time_range: time_range_allowed,
+            terminal: terminal_allowed,
+        } = admissions;
         // Decouple the map
         // It contains properties and a unique key
         // If the unique key is absent, then unique is false
@@ -719,6 +894,8 @@ impl Index {
         let mut ranked_countable = false;
         let mut ranked_summable = false;
         let mut ranked_averageable = false;
+        let mut time_range: Option<TimeRangeTransform> = None;
+        let mut terminal: Option<String> = None;
 
         for (key_value, value_value) in index_type_value_map {
             let key = key_value.to_str()?;
@@ -974,6 +1151,112 @@ impl Index {
                                 "rankedAverageable value must be a boolean".to_string(),
                             ))?;
                 }
+                // `timeRange` is guarded the same way as the ranking keywords
+                // above: it joined the grammar at meta-schema v3, so below
+                // that the key falls through to the unknown-property arm.
+                TIME_RANGE if time_range_allowed => {
+                    let time_range_map =
+                        value_value
+                            .as_map()
+                            .ok_or(DataContractError::ValueWrongType(
+                                "timeRange value should be a map".to_string(),
+                            ))?;
+
+                    let mut source: Option<String> = None;
+                    let mut range_seconds: Option<u64> = None;
+                    let mut step_seconds: Option<u64> = None;
+                    let mut phase_seconds: u64 = 0;
+
+                    for (tr_key_value, tr_value) in time_range_map {
+                        let tr_key = tr_key_value
+                            .to_str()
+                            .map_err(|e| DataContractError::ValueDecodingError(e.to_string()))?;
+                        match tr_key {
+                            "on" => {
+                                source = Some(
+                                    tr_value
+                                        .as_text()
+                                        .ok_or(DataContractError::ValueWrongType(
+                                            "timeRange.on should be a string".to_string(),
+                                        ))?
+                                        .to_owned(),
+                                );
+                            }
+                            "range" => {
+                                range_seconds = Some(tr_value.to_integer().map_err(|_| {
+                                    DataContractError::ValueWrongType(
+                                        "timeRange.range should be an integer".to_string(),
+                                    )
+                                })?);
+                            }
+                            "step" => {
+                                step_seconds = Some(tr_value.to_integer().map_err(|_| {
+                                    DataContractError::ValueWrongType(
+                                        "timeRange.step should be an integer".to_string(),
+                                    )
+                                })?);
+                            }
+                            "phase" => {
+                                phase_seconds = tr_value.to_integer().map_err(|_| {
+                                    DataContractError::ValueWrongType(
+                                        "timeRange.phase should be an integer".to_string(),
+                                    )
+                                })?;
+                            }
+                            other => {
+                                return Err(DataContractError::InvalidContractStructure(format!(
+                                    "unexpected timeRange field: {}",
+                                    other
+                                )));
+                            }
+                        }
+                    }
+
+                    let source = source.ok_or(DataContractError::InvalidContractStructure(
+                        "timeRange requires an `on` field naming the source timestamp property"
+                            .to_string(),
+                    ))?;
+                    let range_seconds =
+                        range_seconds.ok_or(DataContractError::InvalidContractStructure(
+                            "timeRange requires a `range` field (range length in seconds)"
+                                .to_string(),
+                        ))?;
+                    let step_seconds =
+                        step_seconds.ok_or(DataContractError::InvalidContractStructure(
+                            "timeRange requires a `step` field (interval between range starts in \
+                             seconds)"
+                                .to_string(),
+                        ))?;
+
+                    time_range = Some(TimeRangeTransform {
+                        source,
+                        range_seconds,
+                        step_seconds,
+                        phase_seconds,
+                    });
+                }
+                // `terminal` is guarded the same way as the ranking keywords
+                // above: it joined the grammar at meta-schema v3, so below
+                // that the key falls through to the unknown-property arm.
+                // Whether the declaring document type is actually indexOnly —
+                // the only place the keyword is legal — is a doc-type-level
+                // fact this parser cannot see; `apply_index_only` in
+                // `try_from_schema::common` enforces it.
+                TERMINAL if terminal_allowed => {
+                    let terminal_name =
+                        value_value
+                            .as_text()
+                            .ok_or(DataContractError::ValueWrongType(
+                                "terminal value must be a string naming a property".to_string(),
+                            ))?;
+                    if terminal_name.is_empty() {
+                        return Err(DataContractError::InvalidContractStructure(
+                            "terminal must name a property; an empty string names nothing"
+                                .to_string(),
+                        ));
+                    }
+                    terminal = Some(terminal_name.to_owned());
+                }
                 "properties" => {
                     let properties =
                         value_value
@@ -1188,7 +1471,8 @@ impl Index {
         // `identityId` value — each ordering that identity's `class` groups
         // by the group aggregate. There is deliberately no global
         // cross-prefix ordering; the query surfaces require every leading
-        // property to be pinned by an equality `where` clause.
+        // property to be pinned by a `where` clause (`==`, at most one of
+        // them a bounded `IN` whose branches are merged client-visibly).
         //
         // One compound shape stays structurally impossible and is rejected
         // per document type (all indexes are needed to see it): a compound
@@ -1221,6 +1505,192 @@ impl Index {
             ));
         }
 
+        // A time-range transform buckets the index's *first* property. Validate
+        // the structural constraints that don't need document-type context here
+        // (the source must be a timestamp/Date field — which does need the
+        // schema — is checked in `try_from_schema`). Uniqueness is admitted
+        // only for the narrow shape where it has a meaning: non-overlapping
+        // windows over an immutable timestamp.
+        if let Some(transform) = &time_range {
+            // Uniqueness and bucketing only compose when the windows
+            // *partition* time. With `range == step` (overlap factor 1) every
+            // document lands in exactly one bucket, so "at most one document
+            // per window per remaining key tuple" is a coherent constraint —
+            // one report per author per day. With `range > step` a single
+            // document is indexed under `range / step` bucket keys at once, so
+            // it would occupy the unique slot of several windows while two
+            // documents with different timestamps would collide in the windows
+            // they happen to share: there is no constraint left to enforce.
+            //
+            // Compared before the zero-step / multiple checks below because it
+            // only reads the declared numbers; a malformed transform still
+            // gets its own, more specific rejection there.
+            if unique && transform.range_seconds != transform.step_seconds {
+                return Err(DataContractError::InvalidContractStructure(
+                    "a timeRange index cannot be unique unless range equals step \
+                     (non-overlapping windows): with overlapping ranges one document is indexed \
+                     under several bucket keys at once, which uniqueness cannot express"
+                        .to_string(),
+                ));
+            }
+            // Non-overlapping windows are still only safe over an *immutable*
+            // source. Uniqueness validation probes the bucket the candidate
+            // document's timestamp falls into and leans on `allow_original`:
+            // a document may keep occupying its own slot unless one of the
+            // index's values changed, in which case the tuple moved and the
+            // new one must be free. `$createdAt` never changes across a
+            // revision, so the bucket component is fixed and the tuple can
+            // only move through the index's other properties — exactly the
+            // changes the uniqueness request reports. `$updatedAt` /
+            // `$transferredAt` change on *every* revision, silently migrating
+            // the document to a new bucket; validating that would need the old
+            // bucket alongside the new one to know which slot is being
+            // vacated, and the uniqueness request carries only the new
+            // timestamps. Rejected here rather than half-checked; liftable
+            // once the request plumbs the previous timestamp through.
+            if unique && transform.source != property_names::CREATED_AT {
+                return Err(DataContractError::InvalidContractStructure(format!(
+                    "a unique timeRange index requires \"{}\" as its source, not \"{}\": \
+                     \"{}\" is immutable across updates, so a document's bucket is fixed and \
+                     the uniqueness tuple only moves when the index's other properties change. \
+                     A mutable timestamp source would move the document to a new bucket on \
+                     every revision, which uniqueness validation cannot check without tracking \
+                     the old bucket",
+                    property_names::CREATED_AT,
+                    transform.source,
+                    property_names::CREATED_AT
+                )));
+            }
+            if contested_index.is_some() {
+                return Err(DataContractError::InvalidContractStructure(
+                    "a timeRange index cannot be a contested resource".to_string(),
+                ));
+            }
+            // The ranked query surface excludes bucketed indexes — a document
+            // is stored once per containing bucket, so ranking groups keyed by
+            // bucket starts would score each document `overlap_factor` times.
+            // Since no ranked query can ever select such an index, allowing
+            // the flags would only make the contract pay for ranked
+            // secondaries that are unreachable; reject the combination until
+            // bucket-aware ranked semantics are deliberately designed.
+            if ranked_countable || ranked_summable || ranked_averageable {
+                return Err(DataContractError::InvalidContractStructure(
+                    "a timeRange index cannot be ranked (rankedCountable / rankedSummable / \
+                     rankedAverageable): ranked queries have no time-bucket semantics, so the \
+                     ranked secondaries would be maintained but never servable"
+                        .to_string(),
+                ));
+            }
+            // Same reasoning as the ranked `nullSearchable` rejection above,
+            // plus a write-path invariant: the insert, delete and update
+            // walkers all agree that a null timestamp keeps a single ordinary
+            // null entry with its real reference. `nullSearchable: false`
+            // would suppress that reference on insert while the set-diff
+            // update path maintains it, so the combination is rejected.
+            if !null_searchable {
+                return Err(DataContractError::InvalidContractStructure(
+                    "a timeRange index is not supported with nullSearchable: false: documents \
+                     with a null timestamp keep a single ordinary null entry; leave \
+                     nullSearchable at its default (true)"
+                        .to_string(),
+                ));
+            }
+            // The window is declared in seconds but every quantity it is
+            // measured against — the source timestamps, the bucket starts, the
+            // stored index keys — is a millisecond timestamp, so a parameter is
+            // only usable if scaling it by 1_000 still fits in a `u64`.
+            // Rejecting the unscalable ones here is what lets the transform's
+            // `*_ms` accessors saturate instead of returning a `Result` no
+            // validated contract could ever trip.
+            for (field, seconds) in [
+                ("range", transform.range_seconds),
+                ("step", transform.step_seconds),
+                ("phase", transform.phase_seconds),
+            ] {
+                if seconds > u64::MAX / 1_000 {
+                    return Err(DataContractError::InvalidContractStructure(format!(
+                        "timeRange.{} ({} seconds) is too large to express in milliseconds",
+                        field, seconds
+                    )));
+                }
+            }
+            if transform.step_seconds == 0 {
+                return Err(DataContractError::InvalidContractStructure(
+                    "timeRange.step must be greater than zero".to_string(),
+                ));
+            }
+            // The phase is a pure alignment offset: shifting the grid by a
+            // whole number of steps reproduces the identical grid, so any
+            // value >= step is a second spelling of a smaller phase. One
+            // grid, one spelling — reject rather than normalize, so the
+            // contract, the transform and the storage key all carry the same
+            // number.
+            if transform.phase_seconds >= transform.step_seconds {
+                return Err(DataContractError::InvalidContractStructure(format!(
+                    "timeRange.phase ({} seconds) must be less than timeRange.step ({} \
+                     seconds): the phase only aligns the grid within one step, and a larger \
+                     value would be a redundant spelling of phase % step",
+                    transform.phase_seconds, transform.step_seconds
+                )));
+            }
+            // `phase < step` alone is not enough: the region `[0, phase)` is
+            // outside every window (bucket starts are `phase + k*step`,
+            // k >= 0), and with a huge step the phase — while still a valid
+            // sub-step alignment — could land years in the future (e.g.
+            // `step = 2_000_000_000s`, `phase = 1_900_000_000s` ≈ 2030),
+            // leaving every present-day timestamp without index entries and
+            // silently bypassing unique constraints until the phase passes.
+            // Capping the phase at one year keeps the uncovered region
+            // strictly inside 1970–1971 — decades before any Platform block
+            // time, and `$createdAt` & co are consensus-validated against
+            // block time — so no valid document timestamp can ever precede
+            // the first bucket. One year covers every alignment use case
+            // (time-of-day, weekday, month and year boundaries, timezones).
+            if transform.phase_seconds >= MAX_TIME_RANGE_PHASE_SECONDS {
+                return Err(DataContractError::InvalidContractStructure(format!(
+                    "timeRange.phase ({} seconds) must be less than one year ({} seconds): \
+                     the phase aligns window boundaries, and a larger value would leave \
+                     valid document timestamps before the grid's first bucket, outside \
+                     every window",
+                    transform.phase_seconds, MAX_TIME_RANGE_PHASE_SECONDS
+                )));
+            }
+            if transform.range_seconds == 0 {
+                return Err(DataContractError::InvalidContractStructure(
+                    "timeRange.range must be greater than zero".to_string(),
+                ));
+            }
+            if transform.range_seconds % transform.step_seconds != 0 {
+                return Err(DataContractError::InvalidContractStructure(
+                    "timeRange.range must be an exact multiple of timeRange.step so the number \
+                     of overlapping ranges per document is deterministic"
+                        .to_string(),
+                ));
+            }
+            // The overlap-factor cap is NOT checked here: it is a versioned
+            // system limit (`SystemLimits::max_time_range_overlap_factor`),
+            // and this parser has no platform version. It is enforced at
+            // contract registration in `try_from_schema`, like the other
+            // versioned index limits; this function keeps only the structural
+            // rules that hold at every version.
+            match index_properties.first() {
+                Some(first) if first.name == transform.source => {}
+                Some(first) => {
+                    return Err(DataContractError::InvalidContractStructure(format!(
+                        "timeRange.on (\"{}\") must name the first index property (\"{}\"); a \
+                         time range partitions the index by time, so it has to be the leading \
+                         property",
+                        transform.source, first.name
+                    )));
+                }
+                None => {
+                    return Err(DataContractError::InvalidContractStructure(
+                        "an index with a timeRange must have at least one property".to_string(),
+                    ));
+                }
+            }
+        }
+
         // If the index didn't have a name, derive one deterministically from
         // its properties and their directions. Every document meta-schema
         // (v0/v1/v2) requires `name`, so an unnamed index can only reach this
@@ -1265,6 +1735,8 @@ impl Index {
             ranked_countable,
             ranked_summable,
             ranked_averageable,
+            time_range,
+            terminal,
         })
     }
 }
@@ -1335,9 +1807,610 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }
     }
 
+    // -----------------------------------------------------------------------
+    // timeRange parsing + structural validation tests
+    // -----------------------------------------------------------------------
+
+    /// `time_range` is `(on, range, step)` with the window parameters in the
+    /// seconds the contract grammar declares them in.
+    fn index_value_map(
+        first_property: &str,
+        time_range: Option<(&str, u64, u64)>,
+    ) -> Vec<(Value, Value)> {
+        let property = Value::Map(vec![(
+            Value::Text(first_property.to_string()),
+            Value::Text("asc".to_string()),
+        )]);
+        let hashtag = Value::Map(vec![(
+            Value::Text("hashtag".to_string()),
+            Value::Text("asc".to_string()),
+        )]);
+
+        let mut map = vec![
+            (
+                Value::Text("name".to_string()),
+                Value::Text("trending".to_string()),
+            ),
+            (
+                Value::Text("properties".to_string()),
+                Value::Array(vec![property, hashtag]),
+            ),
+        ];
+
+        if let Some((on, range, step)) = time_range {
+            map.push((
+                Value::Text("timeRange".to_string()),
+                Value::Map(vec![
+                    (Value::Text("on".to_string()), Value::Text(on.to_string())),
+                    (Value::Text("range".to_string()), Value::U64(range)),
+                    (Value::Text("step".to_string()), Value::U64(step)),
+                ]),
+            ));
+        }
+
+        map
+    }
+
+    /// [`index_value_map`] with one extra `timeRange` key — for the `phase`
+    /// tests and for pinning that removed keys (like the pre-phase-era
+    /// `origin`) fall through to the unknown-field rejection.
+    fn index_value_map_with_extra_time_range_key(
+        range: u64,
+        step: u64,
+        key: &str,
+        value: u64,
+    ) -> Vec<(Value, Value)> {
+        let mut map = index_value_map("$createdAt", Some(("$createdAt", range, step)));
+        let Some((_, Value::Map(time_range))) = map
+            .iter_mut()
+            .find(|(k, _)| k.as_text() == Some("timeRange"))
+        else {
+            panic!("the helper always builds a timeRange map");
+        };
+        time_range.push((Value::Text(key.to_string()), Value::U64(value)));
+        map
+    }
+
+    /// `phase` parses into the transform, and its being strictly less than
+    /// `step` is a structural rule — a larger value is a redundant spelling
+    /// of `phase % step` and is rejected rather than normalized, so the
+    /// contract, the transform and the storage key all carry one number.
+    #[test]
+    fn time_range_phase_parses_and_must_be_less_than_step() {
+        let map = index_value_map_with_extra_time_range_key(21_600, 7_200, "phase", 3_600);
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        let transform = index.time_range.expect("time_range should be set");
+        assert_eq!(transform.phase_seconds, 3_600);
+
+        // phase == step: one whole step of shift reproduces the identical
+        // grid, so this is the smallest redundant spelling.
+        let map = index_value_map_with_extra_time_range_key(21_600, 7_200, "phase", 7_200);
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+
+        let map = index_value_map_with_extra_time_range_key(21_600, 7_200, "phase", 10_000);
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    /// `phase < step` alone is not enough: on a huge step a sub-step phase
+    /// can sit years in the *future*, leaving every present-day timestamp
+    /// before the grid's first bucket — unindexed, and free to bypass a
+    /// unique constraint. The one-year cap closes that: the uncovered
+    /// region stays inside 1970–1971, unreachable for consensus-validated
+    /// timestamps.
+    #[test]
+    fn time_range_phase_is_capped_at_one_year_even_when_the_step_allows_more() {
+        // The reported exploit shape: overlap factor 1, everything scalable,
+        // phase < step — but the phase anchor lands around 2030, so a unique
+        // index would silently skip every document until then.
+        let map = index_value_map_with_extra_time_range_key(
+            2_000_000_000,
+            2_000_000_000,
+            "phase",
+            1_900_000_000,
+        );
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+
+        // Just under the cap on the same huge step parses fine.
+        let map = index_value_map_with_extra_time_range_key(
+            2_000_000_000,
+            2_000_000_000,
+            "phase",
+            MAX_TIME_RANGE_PHASE_SECONDS - 1,
+        );
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        assert_eq!(
+            index.time_range.expect("transform set").phase_seconds,
+            MAX_TIME_RANGE_PHASE_SECONDS - 1
+        );
+
+        // Exactly the cap is rejected (exclusive bound).
+        let map = index_value_map_with_extra_time_range_key(
+            2_000_000_000,
+            2_000_000_000,
+            "phase",
+            MAX_TIME_RANGE_PHASE_SECONDS,
+        );
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    /// The pre-phase grammar's `origin` key no longer exists: it named an
+    /// absolute grid anchor with beginning-of-time semantics the phase-only
+    /// design dropped, so it must be rejected as an unknown field rather
+    /// than silently ignored.
+    #[test]
+    fn time_range_rejects_the_removed_origin_key() {
+        let map = index_value_map_with_extra_time_range_key(21_600, 7_200, "origin", 3_600);
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    /// Two grids over the same property produce distinct storage keys — the
+    /// fork that lets them coexist as sibling index subtrees — and identical
+    /// grids produce the identical key, so indexes sharing a grid share a
+    /// level. Zero phase is spelled by omission; a declared phase appends
+    /// the fourth part.
+    #[test]
+    fn time_range_storage_keys_are_grid_qualified() {
+        let map = index_value_map("$createdAt", Some(("$createdAt", 21_600, 7_200)));
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        assert_eq!(index.level_key(0, "$createdAt"), "$createdAt#21600#7200");
+        assert_eq!(
+            index.level_key_for_property("$createdAt"),
+            "$createdAt#21600#7200"
+        );
+        // non-first / non-source properties keep their bare names
+        assert_eq!(index.level_key(1, "hashtag"), "hashtag");
+        assert_eq!(index.level_key_for_property("hashtag"), "hashtag");
+
+        let map = index_value_map_with_extra_time_range_key(21_600, 7_200, "phase", 3_600);
+        let phased = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        assert_eq!(
+            phased.level_key(0, "$createdAt"),
+            "$createdAt#21600#7200#3600"
+        );
+        assert_ne!(
+            phased.level_key(0, "$createdAt"),
+            index.level_key(0, "$createdAt"),
+            "different grids must fork into different levels"
+        );
+    }
+
+    #[test]
+    fn time_range_index_parses() {
+        // A six-hour window refreshed every two hours.
+        let map = index_value_map("$createdAt", Some(("$createdAt", 21_600, 7_200)));
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        let transform = index.time_range.expect("time_range should be set");
+        assert_eq!(transform.source, "$createdAt");
+        assert_eq!(transform.range_seconds, 21_600);
+        assert_eq!(transform.step_seconds, 7_200);
+        assert_eq!(transform.phase_seconds, 0);
+        assert_eq!(transform.overlap_factor(), 3);
+        // The parsed seconds are what the bucket math scales into the
+        // millisecond domain the source timestamps live in.
+        assert_eq!(transform.range_ms(), 21_600_000);
+        assert_eq!(transform.step_ms(), 7_200_000);
+    }
+
+    #[test]
+    fn time_range_rejects_non_multiple_range() {
+        let map = index_value_map("$createdAt", Some(("$createdAt", 21_600, 7_000)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    #[test]
+    fn time_range_rejects_parameters_that_cannot_be_expressed_in_milliseconds() {
+        // `range == step` keeps the overlap factor at 1 and the multiple check
+        // satisfied, so the millisecond-expressibility guard is the only rule
+        // that can reject this transform.
+        let too_large = u64::MAX / 1_000 + 1;
+        let map = index_value_map("$createdAt", Some(("$createdAt", too_large, too_large)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        match err {
+            DataContractError::InvalidContractStructure(message) => {
+                assert!(
+                    message.contains("too large to express in milliseconds"),
+                    "expected the millisecond-expressibility rejection, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidContractStructure, got: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn time_range_parse_accepts_any_overlap_factor() {
+        // The overlap-factor cap is a versioned system limit enforced at
+        // contract registration (`try_from_schema`), not a structural parse
+        // rule — this parser has no platform version to read it from. A
+        // huge factor must therefore parse; registration is what rejects it.
+        let map = index_value_map("$createdAt", Some(("$createdAt", 300, 1)));
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("the parser applies structural rules only");
+        assert_eq!(
+            index
+                .time_range
+                .expect("time_range should be set")
+                .overlap_factor(),
+            300
+        );
+    }
+
+    #[test]
+    fn time_range_rejects_source_not_first_property() {
+        // `on` names a property that is not the first index property
+        let map = index_value_map("$createdAt", Some(("hashtag", 60, 20)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    #[test]
+    fn time_range_rejects_zero_step() {
+        let map = index_value_map("$createdAt", Some(("$createdAt", 60, 0)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    #[test]
+    fn time_range_rejects_null_searchable_false() {
+        let mut map = index_value_map("$createdAt", Some(("$createdAt", 21_600, 7_200)));
+        map.push((
+            Value::Text("nullSearchable".to_string()),
+            Value::Bool(false),
+        ));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            DataContractError::InvalidContractStructure(_)
+        ));
+    }
+
+    #[test]
+    fn time_range_rejects_ranked_flags() {
+        // Ranked queries exclude bucketed indexes, so the combination would
+        // maintain ranked secondaries no query can ever select. The index is
+        // otherwise a fully valid ranked shape (single property, countable +
+        // rangeCountable), so the ranked-prerequisite checks pass and the
+        // rejection under test is the one that fires.
+        let property = Value::Map(vec![(
+            Value::Text("$createdAt".to_string()),
+            Value::Text("asc".to_string()),
+        )]);
+        let map = vec![
+            (
+                Value::Text("name".to_string()),
+                Value::Text("busiestBuckets".to_string()),
+            ),
+            (
+                Value::Text("properties".to_string()),
+                Value::Array(vec![property]),
+            ),
+            (Value::Text("countable".to_string()), Value::Bool(true)),
+            (Value::Text("rangeCountable".to_string()), Value::Bool(true)),
+            (
+                Value::Text("rankedCountable".to_string()),
+                Value::Bool(true),
+            ),
+            (
+                Value::Text("timeRange".to_string()),
+                Value::Map(vec![
+                    (
+                        Value::Text("on".to_string()),
+                        Value::Text("$createdAt".to_string()),
+                    ),
+                    (Value::Text("range".to_string()), Value::U64(21_600)),
+                    (Value::Text("step".to_string()), Value::U64(7_200)),
+                ]),
+            ),
+        ];
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .unwrap_err();
+        match err {
+            DataContractError::InvalidContractStructure(message) => {
+                assert!(
+                    message.contains("cannot be ranked"),
+                    "expected the timeRange-vs-ranked rejection, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidContractStructure, got: {other:?}"),
+        }
+    }
+
+    /// One day as the contract grammar declares a window (seconds), aligned to
+    /// the epoch: `range == step`, so the windows tile time without
+    /// overlapping and every document lands in exactly one.
+    const ONE_DAY_SECONDS: u64 = 24 * 3_600;
+
+    #[test]
+    fn unique_time_range_index_parses_for_non_overlapping_windows_on_created_at() {
+        // "one post per author per day": the bucket is a genuine partition of
+        // time, so at most one document per (day, hashtag) is a constraint the
+        // storage layout can actually hold.
+        let mut map = index_value_map(
+            "$createdAt",
+            Some(("$createdAt", ONE_DAY_SECONDS, ONE_DAY_SECONDS)),
+        );
+        map.push((Value::Text("unique".to_string()), Value::Bool(true)));
+        let index = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("should parse");
+        assert!(index.unique, "the unique flag must survive parsing");
+        let transform = index.time_range.expect("time_range should be set");
+        assert_eq!(transform.source, "$createdAt");
+        assert_eq!(
+            transform.overlap_factor(),
+            1,
+            "range == step is what makes the index a partition"
+        );
+    }
+
+    #[test]
+    fn time_range_rejects_unique_when_windows_overlap() {
+        // range = 3 * step: each document is indexed under three bucket keys
+        // at once, so there is no single slot for uniqueness to guard.
+        let mut map = index_value_map(
+            "$createdAt",
+            Some(("$createdAt", 3 * ONE_DAY_SECONDS, ONE_DAY_SECONDS)),
+        );
+        map.push((Value::Text("unique".to_string()), Value::Bool(true)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        match err {
+            DataContractError::InvalidContractStructure(message) => {
+                assert!(
+                    message.contains("unique") && message.contains("non-overlapping"),
+                    "expected the overlapping-windows rejection, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidContractStructure, got: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn time_range_rejects_unique_on_a_mutable_timestamp_source() {
+        // `$updatedAt` moves the document to a new bucket on every revision;
+        // uniqueness validation only sees the new timestamp, so it could never
+        // tell which bucket the document is vacating.
+        let mut map = index_value_map(
+            "$updatedAt",
+            Some(("$updatedAt", ONE_DAY_SECONDS, ONE_DAY_SECONDS)),
+        );
+        map.push((Value::Text("unique".to_string()), Value::Bool(true)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        match err {
+            DataContractError::InvalidContractStructure(message) => {
+                assert!(
+                    message.contains("$createdAt"),
+                    "expected the immutable-source requirement, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidContractStructure, got: {other:?}"),
+        }
+        // The same shape without `unique` is fine — the restriction is about
+        // uniqueness, not about bucketing `$updatedAt`.
+        let map = index_value_map(
+            "$updatedAt",
+            Some(("$updatedAt", ONE_DAY_SECONDS, ONE_DAY_SECONDS)),
+        );
+        Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: false,
+                time_range: true,
+                terminal: false,
+            },
+        )
+        .expect("a non-unique $updatedAt bucketing stays legal");
+    }
+
+    #[test]
+    fn time_range_is_not_part_of_the_pre_v3_grammar() {
+        // Without the meta-schema-v3 grammar admission, `timeRange` falls
+        // through to the unknown-key arm — exactly how a pre-PV14 node
+        // rejected it.
+        let map = index_value_map("$createdAt", Some(("$createdAt", 21_600, 7_200)));
+        let err = Index::try_from(map.as_slice()).unwrap_err();
+        assert!(matches!(err, DataContractError::ValueWrongType(_)));
+        let err = Index::try_from_value_map(
+            map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: false,
+                terminal: false,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(err, DataContractError::ValueWrongType(_)));
+    }
+
     // -----------------------------------------------------------------------
     // ContestedIndexResolution tests
     // -----------------------------------------------------------------------
@@ -1541,6 +2614,76 @@ mod tests {
         assert!(!index.objects_are_conflicting(&obj1, &obj2));
     }
 
+    /// A daily unique grid (`range == step`, the only shape a unique
+    /// time-range index may take): the bucketed property occupies its
+    /// bucket-start slot, so conflict follows the bucket, not the raw
+    /// timestamp.
+    fn make_unique_daily_index() -> Index {
+        let mut index = make_index("idx", vec![("$createdAt", true), ("author", true)], true);
+        index.time_range = Some(TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 86_400,
+            step_seconds: 86_400,
+            phase_seconds: 0,
+        });
+        index
+    }
+
+    fn created_at_author(timestamp_ms: u64, author: &str) -> ValueMap {
+        vec![
+            (
+                Value::Text("$createdAt".to_string()),
+                Value::U64(timestamp_ms),
+            ),
+            (
+                Value::Text("author".to_string()),
+                Value::Text(author.to_string()),
+            ),
+        ]
+    }
+
+    const DAY_MS: u64 = 86_400_000;
+
+    #[test]
+    fn test_objects_are_conflicting_time_range_same_bucket() {
+        let index = make_unique_daily_index();
+        // different timestamps, same daily bucket, same suffix → same slot
+        let obj1 = created_at_author(3 * DAY_MS + 1_000, "sam");
+        let obj2 = created_at_author(3 * DAY_MS + 2_000, "sam");
+        assert!(index.objects_are_conflicting(&obj1, &obj2));
+    }
+
+    #[test]
+    fn test_objects_are_conflicting_time_range_adjacent_buckets() {
+        let index = make_unique_daily_index();
+        // last ms of day 3 vs first ms of day 4: adjacent slots, no conflict
+        let obj1 = created_at_author(4 * DAY_MS - 1, "sam");
+        let obj2 = created_at_author(4 * DAY_MS, "sam");
+        assert!(!index.objects_are_conflicting(&obj1, &obj2));
+    }
+
+    #[test]
+    fn test_objects_are_conflicting_time_range_same_bucket_different_suffix() {
+        let index = make_unique_daily_index();
+        let obj1 = created_at_author(3 * DAY_MS + 1_000, "sam");
+        let obj2 = created_at_author(3 * DAY_MS + 2_000, "alice");
+        assert!(!index.objects_are_conflicting(&obj1, &obj2));
+    }
+
+    #[test]
+    fn test_objects_are_conflicting_time_range_epoch_sliver_never_conflicts() {
+        let mut index = make_unique_daily_index();
+        // a one-hour phase leaves timestamps below the anchor with no
+        // index entries at all — no slot exists to share, even for
+        // identical timestamps
+        if let Some(transform) = index.time_range.as_mut() {
+            transform.phase_seconds = 3_600;
+        }
+        let obj1 = created_at_author(1_000, "sam");
+        let obj2 = created_at_author(1_000, "sam");
+        assert!(!index.objects_are_conflicting(&obj1, &obj2));
+    }
+
     #[test]
     fn test_objects_are_conflicting_one_missing_property() {
         let index = make_index("idx", vec![("name", true)], true);
@@ -2237,8 +3380,15 @@ mod tests {
             ("rankedSummable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let index = Index::try_from_value_map(index_map.as_slice(), true)
-            .expect("all three ranked keywords must parse when the grammar allows them");
+        let index = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("all three ranked keywords must parse when the grammar allows them");
         assert!(index.ranked_countable);
         assert!(index.ranked_summable);
         assert!(index.ranked_averageable);
@@ -2255,8 +3405,15 @@ mod tests {
             ("averageable", Value::Text("score".to_string())),
             ("rangeAverageable", Value::Bool(true)),
         ]);
-        let index = Index::try_from_value_map(index_map.as_slice(), true)
-            .expect("index without ranked keywords must parse");
+        let index = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("index without ranked keywords must parse");
         assert!(!index.ranked_countable);
         assert!(!index.ranked_summable);
         assert!(!index.ranked_averageable);
@@ -2289,8 +3446,15 @@ mod tests {
                 Value::Text("asc".to_string()),
             )]),
         ]);
-        let index = Index::try_from_value_map(index_map.as_slice(), true)
-            .expect("ranked flags on a compound index must be accepted");
+        let index = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("ranked flags on a compound index must be accepted");
         assert!(index.ranked_averageable);
         assert_eq!(index.properties.len(), 2);
         assert_eq!(index.properties[1].name, "score");
@@ -2311,7 +3475,14 @@ mod tests {
                 Value::Text("asc".to_string()),
             )]),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "rankedCountable without rangeCountable must be rejected on a compound index too"
@@ -2334,7 +3505,14 @@ mod tests {
             ("rangeAverageable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "ranked flags on a unique index must be rejected"
@@ -2355,7 +3533,14 @@ mod tests {
             ("countable", Value::Text("countable".to_string())),
             ("rankedCountable", Value::Bool(true)),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "rankedCountable without rangeCountable must be rejected"
@@ -2373,7 +3558,14 @@ mod tests {
             ("summable", Value::Text("score".to_string())),
             ("rankedSummable", Value::Bool(true)),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "rankedSummable without rangeSummable must be rejected"
@@ -2393,7 +3585,14 @@ mod tests {
             ("rangeCountable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "rankedAverageable with only the count range axis must be rejected"
@@ -2413,7 +3612,14 @@ mod tests {
             ("rangeSummable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let result = Index::try_from_value_map(index_map.as_slice(), true);
+        let result = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        );
         assert!(
             result.is_err(),
             "rankedAverageable with only the sum range axis must be rejected"
@@ -2435,8 +3641,15 @@ mod tests {
             ("rangeAverageable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let index = Index::try_from_value_map(index_map.as_slice(), true)
-            .expect("rankedAverageable on the averageable sugar form must parse");
+        let index = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("rankedAverageable on the averageable sugar form must parse");
         assert!(index.ranked_averageable);
         assert!(index.countable.is_countable());
         assert_eq!(index.summable.as_deref(), Some("score"));
@@ -2463,8 +3676,15 @@ mod tests {
             ("rangeSummable", Value::Bool(true)),
             ("rankedAverageable", Value::Bool(true)),
         ]);
-        let index = Index::try_from_value_map(index_map.as_slice(), true)
-            .expect("rankedAverageable on the explicit longhand form must parse");
+        let index = Index::try_from_value_map(
+            index_map.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("rankedAverageable on the explicit longhand form must parse");
         assert!(index.ranked_averageable);
         assert!(index.range_countable);
         assert!(index.range_summable);
@@ -2481,7 +3701,14 @@ mod tests {
                 ("rangeAverageable", Value::Bool(true)),
                 (key, Value::Text("yes".to_string())),
             ]);
-            let result = Index::try_from_value_map(index_map.as_slice(), true);
+            let result = Index::try_from_value_map(
+                index_map.as_slice(),
+                IndexGrammarAdmissions {
+                    ranked: true,
+                    time_range: true,
+                    terminal: true,
+                },
+            );
             assert!(result.is_err(), "{key} must reject a non-boolean value");
             let msg = format!("{:?}", result.unwrap_err());
             assert!(
@@ -2505,7 +3732,14 @@ mod tests {
                     ("rangeAverageable", Value::Bool(true)),
                     (key, value.clone()),
                 ]);
-                let result = Index::try_from_value_map(index_map.as_slice(), false);
+                let result = Index::try_from_value_map(
+                    index_map.as_slice(),
+                    IndexGrammarAdmissions {
+                        ranked: false,
+                        time_range: false,
+                        terminal: false,
+                    },
+                );
                 assert!(
                     result.is_err(),
                     "{key}: {value:?} must be rejected when the ranked grammar is off"
@@ -2578,7 +3812,14 @@ mod tests {
         for (axis, mut extra) in ranked_axis_fixtures() {
             extra.push(("nullSearchable", Value::Bool(false)));
             let index_map = ranked_index_map(extra);
-            let result = Index::try_from_value_map(index_map.as_slice(), true);
+            let result = Index::try_from_value_map(
+                index_map.as_slice(),
+                IndexGrammarAdmissions {
+                    ranked: true,
+                    time_range: true,
+                    terminal: true,
+                },
+            );
             assert!(
                 result.is_err(),
                 "{axis} with nullSearchable: false must be rejected"
@@ -2598,8 +3839,15 @@ mod tests {
     fn test_index_try_from_ranked_without_null_searchable_key_accepted() {
         for (axis, extra) in ranked_axis_fixtures() {
             let index_map = ranked_index_map(extra);
-            let index = Index::try_from_value_map(index_map.as_slice(), true)
-                .unwrap_or_else(|e| panic!("{axis} with no nullSearchable key must parse: {e:?}"));
+            let index = Index::try_from_value_map(
+                index_map.as_slice(),
+                IndexGrammarAdmissions {
+                    ranked: true,
+                    time_range: true,
+                    terminal: true,
+                },
+            )
+            .unwrap_or_else(|e| panic!("{axis} with no nullSearchable key must parse: {e:?}"));
             assert!(
                 index.null_searchable,
                 "{axis}: the absent key must still default to true"
@@ -2614,7 +3862,15 @@ mod tests {
         for (axis, mut extra) in ranked_axis_fixtures() {
             extra.push(("nullSearchable", Value::Bool(true)));
             let index_map = ranked_index_map(extra);
-            let index = Index::try_from_value_map(index_map.as_slice(), true).unwrap_or_else(|e| {
+            let index = Index::try_from_value_map(
+                index_map.as_slice(),
+                IndexGrammarAdmissions {
+                    ranked: true,
+                    time_range: true,
+                    terminal: true,
+                },
+            )
+            .unwrap_or_else(|e| {
                 panic!("{axis} with an explicit nullSearchable: true must parse: {e:?}")
             });
             assert!(index.null_searchable);
@@ -2627,8 +3883,15 @@ mod tests {
     #[test]
     fn test_index_try_from_non_ranked_with_null_searchable_false_still_accepted() {
         let plain = ranked_index_map(vec![("nullSearchable", Value::Bool(false))]);
-        let index = Index::try_from_value_map(plain.as_slice(), true)
-            .expect("nullSearchable: false on a plain index must still parse");
+        let index = Index::try_from_value_map(
+            plain.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("nullSearchable: false on a plain index must still parse");
         assert!(!index.null_searchable);
 
         let aggregating = ranked_index_map(vec![
@@ -2636,8 +3899,15 @@ mod tests {
             ("rangeAverageable", Value::Bool(true)),
             ("nullSearchable", Value::Bool(false)),
         ]);
-        let index = Index::try_from_value_map(aggregating.as_slice(), true)
-            .expect("nullSearchable: false on a range-averageable index must still parse");
+        let index = Index::try_from_value_map(
+            aggregating.as_slice(),
+            IndexGrammarAdmissions {
+                ranked: true,
+                time_range: true,
+                terminal: true,
+            },
+        )
+        .expect("nullSearchable: false on a range-averageable index must still parse");
         assert!(!index.null_searchable);
         assert!(!index.ranked_averageable);
     }
@@ -3119,6 +4389,8 @@ mod json_convertible_tests {
             ranked_countable: true,
             ranked_summable: false,
             ranked_averageable: true,
+            time_range: None,
+            terminal: None,
         }
     }
 
@@ -3148,6 +4420,8 @@ mod json_convertible_tests {
                 "ranked_countable": true,
                 "ranked_summable": false,
                 "ranked_averageable": true,
+                "time_range": serde_json::Value::Null,
+                "terminal": serde_json::Value::Null,
             })
         );
         let recovered = Index::from_json(json).expect("from_json");
diff --git a/packages/rs-dpp/src/data_contract/document_type/index/random_index.rs b/packages/rs-dpp/src/data_contract/document_type/index/random_index.rs
index a352c935e86..25c14ae4d74 100644
--- a/packages/rs-dpp/src/data_contract/document_type/index/random_index.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/index/random_index.rs
@@ -67,6 +67,8 @@ impl Index {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         })
     }
 }
diff --git a/packages/rs-dpp/src/data_contract/document_type/index/time_range.rs b/packages/rs-dpp/src/data_contract/document_type/index/time_range.rs
new file mode 100644
index 00000000000..2e78e1c7ef0
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/document_type/index/time_range.rs
@@ -0,0 +1,490 @@
+#[cfg(feature = "serde-conversion")]
+use serde::{Deserialize, Serialize};
+
+/// An index-level transform that buckets a timestamp index property into
+/// fixed-length, regularly-spaced time ranges.
+///
+/// The window is **declared in seconds** and **identified in milliseconds**.
+/// A contract author writes `range` / `step` / `phase` as second counts
+/// because the finest clock a bucket selection ever sees is block time, whose
+/// target interval is five seconds — a window declared to the millisecond
+/// would be precision the protocol cannot deliver. A time range is still
+/// identified by a single `u64`: the **start time of the range** as a
+/// millisecond timestamp, because the source fields (`$createdAt` &co.) are
+/// millisecond timestamps and the stored index key has to stay directly
+/// comparable to them. [`Self::range_ms`] and its siblings are the one place
+/// the two units meet.
+///
+/// Each range covers `[start, start + range)`. New ranges start every `step`,
+/// on the grid `phase + k * step` — `phase` is a pure alignment offset,
+/// validated to be strictly less than `step`, so the grid covers all of time
+/// (bar the sub-`step` sliver at the epoch that no real timestamp can ever
+/// fall into). When `range > step` the ranges overlap, so a single timestamp
+/// falls into `range / step` ranges (the "overlap factor") and a document is
+/// indexed under that many bucket-start values.
+///
+/// The canonical use case is "trending" leaderboards: index on
+/// `(timeRange($createdAt), hashtag)` with `countable`, then query a single
+/// bucket. Per-hashtag counts within the bucket are served by the grouped
+/// count surface, whose single `GROUP BY` field must itself carry an `In`
+/// or range clause: `IN_TIME_RANGE($createdAt, "newest") AND hashtag IN
+/// (candidates) GROUP BY hashtag` returns one count per candidate (the
+/// client orders the returned groups), and a range predicate on the grouped
+/// field with `rangeCountable: true` covers the open-ended form. A bare
+/// `GROUP BY hashtag` with no clause on `hashtag` is not routable —
+/// aggregate coverage requires every index property to carry an
+/// `Equal`/`In`/range clause. Overlapping ranges guarantee that, at any
+/// instant, there is always an active range covering a near-full `range`
+/// window of history (see [`Self::oldest_active_start`]).
+///
+/// Note that the *server-ordered* form (`ORDER BY COUNT(*)` — the ranked
+/// query surface) cannot yet be combined with a time-range selection: ranked
+/// queries accept no where clauses in this protocol version (their routing
+/// deliberately has no equality-prefix support yet), so "top K by count
+/// within the bucket" is served as the grouped count above with client-side
+/// ordering until ranked prefix routing lands at a future protocol version.
+///
+/// At the GroveDB storage layer, a transformed first property gets its own
+/// index level keyed by [`Self::storage_key`] — the property name qualified
+/// with the grid — so several grids over the same timestamp coexist as
+/// sibling subtrees. Within a grid's subtree a bucket start is an ordinary
+/// `u64` key segment (encoded exactly like a `$createdAt` value), so existing
+/// index queries, count trees and proofs apply unchanged — the only novelty
+/// is that one document produces several index entries.
+// The serde keys deliberately match the contract grammar (`on` / `range` /
+// `step` / `phase`, see the `timeRange` entry in the v3 document
+// meta-schema), so a serialized `Index` round-trips into the same key set a
+// contract author writes rather than a second, camelCased spelling.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "serde-conversion", derive(Serialize, Deserialize))]
+pub struct TimeRangeTransform {
+    /// The source timestamp index property this transform buckets. Must be
+    /// the first property of the index and must name one of the system
+    /// timestamps (`$createdAt` / `$updatedAt` / `$transferredAt`); the
+    /// document-schema grammar has no user property type that parses to a
+    /// millisecond timestamp, so user-defined sources are rejected at
+    /// contract validation until such a representation exists.
+    #[cfg_attr(feature = "serde-conversion", serde(rename = "on"))]
+    pub source: String,
+    /// Length of each range window, in seconds. Must be a positive multiple
+    /// of `step_seconds`. The window a document is measured against is this
+    /// length expressed in milliseconds ([`Self::range_ms`]), since bucket
+    /// starts are millisecond timestamps.
+    #[cfg_attr(feature = "serde-conversion", serde(rename = "range"))]
+    pub range_seconds: u64,
+    /// Interval between successive range starts, in seconds. Must be greater
+    /// than zero. Consecutive bucket starts are [`Self::step_ms`] apart on the
+    /// millisecond timeline.
+    #[cfg_attr(feature = "serde-conversion", serde(rename = "step"))]
+    pub step_seconds: u64,
+    /// Grid alignment phase, in seconds. Range starts are the millisecond
+    /// timestamps `phase_ms() + k * step_ms()` for `k = 0, 1, 2, …`. A pure
+    /// phase offset: contract validation requires `phase < step` AND
+    /// `phase < MAX_TIME_RANGE_PHASE_SECONDS` (one year), so shifting the
+    /// grid never excludes any real timestamp — the region before the first
+    /// bucket stays inside 1970–1971, unreachable for consensus-validated
+    /// timestamps — it only moves where the window boundaries fall (e.g.
+    /// daily windows cut at 06:00 UTC instead of midnight). Defaults to `0`.
+    #[cfg_attr(feature = "serde-conversion", serde(rename = "phase", default))]
+    pub phase_seconds: u64,
+}
+
+impl TimeRangeTransform {
+    /// The window length on the millisecond timeline.
+    ///
+    /// The three `*_ms` accessors are the single crossing point between the
+    /// transform's two units: the parameters are seconds because that is the
+    /// resolution a contract author can meaningfully declare, while every
+    /// quantity the bucket math consumes or produces — a document's
+    /// `$createdAt`, a bucket start, a stored index key — is a millisecond
+    /// timestamp, so the parameters have to be scaled before they can take
+    /// part.
+    ///
+    /// Saturating rather than checked: contract validation rejects any
+    /// parameter above `u64::MAX / 1_000`, so a transform that came from a
+    /// validated contract can never reach the ceiling. A transform built
+    /// outside validation degrades into a pinned-to-the-maximum window
+    /// instead of panicking — the same defensive posture as the
+    /// `step_seconds == 0` handling below, which returns `None` / an empty
+    /// bucket set rather than dividing by zero.
+    pub fn range_ms(&self) -> u64 {
+        self.range_seconds.saturating_mul(1_000)
+    }
+
+    /// The interval between successive range starts on the millisecond
+    /// timeline. See [`Self::range_ms`] for why the accessor exists and why
+    /// it saturates.
+    pub fn step_ms(&self) -> u64 {
+        self.step_seconds.saturating_mul(1_000)
+    }
+
+    /// The grid alignment phase on the millisecond timeline — the first
+    /// range's start. See [`Self::range_ms`] for why the accessor exists and
+    /// why it saturates.
+    pub fn phase_ms(&self) -> u64 {
+        self.phase_seconds.saturating_mul(1_000)
+    }
+
+    /// The number of overlapping ranges that contain any given instant, i.e.
+    /// the number of bucket-start values a single document is indexed under.
+    /// Equal to `range / step`.
+    ///
+    /// A ratio of two same-unit quantities, so it is unit-invariant and reads
+    /// the declared seconds directly rather than scaling both sides first.
+    ///
+    /// Returns `0` only for a malformed transform with a zero step; callers
+    /// constructing from a validated contract never observe that.
+    pub fn overlap_factor(&self) -> u64 {
+        if self.step_seconds == 0 {
+            return 0;
+        }
+        self.range_seconds / self.step_seconds
+    }
+
+    /// The GroveDB index-level key for this grid over `property_name`: the
+    /// property name qualified with the grid parameters, so different grids
+    /// over the same timestamp fork into sibling subtrees instead of
+    /// colliding in one keyspace (every 6-hour bucket start is also a
+    /// 3-hour bucket start — unqualified, the two grids' entries would be
+    /// indistinguishable).
+    ///
+    /// **This is the single source of the key encoding.** Contract setup,
+    /// the insert/delete/update walkers, query path derivation, the
+    /// uniqueness probe and proof verification must all derive the level key
+    /// through this function; a second implementation that disagreed on any
+    /// detail would split one logical index into two trees.
+    ///
+    /// Format: `{property}#{range}#{step}` with `#{phase}` appended **iff**
+    /// the phase is non-zero — omitted-means-zero is canonical (nothing ever
+    /// writes `#0`), mirroring the contract grammar where `phase` is an
+    /// omittable key. The numbers are the contract-declared **seconds**
+    /// verbatim, which are already canonical. `#` can never appear in a
+    /// schema property name (`^[a-zA-Z0-9-_]{1,64}$`, dot-joined for nested
+    /// paths), so a qualified key can never collide with a plain property
+    /// level.
+    pub fn storage_key(&self, property_name: &str) -> String {
+        if self.phase_seconds == 0 {
+            format!(
+                "{}#{}#{}",
+                property_name, self.range_seconds, self.step_seconds
+            )
+        } else {
+            format!(
+                "{}#{}#{}#{}",
+                property_name, self.range_seconds, self.step_seconds, self.phase_seconds
+            )
+        }
+    }
+
+    /// The start of the most recent range that has begun at or before the
+    /// millisecond timestamp `t`, i.e. the largest `phase + k * step` that is
+    /// `<= t`.
+    ///
+    /// Returns `None` for `t` before the phase anchor — with a validated
+    /// transform (`phase < step`) that is only the sub-`step` sliver at the
+    /// epoch, which no real timestamp reaches; the arm is defensive. (Also
+    /// `None` for a malformed zero-step transform, which a validated contract
+    /// can never carry.)
+    pub fn most_recent_start(&self, t: u64) -> Option<u64> {
+        let (step_ms, phase_ms) = (self.step_ms(), self.phase_ms());
+        if step_ms == 0 || t < phase_ms {
+            return None;
+        }
+        let elapsed = t - phase_ms;
+        Some(phase_ms + (elapsed / step_ms) * step_ms)
+    }
+
+    /// All bucket-start values whose range `[start, start + range)` contains
+    /// the millisecond timestamp `t`. This is the set of index entries a
+    /// document with timestamp `t` must be written under.
+    ///
+    /// The result is sorted in descending order (newest range first) and has
+    /// exactly [`Self::overlap_factor`] elements, except within the first
+    /// `range` after the epoch where fewer ranges have started. For `t`
+    /// before the phase anchor (the sub-`step` epoch sliver no real timestamp
+    /// reaches) the result is empty — insert, delete and update all share
+    /// this rule, keeping the index consistent.
+    pub fn containing_buckets(&self, t: u64) -> Vec<u64> {
+        let overlap = self.overlap_factor();
+        if overlap == 0 {
+            return Vec::new();
+        }
+        let Some(newest) = self.most_recent_start(t) else {
+            return Vec::new();
+        };
+        let (step_ms, phase_ms) = (self.step_ms(), self.phase_ms());
+        (0..overlap)
+            .filter_map(|j| {
+                let offset = j.checked_mul(step_ms)?;
+                newest.checked_sub(offset)
+            })
+            .filter(|start| *start >= phase_ms)
+            .collect()
+    }
+
+    /// The start of the newest range that is active at the millisecond
+    /// timestamp `now` (the freshest started range). Querying this bucket
+    /// returns documents from the latest partial slice — between `0` and one
+    /// `step` of history.
+    ///
+    /// Returns `None` only when `now` predates the phase anchor (the epoch
+    /// sliver; unreachable for real block times).
+    pub fn newest_active_start(&self, now: u64) -> Option<u64> {
+        self.most_recent_start(now)
+    }
+
+    /// The start of the oldest range still active at the millisecond timestamp
+    /// `now`. Its window `[start, start + range)` still contains `now`, so
+    /// querying this bucket returns a near-full trailing window of `~range` of
+    /// history (between `range - step` and `range`). This is the bucket to
+    /// query for "trending over the last range window".
+    ///
+    /// Returns `None` only when `now` predates the phase anchor (the epoch
+    /// sliver; unreachable for real block times).
+    pub fn oldest_active_start(&self, now: u64) -> Option<u64> {
+        let overlap = self.overlap_factor();
+        if overlap == 0 {
+            return None;
+        }
+        let newest = self.most_recent_start(now)?;
+        let back = (overlap - 1).saturating_mul(self.step_ms());
+        Some(newest.saturating_sub(back).max(self.phase_ms()))
+    }
+
+    /// The set of index-entry keys a document with the given raw encoded
+    /// value for the bucketed property must be stored under.
+    ///
+    /// **This is the single source of truth for the fan-out rule**: the
+    /// insert, delete and update walkers in rs-drive must all derive their
+    /// entry keys through this function, or a document written by one walker
+    /// becomes unfindable by another (a consensus break on
+    /// update-after-insert).
+    ///
+    /// - An empty `raw` (the null / property-absent case) keeps the single
+    ///   ordinary null entry every index gives null values.
+    /// - A decodable millisecond timestamp yields one key per containing
+    ///   bucket — the bucket *start*, encoded exactly like the timestamp
+    ///   itself. (A timestamp inside the sub-`step` epoch sliver before the
+    ///   phase anchor yields no keys; no real timestamp reaches it.)
+    /// - A non-empty value that is not an 8-byte encoded timestamp keeps its
+    ///   raw key, exactly as a non-time-range index would store it.
+    pub fn entry_keys_for_raw(&self, raw: &[u8]) -> Vec<Vec<u8>> {
+        use crate::data_contract::document_type::DocumentPropertyType;
+        if raw.is_empty() {
+            return vec![Vec::new()];
+        }
+        // Gate on the exact encoded-timestamp width: `decode_date_timestamp`
+        // reads the first 8 bytes of any longer input, which would bucket a
+        // longer value by a truncated prefix instead of keeping its raw key.
+        let timestamp = (raw.len() == 8)
+            .then(|| DocumentPropertyType::decode_date_timestamp(raw))
+            .flatten();
+        match timestamp {
+            Some(timestamp) => self
+                .containing_buckets(timestamp)
+                .into_iter()
+                .map(DocumentPropertyType::encode_date_timestamp)
+                .collect(),
+            None => vec![raw.to_vec()],
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// One hour as the transform declares it (seconds) and as every timestamp
+    /// below is expressed (milliseconds).
+    const HOUR_SECONDS: u64 = 3_600;
+    const HOUR_MS: u64 = 3_600_000;
+
+    fn transform() -> TimeRangeTransform {
+        // range = 6h, step = 2h, phase = 0 → overlap factor 3.
+        TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 6 * HOUR_SECONDS,
+            step_seconds: 2 * HOUR_SECONDS,
+            phase_seconds: 0,
+        }
+    }
+
+    #[test]
+    fn overlap_factor_is_range_over_step() {
+        assert_eq!(transform().overlap_factor(), 3);
+    }
+
+    #[test]
+    fn seconds_that_cannot_be_scaled_saturate_rather_than_panic() {
+        // Contract validation refuses parameters this large, so the only way
+        // to build one is in code; the accessors must degrade into a pinned
+        // window instead of panicking on the multiplication.
+        let t = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: u64::MAX,
+            step_seconds: u64::MAX,
+            phase_seconds: 0,
+        };
+        assert_eq!(t.range_ms(), u64::MAX);
+        assert_eq!(t.overlap_factor(), 1);
+        assert_eq!(t.most_recent_start(u64::MAX), Some(u64::MAX));
+    }
+
+    #[test]
+    fn most_recent_start_floors_to_step_multiple() {
+        let t = transform();
+        let h = HOUR_MS;
+        // now = 7h → most recent start = 6h
+        assert_eq!(t.most_recent_start(7 * h), Some(6 * h));
+        // exactly on a boundary stays put
+        assert_eq!(t.most_recent_start(6 * h), Some(6 * h));
+        // exactly at the epoch is the first range
+        assert_eq!(t.most_recent_start(0), Some(0));
+    }
+
+    #[test]
+    fn the_epoch_sliver_before_the_phase_has_no_buckets() {
+        // A one-minute window stepping every twenty seconds, its grid phased
+        // five seconds into each step. The only timestamps outside every
+        // range are the first five seconds of 1970 — a sliver no real
+        // timestamp reaches; the math must still answer it honestly.
+        let t = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 60,
+            step_seconds: 20,
+            phase_seconds: 5,
+        };
+        assert_eq!(t.most_recent_start(4_999), None);
+        assert_eq!(t.containing_buckets(4_999), Vec::<u64>::new());
+        assert_eq!(t.newest_active_start(4_999), None);
+        assert_eq!(t.oldest_active_start(4_999), None);
+        // at the phase anchor the first range starts
+        assert_eq!(t.most_recent_start(5_000), Some(5_000));
+        assert_eq!(t.containing_buckets(5_000), vec![5_000]);
+        // every returned bucket actually contains the timestamp
+        for now in [5_000u64, 15_000, 64_999, 105_000] {
+            for start in t.containing_buckets(now) {
+                assert!(start <= now && now < start + t.range_ms());
+            }
+        }
+    }
+
+    #[test]
+    fn containing_buckets_are_the_overlapping_ranges() {
+        let t = transform();
+        let h = HOUR_MS;
+        // doc at 7h belongs to ranges starting at 6h, 4h, 2h
+        assert_eq!(t.containing_buckets(7 * h), vec![6 * h, 4 * h, 2 * h]);
+        // every returned range actually contains the timestamp
+        for start in t.containing_buckets(7 * h) {
+            assert!(start <= 7 * h && 7 * h < start + t.range_ms());
+        }
+    }
+
+    #[test]
+    fn containing_buckets_truncate_near_the_epoch() {
+        let t = transform();
+        let h = HOUR_MS;
+        // doc at 3h: ranges starting at 2h and 0h (4h start would be in future)
+        assert_eq!(t.containing_buckets(3 * h), vec![2 * h, 0]);
+    }
+
+    #[test]
+    fn newest_vs_oldest_active() {
+        let t = transform();
+        let h = HOUR_MS;
+        let now = 7 * h;
+        // newest active = freshest started range
+        assert_eq!(t.newest_active_start(now), Some(6 * h));
+        // oldest active = covers the full trailing window
+        assert_eq!(t.oldest_active_start(now), Some(2 * h));
+        // oldest active range still contains now
+        let oldest = t.oldest_active_start(now).expect("a range is active");
+        assert!(oldest <= now && now < oldest + t.range_ms());
+    }
+
+    #[test]
+    fn entry_keys_follow_the_shared_fan_out_rule() {
+        use crate::data_contract::document_type::DocumentPropertyType;
+        let t = transform();
+        let h = HOUR_MS;
+        // null keeps the single ordinary null entry
+        assert_eq!(t.entry_keys_for_raw(&[]), vec![Vec::<u8>::new()]);
+        // a decodable timestamp fans out into its containing buckets
+        let raw = DocumentPropertyType::encode_date_timestamp(7 * h);
+        assert_eq!(
+            t.entry_keys_for_raw(&raw),
+            vec![
+                DocumentPropertyType::encode_date_timestamp(6 * h),
+                DocumentPropertyType::encode_date_timestamp(4 * h),
+                DocumentPropertyType::encode_date_timestamp(2 * h),
+            ]
+        );
+        // a non-timestamp non-empty value keeps its raw key: shorter than
+        // the 8-byte encoding…
+        assert_eq!(t.entry_keys_for_raw(&[1, 2, 3]), vec![vec![1, 2, 3]]);
+        // …and longer too — it must NOT bucket by its first 8 bytes
+        let mut long = DocumentPropertyType::encode_date_timestamp(7 * h);
+        long.push(0xFF);
+        assert_eq!(t.entry_keys_for_raw(&long), vec![long.clone()]);
+        // a timestamp inside the epoch sliver belongs to no range: no keys
+        let t_phased = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 60,
+            step_seconds: 20,
+            phase_seconds: 5,
+        };
+        let raw = DocumentPropertyType::encode_date_timestamp(4_999);
+        assert_eq!(t_phased.entry_keys_for_raw(&raw), Vec::<Vec<u8>>::new());
+    }
+
+    #[test]
+    fn phase_shifts_alignment() {
+        let t = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 60,
+            step_seconds: 20,
+            phase_seconds: 5,
+        };
+        // starts are the 5th, 25th, 45th, ... second; now = the 50th second →
+        // most recent start is the 45th
+        assert_eq!(t.most_recent_start(50_000), Some(45_000));
+        assert_eq!(t.containing_buckets(50_000), vec![45_000, 25_000, 5_000]);
+    }
+
+    #[test]
+    fn storage_keys_qualify_the_property_with_the_grid() {
+        // phase 0 is spelled by omission — the canonical three-part form
+        assert_eq!(
+            transform().storage_key("$createdAt"),
+            "$createdAt#21600#7200"
+        );
+        // a non-zero phase appends the fourth part
+        let t = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 60,
+            step_seconds: 20,
+            phase_seconds: 5,
+        };
+        assert_eq!(t.storage_key("$createdAt"), "$createdAt#60#20#5");
+        // two grids over the same property produce distinct sibling keys —
+        // the collision the qualification exists to prevent (every 6h start
+        // is also a 3h start, so unqualified keys would interleave)
+        let six_hourly = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 6 * HOUR_SECONDS,
+            step_seconds: 6 * HOUR_SECONDS,
+            phase_seconds: 0,
+        };
+        let three_hourly = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 3 * HOUR_SECONDS,
+            step_seconds: 3 * HOUR_SECONDS,
+            phase_seconds: 0,
+        };
+        assert_ne!(
+            six_hourly.storage_key("$createdAt"),
+            three_hourly.storage_key("$createdAt")
+        );
+    }
+}
diff --git a/packages/rs-dpp/src/data_contract/document_type/index_level/find_first_change.rs b/packages/rs-dpp/src/data_contract/document_type/index_level/find_first_change.rs
index 80b37ef390f..8f1d0c4a7b5 100644
--- a/packages/rs-dpp/src/data_contract/document_type/index_level/find_first_change.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/index_level/find_first_change.rs
@@ -159,4 +159,40 @@ impl IndexLevel {
 
         None
     }
+
+    /// Time-range counterpart of [`Self::find_first_countability_change`].
+    /// Recursively finds the first index path where the `time_range`
+    /// transform differs between two `IndexLevel` trees. The transform
+    /// dictates how many index entries each document produces and under
+    /// which bucket keys, so changing it after creation would leave already
+    /// stored documents indexed under stale buckets — it is immutable.
+    ///
+    /// Returns `None` if the transform is the same everywhere.
+    #[cfg(feature = "validation")]
+    pub(super) fn find_first_time_range_change(&self, new: &IndexLevel) -> Option<String> {
+        if self.time_range() != new.time_range() {
+            let fmt = |t: Option<&super::TimeRangeTransform>| match t {
+                Some(t) => format!(
+                    "Some(on: {:?}, range: {}s, step: {}s, phase: {}s)",
+                    t.source, t.range_seconds, t.step_seconds, t.phase_seconds
+                ),
+                None => "None".to_string(),
+            };
+            return Some(format!(
+                "(timeRange: {} -> {})",
+                fmt(self.time_range()),
+                fmt(new.time_range()),
+            ));
+        }
+
+        for (key, old_sub) in &self.sub_index_levels {
+            if let Some(new_sub) = new.sub_index_levels.get(key) {
+                if let Some(inner_path) = old_sub.find_first_time_range_change(new_sub) {
+                    return Some(format!("{} -> {}", key, inner_path));
+                }
+            }
+        }
+
+        None
+    }
 }
diff --git a/packages/rs-dpp/src/data_contract/document_type/index_level/mod.rs b/packages/rs-dpp/src/data_contract/document_type/index_level/mod.rs
index 77295ca0eae..a098ba7ed20 100644
--- a/packages/rs-dpp/src/data_contract/document_type/index_level/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/index_level/mod.rs
@@ -7,6 +7,7 @@ use crate::consensus::basic::data_contract::DuplicateIndexError;
 use crate::consensus::basic::BasicError;
 use crate::consensus::ConsensusError;
 use crate::data_contract::document_type::index::IndexCountability;
+use crate::data_contract::document_type::index::TimeRangeTransform;
 use crate::data_contract::document_type::index_level::IndexType::{
     ContestedResourceIndex, NonUniqueIndex, UniqueIndex,
 };
@@ -121,6 +122,14 @@ pub struct IndexLevel {
     sub_index_levels: BTreeMap<String, IndexLevel>,
     /// did an index terminate at this level
     has_index_with_type: Option<IndexLevelTypeInfo>,
+    /// When set, the property reached at this level is a timestamp that is
+    /// bucketed into time ranges (see [`TimeRangeTransform`]). Only ever set
+    /// on a *first-property* node (a direct child of the root), because a
+    /// time-range transform must be its index's leading property. At
+    /// insert/delete/update time the document's timestamp for this property
+    /// is expanded into one key per overlapping range bucket instead of a
+    /// single key. Immutable after contract creation.
+    time_range: Option<TimeRangeTransform>,
     /// unique level identifier
     level_identifier: u64,
 }
@@ -134,6 +143,12 @@ impl IndexLevel {
         &self.sub_index_levels
     }
 
+    /// The time-range transform applied to the property reached at this
+    /// level, if any. Only set on first-property nodes.
+    pub fn time_range(&self) -> Option<&TimeRangeTransform> {
+        self.time_range.as_ref()
+    }
+
     pub fn has_index_with_type(&self) -> Option<&IndexLevelTypeInfo> {
         // Was `Option<IndexLevelTypeInfo>` (Copy) before the v3 sum-tree
         // expansion added `summable: Option<String>` to the struct, which
@@ -235,6 +250,7 @@ impl IndexLevel {
         let mut index_level = IndexLevel {
             sub_index_levels: Default::default(),
             has_index_with_type: None,
+            time_range: None,
             level_identifier: 0,
         };
 
@@ -243,21 +259,39 @@ impl IndexLevel {
         for index_to_borrow in indices {
             let index = index_to_borrow.borrow();
             let mut current_level = &mut index_level;
-            let mut properties_iter = index.properties.iter().peekable();
-
-            while let Some(index_part) = properties_iter.next() {
+            let mut properties_iter = index.properties.iter().enumerate().peekable();
+
+            while let Some((position, index_part)) = properties_iter.next() {
+                // A time-range transform always targets the index's first
+                // property, and its level is keyed by the property name
+                // *qualified with the grid* (`Index::level_key`, backed by
+                // `TimeRangeTransform::storage_key`) rather than the bare
+                // name. That fork is what lets several grids over one
+                // timestamp — and a plain index over the same timestamp —
+                // coexist: each grid's bucket starts live in their own
+                // subtree instead of interleaving in one keyspace. Identical
+                // grids map to the identical key, so indices sharing a grid
+                // still share the level.
+                let level_key = index.level_key(position, &index_part.name);
                 current_level = current_level
                     .sub_index_levels
-                    .entry(index_part.name.clone())
+                    .entry(level_key)
                     .or_insert_with(|| {
                         counter += 1;
                         IndexLevel {
                             level_identifier: counter,
                             sub_index_levels: Default::default(),
                             has_index_with_type: None,
+                            time_range: None,
                         }
                     });
 
+                if position == 0 {
+                    if let Some(transform) = &index.time_range {
+                        current_level.time_range = Some(transform.clone());
+                    }
+                }
+
                 // The last property
                 if properties_iter.peek().is_none() {
                     // This level already has been initialized.
@@ -399,6 +433,20 @@ impl IndexLevel {
             );
         }
 
+        // A time-range transform determines how many index entries each
+        // document produces and under which bucket keys. Changing it after
+        // creation would leave already-stored documents indexed under stale
+        // buckets, so it is immutable — reject any change.
+        if let Some(time_range_change_path) = self.find_first_time_range_change(new_indices) {
+            return SimpleConsensusValidationResult::new_with_error(
+                DataContractInvalidIndexDefinitionUpdateError::new(
+                    document_type_name.to_string(),
+                    time_range_change_path,
+                )
+                .into(),
+            );
+        }
+
         SimpleConsensusValidationResult::new()
     }
 }
@@ -430,6 +478,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -464,6 +514,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![
@@ -483,6 +535,8 @@ mod tests {
                 ranked_countable: false,
                 ranked_summable: false,
                 ranked_averageable: false,
+                time_range: None,
+                terminal: None,
             },
             Index {
                 name: "test2".to_string(),
@@ -500,6 +554,8 @@ mod tests {
                 ranked_countable: false,
                 ranked_summable: false,
                 ranked_averageable: false,
+                time_range: None,
+                terminal: None,
             },
         ];
 
@@ -543,6 +599,8 @@ mod tests {
                 ranked_countable: false,
                 ranked_summable: false,
                 ranked_averageable: false,
+                time_range: None,
+                terminal: None,
             },
             Index {
                 name: "test2".to_string(),
@@ -560,6 +618,8 @@ mod tests {
                 ranked_countable: false,
                 ranked_summable: false,
                 ranked_averageable: false,
+                time_range: None,
+                terminal: None,
             },
         ];
 
@@ -579,6 +639,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -620,6 +682,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -644,6 +708,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -691,6 +757,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -709,6 +777,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -750,6 +820,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -768,6 +840,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -809,6 +883,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -827,6 +903,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -868,6 +946,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -909,6 +989,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -927,6 +1009,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -968,6 +1052,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -986,6 +1072,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -1033,6 +1121,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -1057,6 +1147,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -1104,6 +1196,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let new_indices = vec![Index {
@@ -1128,6 +1222,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let old_index_structure =
@@ -1183,6 +1279,8 @@ mod tests {
             ranked_countable,
             ranked_summable,
             ranked_averageable,
+            time_range: None,
+            terminal: None,
         }
     }
 
@@ -1339,6 +1437,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }];
 
         let mut new_indices = old_indices.clone();
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/mod.rs b/packages/rs-dpp/src/data_contract/document_type/methods/mod.rs
index 88ce7c0f39d..9a10bfaa296 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/mod.rs
@@ -95,6 +95,41 @@ pub trait DocumentTypeV0Methods: DocumentTypeV0Getters + DocumentTypeV0MethodsVe
         }
     }
 
+    /// [`Self::index_for_types`] restricted to the indexes `filter` admits.
+    ///
+    /// Candidates rejected by `filter` are skipped before they are scored, so
+    /// they can never be returned. This is the only correct way to require a
+    /// property of the selected index: because several indexes can cover the
+    /// same fields and ties are broken by the index map's name ordering,
+    /// checking the property after an unrestricted search can reject the
+    /// winner but cannot surface the index the caller actually needed.
+    ///
+    /// Shares the `index_for_types` feature-version gate — the filter narrows
+    /// the candidate set, it does not change how a candidate is scored.
+    fn index_for_types_matching(
+        &self,
+        index_names: &[&str],
+        in_field_name: Option<&str>,
+        order_by: &[&str],
+        filter: impl Fn(&Index) -> bool,
+        platform_version: &PlatformVersion,
+    ) -> Result<Option<(&Index, u16)>, ProtocolError> {
+        match platform_version
+            .dpp
+            .contract_versions
+            .document_type_versions
+            .methods
+            .index_for_types
+        {
+            0 => Ok(self.index_for_types_matching_v0(index_names, in_field_name, order_by, filter)),
+            version => Err(ProtocolError::UnknownVersionMismatch {
+                method: "index_for_types_matching".to_string(),
+                known_versions: vec![0],
+                received: version,
+            }),
+        }
+    }
+
     fn serialize_value_for_key(
         &self,
         key: &str,
@@ -164,9 +199,10 @@ pub trait DocumentTypeV0Methods: DocumentTypeV0Getters + DocumentTypeV0MethodsVe
             .estimated_size
         {
             0 => self.estimated_size_v0(platform_version),
+            1 => self.estimated_size_v1(platform_version),
             version => Err(ProtocolError::UnknownVersionMismatch {
                 method: "estimated_size".to_string(),
-                known_versions: vec![0],
+                known_versions: vec![0, 1],
                 received: version,
             }),
         }
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/common/mod.rs b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/common/mod.rs
index cae38edefce..8feb0940fd3 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/common/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/common/mod.rs
@@ -346,6 +346,29 @@ impl DocumentTypeRef<'_> {
             );
         }
 
+        // indexOnly immutability: the flag selects the entire storage layout
+        // (no primary-key tree, index terminals are Items keyed by the
+        // terminal property). Flipping it in either direction would strand
+        // every existing entry: rows with no primary storage to dereference,
+        // or references whose primary rows were never written. The per-index
+        // `terminal` needs no separate check here — it is a field of `Index`,
+        // so `validate_index_definitions_unchanged`'s full equality
+        // comparison already rejects any change to it.
+        if new_document_type.index_only() != self.index_only() {
+            return SimpleConsensusValidationResult::new_with_error(
+                DocumentTypeUpdateError::new(
+                    self.data_contract_id(),
+                    self.name(),
+                    format!(
+                        "document type can not change whether it is indexOnly: changing from {} to {}",
+                        self.index_only(),
+                        new_document_type.index_only()
+                    ),
+                )
+                    .into(),
+            );
+        }
+
         SimpleConsensusValidationResult::new()
     }
 
@@ -1196,6 +1219,100 @@ mod tests {
             );
         }
 
+        #[test]
+        fn should_return_invalid_result_when_index_only_is_changed() {
+            let platform_version = PlatformVersion::latest();
+            let data_contract_id = Identifier::random();
+            let document_type_name = "like";
+
+            // A minimal valid indexOnly type: one refersTo-typed property,
+            // one index over it, terminal defaulting to $ownerId.
+            let index_only_schema = platform_value!({
+                "type": "object",
+                "indexOnly": true,
+                "documentsMutable": false,
+                "properties": {
+                    "postId": {
+                        "type": "array",
+                        "byteArray": true,
+                        "minItems": 32,
+                        "maxItems": 32,
+                        "contentMediaType": "application/x.dash.dpp.identifier",
+                        "refersTo": { "type": "identity" },
+                        "position": 0,
+                    }
+                },
+                "required": ["postId"],
+                "indices": [
+                    {
+                        "name": "byPost",
+                        "properties": [{ "postId": "asc" }],
+                    }
+                ],
+                "additionalProperties": false,
+            });
+
+            // The same type without indexOnly (documentsMutable kept equal
+            // so the earlier mutability check doesn't fire first).
+            let plain_schema = platform_value!({
+                "type": "object",
+                "documentsMutable": false,
+                "properties": {
+                    "postId": {
+                        "type": "array",
+                        "byteArray": true,
+                        "minItems": 32,
+                        "maxItems": 32,
+                        "contentMediaType": "application/x.dash.dpp.identifier",
+                        "refersTo": { "type": "identity" },
+                        "position": 0,
+                    }
+                },
+                "required": ["postId"],
+                "indices": [
+                    {
+                        "name": "byPost",
+                        "properties": [{ "postId": "asc" }],
+                    }
+                ],
+                "additionalProperties": false,
+            });
+
+            let config = DataContractConfig::default_for_version(platform_version)
+                .expect("should create a default config");
+
+            let make_document_type = |schema: platform_value::Value| {
+                DocumentType::try_from_schema(
+                    data_contract_id,
+                    1,
+                    config.version(),
+                    document_type_name,
+                    schema,
+                    None,
+                    &BTreeMap::new(),
+                    &config,
+                    false,
+                    &mut Vec::new(),
+                    platform_version,
+                )
+                .expect("document type should parse")
+            };
+
+            let old_document_type = make_document_type(index_only_schema);
+            let new_document_type = make_document_type(plain_schema);
+
+            let result = old_document_type
+                .as_ref()
+                .validate_config(new_document_type.as_ref());
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::StateError(
+                    StateError::DocumentTypeUpdateError(e)
+                )] if e.additional_message() == "document type can not change whether it is indexOnly: changing from true to false"
+            );
+        }
+
         #[test]
         fn should_return_invalid_result_when_range_countable_is_changed() {
             // documents_countable must remain equal across old/new so that
@@ -1712,7 +1829,7 @@ mod tests {
             let old = document_type_with_byte_array(old_ba, platform_version);
             let new = document_type_with_byte_array(new_ba, platform_version);
             old.as_ref()
-                .validate_update(new.as_ref(), platform_version)
+                .validate_update(new.as_ref(), 2, platform_version)
                 .expect("validate_update should not error")
         }
 
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/mod.rs b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/mod.rs
index a8fd6b443c5..6e4418eaeeb 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/mod.rs
@@ -9,10 +9,14 @@ mod v1;
 
 impl DocumentTypeRef<'_> {
     /// Verify that the update to the document type is valid.
-    /// We assume that new document type is valid
+    /// We assume that new document type is valid.
+    /// `new_contract_version` is the version the updated contract will have
+    /// (already validated to be the old version + 1): a newly added required
+    /// property must carry `requiredSince` equal to exactly that version.
     pub fn validate_update(
         &self,
         new_document_type: DocumentTypeRef,
+        new_contract_version: u32,
         platform_version: &PlatformVersion,
     ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
         match platform_version
@@ -22,7 +26,7 @@ impl DocumentTypeRef<'_> {
             .validate_update
         {
             0 => self.validate_update_v0(new_document_type, platform_version),
-            1 => self.validate_update_v1(new_document_type, platform_version),
+            1 => self.validate_update_v1(new_document_type, new_contract_version, platform_version),
             version => Err(ProtocolError::UnknownVersionMismatch {
                 method: "validate_update".to_string(),
                 known_versions: vec![0, 1],
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v0/mod.rs b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v0/mod.rs
index 46a4de01420..3f7616e6e47 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v0/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v0/mod.rs
@@ -132,7 +132,7 @@ mod tests {
 
         let early_result = old
             .as_ref()
-            .validate_update(new_early_name.as_ref(), platform_version)
+            .validate_update(new_early_name.as_ref(), 2, platform_version)
             .expect("early-name addition should produce a validation result");
 
         assert_matches!(
@@ -147,7 +147,7 @@ mod tests {
         // check ("schema keyword 'indices' ... is not supported").
         let late_error = old
             .as_ref()
-            .validate_update(new_late_name.as_ref(), platform_version)
+            .validate_update(new_late_name.as_ref(), 2, platform_version)
             .expect_err("late-name addition should error in schema compatibility");
 
         assert_matches!(
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v1/mod.rs b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v1/mod.rs
index 8e872772233..76a6732fc20 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v1/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/validate_update/v1/mod.rs
@@ -20,7 +20,9 @@
 //! was always rejected by the `indices` schema-compatibility hard error) —
 //! it makes the rejection deterministic, clean, and correctly labeled.
 
-use crate::consensus::basic::data_contract::DataContractInvalidIndexDefinitionUpdateError;
+use crate::consensus::basic::data_contract::{
+    DataContractInvalidIndexDefinitionUpdateError, DataContractInvalidRequiredFieldsUpdateError,
+};
 use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use crate::data_contract::document_type::DocumentTypeRef;
 use crate::validation::SimpleConsensusValidationResult;
@@ -32,6 +34,7 @@ impl DocumentTypeRef<'_> {
     pub(super) fn validate_update_v1(
         &self,
         new_document_type: DocumentTypeRef,
+        new_contract_version: u32,
         platform_version: &PlatformVersion,
     ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
         // Validate configuration
@@ -55,10 +58,102 @@ impl DocumentTypeRef<'_> {
             return Ok(result);
         }
 
+        // Validate required-field changes (the schema compatibility differ
+        // has the top-level `required` key stripped, so this is the only
+        // place top-level requiredness changes are judged)
+        let result = self.validate_required_fields_update(new_document_type, new_contract_version);
+
+        if !result.is_valid() {
+            return Ok(result);
+        }
+
         // Validate schema compatibility
         self.validate_schema(new_document_type, platform_version)
     }
 
+    /// Top-level requiredness may only change in one way: a brand-new
+    /// property may be added as required when it is annotated with
+    /// `requiredSince` equal to the contract version this update creates.
+    /// Everything else is frozen: requiredness is baked into the document
+    /// wire format (required properties serialize without a presence flag),
+    /// and the per-document contract-version stamp resolves layouts from the
+    /// latest schema alone only if annotations never change retroactively.
+    ///
+    /// Nested (dotted) required paths and the `requiredSince` keyword on
+    /// existing properties stay frozen by the schema compatibility differ;
+    /// this check judges the top-level `required` key, which is stripped
+    /// from the diff exactly like `indices`.
+    fn validate_required_fields_update(
+        &self,
+        new_document_type: DocumentTypeRef,
+        new_contract_version: u32,
+    ) -> SimpleConsensusValidationResult {
+        let old_required = self.required_fields();
+        let new_required = new_document_type.required_fields();
+
+        for name in old_required {
+            // Nested paths are governed by the schema compatibility differ
+            if name.contains('.') {
+                continue;
+            }
+            if !new_required.contains(name) {
+                return SimpleConsensusValidationResult::new_with_error(
+                    DataContractInvalidRequiredFieldsUpdateError::new(
+                        self.name().to_string(),
+                        format!("removed required field '{name}'"),
+                    )
+                    .into(),
+                );
+            }
+        }
+
+        for name in new_required {
+            if name.contains('.') || old_required.contains(name) {
+                continue;
+            }
+            if name.starts_with('$') {
+                return SimpleConsensusValidationResult::new_with_error(
+                    DataContractInvalidRequiredFieldsUpdateError::new(
+                        self.name().to_string(),
+                        format!("system field '{name}' cannot become required"),
+                    )
+                    .into(),
+                );
+            }
+            if self.properties().contains_key(name) {
+                return SimpleConsensusValidationResult::new_with_error(
+                    DataContractInvalidRequiredFieldsUpdateError::new(
+                        self.name().to_string(),
+                        format!("existing property '{name}' cannot become required"),
+                    )
+                    .into(),
+                );
+            }
+            let Some(new_property) = new_document_type.properties().get(name) else {
+                return SimpleConsensusValidationResult::new_with_error(
+                    DataContractInvalidRequiredFieldsUpdateError::new(
+                        self.name().to_string(),
+                        format!("added required field '{name}' references an unknown property"),
+                    )
+                    .into(),
+                );
+            };
+            if new_property.required_since != Some(new_contract_version) {
+                return SimpleConsensusValidationResult::new_with_error(
+                    DataContractInvalidRequiredFieldsUpdateError::new(
+                        self.name().to_string(),
+                        format!(
+                            "new required field '{name}' must carry requiredSince {new_contract_version}, the contract version this update creates"
+                        ),
+                    )
+                    .into(),
+                );
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+
     /// Index definitions are immutable once a document type is registered:
     /// Drive lays out the index trees at contract creation and never
     /// backfills them, so an added index would silently miss every
@@ -196,7 +291,7 @@ mod tests {
 
         let early_result = old
             .as_ref()
-            .validate_update(new_early_name.as_ref(), platform_version)
+            .validate_update(new_early_name.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -208,7 +303,7 @@ mod tests {
 
         let late_result = old
             .as_ref()
-            .validate_update(new_late_name.as_ref(), platform_version)
+            .validate_update(new_late_name.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -242,7 +337,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -268,7 +363,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -295,7 +390,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -325,7 +420,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert_matches!(
@@ -359,7 +454,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert!(
@@ -378,7 +473,7 @@ mod tests {
 
         let result = old
             .as_ref()
-            .validate_update(new.as_ref(), platform_version)
+            .validate_update(new.as_ref(), 2, platform_version)
             .expect("validate_update should not error");
 
         assert!(
@@ -465,7 +560,7 @@ mod tests {
 
             let result = old
                 .as_ref()
-                .validate_update(new.as_ref(), platform_version)
+                .validate_update(new.as_ref(), 2, platform_version)
                 .expect("validate_update should not error");
 
             assert_matches!(
@@ -484,7 +579,7 @@ mod tests {
 
             let result = old
                 .as_ref()
-                .validate_update(new.as_ref(), platform_version)
+                .validate_update(new.as_ref(), 2, platform_version)
                 .expect("validate_update should not error");
 
             assert!(
@@ -494,4 +589,239 @@ mod tests {
             );
         }
     }
+
+    // ================================================================
+    //  Required-field updates (`requiredSince`)
+    // ================================================================
+
+    mod required_fields_update {
+        use super::*;
+
+        fn doc_type_with(
+            properties: Value,
+            required: Value,
+            platform_version: &PlatformVersion,
+        ) -> DocumentType {
+            let schema = platform_value!({
+                "type": "object",
+                "properties": properties,
+                "required": required,
+                "additionalProperties": false,
+            });
+            let config = DataContractConfig::default_for_version(platform_version)
+                .expect("should create a default config");
+            DocumentType::try_from_schema(
+                Identifier::new([1; 32]),
+                1,
+                config.version(),
+                "test",
+                schema,
+                None,
+                &BTreeMap::new(),
+                &config,
+                false,
+                &mut Vec::new(),
+                platform_version,
+            )
+            .expect("failed to create document type")
+        }
+
+        fn old_doc_type(platform_version: &PlatformVersion) -> DocumentType {
+            doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                }),
+                platform_value!(["a"]),
+                platform_version,
+            )
+        }
+
+        #[test]
+        fn should_allow_adding_new_required_property_with_correct_required_since() {
+            let platform_version = PlatformVersion::latest();
+
+            let old = old_doc_type(platform_version);
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32, "requiredSince": 2},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 2, platform_version)
+                .expect("validate_update should not error");
+
+            assert!(
+                result.is_valid(),
+                "a new required property annotated with the version this \
+                 update creates must be accepted, got {:?}",
+                result.errors
+            );
+        }
+
+        #[test]
+        fn should_reject_new_required_property_with_retroactive_required_since() {
+            let platform_version = PlatformVersion::latest();
+
+            let old = old_doc_type(platform_version);
+            // Contract moving to version 3, but the annotation claims 2:
+            // documents stamped 2 would misparse
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32, "requiredSince": 2},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 3, platform_version)
+                .expect("validate_update should not error");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.details().contains("must carry requiredSince 3")
+            );
+        }
+
+        #[test]
+        fn should_reject_new_required_property_without_required_since() {
+            let platform_version = PlatformVersion::latest();
+
+            let old = old_doc_type(platform_version);
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 2, platform_version)
+                .expect("validate_update should not error");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.details().contains("must carry requiredSince 2")
+            );
+        }
+
+        #[test]
+        fn should_reject_promoting_existing_property_to_required() {
+            let platform_version = PlatformVersion::latest();
+
+            let old = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32},
+                }),
+                platform_value!(["a"]),
+                platform_version,
+            );
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 2, platform_version)
+                .expect("validate_update should not error");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.details() == "existing property 'b' cannot become required"
+            );
+        }
+
+        #[test]
+        fn should_reject_removing_required_field() {
+            let platform_version = PlatformVersion::latest();
+
+            let old = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32},
+                }),
+                platform_value!(["a"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 2, platform_version)
+                .expect("validate_update should not error");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.details() == "removed required field 'b'"
+            );
+        }
+
+        #[test]
+        fn should_reject_mutating_required_since_on_existing_property() {
+            let platform_version = PlatformVersion::latest();
+
+            // The property was added as required at version 2; a later
+            // update must not move the annotation. This is caught by the
+            // compatibility differ's frozen `requiredSince` rule.
+            let old = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32, "requiredSince": 2},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+            let new = doc_type_with(
+                platform_value!({
+                    "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+                    "b": {"type": "string", "position": 1, "maxLength": 60_u32, "requiredSince": 3},
+                }),
+                platform_value!(["a", "b"]),
+                platform_version,
+            );
+
+            let result = old
+                .as_ref()
+                .validate_update(new.as_ref(), 3, platform_version)
+                .expect("validate_update should not error");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::IncompatibleDocumentTypeSchemaError(e)
+                )] if e.operation() == "replace" && e.property_path() == "/properties/b/requiredSince"
+            );
+        }
+    }
 }
diff --git a/packages/rs-dpp/src/data_contract/document_type/methods/versioned_methods.rs b/packages/rs-dpp/src/data_contract/document_type/methods/versioned_methods.rs
index 588c826c383..0c882423d35 100644
--- a/packages/rs-dpp/src/data_contract/document_type/methods/versioned_methods.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/methods/versioned_methods.rs
@@ -4,7 +4,8 @@ use crate::data_contract::document_type::v0::DocumentTypeV0;
 use crate::data_contract::document_type::v1::DocumentTypeV1;
 use crate::data_contract::document_type::v2::DocumentTypeV2;
 use crate::data_contract::document_type::{
-    DocumentPropertyType, DocumentType, DocumentTypeRef, Index, DEFAULT_HASH_SIZE, MAX_INDEX_SIZE,
+    DocumentPropertyType, DocumentType, DocumentTypeRef, Index, CONTRACT_VERSION_STAMP_MAX_SIZE,
+    DEFAULT_HASH_SIZE, MAX_INDEX_SIZE,
 };
 use crate::data_contract::errors::DataContractError;
 use crate::document::property_names::{
@@ -166,6 +167,7 @@ pub trait DocumentTypeV0MethodsVersioned: DocumentTypeV0Getters + DocumentTypeBa
         {
             0 => {
                 let mut document = DocumentV0 {
+                    contract_version: None,
                     id: document_id,
                     owner_id,
                     properties: data
@@ -328,6 +330,7 @@ pub trait DocumentTypeV0MethodsVersioned: DocumentTypeV0Getters + DocumentTypeBa
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 owner_id,
                 properties,
@@ -400,10 +403,32 @@ pub trait DocumentTypeV0MethodsVersioned: DocumentTypeV0Getters + DocumentTypeBa
         index_names: &[&str],
         in_field_name: Option<&str>,
         order_by: &[&str],
+    ) -> Option<(&Index, u16)> {
+        self.index_for_types_matching_v0(index_names, in_field_name, order_by, |_| true)
+    }
+
+    /// [`Self::index_for_types_v0`] restricted to the indexes `filter` admits.
+    ///
+    /// The filter is applied before `Index::matches`, so a rejected index can
+    /// never win the difference comparison. Callers that need selection pinned
+    /// to a class of index must use this rather than post-checking whatever the
+    /// unrestricted search returned: several indexes can cover the same fields,
+    /// the winner among equally-good candidates is decided by the index map's
+    /// name ordering, and a post-check can only reject the winner — never
+    /// promote the index that was actually required.
+    fn index_for_types_matching_v0(
+        &self,
+        index_names: &[&str],
+        in_field_name: Option<&str>,
+        order_by: &[&str],
+        filter: impl Fn(&Index) -> bool,
     ) -> Option<(&Index, u16)> {
         let mut best_index: Option<(&Index, u16)> = None;
         let mut best_difference = u16::MAX;
         for (_, index) in self.indexes().iter() {
+            if !filter(index) {
+                continue;
+            }
             let difference_option = index.matches(index_names, in_field_name, order_by);
             if let Some(difference) = difference_option {
                 if difference == 0 {
@@ -440,6 +465,15 @@ pub trait DocumentTypeV0MethodsVersioned: DocumentTypeV0Getters + DocumentTypeBa
         Ok(total_size)
     }
 
+    /// Generation 0 plus the document serialization format 3
+    /// contract-version stamp varint. Selected together with format 3 by
+    /// the version table.
+    fn estimated_size_v1(&self, platform_version: &PlatformVersion) -> Result<u16, ProtocolError> {
+        Ok(self
+            .estimated_size_v0(platform_version)?
+            .saturating_add(CONTRACT_VERSION_STAMP_MAX_SIZE))
+    }
+
     fn max_size_v0(&self, platform_version: &PlatformVersion) -> Result<u16, ProtocolError> {
         let mut total_size = 0u16;
 
diff --git a/packages/rs-dpp/src/data_contract/document_type/mod.rs b/packages/rs-dpp/src/data_contract/document_type/mod.rs
index 3492b399571..5f373fa0240 100644
--- a/packages/rs-dpp/src/data_contract/document_type/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/mod.rs
@@ -16,6 +16,8 @@ pub mod restricted_creation;
 pub mod schema;
 
 mod token_costs;
+mod validate_required_since_within_contract_version;
+pub(crate) use validate_required_since_within_contract_version::validate_required_since_within_contract_version;
 pub mod v0;
 pub mod v1;
 pub mod v2;
@@ -39,6 +41,9 @@ pub const DEFAULT_FLOAT_SIZE: usize = 8;
 pub const EMPTY_TREE_STORAGE_SIZE: usize = 33;
 pub const MAX_INDEX_SIZE: usize = 255;
 pub const STORAGE_FLAGS_SIZE: usize = 2;
+/// Worst-case byte length of the contract-version stamp written by document
+/// serialization format 3: a u32 varint.
+pub const CONTRACT_VERSION_STAMP_MAX_SIZE: u16 = 5;
 
 pub(crate) mod property_names {
     pub const DOCUMENTS_KEEP_HISTORY: &str = "documentsKeepHistory";
@@ -62,6 +67,7 @@ pub(crate) mod property_names {
     pub const PROPERTIES: &str = "properties";
     pub const POSITION: &str = "position";
     pub const REQUIRED: &str = "required";
+    pub const REQUIRED_SINCE: &str = "requiredSince";
     pub const TRANSIENT: &str = "transient";
     pub const TYPE: &str = "type";
     pub const REF: &str = "$ref";
@@ -111,6 +117,14 @@ pub(crate) mod property_names {
     /// to be set (parallels the count/sum-individually rules: range
     /// axes require the corresponding base flag).
     pub const RANGE_AVERAGEABLE: &str = "rangeAverageable";
+    /// Doctype-level flag declaring an **indexOnly** document type: documents
+    /// are never written to primary storage — the index entries are the rows,
+    /// each terminating in an `Item` keyed by the index's `terminal` property
+    /// instead of a `Reference` keyed by the document id. Only what is in the
+    /// indexes exists and is recoverable. Meta-schema v3+ (protocol version
+    /// 14). See `apply_index_only` in `try_from_schema::common` for the
+    /// structural constraints the flag imposes.
+    pub const INDEX_ONLY: &str = "indexOnly";
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
diff --git a/packages/rs-dpp/src/data_contract/document_type/property/byte_array_encoding_flip_tests.rs b/packages/rs-dpp/src/data_contract/document_type/property/byte_array_encoding_flip_tests.rs
index 832ba61c864..948b0401352 100644
--- a/packages/rs-dpp/src/data_contract/document_type/property/byte_array_encoding_flip_tests.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/property/byte_array_encoding_flip_tests.rs
@@ -105,6 +105,7 @@ fn build_document_with_ff_prefixed_bytes(_contract: &DataContract) -> Document {
     properties.insert(BYTE_ARRAY_FIELD.to_string(), Value::Bytes32(bytes));
 
     DocumentV0 {
+        contract_version: None,
         id: Identifier::new([1; 32]),
         owner_id: Identifier::new([2; 32]),
         properties,
diff --git a/packages/rs-dpp/src/data_contract/document_type/property/mod.rs b/packages/rs-dpp/src/data_contract/document_type/property/mod.rs
index 7b1dc041afa..ba8f1fb1042 100644
--- a/packages/rs-dpp/src/data_contract/document_type/property/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/property/mod.rs
@@ -39,6 +39,34 @@ pub struct DocumentProperty {
     pub property_type: DocumentPropertyType,
     pub required: bool,
     pub transient: bool,
+    /// The contract version this property is required from (`requiredSince`).
+    /// `None` for plain-required properties (required at every version) and
+    /// for optional properties. Only ever `Some` when `required` is true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required_since: Option<u32>,
+}
+
+impl DocumentProperty {
+    /// Whether this property is required for a document whose bytes conform to
+    /// `contract_version` (the document's stamp). `None` means the document
+    /// was serialized before format 3, which predates every `requiredSince`
+    /// annotation, so only unconditionally required properties count.
+    pub fn required_at(&self, contract_version: Option<u32>) -> bool {
+        self.required
+            && match self.required_since {
+                None => true,
+                Some(since) => contract_version.is_some_and(|version| version >= since),
+            }
+    }
+
+    /// Whether this property is required regardless of any document's
+    /// contract-version stamp: `required` without a `requiredSince` gate.
+    /// This is the requiredness the pre-stamp serialization formats (0–2)
+    /// encode, and it equals `required_at(None)` — an unstamped document
+    /// predates every `requiredSince` annotation.
+    pub fn always_required(&self) -> bool {
+        self.required && self.required_since.is_none()
+    }
 }
 
 #[derive(Debug, PartialEq, Clone, Serialize)]
@@ -2825,6 +2853,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -2833,6 +2862,7 @@ mod tests {
                 property_type: DocumentPropertyType::U64,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let obj = DocumentPropertyType::Object(sub_fields);
@@ -5121,6 +5151,7 @@ mod tests {
                 }),
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         inner_fields.insert(
@@ -5129,6 +5160,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -5179,6 +5211,7 @@ mod tests {
                 }),
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -5198,6 +5231,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         inner_fields.insert(
@@ -5206,6 +5240,7 @@ mod tests {
                 property_type: DocumentPropertyType::U64,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -5638,6 +5673,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -5672,6 +5708,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -5680,6 +5717,7 @@ mod tests {
                 property_type: DocumentPropertyType::U64,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let obj = DocumentPropertyType::Object(sub_fields);
@@ -5697,6 +5735,7 @@ mod tests {
                 property_type: DocumentPropertyType::U16,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -5705,6 +5744,7 @@ mod tests {
                 property_type: DocumentPropertyType::Boolean,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let obj = DocumentPropertyType::Object(sub_fields);
@@ -5996,6 +6036,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -6004,6 +6045,7 @@ mod tests {
                 property_type: DocumentPropertyType::U64,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(sub_fields);
@@ -6063,6 +6105,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -6071,6 +6114,7 @@ mod tests {
                 property_type: DocumentPropertyType::U64,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(sub_fields);
@@ -6156,6 +6200,7 @@ mod tests {
                 property_type: DocumentPropertyType::U8,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         sub_fields.insert(
@@ -6164,6 +6209,7 @@ mod tests {
                 property_type: DocumentPropertyType::Boolean,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(sub_fields);
@@ -6429,6 +6475,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -6457,6 +6504,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         // Second field is required
@@ -6466,6 +6514,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -6581,6 +6630,7 @@ mod tests {
                 }),
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -6598,6 +6648,7 @@ mod tests {
                 property_type: DocumentPropertyType::U32,
                 required: false,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(inner_fields);
@@ -6903,6 +6954,7 @@ mod tests {
                 property_type: DocumentPropertyType::U8,
                 required: true,
                 transient: false,
+                required_since: None,
             },
         );
         let prop = DocumentPropertyType::Object(sub_fields);
@@ -7165,6 +7217,7 @@ mod tests {
             ),
             required: false,
             transient: false,
+            required_since: None,
         };
 
         let value = serde_json::to_value(&property).expect("serialization should succeed");
diff --git a/packages/rs-dpp/src/data_contract/document_type/random_document.rs b/packages/rs-dpp/src/data_contract/document_type/random_document.rs
index 39394248c1a..7797534e8dd 100644
--- a/packages/rs-dpp/src/data_contract/document_type/random_document.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/random_document.rs
@@ -376,6 +376,7 @@ pub trait CreateRandomDocument: DocumentTypeV0Getters + DocumentTypeV0Methods {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 properties,
                 owner_id,
diff --git a/packages/rs-dpp/src/data_contract/document_type/schema/validate_schema_compatibility/v1/mod.rs b/packages/rs-dpp/src/data_contract/document_type/schema/validate_schema_compatibility/v1/mod.rs
index bd369d8ed2b..b1bbcbca3cb 100644
--- a/packages/rs-dpp/src/data_contract/document_type/schema/validate_schema_compatibility/v1/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/schema/validate_schema_compatibility/v1/mod.rs
@@ -16,6 +16,14 @@
 //! diffing, so index definitions are validated in exactly one place. Only
 //! the document type's own `indices` keyword is removed; a *property* named
 //! `indices` lives under `/properties/indices` and is still validated.
+//!
+//! The top-level `required` key is stripped for the same reason: top-level
+//! requiredness changes are judged by `validate_update` v1's
+//! `validate_required_fields_update`, which admits exactly one change the
+//! differ's frozen `required` rule cannot express — a brand-new property
+//! added as required with `requiredSince` equal to the version the update
+//! creates. Nested `required` arrays (under `/properties/<name>/required`)
+//! remain frozen by the differ.
 
 use crate::data_contract::document_type::schema::IncompatibleJsonSchemaOperation;
 use crate::data_contract::errors::{DataContractError, JsonSchemaError};
@@ -48,30 +56,41 @@ static OPTIONS: Lazy<Options> = Lazy::new(|| {
     }
 });
 
-fn without_indices(schema: &JsonValue) -> Cow<'_, JsonValue> {
+/// Strips the two top-level keys whose changes are validated by dedicated
+/// checks in `validate_update` v1 instead of the JSON diff: `indices`
+/// (index definitions compared by name) and `required`
+/// (`validate_required_fields_update`, which admits new-property additions
+/// annotated with `requiredSince`). Only the document type's own top-level
+/// keys are removed; a nested object property's `required` array lives under
+/// `/properties/<name>/required` and stays governed by the differ's frozen
+/// `required` rule, as do properties named `indices` or `required`.
+fn without_top_level_validated_keys(schema: &JsonValue) -> Cow<'_, JsonValue> {
     match schema {
-        JsonValue::Object(map) if map.contains_key("indices") => {
+        JsonValue::Object(map) if map.contains_key("indices") || map.contains_key("required") => {
             let mut map = map.clone();
             map.remove("indices");
+            map.remove("required");
             Cow::Owned(JsonValue::Object(map))
         }
         _ => Cow::Borrowed(schema),
     }
 }
 
-/// Pairing invariant: stripping `indices` unconditionally is only safe
-/// because every `PlatformVersion` that selects this generation
-/// (`validate_schema_compatibility: 1`) also selects a `validate_update`
-/// generation of at least 1 (`dpp.validation.document_type.validate_update`),
-/// which rejects every real index change before this check runs. A future
-/// version table that bumps one without the other would let index changes
-/// bypass compatibility validation entirely.
+/// Pairing invariant: stripping `indices` and top-level `required`
+/// unconditionally is only safe because every `PlatformVersion` that selects
+/// this generation (`validate_schema_compatibility: 1`) also selects a
+/// `validate_update` generation of at least 1
+/// (`dpp.validation.document_type.validate_update`), which rejects every
+/// real index change and every disallowed required-set change before this
+/// check runs. A future version table that bumps one without the other
+/// would let index or required changes bypass compatibility validation
+/// entirely.
 pub(super) fn validate_schema_compatibility_v1(
     original_schema: &JsonValue,
     new_schema: &JsonValue,
 ) -> Result<SimpleValidationResult<IncompatibleJsonSchemaOperation>, ProtocolError> {
-    let original_schema = without_indices(original_schema);
-    let new_schema = without_indices(new_schema);
+    let original_schema = without_top_level_validated_keys(original_schema);
+    let new_schema = without_top_level_validated_keys(new_schema);
 
     validate_schemas_compatibility(&original_schema, &new_schema, OPTIONS.deref())
         .map(|result| {
diff --git a/packages/rs-dpp/src/data_contract/document_type/v0/random_document_type.rs b/packages/rs-dpp/src/data_contract/document_type/v0/random_document_type.rs
index 17fdc0fe3a4..26231060fd9 100644
--- a/packages/rs-dpp/src/data_contract/document_type/v0/random_document_type.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/v0/random_document_type.rs
@@ -197,6 +197,7 @@ impl DocumentTypeV0 {
                 property_type: document_type,
                 required,
                 transient: false,
+                required_since: None,
             }
         };
 
@@ -526,6 +527,7 @@ impl DocumentTypeV0 {
                 property_type: document_type,
                 required,
                 transient: false,
+                required_since: None,
             }
         };
 
diff --git a/packages/rs-dpp/src/data_contract/document_type/v2/accessors.rs b/packages/rs-dpp/src/data_contract/document_type/v2/accessors.rs
index e5a1e59b14f..3964010b1d9 100644
--- a/packages/rs-dpp/src/data_contract/document_type/v2/accessors.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/v2/accessors.rs
@@ -226,6 +226,10 @@ impl DocumentTypeV2Getters for DocumentTypeV2 {
     fn range_summable(&self) -> bool {
         self.range_summable
     }
+
+    fn index_only(&self) -> bool {
+        self.index_only
+    }
 }
 
 impl DocumentTypeV2Setters for DocumentTypeV2 {
diff --git a/packages/rs-dpp/src/data_contract/document_type/v2/mod.rs b/packages/rs-dpp/src/data_contract/document_type/v2/mod.rs
index 99ec4887bdb..07242298e31 100644
--- a/packages/rs-dpp/src/data_contract/document_type/v2/mod.rs
+++ b/packages/rs-dpp/src/data_contract/document_type/v2/mod.rs
@@ -99,6 +99,16 @@ pub struct DocumentTypeV2 {
     /// [`Self::documents_summable`] is `Some` — enforced by
     /// [`crate::data_contract::document_type::accessors::DocumentTypeV2Setters::set_range_summable`].
     pub(in crate::data_contract) range_summable: bool,
+    /// When true, documents of this type are **indexOnly**: nothing is
+    /// written to primary storage (there is no `[0]` primary-key tree at
+    /// all) — the index entries are the rows, each terminating in an `Item`
+    /// keyed by the index's `terminal` property instead of a `Reference`
+    /// keyed by the document id. Only what is in the indexes exists and is
+    /// recoverable. The parser (`apply_index_only`) enforces the structural
+    /// constraints this layout depends on: every property required and
+    /// indexed, `$ownerId` recoverable from at least one index, immutable /
+    /// non-transferable / no history, and per-index terminal typing.
+    pub(in crate::data_contract) index_only: bool,
 }
 
 impl DocumentTypeBasicMethods for DocumentTypeV2 {}
@@ -166,6 +176,7 @@ impl From<DocumentTypeV0> for DocumentTypeV2 {
             range_countable: false,
             documents_summable: None,
             range_summable: false,
+            index_only: false,
         }
     }
 }
@@ -205,6 +216,7 @@ impl From<DocumentTypeV1> for DocumentTypeV2 {
             range_countable: false,
             documents_summable: None,
             range_summable: false,
+            index_only: false,
         }
     }
 }
diff --git a/packages/rs-dpp/src/data_contract/document_type/validate_required_since_within_contract_version.rs b/packages/rs-dpp/src/data_contract/document_type/validate_required_since_within_contract_version.rs
new file mode 100644
index 00000000000..98a8b025c94
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/document_type/validate_required_since_within_contract_version.rs
@@ -0,0 +1,39 @@
+use std::collections::BTreeMap;
+
+use crate::consensus::basic::data_contract::DataContractInvalidRequiredFieldsUpdateError;
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::document_type::DocumentType;
+
+/// A `requiredSince` annotation may never exceed the version of the contract
+/// carrying it — requiredness cannot be pre-scheduled at a future version.
+/// Runs over the *parsed* properties, so annotations reached through `$ref`
+/// are covered. Called wherever document types are built from a contract's
+/// serialized form (creates, updates, and disk loads all pass through
+/// there); a no-op for every contract predating the keyword, since their
+/// properties carry no annotation.
+///
+/// The failure is the dedicated consensus error, because the input is
+/// untrusted schema data: state-transition processing must classify it as
+/// consensus-invalid (nonce bump), never as an execution error. Callers map
+/// it through
+/// [`class_methods::consensus_or_protocol_required_fields_error`](crate::data_contract::document_type::class_methods).
+pub(crate) fn validate_required_since_within_contract_version(
+    document_types: &BTreeMap<String, DocumentType>,
+    contract_version: u32,
+) -> Result<(), DataContractInvalidRequiredFieldsUpdateError> {
+    for (document_type_name, document_type) in document_types {
+        for (property_name, property) in document_type.as_ref().properties() {
+            if let Some(required_since) = property.required_since {
+                if required_since > contract_version {
+                    return Err(DataContractInvalidRequiredFieldsUpdateError::new(
+                        document_type_name.clone(),
+                        format!(
+                            "property '{property_name}' carries requiredSince {required_since} which exceeds the contract version {contract_version}"
+                        ),
+                    ));
+                }
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/packages/rs-dpp/src/data_contract/methods/registration_cost/v1/mod.rs b/packages/rs-dpp/src/data_contract/methods/registration_cost/v1/mod.rs
index f1522e5f888..44a7e6fd047 100644
--- a/packages/rs-dpp/src/data_contract/methods/registration_cost/v1/mod.rs
+++ b/packages/rs-dpp/src/data_contract/methods/registration_cost/v1/mod.rs
@@ -3,7 +3,7 @@ use crate::data_contract::accessors::v1::DataContractV1Getters;
 use crate::data_contract::associated_token::token_configuration::accessors::v0::TokenConfigurationV0Getters;
 use crate::data_contract::associated_token::token_distribution_rules::accessors::v0::TokenDistributionRulesV0Getters;
 use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
-use crate::data_contract::document_type::Index;
+use crate::data_contract::document_type::{Index, IndexGrammarAdmissions};
 use crate::data_contract::serialized_version::DataContractInSerializationFormat;
 use crate::fee::Credits;
 use crate::prelude::DataContract;
@@ -112,24 +112,25 @@ impl DataContractInSerializationFormat {
                 ) {
                     for index_value in index_values {
                         if let Ok(index_value_map) = index_value.to_map() {
-                            // Same ranked-keyword gate the document type parser
-                            // applies (`document_type_schema >= 3`, i.e. meta
-                            // schema v3 / protocol version 14). Without it a
-                            // PV14 index carrying `rankedCountable` &co. would
-                            // fail to parse here and be billed nothing, while
-                            // the identical index parses fine during
+                            // Same keyword gates the document type parser
+                            // applies, read from the one shared generation →
+                            // admission mapping. Without them a PV14 index
+                            // carrying `rankedCountable` &co. or `timeRange`
+                            // would fail to parse here and be billed nothing,
+                            // while the identical index parses fine during
                             // validation — the fee must cover every index the
                             // contract actually registers.
-                            if let Ok(index) = Index::try_from_value_map(
-                                index_value_map.as_slice(),
+                            let admissions = IndexGrammarAdmissions::for_schema_generation(
                                 platform_version
                                     .dpp
                                     .contract_versions
                                     .document_type_versions
                                     .schema
-                                    .document_type_schema
-                                    >= 3,
-                            ) {
+                                    .document_type_schema,
+                            );
+                            if let Ok(index) =
+                                Index::try_from_value_map(index_value_map.as_slice(), admissions)
+                            {
                                 let base_index_fee = if index.contested_index.is_some() {
                                     fee_version.document_type_base_contested_index_registration_fee
                                 } else if index.unique {
diff --git a/packages/rs-dpp/src/data_contract/methods/validate_update/common/mod.rs b/packages/rs-dpp/src/data_contract/methods/validate_update/common/mod.rs
new file mode 100644
index 00000000000..81a786a9ee7
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/methods/validate_update/common/mod.rs
@@ -0,0 +1,393 @@
+//! Helpers shared by every generation of `DataContract::validate_update`
+//! (`v0`, `v1`, …). Only the parts of the update-validation flow that differ
+//! between generations live in the per-version modules; the checks below are
+//! generation independent. Each helper returns a
+//! `SimpleConsensusValidationResult`; generations run them in sequence and
+//! short-circuit on the first invalid result, so extraction preserves the
+//! original early-return semantics exactly.
+
+use std::collections::HashSet;
+
+use crate::block::block_info::BlockInfo;
+use crate::consensus::state::state_error::StateError;
+use crate::consensus::state::token::PreProgrammedDistributionTimestampInPastError;
+use crate::data_contract::accessors::v0::DataContractV0Getters;
+
+use crate::consensus::basic::data_contract::{
+    DuplicateKeywordsError, IncompatibleDataContractSchemaError, InvalidDataContractVersionError,
+    InvalidDescriptionLengthError, InvalidKeywordCharacterError, InvalidKeywordLengthError,
+    TooManyKeywordsError,
+};
+use crate::consensus::state::data_contract::data_contract_update_action_not_allowed_error::DataContractUpdateActionNotAllowedError;
+use crate::consensus::state::data_contract::data_contract_update_permission_error::DataContractUpdatePermissionError;
+use crate::consensus::state::data_contract::document_type_update_error::DocumentTypeUpdateError;
+use crate::data_contract::accessors::v1::DataContractV1Getters;
+use crate::data_contract::associated_token::token_configuration::accessors::v0::TokenConfigurationV0Getters;
+use crate::data_contract::associated_token::token_distribution_rules::accessors::v0::TokenDistributionRulesV0Getters;
+use crate::data_contract::associated_token::token_pre_programmed_distribution::accessors::v0::TokenPreProgrammedDistributionV0Methods;
+use crate::data_contract::document_type::schema::validate_schema_compatibility;
+use crate::data_contract::schema::DataContractSchemaMethodsV0;
+use crate::data_contract::DataContract;
+use crate::validation::SimpleConsensusValidationResult;
+use crate::ProtocolError;
+use platform_value::Value;
+use platform_version::version::PlatformVersion;
+use serde_json::json;
+
+impl DataContract {
+    /// The update must come from the contract owner, and the new contract's
+    /// version must be exactly the old version plus one.
+    ///
+    /// Failure (version != previous version + 1): Keep ST and transform it to
+    /// a nonce bump action. How: A user pushed an update that was not the
+    /// next version.
+    pub(super) fn validate_update_ownership_and_version(
+        &self,
+        new_data_contract: &DataContract,
+    ) -> SimpleConsensusValidationResult {
+        // Check if the contract is owned by the same identity
+        if self.owner_id() != new_data_contract.owner_id() {
+            return SimpleConsensusValidationResult::new_with_error(
+                DataContractUpdatePermissionError::new(self.id(), new_data_contract.owner_id())
+                    .into(),
+            );
+        }
+
+        // Check version is bumped
+        let new_version = new_data_contract.version();
+        let old_version = self.version();
+        if new_version < old_version || new_version - old_version != 1 {
+            return SimpleConsensusValidationResult::new_with_error(
+                InvalidDataContractVersionError::new(old_version + 1, new_version).into(),
+            );
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+
+    /// Validate that the config was not updated
+    /// * Includes verifications that:
+    ///     - Old contract is not read_only
+    ///     - New contract is not read_only
+    ///     - Keeps history did not change
+    ///     - Can be deleted did not change
+    ///     - Documents keep history did not change
+    ///     - Documents can be deleted contract default did not change
+    ///     - Documents mutable contract default did not change
+    ///     - Requires identity encryption bounded key did not change
+    ///     - Requires identity decryption bounded key did not change
+    /// * Failure (contract does not exist): Keep ST and transform it to a nonce bump action.
+    /// * How: A user pushed an update to a contract that changed its configuration.
+    pub(super) fn validate_update_config(
+        &self,
+        new_data_contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
+        let config_validation_result = self.config().validate_update(
+            new_data_contract.config(),
+            self.id(),
+            platform_version,
+        )?;
+
+        if !config_validation_result.is_valid() {
+            return Ok(SimpleConsensusValidationResult::new_with_errors(
+                config_validation_result.errors,
+            ));
+        }
+
+        Ok(SimpleConsensusValidationResult::new())
+    }
+
+    /// Validate updates for existing document types to make sure that
+    /// previously created documents will be still valid with a new version
+    /// of the data contract. Document types can never be removed. The new
+    /// contract version is passed into the per-type dispatcher: its
+    /// generation 1 admits required-set additions annotated with
+    /// `requiredSince` equal to that version, while generation 0 — the only
+    /// one selected by pre-v14 platform versions — ignores it.
+    pub(super) fn validate_update_existing_document_types(
+        &self,
+        new_data_contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
+        for (document_type_name, old_document_type) in self.document_types() {
+            // Make sure that existing document aren't removed
+            let Some(new_document_type) =
+                new_data_contract.document_type_optional_for_name(document_type_name)
+            else {
+                return Ok(SimpleConsensusValidationResult::new_with_error(
+                    DocumentTypeUpdateError::new(
+                        self.id(),
+                        document_type_name,
+                        "document type can't be removed",
+                    )
+                    .into(),
+                ));
+            };
+
+            // Validate document type update rules
+            let validate_update_result = old_document_type.as_ref().validate_update(
+                new_document_type,
+                new_data_contract.version(),
+                platform_version,
+            )?;
+
+            if !validate_update_result.is_valid() {
+                return Ok(SimpleConsensusValidationResult::new_with_errors(
+                    validate_update_result.errors,
+                ));
+            }
+        }
+
+        Ok(SimpleConsensusValidationResult::new())
+    }
+
+    /// Schema $defs should be compatible: `$defs` may not be removed, and a
+    /// changed `$defs` must remain compatible with previously created data.
+    pub(super) fn validate_update_schema_defs(
+        &self,
+        new_data_contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
+        if let Some(old_defs_map) = self.schema_defs() {
+            // If new contract doesn't have $defs, it means that it's $defs was removed and compatibility is broken
+            let Some(new_defs_map) = new_data_contract.schema_defs() else {
+                return Ok(SimpleConsensusValidationResult::new_with_error(
+                    IncompatibleDataContractSchemaError::new(
+                        self.id(),
+                        "remove".to_string(),
+                        "/$defs".to_string(),
+                    )
+                    .into(),
+                ));
+            };
+
+            // If $defs is updated we need to make sure that our data contract is still compatible
+            // with previously created data
+            if old_defs_map != new_defs_map {
+                // both new and old $defs already validated as a part of new and old contract
+                let old_defs_json = Value::from(old_defs_map)
+                    .try_into_validating_json()
+                    .map_err(ProtocolError::ValueError)?;
+
+                let new_defs_json = Value::from(new_defs_map)
+                    .try_into_validating_json()
+                    .map_err(ProtocolError::ValueError)?;
+
+                let old_defs_schema = json!({
+                    "$defs": old_defs_json
+                });
+
+                let new_defs_schema = json!({
+                    "$defs": new_defs_json
+                });
+
+                // We do not allow to remove or modify $ref in document type schemas
+                // it means that compatible changes in $defs won't break the overall compatibility
+                // Make sure that updated $defs schema is compatible
+                let compatibility_validation_result = validate_schema_compatibility(
+                    &old_defs_schema,
+                    &new_defs_schema,
+                    platform_version,
+                )?;
+
+                if !compatibility_validation_result.is_valid() {
+                    let errors = compatibility_validation_result
+                        .errors
+                        .into_iter()
+                        .map(|operation| {
+                            IncompatibleDataContractSchemaError::new(
+                                self.id(),
+                                operation.name,
+                                operation.path,
+                            )
+                            .into()
+                        })
+                        .collect();
+
+                    return Ok(SimpleConsensusValidationResult::new_with_errors(errors));
+                }
+            }
+        }
+
+        Ok(SimpleConsensusValidationResult::new())
+    }
+
+    /// Groups can be neither removed nor changed by an update.
+    pub(super) fn validate_update_groups(
+        &self,
+        new_data_contract: &DataContract,
+    ) -> SimpleConsensusValidationResult {
+        if self.groups() != new_data_contract.groups() {
+            // No groups can have been removed
+            for old_group_position in self.groups().keys() {
+                if !new_data_contract.groups().contains_key(old_group_position) {
+                    return SimpleConsensusValidationResult::new_with_error(
+                        DataContractUpdateActionNotAllowedError::new(
+                            self.id(),
+                            "remove group".to_string(),
+                        )
+                        .into(),
+                    );
+                }
+            }
+
+            // Ensure no group has been changed
+            for (old_group_position, old_group) in self.groups() {
+                if let Some(new_group) = new_data_contract.groups().get(old_group_position) {
+                    if old_group != new_group {
+                        return SimpleConsensusValidationResult::new_with_error(
+                            DataContractUpdateActionNotAllowedError::new(
+                                self.id(),
+                                format!(
+                                    "change group at position {} is not allowed",
+                                    old_group_position
+                                ),
+                            )
+                            .into(),
+                        );
+                    }
+                }
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+
+    /// Existing tokens can be neither removed nor reconfigured; a newly
+    /// added token may not carry a pre-programmed distribution timestamp in
+    /// the past.
+    pub(super) fn validate_update_tokens(
+        &self,
+        new_data_contract: &DataContract,
+        block_info: &BlockInfo,
+    ) -> SimpleConsensusValidationResult {
+        if self.tokens() != new_data_contract.tokens() {
+            for (token_position, old_token_config) in self.tokens() {
+                // Check if a token has been removed
+                if !new_data_contract.tokens().contains_key(token_position) {
+                    return SimpleConsensusValidationResult::new_with_error(
+                        DataContractUpdateActionNotAllowedError::new(
+                            self.id(),
+                            format!("remove token at position {}", token_position),
+                        )
+                        .into(),
+                    );
+                }
+
+                // Check if a token configuration has been changed
+                if let Some(new_token_config) = new_data_contract.tokens().get(token_position) {
+                    if old_token_config != new_token_config {
+                        return SimpleConsensusValidationResult::new_with_error(
+                            DataContractUpdateActionNotAllowedError::new(
+                                self.id(),
+                                format!("update token at position {}", token_position),
+                            )
+                            .into(),
+                        );
+                    }
+                }
+            }
+
+            // Validate any newly added tokens
+            for (token_contract_position, token_configuration) in new_data_contract.tokens() {
+                if !self.tokens().contains_key(token_contract_position) {
+                    if let Some(distribution) = token_configuration
+                        .distribution_rules()
+                        .pre_programmed_distribution()
+                    {
+                        if let Some((timestamp, _)) = distribution.distributions().iter().next() {
+                            if timestamp < &block_info.time_ms {
+                                return SimpleConsensusValidationResult::new_with_error(
+                                    StateError::PreProgrammedDistributionTimestampInPastError(
+                                        PreProgrammedDistributionTimestampInPastError::new(
+                                            new_data_contract.id(),
+                                            *token_contract_position,
+                                            *timestamp,
+                                            block_info.time_ms,
+                                        ),
+                                    )
+                                    .into(),
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+
+    /// Changed keywords must number at most 50, each between 3 and 50
+    /// visible characters, all unique.
+    pub(super) fn validate_update_keywords(
+        &self,
+        new_data_contract: &DataContract,
+    ) -> SimpleConsensusValidationResult {
+        if self.keywords() != new_data_contract.keywords() {
+            // Validate there are no more than 50 contract keywords
+            if new_data_contract.keywords().len() > 50 {
+                return SimpleConsensusValidationResult::new_with_error(
+                    TooManyKeywordsError::new(self.id(), new_data_contract.keywords().len() as u8)
+                        .into(),
+                );
+            }
+
+            // Validate the keywords are all unique and between 3 and 50 characters
+            let mut seen_keywords = HashSet::new();
+            for keyword in new_data_contract.keywords() {
+                // First check keyword length
+                if keyword.len() < 3 || keyword.len() > 50 {
+                    return SimpleConsensusValidationResult::new_with_error(
+                        InvalidKeywordLengthError::new(self.id(), keyword.to_string()).into(),
+                    );
+                }
+
+                if !keyword
+                    .chars()
+                    .all(|c| !c.is_control() && !c.is_whitespace())
+                {
+                    // This would mean we have an invalid character
+                    return SimpleConsensusValidationResult::new_with_error(
+                        InvalidKeywordCharacterError::new(
+                            new_data_contract.id(),
+                            keyword.to_string(),
+                        )
+                        .into(),
+                    );
+                }
+
+                // Then check uniqueness
+                if !seen_keywords.insert(keyword) {
+                    return SimpleConsensusValidationResult::new_with_error(
+                        DuplicateKeywordsError::new(self.id(), keyword.to_string()).into(),
+                    );
+                }
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+
+    /// A changed description must be between 3 and 100 characters.
+    pub(super) fn validate_update_description(
+        &self,
+        new_data_contract: &DataContract,
+    ) -> SimpleConsensusValidationResult {
+        if self.description() != new_data_contract.description() {
+            // Validate the description is between 3 and 100 characters
+            if let Some(description) = new_data_contract.description() {
+                let char_count = description.chars().count();
+                if !(3..=100).contains(&char_count) {
+                    return SimpleConsensusValidationResult::new_with_error(
+                        InvalidDescriptionLengthError::new(self.id(), description.to_string())
+                            .into(),
+                    );
+                }
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+}
diff --git a/packages/rs-dpp/src/data_contract/methods/validate_update/mod.rs b/packages/rs-dpp/src/data_contract/methods/validate_update/mod.rs
index 2a40b26459f..5081e57bcd3 100644
--- a/packages/rs-dpp/src/data_contract/methods/validate_update/mod.rs
+++ b/packages/rs-dpp/src/data_contract/methods/validate_update/mod.rs
@@ -2,7 +2,9 @@ use crate::block::block_info::BlockInfo;
 use crate::prelude::DataContract;
 use platform_version::version::PlatformVersion;
 
+mod common;
 mod v0;
+mod v1;
 use crate::validation::SimpleConsensusValidationResult;
 use crate::ProtocolError;
 pub use v0::*;
@@ -21,9 +23,10 @@ impl DataContractUpdateValidationMethodsV0 for DataContract {
             .validate_update
         {
             0 => self.validate_update_v0(data_contract, block_info, platform_version),
+            1 => self.validate_update_v1(data_contract, block_info, platform_version),
             version => Err(ProtocolError::UnknownVersionMismatch {
                 method: "DataContract::validate_update".to_string(),
-                known_versions: vec![0],
+                known_versions: vec![0, 1],
                 received: version,
             }),
         }
diff --git a/packages/rs-dpp/src/data_contract/methods/validate_update/v0/mod.rs b/packages/rs-dpp/src/data_contract/methods/validate_update/v0/mod.rs
index b269970d6e0..6cea9ac97b6 100644
--- a/packages/rs-dpp/src/data_contract/methods/validate_update/v0/mod.rs
+++ b/packages/rs-dpp/src/data_contract/methods/validate_update/v0/mod.rs
@@ -1,30 +1,8 @@
-use std::collections::HashSet;
-
 use crate::block::block_info::BlockInfo;
-use crate::consensus::state::state_error::StateError;
-use crate::consensus::state::token::PreProgrammedDistributionTimestampInPastError;
-use crate::data_contract::accessors::v0::DataContractV0Getters;
-
-use crate::consensus::basic::data_contract::{
-    DuplicateKeywordsError, IncompatibleDataContractSchemaError, InvalidDataContractVersionError,
-    InvalidDescriptionLengthError, InvalidKeywordCharacterError, InvalidKeywordLengthError,
-    TooManyKeywordsError,
-};
-use crate::consensus::state::data_contract::data_contract_update_action_not_allowed_error::DataContractUpdateActionNotAllowedError;
-use crate::consensus::state::data_contract::data_contract_update_permission_error::DataContractUpdatePermissionError;
-use crate::consensus::state::data_contract::document_type_update_error::DocumentTypeUpdateError;
-use crate::data_contract::accessors::v1::DataContractV1Getters;
-use crate::data_contract::associated_token::token_configuration::accessors::v0::TokenConfigurationV0Getters;
-use crate::data_contract::associated_token::token_distribution_rules::accessors::v0::TokenDistributionRulesV0Getters;
-use crate::data_contract::associated_token::token_pre_programmed_distribution::accessors::v0::TokenPreProgrammedDistributionV0Methods;
-use crate::data_contract::document_type::schema::validate_schema_compatibility;
-use crate::data_contract::schema::DataContractSchemaMethodsV0;
 use crate::data_contract::DataContract;
 use crate::validation::SimpleConsensusValidationResult;
 use crate::ProtocolError;
-use platform_value::Value;
 use platform_version::version::PlatformVersion;
-use serde_json::json;
 
 pub trait DataContractUpdateValidationMethodsV0 {
     fn validate_update(
@@ -43,286 +21,43 @@ impl DataContract {
         block_info: &BlockInfo,
         platform_version: &PlatformVersion,
     ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
-        // Check if the contract is owned by the same identity
-        if self.owner_id() != new_data_contract.owner_id() {
-            return Ok(SimpleConsensusValidationResult::new_with_error(
-                DataContractUpdatePermissionError::new(self.id(), new_data_contract.owner_id())
-                    .into(),
-            ));
+        let result = self.validate_update_ownership_and_version(new_data_contract);
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        // Check version is bumped
-        // Failure (version != previous version + 1): Keep ST and transform it to a nonce bump action.
-        // How: A user pushed an update that was not the next version.
-
-        let new_version = new_data_contract.version();
-        let old_version = self.version();
-        if new_version < old_version || new_version - old_version != 1 {
-            return Ok(SimpleConsensusValidationResult::new_with_error(
-                InvalidDataContractVersionError::new(old_version + 1, new_version).into(),
-            ));
+        let result = self.validate_update_config(new_data_contract, platform_version)?;
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        // Validate that the config was not updated
-        // * Includes verifications that:
-        //     - Old contract is not read_only
-        //     - New contract is not read_only
-        //     - Keeps history did not change
-        //     - Can be deleted did not change
-        //     - Documents keep history did not change
-        //     - Documents can be deleted contract default did not change
-        //     - Documents mutable contract default did not change
-        //     - Requires identity encryption bounded key did not change
-        //     - Requires identity decryption bounded key did not change
-        // * Failure (contract does not exist): Keep ST and transform it to a nonce bump action.
-        // * How: A user pushed an update to a contract that changed its configuration.
-
-        let config_validation_result = self.config().validate_update(
-            new_data_contract.config(),
-            self.id(),
-            platform_version,
-        )?;
-
-        if !config_validation_result.is_valid() {
-            return Ok(SimpleConsensusValidationResult::new_with_errors(
-                config_validation_result.errors,
-            ));
+        let result =
+            self.validate_update_existing_document_types(new_data_contract, platform_version)?;
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        // Validate updates for existing document types to make sure that previously created
-        // documents will be still valid with a new version of the data contract
-        for (document_type_name, old_document_type) in self.document_types() {
-            // Make sure that existing document aren't removed
-            let Some(new_document_type) =
-                new_data_contract.document_type_optional_for_name(document_type_name)
-            else {
-                return Ok(SimpleConsensusValidationResult::new_with_error(
-                    DocumentTypeUpdateError::new(
-                        self.id(),
-                        document_type_name,
-                        "document type can't be removed",
-                    )
-                    .into(),
-                ));
-            };
-
-            // Validate document type update rules
-            let validate_update_result = old_document_type
-                .as_ref()
-                .validate_update(new_document_type, platform_version)?;
-
-            if !validate_update_result.is_valid() {
-                return Ok(SimpleConsensusValidationResult::new_with_errors(
-                    validate_update_result.errors,
-                ));
-            }
+        let result = self.validate_update_schema_defs(new_data_contract, platform_version)?;
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        // Schema $defs should be compatible
-        if let Some(old_defs_map) = self.schema_defs() {
-            // If new contract doesn't have $defs, it means that it's $defs was removed and compatibility is broken
-            let Some(new_defs_map) = new_data_contract.schema_defs() else {
-                return Ok(SimpleConsensusValidationResult::new_with_error(
-                    IncompatibleDataContractSchemaError::new(
-                        self.id(),
-                        "remove".to_string(),
-                        "/$defs".to_string(),
-                    )
-                    .into(),
-                ));
-            };
-
-            // If $defs is updated we need to make sure that our data contract is still compatible
-            // with previously created data
-            if old_defs_map != new_defs_map {
-                // both new and old $defs already validated as a part of new and old contract
-                let old_defs_json = Value::from(old_defs_map)
-                    .try_into_validating_json()
-                    .map_err(ProtocolError::ValueError)?;
-
-                let new_defs_json = Value::from(new_defs_map)
-                    .try_into_validating_json()
-                    .map_err(ProtocolError::ValueError)?;
-
-                let old_defs_schema = json!({
-                    "$defs": old_defs_json
-                });
-
-                let new_defs_schema = json!({
-                    "$defs": new_defs_json
-                });
-
-                // We do not allow to remove or modify $ref in document type schemas
-                // it means that compatible changes in $defs won't break the overall compatibility
-                // Make sure that updated $defs schema is compatible
-                let compatibility_validation_result = validate_schema_compatibility(
-                    &old_defs_schema,
-                    &new_defs_schema,
-                    platform_version,
-                )?;
-
-                if !compatibility_validation_result.is_valid() {
-                    let errors = compatibility_validation_result
-                        .errors
-                        .into_iter()
-                        .map(|operation| {
-                            IncompatibleDataContractSchemaError::new(
-                                self.id(),
-                                operation.name,
-                                operation.path,
-                            )
-                            .into()
-                        })
-                        .collect();
-
-                    return Ok(SimpleConsensusValidationResult::new_with_errors(errors));
-                }
-            }
-        }
-
-        if self.groups() != new_data_contract.groups() {
-            // No groups can have been removed
-            for old_group_position in self.groups().keys() {
-                if !new_data_contract.groups().contains_key(old_group_position) {
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        DataContractUpdateActionNotAllowedError::new(
-                            self.id(),
-                            "remove group".to_string(),
-                        )
-                        .into(),
-                    ));
-                }
-            }
-
-            // Ensure no group has been changed
-            for (old_group_position, old_group) in self.groups() {
-                if let Some(new_group) = new_data_contract.groups().get(old_group_position) {
-                    if old_group != new_group {
-                        return Ok(SimpleConsensusValidationResult::new_with_error(
-                            DataContractUpdateActionNotAllowedError::new(
-                                self.id(),
-                                format!(
-                                    "change group at position {} is not allowed",
-                                    old_group_position
-                                ),
-                            )
-                            .into(),
-                        ));
-                    }
-                }
-            }
-        }
-
-        if self.tokens() != new_data_contract.tokens() {
-            for (token_position, old_token_config) in self.tokens() {
-                // Check if a token has been removed
-                if !new_data_contract.tokens().contains_key(token_position) {
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        DataContractUpdateActionNotAllowedError::new(
-                            self.id(),
-                            format!("remove token at position {}", token_position),
-                        )
-                        .into(),
-                    ));
-                }
-
-                // Check if a token configuration has been changed
-                if let Some(new_token_config) = new_data_contract.tokens().get(token_position) {
-                    if old_token_config != new_token_config {
-                        return Ok(SimpleConsensusValidationResult::new_with_error(
-                            DataContractUpdateActionNotAllowedError::new(
-                                self.id(),
-                                format!("update token at position {}", token_position),
-                            )
-                            .into(),
-                        ));
-                    }
-                }
-            }
-
-            // Validate any newly added tokens
-            for (token_contract_position, token_configuration) in new_data_contract.tokens() {
-                if !self.tokens().contains_key(token_contract_position) {
-                    if let Some(distribution) = token_configuration
-                        .distribution_rules()
-                        .pre_programmed_distribution()
-                    {
-                        if let Some((timestamp, _)) = distribution.distributions().iter().next() {
-                            if timestamp < &block_info.time_ms {
-                                return Ok(SimpleConsensusValidationResult::new_with_error(
-                                    StateError::PreProgrammedDistributionTimestampInPastError(
-                                        PreProgrammedDistributionTimestampInPastError::new(
-                                            new_data_contract.id(),
-                                            *token_contract_position,
-                                            *timestamp,
-                                            block_info.time_ms,
-                                        ),
-                                    )
-                                    .into(),
-                                ));
-                            }
-                        }
-                    }
-                }
-            }
+        let result = self.validate_update_groups(new_data_contract);
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        if self.keywords() != new_data_contract.keywords() {
-            // Validate there are no more than 50 contract keywords
-            if new_data_contract.keywords().len() > 50 {
-                return Ok(SimpleConsensusValidationResult::new_with_error(
-                    TooManyKeywordsError::new(self.id(), new_data_contract.keywords().len() as u8)
-                        .into(),
-                ));
-            }
-
-            // Validate the keywords are all unique and between 3 and 50 characters
-            let mut seen_keywords = HashSet::new();
-            for keyword in new_data_contract.keywords() {
-                // First check keyword length
-                if keyword.len() < 3 || keyword.len() > 50 {
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        InvalidKeywordLengthError::new(self.id(), keyword.to_string()).into(),
-                    ));
-                }
-
-                if !keyword
-                    .chars()
-                    .all(|c| !c.is_control() && !c.is_whitespace())
-                {
-                    // This would mean we have an invalid character
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        InvalidKeywordCharacterError::new(
-                            new_data_contract.id(),
-                            keyword.to_string(),
-                        )
-                        .into(),
-                    ));
-                }
-
-                // Then check uniqueness
-                if !seen_keywords.insert(keyword) {
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        DuplicateKeywordsError::new(self.id(), keyword.to_string()).into(),
-                    ));
-                }
-            }
+        let result = self.validate_update_tokens(new_data_contract, block_info);
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        if self.description() != new_data_contract.description() {
-            // Validate the description is between 3 and 100 characters
-            if let Some(description) = new_data_contract.description() {
-                let char_count = description.chars().count();
-                if !(3..=100).contains(&char_count) {
-                    return Ok(SimpleConsensusValidationResult::new_with_error(
-                        InvalidDescriptionLengthError::new(self.id(), description.to_string())
-                            .into(),
-                    ));
-                }
-            }
+        let result = self.validate_update_keywords(new_data_contract);
+        if !result.is_valid() {
+            return Ok(result);
         }
 
-        Ok(SimpleConsensusValidationResult::new())
+        Ok(self.validate_update_description(new_data_contract))
     }
 }
 
@@ -332,7 +67,11 @@ mod tests {
     use crate::consensus::basic::basic_error::BasicError;
     use crate::consensus::state::state_error::StateError;
     use crate::consensus::ConsensusError;
+    use crate::data_contract::accessors::v0::DataContractV0Getters;
+    use crate::data_contract::accessors::v1::DataContractV1Getters;
     use crate::data_contract::config::v0::DataContractConfigSettersV0;
+    use crate::data_contract::methods::validate_update::DataContractUpdateValidationMethodsV0;
+    use crate::data_contract::schema::DataContractSchemaMethodsV0;
     use crate::prelude::IdentityNonce;
     use crate::tests::fixtures::get_data_contract_fixture;
     use assert_matches::assert_matches;
diff --git a/packages/rs-dpp/src/data_contract/methods/validate_update/v1/mod.rs b/packages/rs-dpp/src/data_contract/methods/validate_update/v1/mod.rs
new file mode 100644
index 00000000000..24eec3afaf5
--- /dev/null
+++ b/packages/rs-dpp/src/data_contract/methods/validate_update/v1/mod.rs
@@ -0,0 +1,168 @@
+use crate::block::block_info::BlockInfo;
+use crate::consensus::basic::data_contract::DataContractInvalidRequiredFieldsUpdateError;
+use crate::data_contract::accessors::v0::DataContractV0Getters;
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::DataContract;
+use crate::validation::SimpleConsensusValidationResult;
+use crate::ProtocolError;
+use platform_version::version::PlatformVersion;
+
+impl DataContract {
+    /// Generation 1 (protocol version 14, `requiredSince`): generation 0
+    /// plus validation of `requiredSince` annotations on document types
+    /// introduced by the update, which have no old counterpart for the
+    /// per-type pass to see. (Required-set changes on *existing* document
+    /// types are judged inside the shared per-type dispatcher, which
+    /// resolves its own generation from the platform version, so this
+    /// method needs no logic of its own for them.)
+    ///
+    /// Delegating to generation 0 is safe because that generation is
+    /// shipped and therefore frozen. The checks are independent and
+    /// short-circuiting, so appending the extra one changes only which
+    /// error is reported when an update violates several rules at once —
+    /// never whether it is rejected.
+    #[inline(always)]
+    pub(super) fn validate_update_v1(
+        &self,
+        new_data_contract: &DataContract,
+        block_info: &BlockInfo,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, ProtocolError> {
+        let result = self.validate_update_v0(new_data_contract, block_info, platform_version)?;
+        if !result.is_valid() {
+            return Ok(result);
+        }
+
+        Ok(self.validate_update_new_document_types_required_since(new_data_contract))
+    }
+
+    /// Document types introduced by this update have no old counterpart,
+    /// so the per-type update validation never sees them. Their
+    /// `requiredSince` annotations must name the version this update
+    /// creates — anything else would pre-schedule (or backdate) a
+    /// wire-layout change without validation.
+    fn validate_update_new_document_types_required_since(
+        &self,
+        new_data_contract: &DataContract,
+    ) -> SimpleConsensusValidationResult {
+        for (document_type_name, new_document_type) in new_data_contract.document_types() {
+            if self
+                .document_type_optional_for_name(document_type_name)
+                .is_some()
+            {
+                continue;
+            }
+            for (property_name, property) in new_document_type.as_ref().properties() {
+                if let Some(required_since) = property.required_since {
+                    if required_since != new_data_contract.version() {
+                        return SimpleConsensusValidationResult::new_with_error(
+                            DataContractInvalidRequiredFieldsUpdateError::new(
+                                document_type_name.clone(),
+                                format!(
+                                    "new document type property '{property_name}' must carry requiredSince {}, the contract version this update creates",
+                                    new_data_contract.version()
+                                ),
+                            )
+                            .into(),
+                        );
+                    }
+                }
+            }
+        }
+
+        SimpleConsensusValidationResult::new()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::consensus::basic::basic_error::BasicError;
+    use crate::consensus::ConsensusError;
+    use crate::data_contract::accessors::v0::DataContractV0Setters;
+    use crate::data_contract::methods::validate_update::DataContractUpdateValidationMethodsV0;
+    use crate::data_contract::schema::DataContractSchemaMethodsV0;
+    use crate::prelude::IdentityNonce;
+    use crate::tests::fixtures::get_data_contract_fixture;
+    use assert_matches::assert_matches;
+    use platform_value::platform_value;
+
+    #[test]
+    fn should_validate_required_since_on_document_types_added_by_the_update() {
+        let platform_version = PlatformVersion::latest();
+
+        let old_data_contract = get_data_contract_fixture(
+            None,
+            IdentityNonce::default(),
+            platform_version.protocol_version,
+        )
+        .data_contract_owned();
+
+        let new_type_schema = |required_since: u32| {
+            platform_value!({
+                "type": "object",
+                "properties": {
+                    "message": {
+                        "type": "string",
+                        "position": 0,
+                        "maxLength": 60_u32,
+                        "requiredSince": required_since,
+                    }
+                },
+                "required": ["message"],
+                "additionalProperties": false
+            })
+        };
+
+        // A new document type pre-scheduling requiredness at version 99
+        // has no old counterpart, so the per-type update validation
+        // never runs on it — this pass must catch it
+        let mut new_data_contract = old_data_contract.clone();
+        new_data_contract.set_version(old_data_contract.version() + 1);
+        new_data_contract
+            .set_document_schema(
+                "note",
+                new_type_schema(99),
+                false,
+                &mut Vec::new(),
+                platform_version,
+            )
+            .expect("should add document type");
+
+        let result = old_data_contract
+            .validate_update(&new_data_contract, &BlockInfo::default(), platform_version)
+            .expect("failed validate update");
+
+        assert_matches!(
+            result.errors.as_slice(),
+            [ConsensusError::BasicError(
+                BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+            )] if e.details().contains("must carry requiredSince 2")
+        );
+
+        // The same new document type annotated with the version this
+        // update creates is accepted
+        let mut new_data_contract = old_data_contract.clone();
+        new_data_contract.set_version(old_data_contract.version() + 1);
+        new_data_contract
+            .set_document_schema(
+                "note",
+                new_type_schema(old_data_contract.version() + 1),
+                false,
+                &mut Vec::new(),
+                platform_version,
+            )
+            .expect("should add document type");
+
+        let result = old_data_contract
+            .validate_update(&new_data_contract, &BlockInfo::default(), platform_version)
+            .expect("failed validate update");
+
+        assert!(
+            result.is_valid(),
+            "a new document type annotated with the version this update \
+             creates must be accepted, got {:?}",
+            result.errors
+        );
+    }
+}
diff --git a/packages/rs-dpp/src/data_contract/v0/serialization/mod.rs b/packages/rs-dpp/src/data_contract/v0/serialization/mod.rs
index 2fcee85088d..a17abd6d74d 100644
--- a/packages/rs-dpp/src/data_contract/v0/serialization/mod.rs
+++ b/packages/rs-dpp/src/data_contract/v0/serialization/mod.rs
@@ -1,3 +1,5 @@
+use crate::data_contract::document_type::class_methods::consensus_or_protocol_required_fields_error;
+use crate::data_contract::document_type::validate_required_since_within_contract_version;
 use crate::data_contract::document_type::DocumentType;
 use crate::data_contract::serialized_version::v0::DataContractInSerializationFormatV0;
 use crate::data_contract::serialized_version::DataContractInSerializationFormat;
@@ -101,6 +103,9 @@ impl DataContractV0 {
             platform_version,
         )?;
 
+        validate_required_since_within_contract_version(&document_types, version)
+            .map_err(consensus_or_protocol_required_fields_error)?;
+
         let data_contract = DataContractV0 {
             id,
             version,
@@ -144,6 +149,9 @@ impl DataContractV0 {
             platform_version,
         )?;
 
+        validate_required_since_within_contract_version(&document_types, version)
+            .map_err(consensus_or_protocol_required_fields_error)?;
+
         let data_contract = DataContractV0 {
             id,
             version,
diff --git a/packages/rs-dpp/src/data_contract/v1/serialization/mod.rs b/packages/rs-dpp/src/data_contract/v1/serialization/mod.rs
index c044aaf0833..dadcf2f8256 100644
--- a/packages/rs-dpp/src/data_contract/v1/serialization/mod.rs
+++ b/packages/rs-dpp/src/data_contract/v1/serialization/mod.rs
@@ -1,3 +1,5 @@
+use crate::data_contract::document_type::class_methods::consensus_or_protocol_required_fields_error;
+use crate::data_contract::document_type::validate_required_since_within_contract_version;
 use crate::data_contract::document_type::DocumentType;
 use crate::data_contract::serialized_version::v0::DataContractInSerializationFormatV0;
 use crate::data_contract::serialized_version::DataContractInSerializationFormat;
@@ -100,6 +102,9 @@ impl DataContractV1 {
             platform_version,
         )?;
 
+        validate_required_since_within_contract_version(&document_types, version)
+            .map_err(consensus_or_protocol_required_fields_error)?;
+
         let data_contract = DataContractV1 {
             id,
             version,
@@ -161,6 +166,9 @@ impl DataContractV1 {
             platform_version,
         )?;
 
+        validate_required_since_within_contract_version(&document_types, version)
+            .map_err(consensus_or_protocol_required_fields_error)?;
+
         let data_contract = DataContractV1 {
             id,
             version,
diff --git a/packages/rs-dpp/src/document/accessors/mod.rs b/packages/rs-dpp/src/document/accessors/mod.rs
index ecae8be34d1..d629cbffcbd 100644
--- a/packages/rs-dpp/src/document/accessors/mod.rs
+++ b/packages/rs-dpp/src/document/accessors/mod.rs
@@ -116,6 +116,12 @@ impl DocumentV0Getters for Document {
             Document::V0(v0) => v0.creator_id,
         }
     }
+
+    fn contract_version(&self) -> Option<u32> {
+        match self {
+            Document::V0(v0) => v0.contract_version,
+        }
+    }
 }
 
 impl DocumentV0Setters for Document {
@@ -213,6 +219,12 @@ impl DocumentV0Setters for Document {
             Document::V0(v0) => v0.creator_id = creator_id,
         }
     }
+
+    fn set_contract_version(&mut self, contract_version: Option<u32>) {
+        match self {
+            Document::V0(v0) => v0.contract_version = contract_version,
+        }
+    }
 }
 
 #[cfg(test)]
@@ -223,6 +235,7 @@ mod tests {
 
     fn make_doc() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::new([1u8; 32]),
             owner_id: Identifier::new([2u8; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/accessors/v0/mod.rs b/packages/rs-dpp/src/document/accessors/v0/mod.rs
index b2de832bc36..b448e060016 100644
--- a/packages/rs-dpp/src/document/accessors/v0/mod.rs
+++ b/packages/rs-dpp/src/document/accessors/v0/mod.rs
@@ -48,6 +48,9 @@ pub trait DocumentV0Getters {
     fn updated_at_core_block_height(&self) -> Option<u32>;
     fn transferred_at_core_block_height(&self) -> Option<u32>;
     fn creator_id(&self) -> Option<Identifier>;
+    /// The data contract version this document's bytes conform to (the
+    /// serialization format 3 stamp); `None` for pre-stamp documents.
+    fn contract_version(&self) -> Option<u32>;
 }
 
 pub trait DocumentV0Setters: DocumentV0Getters {
@@ -158,4 +161,7 @@ pub trait DocumentV0Setters: DocumentV0Getters {
     /// - `creator_id`: An `Option<Identifier>` to set as the document's creator ID.
     ///   `None` indicates the creator ID is not available.
     fn set_creator_id(&mut self, creator_id: Option<Identifier>);
+    /// Sets the contract-version stamp: the data contract version this
+    /// document's bytes conform to.
+    fn set_contract_version(&mut self, contract_version: Option<u32>);
 }
diff --git a/packages/rs-dpp/src/document/document_event.rs b/packages/rs-dpp/src/document/document_event.rs
index b28086ce9a0..84477f13e93 100644
--- a/packages/rs-dpp/src/document/document_event.rs
+++ b/packages/rs-dpp/src/document/document_event.rs
@@ -103,6 +103,7 @@ impl DocumentEvent {
         }
 
         DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties,
diff --git a/packages/rs-dpp/src/document/document_factory/v0/mod.rs b/packages/rs-dpp/src/document/document_factory/v0/mod.rs
index 269dc16c092..55f82eedb26 100644
--- a/packages/rs-dpp/src/document/document_factory/v0/mod.rs
+++ b/packages/rs-dpp/src/document/document_factory/v0/mod.rs
@@ -574,6 +574,7 @@ mod test {
             platform_value::Value::Array(vec![]),
         );
         let document_v0 = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties,
diff --git a/packages/rs-dpp/src/document/document_methods/get_raw_for_document_type/v0/mod.rs b/packages/rs-dpp/src/document/document_methods/get_raw_for_document_type/v0/mod.rs
index d2e5464cf5a..e7c3eabb2e6 100644
--- a/packages/rs-dpp/src/document/document_methods/get_raw_for_document_type/v0/mod.rs
+++ b/packages/rs-dpp/src/document/document_methods/get_raw_for_document_type/v0/mod.rs
@@ -96,6 +96,7 @@ mod tests {
 
     fn make_document_with_known_ids() -> DocumentV0 {
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([0xAA; 32]),
             owner_id: Identifier::new([0xBB; 32]),
             properties: BTreeMap::new(),
@@ -399,6 +400,7 @@ mod tests {
 
     fn minimal_doc() -> DocumentV0 {
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([1u8; 32]),
             owner_id: Identifier::new([2u8; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/document_methods/is_equal_ignoring_timestamps/v0/mod.rs b/packages/rs-dpp/src/document/document_methods/is_equal_ignoring_timestamps/v0/mod.rs
index a27dcb20c27..14c2a5ed610 100644
--- a/packages/rs-dpp/src/document/document_methods/is_equal_ignoring_timestamps/v0/mod.rs
+++ b/packages/rs-dpp/src/document/document_methods/is_equal_ignoring_timestamps/v0/mod.rs
@@ -56,6 +56,7 @@ mod tests {
         properties.insert("score".to_string(), Value::U64(100));
 
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([1u8; 32]),
             owner_id: Identifier::new([2u8; 32]),
             properties,
diff --git a/packages/rs-dpp/src/document/extended_document/mod.rs b/packages/rs-dpp/src/document/extended_document/mod.rs
index 6b9fd509bde..19c2371a840 100644
--- a/packages/rs-dpp/src/document/extended_document/mod.rs
+++ b/packages/rs-dpp/src/document/extended_document/mod.rs
@@ -63,6 +63,7 @@ mod json_convertible_tests {
         let data_contract_id = data_contract.id();
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::new([0xa1; 32]),
             owner_id: Identifier::new([0xb2; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/fields.rs b/packages/rs-dpp/src/document/fields.rs
index 2d88483f034..93dbd0bc200 100644
--- a/packages/rs-dpp/src/document/fields.rs
+++ b/packages/rs-dpp/src/document/fields.rs
@@ -6,6 +6,7 @@ pub mod property_names {
     pub const REVISION: &str = "$revision";
     pub const OWNER_ID: &str = "$ownerId";
     pub const CREATOR_ID: &str = "$creatorId";
+    pub const CONTRACT_VERSION: &str = "$contractVersion";
     pub const PRICE: &str = "$price";
     pub const CREATED_AT: &str = "$createdAt";
     pub const UPDATED_AT: &str = "$updatedAt";
diff --git a/packages/rs-dpp/src/document/mod.rs b/packages/rs-dpp/src/document/mod.rs
index dee2eef4bf3..ce4d97fba80 100644
--- a/packages/rs-dpp/src/document/mod.rs
+++ b/packages/rs-dpp/src/document/mod.rs
@@ -344,6 +344,7 @@ mod tests {
     #[test]
     fn display_document_with_no_properties() {
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([0xAA; 32]),
             owner_id: platform_value::Identifier::new([0xBB; 32]),
             properties: Default::default(),
@@ -371,6 +372,7 @@ mod tests {
     #[test]
     fn display_document_shows_transferred_at_fields() {
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -409,6 +411,7 @@ mod tests {
     fn display_document_shows_creator_id() {
         let creator = platform_value::Identifier::new([0xCC; 32]);
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -436,6 +439,7 @@ mod tests {
     #[test]
     fn display_document_shows_block_height_fields() {
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -466,6 +470,7 @@ mod tests {
     #[test]
     fn increment_revision_works_on_mutable_document() {
         let mut doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -490,6 +495,7 @@ mod tests {
     #[test]
     fn increment_revision_fails_when_no_revision() {
         let mut doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -618,6 +624,7 @@ mod tests {
     #[test]
     fn increment_revision_errors_on_overflow() {
         let mut doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -647,6 +654,7 @@ mod tests {
     #[test]
     fn from_document_v0_produces_v0_variant() {
         let v0 = DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -676,6 +684,7 @@ mod tests {
     #[test]
     fn document_display_has_version_prefix() {
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: platform_value::Identifier::new([1u8; 32]),
             owner_id: platform_value::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -742,6 +751,7 @@ mod json_convertible_tests {
 
     fn fixture() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::new([0xa1; 32]),
             owner_id: Identifier::new([0xb2; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/deserialize/v0/mod.rs b/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/deserialize/v0/mod.rs
index 5db85a579fa..aa6686d6ccb 100644
--- a/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/deserialize/v0/mod.rs
+++ b/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/deserialize/v0/mod.rs
@@ -35,6 +35,18 @@ pub(in crate::document) trait DocumentPlatformDeserializationMethodsV0 {
     ) -> Result<Self, DataContractError>
     where
         Self: Sized;
+
+    /// Reads a serialized document and creates a Document from it.
+    /// Version 3 has the contract version stamp, which selects each
+    /// `requiredSince` property's byte layout (raw when the stamp reaches the
+    /// property's `requiredSince`, presence-flagged otherwise).
+    fn from_bytes_v3(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError>
+    where
+        Self: Sized;
 }
 
 #[cfg(feature = "extended-document")]
diff --git a/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/serialize/v0/mod.rs b/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/serialize/v0/mod.rs
index 5f6238667b8..80700fd9a92 100644
--- a/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/serialize/v0/mod.rs
+++ b/packages/rs-dpp/src/document/serialization_traits/platform_serialization_conversion/serialize/v0/mod.rs
@@ -24,6 +24,15 @@ pub(in crate::document) trait DocumentPlatformSerializationMethodsV0 {
     /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
     /// Serialize v2 will serialize the creator id if the document can be transferred or sold
     fn serialize_v2(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError>;
+
+    /// Serializes the document.
+    ///
+    /// The serialization of a document follows the pattern:
+    /// contract version stamp varint + id 32 bytes + owner_id 32 bytes + encoded values byte arrays
+    /// Serialize v3 stamps the document with the data contract version its
+    /// bytes conform to, and encodes a property whose `requiredSince` exceeds
+    /// the stamp with a presence flag instead of raw
+    fn serialize_v3(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError>;
 }
 
 #[cfg(feature = "extended-document")]
diff --git a/packages/rs-dpp/src/document/serialization_traits/platform_value_conversion/mod.rs b/packages/rs-dpp/src/document/serialization_traits/platform_value_conversion/mod.rs
index 5d451bce535..2e6c7ea9eb3 100644
--- a/packages/rs-dpp/src/document/serialization_traits/platform_value_conversion/mod.rs
+++ b/packages/rs-dpp/src/document/serialization_traits/platform_value_conversion/mod.rs
@@ -159,6 +159,7 @@ mod tests {
         let owner_id = Identifier::new([2u8; 32]);
 
         let doc_v0 = DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties: std::collections::BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/v0/accessors.rs b/packages/rs-dpp/src/document/v0/accessors.rs
index 7d0b47f0de3..7ce2269f81c 100644
--- a/packages/rs-dpp/src/document/v0/accessors.rs
+++ b/packages/rs-dpp/src/document/v0/accessors.rs
@@ -160,6 +160,10 @@ impl DocumentV0Getters for DocumentV0 {
     fn creator_id(&self) -> Option<Identifier> {
         self.creator_id
     }
+
+    fn contract_version(&self) -> Option<u32> {
+        self.contract_version
+    }
 }
 
 impl DocumentV0Setters for DocumentV0 {
@@ -290,4 +294,11 @@ impl DocumentV0Setters for DocumentV0 {
     fn set_creator_id(&mut self, creator_id: Option<Identifier>) {
         self.creator_id = creator_id;
     }
+
+    /// Sets the contract-version stamp: the data contract version this
+    /// document's bytes conform to. Assigned by Drive when document content
+    /// is (re-)supplied; `None` for pre-stamp documents.
+    fn set_contract_version(&mut self, contract_version: Option<u32>) {
+        self.contract_version = contract_version;
+    }
 }
diff --git a/packages/rs-dpp/src/document/v0/cbor_conversion.rs b/packages/rs-dpp/src/document/v0/cbor_conversion.rs
index 190fa5ffa69..632d9c5ea68 100644
--- a/packages/rs-dpp/src/document/v0/cbor_conversion.rs
+++ b/packages/rs-dpp/src/document/v0/cbor_conversion.rs
@@ -58,6 +58,15 @@ pub struct DocumentForCbor {
 
     #[serde(rename = "$creatorId")]
     pub creator_id: Option<Identifier>,
+
+    /// The contract-version stamp. Skipped when absent so pre-stamp CBOR
+    /// output stays byte-identical; `default` keeps old CBOR readable.
+    #[serde(
+        rename = "$contractVersion",
+        default,
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub contract_version: Option<u32>,
 }
 
 #[cfg(feature = "cbor")]
@@ -80,8 +89,10 @@ impl TryFrom<DocumentV0> for DocumentForCbor {
             updated_at_core_block_height,
             transferred_at_core_block_height,
             creator_id,
+            contract_version,
         } = value;
         Ok(DocumentForCbor {
+            contract_version,
             id: id.to_buffer(),
             properties: Value::convert_to_cbor_map(properties)
                 .map_err(ProtocolError::ValueError)?,
@@ -146,8 +157,12 @@ impl DocumentV0 {
             .remove_optional_identifier(property_names::CREATOR_ID)
             .map_err(ProtocolError::ValueError)?;
 
+        let contract_version =
+            document_map.remove_optional_integer(property_names::CONTRACT_VERSION)?;
+
         // dev-note: properties is everything other than the id and owner id
         Ok(DocumentV0 {
+            contract_version,
             properties: document_map,
             owner_id: Identifier::new(owner_id),
             id: Identifier::new(id),
@@ -229,6 +244,7 @@ mod tests {
         properties.insert("name".to_string(), Value::Text("Alice".to_string()));
         properties.insert("age".to_string(), Value::U64(30));
         DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
@@ -250,6 +266,39 @@ mod tests {
     //  Round-trip: to_cbor -> from_cbor preserves document data
     // ================================================================
 
+    #[test]
+    fn cbor_round_trip_preserves_contract_version_stamp() {
+        use crate::document::Document;
+
+        let platform_version = PlatformVersion::latest();
+        let mut document = make_document_v0_with_timestamps();
+        document.contract_version = Some(7);
+
+        let cbor = document.to_cbor().expect("expected to serialize to cbor");
+        let restored = Document::from_cbor(&cbor, None, None, platform_version)
+            .expect("expected to deserialize from cbor");
+
+        let Document::V0(restored) = restored;
+        assert_eq!(restored.contract_version, Some(7));
+        assert_eq!(restored.id, document.id);
+        assert_eq!(restored.revision, document.revision);
+        // (full property equality is not asserted: CBOR decodes integers as
+        // I128, a pre-existing normalization of this legacy path)
+        assert_eq!(
+            restored.properties.get("name"),
+            document.properties.get("name")
+        );
+
+        // An unstamped document round-trips to no stamp (the key is skipped
+        // entirely when absent, keeping pre-stamp CBOR byte-identical)
+        let unstamped = make_document_v0_with_timestamps();
+        let unstamped_cbor = unstamped.to_cbor().expect("expected to serialize to cbor");
+        let restored_unstamped = Document::from_cbor(&unstamped_cbor, None, None, platform_version)
+            .expect("expected to deserialize from cbor");
+        let Document::V0(restored_unstamped) = restored_unstamped;
+        assert_eq!(restored_unstamped.contract_version, None);
+    }
+
     #[test]
     fn cbor_round_trip_with_random_dashpay_profile() {
         let platform_version = PlatformVersion::latest();
diff --git a/packages/rs-dpp/src/document/v0/mod.rs b/packages/rs-dpp/src/document/v0/mod.rs
index 130908e1419..406d36023d8 100644
--- a/packages/rs-dpp/src/document/v0/mod.rs
+++ b/packages/rs-dpp/src/document/v0/mod.rs
@@ -98,6 +98,20 @@ pub struct DocumentV0 {
     /// The creator id.
     #[cfg_attr(feature = "serde-conversion", serde(rename = "$creatorId", default))]
     pub creator_id: Option<Identifier>,
+    /// The data contract version this document's bytes conform to — assigned
+    /// by Drive when document content is (re-)supplied (create/replace) and
+    /// preserved across server-side rewrites (transfer/purchase). Selects the
+    /// per-property byte layout when the document type carries `requiredSince`
+    /// annotations. `None` for documents serialized before format 3.
+    #[cfg_attr(
+        feature = "serde-conversion",
+        serde(
+            rename = "$contractVersion",
+            default,
+            skip_serializing_if = "Option::is_none"
+        )
+    )]
+    pub contract_version: Option<u32>,
 }
 
 impl DocumentGetRawForContractV0 for DocumentV0 {
@@ -197,6 +211,7 @@ mod tests {
 
     fn minimal_doc() -> DocumentV0 {
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([1u8; 32]),
             owner_id: Identifier::new([2u8; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-dpp/src/document/v0/platform_value_conversion.rs b/packages/rs-dpp/src/document/v0/platform_value_conversion.rs
index fa2902cd9eb..8811958b5d9 100644
--- a/packages/rs-dpp/src/document/v0/platform_value_conversion.rs
+++ b/packages/rs-dpp/src/document/v0/platform_value_conversion.rs
@@ -22,6 +22,7 @@ mod tests {
 
     fn minimal_doc() -> DocumentV0 {
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([1u8; 32]),
             owner_id: Identifier::new([2u8; 32]),
             properties: BTreeMap::new(),
@@ -44,6 +45,7 @@ mod tests {
         props.insert("name".into(), Value::Text("Eve".into()));
         props.insert("score".into(), Value::U64(42));
         DocumentV0 {
+            contract_version: None,
             id: Identifier::new([7u8; 32]),
             owner_id: Identifier::new([8u8; 32]),
             properties: props,
diff --git a/packages/rs-dpp/src/document/v0/serialize.rs b/packages/rs-dpp/src/document/v0/serialize.rs
deleted file mode 100644
index 14d0024b444..00000000000
--- a/packages/rs-dpp/src/document/v0/serialize.rs
+++ /dev/null
@@ -1,2609 +0,0 @@
-use crate::data_contract::document_type::{DocumentPropertyType, DocumentTypeRef};
-use crate::data_contract::errors::DataContractError;
-
-use crate::document::property_names::{
-    CREATED_AT, CREATED_AT_BLOCK_HEIGHT, CREATED_AT_CORE_BLOCK_HEIGHT, PRICE, TRANSFERRED_AT,
-    TRANSFERRED_AT_BLOCK_HEIGHT, TRANSFERRED_AT_CORE_BLOCK_HEIGHT, UPDATED_AT,
-    UPDATED_AT_BLOCK_HEIGHT, UPDATED_AT_CORE_BLOCK_HEIGHT,
-};
-
-#[cfg(feature = "validation")]
-use crate::prelude::ConsensusValidationResult;
-
-use crate::prelude::{DataContract, Revision};
-
-use crate::ProtocolError;
-
-use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
-use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
-use crate::document::serialization_traits::deserialize::v0::DocumentPlatformDeserializationMethodsV0;
-use crate::document::serialization_traits::serialize::v0::DocumentPlatformSerializationMethodsV0;
-use crate::document::serialization_traits::DocumentPlatformConversionMethodsV0;
-use crate::document::v0::DocumentV0;
-use crate::version::PlatformVersion;
-use byteorder::{BigEndian, ReadBytesExt};
-use integer_encoding::{VarInt, VarIntReader};
-
-use platform_value::{Identifier, Value};
-use platform_version::version::FeatureVersion;
-
-use std::collections::BTreeMap;
-
-use crate::consensus::basic::decode::DecodingError;
-#[cfg(feature = "validation")]
-use crate::consensus::basic::BasicError;
-#[cfg(feature = "validation")]
-use crate::consensus::ConsensusError;
-use crate::data_contract::accessors::v0::DataContractV0Getters;
-use crate::data_contract::config::DataContractConfig;
-use crate::nft::TradeMode;
-use std::io::{BufReader, Read};
-
-impl DocumentPlatformSerializationMethodsV0 for DocumentV0 {
-    /// Serializes the document.
-    ///
-    /// The serialization of a document follows the pattern:
-    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
-    /// In serialize v0 all integers are always encoded as i64s
-    fn serialize_v0(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
-        let mut buffer: Vec<u8> = 0u64.encode_var_vec(); //version 0
-
-        // $id
-        buffer.extend(self.id.as_slice());
-
-        // $ownerId
-        buffer.extend(self.owner_id.as_slice());
-
-        // $revision
-        if let Some(revision) = self.revision {
-            buffer.extend(revision.encode_var_vec())
-        } else if document_type.requires_revision() {
-            buffer.extend((1 as Revision).encode_var_vec())
-        }
-
-        let mut bitwise_exists_flag: u16 = 0;
-
-        let mut time_fields_data_buffer = vec![];
-
-        // $createdAt
-        if let Some(created_at) = &self.created_at {
-            bitwise_exists_flag |= 1;
-            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
-            time_fields_data_buffer.extend(created_at.to_be_bytes());
-        } else if document_type.required_fields().contains(CREATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAt
-        if let Some(updated_at) = &self.updated_at {
-            bitwise_exists_flag |= 2;
-            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
-            time_fields_data_buffer.extend(updated_at.to_be_bytes());
-        } else if document_type.required_fields().contains(UPDATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAt
-        if let Some(transferred_at) = &self.transferred_at {
-            bitwise_exists_flag |= 4;
-            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
-            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
-        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtBlockHeight
-        if let Some(created_at_block_height) = &self.created_at_block_height {
-            bitwise_exists_flag |= 8;
-            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtBlockHeight
-        if let Some(updated_at_block_height) = &self.updated_at_block_height {
-            bitwise_exists_flag |= 16;
-            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtBlockHeight
-        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
-            bitwise_exists_flag |= 32;
-            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtCoreBlockHeight
-        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
-            bitwise_exists_flag |= 64;
-            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtCoreBlockHeight
-        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
-            bitwise_exists_flag |= 128;
-            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtCoreBlockHeight
-        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
-            bitwise_exists_flag |= 256;
-            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
-        buffer.append(&mut time_fields_data_buffer);
-
-        // Now we serialize the price which might not be necessary unless called for by the document type
-
-        if document_type.trade_mode().seller_sets_price() {
-            if let Some(price) = self.properties.get(PRICE) {
-                buffer.push(1);
-                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
-                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
-            } else {
-                buffer.push(0);
-            }
-        }
-
-        // User defined properties
-        document_type
-            .properties()
-            .iter()
-            .try_for_each(|(field_name, property)| {
-                if let Some(value) = self.properties.get(field_name) {
-                    if value.is_null() {
-                        if property.required && !property.transient {
-                            Err(ProtocolError::DataContractError(
-                                DataContractError::MissingRequiredKey(
-                                    "a required field is not present".to_string(),
-                                ),
-                            ))
-                        } else {
-                            // dbg!("we pushed {} with 0", field_name);
-                            // We don't have something that wasn't required
-                            buffer.push(0);
-                            Ok(())
-                        }
-                    } else {
-                        if !property.required || property.transient {
-                            // dbg!("we added 1", field_name);
-                            buffer.push(1);
-                        }
-                        let value = if property.property_type.is_integer() {
-                            DocumentPropertyType::I64
-                                .encode_value_ref_with_size(value, property.required)
-                        } else {
-                            property
-                                .property_type
-                                .encode_value_ref_with_size(value, property.required)
-                        }?;
-
-                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
-                        buffer.extend(value.as_slice());
-                        Ok(())
-                    }
-                } else if property.required && !property.transient {
-                    Err(ProtocolError::DataContractError(
-                        DataContractError::MissingRequiredKey(format!(
-                            "a required field {field_name} is not present"
-                        )),
-                    ))
-                } else {
-                    // dbg!("we pushed {} with 0", field_name);
-                    // We don't have something that wasn't required
-                    buffer.push(0);
-                    Ok(())
-                }
-            })?;
-
-        Ok(buffer)
-    }
-
-    /// Serializes the document.
-    ///
-    /// The serialization of a document follows the pattern:
-    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
-    /// Serialize v1 will encode integers normally with their known size.
-    /// Otherwise it is almost identical to V0. V1 represents the original code.
-    fn serialize_v1(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
-        let mut buffer: Vec<u8> = 1u64.encode_var_vec(); //version 1
-
-        // $id
-        buffer.extend(self.id.as_slice());
-
-        // $ownerId
-        buffer.extend(self.owner_id.as_slice());
-
-        // $revision
-        if let Some(revision) = self.revision {
-            buffer.extend(revision.encode_var_vec())
-        } else if document_type.requires_revision() {
-            buffer.extend((1 as Revision).encode_var_vec())
-        }
-
-        let mut bitwise_exists_flag: u16 = 0;
-
-        let mut time_fields_data_buffer = vec![];
-
-        // $createdAt
-        if let Some(created_at) = &self.created_at {
-            bitwise_exists_flag |= 1;
-            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
-            time_fields_data_buffer.extend(created_at.to_be_bytes());
-        } else if document_type.required_fields().contains(CREATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAt
-        if let Some(updated_at) = &self.updated_at {
-            bitwise_exists_flag |= 2;
-            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
-            time_fields_data_buffer.extend(updated_at.to_be_bytes());
-        } else if document_type.required_fields().contains(UPDATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAt
-        if let Some(transferred_at) = &self.transferred_at {
-            bitwise_exists_flag |= 4;
-            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
-            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
-        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtBlockHeight
-        if let Some(created_at_block_height) = &self.created_at_block_height {
-            bitwise_exists_flag |= 8;
-            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtBlockHeight
-        if let Some(updated_at_block_height) = &self.updated_at_block_height {
-            bitwise_exists_flag |= 16;
-            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtBlockHeight
-        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
-            bitwise_exists_flag |= 32;
-            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtCoreBlockHeight
-        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
-            bitwise_exists_flag |= 64;
-            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtCoreBlockHeight
-        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
-            bitwise_exists_flag |= 128;
-            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtCoreBlockHeight
-        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
-            bitwise_exists_flag |= 256;
-            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
-        buffer.append(&mut time_fields_data_buffer);
-
-        // Now we serialize the price which might not be necessary unless called for by the document type
-
-        if document_type.trade_mode().seller_sets_price() {
-            if let Some(price) = self.properties.get(PRICE) {
-                buffer.push(1);
-                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
-                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
-            } else {
-                buffer.push(0);
-            }
-        }
-
-        // User defined properties
-        document_type
-            .properties()
-            .iter()
-            .try_for_each(|(field_name, property)| {
-                if let Some(value) = self.properties.get(field_name) {
-                    if value.is_null() {
-                        if property.required && !property.transient {
-                            Err(ProtocolError::DataContractError(
-                                DataContractError::MissingRequiredKey(
-                                    "a required field is not present".to_string(),
-                                ),
-                            ))
-                        } else {
-                            // dbg!("we pushed {} with 0", field_name);
-                            // We don't have something that wasn't required
-                            buffer.push(0);
-                            Ok(())
-                        }
-                    } else {
-                        if !property.required || property.transient {
-                            // dbg!("we added 1", field_name);
-                            buffer.push(1);
-                        }
-                        let value = property
-                            .property_type
-                            .encode_value_ref_with_size(value, property.required)?;
-                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
-                        buffer.extend(value.as_slice());
-                        Ok(())
-                    }
-                } else if property.required && !property.transient {
-                    Err(ProtocolError::DataContractError(
-                        DataContractError::MissingRequiredKey(format!(
-                            "a required field {field_name} is not present"
-                        )),
-                    ))
-                } else {
-                    // dbg!("we pushed {} with 0", field_name);
-                    // We don't have something that wasn't required
-                    buffer.push(0);
-                    Ok(())
-                }
-            })?;
-
-        Ok(buffer)
-    }
-
-    /// Serializes the document.
-    ///
-    /// The serialization of a document follows the pattern:
-    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
-    /// Serialize v2 will encode the creator id as well.
-    fn serialize_v2(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
-        let mut buffer: Vec<u8> = 2u64.encode_var_vec(); //version 2
-
-        // $id
-        buffer.extend(self.id.as_slice());
-
-        // $ownerId
-        buffer.extend(self.owner_id.as_slice());
-
-        if document_type.trade_mode() != TradeMode::None
-            || document_type.documents_transferable().is_transferable()
-        {
-            if let Some(creator_id) = self.creator_id {
-                buffer.push(1);
-                buffer.extend(creator_id.as_slice());
-            } else {
-                buffer.push(0);
-            }
-        }
-
-        // $revision
-        if let Some(revision) = self.revision {
-            buffer.extend(revision.encode_var_vec())
-        } else if document_type.requires_revision() {
-            buffer.extend((1 as Revision).encode_var_vec())
-        }
-
-        let mut bitwise_exists_flag: u16 = 0;
-
-        let mut time_fields_data_buffer = vec![];
-
-        // $createdAt
-        if let Some(created_at) = &self.created_at {
-            bitwise_exists_flag |= 1;
-            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
-            time_fields_data_buffer.extend(created_at.to_be_bytes());
-        } else if document_type.required_fields().contains(CREATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAt
-        if let Some(updated_at) = &self.updated_at {
-            bitwise_exists_flag |= 2;
-            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
-            time_fields_data_buffer.extend(updated_at.to_be_bytes());
-        } else if document_type.required_fields().contains(UPDATED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAt
-        if let Some(transferred_at) = &self.transferred_at {
-            bitwise_exists_flag |= 4;
-            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
-            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
-        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred at field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtBlockHeight
-        if let Some(created_at_block_height) = &self.created_at_block_height {
-            bitwise_exists_flag |= 8;
-            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtBlockHeight
-        if let Some(updated_at_block_height) = &self.updated_at_block_height {
-            bitwise_exists_flag |= 16;
-            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtBlockHeight
-        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
-            bitwise_exists_flag |= 32;
-            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $createdAtCoreBlockHeight
-        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
-            bitwise_exists_flag |= 64;
-            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "created_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $updatedAtCoreBlockHeight
-        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
-            bitwise_exists_flag |= 128;
-            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "updated_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        // $transferredAtCoreBlockHeight
-        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
-            bitwise_exists_flag |= 256;
-            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
-        } else if document_type
-            .required_fields()
-            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
-        {
-            return Err(ProtocolError::DataContractError(
-                DataContractError::MissingRequiredKey(
-                    "transferred_at_core_block_height field is not present".to_string(),
-                ),
-            ));
-        }
-
-        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
-        buffer.append(&mut time_fields_data_buffer);
-
-        // Now we serialize the price which might not be necessary unless called for by the document type
-
-        if document_type.trade_mode().seller_sets_price() {
-            if let Some(price) = self.properties.get(PRICE) {
-                buffer.push(1);
-                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
-                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
-            } else {
-                buffer.push(0);
-            }
-        }
-
-        // User defined properties
-        document_type
-            .properties()
-            .iter()
-            .try_for_each(|(field_name, property)| {
-                if let Some(value) = self.properties.get(field_name) {
-                    if value.is_null() {
-                        if property.required && !property.transient {
-                            Err(ProtocolError::DataContractError(
-                                DataContractError::MissingRequiredKey(
-                                    "a required field is not present".to_string(),
-                                ),
-                            ))
-                        } else {
-                            // dbg!("we pushed {} with 0", field_name);
-                            // We don't have something that wasn't required
-                            buffer.push(0);
-                            Ok(())
-                        }
-                    } else {
-                        if !property.required || property.transient {
-                            // dbg!("we added 1", field_name);
-                            buffer.push(1);
-                        }
-                        let value = property
-                            .property_type
-                            .encode_value_ref_with_size(value, property.required)?;
-                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
-                        buffer.extend(value.as_slice());
-                        Ok(())
-                    }
-                } else if property.required && !property.transient {
-                    Err(ProtocolError::DataContractError(
-                        DataContractError::MissingRequiredKey(format!(
-                            "a required field {field_name} is not present"
-                        )),
-                    ))
-                } else {
-                    // dbg!("we pushed {} with 0", field_name);
-                    // We don't have something that wasn't required
-                    buffer.push(0);
-                    Ok(())
-                }
-            })?;
-
-        Ok(buffer)
-    }
-}
-
-impl DocumentPlatformDeserializationMethodsV0 for DocumentV0 {
-    /// Reads a serialized document and creates a Document from it.
-    fn from_bytes_v0(
-        serialized_document: &[u8],
-        document_type: DocumentTypeRef,
-        _platform_version: &PlatformVersion,
-    ) -> Result<Self, DataContractError> {
-        let mut buf = BufReader::new(serialized_document);
-        if serialized_document.len() < 64 {
-            return Err(DataContractError::DecodingDocumentError(
-                DecodingError::new(
-                    "serialized document is too small, must have id and owner id".to_string(),
-                ),
-            ));
-        }
-
-        // $id
-        let mut id = [0; 32];
-        buf.read_exact(&mut id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for id".to_string(),
-            ))
-        })?;
-
-        // $ownerId
-        let mut owner_id = [0; 32];
-        buf.read_exact(&mut owner_id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for owner id".to_string(),
-            ))
-        })?;
-
-        // $revision
-        // if the document type is mutable then we should deserialize the revision
-        let revision: Option<Revision> = if document_type.requires_revision() {
-            let revision = buf.read_varint().map_err(|_| {
-                DataContractError::DecodingDocumentError(DecodingError::new(
-                    "error reading revision from serialized document for revision".to_string(),
-                ))
-            })?;
-            Some(revision)
-        } else {
-            None
-        };
-
-        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
-            DataContractError::CorruptedSerialization(
-                "error reading timestamp flags from serialized document".to_string(),
-            )
-        })?;
-
-        let created_at = if timestamp_flags & 1 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at = if timestamp_flags & 2 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at = if timestamp_flags & 4 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_block_height = if timestamp_flags & 8 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_block_height = if timestamp_flags & 16 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        // Now we deserialize the price which might not be necessary unless called for by the document type
-
-        let price = if document_type.trade_mode().seller_sets_price() {
-            let has_price = buf.read_u8().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading has price bool from serialized document".to_string(),
-                )
-            })?;
-            if has_price > 0 {
-                let price = buf.read_u64::<BigEndian>().map_err(|_| {
-                    DataContractError::CorruptedSerialization(
-                        "error reading price u64 from serialized document".to_string(),
-                    )
-                })?;
-                Some(price)
-            } else {
-                None
-            }
-        } else {
-            None
-        };
-
-        let mut finished_buffer = false;
-
-        let mut properties = document_type
-            .properties()
-            .iter()
-            .filter_map(|(key, property)| {
-                if finished_buffer {
-                    return if property.required && !property.transient {
-                        Some(Err(DataContractError::CorruptedSerialization(
-                            "required field after finished buffer".to_string(),
-                        )))
-                    } else {
-                        None
-                    };
-                }
-
-                // In version 0 all integers are encoded as I64 (in theory)
-                let read_value = if property.property_type.is_integer() {
-                    DocumentPropertyType::I64
-                        .read_optionally_from(&mut buf, property.required & !property.transient)
-                } else {
-                    property
-                        .property_type
-                        .read_optionally_from(&mut buf, property.required & !property.transient)
-                };
-
-                match read_value {
-                    Ok(read_value) => {
-                        finished_buffer |= read_value.1;
-                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
-                    }
-                    Err(e) => Some(Err(e)),
-                }
-            })
-            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
-
-        if let Some(price) = price {
-            properties.insert(PRICE.to_string(), price.into());
-        }
-
-        Ok(DocumentV0 {
-            id: Identifier::new(id),
-            properties,
-            owner_id: Identifier::new(owner_id),
-            revision,
-            created_at,
-            updated_at,
-            transferred_at,
-            created_at_block_height,
-            updated_at_block_height,
-            transferred_at_block_height,
-            created_at_core_block_height,
-            updated_at_core_block_height,
-            transferred_at_core_block_height,
-            creator_id: None,
-        })
-    }
-
-    /// Reads a serialized document and creates a Document from it.
-    fn from_bytes_v1(
-        serialized_document: &[u8],
-        document_type: DocumentTypeRef,
-        _platform_version: &PlatformVersion,
-    ) -> Result<Self, DataContractError> {
-        let mut buf = BufReader::new(serialized_document);
-        if serialized_document.len() < 64 {
-            return Err(DataContractError::DecodingDocumentError(
-                DecodingError::new(
-                    "serialized document is too small, must have id and owner id".to_string(),
-                ),
-            ));
-        }
-
-        // $id
-        let mut id = [0; 32];
-        buf.read_exact(&mut id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for id".to_string(),
-            ))
-        })?;
-
-        // $ownerId
-        let mut owner_id = [0; 32];
-        buf.read_exact(&mut owner_id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for owner id".to_string(),
-            ))
-        })?;
-
-        // $revision
-        // if the document type is mutable then we should deserialize the revision
-        let revision: Option<Revision> = if document_type.requires_revision() {
-            let revision = buf.read_varint().map_err(|_| {
-                DataContractError::DecodingDocumentError(DecodingError::new(
-                    "error reading revision from serialized document for revision".to_string(),
-                ))
-            })?;
-            Some(revision)
-        } else {
-            None
-        };
-
-        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
-            DataContractError::CorruptedSerialization(
-                "error reading timestamp flags from serialized document".to_string(),
-            )
-        })?;
-
-        let created_at = if timestamp_flags & 1 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at = if timestamp_flags & 2 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at = if timestamp_flags & 4 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_block_height = if timestamp_flags & 8 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_block_height = if timestamp_flags & 16 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        // Now we deserialize the price which might not be necessary unless called for by the document type
-
-        let price = if document_type.trade_mode().seller_sets_price() {
-            let has_price = buf.read_u8().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading has price bool from serialized document".to_string(),
-                )
-            })?;
-            if has_price > 0 {
-                let price = buf.read_u64::<BigEndian>().map_err(|_| {
-                    DataContractError::CorruptedSerialization(
-                        "error reading price u64 from serialized document".to_string(),
-                    )
-                })?;
-                Some(price)
-            } else {
-                None
-            }
-        } else {
-            None
-        };
-
-        let mut finished_buffer = false;
-
-        let mut properties = document_type
-            .properties()
-            .iter()
-            .filter_map(|(key, property)| {
-                if finished_buffer {
-                    return if property.required && !property.transient {
-                        Some(Err(DataContractError::CorruptedSerialization(
-                            "required field after finished buffer".to_string(),
-                        )))
-                    } else {
-                        None
-                    };
-                }
-                let read_value = property
-                    .property_type
-                    .read_optionally_from(&mut buf, property.required & !property.transient);
-
-                match read_value {
-                    Ok(read_value) => {
-                        finished_buffer |= read_value.1;
-                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
-                    }
-                    Err(e) => Some(Err(e)),
-                }
-            })
-            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
-
-        if let Some(price) = price {
-            properties.insert(PRICE.to_string(), price.into());
-        }
-
-        Ok(DocumentV0 {
-            id: Identifier::new(id),
-            properties,
-            owner_id: Identifier::new(owner_id),
-            revision,
-            created_at,
-            updated_at,
-            transferred_at,
-            created_at_block_height,
-            updated_at_block_height,
-            transferred_at_block_height,
-            created_at_core_block_height,
-            updated_at_core_block_height,
-            transferred_at_core_block_height,
-            creator_id: None,
-        })
-    }
-
-    /// Reads a serialized document and creates a Document from it.
-    fn from_bytes_v2(
-        serialized_document: &[u8],
-        document_type: DocumentTypeRef,
-        _platform_version: &PlatformVersion,
-    ) -> Result<Self, DataContractError> {
-        let mut buf = BufReader::new(serialized_document);
-        if serialized_document.len() < 64 {
-            return Err(DataContractError::DecodingDocumentError(
-                DecodingError::new(
-                    "serialized document is too small, must have id and owner id".to_string(),
-                ),
-            ));
-        }
-
-        // $id
-        let mut id = [0; 32];
-        buf.read_exact(&mut id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for id".to_string(),
-            ))
-        })?;
-
-        // $ownerId
-        let mut owner_id = [0; 32];
-        buf.read_exact(&mut owner_id).map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading from serialized document for owner id".to_string(),
-            ))
-        })?;
-
-        // $creatorId
-        let creator_id: Option<Identifier> = if document_type.trade_mode() != TradeMode::None
-            || document_type.documents_transferable().is_transferable()
-        {
-            let has_creator_id = buf.read_u8().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading has creator id bool from serialized document".to_string(),
-                )
-            })?;
-            if has_creator_id > 0 {
-                // $creatorId
-                let mut known_owner_id = [0; 32];
-                buf.read_exact(&mut known_owner_id).map_err(|_| {
-                    DataContractError::DecodingDocumentError(DecodingError::new(
-                        "error reading from serialized document for creator id".to_string(),
-                    ))
-                })?;
-                Some(known_owner_id.into())
-            } else {
-                None
-            }
-        } else {
-            None
-        };
-
-        // $revision
-        // if the document type is mutable then we should deserialize the revision
-        let revision: Option<Revision> = if document_type.requires_revision() {
-            let revision = buf.read_varint().map_err(|_| {
-                DataContractError::DecodingDocumentError(DecodingError::new(
-                    "error reading revision from serialized document for revision".to_string(),
-                ))
-            })?;
-            Some(revision)
-        } else {
-            None
-        };
-
-        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
-            DataContractError::CorruptedSerialization(
-                "error reading timestamp flags from serialized document".to_string(),
-            )
-        })?;
-
-        let created_at = if timestamp_flags & 1 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at = if timestamp_flags & 2 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at = if timestamp_flags & 4 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at timestamp from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_block_height = if timestamp_flags & 8 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_block_height = if timestamp_flags & 16 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_block_height from serialized document".to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
-            Some(buf.read_u64::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading transferred_at_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading created_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
-            Some(buf.read_u32::<BigEndian>().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading updated_at_core_block_height from serialized document"
-                        .to_string(),
-                )
-            })?)
-        } else {
-            None
-        };
-
-        // Now we deserialize the price which might not be necessary unless called for by the document type
-
-        let price = if document_type.trade_mode().seller_sets_price() {
-            let has_price = buf.read_u8().map_err(|_| {
-                DataContractError::CorruptedSerialization(
-                    "error reading has price bool from serialized document".to_string(),
-                )
-            })?;
-            if has_price > 0 {
-                let price = buf.read_u64::<BigEndian>().map_err(|_| {
-                    DataContractError::CorruptedSerialization(
-                        "error reading price u64 from serialized document".to_string(),
-                    )
-                })?;
-                Some(price)
-            } else {
-                None
-            }
-        } else {
-            None
-        };
-
-        let mut finished_buffer = false;
-
-        let mut properties = document_type
-            .properties()
-            .iter()
-            .filter_map(|(key, property)| {
-                if finished_buffer {
-                    return if property.required && !property.transient {
-                        Some(Err(DataContractError::CorruptedSerialization(
-                            "required field after finished buffer".to_string(),
-                        )))
-                    } else {
-                        None
-                    };
-                }
-                let read_value = property
-                    .property_type
-                    .read_optionally_from(&mut buf, property.required & !property.transient);
-
-                match read_value {
-                    Ok(read_value) => {
-                        finished_buffer |= read_value.1;
-                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
-                    }
-                    Err(e) => Some(Err(e)),
-                }
-            })
-            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
-
-        if let Some(price) = price {
-            properties.insert(PRICE.to_string(), price.into());
-        }
-
-        Ok(DocumentV0 {
-            id: Identifier::new(id),
-            properties,
-            owner_id: Identifier::new(owner_id),
-            revision,
-            created_at,
-            updated_at,
-            transferred_at,
-            created_at_block_height,
-            updated_at_block_height,
-            transferred_at_block_height,
-            created_at_core_block_height,
-            updated_at_core_block_height,
-            transferred_at_core_block_height,
-            creator_id,
-        })
-    }
-}
-
-impl DocumentPlatformConversionMethodsV0 for DocumentV0 {
-    /// Serializes the document.
-    ///
-    /// The serialization of a document follows the pattern:
-    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
-    fn serialize(
-        &self,
-        document_type: DocumentTypeRef,
-        contract: &DataContract,
-        platform_version: &PlatformVersion,
-    ) -> Result<Vec<u8>, ProtocolError> {
-        if matches!(contract, DataContract::V0(_))
-            || matches!(contract.config(), DataContractConfig::V0(_))
-        {
-            // Any data contract in version 0 should always serialize documents in version 0
-            // This is because integers in such a data contract if made through normal versioning should always
-            // be i64
-            // While it's possible in theory maybe that they are not i64 using serialize_v0
-            // will encode all integers as i64.
-            self.serialize_v0(document_type)
-        } else {
-            match platform_version
-                .dpp
-                .document_versions
-                .document_serialization_version
-                .default_current_version
-            {
-                0 => self.serialize_v0(document_type),
-                // Version 1 coincides with protocol version 9, which contains tokens, new document types,
-                // and most importantly different integer types.
-                // Document types now have properties that are known to be things like u8, i32 etc.
-                1 => self.serialize_v1(document_type),
-                2 => self.serialize_v2(document_type),
-                version => Err(ProtocolError::UnknownVersionMismatch {
-                    method: "DocumentV0::serialize".to_string(),
-                    known_versions: vec![0, 1, 2],
-                    received: version,
-                }),
-            }
-        }
-    }
-
-    fn serialize_specific_version(
-        &self,
-        document_type: DocumentTypeRef,
-        contract: &DataContract,
-        feature_version: FeatureVersion,
-    ) -> Result<Vec<u8>, ProtocolError> {
-        if (matches!(contract, DataContract::V0(_))
-            || matches!(contract.config(), DataContractConfig::V0(_)))
-            && feature_version != 0
-        {
-            // Any data contract in version 0 should always serialize documents in version 0
-            // This is because integers in such a data contract if made through normal versioning should always
-            // be i64
-            // While it's possible in theory maybe that they are not i64 using serialize_v0
-            // will encode all integers as i64.
-            return Err(ProtocolError::NotSupported("Serializing with data contract version 0 or data contract config version 0 is not supported outside of feature version 0".to_string()));
-        };
-        match feature_version {
-            0 => self.serialize_v0(document_type),
-            1 => self.serialize_v1(document_type),
-            2 => self.serialize_v2(document_type),
-            version => Err(ProtocolError::UnknownVersionMismatch {
-                method: "DocumentV0::serialize".to_string(),
-                known_versions: vec![0, 1, 2],
-                received: version,
-            }),
-        }
-    }
-
-    /// Reads a serialized document and creates a DocumentV0 from it.
-    fn from_bytes(
-        mut serialized_document: &[u8],
-        document_type: DocumentTypeRef,
-        platform_version: &PlatformVersion,
-    ) -> Result<Self, ProtocolError> {
-        let serialized_version = serialized_document.read_varint().map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading revision from serialized document for revision".to_string(),
-            ))
-        })?;
-        match serialized_version {
-            0 => {
-                match DocumentV0::from_bytes_v0(
-                    serialized_document,
-                    document_type,
-                    platform_version,
-                )
-                .map_err(ProtocolError::DataContractError)
-                {
-                    Ok(document) => Ok(document),
-                    Err(first_err) => {
-                        // let's try decoding in V1 just to be safe
-                        // Version 0 will decode all integers as I64
-                        // Version 1 will decode all integers properly
-                        // When version was 0 used (protocol version 1 to 8) integers other than I64
-                        // existed, but were probably never used, which is why we try v1 just to be safe
-                        match DocumentV0::from_bytes_v1(
-                            serialized_document,
-                            document_type,
-                            platform_version,
-                        ) {
-                            Ok(document_from_version_1_deserialization) => {
-                                Ok(document_from_version_1_deserialization)
-                            }
-                            Err(_) => Err(first_err),
-                        }
-                    }
-                }
-            }
-            1 => DocumentV0::from_bytes_v1(serialized_document, document_type, platform_version)
-                .map_err(ProtocolError::DataContractError),
-            2 => DocumentV0::from_bytes_v2(serialized_document, document_type, platform_version)
-                .map_err(ProtocolError::DataContractError),
-            version => Err(ProtocolError::UnknownVersionMismatch {
-                method: "Document::from_bytes (deserialization)".to_string(),
-                known_versions: vec![0, 1, 2],
-                received: version,
-            }),
-        }
-    }
-
-    /// Reads a serialized document and creates a DocumentV0 from it.
-    #[cfg(feature = "validation")]
-    fn from_bytes_in_consensus(
-        mut serialized_document: &[u8],
-        document_type: DocumentTypeRef,
-        platform_version: &PlatformVersion,
-    ) -> Result<ConsensusValidationResult<Self>, ProtocolError> {
-        let serialized_version = serialized_document.read_varint().map_err(|_| {
-            DataContractError::DecodingDocumentError(DecodingError::new(
-                "error reading revision from serialized document for revision".to_string(),
-            ))
-        })?;
-        match serialized_version {
-            0 => {
-                match DocumentV0::from_bytes_v0(
-                    serialized_document,
-                    document_type,
-                    platform_version,
-                ) {
-                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
-                    Err(first_err) => {
-                        // let's try decoding in V1 just to be safe
-                        // Version 0 will decode all integers as I64
-                        // Version 1 will decode all integers properly
-                        // When version was 0 used (protocol version 1 to 8) integers other than I64
-                        // existed, but were probably never used, which is why we try v1 just to be safe
-                        match DocumentV0::from_bytes_v1(
-                            serialized_document,
-                            document_type,
-                            platform_version,
-                        ) {
-                            Ok(document_from_version_1_deserialization) => {
-                                Ok(ConsensusValidationResult::new_with_data(
-                                    document_from_version_1_deserialization,
-                                ))
-                            }
-                            Err(_) => Ok(ConsensusValidationResult::new_with_error(
-                                ConsensusError::BasicError(BasicError::ContractError(first_err)),
-                            )),
-                        }
-                    }
-                }
-            }
-            1 => {
-                match DocumentV0::from_bytes_v1(
-                    serialized_document,
-                    document_type,
-                    platform_version,
-                ) {
-                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
-                    Err(err) => Ok(ConsensusValidationResult::new_with_error(
-                        ConsensusError::BasicError(BasicError::ContractError(err)),
-                    )),
-                }
-            }
-            2 => {
-                match DocumentV0::from_bytes_v2(
-                    serialized_document,
-                    document_type,
-                    platform_version,
-                ) {
-                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
-                    Err(err) => Ok(ConsensusValidationResult::new_with_error(
-                        ConsensusError::BasicError(BasicError::ContractError(err)),
-                    )),
-                }
-            }
-            version => Err(ProtocolError::UnknownVersionMismatch {
-                method: "Document::from_bytes (deserialization)".to_string(),
-                known_versions: vec![0, 1, 2],
-                received: version,
-            }),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::data_contract::accessors::v0::DataContractV0Getters;
-    use crate::data_contract::document_type::random_document::CreateRandomDocument;
-    use crate::tests::json_document::json_document_to_contract;
-    use integer_encoding::VarInt;
-    use platform_version::version::PlatformVersion;
-
-    // ----------------------------------------------------------------
-    // Helper: load the dashpay contract and return the contract plus a
-    // DocumentTypeRef for the given document type name.
-    // ----------------------------------------------------------------
-    fn dashpay_contract_and_type(
-        platform_version: &PlatformVersion,
-    ) -> (crate::prelude::DataContract, String) {
-        let contract = json_document_to_contract(
-            "../rs-drive/tests/supporting_files/contract/dashpay/dashpay-contract.json",
-            false,
-            platform_version,
-        )
-        .expect("expected to load dashpay contract");
-        (contract, "contactRequest".to_string())
-    }
-
-    fn family_contract(platform_version: &PlatformVersion) -> crate::prelude::DataContract {
-        json_document_to_contract(
-            "../rs-drive/tests/supporting_files/contract/family/family-contract.json",
-            false,
-            platform_version,
-        )
-        .expect("expected to load family contract")
-    }
-
-    fn withdrawals_contract(platform_version: &PlatformVersion) -> crate::prelude::DataContract {
-        json_document_to_contract(
-            "../rs-drive/tests/supporting_files/contract/withdrawals/withdrawals-contract.json",
-            false,
-            platform_version,
-        )
-        .expect("expected to load withdrawals contract")
-    }
-
-    // ================================================================
-    //  Round-trip: serialize then deserialize, expect equality
-    // ================================================================
-
-    #[test]
-    fn round_trip_serialize_v0_dashpay_contact_request() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(42), platform_version)
-            .expect("expected random document");
-
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        let serialized = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("serialize should succeed");
-
-        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-            .expect("from_bytes should succeed");
-
-        assert_eq!(*doc_v0, deserialized);
-    }
-
-    #[test]
-    fn round_trip_serialize_v0_family_person() {
-        let platform_version = PlatformVersion::first();
-        let contract = family_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("person")
-            .expect("expected person document type");
-
-        for seed in 0..20u64 {
-            let document = document_type
-                .random_document(Some(seed), platform_version)
-                .expect("expected random document");
-            let crate::document::Document::V0(doc_v0) = &document;
-            let serialized = doc_v0
-                .serialize(document_type, &contract, platform_version)
-                .expect("serialize should succeed");
-            let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-                .expect("from_bytes should succeed");
-            assert_eq!(*doc_v0, deserialized, "round-trip failed for seed {seed}");
-        }
-    }
-
-    #[test]
-    fn round_trip_serialize_v1_family_person() {
-        // Platform version that defaults to serialization v1
-        let platform_version =
-            PlatformVersion::get(9).unwrap_or_else(|_| PlatformVersion::latest());
-
-        // We need a non-V0 contract for v1 serialization. Use the latest platform version
-        // to load the contract and create a document type.
-        let contract = json_document_to_contract(
-            "../rs-drive/tests/supporting_files/contract/family/family-contract.json",
-            false,
-            platform_version,
-        )
-        .expect("expected to load family contract");
-
-        let document_type = contract
-            .document_type_for_name("person")
-            .expect("expected person document type");
-
-        // Only test if we can actually produce v1 serialization
-        // (contract must not be V0 and config must not be V0 for v1)
-        if matches!(&contract, DataContract::V0(_)) {
-            // V0 contracts always force serialize_v0, so we test that path instead
-            let document = document_type
-                .random_document(Some(99), platform_version)
-                .expect("expected random document");
-            let crate::document::Document::V0(doc_v0) = &document;
-            let serialized = doc_v0
-                .serialize(document_type, &contract, platform_version)
-                .expect("serialize should succeed");
-            let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-                .expect("from_bytes should succeed");
-            assert_eq!(*doc_v0, deserialized);
-        } else {
-            let document = document_type
-                .random_document(Some(99), platform_version)
-                .expect("expected random document");
-            let crate::document::Document::V0(doc_v0) = &document;
-            let serialized = doc_v0
-                .serialize(document_type, &contract, platform_version)
-                .expect("serialize should succeed");
-            let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-                .expect("from_bytes should succeed");
-            assert_eq!(*doc_v0, deserialized);
-        }
-    }
-
-    #[test]
-    fn round_trip_serialize_v2_latest_platform() {
-        let platform_version = PlatformVersion::latest();
-        let contract = json_document_to_contract(
-            "../rs-drive/tests/supporting_files/contract/dashpay/dashpay-contract.json",
-            false,
-            platform_version,
-        )
-        .expect("expected to load dashpay contract");
-
-        let document_type = contract
-            .document_type_for_name("contactRequest")
-            .expect("expected contactRequest document type");
-
-        let document = document_type
-            .random_document(Some(7), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-        let serialized = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("serialize should succeed");
-        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-            .expect("from_bytes should succeed");
-        assert_eq!(*doc_v0, deserialized);
-    }
-
-    #[test]
-    fn round_trip_withdrawals_document() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("expected withdrawal document type");
-
-        let document = document_type
-            .random_document(Some(55), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-        let serialized = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("serialize should succeed");
-        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-            .expect("from_bytes should succeed");
-        assert_eq!(*doc_v0, deserialized);
-    }
-
-    // ================================================================
-    //  serialize_specific_version tests
-    // ================================================================
-
-    #[test]
-    fn serialize_specific_version_v0_produces_version_0_prefix() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(1), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        let serialized = doc_v0
-            .serialize_specific_version(document_type, &contract, 0)
-            .expect("serialize_specific_version v0 should succeed");
-
-        // The first bytes should be varint-encoded 0
-        let (version, _) = u64::decode_var(&serialized).expect("expected varint");
-        assert_eq!(version, 0, "serialization version prefix should be 0");
-    }
-
-    #[test]
-    fn serialize_specific_version_rejects_v1_for_v0_contract() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-
-        // V0 contracts should reject non-0 feature versions
-        if matches!(&contract, DataContract::V0(_)) {
-            let document_type = contract
-                .document_type_for_name(&type_name)
-                .expect("expected document type");
-
-            let document = document_type
-                .random_document(Some(1), platform_version)
-                .expect("expected random document");
-            let crate::document::Document::V0(doc_v0) = &document;
-
-            let result = doc_v0.serialize_specific_version(document_type, &contract, 1);
-            assert!(
-                result.is_err(),
-                "V0 contract should reject serialize_specific_version with feature_version != 0"
-            );
-        }
-    }
-
-    #[test]
-    fn serialize_specific_version_unknown_version_returns_error() {
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(1), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        let result = doc_v0.serialize_specific_version(document_type, &contract, 255);
-        assert!(
-            result.is_err(),
-            "unknown feature version should produce an error"
-        );
-        // V0 contracts reject any non-0 version with NotSupported before reaching the
-        // version dispatch. Non-V0 contracts would reach the version dispatch and return
-        // UnknownVersionMismatch.
-        match result.unwrap_err() {
-            ProtocolError::UnknownVersionMismatch { received, .. } => {
-                assert_eq!(received, 255);
-            }
-            ProtocolError::NotSupported(_) => {
-                // V0 contract path: rejects non-0 feature version before dispatching
-            }
-            other => panic!(
-                "expected UnknownVersionMismatch or NotSupported, got {:?}",
-                other
-            ),
-        }
-    }
-
-    // ================================================================
-    //  from_bytes deserialization error cases
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v0_rejects_too_small_buffer() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        // Buffer with varint(0) prefix then only 10 bytes (too small for id+owner_id = 64 bytes)
-        let mut small_buf = 0u64.encode_var_vec();
-        small_buf.extend_from_slice(&[0u8; 10]);
-
-        let result = DocumentV0::from_bytes(&small_buf, document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "buffer shorter than 64 bytes after version prefix should fail"
-        );
-    }
-
-    #[test]
-    fn from_bytes_empty_buffer_fails() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let result = DocumentV0::from_bytes(&[], document_type, platform_version);
-        assert!(result.is_err(), "empty buffer should fail deserialization");
-    }
-
-    #[test]
-    fn from_bytes_unknown_serialization_version_fails() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        // Encode a version that is not 0, 1, or 2
-        let mut buf = 200u64.encode_var_vec();
-        buf.extend_from_slice(&[0u8; 100]); // padding
-
-        let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
-        assert!(result.is_err(), "unknown version should be rejected");
-        match result.unwrap_err() {
-            ProtocolError::UnknownVersionMismatch { received, .. } => {
-                assert_eq!(received, 200);
-            }
-            other => panic!("expected UnknownVersionMismatch, got {:?}", other),
-        }
-    }
-
-    #[test]
-    fn from_bytes_truncated_after_ids_fails() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        // Valid version prefix, valid 64-byte id+owner_id, then no more data
-        // This should fail when trying to read revision or timestamp flags
-        let mut buf = 0u64.encode_var_vec();
-        buf.extend_from_slice(&[0xAA; 64]); // id (32) + owner_id (32)
-
-        let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "truncated buffer after ids should fail deserialization"
-        );
-    }
-
-    // ================================================================
-    //  Serialization format: verify version prefix encoding
-    // ================================================================
-
-    #[test]
-    fn serialization_starts_with_correct_version_varint() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(100), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        // serialize_v0 should prefix with varint 0
-        let bytes = doc_v0
-            .serialize_v0(document_type)
-            .expect("serialize_v0 should succeed");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
-        assert_eq!(ver, 0);
-
-        // serialize_v1 should prefix with varint 1
-        let bytes = doc_v0
-            .serialize_v1(document_type)
-            .expect("serialize_v1 should succeed");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
-        assert_eq!(ver, 1);
-
-        // serialize_v2 should prefix with varint 2
-        let bytes = doc_v0
-            .serialize_v2(document_type)
-            .expect("serialize_v2 should succeed");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
-        assert_eq!(ver, 2);
-    }
-
-    #[test]
-    fn serialized_id_and_owner_id_are_embedded_after_version() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(42), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        let bytes = doc_v0
-            .serialize_v0(document_type)
-            .expect("serialize should succeed");
-
-        // Version 0 is a single-byte varint
-        let (_, varint_len) = u64::decode_var(&bytes).expect("varint decode");
-        let after_version = &bytes[varint_len..];
-
-        // Next 32 bytes = id
-        assert_eq!(
-            &after_version[..32],
-            doc_v0.id.as_slice(),
-            "id should be at offset after version"
-        );
-        // Following 32 bytes = owner_id
-        assert_eq!(
-            &after_version[32..64],
-            doc_v0.owner_id.as_slice(),
-            "owner_id should follow id"
-        );
-    }
-
-    // ================================================================
-    //  Determinism: same document serializes to the same bytes
-    // ================================================================
-
-    #[test]
-    fn serialization_is_deterministic() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(99), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        let bytes1 = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("first serialize");
-        let bytes2 = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("second serialize");
-        assert_eq!(bytes1, bytes2, "serialization must be deterministic");
-    }
-
-    // ================================================================
-    //  Multiple random documents round-trip (fuzz-like)
-    // ================================================================
-
-    #[test]
-    fn round_trip_many_random_documents() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        for seed in 0..50u64 {
-            let document = document_type
-                .random_document(Some(seed), platform_version)
-                .expect("expected random document");
-            let crate::document::Document::V0(doc_v0) = &document;
-            let serialized = doc_v0
-                .serialize(document_type, &contract, platform_version)
-                .expect("serialize should succeed");
-            let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-                .expect("from_bytes should succeed");
-            assert_eq!(*doc_v0, deserialized, "round-trip mismatch for seed {seed}");
-        }
-    }
-
-    // ================================================================
-    //  from_bytes_in_consensus
-    // ================================================================
-
-    #[cfg(feature = "validation")]
-    #[test]
-    fn from_bytes_in_consensus_valid_data_returns_valid_result() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(77), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-        let serialized = doc_v0
-            .serialize(document_type, &contract, platform_version)
-            .expect("serialize should succeed");
-
-        let result =
-            DocumentV0::from_bytes_in_consensus(&serialized, document_type, platform_version)
-                .expect("from_bytes_in_consensus should not return ProtocolError");
-
-        assert!(result.is_valid(), "consensus result should be valid");
-        let deserialized = result.into_data().expect("should have data");
-        assert_eq!(*doc_v0, deserialized);
-    }
-
-    #[cfg(feature = "validation")]
-    #[test]
-    fn from_bytes_in_consensus_invalid_data_returns_consensus_error() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        // Version 0, then truncated data
-        let mut buf = 0u64.encode_var_vec();
-        buf.extend_from_slice(&[0u8; 10]);
-
-        let result = DocumentV0::from_bytes_in_consensus(&buf, document_type, platform_version)
-            .expect("should not return ProtocolError for consensus-level decode");
-
-        assert!(
-            !result.is_valid(),
-            "consensus result should contain errors for malformed data"
-        );
-    }
-
-    #[cfg(feature = "validation")]
-    #[test]
-    fn from_bytes_in_consensus_unknown_version_returns_protocol_error() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let mut buf = 200u64.encode_var_vec();
-        buf.extend_from_slice(&[0u8; 100]);
-
-        let result = DocumentV0::from_bytes_in_consensus(&buf, document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "unknown version should produce a ProtocolError, not a consensus error"
-        );
-    }
-
-    // ================================================================
-    //  Missing-required-field errors in serialize_v0 / v1 / v2.
-    //  The withdrawal contract requires both $createdAt and $updatedAt,
-    //  so a DocumentV0 lacking those should fail serialization.
-    // ================================================================
-
-    fn doc_with_ids() -> DocumentV0 {
-        DocumentV0 {
-            id: Identifier::new([1u8; 32]),
-            owner_id: Identifier::new([2u8; 32]),
-            properties: BTreeMap::new(),
-            revision: Some(1),
-            created_at: None,
-            updated_at: None,
-            transferred_at: None,
-            created_at_block_height: None,
-            updated_at_block_height: None,
-            transferred_at_block_height: None,
-            created_at_core_block_height: None,
-            updated_at_core_block_height: None,
-            transferred_at_core_block_height: None,
-            creator_id: None,
-        }
-    }
-
-    #[test]
-    fn serialize_v0_missing_created_at_errors_when_required() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("withdrawal document type");
-
-        // Build a document missing $createdAt. Don't include any user-defined
-        // required properties either — we want to trigger the $createdAt path
-        // before the user-property path.
-        let doc = doc_with_ids();
-
-        let err = doc
-            .serialize_v0(document_type)
-            .expect_err("serialize_v0 should fail for missing $createdAt");
-        match err {
-            ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
-                assert!(
-                    msg.contains("created at"),
-                    "expected missing-created-at message, got: {msg}"
-                );
-            }
-            other => panic!(
-                "expected MissingRequiredKey for created_at, got {:?}",
-                other
-            ),
-        }
-    }
-
-    #[test]
-    fn serialize_v0_missing_updated_at_errors_when_required() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("withdrawal document type");
-
-        // Supply $createdAt but not $updatedAt — both are required.
-        let mut doc = doc_with_ids();
-        doc.created_at = Some(1_700_000_000_000);
-
-        let err = doc
-            .serialize_v0(document_type)
-            .expect_err("serialize_v0 should fail for missing $updatedAt");
-        match err {
-            ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
-                assert!(
-                    msg.contains("updated at"),
-                    "expected missing-updated-at message, got: {msg}"
-                );
-            }
-            other => panic!(
-                "expected MissingRequiredKey for updated_at, got {:?}",
-                other
-            ),
-        }
-    }
-
-    #[test]
-    fn serialize_v1_missing_created_at_errors_when_required() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("withdrawal document type");
-
-        let doc = doc_with_ids();
-        let err = doc
-            .serialize_v1(document_type)
-            .expect_err("serialize_v1 should fail for missing $createdAt");
-        assert!(matches!(
-            err,
-            ProtocolError::DataContractError(DataContractError::MissingRequiredKey(_))
-        ));
-    }
-
-    #[test]
-    fn serialize_v2_missing_created_at_errors_when_required() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("withdrawal document type");
-
-        let doc = doc_with_ids();
-        let err = doc
-            .serialize_v2(document_type)
-            .expect_err("serialize_v2 should fail for missing $createdAt");
-        assert!(matches!(
-            err,
-            ProtocolError::DataContractError(DataContractError::MissingRequiredKey(_))
-        ));
-    }
-
-    #[test]
-    fn serialize_v0_missing_required_user_property_errors() {
-        // Family `person` requires `firstName`, `lastName`, `age`.
-        let platform_version = PlatformVersion::first();
-        let contract = family_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("person")
-            .expect("person document type");
-
-        // Document with only ids, no user-defined required properties set.
-        let doc = doc_with_ids();
-
-        let err = doc
-            .serialize_v0(document_type)
-            .expect_err("serialize_v0 should fail for missing required property");
-        match err {
-            ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
-                // The error message includes the field name for user-defined required fields.
-                let any_expected = msg.contains("firstName")
-                    || msg.contains("lastName")
-                    || msg.contains("age")
-                    || msg.contains("required field");
-                assert!(any_expected, "unexpected error message: {msg}");
-            }
-            other => panic!("expected MissingRequiredKey, got {:?}", other),
-        }
-    }
-
-    // ================================================================
-    //  from_bytes: V1 prefix dispatches to from_bytes_v1 directly
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v1_prefix_dispatches_to_v1_path() {
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(123), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        // Bypass the V0-contract gate by calling serialize_v1 directly: the
-        // resulting varint-1 prefix must round-trip through from_bytes.
-        let bytes = doc_v0.serialize_v1(document_type).expect("serialize_v1");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint");
-        assert_eq!(ver, 1);
-        let recovered = DocumentV0::from_bytes(&bytes, document_type, platform_version)
-            .expect("from_bytes should dispatch to v1");
-        assert_eq!(*doc_v0, recovered);
-    }
-
-    // ================================================================
-    //  from_bytes: V2 prefix round-trip for documents with a creator_id
-    //  (contactRequest is transferable, so v2 records the creator flag).
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v2_non_transferable_type_does_not_persist_creator_id() {
-        // frozen: V0 consensus behavior — contactRequest is non-transferable
-        // with TradeMode::None, so v2 intentionally skips the creator_id byte
-        // in both serialize_v2 and from_bytes_v2. Assigning a creator_id on
-        // the source document is therefore NOT round-tripped.
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(321), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(mut doc_v0) = document;
-        // Even setting a creator_id here has no on-wire effect for this type.
-        doc_v0.creator_id = Some(Identifier::new([0xAB; 32]));
-
-        let bytes = doc_v0.serialize_v2(document_type).expect("serialize_v2");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint");
-        assert_eq!(ver, 2);
-
-        let recovered = DocumentV0::from_bytes(&bytes, document_type, platform_version)
-            .expect("from_bytes should dispatch to v2");
-        assert_eq!(doc_v0.id, recovered.id);
-        assert_eq!(doc_v0.owner_id, recovered.owner_id);
-        assert_eq!(
-            recovered.creator_id, None,
-            "creator_id is not encoded for non-transferable / TradeMode::None types"
-        );
-    }
-
-    #[test]
-    fn from_bytes_v2_prefix_round_trip_with_none_creator_id() {
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(999), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(mut doc_v0) = document;
-        // creator_id is None — exercise the else-branch of v2's creator check.
-        doc_v0.creator_id = None;
-
-        let bytes = doc_v0.serialize_v2(document_type).expect("serialize_v2");
-        let recovered =
-            DocumentV0::from_bytes(&bytes, document_type, platform_version).expect("from_bytes v2");
-        assert_eq!(recovered.creator_id, None);
-    }
-
-    // ================================================================
-    //  from_bytes_v1 / v2 directly — too-small buffers should error
-    //  before we read any id / owner id bytes.
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v1_direct_too_small_buffer_errors() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let result = DocumentV0::from_bytes_v1(&[0u8; 10], document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "from_bytes_v1 should fail for buffer < 64 bytes"
-        );
-    }
-
-    #[test]
-    fn from_bytes_v2_direct_too_small_buffer_errors() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let result = DocumentV0::from_bytes_v2(&[0u8; 10], document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "from_bytes_v2 should fail for buffer < 64 bytes"
-        );
-    }
-
-    #[test]
-    fn from_bytes_v0_direct_too_small_buffer_errors() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let result = DocumentV0::from_bytes_v0(&[0u8; 10], document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "from_bytes_v0 should fail for buffer < 64 bytes"
-        );
-    }
-
-    // ================================================================
-    //  from_bytes: V1 prefix with truncated post-id data errors
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v1_truncated_post_ids_errors() {
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        // V1 varint + 64 bytes (id + owner_id) — nothing after that, so the
-        // revision / timestamp_flags read must fail.
-        let mut buf = 1u64.encode_var_vec();
-        buf.extend_from_slice(&[0xCD; 64]);
-
-        let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "v1 with truncated post-ids should fail deserialization"
-        );
-    }
-
-    #[test]
-    fn from_bytes_v2_truncated_post_ids_errors() {
-        let platform_version = PlatformVersion::latest();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let mut buf = 2u64.encode_var_vec();
-        buf.extend_from_slice(&[0xCD; 64]);
-
-        let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
-        assert!(
-            result.is_err(),
-            "v2 with truncated post-ids should fail deserialization"
-        );
-    }
-
-    // ================================================================
-    //  serialize_specific_version: V0 contract + feature_version 0
-    //  should succeed (the V0-gated NotSupported branch is NOT hit).
-    // ================================================================
-
-    #[test]
-    fn serialize_specific_version_v0_contract_feature_version_0_succeeds() {
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(5), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        // feature_version 0 is explicitly allowed for V0 contracts.
-        let bytes = doc_v0
-            .serialize_specific_version(document_type, &contract, 0)
-            .expect("serialize_specific_version v0 should succeed on a V0 contract");
-        let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
-        assert_eq!(ver, 0);
-    }
-
-    // ================================================================
-    //  serialize_specific_version: feature_version 2 with a non-V0
-    //  contract (latest platform version) should succeed.
-    // ================================================================
-
-    #[test]
-    fn serialize_specific_version_rejects_v2_for_v0_contract() {
-        // V0 contracts always force serialize_v0, so feature_version 2 is
-        // rejected with NotSupported before reaching the version dispatch.
-        // Use `PlatformVersion::first()` so the fixture is guaranteed to load
-        // as a V0 contract — without this, the test could pass vacuously if
-        // the dashpay contract began deserializing as a non-V0 variant.
-        let platform_version = PlatformVersion::first();
-        let (contract, type_name) = dashpay_contract_and_type(platform_version);
-        let document_type = contract
-            .document_type_for_name(&type_name)
-            .expect("expected document type");
-
-        let document = document_type
-            .random_document(Some(17), platform_version)
-            .expect("expected random document");
-        let crate::document::Document::V0(doc_v0) = &document;
-
-        // Precondition: the fixture must actually be a V0 contract, otherwise
-        // the NotSupported branch we intend to exercise would never be hit.
-        assert!(
-            matches!(&contract, DataContract::V0(_)),
-            "fixture must be a V0 contract to exercise the V0-gated NotSupported branch"
-        );
-
-        let err = doc_v0
-            .serialize_specific_version(document_type, &contract, 2)
-            .expect_err("V0 contract should reject v2");
-        match err {
-            ProtocolError::NotSupported(_) => {}
-            other => panic!("expected NotSupported, got {:?}", other),
-        }
-    }
-
-    // ================================================================
-    //  from_bytes V0-then-V1 fallback: a valid V1 buffer with a V0
-    //  varint prefix should still round-trip via the fallback path.
-    //  Construct bytes by serializing v1 and then overwriting the
-    //  varint prefix to 0.
-    // ================================================================
-
-    #[test]
-    fn from_bytes_v0_falls_back_to_v1_on_decoding_error() {
-        // Use a contract whose properties are all integers so v0 (I64) and v1
-        // (actual type) produce different encoded lengths / types. family's
-        // `person` has one integer field `age`, suitable for fallback testing.
-        let platform_version = PlatformVersion::latest();
-        let contract = family_contract(platform_version);
-        let document_type = contract
-            .document_type_for_name("person")
-            .expect("person document type");
-
-        // Random document serialized in v1 format (integers kept as native).
-        let document = document_type
-            .random_document(Some(55), platform_version)
-            .expect("random document");
-        let crate::document::Document::V0(doc_v0) = document;
-
-        // Serialize in v1 explicitly.
-        let mut v1_bytes = doc_v0
-            .serialize_v1(document_type)
-            .expect("serialize_v1 should succeed");
-        // Overwrite the varint-1 prefix with varint-0.
-        v1_bytes[0] = 0;
-
-        // from_bytes dispatches to v0, which fails on the mismatched layout,
-        // then retries via v1 — the fallback must recover the original document.
-        let recovered = DocumentV0::from_bytes(&v1_bytes, document_type, platform_version)
-            .expect("v0-prefixed v1 payload must fall back to v1 deserialization");
-        assert_eq!(recovered, doc_v0);
-    }
-
-    // ================================================================
-    //  Known-bytes deserialization (golden test)
-    // ================================================================
-
-    #[test]
-    fn deserialize_known_withdrawal_bytes() {
-        let platform_version = PlatformVersion::latest();
-        let contract = withdrawals_contract(platform_version);
-
-        let document_type = contract
-            .document_type_for_name("withdrawal")
-            .expect("expected withdrawal document type");
-
-        // This is a real serialized withdrawal document (from existing test)
-        let serialized = hex::decode(
-            "010053626cafc76f47062f936c5938190f5f30aac997b8fc22e81c1d9a7f903bd9\
-             fa8696d3f39c518784e53be79ee199e70387f9a7408254de920c1f3779de285601\
-             00030000019782b96d140000019782b96d14000000000002540be40000000001\
-             001976a9149e3292d2612122d81613fdb893dd36a04df3355588ac00",
-        )
-        .expect("expected valid hex");
-
-        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
-            .expect("expected deserialization to succeed");
-
-        // Verify known fields
-        assert_eq!(
-            hex::encode(deserialized.id.as_slice()),
-            "0053626cafc76f47062f936c5938190f5f30aac997b8fc22e81c1d9a7f903bd9"
-        );
-        assert_eq!(
-            hex::encode(deserialized.owner_id.as_slice()),
-            "fa8696d3f39c518784e53be79ee199e70387f9a7408254de920c1f3779de2856"
-        );
-        assert_eq!(deserialized.revision, Some(1));
-        assert_eq!(deserialized.created_at, Some(1750244879636));
-        assert_eq!(deserialized.updated_at, Some(1750244879636));
-    }
-}
diff --git a/packages/rs-dpp/src/document/v0/serialize/mod.rs b/packages/rs-dpp/src/document/v0/serialize/mod.rs
new file mode 100644
index 00000000000..223d1ec58a7
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/mod.rs
@@ -0,0 +1,323 @@
+use crate::data_contract::document_type::DocumentTypeRef;
+use crate::data_contract::errors::DataContractError;
+
+#[cfg(feature = "validation")]
+use crate::prelude::ConsensusValidationResult;
+
+use crate::prelude::DataContract;
+
+use crate::ProtocolError;
+
+use crate::document::serialization_traits::deserialize::v0::DocumentPlatformDeserializationMethodsV0;
+use crate::document::serialization_traits::serialize::v0::DocumentPlatformSerializationMethodsV0;
+use crate::document::serialization_traits::DocumentPlatformConversionMethodsV0;
+use crate::document::v0::DocumentV0;
+use crate::version::PlatformVersion;
+use integer_encoding::VarIntReader;
+
+use platform_version::version::FeatureVersion;
+
+use crate::consensus::basic::decode::DecodingError;
+#[cfg(feature = "validation")]
+use crate::consensus::basic::BasicError;
+#[cfg(feature = "validation")]
+use crate::consensus::ConsensusError;
+use crate::data_contract::accessors::v0::DataContractV0Getters;
+use crate::data_contract::config::DataContractConfig;
+
+mod v0;
+mod v1;
+mod v2;
+mod v3;
+
+// Each serialization format generation lives in its own file (v0.rs–v3.rs);
+// the trait impls below are one-line dispatch shims into the inherent
+// methods those files define. Consensus discipline: a shipped format's file
+// must never change, and a diff touching one is immediately suspect.
+impl DocumentPlatformSerializationMethodsV0 for DocumentV0 {
+    /// Format 0 — implementation in [`v0`].
+    fn serialize_v0(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
+        DocumentV0::serialize_v0(self, document_type)
+    }
+
+    /// Format 1 — implementation in [`v1`].
+    fn serialize_v1(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
+        DocumentV0::serialize_v1(self, document_type)
+    }
+
+    /// Format 2 — implementation in [`v2`].
+    fn serialize_v2(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
+        DocumentV0::serialize_v2(self, document_type)
+    }
+
+    /// Format 3 — implementation in [`v3`].
+    fn serialize_v3(&self, document_type: DocumentTypeRef) -> Result<Vec<u8>, ProtocolError> {
+        DocumentV0::serialize_v3(self, document_type)
+    }
+}
+
+impl DocumentPlatformDeserializationMethodsV0 for DocumentV0 {
+    /// Format 0 — implementation in [`v0`].
+    fn from_bytes_v0(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        DocumentV0::from_bytes_v0(serialized_document, document_type, platform_version)
+    }
+
+    /// Format 1 — implementation in [`v1`].
+    fn from_bytes_v1(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        DocumentV0::from_bytes_v1(serialized_document, document_type, platform_version)
+    }
+
+    /// Format 2 — implementation in [`v2`].
+    fn from_bytes_v2(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        DocumentV0::from_bytes_v2(serialized_document, document_type, platform_version)
+    }
+
+    /// Format 3 — implementation in [`v3`].
+    fn from_bytes_v3(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        DocumentV0::from_bytes_v3(serialized_document, document_type, platform_version)
+    }
+}
+
+impl DocumentPlatformConversionMethodsV0 for DocumentV0 {
+    /// Serializes the document.
+    ///
+    /// The serialization of a document follows the pattern:
+    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
+    fn serialize(
+        &self,
+        document_type: DocumentTypeRef,
+        contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        if matches!(contract, DataContract::V0(_))
+            || matches!(contract.config(), DataContractConfig::V0(_))
+        {
+            // Any data contract in version 0 should always serialize documents in version 0
+            // This is because integers in such a data contract if made through normal versioning should always
+            // be i64
+            // While it's possible in theory maybe that they are not i64 using serialize_v0
+            // will encode all integers as i64.
+            self.serialize_v0(document_type)
+        } else {
+            match platform_version
+                .dpp
+                .document_versions
+                .document_serialization_version
+                .default_current_version
+            {
+                // Version 0 is the original format, the default for protocol
+                // versions 1 through 8. Every integer is encoded as an i64
+                // regardless of its schema type.
+                0 => self.serialize_v0(document_type),
+                // Version 1 coincides with protocol version 9, which contains tokens, new document types,
+                // and most importantly different integer types.
+                // Document types now have properties that are known to be things like u8, i32 etc.
+                1 => self.serialize_v1(document_type),
+                // Version 2 coincides with protocol version 10: it adds the
+                // $creatorId field for document types that support transfers
+                // or trading, so the original creator survives ownership
+                // changes.
+                2 => self.serialize_v2(document_type),
+                // Version 3 coincides with protocol version 14: it stamps the
+                // document with the contract version its bytes conform to,
+                // enabling `requiredSince` properties.
+                3 => self.serialize_v3(document_type),
+                version => Err(ProtocolError::UnknownVersionMismatch {
+                    method: "DocumentV0::serialize".to_string(),
+                    known_versions: vec![0, 1, 2, 3],
+                    received: version,
+                }),
+            }
+        }
+    }
+
+    fn serialize_specific_version(
+        &self,
+        document_type: DocumentTypeRef,
+        contract: &DataContract,
+        feature_version: FeatureVersion,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        if (matches!(contract, DataContract::V0(_))
+            || matches!(contract.config(), DataContractConfig::V0(_)))
+            && feature_version != 0
+        {
+            // Any data contract in version 0 should always serialize documents in version 0
+            // This is because integers in such a data contract if made through normal versioning should always
+            // be i64
+            // While it's possible in theory maybe that they are not i64 using serialize_v0
+            // will encode all integers as i64.
+            return Err(ProtocolError::NotSupported("Serializing with data contract version 0 or data contract config version 0 is not supported outside of feature version 0".to_string()));
+        };
+        match feature_version {
+            0 => self.serialize_v0(document_type),
+            1 => self.serialize_v1(document_type),
+            2 => self.serialize_v2(document_type),
+            3 => self.serialize_v3(document_type),
+            version => Err(ProtocolError::UnknownVersionMismatch {
+                method: "DocumentV0::serialize".to_string(),
+                known_versions: vec![0, 1, 2, 3],
+                received: version,
+            }),
+        }
+    }
+
+    /// Reads a serialized document and creates a DocumentV0 from it.
+    fn from_bytes(
+        mut serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError> {
+        let serialized_version = serialized_document.read_varint().map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading revision from serialized document for revision".to_string(),
+            ))
+        })?;
+        match serialized_version {
+            0 => {
+                match DocumentV0::from_bytes_v0(
+                    serialized_document,
+                    document_type,
+                    platform_version,
+                )
+                .map_err(ProtocolError::DataContractError)
+                {
+                    Ok(document) => Ok(document),
+                    Err(first_err) => {
+                        // let's try decoding in V1 just to be safe
+                        // Version 0 will decode all integers as I64
+                        // Version 1 will decode all integers properly
+                        // When version was 0 used (protocol version 1 to 8) integers other than I64
+                        // existed, but were probably never used, which is why we try v1 just to be safe
+                        match DocumentV0::from_bytes_v1(
+                            serialized_document,
+                            document_type,
+                            platform_version,
+                        ) {
+                            Ok(document_from_version_1_deserialization) => {
+                                Ok(document_from_version_1_deserialization)
+                            }
+                            Err(_) => Err(first_err),
+                        }
+                    }
+                }
+            }
+            1 => DocumentV0::from_bytes_v1(serialized_document, document_type, platform_version)
+                .map_err(ProtocolError::DataContractError),
+            2 => DocumentV0::from_bytes_v2(serialized_document, document_type, platform_version)
+                .map_err(ProtocolError::DataContractError),
+            3 => DocumentV0::from_bytes_v3(serialized_document, document_type, platform_version)
+                .map_err(ProtocolError::DataContractError),
+            version => Err(ProtocolError::UnknownVersionMismatch {
+                method: "Document::from_bytes (deserialization)".to_string(),
+                known_versions: vec![0, 1, 2, 3],
+                received: version,
+            }),
+        }
+    }
+
+    /// Reads a serialized document and creates a DocumentV0 from it.
+    #[cfg(feature = "validation")]
+    fn from_bytes_in_consensus(
+        mut serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        platform_version: &PlatformVersion,
+    ) -> Result<ConsensusValidationResult<Self>, ProtocolError> {
+        let serialized_version = serialized_document.read_varint().map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading revision from serialized document for revision".to_string(),
+            ))
+        })?;
+        match serialized_version {
+            0 => {
+                match DocumentV0::from_bytes_v0(
+                    serialized_document,
+                    document_type,
+                    platform_version,
+                ) {
+                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
+                    Err(first_err) => {
+                        // let's try decoding in V1 just to be safe
+                        // Version 0 will decode all integers as I64
+                        // Version 1 will decode all integers properly
+                        // When version was 0 used (protocol version 1 to 8) integers other than I64
+                        // existed, but were probably never used, which is why we try v1 just to be safe
+                        match DocumentV0::from_bytes_v1(
+                            serialized_document,
+                            document_type,
+                            platform_version,
+                        ) {
+                            Ok(document_from_version_1_deserialization) => {
+                                Ok(ConsensusValidationResult::new_with_data(
+                                    document_from_version_1_deserialization,
+                                ))
+                            }
+                            Err(_) => Ok(ConsensusValidationResult::new_with_error(
+                                ConsensusError::BasicError(BasicError::ContractError(first_err)),
+                            )),
+                        }
+                    }
+                }
+            }
+            1 => {
+                match DocumentV0::from_bytes_v1(
+                    serialized_document,
+                    document_type,
+                    platform_version,
+                ) {
+                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
+                    Err(err) => Ok(ConsensusValidationResult::new_with_error(
+                        ConsensusError::BasicError(BasicError::ContractError(err)),
+                    )),
+                }
+            }
+            2 => {
+                match DocumentV0::from_bytes_v2(
+                    serialized_document,
+                    document_type,
+                    platform_version,
+                ) {
+                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
+                    Err(err) => Ok(ConsensusValidationResult::new_with_error(
+                        ConsensusError::BasicError(BasicError::ContractError(err)),
+                    )),
+                }
+            }
+            3 => {
+                match DocumentV0::from_bytes_v3(
+                    serialized_document,
+                    document_type,
+                    platform_version,
+                ) {
+                    Ok(document) => Ok(ConsensusValidationResult::new_with_data(document)),
+                    Err(err) => Ok(ConsensusValidationResult::new_with_error(
+                        ConsensusError::BasicError(BasicError::ContractError(err)),
+                    )),
+                }
+            }
+            version => Err(ProtocolError::UnknownVersionMismatch {
+                method: "Document::from_bytes (deserialization)".to_string(),
+                known_versions: vec![0, 1, 2, 3],
+                received: version,
+            }),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/packages/rs-dpp/src/document/v0/serialize/tests.rs b/packages/rs-dpp/src/document/v0/serialize/tests.rs
new file mode 100644
index 00000000000..15d2b74447c
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/tests.rs
@@ -0,0 +1,1675 @@
+use super::*;
+use crate::data_contract::accessors::v0::DataContractV0Getters;
+use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
+use crate::data_contract::document_type::random_document::CreateRandomDocument;
+use crate::tests::json_document::json_document_to_contract;
+use integer_encoding::VarInt;
+use platform_value::{Identifier, Value};
+use platform_version::version::PlatformVersion;
+use std::collections::BTreeMap;
+
+// ----------------------------------------------------------------
+// Helper: load the dashpay contract and return the contract plus a
+// DocumentTypeRef for the given document type name.
+// ----------------------------------------------------------------
+fn dashpay_contract_and_type(
+    platform_version: &PlatformVersion,
+) -> (crate::prelude::DataContract, String) {
+    let contract = json_document_to_contract(
+        "../rs-drive/tests/supporting_files/contract/dashpay/dashpay-contract.json",
+        false,
+        platform_version,
+    )
+    .expect("expected to load dashpay contract");
+    (contract, "contactRequest".to_string())
+}
+
+fn family_contract(platform_version: &PlatformVersion) -> crate::prelude::DataContract {
+    json_document_to_contract(
+        "../rs-drive/tests/supporting_files/contract/family/family-contract.json",
+        false,
+        platform_version,
+    )
+    .expect("expected to load family contract")
+}
+
+fn withdrawals_contract(platform_version: &PlatformVersion) -> crate::prelude::DataContract {
+    json_document_to_contract(
+        "../rs-drive/tests/supporting_files/contract/withdrawals/withdrawals-contract.json",
+        false,
+        platform_version,
+    )
+    .expect("expected to load withdrawals contract")
+}
+
+// ================================================================
+//  Round-trip: serialize then deserialize, expect equality
+// ================================================================
+
+#[test]
+fn round_trip_serialize_v0_dashpay_contact_request() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(42), platform_version)
+        .expect("expected random document");
+
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    let serialized = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("serialize should succeed");
+
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+        .expect("from_bytes should succeed");
+
+    assert_eq!(*doc_v0, deserialized);
+}
+
+#[test]
+fn round_trip_serialize_v0_family_person() {
+    let platform_version = PlatformVersion::first();
+    let contract = family_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("person")
+        .expect("expected person document type");
+
+    for seed in 0..20u64 {
+        let document = document_type
+            .random_document(Some(seed), platform_version)
+            .expect("expected random document");
+        let crate::document::Document::V0(doc_v0) = &document;
+        let serialized = doc_v0
+            .serialize(document_type, &contract, platform_version)
+            .expect("serialize should succeed");
+        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+            .expect("from_bytes should succeed");
+        assert_eq!(*doc_v0, deserialized, "round-trip failed for seed {seed}");
+    }
+}
+
+#[test]
+fn round_trip_serialize_v1_family_person() {
+    // Platform version that defaults to serialization v1
+    let platform_version = PlatformVersion::get(9).unwrap_or_else(|_| PlatformVersion::latest());
+
+    // We need a non-V0 contract for v1 serialization. Use the latest platform version
+    // to load the contract and create a document type.
+    let contract = json_document_to_contract(
+        "../rs-drive/tests/supporting_files/contract/family/family-contract.json",
+        false,
+        platform_version,
+    )
+    .expect("expected to load family contract");
+
+    let document_type = contract
+        .document_type_for_name("person")
+        .expect("expected person document type");
+
+    // Only test if we can actually produce v1 serialization
+    // (contract must not be V0 and config must not be V0 for v1)
+    if matches!(&contract, DataContract::V0(_)) {
+        // V0 contracts always force serialize_v0, so we test that path instead
+        let document = document_type
+            .random_document(Some(99), platform_version)
+            .expect("expected random document");
+        let crate::document::Document::V0(doc_v0) = &document;
+        let serialized = doc_v0
+            .serialize(document_type, &contract, platform_version)
+            .expect("serialize should succeed");
+        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+            .expect("from_bytes should succeed");
+        assert_eq!(*doc_v0, deserialized);
+    } else {
+        let document = document_type
+            .random_document(Some(99), platform_version)
+            .expect("expected random document");
+        let crate::document::Document::V0(doc_v0) = &document;
+        let serialized = doc_v0
+            .serialize(document_type, &contract, platform_version)
+            .expect("serialize should succeed");
+        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+            .expect("from_bytes should succeed");
+        assert_eq!(*doc_v0, deserialized);
+    }
+}
+
+#[test]
+fn round_trip_serialize_v2_latest_platform() {
+    let platform_version = PlatformVersion::latest();
+    let contract = json_document_to_contract(
+        "../rs-drive/tests/supporting_files/contract/dashpay/dashpay-contract.json",
+        false,
+        platform_version,
+    )
+    .expect("expected to load dashpay contract");
+
+    let document_type = contract
+        .document_type_for_name("contactRequest")
+        .expect("expected contactRequest document type");
+
+    let document = document_type
+        .random_document(Some(7), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+    let serialized = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("serialize should succeed");
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+        .expect("from_bytes should succeed");
+    assert_eq!(*doc_v0, deserialized);
+}
+
+#[test]
+fn round_trip_withdrawals_document() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("expected withdrawal document type");
+
+    let document = document_type
+        .random_document(Some(55), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+    let serialized = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("serialize should succeed");
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+        .expect("from_bytes should succeed");
+    assert_eq!(*doc_v0, deserialized);
+}
+
+// ================================================================
+//  serialize_specific_version tests
+// ================================================================
+
+#[test]
+fn serialize_specific_version_v0_produces_version_0_prefix() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(1), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    let serialized = doc_v0
+        .serialize_specific_version(document_type, &contract, 0)
+        .expect("serialize_specific_version v0 should succeed");
+
+    // The first bytes should be varint-encoded 0
+    let (version, _) = u64::decode_var(&serialized).expect("expected varint");
+    assert_eq!(version, 0, "serialization version prefix should be 0");
+}
+
+#[test]
+fn serialize_specific_version_rejects_v1_for_v0_contract() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+
+    // V0 contracts should reject non-0 feature versions
+    if matches!(&contract, DataContract::V0(_)) {
+        let document_type = contract
+            .document_type_for_name(&type_name)
+            .expect("expected document type");
+
+        let document = document_type
+            .random_document(Some(1), platform_version)
+            .expect("expected random document");
+        let crate::document::Document::V0(doc_v0) = &document;
+
+        let result = doc_v0.serialize_specific_version(document_type, &contract, 1);
+        assert!(
+            result.is_err(),
+            "V0 contract should reject serialize_specific_version with feature_version != 0"
+        );
+    }
+}
+
+#[test]
+fn serialize_specific_version_unknown_version_returns_error() {
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(1), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    let result = doc_v0.serialize_specific_version(document_type, &contract, 255);
+    assert!(
+        result.is_err(),
+        "unknown feature version should produce an error"
+    );
+    // V0 contracts reject any non-0 version with NotSupported before reaching the
+    // version dispatch. Non-V0 contracts would reach the version dispatch and return
+    // UnknownVersionMismatch.
+    match result.unwrap_err() {
+        ProtocolError::UnknownVersionMismatch { received, .. } => {
+            assert_eq!(received, 255);
+        }
+        ProtocolError::NotSupported(_) => {
+            // V0 contract path: rejects non-0 feature version before dispatching
+        }
+        other => panic!(
+            "expected UnknownVersionMismatch or NotSupported, got {:?}",
+            other
+        ),
+    }
+}
+
+// ================================================================
+//  from_bytes deserialization error cases
+// ================================================================
+
+#[test]
+fn from_bytes_v0_rejects_too_small_buffer() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    // Buffer with varint(0) prefix then only 10 bytes (too small for id+owner_id = 64 bytes)
+    let mut small_buf = 0u64.encode_var_vec();
+    small_buf.extend_from_slice(&[0u8; 10]);
+
+    let result = DocumentV0::from_bytes(&small_buf, document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "buffer shorter than 64 bytes after version prefix should fail"
+    );
+}
+
+#[test]
+fn from_bytes_empty_buffer_fails() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let result = DocumentV0::from_bytes(&[], document_type, platform_version);
+    assert!(result.is_err(), "empty buffer should fail deserialization");
+}
+
+#[test]
+fn from_bytes_unknown_serialization_version_fails() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    // Encode a version that is not 0, 1, or 2
+    let mut buf = 200u64.encode_var_vec();
+    buf.extend_from_slice(&[0u8; 100]); // padding
+
+    let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
+    assert!(result.is_err(), "unknown version should be rejected");
+    match result.unwrap_err() {
+        ProtocolError::UnknownVersionMismatch { received, .. } => {
+            assert_eq!(received, 200);
+        }
+        other => panic!("expected UnknownVersionMismatch, got {:?}", other),
+    }
+}
+
+#[test]
+fn from_bytes_truncated_after_ids_fails() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    // Valid version prefix, valid 64-byte id+owner_id, then no more data
+    // This should fail when trying to read revision or timestamp flags
+    let mut buf = 0u64.encode_var_vec();
+    buf.extend_from_slice(&[0xAA; 64]); // id (32) + owner_id (32)
+
+    let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "truncated buffer after ids should fail deserialization"
+    );
+}
+
+// ================================================================
+//  Serialization format: verify version prefix encoding
+// ================================================================
+
+#[test]
+fn serialization_starts_with_correct_version_varint() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(100), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    // serialize_v0 should prefix with varint 0
+    let bytes = doc_v0
+        .serialize_v0(document_type)
+        .expect("serialize_v0 should succeed");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
+    assert_eq!(ver, 0);
+
+    // serialize_v1 should prefix with varint 1
+    let bytes = doc_v0
+        .serialize_v1(document_type)
+        .expect("serialize_v1 should succeed");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
+    assert_eq!(ver, 1);
+
+    // serialize_v2 should prefix with varint 2
+    let bytes = doc_v0
+        .serialize_v2(document_type)
+        .expect("serialize_v2 should succeed");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
+    assert_eq!(ver, 2);
+}
+
+#[test]
+fn serialized_id_and_owner_id_are_embedded_after_version() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(42), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    let bytes = doc_v0
+        .serialize_v0(document_type)
+        .expect("serialize should succeed");
+
+    // Version 0 is a single-byte varint
+    let (_, varint_len) = u64::decode_var(&bytes).expect("varint decode");
+    let after_version = &bytes[varint_len..];
+
+    // Next 32 bytes = id
+    assert_eq!(
+        &after_version[..32],
+        doc_v0.id.as_slice(),
+        "id should be at offset after version"
+    );
+    // Following 32 bytes = owner_id
+    assert_eq!(
+        &after_version[32..64],
+        doc_v0.owner_id.as_slice(),
+        "owner_id should follow id"
+    );
+}
+
+// ================================================================
+//  Determinism: same document serializes to the same bytes
+// ================================================================
+
+#[test]
+fn serialization_is_deterministic() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(99), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    let bytes1 = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("first serialize");
+    let bytes2 = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("second serialize");
+    assert_eq!(bytes1, bytes2, "serialization must be deterministic");
+}
+
+// ================================================================
+//  Multiple random documents round-trip (fuzz-like)
+// ================================================================
+
+#[test]
+fn round_trip_many_random_documents() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    for seed in 0..50u64 {
+        let document = document_type
+            .random_document(Some(seed), platform_version)
+            .expect("expected random document");
+        let crate::document::Document::V0(doc_v0) = &document;
+        let serialized = doc_v0
+            .serialize(document_type, &contract, platform_version)
+            .expect("serialize should succeed");
+        let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+            .expect("from_bytes should succeed");
+        assert_eq!(*doc_v0, deserialized, "round-trip mismatch for seed {seed}");
+    }
+}
+
+// ================================================================
+//  from_bytes_in_consensus
+// ================================================================
+
+#[cfg(feature = "validation")]
+#[test]
+fn from_bytes_in_consensus_valid_data_returns_valid_result() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(77), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+    let serialized = doc_v0
+        .serialize(document_type, &contract, platform_version)
+        .expect("serialize should succeed");
+
+    let result = DocumentV0::from_bytes_in_consensus(&serialized, document_type, platform_version)
+        .expect("from_bytes_in_consensus should not return ProtocolError");
+
+    assert!(result.is_valid(), "consensus result should be valid");
+    let deserialized = result.into_data().expect("should have data");
+    assert_eq!(*doc_v0, deserialized);
+}
+
+#[cfg(feature = "validation")]
+#[test]
+fn from_bytes_in_consensus_invalid_data_returns_consensus_error() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    // Version 0, then truncated data
+    let mut buf = 0u64.encode_var_vec();
+    buf.extend_from_slice(&[0u8; 10]);
+
+    let result = DocumentV0::from_bytes_in_consensus(&buf, document_type, platform_version)
+        .expect("should not return ProtocolError for consensus-level decode");
+
+    assert!(
+        !result.is_valid(),
+        "consensus result should contain errors for malformed data"
+    );
+}
+
+#[cfg(feature = "validation")]
+#[test]
+fn from_bytes_in_consensus_unknown_version_returns_protocol_error() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let mut buf = 200u64.encode_var_vec();
+    buf.extend_from_slice(&[0u8; 100]);
+
+    let result = DocumentV0::from_bytes_in_consensus(&buf, document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "unknown version should produce a ProtocolError, not a consensus error"
+    );
+}
+
+// ================================================================
+//  Missing-required-field errors in serialize_v0 / v1 / v2.
+//  The withdrawal contract requires both $createdAt and $updatedAt,
+//  so a DocumentV0 lacking those should fail serialization.
+// ================================================================
+
+fn doc_with_ids() -> DocumentV0 {
+    DocumentV0 {
+        contract_version: None,
+        id: Identifier::new([1u8; 32]),
+        owner_id: Identifier::new([2u8; 32]),
+        properties: BTreeMap::new(),
+        revision: Some(1),
+        created_at: None,
+        updated_at: None,
+        transferred_at: None,
+        created_at_block_height: None,
+        updated_at_block_height: None,
+        transferred_at_block_height: None,
+        created_at_core_block_height: None,
+        updated_at_core_block_height: None,
+        transferred_at_core_block_height: None,
+        creator_id: None,
+    }
+}
+
+#[test]
+fn serialize_v0_missing_created_at_errors_when_required() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("withdrawal document type");
+
+    // Build a document missing $createdAt. Don't include any user-defined
+    // required properties either — we want to trigger the $createdAt path
+    // before the user-property path.
+    let doc = doc_with_ids();
+
+    let err = doc
+        .serialize_v0(document_type)
+        .expect_err("serialize_v0 should fail for missing $createdAt");
+    match err {
+        ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
+            assert!(
+                msg.contains("created at"),
+                "expected missing-created-at message, got: {msg}"
+            );
+        }
+        other => panic!(
+            "expected MissingRequiredKey for created_at, got {:?}",
+            other
+        ),
+    }
+}
+
+#[test]
+fn serialize_v0_missing_updated_at_errors_when_required() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("withdrawal document type");
+
+    // Supply $createdAt but not $updatedAt — both are required.
+    let mut doc = doc_with_ids();
+    doc.created_at = Some(1_700_000_000_000);
+
+    let err = doc
+        .serialize_v0(document_type)
+        .expect_err("serialize_v0 should fail for missing $updatedAt");
+    match err {
+        ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
+            assert!(
+                msg.contains("updated at"),
+                "expected missing-updated-at message, got: {msg}"
+            );
+        }
+        other => panic!(
+            "expected MissingRequiredKey for updated_at, got {:?}",
+            other
+        ),
+    }
+}
+
+#[test]
+fn serialize_v1_missing_created_at_errors_when_required() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("withdrawal document type");
+
+    let doc = doc_with_ids();
+    let err = doc
+        .serialize_v1(document_type)
+        .expect_err("serialize_v1 should fail for missing $createdAt");
+    assert!(matches!(
+        err,
+        ProtocolError::DataContractError(DataContractError::MissingRequiredKey(_))
+    ));
+}
+
+#[test]
+fn serialize_v2_missing_created_at_errors_when_required() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("withdrawal document type");
+
+    let doc = doc_with_ids();
+    let err = doc
+        .serialize_v2(document_type)
+        .expect_err("serialize_v2 should fail for missing $createdAt");
+    assert!(matches!(
+        err,
+        ProtocolError::DataContractError(DataContractError::MissingRequiredKey(_))
+    ));
+}
+
+#[test]
+fn serialize_v0_missing_required_user_property_errors() {
+    // Family `person` requires `firstName`, `lastName`, `age`.
+    let platform_version = PlatformVersion::first();
+    let contract = family_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("person")
+        .expect("person document type");
+
+    // Document with only ids, no user-defined required properties set.
+    let doc = doc_with_ids();
+
+    let err = doc
+        .serialize_v0(document_type)
+        .expect_err("serialize_v0 should fail for missing required property");
+    match err {
+        ProtocolError::DataContractError(DataContractError::MissingRequiredKey(msg)) => {
+            // The error message includes the field name for user-defined required fields.
+            let any_expected = msg.contains("firstName")
+                || msg.contains("lastName")
+                || msg.contains("age")
+                || msg.contains("required field");
+            assert!(any_expected, "unexpected error message: {msg}");
+        }
+        other => panic!("expected MissingRequiredKey, got {:?}", other),
+    }
+}
+
+// ================================================================
+//  from_bytes: V1 prefix dispatches to from_bytes_v1 directly
+// ================================================================
+
+#[test]
+fn from_bytes_v1_prefix_dispatches_to_v1_path() {
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(123), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    // Bypass the V0-contract gate by calling serialize_v1 directly: the
+    // resulting varint-1 prefix must round-trip through from_bytes.
+    let bytes = doc_v0.serialize_v1(document_type).expect("serialize_v1");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint");
+    assert_eq!(ver, 1);
+    let recovered = DocumentV0::from_bytes(&bytes, document_type, platform_version)
+        .expect("from_bytes should dispatch to v1");
+    assert_eq!(*doc_v0, recovered);
+}
+
+// ================================================================
+//  from_bytes: V2 prefix round-trip for documents with a creator_id
+//  (contactRequest is transferable, so v2 records the creator flag).
+// ================================================================
+
+#[test]
+fn from_bytes_v2_non_transferable_type_does_not_persist_creator_id() {
+    // frozen: V0 consensus behavior — contactRequest is non-transferable
+    // with TradeMode::None, so v2 intentionally skips the creator_id byte
+    // in both serialize_v2 and from_bytes_v2. Assigning a creator_id on
+    // the source document is therefore NOT round-tripped.
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(321), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(mut doc_v0) = document;
+    // Even setting a creator_id here has no on-wire effect for this type.
+    doc_v0.creator_id = Some(Identifier::new([0xAB; 32]));
+
+    let bytes = doc_v0.serialize_v2(document_type).expect("serialize_v2");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint");
+    assert_eq!(ver, 2);
+
+    let recovered = DocumentV0::from_bytes(&bytes, document_type, platform_version)
+        .expect("from_bytes should dispatch to v2");
+    assert_eq!(doc_v0.id, recovered.id);
+    assert_eq!(doc_v0.owner_id, recovered.owner_id);
+    assert_eq!(
+        recovered.creator_id, None,
+        "creator_id is not encoded for non-transferable / TradeMode::None types"
+    );
+}
+
+#[test]
+fn from_bytes_v2_prefix_round_trip_with_none_creator_id() {
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(999), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(mut doc_v0) = document;
+    // creator_id is None — exercise the else-branch of v2's creator check.
+    doc_v0.creator_id = None;
+
+    let bytes = doc_v0.serialize_v2(document_type).expect("serialize_v2");
+    let recovered =
+        DocumentV0::from_bytes(&bytes, document_type, platform_version).expect("from_bytes v2");
+    assert_eq!(recovered.creator_id, None);
+}
+
+// ================================================================
+//  from_bytes_v1 / v2 directly — too-small buffers should error
+//  before we read any id / owner id bytes.
+// ================================================================
+
+#[test]
+fn from_bytes_v1_direct_too_small_buffer_errors() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let result = DocumentV0::from_bytes_v1(&[0u8; 10], document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "from_bytes_v1 should fail for buffer < 64 bytes"
+    );
+}
+
+#[test]
+fn from_bytes_v2_direct_too_small_buffer_errors() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let result = DocumentV0::from_bytes_v2(&[0u8; 10], document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "from_bytes_v2 should fail for buffer < 64 bytes"
+    );
+}
+
+#[test]
+fn from_bytes_v0_direct_too_small_buffer_errors() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let result = DocumentV0::from_bytes_v0(&[0u8; 10], document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "from_bytes_v0 should fail for buffer < 64 bytes"
+    );
+}
+
+// ================================================================
+//  from_bytes: V1 prefix with truncated post-id data errors
+// ================================================================
+
+#[test]
+fn from_bytes_v1_truncated_post_ids_errors() {
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    // V1 varint + 64 bytes (id + owner_id) — nothing after that, so the
+    // revision / timestamp_flags read must fail.
+    let mut buf = 1u64.encode_var_vec();
+    buf.extend_from_slice(&[0xCD; 64]);
+
+    let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "v1 with truncated post-ids should fail deserialization"
+    );
+}
+
+#[test]
+fn from_bytes_v2_truncated_post_ids_errors() {
+    let platform_version = PlatformVersion::latest();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let mut buf = 2u64.encode_var_vec();
+    buf.extend_from_slice(&[0xCD; 64]);
+
+    let result = DocumentV0::from_bytes(&buf, document_type, platform_version);
+    assert!(
+        result.is_err(),
+        "v2 with truncated post-ids should fail deserialization"
+    );
+}
+
+// ================================================================
+//  serialize_specific_version: V0 contract + feature_version 0
+//  should succeed (the V0-gated NotSupported branch is NOT hit).
+// ================================================================
+
+#[test]
+fn serialize_specific_version_v0_contract_feature_version_0_succeeds() {
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(5), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    // feature_version 0 is explicitly allowed for V0 contracts.
+    let bytes = doc_v0
+        .serialize_specific_version(document_type, &contract, 0)
+        .expect("serialize_specific_version v0 should succeed on a V0 contract");
+    let (ver, _) = u64::decode_var(&bytes).expect("varint decode");
+    assert_eq!(ver, 0);
+}
+
+// ================================================================
+//  serialize_specific_version: feature_version 2 with a non-V0
+//  contract (latest platform version) should succeed.
+// ================================================================
+
+#[test]
+fn serialize_specific_version_rejects_v2_for_v0_contract() {
+    // V0 contracts always force serialize_v0, so feature_version 2 is
+    // rejected with NotSupported before reaching the version dispatch.
+    // Use `PlatformVersion::first()` so the fixture is guaranteed to load
+    // as a V0 contract — without this, the test could pass vacuously if
+    // the dashpay contract began deserializing as a non-V0 variant.
+    let platform_version = PlatformVersion::first();
+    let (contract, type_name) = dashpay_contract_and_type(platform_version);
+    let document_type = contract
+        .document_type_for_name(&type_name)
+        .expect("expected document type");
+
+    let document = document_type
+        .random_document(Some(17), platform_version)
+        .expect("expected random document");
+    let crate::document::Document::V0(doc_v0) = &document;
+
+    // Precondition: the fixture must actually be a V0 contract, otherwise
+    // the NotSupported branch we intend to exercise would never be hit.
+    assert!(
+        matches!(&contract, DataContract::V0(_)),
+        "fixture must be a V0 contract to exercise the V0-gated NotSupported branch"
+    );
+
+    let err = doc_v0
+        .serialize_specific_version(document_type, &contract, 2)
+        .expect_err("V0 contract should reject v2");
+    match err {
+        ProtocolError::NotSupported(_) => {}
+        other => panic!("expected NotSupported, got {:?}", other),
+    }
+}
+
+// ================================================================
+//  from_bytes V0-then-V1 fallback: a valid V1 buffer with a V0
+//  varint prefix should still round-trip via the fallback path.
+//  Construct bytes by serializing v1 and then overwriting the
+//  varint prefix to 0.
+// ================================================================
+
+#[test]
+fn from_bytes_v0_falls_back_to_v1_on_decoding_error() {
+    // Use a contract whose properties are all integers so v0 (I64) and v1
+    // (actual type) produce different encoded lengths / types. family's
+    // `person` has one integer field `age`, suitable for fallback testing.
+    let platform_version = PlatformVersion::latest();
+    let contract = family_contract(platform_version);
+    let document_type = contract
+        .document_type_for_name("person")
+        .expect("person document type");
+
+    // Random document serialized in v1 format (integers kept as native).
+    let document = document_type
+        .random_document(Some(55), platform_version)
+        .expect("random document");
+    let crate::document::Document::V0(doc_v0) = document;
+
+    // Serialize in v1 explicitly.
+    let mut v1_bytes = doc_v0
+        .serialize_v1(document_type)
+        .expect("serialize_v1 should succeed");
+    // Overwrite the varint-1 prefix with varint-0.
+    v1_bytes[0] = 0;
+
+    // from_bytes dispatches to v0, which fails on the mismatched layout,
+    // then retries via v1 — the fallback must recover the original document.
+    let recovered = DocumentV0::from_bytes(&v1_bytes, document_type, platform_version)
+        .expect("v0-prefixed v1 payload must fall back to v1 deserialization");
+    assert_eq!(recovered, doc_v0);
+}
+
+// ================================================================
+//  Known-bytes deserialization (golden test)
+// ================================================================
+
+#[test]
+fn deserialize_known_withdrawal_bytes() {
+    let platform_version = PlatformVersion::latest();
+    let contract = withdrawals_contract(platform_version);
+
+    let document_type = contract
+        .document_type_for_name("withdrawal")
+        .expect("expected withdrawal document type");
+
+    // This is a real serialized withdrawal document (from existing test)
+    let serialized = hex::decode(
+        "010053626cafc76f47062f936c5938190f5f30aac997b8fc22e81c1d9a7f903bd9\
+         fa8696d3f39c518784e53be79ee199e70387f9a7408254de920c1f3779de285601\
+         00030000019782b96d140000019782b96d14000000000002540be40000000001\
+         001976a9149e3292d2612122d81613fdb893dd36a04df3355588ac00",
+    )
+    .expect("expected valid hex");
+
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type, platform_version)
+        .expect("expected deserialization to succeed");
+
+    // Verify known fields
+    assert_eq!(
+        hex::encode(deserialized.id.as_slice()),
+        "0053626cafc76f47062f936c5938190f5f30aac997b8fc22e81c1d9a7f903bd9"
+    );
+    assert_eq!(
+        hex::encode(deserialized.owner_id.as_slice()),
+        "fa8696d3f39c518784e53be79ee199e70387f9a7408254de920c1f3779de2856"
+    );
+    assert_eq!(deserialized.revision, Some(1));
+    assert_eq!(deserialized.created_at, Some(1750244879636));
+    assert_eq!(deserialized.updated_at, Some(1750244879636));
+}
+
+// ================================================================
+//  Format 3: the contract-version stamp and requiredSince layouts
+// ================================================================
+
+/// A document type exercising every schema-reachable property type in
+/// both required and optional positions. Not represented because no
+/// document schema can produce them (`try_from_value_map` dispatches on
+/// `"type"` only): `Date` (no `"date"` arm; only array item types and
+/// system fields use it via `try_from_name`) and u128/i128 (integer
+/// bound inference is i64-limited).
+fn kitchen_sink_document_type() -> crate::data_contract::document_type::DocumentType {
+    use crate::data_contract::config::DataContractConfig;
+    use crate::data_contract::document_type::DocumentType;
+    use platform_value::platform_value;
+    use std::collections::BTreeMap;
+
+    let platform_version = PlatformVersion::latest();
+    let schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "u8v":  {"type": "integer", "position": 0, "minimum": 0, "maximum": 255},
+            "u16v": {"type": "integer", "position": 1, "minimum": 0, "maximum": 65535},
+            "u32v": {"type": "integer", "position": 2, "minimum": 0, "maximum": 4294967295_u64},
+            "i8v":  {"type": "integer", "position": 3, "minimum": -128, "maximum": 127},
+            "i16v": {"type": "integer", "position": 4, "minimum": -32768, "maximum": 32767},
+            "i32v": {"type": "integer", "position": 5, "minimum": -2147483648_i64, "maximum": 2147483647_i64},
+            "i64v": {"type": "integer", "position": 6},
+            "f64v": {"type": "number", "position": 7},
+            "strv": {"type": "string", "position": 8, "maxLength": 60_u32},
+            "bytv": {"type": "array", "position": 9, "byteArray": true, "minItems": 0, "maxItems": 32},
+            "idv":  {"type": "array", "position": 10, "byteArray": true, "minItems": 32, "maxItems": 32, "contentMediaType": "application/x.dash.dpp.identifier"},
+            "boolv": {"type": "boolean", "position": 11},
+            "u8o":  {"type": "integer", "position": 12, "minimum": 0, "maximum": 255},
+            "u16o": {"type": "integer", "position": 13, "minimum": 0, "maximum": 65535},
+            "u32o": {"type": "integer", "position": 14, "minimum": 0, "maximum": 4294967295_u64},
+            "i8o":  {"type": "integer", "position": 15, "minimum": -128, "maximum": 127},
+            "i16o": {"type": "integer", "position": 16, "minimum": -32768, "maximum": 32767},
+            "i32o": {"type": "integer", "position": 17, "minimum": -2147483648_i64, "maximum": 2147483647_i64},
+            "i64o": {"type": "integer", "position": 18},
+            "f64o": {"type": "number", "position": 19},
+            "stro": {"type": "string", "position": 20, "maxLength": 60_u32},
+            "byto": {"type": "array", "position": 21, "byteArray": true, "minItems": 0, "maxItems": 32},
+            "ido":  {"type": "array", "position": 22, "byteArray": true, "minItems": 32, "maxItems": 32, "contentMediaType": "application/x.dash.dpp.identifier"},
+            "boolo": {"type": "boolean", "position": 23},
+        },
+        "required": ["u8v", "u16v", "u32v", "i8v", "i16v", "i32v", "i64v", "f64v", "strv", "bytv", "idv", "boolv"],
+        "additionalProperties": false,
+    });
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("should create a default config");
+    DocumentType::try_from_schema(
+        platform_value::Identifier::new([2; 32]),
+        1,
+        config.version(),
+        "sink",
+        schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        false,
+        &mut Vec::new(),
+        platform_version,
+    )
+    .expect("failed to create kitchen-sink document type")
+}
+
+fn kitchen_sink_required_properties() -> BTreeMap<String, Value> {
+    let mut properties = BTreeMap::new();
+    properties.insert("u8v".to_string(), Value::U8(200));
+    properties.insert("u16v".to_string(), Value::U16(60000));
+    properties.insert("u32v".to_string(), Value::U32(4000000000));
+    properties.insert("i8v".to_string(), Value::I8(-100));
+    properties.insert("i16v".to_string(), Value::I16(-30000));
+    properties.insert("i32v".to_string(), Value::I32(-2000000000));
+    properties.insert("i64v".to_string(), Value::I64(-9000000000000000000));
+    properties.insert("f64v".to_string(), Value::Float(1.5));
+    properties.insert("strv".to_string(), Value::Text("hello".to_string()));
+    properties.insert("bytv".to_string(), Value::Bytes(vec![1, 2, 3]));
+    properties.insert("idv".to_string(), Value::Identifier([7; 32]));
+    properties.insert("boolv".to_string(), Value::Bool(true));
+    properties
+}
+
+#[test]
+fn serialize_v3_round_trips_every_property_type() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = kitchen_sink_document_type();
+
+    // Every optional present alongside every required
+    let mut properties = kitchen_sink_required_properties();
+    properties.insert("u8o".to_string(), Value::U8(1));
+    properties.insert("u16o".to_string(), Value::U16(2));
+    properties.insert("u32o".to_string(), Value::U32(3));
+    properties.insert("i8o".to_string(), Value::I8(-1));
+    properties.insert("i16o".to_string(), Value::I16(-2));
+    properties.insert("i32o".to_string(), Value::I32(-3));
+    properties.insert("i64o".to_string(), Value::I64(-4));
+    properties.insert("f64o".to_string(), Value::Float(-2.75));
+    properties.insert("stro".to_string(), Value::Text(String::new()));
+    properties.insert("byto".to_string(), Value::Bytes(Vec::new()));
+    properties.insert("ido".to_string(), Value::Identifier([9; 32]));
+    properties.insert("boolo".to_string(), Value::Bool(false));
+
+    let document = stamped_document(None, properties, document_type.as_ref());
+    let serialized = document
+        .serialize_v3(document_type.as_ref())
+        .expect("expected to serialize all property types");
+    let deserialized =
+        DocumentV0::from_bytes(&serialized, document_type.as_ref(), platform_version)
+            .expect("expected to deserialize all property types");
+    assert_eq!(document, deserialized);
+
+    // Determinism: same document, same bytes
+    let serialized_again = document
+        .serialize_v3(document_type.as_ref())
+        .expect("expected to serialize again");
+    assert_eq!(serialized, serialized_again);
+
+    // Every optional absent (the flag-0 arm of each type), stamped
+    let document = stamped_document(
+        Some(1),
+        kitchen_sink_required_properties(),
+        document_type.as_ref(),
+    );
+    let serialized = document
+        .serialize_v3(document_type.as_ref())
+        .expect("expected to serialize with absent optionals");
+    let deserialized =
+        DocumentV0::from_bytes(&serialized, document_type.as_ref(), platform_version)
+            .expect("expected to deserialize with absent optionals");
+    assert_eq!(document, deserialized);
+}
+
+#[test]
+fn serialize_v3_missing_plain_required_property_errors() {
+    let document_type = kitchen_sink_document_type();
+    let mut properties = kitchen_sink_required_properties();
+    properties.remove("u16v");
+
+    let document = stamped_document(None, properties, document_type.as_ref());
+    assert!(
+        document.serialize_v3(document_type.as_ref()).is_err(),
+        "serializing without a required property must error"
+    );
+}
+
+#[test]
+fn from_bytes_v3_never_panics_on_truncated_input() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = kitchen_sink_document_type();
+
+    let mut properties = kitchen_sink_required_properties();
+    properties.insert("stro".to_string(), Value::Text("tail".to_string()));
+    let document = stamped_document(Some(1), properties, document_type.as_ref());
+    let serialized = document
+        .serialize_v3(document_type.as_ref())
+        .expect("expected to serialize");
+
+    // Every strict prefix must produce a Result, never a panic. (Some
+    // prefixes legitimately succeed: format 3 tolerates EOF at property
+    // boundaries so appended properties stay readable by old data.)
+    for length in 0..serialized.len() {
+        let _ = DocumentV0::from_bytes(
+            &serialized[..length],
+            document_type.as_ref(),
+            platform_version,
+        );
+    }
+}
+
+/// A document type with:
+///   - `a`: required at every version
+///   - `b`: required since contract version 2
+///   - `c`: plain optional
+fn required_since_document_type() -> crate::data_contract::document_type::DocumentType {
+    use crate::data_contract::config::DataContractConfig;
+    use crate::data_contract::document_type::DocumentType;
+    use platform_value::platform_value;
+    use std::collections::BTreeMap;
+
+    let platform_version = PlatformVersion::latest();
+    let schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+            "b": {"type": "string", "position": 1, "maxLength": 60_u32, "requiredSince": 2},
+            "c": {"type": "string", "position": 2, "maxLength": 60_u32},
+        },
+        "required": ["a", "b"],
+        "additionalProperties": false,
+    });
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("should create a default config");
+    DocumentType::try_from_schema(
+        platform_value::Identifier::new([1; 32]),
+        1,
+        config.version(),
+        "test",
+        schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        false,
+        &mut Vec::new(),
+        platform_version,
+    )
+    .expect("failed to create document type")
+}
+
+fn stamped_document(
+    contract_version: Option<u32>,
+    properties: BTreeMap<String, Value>,
+    document_type: DocumentTypeRef,
+) -> DocumentV0 {
+    DocumentV0 {
+        contract_version,
+        id: Identifier::new([3; 32]),
+        owner_id: Identifier::new([4; 32]),
+        properties,
+        revision: document_type.initial_revision(),
+        ..Default::default()
+    }
+}
+
+#[test]
+fn serialize_v3_round_trips_document_stamped_at_required_since() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+    properties.insert("b".to_string(), Value::Text("beta".to_string()));
+
+    let document = stamped_document(Some(2), properties, document_type_ref);
+
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("stamped document with the required-since field should serialize");
+
+    let (version, _) = u64::decode_var(&serialized).expect("expected varint");
+    assert_eq!(version, 3, "serialization version prefix should be 3");
+
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+
+    assert_eq!(deserialized.contract_version, Some(2));
+    assert_eq!(deserialized, document);
+}
+
+#[test]
+fn serialize_v3_grandfathered_document_may_omit_required_since_field() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+
+    // Stamped at version 1, before `b` became required at version 2
+    let document = stamped_document(Some(1), properties, document_type_ref);
+
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("grandfathered document without the required-since field should serialize");
+
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+
+    assert_eq!(deserialized.contract_version, Some(1));
+    assert!(!deserialized.properties.contains_key("b"));
+    assert_eq!(deserialized, document);
+}
+
+#[test]
+fn serialize_v3_unstamped_document_treats_required_since_fields_as_optional() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+
+    // No stamp: a pre-format-3 document being re-serialized (e.g. on
+    // transfer). Every requiredSince annotation postdates its bytes.
+    let document = stamped_document(None, properties, document_type_ref);
+
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("unstamped document without the required-since field should serialize");
+
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+
+    assert_eq!(deserialized.contract_version, None);
+    assert_eq!(deserialized, document);
+}
+
+#[test]
+fn serialize_v3_stamped_at_required_since_missing_field_errors() {
+    let document_type = required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+
+    // Stamped at version 2, where `b` is required — but `b` is absent
+    let document = stamped_document(Some(2), properties, document_type_ref);
+
+    let result = document.serialize_v3(document_type_ref);
+    assert!(
+        matches!(
+            result,
+            Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(_)
+            ))
+        ),
+        "a document stamped at requiredSince must contain the field, got {result:?}"
+    );
+}
+
+#[test]
+fn format_2_bytes_stay_readable_under_a_required_since_schema() {
+    use crate::data_contract::config::DataContractConfig;
+    use crate::data_contract::document_type::DocumentType;
+    use platform_value::platform_value;
+
+    let platform_version = PlatformVersion::latest();
+
+    // The schema as it was at contract version 1, before `b` (required
+    // since version 2) and `c` (optional) were appended
+    let old_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+        },
+        "required": ["a"],
+        "additionalProperties": false,
+    });
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("should create a default config");
+    let old_document_type = DocumentType::try_from_schema(
+        Identifier::new([1; 32]),
+        1,
+        config.version(),
+        "test",
+        old_schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        false,
+        &mut Vec::new(),
+        platform_version,
+    )
+    .expect("failed to create old document type");
+
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+
+    // A pre-stamp document serialized in format 2 under the old schema
+    // (as every document written before protocol v14 was, at the
+    // latest): its buffer ends before `b` and `c`, which must read back
+    // as absent under the updated schema, not as errors
+    let document = stamped_document(None, properties, old_document_type.as_ref());
+
+    let serialized = document
+        .serialize_v2(old_document_type.as_ref())
+        .expect("format 2 serialization should succeed");
+
+    let (version, _) = u64::decode_var(&serialized).expect("expected varint");
+    assert_eq!(version, 2);
+
+    let new_document_type = required_since_document_type();
+    let deserialized =
+        DocumentV0::from_bytes(&serialized, new_document_type.as_ref(), platform_version)
+            .expect("format 2 bytes must stay readable under a requiredSince schema");
+
+    assert_eq!(deserialized.contract_version, None);
+    assert!(!deserialized.properties.contains_key("b"));
+    assert!(!deserialized.properties.contains_key("c"));
+    assert_eq!(deserialized, document);
+}
+
+#[test]
+fn stale_document_type_rejects_document_stamped_under_newer_contract() {
+    use crate::data_contract::config::DataContractConfig;
+    use crate::data_contract::document_type::DocumentType;
+    use platform_value::platform_value;
+
+    let platform_version = PlatformVersion::latest();
+
+    // The reader's stale view: the schema as of contract version 1,
+    // before `b` and `c` were appended
+    let stale_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "a": {"type": "string", "position": 0, "maxLength": 60_u32},
+        },
+        "required": ["a"],
+        "additionalProperties": false,
+    });
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("should create a default config");
+    let stale_document_type = DocumentType::try_from_schema(
+        Identifier::new([1; 32]),
+        1,
+        config.version(),
+        "test",
+        stale_schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        false,
+        &mut Vec::new(),
+        platform_version,
+    )
+    .expect("failed to create stale document type");
+
+    // A document written under contract version 2, where `b` exists and
+    // is required
+    let current_document_type = required_since_document_type();
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+    properties.insert("b".to_string(), Value::Text("beta".to_string()));
+    let document = stamped_document(Some(2), properties, current_document_type.as_ref());
+
+    let serialized = document
+        .serialize_v3(current_document_type.as_ref())
+        .expect("expected serialization");
+
+    // A stale reader must hard-error on the trailing bytes instead of
+    // silently dropping the field it does not know about
+    let result =
+        DocumentV0::from_bytes(&serialized, stale_document_type.as_ref(), platform_version);
+    assert!(
+        matches!(
+            &result,
+            Err(ProtocolError::DataContractError(
+                DataContractError::CorruptedSerialization(message)
+            )) if message.contains("trailing bytes")
+        ),
+        "a stale document type must reject a newer-stamped document, got {result:?}"
+    );
+}
+
+/// A document type whose `requiredSince` annotations sit on properties of
+/// every distinct byte layout — variable and fixed byte arrays, an
+/// identifier, integers, a float, a bool, and a nested object — at two
+/// different annotation versions, so a stamp can fall before, between,
+/// and after them:
+///   - `a`: string, required at every version
+///   - `bytv2`, `fixv2`, `objv2`: required since contract version 2
+///   - `idv3`, `intv3`, `fltv3`, `boolv3`: required since contract version 3
+fn multi_type_required_since_document_type() -> crate::data_contract::document_type::DocumentType {
+    use crate::data_contract::config::DataContractConfig;
+    use crate::data_contract::document_type::DocumentType;
+    use platform_value::platform_value;
+    use std::collections::BTreeMap;
+
+    let platform_version = PlatformVersion::latest();
+    let schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "a":      {"type": "string", "position": 0, "maxLength": 60_u32},
+            "bytv2":  {"type": "array", "position": 1, "byteArray": true, "minItems": 0, "maxItems": 32, "requiredSince": 2},
+            "fixv2":  {"type": "array", "position": 2, "byteArray": true, "minItems": 8, "maxItems": 8, "requiredSince": 2},
+            "objv2":  {
+                "type": "object",
+                "position": 3,
+                "properties": {
+                    "inner": {"type": "string", "position": 0, "maxLength": 10_u32},
+                },
+                "required": ["inner"],
+                "additionalProperties": false,
+                "requiredSince": 2,
+            },
+            "idv3":   {"type": "array", "position": 4, "byteArray": true, "minItems": 32, "maxItems": 32, "contentMediaType": "application/x.dash.dpp.identifier", "requiredSince": 3},
+            "intv3":  {"type": "integer", "position": 5, "requiredSince": 3},
+            "fltv3":  {"type": "number", "position": 6, "requiredSince": 3},
+            "boolv3": {"type": "boolean", "position": 7, "requiredSince": 3},
+        },
+        "required": ["a", "bytv2", "fixv2", "objv2", "idv3", "intv3", "fltv3", "boolv3"],
+        "additionalProperties": false,
+    });
+    let config = DataContractConfig::default_for_version(platform_version)
+        .expect("should create a default config");
+    DocumentType::try_from_schema(
+        platform_value::Identifier::new([5; 32]),
+        3,
+        config.version(),
+        "multi",
+        schema,
+        None,
+        &BTreeMap::new(),
+        &config,
+        false,
+        &mut Vec::new(),
+        platform_version,
+    )
+    .expect("failed to create multi-type document type")
+}
+
+fn multi_type_properties_since_v2() -> BTreeMap<String, Value> {
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+    properties.insert("bytv2".to_string(), Value::Bytes(vec![1, 2, 3]));
+    properties.insert("fixv2".to_string(), Value::Bytes(vec![9; 8]));
+    properties.insert(
+        "objv2".to_string(),
+        Value::Map(vec![(
+            Value::Text("inner".to_string()),
+            Value::Text("in".to_string()),
+        )]),
+    );
+    properties
+}
+
+fn multi_type_properties_since_v3() -> BTreeMap<String, Value> {
+    let mut properties = multi_type_properties_since_v2();
+    properties.insert("idv3".to_string(), Value::Identifier([7; 32]));
+    properties.insert("intv3".to_string(), Value::I64(-42));
+    properties.insert("fltv3".to_string(), Value::Float(1.5));
+    properties.insert("boolv3".to_string(), Value::Bool(true));
+    properties
+}
+
+#[test]
+fn serialize_v3_round_trips_annotated_non_string_types_at_every_stamp() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = multi_type_required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    let mut base = BTreeMap::new();
+    base.insert("a".to_string(), Value::Text("alpha".to_string()));
+
+    // Unstamped and stamped-at-1: every annotation postdates the bytes,
+    // so all annotated properties may be absent
+    for stamp in [None, Some(1)] {
+        let document = stamped_document(stamp, base.clone(), document_type_ref);
+        let serialized = document
+            .serialize_v3(document_type_ref)
+            .expect("document predating every annotation should serialize");
+        let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+            .expect("expected deserialization to succeed");
+        assert_eq!(deserialized, document, "stamp {stamp:?}");
+    }
+
+    // Stamped between the two annotation versions: the version-2 group is
+    // required (raw layout), the version-3 group still optional and absent
+    let document = stamped_document(Some(2), multi_type_properties_since_v2(), document_type_ref);
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("document stamped between annotations should serialize");
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+    assert_eq!(deserialized, document);
+
+    // Same stamp with the version-3 group present: still optional, so it
+    // rides the presence-flagged layout and must round-trip
+    let document = stamped_document(Some(2), multi_type_properties_since_v3(), document_type_ref);
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("optional-but-present annotated fields should serialize");
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+    assert_eq!(deserialized, document);
+
+    // Stamped at the newest annotation: everything required, raw layouts
+    let document = stamped_document(Some(3), multi_type_properties_since_v3(), document_type_ref);
+    let serialized = document
+        .serialize_v3(document_type_ref)
+        .expect("document stamped at the newest annotation should serialize");
+    let deserialized = DocumentV0::from_bytes(&serialized, document_type_ref, platform_version)
+        .expect("expected deserialization to succeed");
+    assert_eq!(deserialized, document);
+
+    // A stamp at the newest annotation with one of its fields missing
+    // errors for non-string types just like for strings
+    let mut missing = multi_type_properties_since_v3();
+    missing.remove("idv3");
+    let document = stamped_document(Some(3), missing, document_type_ref);
+    assert!(
+        matches!(
+            document.serialize_v3(document_type_ref),
+            Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(_)
+            ))
+        ),
+        "a stamped-at-annotation document missing an annotated identifier must error"
+    );
+}
+
+#[test]
+fn serialize_v3_layouts_diverge_between_stamps_across_property_types() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = multi_type_required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    // Identical content, different stamps: at stamp 2 the version-3 group
+    // is presence-flagged, at stamp 3 it serializes raw — the bytes must
+    // differ beyond the stamp varint itself, and each layout must decode
+    // only under its own stamp
+    let at_2 = stamped_document(Some(2), multi_type_properties_since_v3(), document_type_ref)
+        .serialize_v3(document_type_ref)
+        .expect("stamp-2 document should serialize");
+    let at_3 = stamped_document(Some(3), multi_type_properties_since_v3(), document_type_ref)
+        .serialize_v3(document_type_ref)
+        .expect("stamp-3 document should serialize");
+
+    // Four version-3 properties drop one presence byte each when the
+    // stamp makes them required; the stamp varint is one byte in both
+    assert_eq!(
+        at_2.len(),
+        at_3.len() + 4,
+        "the presence-flagged layout must carry one extra byte per annotated property"
+    );
+
+    let from_2 = DocumentV0::from_bytes(&at_2, document_type_ref, platform_version)
+        .expect("stamp-2 bytes should decode");
+    let from_3 = DocumentV0::from_bytes(&at_3, document_type_ref, platform_version)
+        .expect("stamp-3 bytes should decode");
+    assert_eq!(from_2.properties, from_3.properties);
+    assert_eq!(from_2.contract_version, Some(2));
+    assert_eq!(from_3.contract_version, Some(3));
+}
+
+#[test]
+fn stamp_survives_the_wire_for_documents_stamped_past_required_since() {
+    let platform_version = PlatformVersion::latest();
+    let document_type = required_since_document_type();
+    let document_type_ref = document_type.as_ref();
+
+    // The same content stamped before and at the requiredSince boundary
+    // must produce different byte layouts (flagged vs raw), and each must
+    // round-trip through the layout its own stamp selects
+    let mut properties = BTreeMap::new();
+    properties.insert("a".to_string(), Value::Text("alpha".to_string()));
+    properties.insert("b".to_string(), Value::Text("beta".to_string()));
+
+    let stamped_before = stamped_document(Some(1), properties.clone(), document_type_ref);
+    let stamped_at = stamped_document(Some(2), properties, document_type_ref);
+
+    let serialized_before = stamped_before
+        .serialize_v3(document_type_ref)
+        .expect("expected serialization");
+    let serialized_at = stamped_at
+        .serialize_v3(document_type_ref)
+        .expect("expected serialization");
+
+    // The flagged layout carries one extra presence byte for `b`, and the
+    // two stamps differ in the prefix varint
+    assert_ne!(serialized_before, serialized_at);
+
+    let before_back =
+        DocumentV0::from_bytes(&serialized_before, document_type_ref, platform_version)
+            .expect("expected deserialization");
+    let at_back = DocumentV0::from_bytes(&serialized_at, document_type_ref, platform_version)
+        .expect("expected deserialization");
+
+    assert_eq!(before_back, stamped_before);
+    assert_eq!(at_back, stamped_at);
+}
diff --git a/packages/rs-dpp/src/document/v0/serialize/v0.rs b/packages/rs-dpp/src/document/v0/serialize/v0.rs
new file mode 100644
index 00000000000..a4bdf552ea9
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/v0.rs
@@ -0,0 +1,490 @@
+//! Document serialization format 0: the original wire format, the default
+//! from protocol version 1 through 8. Every integer is encoded as an i64
+//! (8 bytes big-endian) regardless of its schema type — the schema's integer
+//! bounds were not yet reflected in the encoding. Reads have a fallback:
+//! bytes prefixed 0 that fail to decode as all-i64 are retried as format 1,
+//! because protocol versions 1–8 wrote the 0 prefix for either layout.
+//! Shipped consensus code: this file must never change.
+
+use crate::data_contract::document_type::{DocumentPropertyType, DocumentTypeRef};
+use crate::data_contract::errors::DataContractError;
+
+use crate::document::property_names::{
+    CREATED_AT, CREATED_AT_BLOCK_HEIGHT, CREATED_AT_CORE_BLOCK_HEIGHT, PRICE, TRANSFERRED_AT,
+    TRANSFERRED_AT_BLOCK_HEIGHT, TRANSFERRED_AT_CORE_BLOCK_HEIGHT, UPDATED_AT,
+    UPDATED_AT_BLOCK_HEIGHT, UPDATED_AT_CORE_BLOCK_HEIGHT,
+};
+
+use crate::prelude::Revision;
+
+use crate::ProtocolError;
+
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
+use crate::document::v0::DocumentV0;
+use crate::version::PlatformVersion;
+use byteorder::{BigEndian, ReadBytesExt};
+use integer_encoding::{VarInt, VarIntReader};
+
+use platform_value::{Identifier, Value};
+
+use std::collections::BTreeMap;
+
+use crate::consensus::basic::decode::DecodingError;
+use std::io::{BufReader, Read};
+
+impl DocumentV0 {
+    /// Serializes the document.
+    ///
+    /// The serialization of a document follows the pattern:
+    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
+    /// In serialize v0 all integers are always encoded as i64s
+    pub(super) fn serialize_v0(
+        &self,
+        document_type: DocumentTypeRef,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        let mut buffer: Vec<u8> = 0u64.encode_var_vec(); //version 0
+
+        // $id
+        buffer.extend(self.id.as_slice());
+
+        // $ownerId
+        buffer.extend(self.owner_id.as_slice());
+
+        // $revision
+        if let Some(revision) = self.revision {
+            buffer.extend(revision.encode_var_vec())
+        } else if document_type.requires_revision() {
+            buffer.extend((1 as Revision).encode_var_vec())
+        }
+
+        let mut bitwise_exists_flag: u16 = 0;
+
+        let mut time_fields_data_buffer = vec![];
+
+        // $createdAt
+        if let Some(created_at) = &self.created_at {
+            bitwise_exists_flag |= 1;
+            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
+            time_fields_data_buffer.extend(created_at.to_be_bytes());
+        } else if document_type.required_fields().contains(CREATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAt
+        if let Some(updated_at) = &self.updated_at {
+            bitwise_exists_flag |= 2;
+            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
+            time_fields_data_buffer.extend(updated_at.to_be_bytes());
+        } else if document_type.required_fields().contains(UPDATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAt
+        if let Some(transferred_at) = &self.transferred_at {
+            bitwise_exists_flag |= 4;
+            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
+            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
+        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtBlockHeight
+        if let Some(created_at_block_height) = &self.created_at_block_height {
+            bitwise_exists_flag |= 8;
+            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtBlockHeight
+        if let Some(updated_at_block_height) = &self.updated_at_block_height {
+            bitwise_exists_flag |= 16;
+            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtBlockHeight
+        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
+            bitwise_exists_flag |= 32;
+            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtCoreBlockHeight
+        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
+            bitwise_exists_flag |= 64;
+            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtCoreBlockHeight
+        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
+            bitwise_exists_flag |= 128;
+            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtCoreBlockHeight
+        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
+            bitwise_exists_flag |= 256;
+            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
+        buffer.append(&mut time_fields_data_buffer);
+
+        // Now we serialize the price which might not be necessary unless called for by the document type
+
+        if document_type.trade_mode().seller_sets_price() {
+            if let Some(price) = self.properties.get(PRICE) {
+                buffer.push(1);
+                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
+                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // User defined properties
+        document_type
+            .properties()
+            .iter()
+            .try_for_each(|(field_name, property)| {
+                if let Some(value) = self.properties.get(field_name) {
+                    if value.is_null() {
+                        if property.always_required() && !property.transient {
+                            Err(ProtocolError::DataContractError(
+                                DataContractError::MissingRequiredKey(
+                                    "a required field is not present".to_string(),
+                                ),
+                            ))
+                        } else {
+                            // dbg!("we pushed {} with 0", field_name);
+                            // We don't have something that wasn't required
+                            buffer.push(0);
+                            Ok(())
+                        }
+                    } else {
+                        if !property.always_required() || property.transient {
+                            // dbg!("we added 1", field_name);
+                            buffer.push(1);
+                        }
+                        let value = if property.property_type.is_integer() {
+                            DocumentPropertyType::I64
+                                .encode_value_ref_with_size(value, property.always_required())
+                        } else {
+                            property
+                                .property_type
+                                .encode_value_ref_with_size(value, property.always_required())
+                        }?;
+
+                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
+                        buffer.extend(value.as_slice());
+                        Ok(())
+                    }
+                } else if property.always_required() && !property.transient {
+                    Err(ProtocolError::DataContractError(
+                        DataContractError::MissingRequiredKey(format!(
+                            "a required field {field_name} is not present"
+                        )),
+                    ))
+                } else {
+                    // dbg!("we pushed {} with 0", field_name);
+                    // We don't have something that wasn't required
+                    buffer.push(0);
+                    Ok(())
+                }
+            })?;
+
+        Ok(buffer)
+    }
+
+    /// Reads a serialized document and creates a Document from it.
+    pub(super) fn from_bytes_v0(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        _platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        let mut buf = BufReader::new(serialized_document);
+        if serialized_document.len() < 64 {
+            return Err(DataContractError::DecodingDocumentError(
+                DecodingError::new(
+                    "serialized document is too small, must have id and owner id".to_string(),
+                ),
+            ));
+        }
+
+        // $id
+        let mut id = [0; 32];
+        buf.read_exact(&mut id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for id".to_string(),
+            ))
+        })?;
+
+        // $ownerId
+        let mut owner_id = [0; 32];
+        buf.read_exact(&mut owner_id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for owner id".to_string(),
+            ))
+        })?;
+
+        // $revision
+        // if the document type is mutable then we should deserialize the revision
+        let revision: Option<Revision> = if document_type.requires_revision() {
+            let revision = buf.read_varint().map_err(|_| {
+                DataContractError::DecodingDocumentError(DecodingError::new(
+                    "error reading revision from serialized document for revision".to_string(),
+                ))
+            })?;
+            Some(revision)
+        } else {
+            None
+        };
+
+        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
+            DataContractError::CorruptedSerialization(
+                "error reading timestamp flags from serialized document".to_string(),
+            )
+        })?;
+
+        let created_at = if timestamp_flags & 1 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at = if timestamp_flags & 2 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at = if timestamp_flags & 4 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_block_height = if timestamp_flags & 8 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_block_height = if timestamp_flags & 16 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        // Now we deserialize the price which might not be necessary unless called for by the document type
+
+        let price = if document_type.trade_mode().seller_sets_price() {
+            let has_price = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has price bool from serialized document".to_string(),
+                )
+            })?;
+            if has_price > 0 {
+                let price = buf.read_u64::<BigEndian>().map_err(|_| {
+                    DataContractError::CorruptedSerialization(
+                        "error reading price u64 from serialized document".to_string(),
+                    )
+                })?;
+                Some(price)
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        let mut finished_buffer = false;
+
+        let mut properties = document_type
+            .properties()
+            .iter()
+            .filter_map(|(key, property)| {
+                if finished_buffer {
+                    return if property.always_required() && !property.transient {
+                        Some(Err(DataContractError::CorruptedSerialization(
+                            "required field after finished buffer".to_string(),
+                        )))
+                    } else {
+                        None
+                    };
+                }
+
+                // In version 0 all integers are encoded as I64 (in theory)
+                let read_value = if property.property_type.is_integer() {
+                    DocumentPropertyType::I64.read_optionally_from(
+                        &mut buf,
+                        property.always_required() & !property.transient,
+                    )
+                } else {
+                    property.property_type.read_optionally_from(
+                        &mut buf,
+                        property.always_required() & !property.transient,
+                    )
+                };
+
+                match read_value {
+                    Ok(read_value) => {
+                        finished_buffer |= read_value.1;
+                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
+                    }
+                    Err(e) => Some(Err(e)),
+                }
+            })
+            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
+
+        if let Some(price) = price {
+            properties.insert(PRICE.to_string(), price.into());
+        }
+
+        Ok(DocumentV0 {
+            contract_version: None,
+            id: Identifier::new(id),
+            properties,
+            owner_id: Identifier::new(owner_id),
+            revision,
+            created_at,
+            updated_at,
+            transferred_at,
+            created_at_block_height,
+            updated_at_block_height,
+            transferred_at_block_height,
+            created_at_core_block_height,
+            updated_at_core_block_height,
+            transferred_at_core_block_height,
+            creator_id: None,
+        })
+    }
+}
diff --git a/packages/rs-dpp/src/document/v0/serialize/v1.rs b/packages/rs-dpp/src/document/v0/serialize/v1.rs
new file mode 100644
index 00000000000..3e1fd5bb672
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/v1.rs
@@ -0,0 +1,475 @@
+//! Document serialization format 1: the default at protocol version 9,
+//! which introduced tokens and new document types — and, most importantly
+//! for the wire format, schema-typed integers. Integers are encoded at
+//! their native size (u8 = 1 byte, u16 = 2 bytes, …) instead of format 0's
+//! uniform i64. Otherwise identical to format 0. Shipped consensus code:
+//! this file must never change.
+
+use crate::data_contract::document_type::DocumentTypeRef;
+use crate::data_contract::errors::DataContractError;
+
+use crate::document::property_names::{
+    CREATED_AT, CREATED_AT_BLOCK_HEIGHT, CREATED_AT_CORE_BLOCK_HEIGHT, PRICE, TRANSFERRED_AT,
+    TRANSFERRED_AT_BLOCK_HEIGHT, TRANSFERRED_AT_CORE_BLOCK_HEIGHT, UPDATED_AT,
+    UPDATED_AT_BLOCK_HEIGHT, UPDATED_AT_CORE_BLOCK_HEIGHT,
+};
+
+use crate::prelude::Revision;
+
+use crate::ProtocolError;
+
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
+use crate::document::v0::DocumentV0;
+use crate::version::PlatformVersion;
+use byteorder::{BigEndian, ReadBytesExt};
+use integer_encoding::{VarInt, VarIntReader};
+
+use platform_value::{Identifier, Value};
+
+use std::collections::BTreeMap;
+
+use crate::consensus::basic::decode::DecodingError;
+use std::io::{BufReader, Read};
+
+impl DocumentV0 {
+    /// Serializes the document.
+    ///
+    /// The serialization of a document follows the pattern:
+    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
+    /// Serialize v1 will encode integers normally with their known size.
+    /// Otherwise it is almost identical to V0. V1 represents the original code.
+    pub(super) fn serialize_v1(
+        &self,
+        document_type: DocumentTypeRef,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        let mut buffer: Vec<u8> = 1u64.encode_var_vec(); //version 1
+
+        // $id
+        buffer.extend(self.id.as_slice());
+
+        // $ownerId
+        buffer.extend(self.owner_id.as_slice());
+
+        // $revision
+        if let Some(revision) = self.revision {
+            buffer.extend(revision.encode_var_vec())
+        } else if document_type.requires_revision() {
+            buffer.extend((1 as Revision).encode_var_vec())
+        }
+
+        let mut bitwise_exists_flag: u16 = 0;
+
+        let mut time_fields_data_buffer = vec![];
+
+        // $createdAt
+        if let Some(created_at) = &self.created_at {
+            bitwise_exists_flag |= 1;
+            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
+            time_fields_data_buffer.extend(created_at.to_be_bytes());
+        } else if document_type.required_fields().contains(CREATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAt
+        if let Some(updated_at) = &self.updated_at {
+            bitwise_exists_flag |= 2;
+            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
+            time_fields_data_buffer.extend(updated_at.to_be_bytes());
+        } else if document_type.required_fields().contains(UPDATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAt
+        if let Some(transferred_at) = &self.transferred_at {
+            bitwise_exists_flag |= 4;
+            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
+            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
+        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtBlockHeight
+        if let Some(created_at_block_height) = &self.created_at_block_height {
+            bitwise_exists_flag |= 8;
+            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtBlockHeight
+        if let Some(updated_at_block_height) = &self.updated_at_block_height {
+            bitwise_exists_flag |= 16;
+            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtBlockHeight
+        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
+            bitwise_exists_flag |= 32;
+            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtCoreBlockHeight
+        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
+            bitwise_exists_flag |= 64;
+            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtCoreBlockHeight
+        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
+            bitwise_exists_flag |= 128;
+            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtCoreBlockHeight
+        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
+            bitwise_exists_flag |= 256;
+            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
+        buffer.append(&mut time_fields_data_buffer);
+
+        // Now we serialize the price which might not be necessary unless called for by the document type
+
+        if document_type.trade_mode().seller_sets_price() {
+            if let Some(price) = self.properties.get(PRICE) {
+                buffer.push(1);
+                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
+                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // User defined properties
+        document_type
+            .properties()
+            .iter()
+            .try_for_each(|(field_name, property)| {
+                if let Some(value) = self.properties.get(field_name) {
+                    if value.is_null() {
+                        if property.always_required() && !property.transient {
+                            Err(ProtocolError::DataContractError(
+                                DataContractError::MissingRequiredKey(
+                                    "a required field is not present".to_string(),
+                                ),
+                            ))
+                        } else {
+                            // dbg!("we pushed {} with 0", field_name);
+                            // We don't have something that wasn't required
+                            buffer.push(0);
+                            Ok(())
+                        }
+                    } else {
+                        if !property.always_required() || property.transient {
+                            // dbg!("we added 1", field_name);
+                            buffer.push(1);
+                        }
+                        let value = property
+                            .property_type
+                            .encode_value_ref_with_size(value, property.always_required())?;
+                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
+                        buffer.extend(value.as_slice());
+                        Ok(())
+                    }
+                } else if property.always_required() && !property.transient {
+                    Err(ProtocolError::DataContractError(
+                        DataContractError::MissingRequiredKey(format!(
+                            "a required field {field_name} is not present"
+                        )),
+                    ))
+                } else {
+                    // dbg!("we pushed {} with 0", field_name);
+                    // We don't have something that wasn't required
+                    buffer.push(0);
+                    Ok(())
+                }
+            })?;
+
+        Ok(buffer)
+    }
+
+    /// Reads a serialized document and creates a Document from it.
+    pub(super) fn from_bytes_v1(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        _platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        let mut buf = BufReader::new(serialized_document);
+        if serialized_document.len() < 64 {
+            return Err(DataContractError::DecodingDocumentError(
+                DecodingError::new(
+                    "serialized document is too small, must have id and owner id".to_string(),
+                ),
+            ));
+        }
+
+        // $id
+        let mut id = [0; 32];
+        buf.read_exact(&mut id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for id".to_string(),
+            ))
+        })?;
+
+        // $ownerId
+        let mut owner_id = [0; 32];
+        buf.read_exact(&mut owner_id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for owner id".to_string(),
+            ))
+        })?;
+
+        // $revision
+        // if the document type is mutable then we should deserialize the revision
+        let revision: Option<Revision> = if document_type.requires_revision() {
+            let revision = buf.read_varint().map_err(|_| {
+                DataContractError::DecodingDocumentError(DecodingError::new(
+                    "error reading revision from serialized document for revision".to_string(),
+                ))
+            })?;
+            Some(revision)
+        } else {
+            None
+        };
+
+        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
+            DataContractError::CorruptedSerialization(
+                "error reading timestamp flags from serialized document".to_string(),
+            )
+        })?;
+
+        let created_at = if timestamp_flags & 1 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at = if timestamp_flags & 2 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at = if timestamp_flags & 4 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_block_height = if timestamp_flags & 8 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_block_height = if timestamp_flags & 16 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        // Now we deserialize the price which might not be necessary unless called for by the document type
+
+        let price = if document_type.trade_mode().seller_sets_price() {
+            let has_price = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has price bool from serialized document".to_string(),
+                )
+            })?;
+            if has_price > 0 {
+                let price = buf.read_u64::<BigEndian>().map_err(|_| {
+                    DataContractError::CorruptedSerialization(
+                        "error reading price u64 from serialized document".to_string(),
+                    )
+                })?;
+                Some(price)
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        let mut finished_buffer = false;
+
+        let mut properties = document_type
+            .properties()
+            .iter()
+            .filter_map(|(key, property)| {
+                if finished_buffer {
+                    return if property.always_required() && !property.transient {
+                        Some(Err(DataContractError::CorruptedSerialization(
+                            "required field after finished buffer".to_string(),
+                        )))
+                    } else {
+                        None
+                    };
+                }
+                let read_value = property.property_type.read_optionally_from(
+                    &mut buf,
+                    property.always_required() & !property.transient,
+                );
+
+                match read_value {
+                    Ok(read_value) => {
+                        finished_buffer |= read_value.1;
+                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
+                    }
+                    Err(e) => Some(Err(e)),
+                }
+            })
+            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
+
+        if let Some(price) = price {
+            properties.insert(PRICE.to_string(), price.into());
+        }
+
+        Ok(DocumentV0 {
+            contract_version: None,
+            id: Identifier::new(id),
+            properties,
+            owner_id: Identifier::new(owner_id),
+            revision,
+            created_at,
+            updated_at,
+            transferred_at,
+            created_at_block_height,
+            updated_at_block_height,
+            transferred_at_block_height,
+            created_at_core_block_height,
+            updated_at_core_block_height,
+            transferred_at_core_block_height,
+            creator_id: None,
+        })
+    }
+}
diff --git a/packages/rs-dpp/src/document/v0/serialize/v2.rs b/packages/rs-dpp/src/document/v0/serialize/v2.rs
new file mode 100644
index 00000000000..38ac36e9d58
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/v2.rs
@@ -0,0 +1,510 @@
+//! Document serialization format 2: the default from protocol version 10.
+//! Format 1 plus the `$creatorId` field (presence flag + 32 bytes) after
+//! `$ownerId`, written only for document types that support transfers or
+//! trading — introduced so the original creator survives ownership changes.
+//! Shipped consensus code: this file must never change.
+
+use crate::data_contract::document_type::DocumentTypeRef;
+use crate::data_contract::errors::DataContractError;
+
+use crate::document::property_names::{
+    CREATED_AT, CREATED_AT_BLOCK_HEIGHT, CREATED_AT_CORE_BLOCK_HEIGHT, PRICE, TRANSFERRED_AT,
+    TRANSFERRED_AT_BLOCK_HEIGHT, TRANSFERRED_AT_CORE_BLOCK_HEIGHT, UPDATED_AT,
+    UPDATED_AT_BLOCK_HEIGHT, UPDATED_AT_CORE_BLOCK_HEIGHT,
+};
+
+use crate::prelude::Revision;
+
+use crate::ProtocolError;
+
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
+use crate::document::v0::DocumentV0;
+use crate::version::PlatformVersion;
+use byteorder::{BigEndian, ReadBytesExt};
+use integer_encoding::{VarInt, VarIntReader};
+
+use platform_value::{Identifier, Value};
+
+use std::collections::BTreeMap;
+
+use crate::consensus::basic::decode::DecodingError;
+use crate::nft::TradeMode;
+use std::io::{BufReader, Read};
+
+impl DocumentV0 {
+    /// Serializes the document.
+    ///
+    /// The serialization of a document follows the pattern:
+    /// id 32 bytes + owner_id 32 bytes + encoded values byte arrays
+    /// Serialize v2 will encode the creator id as well.
+    pub(super) fn serialize_v2(
+        &self,
+        document_type: DocumentTypeRef,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        let mut buffer: Vec<u8> = 2u64.encode_var_vec(); //version 2
+
+        // $id
+        buffer.extend(self.id.as_slice());
+
+        // $ownerId
+        buffer.extend(self.owner_id.as_slice());
+
+        if document_type.trade_mode() != TradeMode::None
+            || document_type.documents_transferable().is_transferable()
+        {
+            if let Some(creator_id) = self.creator_id {
+                buffer.push(1);
+                buffer.extend(creator_id.as_slice());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // $revision
+        if let Some(revision) = self.revision {
+            buffer.extend(revision.encode_var_vec())
+        } else if document_type.requires_revision() {
+            buffer.extend((1 as Revision).encode_var_vec())
+        }
+
+        let mut bitwise_exists_flag: u16 = 0;
+
+        let mut time_fields_data_buffer = vec![];
+
+        // $createdAt
+        if let Some(created_at) = &self.created_at {
+            bitwise_exists_flag |= 1;
+            // dbg!("we pushed created at {}", hex::encode(created_at.to_be_bytes()));
+            time_fields_data_buffer.extend(created_at.to_be_bytes());
+        } else if document_type.required_fields().contains(CREATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAt
+        if let Some(updated_at) = &self.updated_at {
+            bitwise_exists_flag |= 2;
+            // dbg!("we pushed updated at {}", hex::encode(updated_at.to_be_bytes()));
+            time_fields_data_buffer.extend(updated_at.to_be_bytes());
+        } else if document_type.required_fields().contains(UPDATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAt
+        if let Some(transferred_at) = &self.transferred_at {
+            bitwise_exists_flag |= 4;
+            // dbg!("we pushed transferred at {}", hex::encode(transferred_at.to_be_bytes()));
+            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
+        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtBlockHeight
+        if let Some(created_at_block_height) = &self.created_at_block_height {
+            bitwise_exists_flag |= 8;
+            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtBlockHeight
+        if let Some(updated_at_block_height) = &self.updated_at_block_height {
+            bitwise_exists_flag |= 16;
+            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtBlockHeight
+        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
+            bitwise_exists_flag |= 32;
+            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtCoreBlockHeight
+        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
+            bitwise_exists_flag |= 64;
+            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtCoreBlockHeight
+        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
+            bitwise_exists_flag |= 128;
+            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtCoreBlockHeight
+        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
+            bitwise_exists_flag |= 256;
+            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
+        buffer.append(&mut time_fields_data_buffer);
+
+        // Now we serialize the price which might not be necessary unless called for by the document type
+
+        if document_type.trade_mode().seller_sets_price() {
+            if let Some(price) = self.properties.get(PRICE) {
+                buffer.push(1);
+                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
+                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // User defined properties
+        document_type
+            .properties()
+            .iter()
+            .try_for_each(|(field_name, property)| {
+                if let Some(value) = self.properties.get(field_name) {
+                    if value.is_null() {
+                        if property.always_required() && !property.transient {
+                            Err(ProtocolError::DataContractError(
+                                DataContractError::MissingRequiredKey(
+                                    "a required field is not present".to_string(),
+                                ),
+                            ))
+                        } else {
+                            // dbg!("we pushed {} with 0", field_name);
+                            // We don't have something that wasn't required
+                            buffer.push(0);
+                            Ok(())
+                        }
+                    } else {
+                        if !property.always_required() || property.transient {
+                            // dbg!("we added 1", field_name);
+                            buffer.push(1);
+                        }
+                        let value = property
+                            .property_type
+                            .encode_value_ref_with_size(value, property.always_required())?;
+                        // dbg!("we pushed {} with {}", field_name, hex::encode(&value));
+                        buffer.extend(value.as_slice());
+                        Ok(())
+                    }
+                } else if property.always_required() && !property.transient {
+                    Err(ProtocolError::DataContractError(
+                        DataContractError::MissingRequiredKey(format!(
+                            "a required field {field_name} is not present"
+                        )),
+                    ))
+                } else {
+                    // dbg!("we pushed {} with 0", field_name);
+                    // We don't have something that wasn't required
+                    buffer.push(0);
+                    Ok(())
+                }
+            })?;
+
+        Ok(buffer)
+    }
+
+    /// Reads a serialized document and creates a Document from it.
+    pub(super) fn from_bytes_v2(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        _platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        let mut buf = BufReader::new(serialized_document);
+        if serialized_document.len() < 64 {
+            return Err(DataContractError::DecodingDocumentError(
+                DecodingError::new(
+                    "serialized document is too small, must have id and owner id".to_string(),
+                ),
+            ));
+        }
+
+        // $id
+        let mut id = [0; 32];
+        buf.read_exact(&mut id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for id".to_string(),
+            ))
+        })?;
+
+        // $ownerId
+        let mut owner_id = [0; 32];
+        buf.read_exact(&mut owner_id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for owner id".to_string(),
+            ))
+        })?;
+
+        // $creatorId
+        let creator_id: Option<Identifier> = if document_type.trade_mode() != TradeMode::None
+            || document_type.documents_transferable().is_transferable()
+        {
+            let has_creator_id = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has creator id bool from serialized document".to_string(),
+                )
+            })?;
+            if has_creator_id > 0 {
+                // $creatorId
+                let mut known_owner_id = [0; 32];
+                buf.read_exact(&mut known_owner_id).map_err(|_| {
+                    DataContractError::DecodingDocumentError(DecodingError::new(
+                        "error reading from serialized document for creator id".to_string(),
+                    ))
+                })?;
+                Some(known_owner_id.into())
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        // $revision
+        // if the document type is mutable then we should deserialize the revision
+        let revision: Option<Revision> = if document_type.requires_revision() {
+            let revision = buf.read_varint().map_err(|_| {
+                DataContractError::DecodingDocumentError(DecodingError::new(
+                    "error reading revision from serialized document for revision".to_string(),
+                ))
+            })?;
+            Some(revision)
+        } else {
+            None
+        };
+
+        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
+            DataContractError::CorruptedSerialization(
+                "error reading timestamp flags from serialized document".to_string(),
+            )
+        })?;
+
+        let created_at = if timestamp_flags & 1 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at = if timestamp_flags & 2 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at = if timestamp_flags & 4 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_block_height = if timestamp_flags & 8 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_block_height = if timestamp_flags & 16 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        // Now we deserialize the price which might not be necessary unless called for by the document type
+
+        let price = if document_type.trade_mode().seller_sets_price() {
+            let has_price = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has price bool from serialized document".to_string(),
+                )
+            })?;
+            if has_price > 0 {
+                let price = buf.read_u64::<BigEndian>().map_err(|_| {
+                    DataContractError::CorruptedSerialization(
+                        "error reading price u64 from serialized document".to_string(),
+                    )
+                })?;
+                Some(price)
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        let mut finished_buffer = false;
+
+        let mut properties = document_type
+            .properties()
+            .iter()
+            .filter_map(|(key, property)| {
+                if finished_buffer {
+                    return if property.always_required() && !property.transient {
+                        Some(Err(DataContractError::CorruptedSerialization(
+                            "required field after finished buffer".to_string(),
+                        )))
+                    } else {
+                        None
+                    };
+                }
+                let read_value = property.property_type.read_optionally_from(
+                    &mut buf,
+                    property.always_required() & !property.transient,
+                );
+
+                match read_value {
+                    Ok(read_value) => {
+                        finished_buffer |= read_value.1;
+                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
+                    }
+                    Err(e) => Some(Err(e)),
+                }
+            })
+            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
+
+        if let Some(price) = price {
+            properties.insert(PRICE.to_string(), price.into());
+        }
+
+        Ok(DocumentV0 {
+            contract_version: None,
+            id: Identifier::new(id),
+            properties,
+            owner_id: Identifier::new(owner_id),
+            revision,
+            created_at,
+            updated_at,
+            transferred_at,
+            created_at_block_height,
+            updated_at_block_height,
+            transferred_at_block_height,
+            created_at_core_block_height,
+            updated_at_core_block_height,
+            transferred_at_core_block_height,
+            creator_id,
+        })
+    }
+}
diff --git a/packages/rs-dpp/src/document/v0/serialize/v3.rs b/packages/rs-dpp/src/document/v0/serialize/v3.rs
new file mode 100644
index 00000000000..5ff6badbeb0
--- /dev/null
+++ b/packages/rs-dpp/src/document/v0/serialize/v3.rs
@@ -0,0 +1,552 @@
+//! Document serialization format 3: the default from protocol version 14.
+//! Format 2 plus the contract-version stamp — a varint right after the
+//! format prefix recording the data contract version the bytes conform to
+//! (0 = unstamped: a pre-format-3 document re-serialized in the new
+//! envelope). Introduced so contract updates can add required properties
+//! via `requiredSince`: the stamp selects each annotated property's byte
+//! layout (raw once the stamp reaches the annotation, presence-flagged
+//! before it), letting the latest contract alone decode every stored
+//! document.
+
+use crate::data_contract::document_type::DocumentTypeRef;
+use crate::data_contract::errors::DataContractError;
+
+use crate::document::property_names::{
+    CREATED_AT, CREATED_AT_BLOCK_HEIGHT, CREATED_AT_CORE_BLOCK_HEIGHT, PRICE, TRANSFERRED_AT,
+    TRANSFERRED_AT_BLOCK_HEIGHT, TRANSFERRED_AT_CORE_BLOCK_HEIGHT, UPDATED_AT,
+    UPDATED_AT_BLOCK_HEIGHT, UPDATED_AT_CORE_BLOCK_HEIGHT,
+};
+
+use crate::prelude::Revision;
+
+use crate::ProtocolError;
+
+use crate::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use crate::data_contract::document_type::methods::DocumentTypeBasicMethods;
+use crate::document::v0::DocumentV0;
+use crate::version::PlatformVersion;
+use byteorder::{BigEndian, ReadBytesExt};
+use integer_encoding::{VarInt, VarIntReader};
+
+use platform_value::{Identifier, Value};
+
+use std::collections::BTreeMap;
+
+use crate::consensus::basic::decode::DecodingError;
+use crate::nft::TradeMode;
+use std::io::{BufReader, Read};
+
+impl DocumentV0 {
+    /// Serializes the document.
+    ///
+    /// Serialize v3 is v2 plus the contract version stamp: a varint right
+    /// after the format prefix recording the data contract version the bytes
+    /// conform to (0 = unstamped, for pre-format-3 documents that are
+    /// re-serialized). A property whose `requiredSince` exceeds the stamp is
+    /// encoded with a presence flag exactly like an optional property, so
+    /// documents written before the property became required stay valid.
+    pub(super) fn serialize_v3(
+        &self,
+        document_type: DocumentTypeRef,
+    ) -> Result<Vec<u8>, ProtocolError> {
+        let mut buffer: Vec<u8> = 3u64.encode_var_vec(); //version 3
+
+        // the contract version stamp; 0 means unstamped
+        buffer.extend((self.contract_version.unwrap_or_default() as u64).encode_var_vec());
+
+        // $id
+        buffer.extend(self.id.as_slice());
+
+        // $ownerId
+        buffer.extend(self.owner_id.as_slice());
+
+        if document_type.trade_mode() != TradeMode::None
+            || document_type.documents_transferable().is_transferable()
+        {
+            if let Some(creator_id) = self.creator_id {
+                buffer.push(1);
+                buffer.extend(creator_id.as_slice());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // $revision
+        if let Some(revision) = self.revision {
+            buffer.extend(revision.encode_var_vec())
+        } else if document_type.requires_revision() {
+            buffer.extend((1 as Revision).encode_var_vec())
+        }
+
+        let mut bitwise_exists_flag: u16 = 0;
+
+        let mut time_fields_data_buffer = vec![];
+
+        // $createdAt
+        if let Some(created_at) = &self.created_at {
+            bitwise_exists_flag |= 1;
+            time_fields_data_buffer.extend(created_at.to_be_bytes());
+        } else if document_type.required_fields().contains(CREATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAt
+        if let Some(updated_at) = &self.updated_at {
+            bitwise_exists_flag |= 2;
+            time_fields_data_buffer.extend(updated_at.to_be_bytes());
+        } else if document_type.required_fields().contains(UPDATED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAt
+        if let Some(transferred_at) = &self.transferred_at {
+            bitwise_exists_flag |= 4;
+            time_fields_data_buffer.extend(transferred_at.to_be_bytes());
+        } else if document_type.required_fields().contains(TRANSFERRED_AT) {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred at field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtBlockHeight
+        if let Some(created_at_block_height) = &self.created_at_block_height {
+            bitwise_exists_flag |= 8;
+            time_fields_data_buffer.extend(created_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtBlockHeight
+        if let Some(updated_at_block_height) = &self.updated_at_block_height {
+            bitwise_exists_flag |= 16;
+            time_fields_data_buffer.extend(updated_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtBlockHeight
+        if let Some(transferred_at_block_height) = &self.transferred_at_block_height {
+            bitwise_exists_flag |= 32;
+            time_fields_data_buffer.extend(transferred_at_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $createdAtCoreBlockHeight
+        if let Some(created_at_core_block_height) = &self.created_at_core_block_height {
+            bitwise_exists_flag |= 64;
+            time_fields_data_buffer.extend(created_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(CREATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "created_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $updatedAtCoreBlockHeight
+        if let Some(updated_at_core_block_height) = &self.updated_at_core_block_height {
+            bitwise_exists_flag |= 128;
+            time_fields_data_buffer.extend(updated_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(UPDATED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "updated_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        // $transferredAtCoreBlockHeight
+        if let Some(transferred_at_core_block_height) = &self.transferred_at_core_block_height {
+            bitwise_exists_flag |= 256;
+            time_fields_data_buffer.extend(transferred_at_core_block_height.to_be_bytes());
+        } else if document_type
+            .required_fields()
+            .contains(TRANSFERRED_AT_CORE_BLOCK_HEIGHT)
+        {
+            return Err(ProtocolError::DataContractError(
+                DataContractError::MissingRequiredKey(
+                    "transferred_at_core_block_height field is not present".to_string(),
+                ),
+            ));
+        }
+
+        buffer.extend(bitwise_exists_flag.to_be_bytes().as_slice());
+        buffer.append(&mut time_fields_data_buffer);
+
+        // Now we serialize the price which might not be necessary unless called for by the document type
+
+        if document_type.trade_mode().seller_sets_price() {
+            if let Some(price) = self.properties.get(PRICE) {
+                buffer.push(1);
+                let price_as_u64: u64 = price.to_integer().map_err(ProtocolError::ValueError)?;
+                buffer.append(&mut price_as_u64.to_be_bytes().to_vec());
+            } else {
+                buffer.push(0);
+            }
+        }
+
+        // User defined properties: requiredness is evaluated at this
+        // document's stamp, so a property that became required after the
+        // stamp keeps the presence-flagged layout it was written with
+        document_type
+            .properties()
+            .iter()
+            .try_for_each(|(field_name, property)| {
+                let required = property.required_at(self.contract_version);
+                if let Some(value) = self.properties.get(field_name) {
+                    if value.is_null() {
+                        if required && !property.transient {
+                            Err(ProtocolError::DataContractError(
+                                DataContractError::MissingRequiredKey(
+                                    "a required field is not present".to_string(),
+                                ),
+                            ))
+                        } else {
+                            // We don't have something that wasn't required
+                            buffer.push(0);
+                            Ok(())
+                        }
+                    } else {
+                        if !required || property.transient {
+                            buffer.push(1);
+                        }
+                        let value = property
+                            .property_type
+                            .encode_value_ref_with_size(value, required)?;
+                        buffer.extend(value.as_slice());
+                        Ok(())
+                    }
+                } else if required && !property.transient {
+                    Err(ProtocolError::DataContractError(
+                        DataContractError::MissingRequiredKey(format!(
+                            "a required field {field_name} is not present"
+                        )),
+                    ))
+                } else {
+                    // We don't have something that wasn't required
+                    buffer.push(0);
+                    Ok(())
+                }
+            })?;
+
+        Ok(buffer)
+    }
+
+    /// Reads a serialized document and creates a Document from it.
+    /// Version 3 is version 2 plus the contract version stamp, which selects
+    /// each `requiredSince` property's byte layout: raw when the stamp has
+    /// reached the property's `requiredSince`, presence-flagged otherwise.
+    pub(super) fn from_bytes_v3(
+        serialized_document: &[u8],
+        document_type: DocumentTypeRef,
+        _platform_version: &PlatformVersion,
+    ) -> Result<Self, DataContractError> {
+        let mut buf = BufReader::new(serialized_document);
+        if serialized_document.len() < 65 {
+            return Err(DataContractError::DecodingDocumentError(
+                DecodingError::new(
+                    "serialized document is too small, must have contract version, id and owner id"
+                        .to_string(),
+                ),
+            ));
+        }
+
+        // the contract version stamp; 0 means unstamped
+        let stamp: u64 = buf.read_varint().map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading contract version stamp from serialized document".to_string(),
+            ))
+        })?;
+        if stamp > u32::MAX as u64 {
+            return Err(DataContractError::CorruptedSerialization(
+                "contract version stamp does not fit in a u32".to_string(),
+            ));
+        }
+        let contract_version = if stamp == 0 { None } else { Some(stamp as u32) };
+
+        // $id
+        let mut id = [0; 32];
+        buf.read_exact(&mut id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for id".to_string(),
+            ))
+        })?;
+
+        // $ownerId
+        let mut owner_id = [0; 32];
+        buf.read_exact(&mut owner_id).map_err(|_| {
+            DataContractError::DecodingDocumentError(DecodingError::new(
+                "error reading from serialized document for owner id".to_string(),
+            ))
+        })?;
+
+        // $creatorId
+        let creator_id: Option<Identifier> = if document_type.trade_mode() != TradeMode::None
+            || document_type.documents_transferable().is_transferable()
+        {
+            let has_creator_id = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has creator id bool from serialized document".to_string(),
+                )
+            })?;
+            if has_creator_id > 0 {
+                // $creatorId
+                let mut known_owner_id = [0; 32];
+                buf.read_exact(&mut known_owner_id).map_err(|_| {
+                    DataContractError::DecodingDocumentError(DecodingError::new(
+                        "error reading from serialized document for creator id".to_string(),
+                    ))
+                })?;
+                Some(known_owner_id.into())
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        // $revision
+        // if the document type is mutable then we should deserialize the revision
+        let revision: Option<Revision> = if document_type.requires_revision() {
+            let revision = buf.read_varint().map_err(|_| {
+                DataContractError::DecodingDocumentError(DecodingError::new(
+                    "error reading revision from serialized document for revision".to_string(),
+                ))
+            })?;
+            Some(revision)
+        } else {
+            None
+        };
+
+        let timestamp_flags = buf.read_u16::<BigEndian>().map_err(|_| {
+            DataContractError::CorruptedSerialization(
+                "error reading timestamp flags from serialized document".to_string(),
+            )
+        })?;
+
+        let created_at = if timestamp_flags & 1 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at = if timestamp_flags & 2 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at = if timestamp_flags & 4 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at timestamp from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_block_height = if timestamp_flags & 8 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_block_height = if timestamp_flags & 16 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_block_height from serialized document".to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_block_height = if timestamp_flags & 32 > 0 {
+            Some(buf.read_u64::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading transferred_at_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let created_at_core_block_height = if timestamp_flags & 64 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading created_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let updated_at_core_block_height = if timestamp_flags & 128 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        let transferred_at_core_block_height = if timestamp_flags & 256 > 0 {
+            Some(buf.read_u32::<BigEndian>().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading updated_at_core_block_height from serialized document"
+                        .to_string(),
+                )
+            })?)
+        } else {
+            None
+        };
+
+        // Now we deserialize the price which might not be necessary unless called for by the document type
+
+        let price = if document_type.trade_mode().seller_sets_price() {
+            let has_price = buf.read_u8().map_err(|_| {
+                DataContractError::CorruptedSerialization(
+                    "error reading has price bool from serialized document".to_string(),
+                )
+            })?;
+            if has_price > 0 {
+                let price = buf.read_u64::<BigEndian>().map_err(|_| {
+                    DataContractError::CorruptedSerialization(
+                        "error reading price u64 from serialized document".to_string(),
+                    )
+                })?;
+                Some(price)
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+        let mut finished_buffer = false;
+
+        let mut properties = document_type
+            .properties()
+            .iter()
+            .filter_map(|(key, property)| {
+                let required = property.required_at(contract_version);
+                if finished_buffer {
+                    return if required && !property.transient {
+                        Some(Err(DataContractError::CorruptedSerialization(
+                            "required field after finished buffer".to_string(),
+                        )))
+                    } else {
+                        None
+                    };
+                }
+                let read_value = property
+                    .property_type
+                    .read_optionally_from(&mut buf, required & !property.transient);
+
+                match read_value {
+                    Ok(read_value) => {
+                        finished_buffer |= read_value.1;
+                        read_value.0.map(|read_value| Ok((key.clone(), read_value)))
+                    }
+                    Err(e) => Some(Err(e)),
+                }
+            })
+            .collect::<Result<BTreeMap<String, Value>, DataContractError>>()?;
+
+        if let Some(price) = price {
+            properties.insert(PRICE.to_string(), price.into());
+        }
+
+        // Every property the document was serialized with must have been
+        // consumed. Trailing bytes mean the document was written under a
+        // newer contract version than the document type used to read it — a
+        // stale reader would otherwise silently drop the fields it does not
+        // know about. The stamp makes this detectable: callers should
+        // refetch the contract and retry.
+        let mut trailing_probe = [0u8; 1];
+        let trailing = buf.read(&mut trailing_probe).map_err(|_| {
+            DataContractError::CorruptedSerialization(
+                "error probing for trailing bytes in serialized document".to_string(),
+            )
+        })?;
+        if trailing > 0 {
+            return Err(DataContractError::CorruptedSerialization(format!(
+                "serialized document has trailing bytes: it was serialized under contract version {} with properties this document type does not know; refetch the contract",
+                stamp
+            )));
+        }
+
+        Ok(DocumentV0 {
+            contract_version,
+            id: Identifier::new(id),
+            properties,
+            owner_id: Identifier::new(owner_id),
+            revision,
+            created_at,
+            updated_at,
+            transferred_at,
+            created_at_block_height,
+            updated_at_block_height,
+            transferred_at_block_height,
+            created_at_core_block_height,
+            updated_at_core_block_height,
+            transferred_at_core_block_height,
+            creator_id,
+        })
+    }
+}
diff --git a/packages/rs-dpp/src/errors/consensus/basic/basic_error.rs b/packages/rs-dpp/src/errors/consensus/basic/basic_error.rs
index 6791910923e..d1bed746659 100644
--- a/packages/rs-dpp/src/errors/consensus/basic/basic_error.rs
+++ b/packages/rs-dpp/src/errors/consensus/basic/basic_error.rs
@@ -7,15 +7,15 @@ use crate::consensus::basic::data_contract::data_contract_max_depth_exceed_error
 use crate::consensus::basic::data_contract::{
     ContestedUniqueIndexOnMutableDocumentTypeError, ContestedUniqueIndexWithUniqueIndexError,
     DataContractHaveNewUniqueIndexError, DataContractImmutablePropertiesUpdateError,
-    DataContractInvalidIndexDefinitionUpdateError, DataContractTokenConfigurationUpdateError,
-    DataContractUniqueIndicesChangedError, DecimalsOverLimitError, DuplicateIndexError,
-    DuplicateIndexNameError, GroupExceedsMaxMembersError, GroupHasTooFewMembersError,
-    GroupMemberHasPowerOfZeroError, GroupMemberHasPowerOverLimitError,
-    GroupNonUnilateralMemberPowerHasLessThanRequiredPowerError, GroupPositionDoesNotExistError,
-    GroupRequiredPowerIsInvalidError, GroupTotalPowerLessThanRequiredError,
-    IncompatibleDataContractSchemaError, IncompatibleDocumentTypeSchemaError,
-    IncompatibleRe2PatternError, InvalidCompoundIndexError, InvalidDataContractIdError,
-    InvalidDataContractVersionError, InvalidDocumentTypeNameError,
+    DataContractInvalidIndexDefinitionUpdateError, DataContractInvalidRequiredFieldsUpdateError,
+    DataContractTokenConfigurationUpdateError, DataContractUniqueIndicesChangedError,
+    DecimalsOverLimitError, DuplicateIndexError, DuplicateIndexNameError,
+    GroupExceedsMaxMembersError, GroupHasTooFewMembersError, GroupMemberHasPowerOfZeroError,
+    GroupMemberHasPowerOverLimitError, GroupNonUnilateralMemberPowerHasLessThanRequiredPowerError,
+    GroupPositionDoesNotExistError, GroupRequiredPowerIsInvalidError,
+    GroupTotalPowerLessThanRequiredError, IncompatibleDataContractSchemaError,
+    IncompatibleDocumentTypeSchemaError, IncompatibleRe2PatternError, InvalidCompoundIndexError,
+    InvalidDataContractIdError, InvalidDataContractVersionError, InvalidDocumentTypeNameError,
     InvalidDocumentTypeRequiredSecurityLevelError, InvalidIndexPropertyTypeError,
     InvalidIndexedPropertyConstraintError, InvalidKeywordCharacterError,
     InvalidTokenBaseSupplyError, InvalidTokenDistributionFunctionDivideByZeroError,
@@ -696,6 +696,9 @@ pub enum BasicError {
 
     #[error(transparent)]
     TokenPricingScheduleEmptyError(TokenPricingScheduleEmptyError),
+
+    #[error(transparent)]
+    DataContractInvalidRequiredFieldsUpdateError(DataContractInvalidRequiredFieldsUpdateError),
 }
 
 impl From<BasicError> for ConsensusError {
diff --git a/packages/rs-dpp/src/errors/consensus/basic/data_contract/data_contract_invalid_required_fields_update_error.rs b/packages/rs-dpp/src/errors/consensus/basic/data_contract/data_contract_invalid_required_fields_update_error.rs
new file mode 100644
index 00000000000..db524161d38
--- /dev/null
+++ b/packages/rs-dpp/src/errors/consensus/basic/data_contract/data_contract_invalid_required_fields_update_error.rs
@@ -0,0 +1,46 @@
+use crate::consensus::basic::BasicError;
+use crate::consensus::ConsensusError;
+use crate::errors::ProtocolError;
+use bincode::{Decode, Encode};
+use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
+use thiserror::Error;
+
+#[derive(
+    Error, Debug, Clone, PartialEq, Eq, Encode, Decode, PlatformSerialize, PlatformDeserialize,
+)]
+#[error("Document type {document_type} required fields update is not allowed: {details}")]
+#[platform_serialize(unversioned)]
+pub struct DataContractInvalidRequiredFieldsUpdateError {
+    /*
+
+    DO NOT CHANGE ORDER OF FIELDS WITHOUT INTRODUCING OF NEW VERSION
+
+    */
+    document_type: String,
+    details: String,
+}
+
+impl DataContractInvalidRequiredFieldsUpdateError {
+    pub fn new(document_type: String, details: String) -> Self {
+        Self {
+            document_type,
+            details,
+        }
+    }
+
+    pub fn document_type(&self) -> &str {
+        &self.document_type
+    }
+
+    pub fn details(&self) -> &str {
+        &self.details
+    }
+}
+
+impl From<DataContractInvalidRequiredFieldsUpdateError> for ConsensusError {
+    fn from(err: DataContractInvalidRequiredFieldsUpdateError) -> Self {
+        Self::BasicError(BasicError::DataContractInvalidRequiredFieldsUpdateError(
+            err,
+        ))
+    }
+}
diff --git a/packages/rs-dpp/src/errors/consensus/basic/data_contract/mod.rs b/packages/rs-dpp/src/errors/consensus/basic/data_contract/mod.rs
index a43ea4793a3..d15ccaca661 100644
--- a/packages/rs-dpp/src/errors/consensus/basic/data_contract/mod.rs
+++ b/packages/rs-dpp/src/errors/consensus/basic/data_contract/mod.rs
@@ -3,6 +3,7 @@ mod contested_unique_index_with_unique_index_error;
 mod data_contract_have_new_unique_index_error;
 mod data_contract_immutable_properties_update_error;
 mod data_contract_invalid_index_definition_update_error;
+mod data_contract_invalid_required_fields_update_error;
 pub mod data_contract_max_depth_exceed_error;
 mod data_contract_token_configuration_update_error;
 mod data_contract_unique_indices_changed_error;
@@ -62,6 +63,7 @@ mod unknown_transferable_type_error;
 pub use data_contract_have_new_unique_index_error::*;
 pub use data_contract_immutable_properties_update_error::*;
 pub use data_contract_invalid_index_definition_update_error::*;
+pub use data_contract_invalid_required_fields_update_error::*;
 pub use data_contract_token_configuration_update_error::*;
 pub use data_contract_unique_indices_changed_error::*;
 pub use document_types_are_missing_error::*;
diff --git a/packages/rs-dpp/src/errors/consensus/codes.rs b/packages/rs-dpp/src/errors/consensus/codes.rs
index 6fa1b64d6ca..cc42a8e4d53 100644
--- a/packages/rs-dpp/src/errors/consensus/codes.rs
+++ b/packages/rs-dpp/src/errors/consensus/codes.rs
@@ -120,6 +120,7 @@ impl ErrorWithCode for BasicError {
             Self::InvalidTokenDistributionTimeIntervalTooShortError(_) => 10273,
             Self::InvalidTokenDistributionTimeIntervalNotMinuteAlignedError(_) => 10274,
             Self::RedundantDocumentPaidForByTokenWithContractId(_) => 10275,
+            Self::DataContractInvalidRequiredFieldsUpdateError { .. } => 10276,
 
             // Group Errors: 10350-10399
             Self::GroupPositionDoesNotExistError(_) => 10350,
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_create_transition/v0/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_create_transition/v0/mod.rs
index 8b7a528b7d0..876fc29bc10 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_create_transition/v0/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_create_transition/v0/mod.rs
@@ -374,6 +374,7 @@ impl DocumentFromCreateTransitionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id: base.id(),
                 owner_id,
                 properties: data,
@@ -484,6 +485,7 @@ impl DocumentFromCreateTransitionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id: base.id(),
                 owner_id,
                 properties,
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_replace_transition/v0/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_replace_transition/v0/mod.rs
index 0c2d1f95054..b501324e98d 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_replace_transition/v0/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/document/batch_transition/batched_transition/document_replace_transition/v0/mod.rs
@@ -234,6 +234,7 @@ impl DocumentFromReplaceTransitionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 owner_id,
                 properties: data.clone(),
@@ -315,6 +316,7 @@ impl DocumentFromReplaceTransitionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 owner_id,
                 properties: data,
diff --git a/packages/rs-dpp/src/tests/json_document.rs b/packages/rs-dpp/src/tests/json_document.rs
index 1f76d7431fd..feab00b5adc 100644
--- a/packages/rs-dpp/src/tests/json_document.rs
+++ b/packages/rs-dpp/src/tests/json_document.rs
@@ -154,6 +154,7 @@ pub fn json_document_to_document(
     }
 
     let mut document: DocumentV0 = DocumentV0 {
+        contract_version: None,
         id: data.remove_identifier("$id")?,
         owner_id: data.remove_identifier("$ownerId")?,
         properties: Default::default(),
diff --git a/packages/rs-dpp/src/tokens/token_event.rs b/packages/rs-dpp/src/tokens/token_event.rs
index 5982eb45520..5066b0f0479 100644
--- a/packages/rs-dpp/src/tokens/token_event.rs
+++ b/packages/rs-dpp/src/tokens/token_event.rs
@@ -860,6 +860,7 @@ impl TokenEvent {
         };
 
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties,
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 6d8a854e32d..f3e3fccbc69 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -82,7 +82,7 @@ derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
 # bindings, and blake3 for the snapshot-file checksum.
@@ -90,6 +90,7 @@ rocksdb = { git = "https://github.com/QuantumExplorer/rust-rocksdb.git", rev = "
 blake3 = "1.5"
 
 [dev-dependencies]
+dash-platform-queries = { path = "../dash-platform-queries" }
 platform-version = { path = "../rs-platform-version", features = [
   "mock-versions",
 ] }
@@ -107,7 +108,7 @@ dpp = { path = "../rs-dpp", default-features = false, features = [
 drive = { path = "../rs-drive", features = ["fixtures-and-mocks"] }
 drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", features = ["client"] }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", features = ["client"] }
 assert_matches = "1.5.0"
 drive-abci = { path = ".", features = ["testing-config", "mocks", "shielded_test_data"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
@@ -121,8 +122,8 @@ integer-encoding = { version = "4.0.0" }
 
 # For dump_only_default_and_aux_cfs_under_shielded_subtree_prefix — same
 # subtree-prefix algorithm grovedb uses internally.
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
 
 [features]
 default = ["bls-signatures"]
diff --git a/packages/rs-drive-abci/src/abci/handler/prepare_proposal.rs b/packages/rs-drive-abci/src/abci/handler/prepare_proposal.rs
index 10a4bd95631..e85bd7dc285 100644
--- a/packages/rs-drive-abci/src/abci/handler/prepare_proposal.rs
+++ b/packages/rs-drive-abci/src/abci/handler/prepare_proposal.rs
@@ -13,7 +13,6 @@ use crate::rpc::core::CoreRPCLike;
 use dpp::dashcore::hashes::Hash;
 use dpp::dashcore::Network;
 use dpp::version::TryIntoPlatformVersioned;
-use drive::grovedb_storage::Error::RocksDBError;
 use tenderdash_abci::proto::abci as proto;
 use tenderdash_abci::proto::abci::tx_record::TxAction;
 use tenderdash_abci::proto::abci::{ExecTxResult, TxRecord};
@@ -142,7 +141,7 @@ where
         );
         if let Some(tx) = transaction_guard.as_ref() {
             tx.rollback_to_savepoint()
-                .map_err(|e| drive::grovedb::error::Error::StorageError(RocksDBError(e)))?;
+                .map_err(drive::grovedb::error::Error::StorageError)?;
             tx.set_savepoint();
         }
         transaction_guard
diff --git a/packages/rs-drive-abci/src/abci/handler/process_proposal.rs b/packages/rs-drive-abci/src/abci/handler/process_proposal.rs
index a64aba5013b..69bae1c5fcd 100644
--- a/packages/rs-drive-abci/src/abci/handler/process_proposal.rs
+++ b/packages/rs-drive-abci/src/abci/handler/process_proposal.rs
@@ -14,7 +14,6 @@ use crate::platform_types::state_transitions_processing_result::StateTransitionE
 use crate::rpc::core::CoreRPCLike;
 use dpp::dashcore::Network;
 use dpp::version::TryIntoPlatformVersioned;
-use drive::grovedb_storage::Error::RocksDBError;
 use tenderdash_abci::proto::abci as proto;
 use tenderdash_abci::proto::abci::tx_record::TxAction;
 
@@ -173,7 +172,7 @@ where
         );
         if let Some(tx) = transaction_guard.as_ref() {
             tx.rollback_to_savepoint()
-                .map_err(|e| drive::grovedb::error::Error::StorageError(RocksDBError(e)))?;
+                .map_err(drive::grovedb::error::Error::StorageError)?;
             tx.set_savepoint();
         }
         transaction_guard
diff --git a/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs b/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
index c7c1bf2fb6c..682291a6ce0 100644
--- a/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
@@ -68,7 +68,8 @@ where
                 errors,
                 state_read_guard.last_block_info(),
                 transaction,
-                None, // address_balances_in_update not needed for check_tx
+                None,   // address_balances_in_update not needed for check_tx
+                &mut 0, // check_tx's transaction is discarded, its mints are never recorded
                 platform_ref.state.current_platform_version()?,
                 platform_ref.state.previous_fee_versions(),
             )
diff --git a/packages/rs-drive-abci/src/execution/engine/run_block_proposal/v0/mod.rs b/packages/rs-drive-abci/src/execution/engine/run_block_proposal/v0/mod.rs
index 15dc1a551da..b93125a08c9 100644
--- a/packages/rs-drive-abci/src/execution/engine/run_block_proposal/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/engine/run_block_proposal/v0/mod.rs
@@ -402,6 +402,19 @@ where
 
         tracing::debug!(block_fees = ?processed_block_fees, "block fees are processed");
 
+        // Record the credits this block minted into Platform (asset locks funding state
+        // transitions, epoch Core rewards) as a credit inflow: the daily withdrawal limit adds
+        // inflows younger than its day-old base to the daily maximum, so it limits net outflow.
+        // A system event, so nobody pays fees for the write.
+        self.record_credit_inflows_for_withdrawals(
+            state_transitions_result
+                .credit_mints()
+                .saturating_add(processed_block_fees.credit_mints),
+            &block_info,
+            transaction,
+            platform_version,
+        )?;
+
         // Record the total credits in Platform if this block changed it: the daily withdrawal
         // limit is a share of the total credits Platform held a day ago, read from this history.
         // This runs after fees and epoch rewards, the last things in a block that can move the
diff --git a/packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/process_block_fees_and_validate_sum_trees/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/process_block_fees_and_validate_sum_trees/v0/mod.rs
index effc1d82539..d48d6ff2c65 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/process_block_fees_and_validate_sum_trees/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/block_processing_end_events/process_block_fees_and_validate_sum_trees/v0/mod.rs
@@ -148,6 +148,8 @@ impl<CoreRPCLike> Platform<CoreRPCLike> {
             &platform_version.drive,
         )?;
 
+        let credit_mints = DriveOperation::credit_mints(&batch);
+
         self.drive.apply_drive_operations(
             batch,
             true,
@@ -166,6 +168,7 @@ impl<CoreRPCLike> Platform<CoreRPCLike> {
             payouts,
             refunded_epochs_count: storage_fee_distribution_outcome
                 .map(|outcome| outcome.refunded_epochs_count),
+            credit_mints,
         };
 
         if self.config.execution.verify_sum_trees {
@@ -239,7 +242,9 @@ mod tests {
                 block_time_ms,
                 previous_block_time_ms,
                 proposer_pro_tx_hash,
-                core_chain_locked_height: 1,
+                // Advance Core with the chain so an epoch spans Core blocks and its payout
+                // carries non-zero Core rewards for the credit-mint assertion below.
+                core_chain_locked_height: block_height as u32,
                 block_hash: None,
                 app_hash: None,
             };
@@ -327,10 +332,15 @@ mod tests {
 
             // Should pay for previous epoch
 
+            // The epoch Core rewards minted by the payout batch must be reported in the
+            // outcome's credit mints, which `run_block_proposal` records as a
+            // withdrawal-limit inflow; a block without a payout mints nothing.
             if epoch_info.is_epoch_change() && epoch_index > GENESIS_EPOCH_INDEX {
                 assert!(storage_fee_distribution_outcome.payouts.is_some());
+                assert_ne!(storage_fee_distribution_outcome.credit_mints, 0);
             } else {
                 assert!(storage_fee_distribution_outcome.payouts.is_none());
+                assert_eq!(storage_fee_distribution_outcome.credit_mints, 0);
             }
 
             // Should distribute block fees into pools
diff --git a/packages/rs-drive-abci/src/execution/platform_events/fee_pool_outwards_distribution/fetch_reward_shares_list_for_masternode/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/fee_pool_outwards_distribution/fetch_reward_shares_list_for_masternode/v0/mod.rs
index bd37b545712..ba062b7f737 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/fee_pool_outwards_distribution/fetch_reward_shares_list_for_masternode/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/fee_pool_outwards_distribution/fetch_reward_shares_list_for_masternode/v0/mod.rs
@@ -64,6 +64,7 @@ impl<C> Platform<C> {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // todo: deal with cost of this operation
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/common.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/common.rs
index a96ca521343..aa28c7fa3bf 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/common.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/common.rs
@@ -66,6 +66,7 @@ impl<C> Platform<C> {
             .map_err(|e| Error::Protocol(ProtocolError::ValueError(e)))?;
 
         let document = DocumentV0 {
+            contract_version: None,
             id: DPNS_DASH_TLD_DOCUMENT_ID.into(),
             properties: document_stub_properties,
             owner_id: contract.owner_id(),
diff --git a/packages/rs-drive-abci/src/execution/platform_events/protocol_upgrade/perform_events_on_first_block_of_protocol_change/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/protocol_upgrade/perform_events_on_first_block_of_protocol_change/v0/mod.rs
index 484a56fb9d5..4f66d59dce8 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/protocol_upgrade/perform_events_on_first_block_of_protocol_change/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/protocol_upgrade/perform_events_on_first_block_of_protocol_change/v0/mod.rs
@@ -19,8 +19,9 @@ use drive::drive::identity::key::fetch::{
     IdentityKeysRequest, KeyIDIdentityPublicKeyPairBTreeMap, KeyRequestType,
 };
 use drive::drive::identity::withdrawals::paths::{
-    get_withdrawal_root_path, WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY,
-    WITHDRAWAL_TRANSACTIONS_BROADCASTED_KEY, WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
+    get_withdrawal_root_path, WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+    WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY, WITHDRAWAL_TRANSACTIONS_BROADCASTED_KEY,
+    WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
 };
 use drive::drive::prefunded_specialized_balances::prefunded_specialized_balances_for_voting_path_vec;
 use drive::drive::saved_block_transactions::{
@@ -723,6 +724,18 @@ impl<C> Platform<C> {
             &platform_version.drive,
         )?;
 
+        // Credit inflows sum tree: every credit mint is recorded here so the daily withdrawal
+        // limit counts net outflow instead of gross — credits that entered Platform within the
+        // window may leave again without consuming the withdrawal budget of other users.
+        self.drive.grove_insert_if_not_exists(
+            get_withdrawal_root_path().as_slice().into(),
+            &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+            Element::empty_sum_tree(),
+            Some(transaction),
+            None,
+            &platform_version.drive,
+        )?;
+
         Ok(())
     }
 }
@@ -1402,17 +1415,22 @@ mod tests {
         use drive::grovedb_path::SubtreePath;
 
         // Not there on a v13 genesis state
-        assert!(platform
-            .drive
-            .grove
-            .get(
-                SubtreePath::from(&get_withdrawal_root_path()),
-                &WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY,
-                Some(&transaction),
-                &platform_version.drive.grove_version,
-            )
-            .value
-            .is_err());
+        for key in [
+            &WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY,
+            &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+        ] {
+            assert!(platform
+                .drive
+                .grove
+                .get(
+                    SubtreePath::from(&get_withdrawal_root_path()),
+                    key,
+                    Some(&transaction),
+                    &platform_version.drive.grove_version,
+                )
+                .value
+                .is_err());
+        }
 
         let block_info = BlockInfo {
             time_ms: 1_000_000,
@@ -1437,6 +1455,19 @@ mod tests {
             .expect("total credits history tree should exist after the v14 transition");
         assert!(element.is_any_tree());
 
+        let element = platform
+            .drive
+            .grove
+            .get(
+                SubtreePath::from(&get_withdrawal_root_path()),
+                &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+                Some(&transaction),
+                &platform_version.drive.grove_version,
+            )
+            .value
+            .expect("credit inflows sum tree should exist after the v14 transition");
+        assert!(element.is_sum_tree());
+
         // Running it again is harmless and the tree stays usable
         platform
             .transition_to_version_14(&block_info, &transaction, platform_version)
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/mod.rs
index 8ffa117d71a..fafcac01840 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/mod.rs
@@ -13,6 +13,7 @@ use dpp::balances::credits::CreditOperation;
 use dpp::block::block_info::BlockInfo;
 use dpp::consensus::ConsensusError;
 use dpp::fee::default_costs::CachedEpochIndexFeeVersions;
+use dpp::fee::Credits;
 use dpp::version::PlatformVersion;
 use drive::grovedb::Transaction;
 
@@ -28,6 +29,9 @@ where
     /// * `block_info` - Information about the current block being processed.
     /// * `transaction` - The transaction associated with the execution event.
     /// * `address_balances_in_update` - Optional map to track address balance changes.
+    /// * `block_credit_mints` - Accumulates the credits the applied operations mint into
+    ///   Platform (`AddToSystemCredits`), which the block records as credit inflows for the
+    ///   net daily withdrawal limit.
     /// * `platform_version` - A `PlatformVersion` reference that dictates which version of
     ///   the method to call.
     ///
@@ -49,6 +53,7 @@ where
         block_info: &BlockInfo,
         transaction: &Transaction,
         address_balances_in_update: Option<&mut BTreeMap<PlatformAddress, CreditOperation>>,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<EventExecutionResult, Error> {
@@ -64,6 +69,7 @@ where
                 block_info,
                 transaction,
                 address_balances_in_update,
+                block_credit_mints,
                 platform_version,
                 previous_fee_versions,
             ),
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/v0/mod.rs
index 9d2631c3082..e0c2b4d5dcc 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/execute_event/v0/mod.rs
@@ -43,10 +43,12 @@ where
         block_info: &BlockInfo,
         mut consensus_errors: Vec<ConsensusError>,
         transaction: &Transaction,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<EventExecutionResult, Error> {
         if fee_validation_result.is_valid_with_data() {
+            let credit_mints = DriveOperation::credit_mints(&operations);
             //todo: make this into an atomic event with partial batches
             let mut individual_fee_result = self
                 .drive
@@ -60,6 +62,8 @@ where
                 )
                 .map_err(Error::Drive)?;
 
+            *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
             ValidationOperation::add_many_to_fee_result(
                 &execution_operations,
                 &mut individual_fee_result,
@@ -115,10 +119,12 @@ where
         mut consensus_errors: Vec<ConsensusError>,
         transaction: &Transaction,
         mut address_balances_in_update: Option<&mut BTreeMap<PlatformAddress, CreditOperation>>,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<EventExecutionResult, Error> {
         if fee_validation_result.is_valid_with_data() {
+            let credit_mints = DriveOperation::credit_mints(&operations);
             // Apply the drive operations first to calculate the fee
             let mut individual_fee_result = self
                 .drive
@@ -132,6 +138,8 @@ where
                 )
                 .map_err(Error::Drive)?;
 
+            *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
             ValidationOperation::add_many_to_fee_result(
                 &execution_operations,
                 &mut individual_fee_result,
@@ -369,6 +377,7 @@ where
         block_info: &BlockInfo,
         transaction: &Transaction,
         address_balances_in_update: Option<&mut BTreeMap<PlatformAddress, CreditOperation>>,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<EventExecutionResult, Error> {
@@ -412,6 +421,7 @@ where
                     block_info,
                     consensus_errors,
                     transaction,
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )
@@ -437,6 +447,7 @@ where
                     block_info,
                     consensus_errors,
                     transaction,
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )?;
@@ -477,6 +488,7 @@ where
                     consensus_errors,
                     transaction,
                     address_balances_in_update,
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )
@@ -487,6 +499,7 @@ where
                 processing_fees,
                 operations,
             } => {
+                let credit_mints = DriveOperation::credit_mints(&operations);
                 self.drive
                     .apply_drive_operations(
                         operations,
@@ -498,6 +511,8 @@ where
                     )
                     .map_err(Error::Drive)?;
 
+                *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
                 if consensus_errors.is_empty() {
                     Ok(SuccessfulPaidExecution(
                         None,
@@ -516,6 +531,7 @@ where
                 fees_to_add_to_pool,
             } => {
                 if consensus_errors.is_empty() {
+                    let credit_mints = DriveOperation::credit_mints(&operations);
                     self.drive
                         .apply_drive_operations(
                             operations,
@@ -527,6 +543,8 @@ where
                         )
                         .map_err(Error::Drive)?;
 
+                    *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
                     Ok(SuccessfulPaidExecution(
                         None,
                         FeeResult::default_with_fees(0, fees_to_add_to_pool),
@@ -566,6 +584,7 @@ where
                     return Ok(UnpaidConsensusExecutionError(consensus_errors));
                 }
 
+                let credit_mints = DriveOperation::credit_mints(&operations);
                 let applied_fees = self
                     .drive
                     .apply_drive_operations(
@@ -578,6 +597,8 @@ where
                     )
                     .map_err(Error::Drive)?;
 
+                *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
                 // The ops just applied credited any transparent output address (an Unshield's
                 // recipient, including the chargeable-failure fallback address). Record that credit
                 // so incremental client sync sees it. ShieldedSpend origin: recorded only from v1
@@ -625,6 +646,7 @@ where
                 all_errors.extend(consensus_errors);
 
                 if all_errors.is_empty() {
+                    let credit_mints = DriveOperation::credit_mints(&operations);
                     let applied_fees = self
                         .drive
                         .apply_drive_operations(
@@ -637,6 +659,8 @@ where
                         )
                         .map_err(Error::Drive)?;
 
+                    *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
+
                     // The ops just applied credited the shield's transparent surplus-output address
                     // (when set). Record that credit so incremental client sync sees it. ShieldedSpend
                     // origin: recorded only from v1 (protocol v13); v0 drops it so pre-v13 blocks
@@ -696,11 +720,13 @@ where
                     block_info,
                     consensus_errors,
                     transaction,
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )
             }
             ExecutionEvent::Free { operations } => {
+                let credit_mints = DriveOperation::credit_mints(&operations);
                 self.drive
                     .apply_drive_operations(
                         operations,
@@ -711,6 +737,7 @@ where
                         Some(previous_fee_versions),
                     )
                     .map_err(Error::Drive)?;
+                *block_credit_mints = block_credit_mints.saturating_add(credit_mints);
                 Ok(SuccessfulFreeExecution)
             }
         }
@@ -757,6 +784,7 @@ mod tests {
                 &BlockInfo::default(),
                 &transaction,
                 Some(&mut address_balances),
+                &mut 0,
                 platform_version,
                 &fee_versions,
             )
@@ -802,6 +830,7 @@ mod tests {
                 &BlockInfo::default(),
                 &transaction,
                 Some(&mut address_balances),
+                &mut 0,
                 platform_version,
                 &fee_versions,
             )
@@ -844,6 +873,7 @@ mod tests {
                 &BlockInfo::default(),
                 &transaction,
                 Some(&mut address_balances),
+                &mut 0,
                 platform_version,
                 &fee_versions,
             )
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_raw_state_transitions/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_raw_state_transitions/v0/mod.rs
index 4e19577b925..de55f78281e 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_raw_state_transitions/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_raw_state_transitions/v0/mod.rs
@@ -4,6 +4,7 @@ use crate::platform_types::platform_state::{PlatformState, PlatformStateV0Method
 use crate::rpc::core::CoreRPCLike;
 use dpp::block::block_info::BlockInfo;
 use dpp::consensus::codes::ErrorWithCode;
+use dpp::fee::Credits;
 
 use crate::execution::types::state_transition_container::v0::{
     DecodedStateTransition, InvalidStateTransition, InvalidWithProtocolErrorStateTransition,
@@ -17,7 +18,6 @@ use crate::platform_types::state_transitions_processing_result::{
 use dpp::util::hash::hash_single;
 use dpp::version::PlatformVersion;
 use drive::grovedb::Transaction;
-use drive::grovedb_storage::Error::RocksDBError;
 use std::time::Instant;
 
 use super::super::StateTransitionAwareError;
@@ -138,6 +138,11 @@ where
 
         let mut processing_result = StateTransitionsProcessingResult::default();
 
+        // Credits the block's applied operations mint into Platform (asset locks), summed
+        // across state transitions and recorded once per block as a credit inflow the net
+        // daily withdrawal limit adds to its daily maximum.
+        let mut block_credit_mints: Credits = 0;
+
         for decoded_state_transition in state_transition_container.into_iter() {
             // If we propose state transitions, we need to check if we have a time limit for processing
             // set and if we have exceeded it.
@@ -176,10 +181,12 @@ where
                         }
 
                         // Mark the state we can return to if this transition's result strips
-                        // it from the block (see `rollback_dropped_transitions` above).
+                        // it from the block (see `rollback_dropped_transitions` above). The
+                        // mint accumulator mirrors applied state, so it rewinds with it.
                         if rollback_dropped_transitions {
                             transaction.set_savepoint();
                         }
+                        let credit_mints_at_savepoint = block_credit_mints;
 
                         // Validate state transition and produce an execution event
                         let execution_result = process_state_transition(
@@ -198,6 +205,7 @@ where
                                 validation_result,
                                 block_info,
                                 transaction,
+                                &mut block_credit_mints,
                                 platform_version,
                                 platform_ref.state.previous_fee_versions(),
                             )
@@ -223,9 +231,14 @@ where
                                     // in the state the app hash is computed over. A rollback
                                     // failure means the proposal can no longer match the
                                     // block — fail it rather than continue on leaked state.
-                                    transaction.rollback_to_savepoint().map_err(|e| {
-                                        drive::grovedb::error::Error::StorageError(RocksDBError(e))
-                                    })?;
+                                    transaction
+                                        .rollback_to_savepoint()
+                                        .map_err(drive::grovedb::error::Error::StorageError)?;
+                                    // The rollback discarded this transition's writes; drop
+                                    // its mints with them, or the block would record a
+                                    // credit inflow for a transition the proposal omits and
+                                    // validators re-executing it would compute other state.
+                                    block_credit_mints = credit_mints_at_savepoint;
                                 }
                                 StateTransitionExecutionResult::SuccessfulExecution { .. }
                                 | StateTransitionExecutionResult::PaidConsensusError { .. } => {
@@ -321,6 +334,8 @@ where
             processing_result.add(execution_result)?;
         }
 
+        processing_result.set_credit_mints(block_credit_mints);
+
         Ok(processing_result)
     }
 }
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/mod.rs
index e444eb0c1af..7754f974082 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/mod.rs
@@ -10,6 +10,7 @@ use crate::platform_types::state_transitions_processing_result::StateTransitionE
 use crate::rpc::core::CoreRPCLike;
 use dpp::block::block_info::BlockInfo;
 use dpp::fee::default_costs::CachedEpochIndexFeeVersions;
+use dpp::fee::Credits;
 use dpp::validation::ConsensusValidationResult;
 use dpp::version::PlatformVersion;
 use drive::grovedb::Transaction;
@@ -35,6 +36,7 @@ where
         validation_result: ConsensusValidationResult<ExecutionEvent>,
         block_info: &BlockInfo,
         transaction: &Transaction,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<StateTransitionExecutionResult, StateTransitionAwareError<'a>> {
@@ -50,6 +52,7 @@ where
                 validation_result,
                 block_info,
                 transaction,
+                block_credit_mints,
                 platform_version,
                 previous_fee_versions,
             ),
@@ -59,6 +62,7 @@ where
                 validation_result,
                 block_info,
                 transaction,
+                block_credit_mints,
                 platform_version,
                 previous_fee_versions,
             ),
@@ -125,6 +129,7 @@ mod tests {
                 validation_result,
                 &BlockInfo::default(),
                 &transaction,
+                &mut 0,
                 platform_version,
                 &fee_versions,
             )
@@ -135,6 +140,7 @@ mod tests {
                 validation_result,
                 &BlockInfo::default(),
                 &transaction,
+                &mut 0,
                 platform_version,
                 &fee_versions,
             )
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v0/mod.rs
index af40190097d..c5ff68078dc 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v0/mod.rs
@@ -7,6 +7,7 @@ use crate::rpc::core::CoreRPCLike;
 use dpp::block::block_info::BlockInfo;
 use dpp::fee::default_costs::CachedEpochIndexFeeVersions;
 use dpp::fee::fee_result::FeeResult;
+use dpp::fee::Credits;
 use dpp::util::hash::hash_single;
 use dpp::validation::ConsensusValidationResult;
 use dpp::version::PlatformVersion;
@@ -32,6 +33,7 @@ where
         mut validation_result: ConsensusValidationResult<ExecutionEvent>,
         block_info: &BlockInfo,
         transaction: &Transaction,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<StateTransitionExecutionResult, StateTransitionAwareError<'a>> {
@@ -92,6 +94,7 @@ where
                     block_info,
                     transaction,
                     None, // No address balance tracking for invalid state transitions
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )
@@ -189,6 +192,7 @@ where
                 block_info,
                 transaction,
                 Some(&mut address_balances),
+                block_credit_mints,
                 platform_version,
                 previous_fee_versions,
             )
diff --git a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v1/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v1/mod.rs
index 554e4d2e989..d0ddd84cb6b 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v1/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/state_transition_processing/process_validation_result/v1/mod.rs
@@ -7,6 +7,7 @@ use crate::rpc::core::CoreRPCLike;
 use dpp::block::block_info::BlockInfo;
 use dpp::fee::default_costs::CachedEpochIndexFeeVersions;
 use dpp::fee::fee_result::FeeResult;
+use dpp::fee::Credits;
 use dpp::util::hash::hash_single;
 use dpp::validation::ConsensusValidationResult;
 use dpp::version::PlatformVersion;
@@ -31,6 +32,7 @@ where
         mut validation_result: ConsensusValidationResult<ExecutionEvent>,
         block_info: &BlockInfo,
         transaction: &Transaction,
+        block_credit_mints: &mut Credits,
         platform_version: &PlatformVersion,
         previous_fee_versions: &CachedEpochIndexFeeVersions,
     ) -> Result<StateTransitionExecutionResult, StateTransitionAwareError<'a>> {
@@ -92,6 +94,7 @@ where
                     block_info,
                     transaction,
                     Some(&mut address_balances),
+                    block_credit_mints,
                     platform_version,
                     previous_fee_versions,
                 )
@@ -189,6 +192,7 @@ where
                 block_info,
                 transaction,
                 Some(&mut address_balances),
+                block_credit_mints,
                 platform_version,
                 previous_fee_versions,
             )
diff --git a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/mod.rs
index 837ffd1bf9f..8263bc682e7 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/mod.rs
@@ -9,6 +9,7 @@ use dpp::version::PlatformVersion;
 use drive::grovedb::Transaction;
 
 mod v0;
+mod v1;
 
 impl<C> Platform<C>
 where
@@ -48,9 +49,14 @@ where
                 transaction,
                 platform_version,
             ),
+            1 => self.cleanup_expired_locks_of_withdrawal_amounts_v1(
+                block_info,
+                transaction,
+                platform_version,
+            ),
             version => Err(Error::Execution(ExecutionError::UnknownVersionMismatch {
                 method: "cleanup_expired_locks_of_withdrawal_amounts".to_string(),
-                known_versions: vec![0],
+                known_versions: vec![0, 1],
                 received: version,
             })),
         }
diff --git a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/v1/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/v1/mod.rs
new file mode 100644
index 00000000000..8ff497632f6
--- /dev/null
+++ b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/cleanup_expired_locks_of_withdrawal_amounts/v1/mod.rs
@@ -0,0 +1,176 @@
+use crate::error::Error;
+use crate::platform_types::platform::Platform;
+
+use crate::rpc::core::CoreRPCLike;
+use dpp::block::block_info::BlockInfo;
+
+use dpp::version::PlatformVersion;
+use drive::drive::identity::withdrawals::paths::{
+    get_withdrawal_credit_inflows_sum_tree_path_vec, get_withdrawal_transactions_sum_tree_path_vec,
+};
+use drive::grovedb::{MaybeTree, PathQuery, QueryItem, Transaction};
+use drive::util::grove_operations::BatchDeleteApplyType;
+
+impl<C> Platform<C>
+where
+    C: CoreRPCLike,
+{
+    /// Version 1 differs from version 0 in also pruning the expired entries of the credit
+    /// inflows sum tree, which exists from protocol version 14: both trees are keyed by the
+    /// block time their entries stop counting toward the daily withdrawal limit, on the same
+    /// 25 hour schedule, and both are pruned with the same per-block limit.
+    pub(super) fn cleanup_expired_locks_of_withdrawal_amounts_v1(
+        &self,
+        block_info: &BlockInfo,
+        transaction: &Transaction,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        let limit = platform_version
+            .drive_abci
+            .withdrawal_constants
+            .cleanup_expired_locks_of_withdrawal_amounts_limit;
+
+        if limit == 0 {
+            // No clean up
+            return Ok(());
+        }
+
+        let mut batch_operations = vec![];
+
+        for path in [
+            get_withdrawal_transactions_sum_tree_path_vec(),
+            get_withdrawal_credit_inflows_sum_tree_path_vec(),
+        ] {
+            let mut path_query = PathQuery::new_single_query_item(
+                path,
+                QueryItem::RangeTo(..block_info.time_ms.to_be_bytes().to_vec()),
+            );
+
+            path_query.query.limit = Some(limit);
+
+            self.drive.batch_delete_items_in_path_query(
+                &path_query,
+                true,
+                // we know that we are not deleting a subtree
+                BatchDeleteApplyType::StatefulBatchDelete {
+                    is_known_to_be_subtree_with_sum: Some(MaybeTree::NotTree),
+                },
+                Some(transaction),
+                &mut batch_operations,
+                &platform_version.drive,
+            )?;
+        }
+
+        self.drive.apply_batch_low_level_drive_operations(
+            None,
+            Some(transaction),
+            batch_operations,
+            &mut vec![],
+            &platform_version.drive,
+        )?;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::test::helpers::setup::TestPlatformBuilder;
+    use dpp::block::block_info::BlockInfo;
+    use dpp::block::epoch::Epoch;
+    use dpp::version::PlatformVersion;
+    use drive::drive::identity::withdrawals::paths::{
+        get_withdrawal_credit_inflows_sum_tree_path_vec,
+        get_withdrawal_transactions_sum_tree_path_vec,
+    };
+    use drive::grovedb::{Element, PathQuery, Query, SizedQuery};
+    use drive::util::grove_operations::BatchInsertApplyType;
+    use drive::util::object_size_info::PathKeyElementInfo;
+
+    /// Both the reserved withdrawal amounts and the credit inflows expire on the same
+    /// schedule; the v1 cleanup must prune the entries of both trees whose key is before the
+    /// block time and leave the rest.
+    #[test]
+    fn should_prune_expired_entries_of_both_sum_trees() {
+        let platform_version = PlatformVersion::latest();
+        let platform = TestPlatformBuilder::new()
+            .with_latest_protocol_version()
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+
+        let transaction = platform.drive.grove.start_transaction();
+
+        let now_ms: u64 = 1_000_000;
+
+        for path in [
+            get_withdrawal_transactions_sum_tree_path_vec(),
+            get_withdrawal_credit_inflows_sum_tree_path_vec(),
+        ] {
+            for (key_time_ms, amount) in [(now_ms - 1, 100i64), (now_ms, 250i64)] {
+                let mut drive_operations = vec![];
+                platform
+                    .drive
+                    .batch_insert_sum_item_or_add_to_if_already_exists(
+                        PathKeyElementInfo::PathKeyElement::<0>((
+                            path.clone(),
+                            key_time_ms.to_be_bytes().to_vec(),
+                            Element::new_sum_item(amount),
+                        )),
+                        BatchInsertApplyType::StatefulBatchInsert,
+                        Some(&transaction),
+                        &mut drive_operations,
+                        &platform_version.drive,
+                    )
+                    .expect("expected to insert the entry");
+                platform
+                    .drive
+                    .apply_batch_low_level_drive_operations(
+                        None,
+                        Some(&transaction),
+                        drive_operations,
+                        &mut vec![],
+                        &platform_version.drive,
+                    )
+                    .expect("expected to apply the entry");
+            }
+        }
+
+        platform
+            .cleanup_expired_locks_of_withdrawal_amounts_v1(
+                &BlockInfo {
+                    time_ms: now_ms,
+                    height: 100,
+                    core_height: 10,
+                    epoch: Epoch::default(),
+                },
+                &transaction,
+                platform_version,
+            )
+            .expect("expected the cleanup to succeed");
+
+        for path in [
+            get_withdrawal_transactions_sum_tree_path_vec(),
+            get_withdrawal_credit_inflows_sum_tree_path_vec(),
+        ] {
+            let mut query = Query::new();
+            query.insert_all();
+            let (results, _) = platform
+                .drive
+                .grove_get_raw_path_query(
+                    &PathQuery::new(path, SizedQuery::new(query, None, None)),
+                    Some(&transaction),
+                    drive::grovedb::query_result_type::QueryResultType::QueryKeyElementPairResultType,
+                    &mut vec![],
+                    &platform_version.drive,
+                )
+                .expect("expected to query the tree");
+            let keys: Vec<_> = results
+                .to_key_elements()
+                .into_iter()
+                .map(|(key, _)| key)
+                .collect();
+            // The entry exactly at the block time is not expired yet (strict `<`).
+            assert_eq!(keys, vec![now_ms.to_be_bytes().to_vec()]);
+        }
+    }
+}
diff --git a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/mod.rs
index 830c468fd3e..5f4d3b6f3ea 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/mod.rs
@@ -5,5 +5,6 @@ pub(in crate::execution) mod dequeue_and_build_unsigned_withdrawal_transactions;
 pub(in crate::execution) mod fetch_transactions_block_inclusion_status;
 pub(in crate::execution) mod pool_withdrawals_into_transactions_queue;
 pub(in crate::execution) mod rebroadcast_expired_withdrawal_documents;
+pub(in crate::execution) mod record_credit_inflows_for_withdrawals;
 pub(in crate::execution) mod record_total_credits_history_for_withdrawals;
 pub(in crate::execution) mod update_broadcasted_withdrawal_statuses;
diff --git a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/mod.rs
new file mode 100644
index 00000000000..6a699fc146b
--- /dev/null
+++ b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/mod.rs
@@ -0,0 +1,51 @@
+mod v0;
+
+use crate::error::execution::ExecutionError;
+use crate::error::Error;
+use crate::platform_types::platform::Platform;
+use crate::rpc::core::CoreRPCLike;
+use dpp::block::block_info::BlockInfo;
+use dpp::fee::Credits;
+use dpp::version::PlatformVersion;
+use drive::grovedb::Transaction;
+
+impl<C> Platform<C>
+where
+    C: CoreRPCLike,
+{
+    /// Records the credits this block minted into Platform (asset locks funding state
+    /// transitions, and the epoch Core block rewards on an epoch change) as a credit inflow
+    /// the net daily withdrawal limit adds to its daily maximum, so money that entered
+    /// Platform within the window may leave again without consuming the withdrawal budget of
+    /// other users.
+    ///
+    /// Runs as a system event once per block, so nobody pays fees for the write; a block that
+    /// minted nothing writes nothing.
+    pub(in crate::execution) fn record_credit_inflows_for_withdrawals(
+        &self,
+        credit_mints: Credits,
+        block_info: &BlockInfo,
+        transaction: &Transaction,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        match platform_version
+            .drive_abci
+            .methods
+            .withdrawals
+            .record_credit_inflows_for_withdrawals
+        {
+            None => Ok(()),
+            Some(0) => self.record_credit_inflows_for_withdrawals_v0(
+                credit_mints,
+                block_info,
+                transaction,
+                platform_version,
+            ),
+            Some(version) => Err(Error::Execution(ExecutionError::UnknownVersionMismatch {
+                method: "record_credit_inflows_for_withdrawals".to_string(),
+                known_versions: vec![0],
+                received: version,
+            })),
+        }
+    }
+}
diff --git a/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/v0/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/v0/mod.rs
new file mode 100644
index 00000000000..789f8cf5542
--- /dev/null
+++ b/packages/rs-drive-abci/src/execution/platform_events/withdrawals/record_credit_inflows_for_withdrawals/v0/mod.rs
@@ -0,0 +1,121 @@
+use crate::error::Error;
+use crate::platform_types::platform::Platform;
+use crate::rpc::core::CoreRPCLike;
+use dpp::block::block_info::BlockInfo;
+use dpp::fee::Credits;
+use dpp::version::PlatformVersion;
+use drive::grovedb::Transaction;
+
+impl<C> Platform<C>
+where
+    C: CoreRPCLike,
+{
+    /// Delegates to `Drive::record_credit_inflow`, which records nothing for a zero amount.
+    pub(super) fn record_credit_inflows_for_withdrawals_v0(
+        &self,
+        credit_mints: Credits,
+        block_info: &BlockInfo,
+        transaction: &Transaction,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        self.drive
+            .record_credit_inflow(
+                credit_mints,
+                block_info,
+                Some(transaction),
+                platform_version,
+            )
+            .map_err(Error::Drive)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::test::helpers::setup::TestPlatformBuilder;
+    use dpp::block::block_info::BlockInfo;
+    use dpp::block::epoch::Epoch;
+    use dpp::dash_to_credits;
+    use dpp::version::PlatformVersion;
+    use drive::drive::identity::withdrawals::paths::{
+        get_withdrawal_root_path, WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+    };
+    use drive::util::grove_operations::DirectQueryType;
+
+    /// The event records the block's mints in the credit inflows sum tree, accumulating
+    /// within a block time, and records nothing for a block that minted nothing.
+    #[test]
+    fn should_record_the_blocks_mints_and_skip_zero() {
+        let platform = TestPlatformBuilder::new()
+            .with_latest_protocol_version()
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+        let platform_version = PlatformVersion::latest();
+        let transaction = platform.drive.grove.start_transaction();
+
+        let block_info = BlockInfo {
+            time_ms: 1_000_000,
+            height: 100,
+            core_height: 10,
+            epoch: Epoch::default(),
+        };
+
+        let inflows = |transaction: &_| {
+            platform
+                .drive
+                .grove_get_sum_tree_total_value(
+                    (&get_withdrawal_root_path()).into(),
+                    &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+                    DirectQueryType::StatefulDirectQuery,
+                    Some(transaction),
+                    &mut vec![],
+                    &platform_version.drive,
+                )
+                .expect("expected the inflows sum")
+        };
+
+        platform
+            .record_credit_inflows_for_withdrawals(0, &block_info, &transaction, platform_version)
+            .expect("expected to record nothing");
+        assert_eq!(inflows(&transaction), 0);
+
+        platform
+            .record_credit_inflows_for_withdrawals(
+                dash_to_credits!(3),
+                &block_info,
+                &transaction,
+                platform_version,
+            )
+            .expect("expected to record");
+        platform
+            .record_credit_inflows_for_withdrawals(
+                dash_to_credits!(2),
+                &block_info,
+                &transaction,
+                platform_version,
+            )
+            .expect("expected to add to the same entry");
+
+        assert_eq!(inflows(&transaction), dash_to_credits!(5) as i64);
+    }
+
+    /// Before protocol version 14 the version slot is `None` and the event does nothing.
+    #[test]
+    fn should_do_nothing_before_the_feature_exists() {
+        let platform = TestPlatformBuilder::new()
+            .with_initial_protocol_version(13)
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+        let platform_version =
+            PlatformVersion::get(13).expect("expected to get platform version 13");
+        let transaction = platform.drive.grove.start_transaction();
+
+        platform
+            .record_credit_inflows_for_withdrawals(
+                dash_to_credits!(3),
+                &BlockInfo::default(),
+                &transaction,
+                platform_version,
+            )
+            .expect("expected the event to be a no-op before v14");
+    }
+}
diff --git a/packages/rs-drive-abci/src/execution/types/processed_block_fees_outcome/v0/mod.rs b/packages/rs-drive-abci/src/execution/types/processed_block_fees_outcome/v0/mod.rs
index 08f88c5c666..14b6937b58e 100644
--- a/packages/rs-drive-abci/src/execution/types/processed_block_fees_outcome/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/types/processed_block_fees_outcome/v0/mod.rs
@@ -10,6 +10,10 @@ pub struct ProcessedBlockFeesOutcome {
     pub payouts: Option<proposer_payouts::v0::ProposersPayouts>,
     /// A number of epochs which had refunded
     pub refunded_epochs_count: Option<u16>,
+    /// The credits the applied batch minted into Platform (the epoch Core block rewards, on an
+    /// epoch change): the fee-processing share of the block's credit inflow, recorded for the
+    /// net daily withdrawal limit
+    pub credit_mints: dpp::fee::Credits,
 }
 
 impl fmt::Display for ProcessedBlockFeesOutcome {
@@ -26,12 +30,13 @@ impl fmt::Display for ProcessedBlockFeesOutcome {
         )?;
         writeln!(
             f,
-            "    refunded_epochs_count: {}",
+            "    refunded_epochs_count: {},",
             match self.refunded_epochs_count {
                 Some(count) => count.to_string(),
                 None => "None".to_string(),
             }
         )?;
+        writeln!(f, "    credit_mints: {}", self.credit_mints)?;
         write!(f, "}}")
     }
 }
@@ -54,12 +59,14 @@ mod tests {
                 paid_epoch_index: 5,
             }),
             refunded_epochs_count: Some(2),
+            credit_mints: 5000,
         };
         let output = format!("{}", outcome);
         assert!(output.contains("ProcessedBlockFeesOutcome"));
         assert!(output.contains("fees_in_pools:"));
         assert!(output.contains("proposers_paid_count: 3"));
         assert!(output.contains("refunded_epochs_count: 2"));
+        assert!(output.contains("credit_mints: 5000"));
     }
 
     #[test]
@@ -71,9 +78,11 @@ mod tests {
             },
             payouts: None,
             refunded_epochs_count: None,
+            credit_mints: 0,
         };
         let output = format!("{}", outcome);
         assert!(output.contains("payouts: None"));
+        assert!(output.contains("credit_mints: 0"));
         assert!(output.contains("refunded_epochs_count: None"));
     }
 }
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v0/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v0/mod.rs
index 384aa8781fe..ffe9cbe7b20 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v0/mod.rs
@@ -248,6 +248,7 @@ pub(super) fn create_domain_data_trigger_v0(
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // todo: deal with cost of this operation
@@ -339,6 +340,7 @@ pub(super) fn create_domain_data_trigger_v0(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // todo: deal with cost of this operation
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v1/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v1/mod.rs
index 06fec8661c2..17ee3e1b21c 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v1/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/dpns/v1/mod.rs
@@ -241,6 +241,7 @@ pub(super) fn create_domain_data_trigger_v1(
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // Diff vs `_v0` (parent-domain query):
@@ -354,6 +355,7 @@ pub(super) fn create_domain_data_trigger_v1(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // Diff vs `_v0` (preorder query): same change as above. `_v0`
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v0/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v0/mod.rs
index ccf7a81837f..0f399d63ff9 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v0/mod.rs
@@ -77,6 +77,7 @@ pub(super) fn delete_withdrawal_data_trigger_v0(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // todo: deal with cost of this operation
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v1/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v1/mod.rs
index 66c14377bdc..13d59b238f6 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v1/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/data_triggers/triggers/withdrawals/v1/mod.rs
@@ -71,6 +71,7 @@ pub(super) fn delete_withdrawal_data_trigger_v1(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // Diff vs `_v0` (withdrawal-document lookup):
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/state/v0/fetch_documents.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/state/v0/fetch_documents.rs
index 8a5b5a7d41b..b8f3b475887 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/state/v0/fetch_documents.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/state/v0/fetch_documents.rs
@@ -122,6 +122,7 @@ fn fetch_documents_for_transitions_knowing_contract_and_document_type_v0(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // todo: deal with cost of this operation
@@ -182,6 +183,7 @@ fn fetch_documents_for_transitions_knowing_contract_and_document_type_v1(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // Diff vs `_v0`: epoch is `Some(...)` and the cost is billed via
@@ -307,6 +309,7 @@ fn fetch_document_with_id_v0(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // todo: deal with cost of this operation
@@ -369,6 +372,7 @@ fn fetch_document_with_id_v1(
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     // Diff vs `_v0`: epoch is `Some(...)` and the cost is billed via
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/deletion.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/deletion.rs
index f69dfbaf868..2a14056d93e 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/deletion.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/deletion.rs
@@ -10,7 +10,27 @@ mod deletion_tests {
     async fn test_document_delete_on_document_type_that_is_mutable_and_can_be_deleted() {
         run_document_delete_on_document_type_that_is_mutable_and_can_be_deleted_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            1699160,
+            // v14: the deleted document carries the contract-version stamp
+            // (one stored byte, five estimated), shifting processing costs
+            1699620,
+        )
+        .await;
+    }
+
+    /// PROTOCOL_VERSION_13: fee predating every v14 change on this path —
+    /// both the contract-version stamp and the dashpay payment-address
+    /// contract (#4380), whose v2 schema is gated behind
+    /// `SYSTEM_DATA_CONTRACT_VERSIONS_V3` (v14 only; v13 genesis stores
+    /// dashpay v1, so its smaller node shifts the byte-billed contracts-
+    /// subtree reads). That gate is why this value is below the pre-stamp
+    /// v14 baseline by more than the stamp bytes — and this pin is what
+    /// fails if the gate ever leaks into v13. Pinned so v13 chain history
+    /// stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_delete_on_document_type_that_is_mutable_and_can_be_deleted_protocol_version_13(
+    ) {
+        run_document_delete_on_document_type_that_is_mutable_and_can_be_deleted_at_protocol_version(
+            13, 1678920,
         )
         .await;
     }
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/dpns.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/dpns.rs
index 7a94babf225..f6528d6afad 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/dpns.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/dpns.rs
@@ -456,6 +456,7 @@ mod dpns_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let documents = platform
@@ -503,6 +504,7 @@ mod dpns_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let documents = platform
@@ -911,6 +913,7 @@ mod dpns_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let documents = platform
@@ -945,6 +948,7 @@ mod dpns_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let documents = platform
@@ -1178,6 +1182,7 @@ mod dpns_username_transfer_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         platform
@@ -1273,6 +1278,7 @@ mod dpns_username_transfer_tests {
             limit: None,
             prove: false,
             drive_config: &platform.config.drive,
+            resolved_time_ranges: vec![],
         };
 
         match platform
@@ -1316,6 +1322,7 @@ mod dpns_username_transfer_tests {
             limit: None,
             prove: false,
             drive_config: &platform.config.drive,
+            resolved_time_ranges: vec![],
         };
 
         match platform
@@ -1359,6 +1366,7 @@ mod dpns_username_transfer_tests {
             limit: None,
             prove: false,
             drive_config: &platform.config.drive,
+            resolved_time_ranges: vec![],
         };
 
         match platform
@@ -1426,6 +1434,7 @@ mod dpns_username_transfer_tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         platform
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/mod.rs
index 714a696d900..06546a41465 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/mod.rs
@@ -4,6 +4,7 @@ mod dpns;
 mod nft;
 mod ranked_group_drain;
 mod replacement;
+mod required_since;
 mod transfer;
 
 use super::*;
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/ranked_group_drain.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/ranked_group_drain.rs
index 10ada3042f7..fb5226372ea 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/ranked_group_drain.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/ranked_group_drain.rs
@@ -75,21 +75,42 @@ fn ranked_count_groups(
     path: &[Vec<u8>],
     platform_version: &PlatformVersion,
 ) -> Vec<(u64, String)> {
-    let path_refs: Vec<&[u8]> = path.iter().map(|v| v.as_slice()).collect();
-    platform
+    use drive::grovedb::query_result_type::QueryResultType;
+    use drive::grovedb::{AxisKeys, PathQuery, PathQueryRun};
+
+    let path_query = PathQuery::new_axis(
+        path.to_vec(),
+        drive::grovedb_query::AxisQuery::top_k(
+            drive::grovedb_query::IndexAxis::Count,
+            100,
+            0,
+            true,
+        )
+        .keys_only(),
+    );
+    let run = platform
         .drive
         .grove
-        .indexed_count_top_k(
-            path_refs.as_slice(),
-            100,
+        .run_path_query(
+            &path_query,
+            true,
+            true,
             true,
+            QueryResultType::QueryKeyElementPairResultType,
             None,
             &platform_version.drive.grove_version,
         )
         .unwrap()
-        .expect("the ranked count read must succeed")
+        .expect("the ranked count read must succeed");
+    let PathQueryRun::AxisKeys {
+        keys: AxisKeys::Count(pairs),
+        ..
+    } = run
+    else {
+        panic!("expected a keys-only count page, got {run:?}");
+    };
+    pairs
         .into_iter()
-        .map(|entry| entry.key_pair())
         .map(|(count, key)| {
             (
                 count,
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/replacement.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/replacement.rs
index 9cf7dacdab0..8429b932fea 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/replacement.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/replacement.rs
@@ -333,11 +333,27 @@ mod replacement_tests {
     async fn test_document_replace_on_document_type_that_is_mutable() {
         run_document_replace_on_document_type_that_is_mutable_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            1432760,
+            // v14: replaced documents carry the contract-version stamp
+            1433220,
         )
         .await;
     }
 
+    /// PROTOCOL_VERSION_13: fee predating every v14 change on this path —
+    /// both the contract-version stamp and the dashpay payment-address
+    /// contract (#4380), whose v2 schema is gated behind
+    /// `SYSTEM_DATA_CONTRACT_VERSIONS_V3` (v14 only; v13 genesis stores
+    /// dashpay v1, so its smaller node shifts the byte-billed contracts-
+    /// subtree reads). That gate is why this value is below the pre-stamp
+    /// v14 baseline by more than the stamp bytes — and this pin is what
+    /// fails if the gate ever leaks into v13. Pinned so v13 chain history
+    /// stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_replace_on_document_type_that_is_mutable_protocol_version_13() {
+        run_document_replace_on_document_type_that_is_mutable_at_protocol_version(13, 1411320)
+            .await;
+    }
+
     /// PROTOCOL_VERSION_11: pre-B7 happy-path fee — transformer's local
     /// execution context was dropped, so per-transition grovedb reads
     /// were not billed. Pinned so v11 chain history stays bit-for-bit
@@ -1037,11 +1053,21 @@ mod replacement_tests {
     async fn test_document_replace_on_document_type_that_is_not_mutable() {
         run_document_replace_on_document_type_that_is_not_mutable_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            460920,
+            460940, // v14: stamped documents (see happy-path baseline note)
         )
         .await;
     }
 
+    /// PROTOCOL_VERSION_13: pre-stamp fee — document serialization format 3
+    /// (the contract-version stamp) activates at v14, so v13 costs must be
+    /// exactly what they were before the `requiredSince` changes. Pinned so
+    /// v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_replace_on_document_type_that_is_not_mutable_protocol_version_13() {
+        run_document_replace_on_document_type_that_is_not_mutable_at_protocol_version(13, 460920)
+            .await;
+    }
+
     /// PROTOCOL_VERSION_11: pre-fix bump-only fee (no charge for the fetch
     /// + validation work). Pinned so v11 chain history stays bit-for-bit
     /// reproducible.
@@ -1293,6 +1319,20 @@ mod replacement_tests {
     async fn test_document_replace_on_document_type_that_is_not_mutable_but_is_transferable() {
         run_document_replace_on_document_type_that_is_not_mutable_but_is_transferable_at_protocol_version(
             PlatformVersion::latest().protocol_version,
+            457680, // v14: stamped documents (see happy-path baseline note)
+        )
+        .await;
+    }
+
+    /// PROTOCOL_VERSION_13: pre-stamp fee — document serialization format 3
+    /// (the contract-version stamp) activates at v14, so v13 costs must be
+    /// exactly what they were before the `requiredSince` changes. Pinned so
+    /// v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_replace_on_document_type_that_is_not_mutable_but_is_transferable_protocol_version_13(
+    ) {
+        run_document_replace_on_document_type_that_is_not_mutable_but_is_transferable_at_protocol_version(
+            13,
             457660,
         )
         .await;
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/required_since.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/required_since.rs
new file mode 100644
index 00000000000..211bddb97bf
--- /dev/null
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/required_since.rs
@@ -0,0 +1,782 @@
+//! End-to-end coverage for `requiredSince`: a contract update adds a new
+//! required property, and every document lifecycle op runs through real
+//! state-transition processing before and after — proving grandfathered
+//! documents keep working, new writes are held to the new schema, and the
+//! contract-version stamp is assigned, preserved, and refreshed where the
+//! design says it must be.
+
+use super::*;
+
+mod required_since_tests {
+    use super::*;
+    use crate::platform_types::platform_state::PlatformState;
+    use crate::rpc::core::MockCoreRPCLike;
+    use crate::test::helpers::setup::TempPlatform;
+    use dpp::data_contract::accessors::v0::DataContractV0Setters;
+    use dpp::data_contract::schema::DataContractSchemaMethodsV0;
+    use dpp::document::Document;
+    use dpp::identity::identity_public_key::accessors::v0::IdentityPublicKeyGettersV0;
+    use dpp::platform_value::platform_value;
+    use dpp::prelude::DataContract;
+    use dpp::state_transition::data_contract_update_transition::methods::DataContractUpdateTransitionMethodsV0;
+    use dpp::state_transition::data_contract_update_transition::DataContractUpdateTransition;
+    use dpp::state_transition::StateTransition;
+    use dpp::tests::fixtures::get_data_contract_fixture;
+    use drive::util::storage_flags::StorageFlags;
+
+    /// The full grandfathering story, in order:
+    /// 1. contract v1 with a `note` document type (one required property);
+    /// 2. two documents created — both stamped with contract version 1;
+    /// 3. the update to v2 adds required `extra` with `requiredSince: 2`;
+    /// 4. a create omitting `extra` is consensus-rejected, one carrying it is
+    ///    accepted and stamped 2;
+    /// 5. the grandfathered documents — which do not have `extra` — still
+    ///    transfer (stamp 1 preserved through the server-side rewrite) and
+    ///    still delete;
+    /// 6. replacing a grandfathered document must supply `extra` (rejected
+    ///    without it) and re-stamps it to 2 — the lazy migration path.
+    #[tokio::test]
+    async fn test_contract_update_adding_required_field_grandfathers_existing_documents() {
+        let platform_version = PlatformVersion::latest();
+        let mut platform = TestPlatformBuilder::new()
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+        let platform_state = platform.state.load();
+
+        let (identity, signer, key) = setup_identity(&mut platform, 958, dash_to_credits!(0.5));
+        let (receiver, receiver_signer, receiver_key) =
+            setup_identity(&mut platform, 450, dash_to_credits!(0.5));
+
+        // ------------------------------------------------------------------
+        // Contract v1: `note` has a single required property `message`
+        // ------------------------------------------------------------------
+        let mut contract =
+            get_data_contract_fixture(Some(identity.id()), 0, platform_version.protocol_version)
+                .data_contract_owned();
+
+        let note_schema_v1 = platform_value!({
+            "type": "object",
+            "documentsMutable": true,
+            "canBeDeleted": true,
+            "transferable": 1,
+            "properties": {
+                "message": {"type": "string", "position": 0, "maxLength": 100_u32},
+            },
+            "required": ["message"],
+            "additionalProperties": false
+        });
+
+        contract
+            .set_document_schema(
+                "note",
+                note_schema_v1,
+                true,
+                &mut Vec::new(),
+                platform_version,
+            )
+            .expect("expected to add the note document type");
+
+        platform
+            .drive
+            .apply_contract(
+                &contract,
+                BlockInfo::default(),
+                true,
+                StorageFlags::optional_default_as_cow(),
+                None,
+                platform_version,
+            )
+            .expect("expected to apply contract");
+
+        let note_type_v1 = contract
+            .document_type_for_name("note")
+            .expect("expected the note document type");
+
+        let mut rng = StdRng::seed_from_u64(433);
+
+        // ------------------------------------------------------------------
+        // Two documents under contract v1 — the grandfathered generation
+        // ------------------------------------------------------------------
+        let mut grandfathered = Vec::new();
+        for (nonce, seed_text) in [(1, "first note"), (2, "second note")] {
+            let entropy = Bytes32::random_with_rng(&mut rng);
+            let mut document = note_type_v1
+                .random_document_with_identifier_and_entropy(
+                    &mut rng,
+                    identity.id(),
+                    entropy,
+                    DocumentFieldFillType::DoNotFillIfNotRequired,
+                    DocumentFieldFillSize::AnyDocumentFillSize,
+                    platform_version,
+                )
+                .expect("expected a random document");
+            document.set("message", seed_text.into());
+
+            let transition = BatchTransition::new_document_creation_transition_from_document(
+                document.clone(),
+                note_type_v1,
+                entropy.0,
+                &key,
+                nonce,
+                0,
+                None,
+                &signer,
+                platform_version,
+                None,
+            )
+            .await
+            .expect("expected a creation transition");
+
+            let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+            assert_matches!(
+                result,
+                StateTransitionExecutionResult::SuccessfulExecution { .. },
+                "creating a document under contract v1 must succeed"
+            );
+            grandfathered.push(document);
+        }
+
+        let stored = query_notes(&platform, &contract, platform_version);
+        assert_eq!(stored.len(), 2);
+        for document in &stored {
+            assert_eq!(
+                document.contract_version(),
+                Some(1),
+                "documents created under contract v1 must be stamped 1"
+            );
+        }
+
+        // ------------------------------------------------------------------
+        // The update: v2 adds required `extra` with `requiredSince: 2`
+        // ------------------------------------------------------------------
+        let note_schema_v2 = platform_value!({
+            "type": "object",
+            "documentsMutable": true,
+            "canBeDeleted": true,
+            "transferable": 1,
+            "properties": {
+                "message": {"type": "string", "position": 0, "maxLength": 100_u32},
+                "extra": {"type": "string", "position": 1, "maxLength": 50_u32, "requiredSince": 2},
+            },
+            "required": ["message", "extra"],
+            "additionalProperties": false
+        });
+
+        let mut updated_contract = contract.clone();
+        updated_contract.set_version(2);
+        updated_contract
+            .set_document_schema(
+                "note",
+                note_schema_v2,
+                true,
+                &mut Vec::new(),
+                platform_version,
+            )
+            .expect("expected to update the note document type");
+
+        let update_transition = DataContractUpdateTransition::new_from_data_contract(
+            updated_contract.clone(),
+            &identity.clone().into_partial_identity_info(),
+            key.id(),
+            3,
+            0,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected an update transition");
+
+        let result = process_and_commit_serialized(
+            &mut platform,
+            &platform_state,
+            update_transition
+                .serialize_to_bytes()
+                .expect("expected serialized update"),
+        )
+        .await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "adding a required property with requiredSince = new version must be accepted"
+        );
+
+        let note_type_v2 = updated_contract
+            .document_type_for_name("note")
+            .expect("expected the updated note document type");
+
+        // ------------------------------------------------------------------
+        // New creates: without `extra` rejected, with it accepted + stamped 2
+        // ------------------------------------------------------------------
+        let entropy = Bytes32::random_with_rng(&mut rng);
+        let mut incomplete = note_type_v2
+            .random_document_with_identifier_and_entropy(
+                &mut rng,
+                identity.id(),
+                entropy,
+                DocumentFieldFillType::DoNotFillIfNotRequired,
+                DocumentFieldFillSize::AnyDocumentFillSize,
+                platform_version,
+            )
+            .expect("expected a random document");
+        incomplete.set("message", "no extra".into());
+        incomplete.remove("extra");
+
+        let transition = BatchTransition::new_document_creation_transition_from_document(
+            incomplete,
+            note_type_v2,
+            entropy.0,
+            &key,
+            4,
+            0,
+            None,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a creation transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::PaidConsensusError { ref error, .. }
+                if error.to_string().contains("extra"),
+            "a create missing the newly required property must be consensus-rejected"
+        );
+
+        let entropy = Bytes32::random_with_rng(&mut rng);
+        let mut complete = note_type_v2
+            .random_document_with_identifier_and_entropy(
+                &mut rng,
+                identity.id(),
+                entropy,
+                DocumentFieldFillType::DoNotFillIfNotRequired,
+                DocumentFieldFillSize::AnyDocumentFillSize,
+                platform_version,
+            )
+            .expect("expected a random document");
+        complete.set("message", "with extra".into());
+        complete.set("extra", "present".into());
+        let complete_id = complete.id();
+
+        let transition = BatchTransition::new_document_creation_transition_from_document(
+            complete,
+            note_type_v2,
+            entropy.0,
+            &key,
+            5,
+            0,
+            None,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a creation transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "a create carrying the newly required property must succeed"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version);
+        let stored_complete = stored
+            .iter()
+            .find(|d| d.id() == complete_id)
+            .expect("expected the new document to be stored");
+        assert_eq!(
+            stored_complete.contract_version(),
+            Some(2),
+            "documents created under contract v2 must be stamped 2"
+        );
+
+        // ------------------------------------------------------------------
+        // Grandfathered transfer: succeeds, stamp 1 preserved untouched
+        // ------------------------------------------------------------------
+        let transferred_id = grandfathered[0].id();
+        let mut to_transfer = grandfathered[0].clone();
+        to_transfer.set_revision(Some(2));
+        let transition = BatchTransition::new_document_transfer_transition_from_document(
+            to_transfer,
+            note_type_v2,
+            receiver.id(),
+            &key,
+            6,
+            0,
+            None,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a transfer transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "a grandfathered document without the new property must stay transferable"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version);
+        let transferred = stored
+            .iter()
+            .find(|d| d.id() == transferred_id)
+            .expect("expected the transferred document to be stored");
+        assert_eq!(
+            transferred.owner_id(),
+            receiver.id(),
+            "the transfer must have moved ownership"
+        );
+        assert_eq!(
+            transferred.contract_version(),
+            Some(1),
+            "a transfer re-serializes the fetched document without touching it, \
+             so the stamp must stay at the version its bytes conform to"
+        );
+        assert!(
+            !transferred.properties().contains_key("extra"),
+            "the grandfathered document must still omit the new property"
+        );
+
+        // ------------------------------------------------------------------
+        // Grandfathered replace: must supply `extra`, and re-stamps to 2
+        // ------------------------------------------------------------------
+        let mut replacement_missing_extra = grandfathered[1].clone();
+        replacement_missing_extra.set_revision(Some(2));
+        replacement_missing_extra.set("message", "still no extra".into());
+
+        let transition = BatchTransition::new_document_replacement_transition_from_document(
+            replacement_missing_extra,
+            note_type_v2,
+            &key,
+            7,
+            0,
+            None,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a replacement transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::PaidConsensusError { ref error, .. }
+                if error.to_string().contains("extra"),
+            "a replace re-supplies full content, so it must carry the newly required property"
+        );
+
+        let replaced_id = grandfathered[1].id();
+        let mut replacement = grandfathered[1].clone();
+        replacement.set_revision(Some(2));
+        replacement.set("message", "migrated".into());
+        replacement.set("extra", "now present".into());
+
+        let transition = BatchTransition::new_document_replacement_transition_from_document(
+            replacement,
+            note_type_v2,
+            &key,
+            8,
+            0,
+            None,
+            &signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a replacement transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "a replace carrying the newly required property must succeed"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version);
+        let replaced = stored
+            .iter()
+            .find(|d| d.id() == replaced_id)
+            .expect("expected the replaced document to be stored");
+        assert_eq!(
+            replaced.contract_version(),
+            Some(2),
+            "a replace re-supplies content, so the document must be re-stamped — lazy migration"
+        );
+        assert_eq!(
+            replaced
+                .properties()
+                .get_str("extra")
+                .expect("expected the migrated property"),
+            "now present"
+        );
+
+        // ------------------------------------------------------------------
+        // Grandfathered delete: the transferred stamp-1 document still deletes
+        // ------------------------------------------------------------------
+        let mut to_delete = grandfathered[0].clone();
+        to_delete.set_owner_id(receiver.id());
+
+        let transition = BatchTransition::new_document_deletion_transition_from_document(
+            to_delete,
+            note_type_v2,
+            &receiver_key,
+            1,
+            0,
+            None,
+            &receiver_signer,
+            platform_version,
+            None,
+        )
+        .await
+        .expect("expected a deletion transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "a grandfathered document must stay deletable under the new schema"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version);
+        assert!(
+            stored.iter().all(|d| d.id() != transferred_id),
+            "the deleted document must be gone"
+        );
+    }
+
+    /// The protocol-upgrade boundary: a document written at protocol v13
+    /// (serialization format 2, no stamp) keeps working after the chain
+    /// upgrades to v14 and the contract gains a required `requiredSince`
+    /// property — it transfers with no stamp acquired (its bytes predate
+    /// every annotation), and replacing it re-stamps it at the current
+    /// contract version. This is the exact shape of mainnet data crossing
+    /// the v14 activation.
+    #[tokio::test]
+    async fn test_documents_created_at_v13_survive_the_v14_upgrade_and_required_field_update() {
+        let platform_version_13 = PlatformVersion::get(13).expect("expected protocol version 13");
+        let mut platform = TestPlatformBuilder::new()
+            .with_initial_protocol_version(13)
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+        let platform_state = platform.state.load();
+
+        let (identity, signer, key) = setup_identity(&mut platform, 958, dash_to_credits!(0.5));
+        let (receiver, receiver_signer, receiver_key) =
+            setup_identity(&mut platform, 450, dash_to_credits!(0.5));
+
+        // Contract v1 at protocol v13 — no requiredSince anywhere (the v13
+        // meta-schema does not admit the keyword)
+        let mut contract =
+            get_data_contract_fixture(Some(identity.id()), 0, platform_version_13.protocol_version)
+                .data_contract_owned();
+
+        let note_schema_v1 = platform_value!({
+            "type": "object",
+            "documentsMutable": true,
+            "canBeDeleted": true,
+            "transferable": 1,
+            "properties": {
+                "message": {"type": "string", "position": 0, "maxLength": 100_u32},
+            },
+            "required": ["message"],
+            "additionalProperties": false
+        });
+
+        contract
+            .set_document_schema(
+                "note",
+                note_schema_v1,
+                true,
+                &mut Vec::new(),
+                platform_version_13,
+            )
+            .expect("expected to add the note document type");
+
+        platform
+            .drive
+            .apply_contract(
+                &contract,
+                BlockInfo::default(),
+                true,
+                StorageFlags::optional_default_as_cow(),
+                None,
+                platform_version_13,
+            )
+            .expect("expected to apply contract");
+
+        let note_type_v1 = contract
+            .document_type_for_name("note")
+            .expect("expected the note document type");
+
+        let mut rng = StdRng::seed_from_u64(433);
+
+        // A document written at protocol v13: serialization format 2, no stamp
+        let entropy = Bytes32::random_with_rng(&mut rng);
+        let mut document = note_type_v1
+            .random_document_with_identifier_and_entropy(
+                &mut rng,
+                identity.id(),
+                entropy,
+                DocumentFieldFillType::DoNotFillIfNotRequired,
+                DocumentFieldFillSize::AnyDocumentFillSize,
+                platform_version_13,
+            )
+            .expect("expected a random document");
+        document.set("message", "written at v13".into());
+        let document_id = document.id();
+
+        let transition = BatchTransition::new_document_creation_transition_from_document(
+            document.clone(),
+            note_type_v1,
+            entropy.0,
+            &key,
+            1,
+            0,
+            None,
+            &signer,
+            platform_version_13,
+            None,
+        )
+        .await
+        .expect("expected a creation transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "creating a document at protocol v13 must succeed"
+        );
+
+        let stored = query_notes(&platform, &contract, platform_version_13);
+        assert_eq!(stored.len(), 1);
+        assert_eq!(
+            stored[0].contract_version(),
+            None,
+            "a document written before serialization format 3 carries no stamp"
+        );
+
+        // ------------------------------------------------------------------
+        // The chain upgrades to protocol v14
+        // ------------------------------------------------------------------
+        let mut upgraded_state = platform.state.load().as_ref().clone();
+        upgraded_state.set_current_protocol_version_in_consensus(14);
+        upgraded_state.set_next_epoch_protocol_version(14);
+        platform.state.store(std::sync::Arc::new(upgraded_state));
+        let platform_state = platform.state.load();
+        let platform_version_14 = PlatformVersion::get(14).expect("expected protocol version 14");
+
+        // The contract update adding required `extra` now goes through
+        let note_schema_v2 = platform_value!({
+            "type": "object",
+            "documentsMutable": true,
+            "canBeDeleted": true,
+            "transferable": 1,
+            "properties": {
+                "message": {"type": "string", "position": 0, "maxLength": 100_u32},
+                "extra": {"type": "string", "position": 1, "maxLength": 50_u32, "requiredSince": 2},
+            },
+            "required": ["message", "extra"],
+            "additionalProperties": false
+        });
+
+        let mut updated_contract = contract.clone();
+        updated_contract.set_version(2);
+        updated_contract
+            .set_document_schema(
+                "note",
+                note_schema_v2,
+                true,
+                &mut Vec::new(),
+                platform_version_14,
+            )
+            .expect("expected to update the note document type");
+
+        let update_transition = DataContractUpdateTransition::new_from_data_contract(
+            updated_contract.clone(),
+            &identity.clone().into_partial_identity_info(),
+            key.id(),
+            2,
+            0,
+            &signer,
+            platform_version_14,
+            None,
+        )
+        .await
+        .expect("expected an update transition");
+
+        let result = process_and_commit_serialized(
+            &mut platform,
+            &platform_state,
+            update_transition
+                .serialize_to_bytes()
+                .expect("expected serialized update"),
+        )
+        .await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "the requiredSince update must be accepted after the upgrade"
+        );
+
+        let note_type_v2 = updated_contract
+            .document_type_for_name("note")
+            .expect("expected the updated note document type");
+
+        // The format-2 document transfers at v14: rewritten in format 3 but
+        // still unstamped — its bytes predate every annotation
+        let mut to_transfer = document.clone();
+        to_transfer.set_revision(Some(2));
+        let transition = BatchTransition::new_document_transfer_transition_from_document(
+            to_transfer,
+            note_type_v2,
+            receiver.id(),
+            &key,
+            3,
+            0,
+            None,
+            &signer,
+            platform_version_14,
+            None,
+        )
+        .await
+        .expect("expected a transfer transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "a pre-upgrade document must stay transferable at v14"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version_14);
+        let transferred = stored
+            .iter()
+            .find(|d| d.id() == document_id)
+            .expect("expected the transferred document");
+        assert_eq!(transferred.owner_id(), receiver.id());
+        assert_eq!(
+            transferred.contract_version(),
+            None,
+            "a transfer must not stamp a document whose bytes predate format 3"
+        );
+        assert!(!transferred.properties().contains_key("extra"));
+
+        // Replacing it re-supplies content and re-stamps — lazy migration
+        // across the upgrade boundary
+        let mut replacement = document.clone();
+        replacement.set_owner_id(receiver.id());
+        replacement.set_revision(Some(3));
+        replacement.set("message", "migrated after upgrade".into());
+        replacement.set("extra", "now present".into());
+
+        let transition = BatchTransition::new_document_replacement_transition_from_document(
+            replacement,
+            note_type_v2,
+            &receiver_key,
+            1,
+            0,
+            None,
+            &receiver_signer,
+            platform_version_14,
+            None,
+        )
+        .await
+        .expect("expected a replacement transition");
+
+        let result = process_and_commit(&mut platform, &platform_state, &transition).await;
+        assert_matches!(
+            result,
+            StateTransitionExecutionResult::SuccessfulExecution { .. },
+            "replacing a pre-upgrade document with the new property must succeed"
+        );
+
+        let stored = query_notes(&platform, &updated_contract, platform_version_14);
+        let replaced = stored
+            .iter()
+            .find(|d| d.id() == document_id)
+            .expect("expected the replaced document");
+        assert_eq!(
+            replaced.contract_version(),
+            Some(2),
+            "the replace must stamp the pre-upgrade document at the current contract version"
+        );
+        assert_eq!(
+            replaced
+                .properties()
+                .get_str("extra")
+                .expect("expected the migrated property"),
+            "now present"
+        );
+    }
+
+    async fn process_and_commit(
+        platform: &mut TempPlatform<MockCoreRPCLike>,
+        platform_state: &PlatformState,
+        transition: &StateTransition,
+    ) -> StateTransitionExecutionResult {
+        process_and_commit_serialized(
+            platform,
+            platform_state,
+            transition
+                .serialize_to_bytes()
+                .expect("expected serialized transition"),
+        )
+        .await
+    }
+
+    async fn process_and_commit_serialized(
+        platform: &mut TempPlatform<MockCoreRPCLike>,
+        platform_state: &PlatformState,
+        serialized: Vec<u8>,
+    ) -> StateTransitionExecutionResult {
+        let platform_version = platform_state
+            .current_platform_version()
+            .expect("expected the current platform version");
+        let transaction = platform.drive.grove.start_transaction();
+        let processing_result = platform
+            .platform
+            .process_raw_state_transitions(
+                &[serialized],
+                platform_state,
+                &BlockInfo::default(),
+                &transaction,
+                platform_version,
+                false,
+                None,
+            )
+            .expect("expected to process the state transition");
+        platform
+            .drive
+            .grove
+            .commit_transaction(transaction)
+            .unwrap()
+            .expect("expected to commit the transaction");
+        processing_result.into_execution_results().remove(0)
+    }
+
+    fn query_notes(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Vec<Document> {
+        let query = DriveDocumentQuery::from_sql_expr(
+            "select * from note",
+            contract,
+            Some(&platform.config.drive),
+            platform_version,
+        )
+        .expect("expected a document query");
+        platform
+            .drive
+            .query_documents(query, None, false, None, None)
+            .expect("expected a query result")
+            .documents()
+            .to_vec()
+    }
+}
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/transfer.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/transfer.rs
index cd03d32a7c5..e8f51ec6344 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/transfer.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/document/transfer.rs
@@ -498,7 +498,20 @@ mod transfer_tests {
     async fn test_document_transfer_on_document_type_that_is_transferable() {
         run_document_transfer_on_document_type_that_is_transferable_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            3643400,
+            // v14: transferred documents carry the contract-version stamp
+            3643860,
+        )
+        .await;
+    }
+
+    /// PROTOCOL_VERSION_13: pre-stamp fee — document serialization format 3
+    /// (the contract-version stamp) activates at v14, so v13 costs must be
+    /// exactly what they were before the `requiredSince` changes. Pinned so
+    /// v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_transfer_on_document_type_that_is_transferable_protocol_version_13() {
+        run_document_transfer_on_document_type_that_is_transferable_at_protocol_version(
+            13, 3643400,
         )
         .await;
     }
@@ -1478,11 +1491,20 @@ mod transfer_tests {
     async fn test_document_delete_after_transfer() {
         run_document_delete_after_transfer_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            4004260,
+            4004720, // v14: stamped documents (see transferable baseline note)
         )
         .await;
     }
 
+    /// PROTOCOL_VERSION_13: pre-stamp fee — document serialization format 3
+    /// (the contract-version stamp) activates at v14, so v13 costs must be
+    /// exactly what they were before the `requiredSince` changes. Pinned so
+    /// v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_document_delete_after_transfer_protocol_version_13() {
+        run_document_delete_after_transfer_at_protocol_version(13, 4004260).await;
+    }
+
     /// PROTOCOL_VERSION_11: pre-B4 fee — query_documents cost was discarded.
     /// Pinned so v11 chain history stays bit-for-bit reproducible.
     #[tokio::test]
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/burn/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/burn/mod.rs
index 5fba3b44ec7..32d40c65338 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/burn/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/burn/mod.rs
@@ -3958,7 +3958,22 @@ mod token_burn_tests {
         // sizes and therefore the byte-billed group-action contract reads.
         run_token_burn_group_action_confirmer_fee_includes_transformer_reads_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            4_367_880,
+            // PROTOCOL_VERSION_14: +400 — genesis system documents now carry
+            // the contract-version stamp, shifting byte-billed subtree reads
+            4_368_280,
+        )
+        .await;
+    }
+
+    /// PROTOCOL_VERSION_13: pre-stamp fee — genesis system documents are not
+    /// stamped before document serialization format 3 (v14), so v13 costs
+    /// must be exactly what they were before the `requiredSince` changes.
+    /// Pinned so v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_token_burn_group_action_confirmer_fee_includes_transformer_reads_protocol_version_13(
+    ) {
+        run_token_burn_group_action_confirmer_fee_includes_transformer_reads_at_protocol_version(
+            13, 4_367_880,
         )
         .await;
     }
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/direct_selling/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/direct_selling/mod.rs
index 2fe0cb1727c..11451ddcbae 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/direct_selling/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/batch/tests/token/direct_selling/mod.rs
@@ -24,11 +24,23 @@ mod token_selling_tests {
         // sizes and therefore the byte-billed contract reads.
         run_successful_direct_purchase_single_price_at_protocol_version(
             PlatformVersion::latest().protocol_version,
-            699_868_073_580,
+            // PROTOCOL_VERSION_14: 27_400 credits more in fees — genesis system
+            // documents now carry the contract-version stamp, shifting
+            // byte-billed subtree reads
+            699_868_046_180,
         )
         .await;
     }
 
+    /// PROTOCOL_VERSION_13: pre-stamp buyer balance — genesis system documents
+    /// are not stamped before document serialization format 3 (v14), so v13
+    /// costs must be exactly what they were before the `requiredSince`
+    /// changes. Pinned so v13 chain history stays bit-for-bit reproducible.
+    #[tokio::test]
+    async fn test_successful_direct_purchase_single_price_protocol_version_13() {
+        run_successful_direct_purchase_single_price_at_protocol_version(13, 699_868_073_580).await;
+    }
+
     /// PROTOCOL_VERSION_11: pre-B4/B7 buyer balance — query_documents +
     /// transformer-phase reads were dropped, so the buyer paid 7,900
     /// credits less in fees. Pinned so v11 chain history stays
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/mod.rs
index 008be12cc67..4598692d1d6 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/mod.rs
@@ -1,2 +1,3 @@
 pub(crate) mod v0;
 pub(crate) mod v1;
+pub(crate) mod v2;
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/v2/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/v2/mod.rs
new file mode 100644
index 00000000000..b8c12c7c0c2
--- /dev/null
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/basic_structure/v2/mod.rs
@@ -0,0 +1,181 @@
+use crate::error::Error;
+use dpp::consensus::basic::data_contract::DataContractInvalidRequiredFieldsUpdateError;
+use dpp::dashcore::Network;
+use dpp::state_transition::data_contract_create_transition::accessors::DataContractCreateTransitionAccessorsV0;
+use dpp::state_transition::data_contract_create_transition::DataContractCreateTransition;
+use dpp::validation::SimpleConsensusValidationResult;
+use dpp::version::PlatformVersion;
+
+use super::v1::DataContractCreateStateTransitionBasicStructureValidationV1;
+
+const PROPERTIES: &str = "properties";
+const REQUIRED_SINCE: &str = "requiredSince";
+
+pub(in crate::execution::validation::state_transition::state_transitions::data_contract_create) trait DataContractCreateStateTransitionBasicStructureValidationV2
+{
+    fn validate_basic_structure_v2(
+        &self,
+        network_type: Network,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, Error>;
+}
+
+impl DataContractCreateStateTransitionBasicStructureValidationV2 for DataContractCreateTransition {
+    fn validate_basic_structure_v2(
+        &self,
+        network_type: Network,
+        platform_version: &PlatformVersion,
+    ) -> Result<SimpleConsensusValidationResult, Error> {
+        // First run all v1 (and transitively v0) validations
+        let v1_result = self.validate_basic_structure_v1(network_type, platform_version)?;
+        if !v1_result.is_valid() {
+            return Ok(v1_result);
+        }
+
+        // `requiredSince` names the contract version a property is required
+        // from. A freshly created contract is version 1, so the only value
+        // that names an existing version is 1 (which is equivalent to plain
+        // membership in `required`). Later values would pre-schedule
+        // requiredness at a future version — coherent for the wire format,
+        // but banned: requiredness changes must arrive with the update that
+        // creates the version they name.
+        //
+        // This raw-JSON scan is an early, cheap rejection only — it cannot
+        // see an annotation reached through a `$defs` `$ref`. The
+        // authoritative enforcement is
+        // `validate_required_since_within_contract_version` in dpp, which
+        // runs on the *parsed* properties (references resolved) whenever the
+        // contract is built from its serialized form, including this
+        // transition's transform into action.
+        for (document_type_name, schema) in self.data_contract().document_schemas() {
+            let Some(properties) = schema
+                .get_optional_value(PROPERTIES)
+                .ok()
+                .flatten()
+                .and_then(|properties| properties.as_map())
+            else {
+                continue;
+            };
+
+            for (property_name, property_schema) in properties {
+                let Some(required_since) = property_schema
+                    .as_map()
+                    .and_then(|map| {
+                        map.iter()
+                            .find(|(key, _)| key.as_text() == Some(REQUIRED_SINCE))
+                    })
+                    .and_then(|(_, value)| value.as_integer::<u32>())
+                else {
+                    continue;
+                };
+
+                if required_since != 1 {
+                    return Ok(SimpleConsensusValidationResult::new_with_error(
+                        DataContractInvalidRequiredFieldsUpdateError::new(
+                            document_type_name.clone(),
+                            format!(
+                                "property '{}' of a newly created contract cannot carry requiredSince {} — a fresh contract is version 1",
+                                property_name.as_text().unwrap_or_default(),
+                                required_since
+                            ),
+                        )
+                        .into(),
+                    ));
+                }
+            }
+        }
+
+        Ok(SimpleConsensusValidationResult::new())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use assert_matches::assert_matches;
+    use dpp::consensus::basic::BasicError;
+    use dpp::consensus::ConsensusError;
+    use dpp::platform_value::platform_value;
+    use dpp::prelude::IdentityNonce;
+    use dpp::state_transition::data_contract_create_transition::DataContractCreateTransitionV0;
+    use dpp::tests::fixtures::get_data_contract_fixture;
+    use platform_version::version::PlatformVersion;
+    use platform_version::TryIntoPlatformVersioned;
+
+    fn create_transition_with_required_since(
+        required_since: u32,
+    ) -> (DataContractCreateTransition, &'static PlatformVersion) {
+        let platform_version = PlatformVersion::latest();
+        let identity_nonce = IdentityNonce::default();
+
+        let data_contract =
+            get_data_contract_fixture(None, identity_nonce, platform_version.protocol_version)
+                .data_contract_owned();
+
+        let mut data_contract_for_serialization: dpp::data_contract::serialized_version::DataContractInSerializationFormat = data_contract
+            .try_into_platform_versioned(platform_version)
+            .expect("failed to convert data contract");
+
+        data_contract_for_serialization
+            .document_schemas_mut()
+            .insert(
+                "note".to_string(),
+                platform_value!({
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "position": 0,
+                            "maxLength": 60,
+                            "requiredSince": required_since,
+                        }
+                    },
+                    "required": ["message"],
+                    "additionalProperties": false
+                }),
+            );
+
+        let transition: DataContractCreateTransition = DataContractCreateTransitionV0 {
+            data_contract: data_contract_for_serialization,
+            identity_nonce,
+            user_fee_increase: 0,
+            signature_public_key_id: 0,
+            signature: Default::default(),
+        }
+        .into();
+
+        (transition, platform_version)
+    }
+
+    #[test]
+    fn should_accept_required_since_of_one_on_a_new_contract() {
+        let (transition, platform_version) = create_transition_with_required_since(1);
+
+        let result = transition
+            .validate_basic_structure_v2(Network::Testnet, platform_version)
+            .expect("failed to validate basic structure");
+
+        assert!(
+            result.is_valid(),
+            "requiredSince 1 on a fresh contract is equivalent to plain \
+             required and must be accepted, got {:?}",
+            result.errors
+        );
+    }
+
+    #[test]
+    fn should_reject_required_since_above_one_on_a_new_contract() {
+        let (transition, platform_version) = create_transition_with_required_since(2);
+
+        let result = transition
+            .validate_basic_structure_v2(Network::Testnet, platform_version)
+            .expect("failed to validate basic structure");
+
+        assert_matches!(
+            result.errors.as_slice(),
+            [ConsensusError::BasicError(
+                BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+            )] if e.details().contains("cannot carry requiredSince 2")
+        );
+    }
+}
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/mod.rs
index 253cb58f71d..f9fce859481 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/mod.rs
@@ -6,6 +6,7 @@ mod state;
 use advanced_structure::v1::DataContractCreatedStateTransitionAdvancedStructureValidationV1;
 use basic_structure::v0::DataContractCreateStateTransitionBasicStructureValidationV0;
 use basic_structure::v1::DataContractCreateStateTransitionBasicStructureValidationV1;
+use basic_structure::v2::DataContractCreateStateTransitionBasicStructureValidationV2;
 use dpp::address_funds::PlatformAddress;
 use dpp::block::block_info::BlockInfo;
 use dpp::dashcore::Network;
@@ -99,14 +100,15 @@ impl StateTransitionBasicStructureValidationV0 for DataContractCreateTransition
         {
             Some(0) => self.validate_basic_structure_v0(network_type, platform_version),
             Some(1) => self.validate_basic_structure_v1(network_type, platform_version),
+            Some(2) => self.validate_basic_structure_v2(network_type, platform_version),
             Some(version) => Err(Error::Execution(ExecutionError::UnknownVersionMismatch {
                 method: "data contract create transition: validate_basic_structure".to_string(),
-                known_versions: vec![0, 1],
+                known_versions: vec![0, 1, 2],
                 received: version,
             })),
             None => Err(Error::Execution(ExecutionError::VersionNotActive {
                 method: "data contract create transition: validate_basic_structure".to_string(),
-                known_versions: vec![0, 1],
+                known_versions: vec![0, 1, 2],
             })),
         }
     }
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/state/v0/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/state/v0/mod.rs
index dc72d28a481..cf445d8841c 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/state/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_create/state/v0/mod.rs
@@ -443,7 +443,7 @@ mod tests {
     use dpp::data_contract::accessors::v0::DataContractV0Getters;
     use dpp::data_contract::errors::DataContractError;
     use dpp::data_contract::serialized_version::DataContractInSerializationFormat;
-    use dpp::platform_value::Value;
+    use dpp::platform_value::{platform_value, Value};
     use dpp::prelude::IdentityNonce;
     use dpp::state_transition::data_contract_create_transition::DataContractCreateTransitionV0;
     use dpp::tests::fixtures::get_data_contract_fixture;
@@ -546,6 +546,109 @@ mod tests {
             assert!(!execution_context.operations_slice().is_empty());
         }
 
+        #[test]
+        fn should_return_invalid_result_when_required_since_reached_through_a_ref_exceeds_the_contract_version(
+        ) {
+            // The create-time basic-structure check scans only raw top-level
+            // property JSON, so a `requiredSince` annotation hidden behind
+            // `$ref` slips past it. Contract deserialization enforces the
+            // invariant on parsed properties instead, and its failure must be
+            // classified as a consensus error converted to a nonce bump —
+            // never as an execution error, which would abort processing.
+            let platform_version = PlatformVersion::latest();
+            let identity_nonce = IdentityNonce::default();
+
+            let platform = TestPlatformBuilder::new()
+                .build_with_mock_rpc()
+                .set_genesis_state();
+
+            let data_contract =
+                get_data_contract_fixture(None, identity_nonce, platform_version.protocol_version)
+                    .data_contract_owned();
+
+            let identity_id = data_contract.owner_id();
+
+            let mut data_contract_for_serialization = data_contract
+                .try_into_platform_versioned(platform_version)
+                .expect("failed to convert data contract");
+
+            let DataContractInSerializationFormat::V1(ref mut contract) =
+                data_contract_for_serialization
+            else {
+                panic!("expected serialization version 1")
+            };
+
+            contract
+                .schema_defs
+                .get_or_insert_with(Default::default)
+                .insert(
+                    "annotated".to_string(),
+                    platform_value!({
+                        "type": "string",
+                        "maxLength": 60_u32,
+                        "requiredSince": 2_u32,
+                    }),
+                );
+            contract.document_schemas.insert(
+                "note".to_string(),
+                platform_value!({
+                    "type": "object",
+                    "properties": {
+                        "message": {"$ref": "#/$defs/annotated", "position": 0_u32},
+                    },
+                    "required": ["message"],
+                    "additionalProperties": false
+                }),
+            );
+
+            let transition: DataContractCreateTransition = DataContractCreateTransitionV0 {
+                data_contract: data_contract_for_serialization,
+                identity_nonce,
+                user_fee_increase: 0,
+                signature_public_key_id: 0,
+                signature: Default::default(),
+            }
+            .into();
+
+            let mut execution_context =
+                StateTransitionExecutionContext::default_for_platform_version(platform_version)
+                    .expect("failed to create execution context");
+
+            let state = platform.state.load_full();
+
+            let platform_ref = PlatformRef {
+                drive: &platform.drive,
+                state: &state,
+                config: &platform.config,
+                core_rpc: &platform.core_rpc,
+            };
+
+            let result = transition
+                .validate_state_v0::<MockCoreRPCLike>(
+                    &platform_ref,
+                    &BlockInfo::default(),
+                    ValidationMode::Validator,
+                    None,
+                    &mut execution_context,
+                    platform_version,
+                )
+                .expect("failed to validate state");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.document_type() == "note"
+                    && e.details().contains("requiredSince 2 which exceeds the contract version 1")
+            );
+
+            assert_matches!(
+                result.data,
+                Some(StateTransitionAction::BumpIdentityNonceAction(action))
+                if action.identity_id() == identity_id && action.identity_nonce() == identity_nonce
+            );
+        }
+
         #[test]
         fn should_return_invalid_result_when_transform_into_action_failed_latest() {
             let platform_version = PlatformVersion::latest();
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/mod.rs
index 91344794871..179da4d0162 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/mod.rs
@@ -2600,6 +2600,7 @@ mod tests {
                 start_at: None,
                 start_at_included: false,
                 block_time_ms: None,
+                resolved_time_ranges: vec![],
             };
             query.internal_clauses.equal_clauses.insert(
                 "contractId".to_string(),
@@ -2982,6 +2983,7 @@ mod tests {
                 start_at: None,
                 start_at_included: false,
                 block_time_ms: None,
+                resolved_time_ranges: vec![],
             };
             query.internal_clauses.equal_clauses.insert(
                 "contractId".to_string(),
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/state/v0/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/state/v0/mod.rs
index 776ca42b7a1..e7a04348217 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/state/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/data_contract_update/state/v0/mod.rs
@@ -510,7 +510,7 @@ mod tests {
     use dpp::data_contract::accessors::v0::DataContractV0Setters;
     use dpp::data_contract::errors::DataContractError;
     use dpp::data_contract::serialized_version::DataContractInSerializationFormat;
-    use dpp::platform_value::Value;
+    use dpp::platform_value::{platform_value, Value};
     use dpp::prelude::IdentityNonce;
     use dpp::state_transition::data_contract_update_transition::DataContractUpdateTransitionV0;
     use dpp::tests::fixtures::get_data_contract_fixture;
@@ -606,6 +606,106 @@ mod tests {
             assert!(!execution_context.operations_slice().is_empty());
         }
 
+        #[test]
+        fn should_return_invalid_result_when_required_since_exceeds_the_contract_version() {
+            // Deserializing the updated contract enforces `requiredSince <=
+            // contract version` on parsed properties. That failure must be
+            // classified as a consensus error converted to a nonce bump —
+            // never as an execution error, which would abort processing.
+            let platform_version = PlatformVersion::latest();
+            let identity_contract_nonce = IdentityNonce::default();
+
+            let platform = TestPlatformBuilder::new()
+                .build_with_mock_rpc()
+                .set_genesis_state();
+
+            let data_contract = get_data_contract_fixture(
+                None,
+                identity_contract_nonce,
+                platform_version.protocol_version,
+            )
+            .data_contract_owned();
+
+            let identity_id = data_contract.owner_id();
+            let data_contract_id = data_contract.id();
+
+            let mut data_contract_for_serialization = data_contract
+                .try_into_platform_versioned(platform_version)
+                .expect("failed to convert data contract");
+
+            let DataContractInSerializationFormat::V1(ref mut contract) =
+                data_contract_for_serialization
+            else {
+                panic!("expected serialization version 1")
+            };
+
+            contract.document_schemas.insert(
+                "note".to_string(),
+                platform_value!({
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "position": 0_u32,
+                            "maxLength": 60_u32,
+                            "requiredSince": 99_u32,
+                        },
+                    },
+                    "required": ["message"],
+                    "additionalProperties": false
+                }),
+            );
+
+            let transition: DataContractUpdateTransition = DataContractUpdateTransitionV0 {
+                identity_contract_nonce,
+                data_contract: data_contract_for_serialization,
+                user_fee_increase: 0,
+                signature_public_key_id: 0,
+                signature: Default::default(),
+            }
+            .into();
+
+            let mut execution_context =
+                StateTransitionExecutionContext::default_for_platform_version(platform_version)
+                    .expect("failed to create execution context");
+
+            let state = platform.state.load_full();
+
+            let platform_ref = PlatformRef {
+                drive: &platform.drive,
+                state: &state,
+                config: &platform.config,
+                core_rpc: &platform.core_rpc,
+            };
+
+            let result = transition
+                .validate_state_v0::<MockCoreRPCLike>(
+                    &platform_ref,
+                    &BlockInfo::default(),
+                    ValidationMode::Validator,
+                    &mut execution_context,
+                    None,
+                    platform_version,
+                )
+                .expect("failed to validate state");
+
+            assert_matches!(
+                result.errors.as_slice(),
+                [ConsensusError::BasicError(
+                    BasicError::DataContractInvalidRequiredFieldsUpdateError(e)
+                )] if e.document_type() == "note"
+                    && e.details().contains("requiredSince 99 which exceeds the contract version 1")
+            );
+
+            assert_matches!(
+                result.data,
+                Some(StateTransitionAction::BumpIdentityDataContractNonceAction(action))
+                if action.identity_id() == identity_id
+                    && action.identity_contract_nonce() == identity_contract_nonce
+                    && action.data_contract_id() == data_contract_id
+            );
+        }
+
         #[test]
         fn should_return_invalid_result_when_data_contract_does_not_exist() {
             let platform_version = PlatformVersion::latest();
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_shielded_pool/tests.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_shielded_pool/tests.rs
index 885d176dbf2..8938fb57d54 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_shielded_pool/tests.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_shielded_pool/tests.rs
@@ -464,6 +464,7 @@ fn failure_path_charge_executes_through_execute_event() {
             &block_info,
             &transaction,
             None,
+            &mut 0,
             platform_version,
             &fee_versions,
         )
@@ -933,6 +934,7 @@ fn executed_transition_result_proof_roundtrips() {
             &block_info,
             &transaction,
             None,
+            &mut 0,
             platform_version,
             &fee_versions,
         )
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
index ce077429841..189293e46cd 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
@@ -385,6 +385,169 @@ mod tests {
         assert_eq!(identity_balance, 149993606160); // about 0.5 Dash starting balance + 1 Dash asset lock top up
     }
 
+    /// Regression for the proposer-side mint accounting: a minting transition (an asset-lock
+    /// top up) that executes but is then dropped from the proposal (`InternalError` ->
+    /// `TxAction::Removed`) has its GroveDB writes rolled back to the savepoint — its mint
+    /// must leave the block's credit-mint accumulator with them, or the block records a
+    /// credit inflow for a transition the proposal omits and validators re-executing the
+    /// proposal compute different state.
+    #[test]
+    fn test_identity_top_up_dropped_from_proposal_must_not_record_a_credit_mint() {
+        use crate::execution::platform_events::state_transition_processing::test_fault_injection::FAIL_NEXT_SUCCESSFUL_EXECUTION;
+        use crate::platform_types::state_transitions_processing_result::StateTransitionExecutionResult;
+
+        let platform_version = PlatformVersion::latest();
+        let platform_config = PlatformConfig {
+            testing_configs: PlatformTestConfig {
+                disable_instant_lock_signature_verification: true,
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+
+        let platform = TestPlatformBuilder::new()
+            .with_config(platform_config)
+            .build_with_mock_rpc()
+            .set_initial_state_structure();
+
+        let platform_state = platform.state.load();
+
+        let mut signer = SimpleSigner::default();
+
+        let mut rng = StdRng::seed_from_u64(567);
+
+        let (master_key, master_private_key) =
+            IdentityPublicKey::random_ecdsa_master_authentication_key(
+                0,
+                Some(58),
+                platform_version,
+            )
+            .expect("expected to get key pair");
+
+        signer.add_identity_public_key(master_key.clone(), master_private_key);
+
+        let (critical_public_key, private_key) =
+            IdentityPublicKey::random_ecdsa_critical_level_authentication_key(
+                1,
+                Some(999),
+                platform_version,
+            )
+            .expect("expected to get key pair");
+
+        let identity_already_in_system: Identity = IdentityV0 {
+            id: Identifier::random_with_rng(&mut rng),
+            public_keys: BTreeMap::from([
+                (0, master_key.clone()),
+                (1, critical_public_key.clone()),
+            ]),
+            balance: 50000000000,
+            revision: 0,
+        }
+        .into();
+
+        platform
+            .drive
+            .add_new_identity(
+                identity_already_in_system.clone(),
+                false,
+                &BlockInfo::default(),
+                true,
+                None,
+                platform_version,
+            )
+            .expect("expected to add a new identity");
+
+        signer.add_identity_public_key(critical_public_key.clone(), private_key);
+
+        let (_, pk) = ECDSA_SECP256K1
+            .random_public_and_private_key_data(&mut rng, platform_version)
+            .unwrap();
+
+        let asset_lock_proof = instant_asset_lock_proof_fixture(
+            Some(PrivateKey::from_byte_array(&pk, Network::Testnet).unwrap()),
+            None,
+        );
+
+        let identity_top_up_transition: StateTransition =
+            IdentityTopUpTransition::try_from_identity_with_private_key(
+                &identity_already_in_system,
+                asset_lock_proof,
+                pk.as_slice(),
+                0,
+                platform_version,
+                None,
+            )
+            .expect("expected an identity create transition");
+
+        let identity_top_up_serialized_transition = identity_top_up_transition
+            .serialize_to_bytes()
+            .expect("serialized state transition");
+
+        // Control: on a transaction we discard, the successful top up reports its asset-lock
+        // mint in the block's credit mints.
+        let control_transaction = platform.drive.grove.start_transaction();
+        let control_result = platform
+            .platform
+            .process_raw_state_transitions(
+                &vec![identity_top_up_serialized_transition.clone()],
+                &platform_state,
+                &BlockInfo::default(),
+                &control_transaction,
+                platform_version,
+                true,
+                None,
+            )
+            .expect("expected to process state transition");
+        assert_eq!(control_result.valid_count(), 1);
+        let expected_mint = control_result.credit_mints();
+        assert!(
+            expected_mint > 0,
+            "sanity: a successful asset-lock top up must report its mint"
+        );
+        platform
+            .drive
+            .grove
+            .rollback_transaction(&control_transaction)
+            .expect("expected to roll back the control transaction");
+        drop(control_transaction);
+
+        // Injected run while proposing: the top up executes, is overridden to the
+        // `InternalError` a post-apply failure would produce, and is rolled back to the
+        // savepoint. Its mint must roll back with it.
+        let transaction = platform.drive.grove.start_transaction();
+        FAIL_NEXT_SUCCESSFUL_EXECUTION.with(|flag| flag.set(true));
+        let processing_result = platform
+            .platform
+            .process_raw_state_transitions(
+                &vec![identity_top_up_serialized_transition.clone()],
+                &platform_state,
+                &BlockInfo::default(),
+                &transaction,
+                platform_version,
+                true,
+                None,
+            )
+            .expect("expected to process state transition");
+        assert!(
+            !FAIL_NEXT_SUCCESSFUL_EXECUTION.with(|flag| flag.get()),
+            "sanity: the injection must have been consumed (the top up must have executed \
+             successfully before being overridden)"
+        );
+        assert!(
+            matches!(
+                processing_result.execution_results().first(),
+                Some(StateTransitionExecutionResult::InternalError(_))
+            ),
+            "expected the injected InternalError"
+        );
+        assert_eq!(
+            processing_result.credit_mints(),
+            0,
+            "PHANTOM MINT: a transition dropped from the proposal left its mint in the \
+             block's credit-mint accumulator"
+        );
+    }
+
     #[test]
     fn test_identity_top_up_for_nonexistent_identity() {
         let platform_version = PlatformVersion::latest();
diff --git a/packages/rs-drive-abci/src/platform_types/state_transitions_processing_result/mod.rs b/packages/rs-drive-abci/src/platform_types/state_transitions_processing_result/mod.rs
index 4398ff07d31..1c26adde5f2 100644
--- a/packages/rs-drive-abci/src/platform_types/state_transitions_processing_result/mod.rs
+++ b/packages/rs-drive-abci/src/platform_types/state_transitions_processing_result/mod.rs
@@ -1,6 +1,7 @@
 use dpp::address_funds::PlatformAddress;
 use dpp::balances::credits::CreditOperation;
 use dpp::consensus::ConsensusError;
+use dpp::fee::Credits;
 use std::collections::BTreeMap;
 
 use crate::error::Error;
@@ -68,6 +69,7 @@ pub struct StateTransitionsProcessingResult {
     valid_count: usize,
     failed_count: usize,
     fees: FeeResult,
+    credit_mints: Credits,
 }
 
 impl StateTransitionsProcessingResult {
@@ -174,6 +176,18 @@ impl StateTransitionsProcessingResult {
         self.failed_count
     }
 
+    /// Sets the credits the block's applied state transitions minted into Platform
+    pub fn set_credit_mints(&mut self, credit_mints: Credits) {
+        self.credit_mints = credit_mints;
+    }
+
+    /// Returns the credits the block's applied state transitions minted into Platform
+    /// (their `AddToSystemCredits` operations): the state-transition share of the block's
+    /// credit inflow, recorded for the net daily withdrawal limit.
+    pub fn credit_mints(&self) -> Credits {
+        self.credit_mints
+    }
+
     /// Returns the aggregated fees
     pub fn aggregated_fees(&self) -> &FeeResult {
         &self.fees
diff --git a/packages/rs-drive-abci/src/query/document_query/v0/mod.rs b/packages/rs-drive-abci/src/query/document_query/v0/mod.rs
index 2bd36c1fad1..bb245961d83 100644
--- a/packages/rs-drive-abci/src/query/document_query/v0/mod.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v0/mod.rs
@@ -16,6 +16,7 @@ use dpp::platform_value::Value;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
 use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{DriveDocumentQuery, OrderClause, WhereClause};
 use drive::util::grove_operations::GroveDBToUse;
 
@@ -125,6 +126,9 @@ impl<C> Platform<C> {
             data_contract_id,
             document_type_name,
             where_clauses,
+            // The v0 wire has no time-range operator, so nothing on this path
+            // can carry a resolved bucket equality.
+            Vec::new(),
             order_by_clauses,
             // v0 wire's `uint32` limit: `0` is the sentinel for
             // "use server default"; `> u16::MAX` is rejected.
@@ -157,6 +161,7 @@ impl<C> Platform<C> {
         data_contract_id: Vec<u8>,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_by_clauses: Vec<OrderClause>,
         limit_u32: Option<u32>,
         prove: bool,
@@ -233,7 +238,7 @@ impl<C> Platform<C> {
             Some(n) => Some(n as u16),
         };
 
-        let drive_query =
+        let mut drive_query =
             check_validation_result_with_data!(DriveDocumentQuery::from_typed_clauses(
                 where_clauses,
                 order_by_clauses,
@@ -246,6 +251,11 @@ impl<C> Platform<C> {
                 &self.config.drive,
                 platform_version,
             ));
+        // Clause parsing cannot tell a resolved bucket equality from a
+        // hand-written one, so the provenance the v1 handler established is
+        // attached here; index selection reads it to pin the query to the
+        // index that buckets the field.
+        drive_query.resolved_time_ranges = resolved_time_ranges;
 
         let response = if prove {
             let proof =
@@ -644,6 +654,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let request = GetDocumentsRequestV0 {
@@ -717,6 +728,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let request = GetDocumentsRequestV0 {
@@ -802,6 +814,7 @@ mod tests {
             start_at: Some(after),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let request = GetDocumentsRequestV0 {
@@ -886,6 +899,7 @@ mod tests {
             let created_at = base_time + i * 20000;
             // Create a Document with the desired properties
             let random_document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::random_with_rng(&mut std_rng),
                 owner_id: Identifier::random_with_rng(&mut std_rng),
                 properties: {
@@ -973,6 +987,7 @@ mod tests {
             start_at: Some(after.to_buffer()),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let where_clauses = serialize_vec_to_cbor(
@@ -1052,6 +1067,7 @@ mod tests {
             let created_at = base_time + i * 20000;
             // Create a Document with the desired properties
             let random_document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::random_with_rng(&mut std_rng),
                 owner_id: Identifier::random_with_rng(&mut std_rng),
                 properties: {
@@ -1139,6 +1155,7 @@ mod tests {
             start_at: Some(after.to_buffer()),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let where_clauses = serialize_vec_to_cbor(
@@ -1218,6 +1235,7 @@ mod tests {
             let created_at = base_time + i * 20000;
             // Create a Document with the desired properties
             let random_document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::random_with_rng(&mut std_rng),
                 owner_id: Identifier::random_with_rng(&mut std_rng),
                 properties: {
@@ -1293,6 +1311,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let mut where_clauses: Vec<_> = drive_document_query
@@ -1377,6 +1396,7 @@ mod tests {
             let created_at = base_time + i * 20000;
             // Create a Document with the desired properties
             let random_document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::random_with_rng(&mut std_rng),
                 owner_id: Identifier::random_with_rng(&mut std_rng),
                 properties: {
@@ -1458,6 +1478,7 @@ mod tests {
             start_at: Some(after.to_buffer()),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let mut where_clauses: Vec<_> = drive_document_query
@@ -1551,6 +1572,7 @@ mod tests {
             let created_at = base_time + i * 20000;
             // Create a Document with the desired properties
             let random_document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::random_with_rng(&mut std_rng),
                 owner_id: Identifier::random_with_rng(&mut std_rng),
                 properties: {
@@ -1640,6 +1662,7 @@ mod tests {
             start_at: Some(after.to_buffer()),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let mut where_clauses: Vec<_> = drive_document_query
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/conversions.rs b/packages/rs-drive-abci/src/query/document_query/v1/conversions.rs
index fa5c4da140b..b608a7c9952 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/conversions.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/conversions.rs
@@ -36,9 +36,10 @@ use dapi_grpc::platform::v0::get_documents_request::{
     WhereOperator as ProtoWhereOperator,
 };
 use dpp::platform_value::Value;
+use drive::query::TimeRangeGridSpec;
 use drive::query::{
     HavingAggregate, HavingAggregateFunction, HavingClause, HavingOperator, HavingRightOperand,
-    OrderClause, SelectFunction, SelectProjection, WhereClause, WhereOperator,
+    OrderClause, SelectFunction, SelectProjection, TimeRangeSelector, WhereClause, WhereOperator,
 };
 
 /// Map a wire-level [`ProtoWhereOperator`] discriminant onto
@@ -49,7 +50,7 @@ use drive::query::{
 pub(super) fn where_operator_from_proto(op: i32) -> Result<WhereOperator, QueryError> {
     let proto_op = ProtoWhereOperator::try_from(op).map_err(|_| {
         QueryError::InvalidArgument(format!(
-            "unknown WhereOperator discriminant: {} (valid values: 0..=10, see \
+            "unknown WhereOperator discriminant: {} (valid values: 0..=11, see \
              `get_documents_request::WhereOperator`)",
             op
         ))
@@ -66,9 +67,127 @@ pub(super) fn where_operator_from_proto(op: i32) -> Result<WhereOperator, QueryE
         ProtoWhereOperator::BetweenExcludeRight => WhereOperator::BetweenExcludeRight,
         ProtoWhereOperator::In => WhereOperator::In,
         ProtoWhereOperator::StartsWith => WhereOperator::StartsWith,
+        // IN_TIME_RANGE is not an engine operator: it's resolved to a concrete
+        // equality from authoritative block time before clause conversion (see
+        // `is_time_range_clause` / `time_range_clause_from_proto`), so it must
+        // never reach this mapping.
+        ProtoWhereOperator::InTimeRange => {
+            return Err(QueryError::InvalidArgument(
+                "IN_TIME_RANGE where clauses are resolved from block time before \
+                 operator conversion and must not be mixed into normal clause decoding"
+                    .to_string(),
+            ))
+        }
     })
 }
 
+/// Whether a wire where clause is a time-range selection
+/// (`operator == IN_TIME_RANGE`). The v1 handler partitions these out and
+/// resolves them from authoritative block time via
+/// [`time_range_clause_from_proto`].
+pub(super) fn is_time_range_clause(clause: &ProtoWhereClause) -> bool {
+    clause.operator == ProtoWhereOperator::InTimeRange as i32
+}
+
+/// Decode an `IN_TIME_RANGE` wire where clause into its
+/// `(field, selector, grid)`. Two operand shapes:
+///
+/// - `DocumentFieldValue.text` — the bare selector (`"newest"` /
+///   `"oldest"`). Unambiguous only while exactly one grid buckets the
+///   field; the resolver rejects it otherwise.
+/// - `DocumentFieldValue.list` — `[text(selector), uint64(range),
+///   uint64(step)]` or `[…, uint64(phase)]`, naming one grid in the
+///   contract's own declared units (seconds). Required when several grids
+///   bucket the field. Like the contract grammar and the storage key, a
+///   zero phase is spelled by omission — the three-element form — so every
+///   grid has exactly one wire spelling.
+pub(super) fn time_range_clause_from_proto(
+    clause: ProtoWhereClause,
+) -> Result<(String, TimeRangeSelector, Option<TimeRangeGridSpec>), QueryError> {
+    let field = clause.field;
+    let parse_selector = |text: &str| {
+        TimeRangeSelector::from_string(text).ok_or_else(|| {
+            QueryError::InvalidArgument(format!(
+                "IN_TIME_RANGE selector must be \"newest\" or \"oldest\", got \"{}\"",
+                text
+            ))
+        })
+    };
+    match clause.value.and_then(|v| v.variant) {
+        Some(document_field_value::Variant::Text(selector_text)) => {
+            Ok((field, parse_selector(&selector_text)?, None))
+        }
+        Some(document_field_value::Variant::List(list)) => {
+            let mut values = list.values.into_iter();
+            let selector = match values.next().and_then(|v| v.variant) {
+                Some(document_field_value::Variant::Text(s)) => parse_selector(&s)?,
+                _ => {
+                    return Err(QueryError::InvalidArgument(format!(
+                        "IN_TIME_RANGE list operand on field '{}' must start with the \
+                         text selector \"newest\" or \"oldest\"",
+                        field
+                    )))
+                }
+            };
+            let mut grid_number = |name: &str| -> Result<u64, QueryError> {
+                match values.next().and_then(|v| v.variant) {
+                    Some(document_field_value::Variant::Uint64Value(n)) => Ok(n),
+                    _ => Err(QueryError::InvalidArgument(format!(
+                        "IN_TIME_RANGE list operand on field '{}' must carry the grid's \
+                         {} as a uint64 of seconds, exactly as the contract declares it",
+                        field, name
+                    ))),
+                }
+            };
+            let range_seconds = grid_number("range")?;
+            let step_seconds = grid_number("step")?;
+            let phase_seconds = match values.next() {
+                None => 0,
+                Some(v) => match v.variant {
+                    Some(document_field_value::Variant::Uint64Value(0)) => {
+                        return Err(QueryError::InvalidArgument(format!(
+                            "IN_TIME_RANGE list operand on field '{}': a zero phase is \
+                             spelled by omission (use the three-element form), so every \
+                             grid has exactly one wire spelling",
+                            field
+                        )))
+                    }
+                    Some(document_field_value::Variant::Uint64Value(n)) => n,
+                    _ => {
+                        return Err(QueryError::InvalidArgument(format!(
+                            "IN_TIME_RANGE list operand on field '{}' must carry the \
+                             grid's phase as a uint64 of seconds",
+                            field
+                        )))
+                    }
+                },
+            };
+            if values.next().is_some() {
+                return Err(QueryError::InvalidArgument(format!(
+                    "IN_TIME_RANGE list operand on field '{}' takes at most \
+                     [selector, range, step, phase]",
+                    field
+                )));
+            }
+            Ok((
+                field,
+                selector,
+                Some(TimeRangeGridSpec {
+                    range_seconds,
+                    step_seconds,
+                    phase_seconds,
+                }),
+            ))
+        }
+        _ => Err(QueryError::InvalidArgument(format!(
+            "IN_TIME_RANGE clause on field '{}' must carry either a text operand \
+             (\"newest\" / \"oldest\") or a list operand [selector, range, step] / \
+             [selector, range, step, phase] naming one of the field's grids",
+            field
+        ))),
+    }
+}
+
 /// Map a wire [`ProtoDocumentFieldValue`] onto a
 /// `dpp::platform_value::Value`. Schema-agnostic — variants map
 /// 1:1 by primitive type and recurse for `list` up to a depth of
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/average.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/average.rs
index 33a53487d65..f868ac9bc8a 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/average.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/average.rs
@@ -1,6 +1,7 @@
 //! `RoutingDecision::Average` — the grouped average surface.
 
 use super::super::not_yet_implemented;
+use super::super::PrefetchedContract;
 use crate::error::query::QueryError;
 use crate::error::Error;
 use crate::platform_types::platform::Platform;
@@ -17,10 +18,10 @@ use dapi_grpc::platform::v0::get_documents_response::{
 };
 use dpp::check_validation_result_with_data;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
-use dpp::identifier::Identifier;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
 use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{
     AverageEntry as DriveAverageEntry, AverageMode, CountMode, DocumentAverageRequest,
     DocumentAverageResponse, OrderClause, WhereClause,
@@ -43,9 +44,11 @@ impl<C> Platform<C> {
     #[allow(clippy::too_many_arguments)]
     pub(in crate::query::document_query::v1) fn dispatch_average_v1(
         &self,
+        prefetched_contract: PrefetchedContract,
         data_contract_id: Vec<u8>,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         start: Option<RequestV1Start>,
@@ -62,25 +65,15 @@ impl<C> Platform<C> {
             )));
         }
 
-        let contract_id: Identifier =
-            check_validation_result_with_data!(data_contract_id.try_into().map_err(|_| {
-                QueryError::InvalidArgument(
-                    "id must be a valid identifier (32 bytes long)".to_string(),
-                )
-            }));
-
-        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
-            contract_id.to_buffer(),
-            None,
-            true,
-            None,
-            platform_version,
-        )?;
-        let contract_fetch_info = check_validation_result_with_data!(contract_fetch_info.ok_or(
-            QueryError::Query(QuerySyntaxError::DataContractNotFound(
-                "contract not found when querying from value with contract info",
-            ))
-        ));
+        // The request's single contract fetch: reuse the time-range
+        // resolution's when it ran, fetch now otherwise — after the cheap
+        // shape guards above, so their rejections keep precedence.
+        let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+            .contract_for_aggregate_dispatch(
+                prefetched_contract,
+                data_contract_id,
+                platform_version
+            )?);
         let contract_ref = &contract_fetch_info.contract;
         let document_type = check_validation_result_with_data!(contract_ref
             .document_type_for_name(document_type_name.as_str())
@@ -102,6 +95,7 @@ impl<C> Platform<C> {
             document_type,
             sum_property,
             where_clauses,
+            resolved_time_ranges,
             order_clauses,
             mode: avg_mode,
             limit,
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/count.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/count.rs
index 7af8f56ef41..5f4f3c921dd 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/count.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/count.rs
@@ -2,6 +2,7 @@
 //! per-group entries).
 
 use super::super::not_yet_implemented;
+use super::super::PrefetchedContract;
 use crate::error::query::QueryError;
 use crate::error::Error;
 use crate::platform_types::platform::Platform;
@@ -17,10 +18,10 @@ use dapi_grpc::platform::v0::get_documents_response::{
 };
 use dpp::check_validation_result_with_data;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
-use dpp::identifier::Identifier;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
 use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{
     CountMode, DocumentCountRequest, DocumentCountResponse, OrderClause, SplitCountEntry,
     WhereClause,
@@ -39,9 +40,11 @@ impl<C> Platform<C> {
     #[allow(clippy::too_many_arguments)]
     pub(in crate::query::document_query::v1) fn dispatch_count_v1(
         &self,
+        prefetched_contract: PrefetchedContract,
         data_contract_id: Vec<u8>,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         start: Option<RequestV1Start>,
@@ -57,25 +60,15 @@ impl<C> Platform<C> {
             )));
         }
 
-        let contract_id: Identifier =
-            check_validation_result_with_data!(data_contract_id.try_into().map_err(|_| {
-                QueryError::InvalidArgument(
-                    "id must be a valid identifier (32 bytes long)".to_string(),
-                )
-            }));
-
-        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
-            contract_id.to_buffer(),
-            None,
-            true,
-            None,
-            platform_version,
-        )?;
-        let contract_fetch_info = check_validation_result_with_data!(contract_fetch_info.ok_or(
-            QueryError::Query(QuerySyntaxError::DataContractNotFound(
-                "contract not found when querying from value with contract info",
-            ))
-        ));
+        // The request's single contract fetch: reuse the time-range
+        // resolution's when it ran, fetch now otherwise — after the cheap
+        // shape guards above, so their rejections keep precedence.
+        let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+            .contract_for_aggregate_dispatch(
+                prefetched_contract,
+                data_contract_id,
+                platform_version
+            )?);
         let contract_ref = &contract_fetch_info.contract;
         let document_type = check_validation_result_with_data!(contract_ref
             .document_type_for_name(document_type_name.as_str())
@@ -88,6 +81,7 @@ impl<C> Platform<C> {
             contract: contract_ref,
             document_type,
             where_clauses,
+            resolved_time_ranges,
             order_clauses,
             mode,
             limit,
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/documents.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/documents.rs
index 9dd9419363c..c2cefc2ba3b 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/documents.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/documents.rs
@@ -13,6 +13,7 @@ use dapi_grpc::platform::v0::get_documents_response::{
     get_documents_response_v0, get_documents_response_v1, GetDocumentsResponseV1,
 };
 use dpp::version::PlatformVersion;
+use drive::query::ResolvedTimeRange;
 use drive::query::{OrderClause, WhereClause};
 
 impl<C> Platform<C> {
@@ -28,6 +29,7 @@ impl<C> Platform<C> {
         data_contract_id: Vec<u8>,
         document_type: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_by_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         start: Option<RequestV1Start>,
@@ -48,6 +50,7 @@ impl<C> Platform<C> {
             data_contract_id,
             document_type,
             where_clauses,
+            resolved_time_ranges,
             order_by_clauses,
             limit,
             prove,
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/having.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/having.rs
index eb561a62775..cc874ab9c40 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/having.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/having.rs
@@ -1,6 +1,7 @@
 //! `RoutingDecision::HavingRange` — the boolean-HAVING range
 //! surface (PV14).
 
+use super::super::PrefetchedContract;
 use super::{empty_ranking_proof_rejection, into_v1_ranked_entry};
 use crate::error::query::QueryError;
 use crate::error::Error;
@@ -17,10 +18,9 @@ use dapi_grpc::platform::v0::get_documents_response::{
 };
 use dpp::check_validation_result_with_data;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
-use dpp::identifier::Identifier;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
-use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{
     DocumentHavingRequest, DocumentHavingResponse, HavingClause, OrderClause, SelectProjection,
     WhereClause,
@@ -45,12 +45,14 @@ impl<C> Platform<C> {
     #[allow(clippy::too_many_arguments)]
     pub(in crate::query::document_query::v1) fn dispatch_having_v1(
         &self,
+        prefetched_contract: PrefetchedContract,
         data_contract_id: Vec<u8>,
         document_type_name: String,
         select: SelectProjection,
         group_by: Vec<String>,
         having: Vec<HavingClause>,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         offset: Option<u32>,
@@ -59,25 +61,15 @@ impl<C> Platform<C> {
         platform_state: &PlatformState,
         platform_version: &PlatformVersion,
     ) -> Result<QueryValidationResult<GetDocumentsResponseV1>, Error> {
-        let contract_id: Identifier =
-            check_validation_result_with_data!(data_contract_id.try_into().map_err(|_| {
-                QueryError::InvalidArgument(
-                    "id must be a valid identifier (32 bytes long)".to_string(),
-                )
-            }));
-
-        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
-            contract_id.to_buffer(),
-            None,
-            true,
-            None,
-            platform_version,
-        )?;
-        let contract_fetch_info = check_validation_result_with_data!(contract_fetch_info.ok_or(
-            QueryError::Query(QuerySyntaxError::DataContractNotFound(
-                "contract not found when querying from value with contract info",
-            ))
-        ));
+        // The request's single contract fetch: reuse the time-range
+        // resolution's when it ran, fetch now otherwise — after the cheap
+        // shape guards above, so their rejections keep precedence.
+        let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+            .contract_for_aggregate_dispatch(
+                prefetched_contract,
+                data_contract_id,
+                platform_version
+            )?);
         let contract_ref = &contract_fetch_info.contract;
         let document_type = check_validation_result_with_data!(contract_ref
             .document_type_for_name(document_type_name.as_str())
@@ -94,6 +86,7 @@ impl<C> Platform<C> {
             having: &having,
             order_by: &order_clauses,
             where_clauses: &where_clauses,
+            resolved_time_ranges: &resolved_time_ranges,
             limit,
             offset,
             has_start_at: start.is_some(),
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/mod.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/mod.rs
index 4c2d0315f48..4e2bbc216b2 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/mod.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/mod.rs
@@ -34,6 +34,10 @@ use drive::query::{RankedEntry as DriveRankedEntry, RankedEntryValue};
 /// silent about).
 fn into_v1_ranked_entry(e: DriveRankedEntry) -> RankedEntry {
     RankedEntry {
+        // Set exactly when the request carried an `IN` prefix pin —
+        // drive's merge tags entries with their branch, single-branch
+        // responses stay untagged.
+        in_key: e.in_key,
         key: e.key,
         value: Some(match e.value {
             RankedEntryValue::Count(count) => ranked_entry::Value::Count(count),
@@ -58,10 +62,11 @@ fn into_v1_ranked_entry(e: DriveRankedEntry) -> RankedEntry {
 /// proved**.
 ///
 /// **This is now a backstop rather than a live path.** The ranked
-/// prover moved to `prove_indexed_axis_top_k_paginated`, which emits a
-/// guaranteed-empty range against an empty axis secondary instead of
-/// refusing, so proving a ranking over a contract with no documents
-/// succeeds and the proved and unproven paths agree (pinned by
+/// prover moved to the paginated axis traversal (today through
+/// grovedb's unified `prove_query`), which emits a guaranteed-empty
+/// range against an empty axis secondary instead of refusing, so
+/// proving a ranking over a contract with no documents succeeds and
+/// the proved and unproven paths agree (pinned by
 /// `ranked_tests::proving_an_empty_ranking_succeeds`). The mapping is
 /// kept because the failure it recognizes is a *class* — a merk-level
 /// "cannot prove an empty tree" surfacing from somewhere in the
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/ranked.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/ranked.rs
index 2d75bc4b4f1..7c990672a96 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/ranked.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/ranked.rs
@@ -1,5 +1,6 @@
 //! `RoutingDecision::Ranked` — the ranked top-k surface (PV14).
 
+use super::super::PrefetchedContract;
 use super::{empty_ranking_proof_rejection, into_v1_ranked_entry};
 use crate::error::query::QueryError;
 use crate::error::Error;
@@ -16,10 +17,9 @@ use dapi_grpc::platform::v0::get_documents_response::{
 };
 use dpp::check_validation_result_with_data;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
-use dpp::identifier::Identifier;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
-use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{
     DocumentRankedRequest, DocumentRankedResponse, HavingClause, OrderClause, SelectProjection,
     WhereClause,
@@ -54,12 +54,14 @@ impl<C> Platform<C> {
     #[allow(clippy::too_many_arguments)]
     pub(in crate::query::document_query::v1) fn dispatch_ranked_v1(
         &self,
+        prefetched_contract: PrefetchedContract,
         data_contract_id: Vec<u8>,
         document_type_name: String,
         select: SelectProjection,
         group_by: Vec<String>,
         having: Vec<HavingClause>,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         offset: Option<u32>,
@@ -68,25 +70,15 @@ impl<C> Platform<C> {
         platform_state: &PlatformState,
         platform_version: &PlatformVersion,
     ) -> Result<QueryValidationResult<GetDocumentsResponseV1>, Error> {
-        let contract_id: Identifier =
-            check_validation_result_with_data!(data_contract_id.try_into().map_err(|_| {
-                QueryError::InvalidArgument(
-                    "id must be a valid identifier (32 bytes long)".to_string(),
-                )
-            }));
-
-        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
-            contract_id.to_buffer(),
-            None,
-            true,
-            None,
-            platform_version,
-        )?;
-        let contract_fetch_info = check_validation_result_with_data!(contract_fetch_info.ok_or(
-            QueryError::Query(QuerySyntaxError::DataContractNotFound(
-                "contract not found when querying from value with contract info",
-            ))
-        ));
+        // The request's single contract fetch: reuse the time-range
+        // resolution's when it ran, fetch now otherwise — after the cheap
+        // shape guards above, so their rejections keep precedence.
+        let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+            .contract_for_aggregate_dispatch(
+                prefetched_contract,
+                data_contract_id,
+                platform_version
+            )?);
         let contract_ref = &contract_fetch_info.contract;
         let document_type = check_validation_result_with_data!(contract_ref
             .document_type_for_name(document_type_name.as_str())
@@ -103,6 +95,7 @@ impl<C> Platform<C> {
             having: &having,
             order_by: &order_clauses,
             where_clauses: &where_clauses,
+            resolved_time_ranges: &resolved_time_ranges,
             limit,
             offset,
             has_start_at: start.is_some(),
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/sum.rs b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/sum.rs
index 5a495cef98d..b5fc7a064d1 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/dispatch/sum.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/dispatch/sum.rs
@@ -1,6 +1,7 @@
 //! `RoutingDecision::Sum` — the grouped sum surface.
 
 use super::super::not_yet_implemented;
+use super::super::PrefetchedContract;
 use crate::error::query::QueryError;
 use crate::error::Error;
 use crate::platform_types::platform::Platform;
@@ -16,10 +17,10 @@ use dapi_grpc::platform::v0::get_documents_response::{
 };
 use dpp::check_validation_result_with_data;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
-use dpp::identifier::Identifier;
 use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
 use drive::error::query::QuerySyntaxError;
+use drive::query::ResolvedTimeRange;
 use drive::query::{
     CountMode, DocumentSumRequest, DocumentSumResponse, OrderClause, SumEntry as DriveSumEntry,
     SumMode, WhereClause,
@@ -41,9 +42,11 @@ impl<C> Platform<C> {
     #[allow(clippy::too_many_arguments)]
     pub(in crate::query::document_query::v1) fn dispatch_sum_v1(
         &self,
+        prefetched_contract: PrefetchedContract,
         data_contract_id: Vec<u8>,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: Vec<ResolvedTimeRange>,
         order_clauses: Vec<OrderClause>,
         limit: Option<u32>,
         start: Option<RequestV1Start>,
@@ -60,25 +63,15 @@ impl<C> Platform<C> {
             )));
         }
 
-        let contract_id: Identifier =
-            check_validation_result_with_data!(data_contract_id.try_into().map_err(|_| {
-                QueryError::InvalidArgument(
-                    "id must be a valid identifier (32 bytes long)".to_string(),
-                )
-            }));
-
-        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
-            contract_id.to_buffer(),
-            None,
-            true,
-            None,
-            platform_version,
-        )?;
-        let contract_fetch_info = check_validation_result_with_data!(contract_fetch_info.ok_or(
-            QueryError::Query(QuerySyntaxError::DataContractNotFound(
-                "contract not found when querying from value with contract info",
-            ))
-        ));
+        // The request's single contract fetch: reuse the time-range
+        // resolution's when it ran, fetch now otherwise — after the cheap
+        // shape guards above, so their rejections keep precedence.
+        let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+            .contract_for_aggregate_dispatch(
+                prefetched_contract,
+                data_contract_id,
+                platform_version
+            )?);
         let contract_ref = &contract_fetch_info.contract;
         let document_type = check_validation_result_with_data!(contract_ref
             .document_type_for_name(document_type_name.as_str())
@@ -102,6 +95,7 @@ impl<C> Platform<C> {
             document_type,
             sum_property,
             where_clauses,
+            resolved_time_ranges,
             order_clauses,
             mode: sum_mode,
             limit,
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/mod.rs b/packages/rs-drive-abci/src/query/document_query/v1/mod.rs
index 4a7fe596e1c..58c227bff34 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/mod.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/mod.rs
@@ -31,6 +31,7 @@ mod conversions;
 mod dispatch;
 mod routing;
 
+use drive::query::ResolvedTimeRange;
 use routing::{reject_offset_off_the_ranked_path, validate_and_route};
 // Re-exported so `tests.rs` (a `use super::*` consumer) keeps seeing
 // the routing probe under its old name.
@@ -55,12 +56,19 @@ use crate::error::query::QueryError;
 use crate::error::Error;
 use crate::platform_types::platform::Platform;
 use crate::platform_types::platform_state::PlatformState;
+use crate::platform_types::platform_state::PlatformStateV0Methods;
 use crate::query::QueryValidationResult;
 use dapi_grpc::platform::v0::get_documents_request::GetDocumentsRequestV1;
 use dapi_grpc::platform::v0::get_documents_response::GetDocumentsResponseV1;
+use dpp::check_validation_result_with_data;
+use dpp::data_contract::accessors::v0::DataContractV0Getters as _;
+use dpp::prelude::Identifier as ContractIdentifier;
+use dpp::validation::ValidationResult;
 use dpp::version::PlatformVersion;
+use drive::drive::contract::DataContractFetchInfo;
 use drive::error::query::QuerySyntaxError;
-use drive::query::{CountMode, SelectProjection};
+use drive::query::{resolve_time_range_bucket_clause, CountMode, SelectProjection};
+use std::sync::Arc;
 
 /// Build a `QuerySyntaxError::Unsupported` carrying a stable
 /// "<feature> is not yet implemented" message. The wording is
@@ -75,6 +83,12 @@ pub(super) fn not_yet_implemented(feature: &str) -> QueryError {
     )))
 }
 
+/// The contract fetched once per request — by time-range resolution when
+/// the request carries an `IN_TIME_RANGE` clause — and handed to the
+/// aggregate dispatchers so they never fetch a second time.
+pub(in crate::query::document_query::v1) type PrefetchedContract =
+    Option<(ContractIdentifier, Arc<DataContractFetchInfo>)>;
+
 /// Outcome of `validate_and_route` — names the path the v1 request
 /// will dispatch to.
 ///
@@ -137,6 +151,64 @@ enum RoutingDecision {
 }
 
 impl<C> Platform<C> {
+    /// Parse the wire contract id and fetch the contract (through drive's
+    /// cache) with the uniform error mapping every v1 document route uses.
+    /// One fetch per request: time-range resolution and the aggregate
+    /// dispatch arms both consume this instead of carrying their own
+    /// copies of the parse → fetch → not-found sequence. The document-type
+    /// lookup stays at each consumer — it borrows from the returned `Arc`.
+    ///
+    /// Outer `Err` is an internal error; inner `Err` is the validation
+    /// error to hand back to the wire caller
+    /// (`check_validation_result_with_data!` unwraps the nesting).
+    #[allow(clippy::type_complexity)]
+    fn fetch_contract_for_document_query_v1(
+        &self,
+        data_contract_id: Vec<u8>,
+        platform_version: &PlatformVersion,
+    ) -> Result<Result<(ContractIdentifier, Arc<DataContractFetchInfo>), QueryError>, Error> {
+        let contract_id: ContractIdentifier = match data_contract_id.try_into() {
+            Ok(id) => id,
+            Err(_) => {
+                return Ok(Err(QueryError::InvalidArgument(
+                    "id must be a valid identifier (32 bytes long)".to_string(),
+                )))
+            }
+        };
+        let (_, contract_fetch_info) = self.drive.get_contract_with_fetch_info_and_fee(
+            contract_id.to_buffer(),
+            None,
+            true,
+            None,
+            platform_version,
+        )?;
+        let Some(contract_fetch_info) = contract_fetch_info else {
+            return Ok(Err(QueryError::Query(
+                QuerySyntaxError::DataContractNotFound("contract not found for a document query"),
+            )));
+        };
+        Ok(Ok((contract_id, contract_fetch_info)))
+    }
+
+    /// The contract an aggregate dispatch arm executes against: the
+    /// time-range resolution's fetch when it ran, one fetch now
+    /// otherwise. Called by each aggregate dispatcher AFTER its cheap
+    /// shape guards, so their rejections keep precedence over
+    /// contract-lookup errors. Same nested-`Result` contract as
+    /// [`Self::fetch_contract_for_document_query_v1`].
+    #[allow(clippy::type_complexity)]
+    pub(in crate::query::document_query::v1) fn contract_for_aggregate_dispatch(
+        &self,
+        prefetched: PrefetchedContract,
+        data_contract_id: Vec<u8>,
+        platform_version: &PlatformVersion,
+    ) -> Result<Result<(ContractIdentifier, Arc<DataContractFetchInfo>), QueryError>, Error> {
+        match prefetched {
+            Some(pair) => Ok(Ok(pair)),
+            None => self.fetch_contract_for_document_query_v1(data_contract_id, platform_version),
+        }
+    }
+
     pub(super) fn query_documents_v1(
         &self,
         request_v1: GetDocumentsRequestV1,
@@ -182,10 +254,98 @@ impl<C> Platform<C> {
         // `InvalidArgument` rather than being masked by the blanket
         // "not yet implemented", since malformed input is malformed
         // regardless of which capability would have handled it.
-        let where_clauses = match conversions::where_clauses_from_proto(proto_where_clauses) {
+        //
+        // Time-range (IN_TIME_RANGE) clauses are partitioned out first. They
+        // are resolved to concrete equality clauses on the bucketed source
+        // field using the authoritative committed block time, so the rest of
+        // the v1 pipeline (routing, executors, proofs) treats them as
+        // ordinary equality lookups. The verifier re-derives the same bucket
+        // from the quorum-signed response metadata time, so the proof
+        // matches.
+        // The `.any()` pre-check skips the two-Vec partition on the
+        // overwhelmingly common clause set with no time-range operator.
+        let (time_range_proto, normal_proto): (Vec<_>, Vec<_>) = if proto_where_clauses
+            .iter()
+            .any(conversions::is_time_range_clause)
+        {
+            proto_where_clauses
+                .into_iter()
+                .partition(conversions::is_time_range_clause)
+        } else {
+            (Vec::new(), proto_where_clauses)
+        };
+
+        let mut where_clauses = match conversions::where_clauses_from_proto(normal_proto) {
             Ok(c) => c,
             Err(e) => return Ok(QueryValidationResult::new_with_error(e)),
         };
+        let mut resolved_time_ranges: Vec<ResolvedTimeRange> = Vec::new();
+        // The contract fetched for time-range resolution, handed to the
+        // aggregate dispatchers below so a request fetches at most once.
+        let mut prefetched_contract: PrefetchedContract = None;
+
+        if !time_range_proto.is_empty() {
+            // LOAD-BEARING TIME SOURCE: the verifier re-derives the bucket
+            // from the response metadata's `time_ms`, which
+            // `response_metadata_v0` stamps from the state selected by
+            // `CheckpointUsed`. Reading `platform_state` here matches that
+            // only because every v1 document dispatch serves from
+            // `GroveDBToUse::Current`. If any document route ever serves
+            // from a checkpoint, this resolution must read the SAME state
+            // the response metadata will be built from, or every time-range
+            // proof will fail client-side verification.
+            let block_time_ms =
+                match platform_state.last_committed_block_time_ms() {
+                    Some(t) => t,
+                    None => return Ok(QueryValidationResult::new_with_error(QueryError::Query(
+                        QuerySyntaxError::Unsupported(
+                            "a time range (IN_TIME_RANGE) query requires a committed block time"
+                                .to_string(),
+                        ),
+                    ))),
+                };
+            let (contract_id, contract_fetch_info) = check_validation_result_with_data!(self
+                .fetch_contract_for_document_query_v1(
+                    data_contract_id.clone(),
+                    platform_version
+                )?);
+            let contract_ref = &contract_fetch_info.contract;
+            let doc_type = check_validation_result_with_data!(contract_ref
+                .document_type_for_name(document_type.as_str())
+                .map_err(|_| QueryError::InvalidArgument(format!(
+                    "document type {} not found for contract {}",
+                    document_type, contract_id
+                ))));
+            for proto_wc in time_range_proto {
+                let (field, selector, grid) =
+                    match conversions::time_range_clause_from_proto(proto_wc) {
+                        Ok(parsed) => parsed,
+                        Err(e) => return Ok(QueryValidationResult::new_with_error(e)),
+                    };
+                match resolve_time_range_bucket_clause(
+                    &field,
+                    selector,
+                    grid,
+                    doc_type,
+                    block_time_ms,
+                ) {
+                    Ok((clause, resolved)) => {
+                        where_clauses.push(clause);
+                        // The resolved clause is an ordinary equality; only
+                        // this list tells the executors that it must be
+                        // matched against bucket starts of the resolved
+                        // grid rather than raw timestamps (or another
+                        // grid's starts), so it travels with the request.
+                        resolved_time_ranges.push(resolved);
+                    }
+                    Err(drive::error::Error::Query(qe)) => {
+                        return Ok(QueryValidationResult::new_with_error(QueryError::Query(qe)))
+                    }
+                    Err(e) => return Err(e.into()),
+                }
+            }
+            prefetched_contract = Some((contract_id, contract_fetch_info));
+        }
         let order_by_clauses = match conversions::order_clauses_from_proto(proto_order_by) {
             Ok(c) => c,
             Err(e) => return Ok(QueryValidationResult::new_with_error(e)),
@@ -238,10 +398,15 @@ impl<C> Platform<C> {
         }
 
         match routing {
+            // The documents route forwards the raw id into the shared
+            // `query_documents_typed` helper (v0 dispatches into it too),
+            // which owns its contract fetch; the aggregate arms below
+            // consume the request's single fetch instead.
             RoutingDecision::Documents => self.dispatch_documents_v1(
                 data_contract_id,
                 document_type,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 start,
@@ -250,9 +415,11 @@ impl<C> Platform<C> {
                 platform_version,
             ),
             RoutingDecision::Count(mode) => self.dispatch_count_v1(
+                prefetched_contract,
                 data_contract_id,
                 document_type,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 start,
@@ -262,9 +429,11 @@ impl<C> Platform<C> {
                 platform_version,
             ),
             RoutingDecision::Sum { sum_property, mode } => self.dispatch_sum_v1(
+                prefetched_contract,
                 data_contract_id,
                 document_type,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 start,
@@ -275,9 +444,11 @@ impl<C> Platform<C> {
                 platform_version,
             ),
             RoutingDecision::Average { sum_property, mode } => self.dispatch_average_v1(
+                prefetched_contract,
                 data_contract_id,
                 document_type,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 start,
@@ -288,12 +459,14 @@ impl<C> Platform<C> {
                 platform_version,
             ),
             RoutingDecision::Ranked => self.dispatch_ranked_v1(
+                prefetched_contract,
                 data_contract_id,
                 document_type,
                 select,
                 group_by,
                 having_clauses,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 offset,
@@ -303,12 +476,14 @@ impl<C> Platform<C> {
                 platform_version,
             ),
             RoutingDecision::HavingRange => self.dispatch_having_v1(
+                prefetched_contract,
                 data_contract_id,
                 document_type,
                 select,
                 group_by,
                 having_clauses,
                 where_clauses,
+                resolved_time_ranges,
                 order_by_clauses,
                 limit,
                 offset,
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/routing.rs b/packages/rs-drive-abci/src/query/document_query/v1/routing.rs
index f686ffb47f4..91dd096e96c 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/routing.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/routing.rs
@@ -368,7 +368,22 @@ pub(super) fn validate_and_route_for_tests(
     //    `where_clauses` slice for the routing decision, because
     //    the depth-cap and similar decode-time contracts aren't
     //    exercisable otherwise.
-    conversions::where_clauses_from_proto(request_v1.where_clauses.clone())?;
+    //
+    //    Time-range (IN_TIME_RANGE) clauses are partitioned out first —
+    //    the same order `query_documents_v1` decodes in. The real handler
+    //    resolves them into bucket equalities from committed block time;
+    //    this stateless helper has no block time (or contract), so it
+    //    only validates the clause shape here. Routing-relevant callers
+    //    pass the resolved equality in their pre-decoded slice.
+    let (time_range_proto, normal_proto): (Vec<_>, Vec<_>) = request_v1
+        .where_clauses
+        .clone()
+        .into_iter()
+        .partition(conversions::is_time_range_clause);
+    for proto_wc in time_range_proto {
+        conversions::time_range_clause_from_proto(proto_wc)?;
+    }
+    conversions::where_clauses_from_proto(normal_proto)?;
     // 2. ORDER BY decoding — aggregate-target reject as
     //    `Unsupported("ORDER BY on aggregate keys …")`.
     let order_by_clauses = conversions::order_clauses_from_proto(request_v1.order_by.clone())?;
diff --git a/packages/rs-drive-abci/src/query/document_query/v1/tests.rs b/packages/rs-drive-abci/src/query/document_query/v1/tests.rs
index 50fadc2e293..fa34310ca4e 100644
--- a/packages/rs-drive-abci/src/query/document_query/v1/tests.rs
+++ b/packages/rs-drive-abci/src/query/document_query/v1/tests.rs
@@ -26,6 +26,7 @@ use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::random_document::CreateRandomDocument;
 use dpp::platform_value::{platform_value, Value};
 use drive::query::WhereOperator;
+use drive::query::{resolve_time_range_bucket_clause, validate_resolved_time_range_clause_shapes};
 
 /// Build a `ProtoDocumentFieldValue` from a `dpp::platform_value::Value`
 /// for use inside this test module only. **Subset of the SDK's
@@ -1130,6 +1131,7 @@ mod ported_v0_count_tests {
         properties.insert("age".to_string(), Value::U64(age));
 
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from(id),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -2803,8 +2805,8 @@ mod ranked_tests {
     }
 
     /// `limit` is **required** on the ranked path — it is the `k` the
-    /// proof envelope echoes, so there is no server default a verifying
-    /// client could reproduce. What this pins is that drive's
+    /// verifier rebuilds its `PathQuery` around, so there is no server
+    /// default a verifying client could reproduce. What this pins is that drive's
     /// `Error::Query` reaches the caller as a query error on the
     /// validation result, rather than being swallowed into an internal
     /// error by the dispatcher's `Err(e) => Err(e.into())` arm.
@@ -3425,7 +3427,7 @@ mod having_range_tests {
             QueryError::Query(QuerySyntaxError::InvalidParameter(message)) => {
                 assert!(
                     message.contains("exactly one `group_by` property")
-                        && message.contains("equality `where` clause"),
+                        && message.contains("pin every leading index property"),
                     "the rejection must steer to the pinned-prefix form, got: {message}"
                 );
             }
@@ -3478,6 +3480,88 @@ mod having_range_tests {
         }
     }
 
+    /// The `IN`-pinned form end to end on the wire: `WHERE identityId
+    /// IN [X, Y] GROUP BY class HAVING AVG(grade) > 80 LIMIT 10` fans
+    /// out across both identities' secondaries and answers one merged
+    /// `ResultData.ranked` page whose entries carry `in_key`; the
+    /// proved variant returns the unified branched `PathQuery` envelope as its Proof
+    /// payload. Merge/proof semantics are pinned in rs-drive's suites;
+    /// this pins the wire encoding, routing, and `in_key` mapping.
+    #[test]
+    fn in_pinned_having_is_served_end_to_end() {
+        let (platform, state, version) = setup_platform(None, Network::Testnet, None);
+        let contract = register_grades_compound(&platform, version);
+        let identity_x = [1u8; 32];
+        let identity_y = [2u8; 32];
+        insert_grade_docs(
+            &platform,
+            &contract,
+            21_000,
+            &[
+                (identity_x, "art", 90),
+                (identity_x, "math", 60),
+                (identity_y, "science", 95),
+            ],
+            version,
+        );
+
+        let mut request = having_request(
+            &contract,
+            "grade",
+            select(v1_select::Function::Avg, "grade"),
+            hc(
+                having_aggregate::Function::Avg,
+                "grade",
+                having_clause::Operator::GreaterThan,
+                Value::U64(80),
+            ),
+            Vec::new(),
+            Some(10),
+            false,
+        );
+        request.group_by = vec!["class".to_string()];
+        request.where_clauses = vec![wc(
+            "identityId",
+            ProtoWhereOperator::In,
+            Value::Array(vec![
+                Value::Bytes(identity_y.to_vec()),
+                Value::Bytes(identity_x.to_vec()),
+            ]),
+        )];
+
+        let page = ranked_page(&platform, &state, request.clone(), version);
+        assert_eq!(
+            group_keys(&page.entries),
+            vec!["art", "science"],
+            "merged ascending: X's art (90) then Y's science (95); X's math \
+             (60) misses the bound"
+        );
+        assert_eq!(
+            page.entries
+                .iter()
+                .map(|e| e.in_key.clone())
+                .collect::<Vec<_>>(),
+            vec![Some(identity_x.to_vec()), Some(identity_y.to_vec())],
+            "merged entries carry their branch's in_key on the wire"
+        );
+
+        // The proved variant answers with a Proof payload (the unified
+        // branched `PathQuery` envelope — verified client-side, pinned
+        // in rs-drive's tamper suite).
+        request.prove = true;
+        let result = platform
+            .query_documents_v1(request, &state, version)
+            .expect("query should succeed");
+        assert!(result.errors.is_empty(), "got {:?}", result.errors);
+        match result.data {
+            Some(GetDocumentsResponseV1 {
+                result: Some(get_documents_response_v1::Result::Proof(proof)),
+                ..
+            }) => assert!(!proof.grovedb_proof.is_empty()),
+            other => panic!("expected a Proof response, got {:?}", other),
+        }
+    }
+
     /// The pinned-prefix form end to end on the wire: `WHERE identityId
     /// = X GROUP BY class HAVING AVG(grade) > 80 LIMIT 10` routes to
     /// the same having executor, descends to X's terminal `class` tree,
@@ -3829,7 +3913,7 @@ mod having_trust_boundary {
         DocumentHavingRequest, DocumentHavingResponse,
     };
     use drive::query::drive_document_having_query::mode_detection::detect_having_mode;
-    use drive::query::drive_document_ranked_query::index_picker::find_ranked_index_for_axis;
+    use drive::query::drive_document_having_query::resolve_having_query_for_mode;
     use drive::query::having::{
         HavingAggregate, HavingAggregateFunction, HavingClause, HavingOperator, HavingRightOperand,
     };
@@ -3859,8 +3943,14 @@ mod having_trust_boundary {
     const TIME_MS: u64 = 1_755_000_000_000;
 
     /// Provider that knows exactly one quorum key — the test one.
-    struct TestQuorumProvider {
-        pubkey: [u8; 48],
+    ///
+    /// This and the two signing helpers below are `pub(super)` so the
+    /// sibling [`super::time_range_proof_verification`] suite signs its
+    /// commits through the same canonical construction; a second copy of
+    /// the tenderdash harness could drift from this one and quietly stop
+    /// testing the binding.
+    pub(super) struct TestQuorumProvider {
+        pub(super) pubkey: [u8; 48],
     }
 
     impl ContextProvider for TestQuorumProvider {
@@ -3898,7 +3988,7 @@ mod having_trust_boundary {
     }
 
     /// A deterministic, valid BLS scalar — no RNG dependency.
-    fn quorum_secret_key() -> SecretKey<Bls12381G2Impl> {
+    pub(super) fn quorum_secret_key() -> SecretKey<Bls12381G2Impl> {
         let mut bytes = [0u8; 32];
         bytes[31] = 42;
         SecretKey::<Bls12381G2Impl>::from_be_bytes(&bytes)
@@ -3991,30 +4081,21 @@ mod having_trust_boundary {
             platform_version(),
         )
         .expect("the case is well-formed");
-        let index = find_ranked_index_for_axis(
+        resolve_having_query_for_mode(
+            contract.id_ref().to_buffer(),
+            contract
+                .document_type_for_name("grade")
+                .expect("grade doctype exists"),
+            "grade".to_string(),
             contract
                 .document_types()
                 .get("grade")
                 .expect("grade doctype exists")
                 .indexes(),
-            &mode.group_by_property,
-            &[],
-            mode.bounds.axis(),
-            &mode.aggregate_field,
+            &mode,
+            PlatformVersion::latest(),
         )
-        .expect("the fixture declares the avg axis");
-        DriveDocumentHavingQuery {
-            document_type: contract
-                .document_type_for_name("grade")
-                .expect("grade doctype exists"),
-            contract_id: contract.id_ref().to_buffer(),
-            document_type_name: "grade".to_string(),
-            index,
-            bounds: mode.bounds,
-            equality_prefix_values: Vec::new(),
-            descending: mode.descending,
-            limit: mode.limit,
-        }
+        .expect("the fixture declares the avg axis")
     }
 
     /// Prove the having request against the live Drive and return
@@ -4034,6 +4115,7 @@ mod having_trust_boundary {
                     having: &having,
                     order_by: &[],
                     where_clauses: &[],
+                    resolved_time_ranges: &[],
                     limit: Some(10),
                     offset: None,
                     has_start_at: false,
@@ -4069,7 +4151,7 @@ mod having_trust_boundary {
     /// Sign a tenderdash precommit whose state id carries `app_hash` —
     /// the same canonical construction `verify_tenderdash_proof`
     /// rebuilds on the verify side.
-    fn signed_proof(
+    pub(super) fn signed_proof(
         grovedb_proof: Vec<u8>,
         app_hash: &[u8; 32],
         mtd: &ResponseMetadata,
@@ -4244,3 +4326,1297 @@ mod having_trust_boundary {
         );
     }
 }
+
+mod time_range_proof_verification {
+    //! The whole time-range reconstruction sequence, run end to end
+    //! against a populated Drive: the handler resolves `IN_TIME_RANGE`
+    //! from committed block time, proves the resulting bucket query,
+    //! and the client re-derives the *identical* bucket from the
+    //! quorum-signed response metadata `time_ms`, re-runs the
+    //! provenance guard, re-picks the bucketed index and verifies the
+    //! proof over the GroveDB path that selection produces. Every link
+    //! in that chain is load-bearing: a resolution reading anything
+    //! but the signed time, a picker admitting the plain index, or a
+    //! guard accepting a shape the resolver never built would each
+    //! turn a wrong answer into a *proven* wrong answer.
+    //!
+    //! The headline assertion is the overlapping-window one. With
+    //! `range = 6h, step = 2h` a document is written under three
+    //! bucket keys at once, so a count that walked buckets rather
+    //! than addressing exactly one would return three times the
+    //! truth — and would verify, because the proof would be an
+    //! honest proof of the wrong query.
+    //!
+    //! Split, same as [`super::having_trust_boundary`]: proof
+    //! end-to-end lives here because generating proofs needs drive's
+    //! `server` feature and a populated platform; the client-surface
+    //! half (resolution from metadata time, provenance bookkeeping,
+    //! ordering) is offline-tested in rs-sdk, which builds drive with
+    //! `verify` only.
+
+    use super::having_trust_boundary::{quorum_secret_key, signed_proof, TestQuorumProvider};
+    use super::*;
+    use crate::rpc::core::MockCoreRPCLike;
+    use crate::test::helpers::setup::TempPlatform;
+    use dapi_grpc::platform::v0::get_documents_response::Version as ResponseVersion;
+    use dapi_grpc::platform::v0::{GetDocumentsResponse, Proof, ResponseMetadata};
+    use dpp::block::block_info::BlockInfo;
+    use dpp::block::extended_block_info::v0::ExtendedBlockInfoV0;
+    use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
+    use dpp::data_contract::document_type::DocumentTypeRef;
+    use dpp::data_contract::DataContractFactory;
+    use dpp::document::{Document, DocumentV0Getters, DocumentV0Setters};
+    use dpp::platform_value::platform_value;
+    use dpp::prelude::DataContract;
+    use drive::drive::Drive;
+    use drive::query::{
+        DriveDocumentCountQuery, DriveDocumentQuery, TimeRangeSelector, WhereClause,
+    };
+    use drive_proof_verifier::types::Documents;
+    use drive_proof_verifier::{
+        verify_point_lookup_count_proof, Error as ProofVerifierError, FromProof, SplitCountEntry,
+    };
+    use std::collections::BTreeMap;
+
+    const DOCUMENT_TYPE: &str = "post";
+    const CREATED_AT: &str = "$createdAt";
+    const BUCKETED_INDEX: &str = "trending";
+    const MINUTE_MS: u64 = 60_000;
+    const HOUR_MS: u64 = 3_600_000;
+
+    /// A bucket start on the contract's grid: `origin` is 0 and the step is
+    /// two hours, and this is an exact multiple of two hours. Every timestamp
+    /// below is expressed relative to it.
+    const NEWEST_BUCKET_START_MS: u64 = 1_755_000_000_000;
+    /// Committed block time, one hour into the newest bucket — so the newest
+    /// active range is `NEWEST_BUCKET_START_MS` and there is a full hour of
+    /// bucket in which documents can sit.
+    const BLOCK_TIME_MS: u64 = NEWEST_BUCKET_START_MS + HOUR_MS;
+    const BLOCK_HEIGHT: u64 = 100;
+    const BLOCK_CORE_HEIGHT: u32 = 42;
+    const QUORUM_HASH: [u8; 32] = [3u8; 32];
+
+    /// `($createdAt, hashtag)` for the four posts, chosen so the newest
+    /// bucket contains: two `#ibiza` posts that *also* live in the two older
+    /// overlapping buckets (the double-count regression), and one `#berlin`
+    /// post (so the second index property has to do work). The third
+    /// `#ibiza` post starts one hour before the newest bucket, so it belongs
+    /// to the three *older* buckets and to none of the newest — the negative
+    /// control that pins the query to a single bucket rather than to "recent
+    /// enough".
+    const POSTS: [(u64, &str); 4] = [
+        (NEWEST_BUCKET_START_MS + 10 * MINUTE_MS, "ibiza"),
+        (NEWEST_BUCKET_START_MS + 30 * MINUTE_MS, "ibiza"),
+        (NEWEST_BUCKET_START_MS - HOUR_MS, "ibiza"),
+        (NEWEST_BUCKET_START_MS + 15 * MINUTE_MS, "berlin"),
+    ];
+
+    /// A `countable` bucketed index over `(timeRange($createdAt), hashtag)`
+    /// with a six-hour window sliding every two hours — overlap factor 3 —
+    /// next to a plain index covering the same two fields the other way
+    /// round. The plain one exists so index selection has something wrong to
+    /// pick: it covers the identical clause field set, and only the
+    /// resolution provenance keeps the query off it.
+    fn register_trending_contract(
+        platform: &Platform<MockCoreRPCLike>,
+        platform_version: &PlatformVersion,
+    ) -> DataContract {
+        let factory = DataContractFactory::new(platform_version.protocol_version)
+            .expect("expected a factory");
+        let schemas = platform_value!({
+            DOCUMENT_TYPE: {
+                "type": "object",
+                "properties": {
+                    "hashtag": { "type": "string", "maxLength": 63, "position": 0 },
+                },
+                "indices": [
+                    {
+                        "name": BUCKETED_INDEX,
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "countable": true,
+                        "timeRange": { "on": "$createdAt", "range": 21_600u64, "step": 7_200u64 },
+                    },
+                    {
+                        "name": "byHashtag",
+                        "properties": [{ "hashtag": "asc" }, { "$createdAt": "asc" }],
+                        "countable": true,
+                    },
+                ],
+                "required": ["$createdAt", "hashtag"],
+                "additionalProperties": false,
+            }
+        });
+        let contract = factory
+            .create_with_value_config(Identifier::new([7u8; 32]), 0, schemas, None, None)
+            .expect("the trending contract is well-formed")
+            .data_contract_owned();
+        store_data_contract(platform, &contract, platform_version);
+        contract
+    }
+
+    fn insert_posts(
+        platform: &Platform<MockCoreRPCLike>,
+        contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) -> Vec<Document> {
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        POSTS
+            .iter()
+            .enumerate()
+            .map(|(i, (created_at_ms, hashtag))| {
+                let mut document: Document = document_type
+                    .random_document(Some(7_000 + i as u64), platform_version)
+                    .expect("random document");
+                document.set_properties(BTreeMap::from([(
+                    "hashtag".to_string(),
+                    Value::Text(hashtag.to_string()),
+                )]));
+                document.set_created_at(Some(*created_at_ms));
+                store_document(
+                    platform,
+                    contract,
+                    document_type,
+                    &document,
+                    platform_version,
+                );
+                document
+            })
+            .collect()
+    }
+
+    fn root_hash(drive: &Drive, platform_version: &PlatformVersion) -> [u8; 32] {
+        drive
+            .grove
+            .root_hash(None, &platform_version.drive.grove_version)
+            .unwrap()
+            .expect("root hash must be readable")
+    }
+
+    /// A state whose last committed block carries [`BLOCK_TIME_MS`] — the
+    /// handler resolves `IN_TIME_RANGE` from it and stamps it into the
+    /// response metadata, which is what makes the client's re-derivation
+    /// land on the same bucket.
+    fn state_with_committed_block_time(
+        base: &PlatformState,
+        drive: &Drive,
+        platform_version: &PlatformVersion,
+    ) -> PlatformState {
+        let mut state = base.clone();
+        state.set_last_committed_block_info(Some(
+            ExtendedBlockInfoV0 {
+                basic_info: BlockInfo {
+                    time_ms: BLOCK_TIME_MS,
+                    height: BLOCK_HEIGHT,
+                    core_height: BLOCK_CORE_HEIGHT,
+                    epoch: Default::default(),
+                },
+                app_hash: root_hash(drive, platform_version),
+                quorum_hash: [0u8; 32],
+                block_id_hash: [0u8; 32],
+                proposer_pro_tx_hash: [0u8; 32],
+                signature: [0u8; 96],
+                round: 0,
+            }
+            .into(),
+        ));
+        state
+    }
+
+    /// Contract registered, posts inserted, and a platform state whose
+    /// committed block time is [`BLOCK_TIME_MS`].
+    fn setup_trending(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        base_state: &PlatformState,
+        platform_version: &PlatformVersion,
+    ) -> (DataContract, Vec<Document>, PlatformState) {
+        assert!(
+            platform_version.protocol_version >= 14,
+            "time-range indexes require protocol version 14 or later"
+        );
+        let contract = register_trending_contract(platform, platform_version);
+        let documents = insert_posts(platform, &contract, platform_version);
+        let state = state_with_committed_block_time(base_state, &platform.drive, platform_version);
+        (contract, documents, state)
+    }
+
+    /// `IN_TIME_RANGE($createdAt, "newest") AND hashtag = <hashtag>` — the
+    /// selector rides the wire as an operator, never as a resolved value, so
+    /// the bucket in the proof can only have come from the node's committed
+    /// block time.
+    fn trending_where_clauses(hashtag: &str) -> Vec<ProtoWhereClause> {
+        vec![
+            wc(
+                "hashtag",
+                ProtoWhereOperator::Equal,
+                Value::Text(hashtag.to_string()),
+            ),
+            wc(
+                CREATED_AT,
+                ProtoWhereOperator::InTimeRange,
+                Value::Text(TimeRangeSelector::Newest.as_str().to_string()),
+            ),
+        ]
+    }
+
+    fn trending_request(
+        contract_id: Vec<u8>,
+        hashtag: &str,
+        selects: Vec<V1Select>,
+    ) -> GetDocumentsRequestV1 {
+        GetDocumentsRequestV1 {
+            data_contract_id: contract_id,
+            document_type: DOCUMENT_TYPE.to_string(),
+            where_clauses: trending_where_clauses(hashtag),
+            order_by: Vec::new(),
+            limit: None,
+            start: None,
+            prove: true,
+            selects,
+            group_by: Vec::new(),
+            having: Vec::new(),
+            offset: None,
+        }
+    }
+
+    /// Run the request through the real v1 handler and re-sign the proof it
+    /// produced: the test platform never signs a commit, so the tenderdash
+    /// binding is supplied here over the *live* root hash and the handler's
+    /// own response metadata. Tampering with either afterwards is what the
+    /// negative case does.
+    fn prove_and_sign(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        state: &PlatformState,
+        request: GetDocumentsRequestV1,
+        platform_version: &PlatformVersion,
+    ) -> (Proof, ResponseMetadata, TestQuorumProvider) {
+        let result = platform
+            .query_documents_v1(request, state, platform_version)
+            .expect("query call should not error at the transport layer");
+        assert!(result.errors.is_empty(), "errors: {:?}", result.errors);
+        let response = result.data.expect("data");
+        let proof = match response.result {
+            Some(get_documents_response_v1::Result::Proof(proof)) => proof,
+            other => panic!("expected a proof, got {:?}", other),
+        };
+        let mtd = response
+            .metadata
+            .expect("the handler stamps response metadata");
+        assert_eq!(
+            mtd.time_ms, BLOCK_TIME_MS,
+            "the metadata time the client resolves from must be the committed \
+             block time the server resolved from"
+        );
+
+        let secret_key = quorum_secret_key();
+        let signed = signed_proof(
+            proof.grovedb_proof,
+            &root_hash(&platform.drive, platform_version),
+            &mtd,
+            &secret_key,
+            QUORUM_HASH,
+        );
+        let provider = TestQuorumProvider {
+            pubkey: secret_key.public_key().0.to_compressed(),
+        };
+        (signed, mtd, provider)
+    }
+
+    /// Re-sign the handler's proof over *altered* metadata with the fixture
+    /// quorum key. The signature then verifies, so a rejection can only come
+    /// from the proof path itself: the verifier resolves the selector from
+    /// the altered time into the NEXT bucket, reconstructs that bucket's
+    /// path query, and the GroveDB proof over the original bucket cannot
+    /// satisfy it. Without the re-signing, the negative tests could pass at
+    /// signature verification and never reach that property.
+    fn resign_over(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        proof: &Proof,
+        mtd: &ResponseMetadata,
+        platform_version: &PlatformVersion,
+    ) -> Proof {
+        signed_proof(
+            proof.grovedb_proof.clone(),
+            &root_hash(&platform.drive, platform_version),
+            mtd,
+            &quorum_secret_key(),
+            QUORUM_HASH,
+        )
+    }
+
+    /// The bucket start the transform puts `time_ms` in, computed straight
+    /// off the contract's declared window rather than off the constants
+    /// above — so a fixture edit that moves the grid cannot leave the
+    /// expectation behind.
+    fn expected_newest_bucket(contract: &DataContract, time_ms: u64) -> u64 {
+        contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists")
+            .indexes()
+            .get(BUCKETED_INDEX)
+            .expect("the bucketed index survives contract registration")
+            .time_range
+            .as_ref()
+            .expect("the bucketed index carries its transform")
+            .newest_active_start(time_ms)
+            .expect("the block time is inside an active range")
+    }
+
+    /// The client's reconstruction sequence, step for step, exactly as the
+    /// SDK's count helper performs it: resolve the selector from the signed
+    /// metadata time, record the provenance, re-run the shape guard, pick
+    /// the index that provenance admits, rebuild the prover's count query.
+    ///
+    /// Returns the resolved bucket start alongside the query so callers can
+    /// assert on what the metadata time resolved to.
+    fn client_count_query<'a>(
+        contract: &'a DataContract,
+        document_type: &'a DocumentTypeRef<'a>,
+        hashtag: &str,
+        time_ms: u64,
+    ) -> (DriveDocumentCountQuery<'a>, u64) {
+        let mut where_clauses = vec![WhereClause {
+            field: "hashtag".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::Text(hashtag.to_string()),
+        }];
+        let (clause, resolution) = resolve_time_range_bucket_clause(
+            CREATED_AT,
+            TimeRangeSelector::Newest,
+            None,
+            *document_type,
+            time_ms,
+        )
+        .expect("the metadata time falls inside an active range");
+        let bucket_start = clause
+            .value
+            .to_integer::<u64>()
+            .expect("a resolved bucket start is a millisecond timestamp");
+        where_clauses.push(clause);
+        let resolutions = vec![resolution];
+
+        validate_resolved_time_range_clause_shapes(&where_clauses, &resolutions)
+            .expect("resolution produces exactly the one equality the guard admits");
+
+        let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+            document_type.indexes(),
+            &where_clauses,
+            &resolutions,
+        )
+        .expect("the bucketed index covers the resolved clause set");
+        assert_eq!(
+            index.name, BUCKETED_INDEX,
+            "resolution provenance must pin selection to the bucketed index, not \
+             to the plain index covering the same fields"
+        );
+
+        let query = DriveDocumentCountQuery {
+            document_type: *document_type,
+            contract_id: contract.id().to_buffer(),
+            document_type_name: DOCUMENT_TYPE.to_string(),
+            index,
+            where_clauses,
+        };
+        (query, bucket_start)
+    }
+
+    fn total_of(entries: &[SplitCountEntry]) -> u64 {
+        entries.iter().map(|e| e.count.unwrap_or_default()).sum()
+    }
+
+    /// The headline case. Two `#ibiza` posts sit in the newest bucket and,
+    /// because the window overlaps three deep, each is *stored* under three
+    /// bucket keys. The verified count must be 2 — one per document — which
+    /// is only true if both sides addressed exactly the one bucket the
+    /// signed block time names.
+    #[test]
+    fn a_count_over_an_overlapping_bucket_verifies_and_counts_each_document_once() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        let transform = document_type
+            .indexes()
+            .get(BUCKETED_INDEX)
+            .expect("the bucketed index survives contract registration")
+            .time_range
+            .as_ref()
+            .expect("the bucketed index carries its transform");
+        assert_eq!(
+            transform.overlap_factor(),
+            3,
+            "the fixture's whole point is that windows overlap"
+        );
+        assert_eq!(
+            transform.containing_buckets(POSTS[0].0).len(),
+            3,
+            "a matching document must really be stored under three bucket keys"
+        );
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let client_document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        let (query, bucket_start) =
+            client_count_query(&contract, &client_document_type, "ibiza", mtd.time_ms);
+        assert_eq!(
+            bucket_start,
+            expected_newest_bucket(&contract, mtd.time_ms),
+            "the resolved bucket must be the transform's newest active start \
+             for the signed time"
+        );
+        assert_eq!(bucket_start, NEWEST_BUCKET_START_MS);
+
+        let entries = verify_point_lookup_count_proof(&query, &proof, &mtd, version, &provider)
+            .expect("a correctly signed count over the resolved bucket must verify");
+
+        assert_eq!(
+            total_of(&entries),
+            2,
+            "the two #ibiza posts in the newest bucket count once each — a \
+             document living in three overlapping buckets must not count three \
+             times, and the #ibiza post one hour older belongs to the previous \
+             buckets only"
+        );
+    }
+
+    /// Move the signed time forward by one full step and the client resolves
+    /// a *different* bucket. Verification must fail hard: either the proof
+    /// cannot be replayed over the other bucket's path, or the tenderdash
+    /// binding rejects the altered metadata. What must never happen is a
+    /// second, differently-scoped count coming back verified.
+    #[test]
+    fn a_tampered_metadata_time_cannot_verify_a_different_bucket() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let step_ms = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists")
+            .indexes()
+            .get(BUCKETED_INDEX)
+            .expect("the bucketed index survives contract registration")
+            .time_range
+            .as_ref()
+            .expect("the bucketed index carries its transform")
+            .step_ms();
+
+        let mut tampered = mtd.clone();
+        tampered.time_ms += step_ms;
+
+        let client_document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        let (_honest_query, honest_bucket) =
+            client_count_query(&contract, &client_document_type, "ibiza", mtd.time_ms);
+        let (tampered_query, tampered_bucket) =
+            client_count_query(&contract, &client_document_type, "ibiza", tampered.time_ms);
+        assert_eq!(
+            tampered_bucket,
+            honest_bucket + step_ms,
+            "one step of tampering must move the resolution one bucket — \
+             otherwise this test proves nothing about where the bucket comes from"
+        );
+
+        let error =
+            verify_point_lookup_count_proof(&tampered_query, &proof, &tampered, version, &provider)
+                .expect_err("an altered signed time must not yield a verified count");
+        assert!(
+            matches!(
+                error,
+                ProofVerifierError::InvalidSignature { .. }
+                    | ProofVerifierError::GroveDBError { .. }
+                    | ProofVerifierError::DriveError { .. }
+            ),
+            "the rejection must be the proof or the signature binding, got: {error:?}"
+        );
+    }
+
+    /// The non-aggregate route through the same fixture: the documents path
+    /// resolves the selector, carries the provenance onto the drive query
+    /// and verifies the returned rows. Same bucket scoping, different
+    /// primitive — so a regression that only reached the documents index
+    /// picker still turns a test red.
+    #[test]
+    fn a_documents_proof_over_the_newest_bucket_verifies_to_the_bucket_members() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, documents, state) = setup_trending(&platform, &base_state, version);
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_documents());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        let mut where_clauses = vec![WhereClause {
+            field: "hashtag".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::Text("ibiza".to_string()),
+        }];
+        let (resolved_clause, resolution) = resolve_time_range_bucket_clause(
+            CREATED_AT,
+            TimeRangeSelector::Newest,
+            None,
+            document_type,
+            mtd.time_ms,
+        )
+        .expect("the metadata time falls inside an active range");
+        where_clauses.push(resolved_clause);
+        let mut drive_query = DriveDocumentQuery::from_typed_clauses(
+            where_clauses,
+            Vec::new(),
+            None,
+            None,
+            true,
+            None,
+            &contract,
+            document_type,
+            &platform.config.drive,
+            version,
+        )
+        .expect("the resolved clause set builds a drive query");
+        drive_query.resolved_time_ranges = vec![resolution];
+
+        let response = GetDocumentsResponse {
+            version: Some(ResponseVersion::V1(GetDocumentsResponseV1 {
+                result: Some(get_documents_response_v1::Result::Proof(proof)),
+                metadata: Some(mtd),
+            })),
+        };
+        let (verified, _mtd, _proof) =
+            <Documents as FromProof<DriveDocumentQuery>>::maybe_from_proof_with_metadata(
+                drive_query,
+                response,
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect("a correctly signed documents proof must verify");
+
+        let mut verified_ids: Vec<_> = verified
+            .expect("the newest bucket is not empty")
+            .into_iter()
+            .filter_map(|(id, document)| document.map(|_| id))
+            .collect();
+        verified_ids.sort();
+        let mut expected_ids = vec![documents[0].id(), documents[1].id()];
+        expected_ids.sort();
+        assert_eq!(
+            verified_ids, expected_ids,
+            "only the two #ibiza posts inside the newest bucket are proven \
+             members — the older #ibiza post and the #berlin post are not"
+        );
+    }
+
+    // ----- the SDK `FromProof` entry points -------------------------------
+    //
+    // The tests above re-run the client sequence step by step so a failure
+    // names the broken link. These run the same signed responses through the
+    // aggregate `FromProof<DocumentQuery>` entry points the SDK actually
+    // exposes — resolution from signed metadata time, provenance, shape
+    // guard, index pick and proof verification all happen *inside* the call
+    // — so a regression in how that layer wires the steps together (not just
+    // in a step) turns a test red.
+
+    use dash_platform_queries::documents::document_query::DocumentQuery as SdkDocumentQuery;
+    use drive::query::SelectProjection;
+    use drive_proof_verifier::{DocumentAverage, DocumentCount, DocumentSum};
+    use std::sync::Arc;
+
+    const SUMMABLE_INDEX: &str = "trendingLikes";
+
+    /// `likes` per post, aligned with [`POSTS`]: the two newest-bucket
+    /// `#ibiza` posts carry 10 and 30 (sum 40, average 20), the older
+    /// `#ibiza` post carries 100 and the `#berlin` post 7 — both excluded,
+    /// so an aggregate that leaked either is off by an unmistakable amount.
+    const LIKES: [u64; 4] = [10, 30, 100, 7];
+
+    /// The summable twin of [`register_trending_contract`]: the same
+    /// six-hour/two-hour bucketed `(timeRange($createdAt), hashtag)` index,
+    /// but countable *and* summable over a `likes` property — the CountSum
+    /// value trees that SUM reads and AVG derives `(count, sum)` from. The
+    /// plain `byHashtag` index mirrors both aggregate declarations so index
+    /// selection again has a wrong-but-covering candidate to reject.
+    fn register_engagement_contract(
+        platform: &Platform<MockCoreRPCLike>,
+        platform_version: &PlatformVersion,
+    ) -> DataContract {
+        let factory = DataContractFactory::new(platform_version.protocol_version)
+            .expect("expected a factory");
+        let schemas = platform_value!({
+            DOCUMENT_TYPE: {
+                "type": "object",
+                "properties": {
+                    "hashtag": { "type": "string", "maxLength": 63, "position": 0 },
+                    "likes": { "type": "integer", "position": 1 },
+                },
+                "indices": [
+                    {
+                        "name": SUMMABLE_INDEX,
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "countable": true,
+                        "summable": "likes",
+                        "timeRange": { "on": "$createdAt", "range": 21_600u64, "step": 7_200u64 },
+                    },
+                    {
+                        "name": "byHashtag",
+                        "properties": [{ "hashtag": "asc" }, { "$createdAt": "asc" }],
+                        "countable": true,
+                        "summable": "likes",
+                    },
+                ],
+                "required": ["$createdAt", "hashtag", "likes"],
+                "additionalProperties": false,
+            }
+        });
+        let contract = factory
+            .create_with_value_config(Identifier::new([8u8; 32]), 0, schemas, None, None)
+            .expect("the engagement contract is well-formed")
+            .data_contract_owned();
+        store_data_contract(platform, &contract, platform_version);
+        contract
+    }
+
+    /// [`insert_posts`] with a `likes` value from [`LIKES`] on each post.
+    fn insert_engagement_posts(
+        platform: &Platform<MockCoreRPCLike>,
+        contract: &DataContract,
+        platform_version: &PlatformVersion,
+    ) {
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        for (i, ((created_at_ms, hashtag), likes)) in POSTS.iter().zip(LIKES).enumerate() {
+            let mut document: Document = document_type
+                .random_document(Some(8_000 + i as u64), platform_version)
+                .expect("random document");
+            document.set_properties(BTreeMap::from([
+                ("hashtag".to_string(), Value::Text(hashtag.to_string())),
+                ("likes".to_string(), Value::U64(likes)),
+            ]));
+            document.set_created_at(Some(*created_at_ms));
+            store_document(
+                platform,
+                contract,
+                document_type,
+                &document,
+                platform_version,
+            );
+        }
+    }
+
+    /// Engagement contract registered, liked posts inserted, and a platform
+    /// state whose committed block time is [`BLOCK_TIME_MS`].
+    fn setup_engagement(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        base_state: &PlatformState,
+        platform_version: &PlatformVersion,
+    ) -> (DataContract, PlatformState) {
+        let contract = register_engagement_contract(platform, platform_version);
+        insert_engagement_posts(platform, &contract, platform_version);
+        let state = state_with_committed_block_time(base_state, &platform.drive, platform_version);
+        (contract, state)
+    }
+
+    /// The query a real SDK caller would build: the selector still pending in
+    /// `time_range_clauses`, to be resolved by the entry point itself from
+    /// the signed metadata time.
+    fn sdk_query(
+        contract: &DataContract,
+        hashtag: &str,
+        select: SelectProjection,
+    ) -> SdkDocumentQuery {
+        SdkDocumentQuery::new(Arc::new(contract.clone()), DOCUMENT_TYPE)
+            .expect("the fixture has this document type")
+            .with_select(select)
+            .with_where(WhereClause {
+                field: "hashtag".to_string(),
+                operator: WhereOperator::Equal,
+                value: Value::Text(hashtag.to_string()),
+            })
+            .with_time_range(CREATED_AT, TimeRangeSelector::Newest)
+    }
+
+    /// Wrap a handler proof and its metadata the way the wire does, so the
+    /// entry points consume exactly what a node returns.
+    fn signed_response(proof: Proof, mtd: &ResponseMetadata) -> GetDocumentsResponse {
+        GetDocumentsResponse {
+            version: Some(ResponseVersion::V1(GetDocumentsResponseV1 {
+                result: Some(get_documents_response_v1::Result::Proof(proof)),
+                metadata: Some(mtd.clone()),
+            })),
+        }
+    }
+
+    fn select_field(function: v1_select::Function, field: &str) -> Vec<V1Select> {
+        vec![V1Select {
+            function: function as i32,
+            field: field.to_string(),
+        }]
+    }
+
+    /// Nudge the signed time one full step so the entry point's own
+    /// resolution lands on a different bucket than the proof covers.
+    fn one_step_later(
+        contract: &DataContract,
+        index: &str,
+        mtd: &ResponseMetadata,
+    ) -> ResponseMetadata {
+        let step_ms = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists")
+            .indexes()
+            .get(index)
+            .expect("the bucketed index survives contract registration")
+            .time_range
+            .as_ref()
+            .expect("the bucketed index carries its transform")
+            .step_ms();
+        let mut tampered = mtd.clone();
+        tampered.time_ms += step_ms;
+        tampered
+    }
+
+    /// The rejection must come from proof reconstruction (GroveDB/Drive) —
+    /// the caller re-signed the altered metadata, so `InvalidSignature`
+    /// would mean the deeper property (resolve-later-bucket → mismatched
+    /// proof path) was never exercised.
+    fn assert_proof_path_rejection(error: ProofVerifierError) {
+        assert!(
+            matches!(
+                error,
+                ProofVerifierError::GroveDBError { .. } | ProofVerifierError::DriveError { .. }
+            ),
+            "the rejection must come from the proof path, got: {error:?}"
+        );
+    }
+
+    #[test]
+    fn a_count_proof_verifies_through_the_sdk_from_proof_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let query = sdk_query(&contract, "ibiza", SelectProjection::count_star());
+        let (count, verified_mtd, _proof) =
+            <DocumentCount as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                query,
+                signed_response(proof, &mtd),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect("a correctly signed count must verify through the entry point");
+
+        assert_eq!(
+            count.expect("the newest bucket is not empty"),
+            DocumentCount(2),
+            "the two #ibiza posts in the newest bucket count once each through \
+             the entry point, exactly as through the step-by-step sequence"
+        );
+        assert_eq!(
+            verified_mtd.time_ms, BLOCK_TIME_MS,
+            "the metadata handed back is the one the resolution consumed"
+        );
+    }
+
+    #[test]
+    fn a_tampered_metadata_time_is_rejected_at_the_count_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+        let tampered = one_step_later(&contract, BUCKETED_INDEX, &mtd);
+
+        // Re-sign the altered metadata so the signature is valid —
+        // verification must then resolve the selector one step later,
+        // reconstruct the NEXT bucket's path query, and reject the
+        // original bucket's GroveDB proof. (Verification reconstructs the
+        // proof path BEFORE checking the signature, so an unsigned
+        // alteration would hit the same rejection without proving the
+        // signature binds anything; the binding itself is pinned by the
+        // trust-boundary tests above.)
+        let resigned = resign_over(&platform, &proof, &tampered, version);
+        let query = sdk_query(&contract, "ibiza", SelectProjection::count_star());
+        let error = <DocumentCount as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+            query,
+            signed_response(resigned, &tampered),
+            Network::Testnet,
+            version,
+            &provider,
+        )
+        .expect_err("a validly re-signed later time must not verify the stale bucket's proof");
+        assert_proof_path_rejection(error);
+    }
+
+    #[test]
+    fn a_sum_proof_verifies_through_the_sdk_from_proof_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_engagement(&platform, &base_state, version);
+
+        let request = GetDocumentsRequestV1 {
+            selects: select_field(v1_select::Function::Sum, "likes"),
+            ..trending_request(contract.id().to_vec(), "ibiza", Vec::new())
+        };
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let query = sdk_query(&contract, "ibiza", SelectProjection::sum("likes"));
+        let (sum, _mtd, _proof) =
+            <DocumentSum as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                query,
+                signed_response(proof, &mtd),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect("a correctly signed sum must verify through the entry point");
+
+        assert_eq!(
+            sum.expect("the newest bucket is not empty"),
+            DocumentSum(40),
+            "10 + 30 likes on the two newest-bucket #ibiza posts — the older \
+             #ibiza post's 100 and the #berlin post's 7 must not leak in, and \
+             overlap fan-out must not multiply the total"
+        );
+    }
+
+    #[test]
+    fn a_tampered_metadata_time_is_rejected_at_the_sum_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_engagement(&platform, &base_state, version);
+
+        let request = GetDocumentsRequestV1 {
+            selects: select_field(v1_select::Function::Sum, "likes"),
+            ..trending_request(contract.id().to_vec(), "ibiza", Vec::new())
+        };
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+        let tampered = one_step_later(&contract, SUMMABLE_INDEX, &mtd);
+        let resigned = resign_over(&platform, &proof, &tampered, version);
+
+        let query = sdk_query(&contract, "ibiza", SelectProjection::sum("likes"));
+        let error = <DocumentSum as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+            query,
+            signed_response(resigned, &tampered),
+            Network::Testnet,
+            version,
+            &provider,
+        )
+        .expect_err("a validly re-signed later time must not verify the stale bucket's proof");
+        assert_proof_path_rejection(error);
+    }
+
+    #[test]
+    fn an_average_proof_verifies_through_the_sdk_from_proof_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_engagement(&platform, &base_state, version);
+
+        let request = GetDocumentsRequestV1 {
+            selects: select_field(v1_select::Function::Avg, "likes"),
+            ..trending_request(contract.id().to_vec(), "ibiza", Vec::new())
+        };
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let query = sdk_query(&contract, "ibiza", SelectProjection::avg("likes"));
+        let (average, _mtd, _proof) =
+            <DocumentAverage as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                query,
+                signed_response(proof, &mtd),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect("a correctly signed average must verify through the entry point");
+
+        let average = average.expect("the newest bucket is not empty");
+        assert_eq!(
+            average,
+            DocumentAverage { count: 2, sum: 40 },
+            "the verified pair is the newest bucket's two #ibiza posts and \
+             their 40 likes — nothing from outside the bucket, nothing doubled"
+        );
+        assert_eq!(average.as_f64(), Some(20.0));
+    }
+
+    #[test]
+    fn a_tampered_metadata_time_is_rejected_at_the_average_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_engagement(&platform, &base_state, version);
+
+        let request = GetDocumentsRequestV1 {
+            selects: select_field(v1_select::Function::Avg, "likes"),
+            ..trending_request(contract.id().to_vec(), "ibiza", Vec::new())
+        };
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+        let tampered = one_step_later(&contract, SUMMABLE_INDEX, &mtd);
+        let resigned = resign_over(&platform, &proof, &tampered, version);
+
+        let query = sdk_query(&contract, "ibiza", SelectProjection::avg("likes"));
+        let error =
+            <DocumentAverage as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                query,
+                signed_response(resigned, &tampered),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect_err("a validly re-signed later time must not verify the stale bucket's proof");
+        assert_proof_path_rejection(error);
+    }
+    // ----- multiple grids over one timestamp ------------------------------
+
+    use drive::query::TimeRangeGridSpec;
+
+    const DAILY_INDEX: &str = "daily";
+    const DAY_SECONDS: u64 = 24 * 3_600;
+
+    /// The trending contract plus a second, daily (24h/24h) grid over the
+    /// same `$createdAt`. Grid-qualified level keys give each grid its own
+    /// subtree; the tests below pin that the wire can address each grid and
+    /// that the two prove independently.
+    fn register_two_grid_contract(
+        platform: &Platform<MockCoreRPCLike>,
+        platform_version: &PlatformVersion,
+    ) -> DataContract {
+        let factory = DataContractFactory::new(platform_version.protocol_version)
+            .expect("expected a factory");
+        let schemas = platform_value!({
+            DOCUMENT_TYPE: {
+                "type": "object",
+                "properties": {
+                    "hashtag": { "type": "string", "maxLength": 63, "position": 0 },
+                },
+                "indices": [
+                    {
+                        "name": BUCKETED_INDEX,
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "countable": true,
+                        "timeRange": { "on": "$createdAt", "range": 21_600u64, "step": 7_200u64 },
+                    },
+                    {
+                        "name": DAILY_INDEX,
+                        "properties": [{ "$createdAt": "asc" }, { "hashtag": "asc" }],
+                        "countable": true,
+                        "timeRange": { "on": "$createdAt", "range": DAY_SECONDS, "step": DAY_SECONDS },
+                    },
+                ],
+                "required": ["$createdAt", "hashtag"],
+                "additionalProperties": false,
+            }
+        });
+        let contract = factory
+            .create_with_value_config(Identifier::new([9u8; 32]), 0, schemas, None, None)
+            .expect("a contract may bucket one timestamp with several grids")
+            .data_contract_owned();
+        store_data_contract(platform, &contract, platform_version);
+        contract
+    }
+
+    fn setup_two_grids(
+        platform: &TempPlatform<MockCoreRPCLike>,
+        base_state: &PlatformState,
+        platform_version: &PlatformVersion,
+    ) -> (DataContract, PlatformState) {
+        let contract = register_two_grid_contract(platform, platform_version);
+        insert_posts(platform, &contract, platform_version);
+        let state = state_with_committed_block_time(base_state, &platform.drive, platform_version);
+        (contract, state)
+    }
+
+    /// The wire's structured `IN_TIME_RANGE` operand:
+    /// `[selector, range, step]` (seconds, as the contract declares them).
+    fn structured_where_clauses(hashtag: &str, grid: TimeRangeGridSpec) -> Vec<ProtoWhereClause> {
+        let uint = |n: u64| ProtoDocumentFieldValue {
+            variant: Some(document_field_value::Variant::Uint64Value(n)),
+        };
+        let mut values = vec![
+            ProtoDocumentFieldValue {
+                variant: Some(document_field_value::Variant::Text(
+                    TimeRangeSelector::Newest.as_str().to_string(),
+                )),
+            },
+            uint(grid.range_seconds),
+            uint(grid.step_seconds),
+        ];
+        if grid.phase_seconds != 0 {
+            values.push(uint(grid.phase_seconds));
+        }
+        vec![
+            wc(
+                "hashtag",
+                ProtoWhereOperator::Equal,
+                Value::Text(hashtag.to_string()),
+            ),
+            ProtoWhereClause {
+                field: CREATED_AT.to_string(),
+                operator: ProtoWhereOperator::InTimeRange as i32,
+                value: Some(ProtoDocumentFieldValue {
+                    variant: Some(document_field_value::Variant::List(
+                        document_field_value::ValueList { values },
+                    )),
+                }),
+            },
+        ]
+    }
+
+    const TRENDING_GRID: TimeRangeGridSpec = TimeRangeGridSpec {
+        range_seconds: 21_600,
+        step_seconds: 7_200,
+        phase_seconds: 0,
+    };
+    const DAILY_GRID: TimeRangeGridSpec = TimeRangeGridSpec {
+        range_seconds: DAY_SECONDS,
+        step_seconds: DAY_SECONDS,
+        phase_seconds: 0,
+    };
+
+    /// With two grids on `$createdAt`, the bare text selector no longer
+    /// names a grid, so the handler refuses it as ambiguous rather than
+    /// picking one — a silent pick would prove an answer to a question the
+    /// client didn't ask.
+    #[test]
+    fn a_bare_selector_on_a_multi_grid_field_is_refused_as_ambiguous() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_two_grids(&platform, &base_state, version);
+
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let result = platform
+            .query_documents_v1(request, &state, version)
+            .expect("transport-level success");
+        assert!(
+            !result.errors.is_empty(),
+            "a bare selector over two grids must be refused"
+        );
+        assert!(
+            format!("{:?}", result.errors).contains("grids"),
+            "the refusal must say the field is multi-grid: {:?}",
+            result.errors
+        );
+    }
+
+    /// A four-element operand spelling a zero phase is refused: like the
+    /// contract grammar and the storage key, zero is spelled by omission so
+    /// every grid has exactly one wire spelling.
+    #[test]
+    fn an_explicit_zero_phase_operand_is_refused_as_non_canonical() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_two_grids(&platform, &base_state, version);
+
+        let mut clauses = structured_where_clauses("ibiza", TRENDING_GRID);
+        // append an explicit zero phase to the list operand
+        if let Some(ProtoDocumentFieldValue {
+            variant: Some(document_field_value::Variant::List(list)),
+        }) = clauses[1].value.as_mut()
+        {
+            list.values.push(ProtoDocumentFieldValue {
+                variant: Some(document_field_value::Variant::Uint64Value(0)),
+            });
+        } else {
+            panic!("the helper builds a list operand");
+        }
+        let request = GetDocumentsRequestV1 {
+            where_clauses: clauses,
+            ..trending_request(contract.id().to_vec(), "ibiza", select_count_star())
+        };
+        let result = platform
+            .query_documents_v1(request, &state, version)
+            .expect("transport-level success");
+        assert!(
+            format!("{:?}", result.errors).contains("omission"),
+            "expected the one-spelling-per-grid refusal, got {:?}",
+            result.errors
+        );
+    }
+
+    /// Each grid proves and verifies independently through the SDK
+    /// `FromProof` entry point, with the structured operand naming the grid
+    /// on the wire and `with_time_range_grid` naming it in the client query.
+    /// The counts differ by design: the newest trending window holds two
+    /// `#ibiza` posts, while the newest daily window also contains the
+    /// one-hour-older post — three. A collapsed keyspace could not produce
+    /// both answers.
+    #[test]
+    fn each_grid_proves_and_verifies_independently_through_the_entry_point() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, state) = setup_two_grids(&platform, &base_state, version);
+
+        for (grid, expected_count) in [(TRENDING_GRID, 2u64), (DAILY_GRID, 3u64)] {
+            let request = GetDocumentsRequestV1 {
+                where_clauses: structured_where_clauses("ibiza", grid),
+                ..trending_request(contract.id().to_vec(), "ibiza", select_count_star())
+            };
+            let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+            let query = SdkDocumentQuery::new(Arc::new(contract.clone()), DOCUMENT_TYPE)
+                .expect("the fixture has this document type")
+                .with_select(SelectProjection::count_star())
+                .with_where(WhereClause {
+                    field: "hashtag".to_string(),
+                    operator: WhereOperator::Equal,
+                    value: Value::Text("ibiza".to_string()),
+                })
+                .with_time_range_grid(CREATED_AT, TimeRangeSelector::Newest, grid);
+            let (count, _mtd, _proof) =
+                <DocumentCount as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                    query,
+                    signed_response(proof, &mtd),
+                    Network::Testnet,
+                    version,
+                    &provider,
+                )
+                .expect("a correctly signed per-grid count must verify");
+            assert_eq!(
+                count.expect("the bucket is not empty"),
+                DocumentCount(expected_count),
+                "grid {:?} must count its own bucket's members",
+                grid
+            );
+        }
+    }
+    // ----- routes that must refuse time-range selections ------------------
+
+    use drive_proof_verifier::{DocumentHavingEntries, DocumentRankedEntries};
+
+    /// The HAVING route accepts equality prefixes that pin plain ranked
+    /// indexes, and its picker excludes transformed ones — so a resolved
+    /// bucket-start equality reaching it would be served from raw
+    /// timestamps at the bucket boundary instead of the selected window.
+    /// The server must refuse the combination outright (drive owns the
+    /// rejection, through `DocumentHavingRequest::resolved_time_ranges`).
+    #[test]
+    fn the_having_route_refuses_a_time_range_selection() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+
+        let request = GetDocumentsRequestV1 {
+            group_by: vec!["hashtag".to_string()],
+            having: vec![hc(
+                having_aggregate::Function::Count,
+                "",
+                having_clause::Operator::GreaterThan,
+                Value::U64(0),
+            )],
+            ..trending_request(contract.id().to_vec(), "ibiza", select_count_star())
+        };
+        let result = platform
+            .query_documents_v1(request, &state, version)
+            .expect("transport-level success");
+        assert!(
+            format!("{:?}", result.errors).contains("time-range"),
+            "the HAVING route must refuse a time-range selection, got {:?}",
+            result.errors
+        );
+    }
+
+    /// The ranked and HAVING *verifiers* must refuse a time-range request
+    /// before authenticating anything: both surfaces pin plain ranked
+    /// indexes with equality prefixes, so a malicious node could otherwise
+    /// prove raw-timestamp matches at the bucket boundary against a request
+    /// shape every honest server rejects. The rejection fires ahead of
+    /// proof verification, so any signed response works as the fixture.
+    #[test]
+    fn ranked_and_having_verifiers_refuse_time_range_requests() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+        let request = trending_request(contract.id().to_vec(), "ibiza", select_count_star());
+        let (proof, mtd, provider) = prove_and_sign(&platform, &state, request, version);
+
+        let time_range_query = || {
+            SdkDocumentQuery::new(Arc::new(contract.clone()), DOCUMENT_TYPE)
+                .expect("the fixture has this document type")
+                .with_select(SelectProjection::count_star())
+                .with_time_range(CREATED_AT, TimeRangeSelector::Newest)
+        };
+
+        let error =
+            <DocumentRankedEntries as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                time_range_query(),
+                signed_response(proof.clone(), &mtd),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect_err("the ranked verifier must refuse a time-range request");
+        assert!(
+            error.to_string().contains("time-range"),
+            "expected the ranked time-range refusal, got {error}"
+        );
+
+        let error =
+            <DocumentHavingEntries as FromProof<SdkDocumentQuery>>::maybe_from_proof_with_metadata(
+                time_range_query().with_having(vec![drive::query::HavingClause {
+                    aggregate: drive::query::HavingAggregate {
+                        function: drive::query::HavingAggregateFunction::Count,
+                        field: String::new(),
+                    },
+                    operator: drive::query::HavingOperator::GreaterThan,
+                    right: drive::query::HavingRightOperand::Value(Value::U64(0)),
+                }]),
+                signed_response(proof, &mtd),
+                Network::Testnet,
+                version,
+                &provider,
+            )
+            .expect_err("the HAVING verifier must refuse a time-range request");
+        assert!(
+            error.to_string().contains("time-range"),
+            "expected the HAVING time-range refusal, got {error}"
+        );
+    }
+
+    /// A drive query carrying resolution provenance has no faithful
+    /// `DocumentQuery` form — serializing it would demote the resolved
+    /// bucket equality to a raw-timestamp predicate — so the conversion
+    /// must refuse rather than silently rewrite the question.
+    #[test]
+    fn a_resolved_drive_query_cannot_convert_to_a_document_query() {
+        let (platform, base_state, version) = setup_platform(None, Network::Testnet, None);
+        let (contract, _documents, state) = setup_trending(&platform, &base_state, version);
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("post doctype exists");
+        let block_time_ms = state
+            .last_committed_block_time_ms()
+            .expect("the fixture committed a block");
+        let (clause, resolution) = resolve_time_range_bucket_clause(
+            CREATED_AT,
+            TimeRangeSelector::Newest,
+            None,
+            document_type,
+            block_time_ms,
+        )
+        .expect("the committed block time is inside an active range");
+
+        let mut drive_query = DriveDocumentQuery::from_typed_clauses(
+            vec![clause],
+            Vec::new(),
+            None,
+            None,
+            true,
+            None,
+            &contract,
+            document_type,
+            &platform.config.drive,
+            version,
+        )
+        .expect("the resolved clause builds a drive query");
+        drive_query.resolved_time_ranges = vec![resolution];
+
+        let error = SdkDocumentQuery::try_from(&drive_query)
+            .expect_err("resolution provenance must not survive the conversion");
+        assert!(
+            error.to_string().contains("provenance"),
+            "expected the provenance rejection, got {error}"
+        );
+    }
+}
diff --git a/packages/rs-drive-abci/src/test/helpers/fee_pools.rs b/packages/rs-drive-abci/src/test/helpers/fee_pools.rs
index 5dbe0cb0957..2a6dcdcf5d5 100644
--- a/packages/rs-drive-abci/src/test/helpers/fee_pools.rs
+++ b/packages/rs-drive-abci/src/test/helpers/fee_pools.rs
@@ -78,6 +78,7 @@ fn create_test_mn_share_document(
     properties.insert(String::from("percentage"), percentage.into());
 
     let document = DocumentV0 {
+        contract_version: None,
         id,
         properties,
         owner_id: identity_id,
diff --git a/packages/rs-drive-abci/tests/strategy_tests/test_cases/mod.rs b/packages/rs-drive-abci/tests/strategy_tests/test_cases/mod.rs
index e24e19439e0..dcd6ddd7ea4 100644
--- a/packages/rs-drive-abci/tests/strategy_tests/test_cases/mod.rs
+++ b/packages/rs-drive-abci/tests/strategy_tests/test_cases/mod.rs
@@ -7,6 +7,7 @@ mod core_update_tests;
 mod data_contract_history_tests;
 mod identity_and_document_tests;
 mod identity_transfer_tests;
+mod required_since_update_tests;
 // TODO: re-enable once OperationType shielded variants are implemented
 // mod shielded_tests;
 mod token_tests;
diff --git a/packages/rs-drive-abci/tests/strategy_tests/test_cases/required_since_update_tests.rs b/packages/rs-drive-abci/tests/strategy_tests/test_cases/required_since_update_tests.rs
new file mode 100644
index 00000000000..203877995ef
--- /dev/null
+++ b/packages/rs-drive-abci/tests/strategy_tests/test_cases/required_since_update_tests.rs
@@ -0,0 +1,205 @@
+//! Multi-block strategy coverage for `requiredSince`: a scheduled contract
+//! update adds a new required property mid-run while random document inserts
+//! keep firing every block. Documents inserted before the update land stamped
+//! with contract version 1 and survive in state; inserts generated from the
+//! pre-update schema after it are consensus-rejected for missing the new
+//! property. Every block's transitions are proof-verified and the chain's
+//! app hashes stay deterministic — the cross-block wiring no scripted test
+//! exercises.
+
+#[cfg(test)]
+mod tests {
+    use crate::execution::run_chain_for_strategy;
+    use crate::strategy::{FailureStrategy, NetworkStrategy};
+    use dash_platform_macros::stack_size;
+    use dpp::data_contract::accessors::v0::{DataContractV0Getters, DataContractV0Setters};
+    use dpp::data_contract::document_type::random_document::{
+        DocumentFieldFillSize, DocumentFieldFillType,
+    };
+    use dpp::document::DocumentV0Getters;
+    use dpp::tests::json_document::json_document_to_created_contract;
+    use dpp::version::PlatformVersion;
+    use drive::drive::document::query::QueryDocumentsOutcomeV0Methods;
+    use drive::query::DriveDocumentQuery;
+    use drive_abci::config::{
+        ChainLockConfig, ExecutionConfig, InstantLockConfig, PlatformConfig, PlatformTestConfig,
+        ValidatorSetConfig,
+    };
+    use drive_abci::test::helpers::setup::TestPlatformBuilder;
+    use std::collections::{BTreeMap, HashMap};
+    use strategy_tests::frequency::Frequency;
+    use strategy_tests::operations::{DocumentAction, DocumentOp, Operation, OperationType};
+    use strategy_tests::{IdentityInsertInfo, StartAddresses, StartIdentities, Strategy};
+
+    #[stack_size(4 * 1024 * 1024)]
+    #[test]
+    async fn run_chain_contract_update_adds_required_field_mid_run() {
+        let platform_version = PlatformVersion::latest();
+        let created_contract = json_document_to_created_contract(
+            "tests/supporting_files/contract/dashpay/dashpay-contract-all-mutable.json",
+            1,
+            true,
+            platform_version,
+        )
+        .expect("expected to get contract from a json document");
+
+        let mut contract_update = json_document_to_created_contract(
+            "tests/supporting_files/contract/dashpay/dashpay-contract-all-mutable-add-required-since-field.json",
+            2,
+            true,
+            platform_version,
+        )
+        .expect("expected to get the updated contract from a json document");
+        contract_update.data_contract_mut().set_version(2);
+
+        let contract = created_contract.data_contract();
+
+        // Inserts are generated from the document type captured here — the
+        // pre-update schema — every block. Before the update they are valid
+        // and get stamped with contract version 1; after it they lack the
+        // newly required `country` and must be consensus-rejected.
+        let document_op = DocumentOp {
+            contract: contract.clone(),
+            action: DocumentAction::DocumentActionInsertRandom(
+                DocumentFieldFillType::DoNotFillIfNotRequired,
+                DocumentFieldFillSize::AnyDocumentFillSize,
+            ),
+            document_type: contract
+                .document_type_for_name("contactRequest")
+                .expect("expected a contactRequest document type")
+                .to_owned_document_type(),
+        };
+
+        let strategy = NetworkStrategy {
+            strategy: Strategy {
+                start_contracts: vec![(
+                    created_contract,
+                    Some(BTreeMap::from([(4, contract_update)])),
+                )],
+                operations: vec![Operation {
+                    op_type: OperationType::Document(document_op),
+                    frequency: Frequency {
+                        times_per_block_range: 1..2,
+                        chance_per_block: None,
+                    },
+                }],
+                start_identities: StartIdentities::default(),
+                start_addresses: StartAddresses::default(),
+                identity_inserts: IdentityInsertInfo {
+                    frequency: Frequency {
+                        times_per_block_range: 1..2,
+                        chance_per_block: None,
+                    },
+                    ..Default::default()
+                },
+                identity_contract_nonce_gaps: None,
+                signer: None,
+            },
+            total_hpmns: 100,
+            extra_normal_mns: 0,
+            validator_quorum_count: 24,
+            chain_lock_quorum_count: 24,
+            upgrading_info: None,
+            proposer_strategy: Default::default(),
+            rotate_quorums: false,
+            failure_testing: Some(FailureStrategy {
+                deterministic_start_seed: None,
+                dont_finalize_block: false,
+                expect_every_block_errors_with_codes: vec![],
+                rounds_before_successful_block: None,
+                // From block 5 on, the pre-update generator's documents miss
+                // the newly required `country`: JSON-schema rejection (10101)
+                expect_specific_block_errors_with_codes: HashMap::from([
+                    (5, vec![10101]),
+                    (6, vec![10101]),
+                    (7, vec![10101]),
+                    (8, vec![10101]),
+                ]),
+            }),
+            query_testing: None,
+            verify_state_transition_results: true,
+            ..Default::default()
+        };
+        let config = PlatformConfig {
+            validator_set: ValidatorSetConfig::default_100_67(),
+            chain_lock: ChainLockConfig::default_100_67(),
+            instant_lock: InstantLockConfig::default_100_67(),
+            execution: ExecutionConfig {
+                verify_sum_trees: true,
+                ..Default::default()
+            },
+            block_spacing_ms: 3000,
+            testing_configs: PlatformTestConfig::default_minimal_verifications(),
+            ..Default::default()
+        };
+        let mut platform = TestPlatformBuilder::new()
+            .with_config(config.clone())
+            .build_with_mock_rpc();
+
+        let outcome =
+            run_chain_for_strategy(&mut platform, 8, strategy, config, 15, &mut None, &mut None)
+                .await;
+
+        // The runner re-derives the contract id at deployment, so read it
+        // back from the outcome's strategy
+        let contract_id = outcome
+            .strategy
+            .strategy
+            .start_contracts
+            .first()
+            .expect("expected the start contract")
+            .0
+            .data_contract()
+            .id();
+
+        // The scheduled update landed: the stored contract is at version 2
+        let fetched_contract = outcome
+            .abci_app
+            .platform
+            .drive
+            .fetch_contract(contract_id.to_buffer(), None, None, None, platform_version)
+            .unwrap()
+            .expect("expected to fetch the contract")
+            .expect("expected the contract to exist");
+        assert_eq!(
+            fetched_contract.contract.version(),
+            2,
+            "the scheduled requiredSince update must have been applied"
+        );
+
+        // Every surviving contactRequest document predates the update: stamped with
+        // contract version 1 and stored without the new required property —
+        // grandfathered rows living under the version-2 schema
+        let query = DriveDocumentQuery::from_sql_expr(
+            "select * from contactRequest",
+            &fetched_contract.contract,
+            None,
+            platform_version,
+        )
+        .expect("expected a document query");
+        let documents = outcome
+            .abci_app
+            .platform
+            .drive
+            .query_documents(query, None, false, None, None)
+            .expect("expected to query documents")
+            .documents()
+            .to_vec();
+
+        assert!(
+            !documents.is_empty(),
+            "documents inserted before the update must survive it"
+        );
+        for document in &documents {
+            assert_eq!(
+                document.contract_version(),
+                Some(1),
+                "every surviving document predates the update and must be stamped 1"
+            );
+            assert!(
+                !document.properties().contains_key("country"),
+                "grandfathered documents must not carry the new property"
+            );
+        }
+    }
+}
diff --git a/packages/rs-drive-abci/tests/strategy_tests/test_cases/withdrawal_tests.rs b/packages/rs-drive-abci/tests/strategy_tests/test_cases/withdrawal_tests.rs
index 7c9dab6a5ab..287aa72ec19 100644
--- a/packages/rs-drive-abci/tests/strategy_tests/test_cases/withdrawal_tests.rs
+++ b/packages/rs-drive-abci/tests/strategy_tests/test_cases/withdrawal_tests.rs
@@ -17,7 +17,8 @@ mod tests {
     use drive::drive::balances::TOTAL_SYSTEM_CREDITS_STORAGE_KEY;
     use drive::drive::identity::withdrawals::fetch_total_credits_in_platform_a_day_ago::DAY_IN_MS;
     use drive::drive::identity::withdrawals::paths::{
-        get_withdrawal_root_path, WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
+        get_withdrawal_root_path, WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+        WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
     };
     use drive::drive::system::misc_path;
     use drive::util::grove_operations::DirectQueryType;
@@ -2200,7 +2201,12 @@ mod tests {
     async fn should_cap_withdrawals_at_the_relative_daily_limit() {
         // Latest protocol version: the daily withdrawal limit is 15% of the total credits
         // Platform held a day ago (the flat 2000 Dash of the previous rule while no recorded
-        // total is a day old yet), counted against the amounts pooled in the last 24 hours.
+        // total is a day old yet) plus the credit inflows of the last 25 hours (the limit is
+        // one on net outflow), counted against the amounts pooled in the last 24 hours.
+        //
+        // The identities are funded through asset locks, which are credit inflows, so a
+        // waiting phase lets those inflows expire before the withdrawals start: the phases
+        // after it exercise the relative limit alone.
         let platform_version = PlatformVersion::latest();
         let start_strategy = NetworkStrategy {
             strategy: Strategy {
@@ -2415,6 +2421,24 @@ mod tests {
 
             assert_eq!(total_credits_in_platform, Some(1010000000000000));
 
+            // Every credit entered through an asset lock, so the whole 10,100 Dash is
+            // recorded as credit inflows the daily withdrawal limit would add to its maximum.
+            let credit_inflows = outcome
+                .abci_app
+                .platform
+                .drive
+                .grove_get_sum_tree_total_value(
+                    (&get_withdrawal_root_path()).into(),
+                    &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+                    DirectQueryType::StatefulDirectQuery,
+                    None,
+                    &mut vec![],
+                    &platform_version.drive,
+                )
+                .expect("expected to get the credit inflows");
+
+            assert_eq!(credit_inflows, 1010000000000000);
+
             outcome
         };
 
@@ -2474,7 +2498,26 @@ mod tests {
             ..Default::default()
         };
 
-        // Run Block 3 onwards: initiates withdrawals
+        let hour_in_ms = 1000 * 60 * 60;
+
+        let hourly_config = PlatformConfig {
+            validator_set: ValidatorSetConfig::default_100_67(),
+            chain_lock: ChainLockConfig::default_100_67(),
+            instant_lock: InstantLockConfig::default_100_67(),
+            execution: ExecutionConfig {
+                verify_sum_trees: true,
+                ..Default::default()
+            },
+            block_spacing_ms: hour_in_ms,
+            testing_configs: PlatformTestConfig::default_minimal_verifications(),
+            ..Default::default()
+        };
+
+        // Let the funding inflows expire: 26 hourly blocks with no operations. The inflow
+        // entries are keyed 25 hours after the funding blocks, so the 26th hourly block prunes
+        // them, and the 10,100 Dash recorded at the funding blocks becomes the day-old base:
+        // from here on the daily maximum is 15% of 10,100 = 1,515 Dash, with no inflows left
+        // to extend it - the phases below exercise the relative limit alone.
         let ChainExecutionOutcome {
             abci_app,
             proposers,
@@ -2494,6 +2537,67 @@ mod tests {
                 ChainExecutionParameters {
                     block_start: 3,
                     core_height_start: 1,
+                    block_count: 26,
+                    proposers,
+                    validator_quorums: quorums,
+                    current_validator_quorum_hash: current_quorum_hash,
+                    current_proposer_versions: Some(current_proposer_versions),
+                    current_identity_nonce_counter: identity_nonce_counter,
+                    current_identity_contract_nonce_counter: identity_contract_nonce_counter,
+                    current_votes: BTreeMap::default(),
+                    start_time_ms: GENESIS_TIME_MS,
+                    current_time_ms: end_time_ms + 1000,
+                    instant_lock_quorums,
+                    current_identities: identities,
+                    current_addresses_with_balance: addresses_with_balance,
+                },
+                continue_strategy_no_operations.clone(),
+                hourly_config.clone(),
+                StrategyRandomness::SeedEntropy(5),
+            )
+            .await;
+
+            // The funding inflows are 25 hours old and pruned; nothing extends the daily
+            // maximum any more.
+            let credit_inflows = outcome
+                .abci_app
+                .platform
+                .drive
+                .grove_get_sum_tree_total_value(
+                    (&get_withdrawal_root_path()).into(),
+                    &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+                    DirectQueryType::StatefulDirectQuery,
+                    None,
+                    &mut vec![],
+                    &platform_version.drive,
+                )
+                .expect("expected to get the credit inflows");
+
+            assert_eq!(credit_inflows, 0);
+
+            outcome
+        };
+
+        // Run Block 29 onwards: initiates withdrawals
+        let ChainExecutionOutcome {
+            abci_app,
+            proposers,
+            validator_quorums: quorums,
+            current_validator_quorum_hash: current_quorum_hash,
+            current_proposer_versions,
+            end_time_ms,
+            identity_nonce_counter,
+            identity_contract_nonce_counter,
+            instant_lock_quorums,
+            identities,
+            addresses_with_balance,
+            ..
+        } = {
+            let outcome = continue_chain_for_strategy(
+                abci_app,
+                ChainExecutionParameters {
+                    block_start: 29,
+                    core_height_start: 1,
                     block_count: 20,
                     proposers,
                     validator_quorums: quorums,
@@ -2554,8 +2658,8 @@ mod tests {
                 )
                 .unwrap();
 
-            // We have 40 out of 80 queued
-            assert_eq!(withdrawal_documents_queued.len(), 40);
+            // We have 50 out of 80 queued
+            assert_eq!(withdrawal_documents_queued.len(), 50);
 
             // Withdrawal documents with queued status should exist.
             let withdrawal_documents_completed = outcome
@@ -2602,12 +2706,13 @@ mod tests {
                 )
                 .unwrap();
 
-            // We have 40 broadcasted (40 queued + 40 broadcasted = 80 total)
-            // 40 broadcasted = 40 * 50 Dash = 2000 Dash
-            // The whole run is younger than a day, so no recorded total is a day old yet and
-            // the flat 2000 Dash of the previous rule still applies: the first ten withdrawal
-            // blocks pool their 4 withdrawals (200 Dash) each, then the limit is exhausted.
-            assert_eq!(withdrawal_documents_broadcasted.len(), 40);
+            // We have 30 broadcasted (50 queued + 30 broadcasted = 80 total)
+            // 30 broadcasted = 30 * 50 Dash = 1500 Dash
+            // The day-old base is the 10,100 Dash of the funding blocks, so the daily maximum
+            // is 15% = 1,515 Dash: the first seven withdrawal blocks pool their 4 withdrawals
+            // (200 Dash) each, the eighth pools two more into the 115 Dash left, then the
+            // limit is exhausted.
+            assert_eq!(withdrawal_documents_broadcasted.len(), 30);
 
             let locked_amount = outcome
                 .abci_app
@@ -2623,13 +2728,11 @@ mod tests {
                 )
                 .expect("expected to get locked amount");
 
-            assert_eq!(locked_amount, dash_to_credits!(2000) as i64);
+            assert_eq!(locked_amount, dash_to_credits!(1500) as i64);
 
             outcome
         };
 
-        let hour_in_ms = 1000 * 60 * 60;
-
         let ChainExecutionOutcome {
             abci_app,
             proposers,
@@ -2647,7 +2750,7 @@ mod tests {
             let outcome = continue_chain_for_strategy(
                 abci_app,
                 ChainExecutionParameters {
-                    block_start: 23,
+                    block_start: 49,
                     core_height_start: 1,
                     block_count: 48,
                     proposers,
@@ -2680,13 +2783,14 @@ mod tests {
             )
             .await;
 
-            // From the 25th hourly block a recorded total is a day old, and the reference is
-            // the 6100 Dash left after all 80 withdrawals were executed (10100 - 80 * 50), so
-            // the daily maximum is 15% = 915 Dash. The 2000 Dash pooled on the first day
-            // unlocked 25 hours later (cleaned up at the 26th hourly block, after pooling), so
-            // from the 27th hourly block withdrawals pooled again, at most 4 (200 Dash) per
-            // block while they fit: 200, 400, 600, 800 Dash locked, then only two more fit in
-            // the 115 Dash left (900 Dash locked), and those locks outlive this phase.
+            // Once the withdrawal blocks are a day in the past the reference is the 6100
+            // Dash they left behind (10100 - 80 * 50), so the daily maximum is 15% = 915
+            // Dash and the 1500 Dash locked in the withdrawal phase stops counting the same
+            // block (outflows the day-old base already reflects are not subtracted again;
+            // the entries themselves are cleaned up an hour later). From that block
+            // withdrawals pooled again, at most 4 (200 Dash) per block while they fit:
+            // 200, 400, 600, 800 Dash locked, then only two more fit in the 115 Dash left
+            // (900 Dash locked), and those locks outlive this phase.
             let locked_amount = outcome
                 .abci_app
                 .platform
@@ -2732,8 +2836,8 @@ mod tests {
                 )
                 .unwrap();
 
-            // We have 22 out of 80 queued
-            assert_eq!(withdrawal_documents_queued.len(), 22);
+            // We have 32 out of 80 queued
+            assert_eq!(withdrawal_documents_queued.len(), 32);
 
             // Withdrawal documents with queued status should exist.
             let withdrawal_documents_completed = outcome
@@ -2780,15 +2884,15 @@ mod tests {
                 )
                 .unwrap();
 
-            // 40 from the first day plus the 18 pooled once the first locks expired
-            assert_eq!(withdrawal_documents_broadcasted.len(), 58);
+            // 30 from the withdrawal phase plus the 18 pooled once the first locks expired
+            assert_eq!(withdrawal_documents_broadcasted.len(), 48);
             outcome
         };
 
         let outcome = continue_chain_for_strategy(
             abci_app,
             ChainExecutionParameters {
-                block_start: 71,
+                block_start: 97,
                 core_height_start: 1,
                 block_count: 250,
                 proposers,
@@ -2837,7 +2941,7 @@ mod tests {
             .expect("expected to get locked amount");
 
         // Another 250 hourly blocks: as each lock expires 25 hours later as many withdrawals
-        // fit again under the 915 Dash daily maximum, so the remaining 22 drain within a few
+        // fit again under the 915 Dash daily maximum, so the remaining 32 drain within a few
         // days and the last locks expired long before the end.
         // We have nothing locked left
         assert_eq!(locked_amount, 0);
diff --git a/packages/rs-drive-abci/tests/strategy_tests/verify_state_transitions.rs b/packages/rs-drive-abci/tests/strategy_tests/verify_state_transitions.rs
index 6d4de616ad0..55cb580b173 100644
--- a/packages/rs-drive-abci/tests/strategy_tests/verify_state_transitions.rs
+++ b/packages/rs-drive-abci/tests/strategy_tests/verify_state_transitions.rs
@@ -3,7 +3,7 @@ use dpp::block::block_info::BlockInfo;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::config::v0::DataContractConfigGettersV0;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
-use dpp::document::{Document, DocumentV0Getters};
+use dpp::document::{Document, DocumentV0Getters, DocumentV0Setters};
 use dpp::fee::Credits;
 use dpp::identity::accessors::IdentityGettersV0;
 use dpp::identity::identity_public_key::accessors::v0::IdentityPublicKeyGettersV0;
@@ -541,15 +541,28 @@ pub(crate) fn verify_state_transitions_were_or_were_not_executed(
                                         //     )
                                         //     .expect("expected to get document")
                                         // );
-                                        assert_eq!(
-                                            document,
+                                        let mut expected_document =
                                             Document::try_from_create_transition_action(
                                                 creation_action,
                                                 batch_transition.owner_id(),
                                                 platform_version,
                                             )
-                                            .expect("expected to get document")
-                                        );
+                                            .expect("expected to get document");
+                                        // The contract-version stamp records the
+                                        // contract version at execution time inside
+                                        // the block, but this harness rebuilds the
+                                        // action against post-block state — so a
+                                        // same-block contract update makes the
+                                        // rebuilt stamp postdate the stored one.
+                                        // Align only in that direction; a stored
+                                        // stamp must never exceed the rebuilt one.
+                                        if document.contract_version()
+                                            < expected_document.contract_version()
+                                        {
+                                            expected_document
+                                                .set_contract_version(document.contract_version());
+                                        }
+                                        assert_eq!(document, expected_document);
                                     } else {
                                         //there is the possibility that the state transition was not executed because it already existed,
                                         // we can discount that for now in tests
@@ -560,15 +573,24 @@ pub(crate) fn verify_state_transitions_were_or_were_not_executed(
                                     if *was_executed {
                                         // it's also possible we deleted something we replaced
                                         if let Some(document) = document {
-                                            assert_eq!(
-                                                document,
+                                            let mut expected_document =
                                                 Document::try_from_replace_transition_action(
                                                     replace_action,
                                                     batch_transition.owner_id(),
                                                     platform_version,
                                                 )
-                                                .expect("expected to get document")
-                                            );
+                                                .expect("expected to get document");
+                                            // Same post-block rebuild skew as the
+                                            // create arm: align the stamp only when
+                                            // the rebuilt one postdates the stored one
+                                            if document.contract_version()
+                                                < expected_document.contract_version()
+                                            {
+                                                expected_document.set_contract_version(
+                                                    document.contract_version(),
+                                                );
+                                            }
+                                            assert_eq!(document, expected_document);
                                         }
                                     } else {
                                         //there is the possibility that the state transition was not executed and the state is equal to the previous
diff --git a/packages/rs-drive-abci/tests/supporting_files/contract/dashpay/dashpay-contract-all-mutable-add-required-since-field.json b/packages/rs-drive-abci/tests/supporting_files/contract/dashpay/dashpay-contract-all-mutable-add-required-since-field.json
new file mode 100644
index 00000000000..8e4847a6b7d
--- /dev/null
+++ b/packages/rs-drive-abci/tests/supporting_files/contract/dashpay/dashpay-contract-all-mutable-add-required-since-field.json
@@ -0,0 +1,227 @@
+{
+  "$formatVersion": "0",
+  "id": "8MjTnX7JUbGfYYswyuCtHU7ZqcYU9s1fUaNiqD9s5tEw",
+  "ownerId": "2QjL594djCH2NyDsn45vd6yQjEDHupMKo7CEGVTHtQxU",
+  "version": 2,
+  "documentSchemas": {
+    "profile": {
+      "type": "object",
+      "indices": [
+        {
+          "name": "ownerId",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            }
+          ],
+          "unique": true
+        },
+        {
+          "name": "ownerIdUpdatedAt",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "$updatedAt": "asc"
+            }
+          ]
+        }
+      ],
+      "properties": {
+        "avatarUrl": {
+          "type": "string",
+          "format": "uri",
+          "maxLength": 2048,
+          "position": 0
+        },
+        "publicMessage": {
+          "type": "string",
+          "maxLength": 140,
+          "position": 1
+        },
+        "displayName": {
+          "type": "string",
+          "maxLength": 25,
+          "position": 2
+        }
+      },
+      "required": [
+        "$createdAt",
+        "$updatedAt"
+      ],
+      "additionalProperties": false
+    },
+    "contactInfo": {
+      "type": "object",
+      "indices": [
+        {
+          "name": "ownerIdKeyIndexes",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "rootEncryptionKeyIndex": "asc"
+            },
+            {
+              "derivationEncryptionKeyIndex": "asc"
+            }
+          ],
+          "unique": true
+        },
+        {
+          "name": "owner_updated",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "$updatedAt": "asc"
+            }
+          ]
+        }
+      ],
+      "properties": {
+        "encToUserId": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 32,
+          "maxItems": 32,
+          "position": 0
+        },
+        "rootEncryptionKeyIndex": {
+          "type": "integer",
+          "position": 1
+        },
+        "derivationEncryptionKeyIndex": {
+          "type": "integer",
+          "position": 2
+        },
+        "privateData": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 48,
+          "maxItems": 2048,
+          "position": 3,
+          "description": "This is the encrypted values of aliasName + note + displayHidden encoded as an array in cbor"
+        }
+      },
+      "required": [
+        "$createdAt",
+        "$updatedAt",
+        "encToUserId",
+        "privateData",
+        "rootEncryptionKeyIndex",
+        "derivationEncryptionKeyIndex"
+      ],
+      "additionalProperties": false
+    },
+    "contactRequest": {
+      "requiresIdentityEncryptionBoundedKey": 2,
+      "requiresIdentityDecryptionBoundedKey": 2,
+      "type": "object",
+      "indices": [
+        {
+          "name": "owner_user_ref",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "toUserId": "asc"
+            },
+            {
+              "accountReference": "asc"
+            }
+          ],
+          "unique": true
+        },
+        {
+          "name": "ownerId_toUserId",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "toUserId": "asc"
+            }
+          ]
+        },
+        {
+          "name": "toUserId_$createdAt",
+          "properties": [
+            {
+              "toUserId": "asc"
+            },
+            {
+              "$createdAt": "asc"
+            }
+          ]
+        },
+        {
+          "name": "$ownerId_$createdAt",
+          "properties": [
+            {
+              "$ownerId": "asc"
+            },
+            {
+              "$createdAt": "asc"
+            }
+          ]
+        }
+      ],
+      "properties": {
+        "toUserId": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 32,
+          "maxItems": 32,
+          "position": 0
+        },
+        "encryptedPublicKey": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 96,
+          "maxItems": 96,
+          "position": 1
+        },
+        "senderKeyIndex": {
+          "type": "integer",
+          "position": 2
+        },
+        "recipientKeyIndex": {
+          "type": "integer",
+          "position": 3
+        },
+        "accountReference": {
+          "type": "integer",
+          "position": 4
+        },
+        "encryptedAccountLabel": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 48,
+          "maxItems": 80,
+          "position": 5
+        },
+        "country": {
+          "type": "string",
+          "maxLength": 50,
+          "position": 6,
+          "requiredSince": 2
+        }
+      },
+      "required": [
+        "$createdAt",
+        "toUserId",
+        "encryptedPublicKey",
+        "senderKeyIndex",
+        "recipientKeyIndex",
+        "accountReference",
+        "country"
+      ],
+      "additionalProperties": false
+    }
+  }
+}
diff --git a/packages/rs-drive-proof-verifier/src/proof/document_having.rs b/packages/rs-drive-proof-verifier/src/proof/document_having.rs
index ea6069a6c10..b8208100071 100644
--- a/packages/rs-drive-proof-verifier/src/proof/document_having.rs
+++ b/packages/rs-drive-proof-verifier/src/proof/document_having.rs
@@ -151,10 +151,13 @@ impl DocumentHavingEntries {
 /// (which does the merk-level verification). Both sides derive the
 /// proved subtree from the same
 /// `DriveDocumentHavingQuery::indexed_property_name_tree_path` and the
-/// secondary query from the same `AxisRangeBounds::merk_query`, so
-/// prover and verifier cannot drift on *which bound over which tree* is
-/// being checked, and grovedb re-checks the echoed query and limit — a
-/// proof of one bound does not verify as another.
+/// bounded traversal from the same
+/// `AxisRangeBounds::inclusive_bounds_i128`, so prover and verifier
+/// cannot drift on *which bound over which tree* is being checked, and
+/// grovedb re-executes the proof against that reconstruction — a proof
+/// of one bound does not cover another (the limit binds as a cap: an
+/// exhausted proof verifies under any admitting cap, a truncated one
+/// fails a larger cap for missing coverage).
 ///
 /// ## The root hash is the whole point
 ///
@@ -236,6 +239,7 @@ mod tests {
 
     fn count_entry(key: &str, count: u64) -> ProtoRankedEntry {
         ProtoRankedEntry {
+            in_key: None,
             key: key.as_bytes().to_vec(),
             value: Some(ranked_entry::Value::Count(count)),
         }
diff --git a/packages/rs-drive-proof-verifier/src/proof/document_ranked.rs b/packages/rs-drive-proof-verifier/src/proof/document_ranked.rs
index 24f06524e7b..e75f22a1bec 100644
--- a/packages/rs-drive-proof-verifier/src/proof/document_ranked.rs
+++ b/packages/rs-drive-proof-verifier/src/proof/document_ranked.rs
@@ -275,6 +275,9 @@ pub(crate) fn ranked_entry_from_proto(entry: &ProtoRankedEntry) -> Result<Ranked
         }
     };
     Ok(RankedEntry {
+        // Present exactly on `IN`-pinned responses; the wire's absent
+        // state maps to the drive type's `None` untouched.
+        in_key: entry.in_key.clone(),
         key: entry.key.clone(),
         value,
     })
@@ -297,9 +300,9 @@ pub(crate) fn ranked_entry_from_proto(entry: &ProtoRankedEntry) -> Result<Ranked
 /// proved subtree from the same
 /// `DriveDocumentRankedQuery::indexed_property_name_tree_path`, so
 /// prover and verifier cannot drift on *which* ranking is being
-/// checked, and grovedb re-checks the `(axis, k, descending)` triple
-/// echoed in the envelope — a proof of one ranking does not verify as
-/// another.
+/// checked, and grovedb re-executes the proof against the
+/// `(axis, k, offset, descending)` traversal rebuilt from the request —
+/// a proof of one ranking does not cover another.
 ///
 /// ## The root hash is the whole point
 ///
@@ -407,6 +410,7 @@ mod tests {
 
     fn count_entry(key: &str, count: u64) -> ProtoRankedEntry {
         ProtoRankedEntry {
+            in_key: None,
             key: key.as_bytes().to_vec(),
             value: Some(ranked_entry::Value::Count(count)),
         }
@@ -424,6 +428,7 @@ mod tests {
     /// that no fixed point maps to.
     fn avg_entry_raw(key: &str, avg: f64) -> ProtoRankedEntry {
         ProtoRankedEntry {
+            in_key: None,
             key: key.as_bytes().to_vec(),
             value: Some(ranked_entry::Value::Avg(avg)),
         }
@@ -566,6 +571,7 @@ mod tests {
     #[test]
     fn decodes_signed_sum_entries() {
         let response = ranked_response(vec![ProtoRankedEntry {
+            in_key: None,
             key: b"refunds".to_vec(),
             value: Some(ranked_entry::Value::Sum(-1_000)),
         }]);
@@ -666,6 +672,7 @@ mod tests {
     #[test]
     fn rejects_an_entry_with_no_value() {
         let response = ranked_response(vec![ProtoRankedEntry {
+            in_key: None,
             key: b"alpha".to_vec(),
             value: None,
         }]);
@@ -734,10 +741,12 @@ mod tests {
     fn from_verified_carries_both_halves_of_the_page() {
         let entries = vec![
             RankedEntry {
+                in_key: None,
                 key: b"gamma".to_vec(),
                 value: RankedEntryValue::Count(9),
             },
             RankedEntry {
+                in_key: None,
                 key: b"alpha".to_vec(),
                 value: RankedEntryValue::Count(2),
             },
diff --git a/packages/rs-drive-proof-verifier/tests/vectors_documents.rs b/packages/rs-drive-proof-verifier/tests/vectors_documents.rs
index e6eb7753f3d..01e9ae063c0 100644
--- a/packages/rs-drive-proof-verifier/tests/vectors_documents.rs
+++ b/packages/rs-drive-proof-verifier/tests/vectors_documents.rs
@@ -150,6 +150,7 @@ fn document_query<'a>(case: &Case, contract: &'a DataContract) -> DriveDocumentQ
         start_at: None,
         start_at_included: false,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     }
 }
 
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index 54012ec1f1f..1f505ea1aa6 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -52,12 +52,13 @@ enum-map = { version = "2.0.3", optional = true }
 intmap = { version = "3.0.1", features = ["serde"], optional = true }
 chrono = { version = "0.4.35", optional = true }
 itertools = { version = "0.13", optional = true }
-grovedb = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", optional = true, default-features = false }
-grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", optional = true }
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", optional = true }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
-grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
+grovedb = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", optional = true, default-features = false }
+grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", optional = true }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
+grovedb-query = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", optional = true }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
+grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
 
 [dev-dependencies]
 criterion = "0.5"
diff --git a/packages/rs-drive/benches/document_average_worst_case.rs b/packages/rs-drive/benches/document_average_worst_case.rs
index 3ec864dc2b5..3ad031fab16 100644
--- a/packages/rs-drive/benches/document_average_worst_case.rs
+++ b/packages/rs-drive/benches/document_average_worst_case.rs
@@ -547,6 +547,7 @@ fn insert_grade_document(
     properties.insert("instructor".to_string(), Value::Bytes(instructor.to_vec()));
 
     let document: Document = DocumentV0 {
+        contract_version: None,
         id: Identifier::from(document_id(row)),
         owner_id: Identifier::from([7u8; 32]),
         properties,
diff --git a/packages/rs-drive/benches/document_count_worst_case.rs b/packages/rs-drive/benches/document_count_worst_case.rs
index 2a00dd884c4..9052996727f 100644
--- a/packages/rs-drive/benches/document_count_worst_case.rs
+++ b/packages/rs-drive/benches/document_count_worst_case.rs
@@ -260,6 +260,7 @@ fn insert_widget_document(
     properties.insert("serial".to_string(), Value::U64(row));
 
     let document: Document = DocumentV0 {
+        contract_version: None,
         id: Identifier::from(document_id(row)),
         owner_id: Identifier::from([7u8; 32]),
         properties,
@@ -1800,6 +1801,7 @@ fn display_proofs(fixture: &CountBenchFixture, platform_version: &PlatformVersio
                 let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
                     document_type.indexes(),
                     &case.structured,
+                    &[],
                 )
                 .expect("countable picker must find a covering index for the display case");
                 let query = DriveDocumentCountQuery {
@@ -1817,6 +1819,7 @@ fn display_proofs(fixture: &CountBenchFixture, platform_version: &PlatformVersio
                 let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
                     document_type.indexes(),
                     &case.structured,
+                    &[],
                 )
                 .expect("range_countable picker must find a covering index");
                 let query = DriveDocumentCountQuery {
@@ -2282,6 +2285,7 @@ fn count_request<'a>(
         limit,
         prove,
         drive_config: &fixture.drive_config,
+        resolved_time_ranges: vec![],
     }
 }
 
diff --git a/packages/rs-drive/benches/document_sum_worst_case.rs b/packages/rs-drive/benches/document_sum_worst_case.rs
index e1953d40b2e..cd4fdc7bff9 100644
--- a/packages/rs-drive/benches/document_sum_worst_case.rs
+++ b/packages/rs-drive/benches/document_sum_worst_case.rs
@@ -312,6 +312,7 @@ fn insert_tip_document(
     properties.insert("sentAt".to_string(), Value::U64(sent_at));
 
     let document: Document = DocumentV0 {
+        contract_version: None,
         id: Identifier::from(document_id(row)),
         owner_id: Identifier::from([7u8; 32]),
         properties,
@@ -1601,6 +1602,7 @@ fn display_proofs(fixture: &SumBenchFixture, platform_version: &PlatformVersion)
                 document_type,
                 SUM_PROPERTY_NAME,
                 &case.structured,
+                &[],
                 platform_version,
             )
             .expect("point-lookup path query builds"),
@@ -1609,6 +1611,7 @@ fn display_proofs(fixture: &SumBenchFixture, platform_version: &PlatformVersion)
                 document_type,
                 SUM_PROPERTY_NAME,
                 &case.structured,
+                &[],
                 platform_version,
             )
             .expect("aggregate-range path query builds"),
@@ -1620,6 +1623,7 @@ fn display_proofs(fixture: &SumBenchFixture, platform_version: &PlatformVersion)
                 document_type,
                 SUM_PROPERTY_NAME,
                 &case.structured,
+                &[],
                 limit,
                 left_to_right,
                 platform_version,
@@ -1913,6 +1917,7 @@ fn sum_request<'a>(
         limit,
         prove,
         drive_config: &fixture.drive_config,
+        resolved_time_ranges: vec![],
     }
 }
 
diff --git a/packages/rs-drive/src/drive/contract/estimation_costs/add_estimation_costs_for_contract_insertion/v1/mod.rs b/packages/rs-drive/src/drive/contract/estimation_costs/add_estimation_costs_for_contract_insertion/v1/mod.rs
index 907b0efb0df..5774dd6fa5d 100644
--- a/packages/rs-drive/src/drive/contract/estimation_costs/add_estimation_costs_for_contract_insertion/v1/mod.rs
+++ b/packages/rs-drive/src/drive/contract/estimation_costs/add_estimation_costs_for_contract_insertion/v1/mod.rs
@@ -12,7 +12,6 @@ use crate::error::Error;
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::config::v0::DataContractConfigGettersV0;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
-use dpp::data_contract::document_type::methods::DocumentTypeBasicMethods;
 use dpp::data_contract::DataContract;
 
 use dpp::serialization::PlatformSerializableWithPlatformVersion;
@@ -25,7 +24,7 @@ use grovedb::EstimatedLayerCount::{ApproximateElements, EstimatedLevel};
 use grovedb::EstimatedLayerSizes::{AllSubtrees, Mix};
 use grovedb::EstimatedSumTrees::NoSumTrees;
 use grovedb::{EstimatedLayerInformation, TreeType};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 impl Drive {
     /// v1 of contract-insertion cost estimation. Differs from v0 by computing
@@ -134,17 +133,14 @@ impl Drive {
             let mut tree_weights = TreeTypeWeights::default();
             tree_weights.tally(pk_tree_type);
 
+            // One root sub-level per distinct top tree (grid-qualified keys
+            // for time-range first properties), matching the trees
+            // `insert_contract_v0` actually creates. The map is already
+            // deduped.
             let index_structure = document_type_ref.index_structure();
-            let mut seen_indexes: HashSet<&[u8]> = HashSet::new();
-            for index in document_type_ref.top_level_indices() {
-                let index_bytes = index.name.as_bytes();
-                if !seen_indexes.insert(index_bytes) {
-                    continue;
-                }
-                let terminator_tree_type = index_structure
-                    .sub_levels()
-                    .get(index.name.as_str())
-                    .and_then(|level| level.has_index_with_type())
+            for level in index_structure.sub_levels().values() {
+                let terminator_tree_type = level
+                    .has_index_with_type()
                     .map(property_name_tree_type_from_flags)
                     .unwrap_or(TreeType::NormalTree);
                 tree_weights.tally(terminator_tree_type);
diff --git a/packages/rs-drive/src/drive/contract/insert/add_description/v0/mod.rs b/packages/rs-drive/src/drive/contract/insert/add_description/v0/mod.rs
index bbd6671fc90..c8a21e091d6 100644
--- a/packages/rs-drive/src/drive/contract/insert/add_description/v0/mod.rs
+++ b/packages/rs-drive/src/drive/contract/insert/add_description/v0/mod.rs
@@ -202,6 +202,7 @@ impl Drive {
         ]);
 
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties,
diff --git a/packages/rs-drive/src/drive/contract/insert/add_new_keywords/v0/mod.rs b/packages/rs-drive/src/drive/contract/insert/add_new_keywords/v0/mod.rs
index 89536fa16cb..950785dd05d 100644
--- a/packages/rs-drive/src/drive/contract/insert/add_new_keywords/v0/mod.rs
+++ b/packages/rs-drive/src/drive/contract/insert/add_new_keywords/v0/mod.rs
@@ -163,6 +163,7 @@ impl Drive {
         ]);
 
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties,
diff --git a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/mod.rs b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/mod.rs
index 42aeab8eaec..20216b04eb6 100644
--- a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/mod.rs
+++ b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/mod.rs
@@ -15,7 +15,6 @@ use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::DataContract;
 use dpp::fee::fee_result::FeeResult;
 
-use dpp::data_contract::document_type::methods::DocumentTypeBasicMethods;
 use dpp::serialization::PlatformSerializableWithPlatformVersion;
 
 use crate::drive::votes::paths::{
@@ -25,7 +24,7 @@ use crate::error::contract::DataContractError;
 use dpp::version::PlatformVersion;
 use grovedb::batch::KeyInfoPath;
 use grovedb::{Element, EstimatedLayerInformation, TransactionArg, TreeType};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 impl Drive {
     /// Insert a contract.
@@ -361,14 +360,18 @@ impl Drive {
                 )?,
             }
 
-            let mut index_cache: HashSet<&[u8]> = HashSet::new();
             let document_type_ref = document_type.as_ref();
             let index_structure = document_type_ref.index_structure();
-            // for each type we should insert the indices that are top level
-            for index in document_type.as_ref().top_level_indices() {
-                // toDo: change this to be a reference by index
-                let index_bytes = index.name.as_bytes();
-                if !index_cache.contains(index_bytes) {
+            // For each type we should insert the indices that are top level.
+            // The index structure's root sub-levels are exactly the distinct
+            // top-level trees: one per plain first property, plus one per
+            // (property, grid) pair for time-range-transformed first
+            // properties, whose keys are already grid-qualified
+            // (`TimeRangeTransform::storage_key`). Iterating the map also
+            // dedupes indexes sharing a first level for free.
+            for (level_key, level) in index_structure.sub_levels() {
+                let index_bytes = level_key.as_bytes();
+                {
                     // The property-name tree variant (the tree at
                     // `@/contract/0x01/<doctype>/<prop>`) is selected from
                     // the index's `(range_countable, range_summable)`
@@ -407,10 +410,7 @@ impl Drive {
                     // top-level property-name tree IS the terminal one. A
                     // compound index's terminal level lives deeper and is
                     // materialized lazily by the document index walker.
-                    let index_info = index_structure
-                        .sub_levels()
-                        .get(index.name.as_str())
-                        .and_then(|level| level.has_index_with_type());
+                    let index_info = level.has_index_with_type();
                     let (tree_type, ranked_axes) =
                         property_name_tree_type_and_ranked_axes(index_info)?;
                     match tree_type {
@@ -472,7 +472,6 @@ impl Drive {
                             &platform_version.drive,
                         )?,
                     }
-                    index_cache.insert(index_bytes);
                 }
             }
         }
diff --git a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/batched_group_drain.rs b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/batched_group_drain.rs
index d81d73c4267..816551e6833 100644
--- a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/batched_group_drain.rs
+++ b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/batched_group_drain.rs
@@ -317,6 +317,7 @@ fn run(
                 offset: Some(0),
                 has_start_at: false,
                 prove,
+                resolved_time_ranges: &[],
             },
             None,
             platform_version(),
@@ -375,7 +376,7 @@ fn verified_page(
         )
         .expect("the fixture declares this axis"),
         axis: axis.ranked,
-        equality_prefix_values: Vec::new(),
+        prefix_branches: vec![Vec::new()],
         descending: !ascending,
         k: 100,
         offset: 0,
diff --git a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/range_countable_index_e2e_tests.rs b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/range_countable_index_e2e_tests.rs
index 277da24108c..e97037cc5b2 100644
--- a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/range_countable_index_e2e_tests.rs
+++ b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/range_countable_index_e2e_tests.rs
@@ -567,6 +567,7 @@ fn range_count_executor_sums_and_splits_correctly() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
 
@@ -647,6 +648,7 @@ fn range_count_executor_sums_and_splits_correctly() {
     let after_index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &after_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
     let after_query = DriveDocumentCountQuery {
@@ -747,6 +749,7 @@ fn range_count_executor_between_is_inclusive_on_both_bounds() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
 
@@ -844,6 +847,7 @@ fn aggregate_count_proof_verifies_and_returns_correct_count() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
 
@@ -998,6 +1002,7 @@ fn range_count_with_in_on_prefix_returns_per_brand_color_entries() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
 
@@ -1151,6 +1156,7 @@ fn range_count_executor_accepts_starts_with_in_all_four_modes() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("picker accepts StartsWith");
     let query = DriveDocumentCountQuery {
@@ -1296,6 +1302,7 @@ fn range_count_executor_accepts_empty_starts_with_prefix_via_sentinel() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("picker accepts StartsWith with any value");
     let query = DriveDocumentCountQuery {
@@ -1418,6 +1425,7 @@ fn assert_aggregate_count_proof_returns(
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("range_countable index should be picked");
 
@@ -1715,6 +1723,7 @@ fn aggregate_count_proof_verifies_on_compound_index_with_equal_prefix() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("compound range_countable index should be picked");
 
@@ -1879,6 +1888,7 @@ fn aggregate_count_proof_counts_cars_in_parking_lots_greater_than_b() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byLot range_countable index should be picked");
     let query = DriveDocumentCountQuery {
@@ -2135,6 +2145,7 @@ fn range_count_executor_returns_per_lot_counts_for_lots_greater_than_b() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byLot range_countable index should be picked");
 
@@ -2309,6 +2320,7 @@ fn distinct_count_proof_returns_per_lot_counts_for_lots_greater_than_b() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byLot range_countable index should be picked");
 
@@ -2654,6 +2666,7 @@ fn distinct_count_proof_honors_request_limit() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byLot picked");
     let query = DriveDocumentCountQuery {
@@ -2812,6 +2825,7 @@ fn distinct_count_proof_descending_returns_last_limit_keys() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byLot picked");
     let query = DriveDocumentCountQuery {
@@ -2936,6 +2950,7 @@ fn distinct_count_proof_rejects_limit_above_max_query_limit() {
         limit: Some(too_large),
         prove: true,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
     let result = drive.execute_document_count_request(request, None, pv);
 
@@ -3081,6 +3096,7 @@ fn distinct_count_proof_with_in_on_prefix_returns_per_brand_color_entries() {
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("byBrandColor picked");
     let query = DriveDocumentCountQuery {
diff --git a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/ranked_index_e2e_tests.rs b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/ranked_index_e2e_tests.rs
index 390621a9886..10d656acd9b 100644
--- a/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/ranked_index_e2e_tests.rs
+++ b/packages/rs-drive/src/drive/contract/insert/insert_contract/v0/tests/ranked_index_e2e_tests.rs
@@ -271,49 +271,55 @@ fn group_keys<T>(entries: &[(T, Vec<u8>)]) -> Vec<String> {
         .collect()
 }
 
-fn avg_top_k(drive: &Drive, path: &[Vec<u8>], k: u16, descending: bool) -> Vec<(i128, Vec<u8>)> {
-    let path_refs: Vec<&[u8]> = path.iter().map(|v| v.as_slice()).collect();
-    drive
+fn axis_top_k_keys(
+    drive: &Drive,
+    path: &[Vec<u8>],
+    axis: grovedb_query::IndexAxis,
+    k: u16,
+    descending: bool,
+) -> grovedb::AxisKeys {
+    let path_query = grovedb::PathQuery::new_axis(
+        path.to_vec(),
+        grovedb_query::AxisQuery::top_k(axis, k, 0, descending).keys_only(),
+    );
+    match drive
         .grove
-        .indexed_avg_top_k_keys(
-            path_refs.as_slice(),
-            k,
-            descending,
+        .run_path_query(
+            &path_query,
+            true,
+            true,
+            true,
+            grovedb::query_result_type::QueryResultType::QueryKeyElementPairResultType,
             None,
             &platform_version().drive.grove_version,
         )
         .unwrap()
-        .expect("indexed_avg_top_k_keys must succeed")
+        .expect("the keys-only axis read must succeed")
+    {
+        grovedb::PathQueryRun::AxisKeys { keys, .. } => keys,
+        other => panic!("expected a keys-only axis page, got {other:?}"),
+    }
+}
+
+fn avg_top_k(drive: &Drive, path: &[Vec<u8>], k: u16, descending: bool) -> Vec<(i128, Vec<u8>)> {
+    match axis_top_k_keys(drive, path, grovedb_query::IndexAxis::Avg, k, descending) {
+        grovedb::AxisKeys::Avg(pairs) => pairs,
+        other => panic!("expected avg keys, got {other:?}"),
+    }
 }
 
 fn count_top_k(drive: &Drive, path: &[Vec<u8>], k: u16, descending: bool) -> Vec<(u64, Vec<u8>)> {
-    let path_refs: Vec<&[u8]> = path.iter().map(|v| v.as_slice()).collect();
-    drive
-        .grove
-        .indexed_count_top_k_keys(
-            path_refs.as_slice(),
-            k,
-            descending,
-            None,
-            &platform_version().drive.grove_version,
-        )
-        .unwrap()
-        .expect("indexed_count_top_k_keys must succeed")
+    match axis_top_k_keys(drive, path, grovedb_query::IndexAxis::Count, k, descending) {
+        grovedb::AxisKeys::Count(pairs) => pairs,
+        other => panic!("expected count keys, got {other:?}"),
+    }
 }
 
 fn sum_top_k(drive: &Drive, path: &[Vec<u8>], k: u16, descending: bool) -> Vec<(i64, Vec<u8>)> {
-    let path_refs: Vec<&[u8]> = path.iter().map(|v| v.as_slice()).collect();
-    drive
-        .grove
-        .indexed_sum_top_k_keys(
-            path_refs.as_slice(),
-            k,
-            descending,
-            None,
-            &platform_version().drive.grove_version,
-        )
-        .unwrap()
-        .expect("indexed_sum_top_k_keys must succeed")
+    match axis_top_k_keys(drive, path, grovedb_query::IndexAxis::Sum, k, descending) {
+        grovedb::AxisKeys::Sum(pairs) => pairs,
+        other => panic!("expected sum keys, got {other:?}"),
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -795,6 +801,8 @@ fn compound_ranked_index_resolves_its_terminal_level_to_an_indexed_tree() {
         ranked_countable: false,
         ranked_summable: false,
         ranked_averageable: true,
+        time_range: None,
+        terminal: None,
     };
     let index_structure =
         IndexLevel::try_from_indices([&compound_ranked_index], "dish", platform_version())
@@ -1010,6 +1018,8 @@ fn a_null_unsearchable_ranked_level_is_what_makes_a_phantom_group_possible() {
         ranked_countable: true,
         ranked_summable: false,
         ranked_averageable: false,
+        time_range: None,
+        terminal: None,
     };
 
     for null_searchable in [false, true] {
@@ -1501,6 +1511,7 @@ fn ranked_avg_page(
                     ascending: false,
                 }],
                 where_clauses: &[],
+                resolved_time_ranges: &[],
                 limit: Some(limit),
                 offset: Some(offset),
                 has_start_at: false,
@@ -1547,6 +1558,7 @@ fn verified_ranked_avg_page(
                     ascending: false,
                 }],
                 where_clauses: &[],
+                resolved_time_ranges: &[],
                 limit: Some(limit),
                 offset: Some(offset),
                 has_start_at: false,
@@ -1573,7 +1585,7 @@ fn verified_ranked_avg_page(
         document_type_name: "review".to_string(),
         index: find_ranked_index_for_axis(indexes, GROUP_PROPERTY, &[], RankedAxis::Avg, "grade")
             .expect("the fixture declares rankedAverageable on grade"),
-        equality_prefix_values: vec![],
+        prefix_branches: vec![vec![]],
         axis: RankedAxis::Avg,
         descending: true,
         k: limit as u16,
diff --git a/packages/rs-drive/src/drive/contract/update/update_contract/v0/mod.rs b/packages/rs-drive/src/drive/contract/update/update_contract/v0/mod.rs
index 7366e1e9a0d..234496ea64e 100644
--- a/packages/rs-drive/src/drive/contract/update/update_contract/v0/mod.rs
+++ b/packages/rs-drive/src/drive/contract/update/update_contract/v0/mod.rs
@@ -15,14 +15,13 @@ use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::DataContract;
 use dpp::fee::fee_result::FeeResult;
 
-use dpp::data_contract::document_type::methods::DocumentTypeBasicMethods;
 use dpp::serialization::PlatformSerializableWithPlatformVersion;
 
 use dpp::fee::default_costs::CachedEpochIndexFeeVersions;
 use dpp::version::PlatformVersion;
 use grovedb::batch::KeyInfoPath;
 use grovedb::{Element, EstimatedLayerInformation, TransactionArg, TreeType};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 impl Drive {
     /// Updates a data contract.
@@ -301,10 +300,13 @@ impl Drive {
                     type_key.as_bytes(),
                 ];
 
-                let mut index_cache: HashSet<&[u8]> = HashSet::new();
                 let document_type_ref = document_type.as_ref();
                 let index_structure = document_type_ref.index_structure();
-                // for each type we should insert the indices that are top level.
+                // For each type we should insert the indices that are top
+                // level — one root sub-level per distinct top tree (plain
+                // first properties by name, time-range grids by their
+                // qualified `TimeRangeTransform::storage_key`), the same
+                // iteration `insert_contract_v0` performs.
                 //
                 // `batch_insert_empty_tree_if_not_exists` is a no-op when the
                 // index already exists, so this loop covers BOTH the
@@ -320,13 +322,9 @@ impl Drive {
                 // contract update silently created a NormalTree, diverging
                 // from the layout a fresh insert would have produced and
                 // breaking subsequent range-sum / range-count reads.
-                for index in document_type.as_ref().top_level_indices() {
-                    let index_bytes = index.name.as_bytes();
-                    if !index_cache.contains(index_bytes) {
-                        let index_info = index_structure
-                            .sub_levels()
-                            .get(index.name.as_str())
-                            .and_then(|level| level.has_index_with_type());
+                for (level_key, level) in index_structure.sub_levels() {
+                    {
+                        let index_info = level.has_index_with_type();
                         // Meta schema v3 (PV14) additionally upgrades the
                         // chosen variant to its indexed mirror when the index
                         // declares a ranking axis; `ranked_axes` is empty for
@@ -356,7 +354,7 @@ impl Drive {
                         // indexes (unchanged on disk) and brand-new ones
                         // (materialized with the dispatch-chosen variant).
                         self.batch_insert_empty_index_tree_if_not_exists(
-                            PathFixedSizeKeyRef((type_path, index.name.as_bytes())),
+                            PathFixedSizeKeyRef((type_path, level_key.as_bytes())),
                             target_tree_type,
                             &ranked_axes,
                             storage_flags.as_ref().map(|flags| flags.as_ref()),
@@ -366,7 +364,6 @@ impl Drive {
                             &mut batch_operations,
                             drive_version,
                         )?;
-                        index_cache.insert(index_bytes);
                     }
                 }
             } else {
@@ -461,13 +458,15 @@ impl Drive {
                     )?,
                 }
 
-                let mut index_cache: HashSet<&[u8]> = HashSet::new();
                 let document_type_ref = document_type.as_ref();
                 let index_structure = document_type_ref.index_structure();
-                // for each type we should insert the indices that are top level
-                for index in document_type.as_ref().top_level_indices() {
-                    let index_bytes = index.name.as_bytes();
-                    if !index_cache.contains(index_bytes) {
+                // For each type we should insert the indices that are top
+                // level — the index structure's root sub-levels, whose keys
+                // are grid-qualified for time-range first properties (see
+                // `insert_contract_v0`).
+                for (level_key, level) in index_structure.sub_levels() {
+                    let index_bytes = level_key.as_bytes();
+                    {
                         // Top-level index tree variant is selected from the
                         // index's `(range_countable, range_summable)` pair —
                         // identical 4-way dispatch as
@@ -477,10 +476,7 @@ impl Drive {
                         // sum- or range-countable top-level index added via
                         // contract update, diverging on-disk layout from
                         // fresh-insert contracts.
-                        let index_info = index_structure
-                            .sub_levels()
-                            .get(index.name.as_str())
-                            .and_then(|level| level.has_index_with_type());
+                        let index_info = level.has_index_with_type();
                         let (tree_type, ranked_axes) =
                             property_name_tree_type_and_ranked_axes(index_info)?;
                         match tree_type {
@@ -542,7 +538,6 @@ impl Drive {
                                 drive_version,
                             )?,
                         }
-                        index_cache.insert(index_bytes);
                     }
                 }
             }
diff --git a/packages/rs-drive/src/drive/document/delete/mod.rs b/packages/rs-drive/src/drive/document/delete/mod.rs
index 9e074da93b2..717446bac3f 100644
--- a/packages/rs-drive/src/drive/document/delete/mod.rs
+++ b/packages/rs-drive/src/drive/document/delete/mod.rs
@@ -1047,7 +1047,9 @@ mod tests {
 
         assert!(fee_result.fee_refunds.0.is_empty());
         assert_eq!(fee_result.storage_fee, 0);
-        assert_eq!(fee_result.processing_fee, 71994700);
+        // estimated_size v1 adds the contract-version stamp varint to the
+        // worst-case document size
+        assert_eq!(fee_result.processing_fee, 72064200);
     }
 
     #[test]
diff --git a/packages/rs-drive/src/drive/document/delete/remove_indices_for_top_index_level_for_contract_operations/v2/mod.rs b/packages/rs-drive/src/drive/document/delete/remove_indices_for_top_index_level_for_contract_operations/v2/mod.rs
index 884cf5306d5..f95cd2c06e4 100644
--- a/packages/rs-drive/src/drive/document/delete/remove_indices_for_top_index_level_for_contract_operations/v2/mod.rs
+++ b/packages/rs-drive/src/drive/document/delete/remove_indices_for_top_index_level_for_contract_operations/v2/mod.rs
@@ -8,12 +8,16 @@ use grovedb::EstimatedSumTrees::NoSumTrees;
 use std::collections::HashMap;
 
 use crate::drive::document::estimation_costs::estimated_sum_trees_for_value_tree_type::estimated_sum_trees_for_value_tree_type;
-use crate::drive::document::index_level_tree_types::index_level_tree_types_with_continuation_demotion;
+use crate::drive::document::index_level_tree_types::{
+    index_level_tree_types_with_continuation_demotion, time_range_index_keys,
+};
 use crate::drive::document::unique_event_id;
 use crate::util::type_constants::DEFAULT_HASH_SIZE_U8;
 
 use crate::drive::Drive;
-use crate::util::object_size_info::{DocumentAndContractInfo, DocumentInfoV0Methods, PathInfo};
+use crate::util::object_size_info::{
+    DocumentAndContractInfo, DocumentInfoV0Methods, DriveKeyInfo, PathInfo,
+};
 
 use crate::error::fee::FeeError;
 use crate::error::Error;
@@ -108,13 +112,23 @@ impl Drive {
             let mut index_path: Vec<Vec<u8>> = contract_document_type_path.clone();
             index_path.push(Vec::from(name.as_bytes()));
 
+            // The level key is the path segment; the document value is read
+            // from the *source property* — they differ on a time-range
+            // level, whose key is grid-qualified
+            // (`TimeRangeTransform::storage_key`) while the timestamp lives
+            // under the bare property name. Mirrors the insert walker.
+            let property_name = sub_level
+                .time_range()
+                .map(|transform| transform.source.as_str())
+                .unwrap_or(name.as_str());
+
             // with the example of the dashpay contract's first index
             // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId
             let document_top_field = document_and_contract_info
                 .owned_document_info
                 .document_info
                 .get_raw_for_document_type(
-                    name,
+                    property_name,
                     document_type,
                     document_and_contract_info.owned_document_info.owner_id,
                     Some((sub_level, event_id)),
@@ -127,7 +141,11 @@ impl Drive {
                 let document_top_field_estimated_size = document_and_contract_info
                     .owned_document_info
                     .document_info
-                    .get_estimated_size_for_document_type(name, document_type, platform_version)?;
+                    .get_estimated_size_for_document_type(
+                        property_name,
+                        document_type,
+                        platform_version,
+                    )?;
 
                 if document_top_field_estimated_size > u8::MAX as u16 {
                     return Err(Error::Fee(FeeError::Overflow(
@@ -155,36 +173,67 @@ impl Drive {
             let any_fields_null = document_top_field.is_empty();
             let all_fields_null = document_top_field.is_empty();
 
-            let mut index_path_info = if document_and_contract_info
-                .owned_document_info
-                .document_info
-                .is_document_size()
-            {
-                // This is a stateless operation
-                PathInfo::PathWithSizes(KeyInfoPath::from_known_owned_path(index_path))
-            } else {
-                PathInfo::PathAsVec::<0>(index_path)
-            };
+            // Mirror the insert side's time-range fan-out: a time-range
+            // first-property node removes one index entry per overlapping
+            // range bucket the document's timestamp fell into. The keys are
+            // recomputed deterministically through the same shared helper the
+            // insert walker uses, so they match exactly what insert wrote —
+            // including the null case (single null entry) and the pre-origin
+            // case (no entries on either side).
+            let index_keys: Vec<DriveKeyInfo> = time_range_index_keys(
+                sub_level.time_range(),
+                document_top_field,
+                // A validated contract cannot exceed this; the clamp only
+                // bounds estimation work for unvalidated transforms. The
+                // `unwrap_or(1)` arm is a protocol version without
+                // time-range indexes, where no transform can exist.
+                platform_version
+                    .system_limits
+                    .max_time_range_overlap_factor
+                    .unwrap_or(1),
+            );
 
-            // we push the actual value of the index path
-            index_path_info.push(document_top_field)?;
-            // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId/<ownerId>
-
-            self.remove_indices_for_index_level_for_contract_operations(
-                document_and_contract_info,
-                index_path_info,
-                sub_level,
-                any_fields_null,
-                all_fields_null,
-                value_tree_type,
-                &storage_flags,
-                previous_batch_operations,
-                estimated_costs_only_with_layer_info,
-                event_id,
-                transaction,
-                batch_operations,
-                platform_version,
-            )?;
+            let bucket_count = index_keys.len();
+            for (bucket, index_key) in index_keys.into_iter().enumerate() {
+                // The final bucket takes ownership of `index_path`; earlier
+                // buckets (only a time-range fan-out has more than one)
+                // clone it.
+                let own_index_path = if bucket + 1 == bucket_count {
+                    std::mem::take(&mut index_path)
+                } else {
+                    index_path.clone()
+                };
+                let mut index_path_info = if document_and_contract_info
+                    .owned_document_info
+                    .document_info
+                    .is_document_size()
+                {
+                    // This is a stateless operation
+                    PathInfo::PathWithSizes(KeyInfoPath::from_known_owned_path(own_index_path))
+                } else {
+                    PathInfo::PathAsVec::<0>(own_index_path)
+                };
+
+                // we push the actual value of the index path
+                index_path_info.push(index_key)?;
+                // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId/<ownerId>
+
+                self.remove_indices_for_index_level_for_contract_operations(
+                    document_and_contract_info,
+                    index_path_info,
+                    sub_level,
+                    any_fields_null,
+                    all_fields_null,
+                    value_tree_type,
+                    &storage_flags,
+                    previous_batch_operations,
+                    estimated_costs_only_with_layer_info,
+                    event_id,
+                    transaction,
+                    batch_operations,
+                    platform_version,
+                )?;
+            }
         }
         Ok(())
     }
diff --git a/packages/rs-drive/src/drive/document/index_level_tree_types.rs b/packages/rs-drive/src/drive/document/index_level_tree_types.rs
index a5c9303e902..c4400187f60 100644
--- a/packages/rs-drive/src/drive/document/index_level_tree_types.rs
+++ b/packages/rs-drive/src/drive/document/index_level_tree_types.rs
@@ -75,7 +75,9 @@
 
 use crate::drive::document::ranked_index_tree_type::property_name_tree_type_and_ranked_axes;
 use crate::error::Error;
-use dpp::data_contract::document_type::IndexLevel;
+use crate::util::object_size_info::DriveKeyInfo;
+use dpp::data_contract::document_type::{IndexLevel, TimeRangeTransform};
+use grovedb::batch::key_info::KeyInfo;
 use grovedb::element::IndexAxis;
 use grovedb::TreeType;
 
@@ -128,6 +130,69 @@ pub(crate) fn index_level_tree_types_with_continuation_demotion(
     })
 }
 
+/// Expands a document's raw top-field key into the set of index-entry keys a
+/// time-range first-property node stores it under. For a node without a
+/// transform the single key passes through untouched.
+///
+/// Shared by the insert and delete v2 walkers (same must-not-drift contract
+/// as the tree-type derivation above); the entry-key rule itself — null keeps
+/// its single null entry, epoch-sliver timestamps produce no entries,
+/// undecodable values keep their raw key — lives in
+/// [`TimeRangeTransform::entry_keys_for_raw`], which the update walker also
+/// calls.
+///
+/// On the estimated-cost path (`KeySize`) the real timestamp isn't available,
+/// so this assumes the worst case of `overlap_factor` overlapping buckets —
+/// and makes each worst-case key **distinct** by suffixing an ordinal:
+/// identical `(path, key)` operations collapse inside grovedb's batch
+/// structure, so `overlap` copies of one key would silently estimate a single
+/// bucket's cost.
+///
+/// `max_overlap_factor` is the platform version's
+/// `SystemLimits::max_time_range_overlap_factor` — a validated contract can
+/// never exceed it, so the clamp only bounds estimation work for a transform
+/// built outside validation, and reading it from the version keeps the
+/// estimated fan-out in step with whatever a future protocol version allows.
+pub(crate) fn time_range_index_keys<'a>(
+    transform: Option<&TimeRangeTransform>,
+    document_top_field: DriveKeyInfo<'a>,
+    max_overlap_factor: u64,
+) -> Vec<DriveKeyInfo<'a>> {
+    let Some(transform) = transform else {
+        return vec![document_top_field];
+    };
+    match &document_top_field {
+        DriveKeyInfo::KeySize(key_info) => {
+            // Not `clamp(1, max)`: `Ord::clamp` asserts `min <= max`, so a
+            // future limits table carrying `Some(0)` would panic here.
+            let overlap = transform.overlap_factor().min(max_overlap_factor).max(1) as usize;
+            (0..overlap)
+                .map(|ordinal| {
+                    let mut key_info = key_info.clone();
+                    let suffix = (ordinal as u16).to_be_bytes();
+                    match &mut key_info {
+                        KeyInfo::KnownKey(bytes) => bytes.extend_from_slice(&suffix),
+                        KeyInfo::MaxKeySize { unique_id, .. } => {
+                            unique_id.extend_from_slice(&suffix)
+                        }
+                    }
+                    DriveKeyInfo::KeySize(key_info)
+                })
+                .collect()
+        }
+        DriveKeyInfo::Key(raw) => transform
+            .entry_keys_for_raw(raw)
+            .into_iter()
+            .map(DriveKeyInfo::Key)
+            .collect(),
+        DriveKeyInfo::KeyRef(raw) => transform
+            .entry_keys_for_raw(raw)
+            .into_iter()
+            .map(DriveKeyInfo::Key)
+            .collect(),
+    }
+}
+
 /// Pure derivation of the value-tree type over the level's four
 /// terminator flags plus whether continuations hang beneath it. Split
 /// out so the full input space is unit-testable without constructing
@@ -329,6 +394,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: true,
+            time_range: None,
+            terminal: None,
         };
         let compound = Index {
             name: "byRestaurantChef".to_string(),
@@ -352,6 +419,8 @@ mod tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         };
 
         let index_structure =
@@ -394,4 +463,66 @@ mod tests {
         )
         .expect("the continuation must be insertable under the demoted value tree");
     }
+    /// The estimated-cost (`KeySize`) branch of [`time_range_index_keys`] is
+    /// consensus-sensitive fee math: it must emit exactly the bounded
+    /// overlap count, keep every synthetic key's `max_size` untouched, and
+    /// make each `unique_id` distinct — grovedb's batch structure collapses
+    /// identical `(path, key)` operations, so `overlap` copies of one key
+    /// would silently estimate a single bucket's cost.
+    #[test]
+    fn estimated_time_range_fan_out_emits_distinct_worst_case_keys() {
+        use super::time_range_index_keys;
+        use crate::util::object_size_info::DriveKeyInfo;
+        use dpp::data_contract::document_type::TimeRangeTransform;
+        use grovedb::batch::key_info::KeyInfo;
+
+        // 6h window sliding every 2h — overlap factor 3.
+        let transform = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 21_600,
+            step_seconds: 7_200,
+            phase_seconds: 0,
+        };
+        let key = DriveKeyInfo::KeySize(KeyInfo::MaxKeySize {
+            unique_id: vec![7u8; 4],
+            max_size: 8,
+        });
+
+        let keys = time_range_index_keys(Some(&transform), key.clone(), 24);
+        assert_eq!(keys.len(), 3, "one worst-case key per overlapping bucket");
+        let mut unique_ids = Vec::new();
+        for entry in &keys {
+            let DriveKeyInfo::KeySize(KeyInfo::MaxKeySize {
+                unique_id,
+                max_size,
+            }) = entry
+            else {
+                panic!("the KeySize branch must stay on the estimation path");
+            };
+            assert_eq!(
+                *max_size, 8,
+                "the ordinal suffix disambiguates unique_id only; the estimated \
+                 key size must be the timestamp key's"
+            );
+            unique_ids.push(unique_id.clone());
+        }
+        let distinct: std::collections::BTreeSet<_> = unique_ids.iter().collect();
+        assert_eq!(
+            distinct.len(),
+            3,
+            "identical unique_ids would collapse in the batch and under-estimate"
+        );
+
+        // An unvalidated transform above the version's cap is clamped: the
+        // estimation work stays bounded by what the protocol version allows.
+        let oversized = TimeRangeTransform {
+            source: "$createdAt".to_string(),
+            range_seconds: 100 * 3_600,
+            step_seconds: 3_600,
+            phase_seconds: 0,
+        };
+        assert_eq!(oversized.overlap_factor(), 100);
+        let keys = time_range_index_keys(Some(&oversized), key, 24);
+        assert_eq!(keys.len(), 24, "fan-out must clamp to the versioned cap");
+    }
 }
diff --git a/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v0/mod.rs b/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v0/mod.rs
index 7612dab7976..b649ced298c 100644
--- a/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v0/mod.rs
+++ b/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v0/mod.rs
@@ -185,6 +185,7 @@ impl Drive {
                             start_at: None,
                             start_at_included: false,
                             block_time_ms: None,
+                            resolved_time_ranges: vec![],
                         };
 
                         // todo: deal with cost of this operation
diff --git a/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v1/mod.rs b/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v1/mod.rs
index 4b5ea32f058..2c3572be562 100644
--- a/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v1/mod.rs
+++ b/packages/rs-drive/src/drive/document/index_uniqueness/internal/validate_uniqueness_of_data/v1/mod.rs
@@ -4,13 +4,16 @@ use crate::drive::document::index_uniqueness::internal::validate_uniqueness_of_d
     UniquenessOfDataRequestUpdateType, UniquenessOfDataRequestV1,
 };
 use crate::drive::document::query::QueryDocumentsOutcomeV0Methods;
+use crate::error::drive::DriveError;
 use crate::error::Error;
-use crate::query::{DriveDocumentQuery, InternalClauses, WhereClause, WhereOperator};
+use crate::query::{
+    DriveDocumentQuery, InternalClauses, ResolvedTimeRange, WhereClause, WhereOperator,
+};
 use dpp::consensus::state::document::duplicate_unique_index_error::DuplicateUniqueIndexError;
 use dpp::consensus::state::state_error::StateError;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::document::{property_names, DocumentV0Getters};
-use dpp::platform_value::platform_value;
+use dpp::platform_value::{platform_value, Value};
 use dpp::validation::SimpleConsensusValidationResult;
 use dpp::version::PlatformVersion;
 use grovedb::TransactionArg;
@@ -70,7 +73,7 @@ impl Drive {
                     // if an index is not unique there is no issue
                     None
                 } else {
-                    let (where_queries, allow_original) = match &update_type {
+                    let (mut where_queries, allow_original) = match &update_type {
                         UniquenessOfDataRequestUpdateType::NewDocument => {
                             let where_queries = index
                                 .properties
@@ -352,6 +355,93 @@ impl Drive {
                         // there are empty fields, which means that the index is no longer unique
                         None
                     } else {
+                        // A unique time-range index stores bucket *starts*
+                        // under its first property, never raw timestamps, so
+                        // probing it with the candidate document's own
+                        // timestamp would look in a key that no document ever
+                        // occupies and report every duplicate as unique.
+                        // Rewrite the source equality to the containing
+                        // bucket, and record the rewrite as provenance so
+                        // index selection admits the bucketed index (see
+                        // `index_admissible_for_resolved_time_range`): this is
+                        // a legitimate internal producer of a resolved bucket
+                        // equality — the value is derived deterministically
+                        // from the candidate document's own timestamp through
+                        // the contract's transform, so every node computes the
+                        // identical clause.
+                        //
+                        // On the `ChangedDocument` path this stays correct
+                        // without any old-vs-new bucket tracking (which the
+                        // request has no field for — note the arm carries no
+                        // `changed_created_at` flag): a unique time-range
+                        // index is validated to bucket `$createdAt`, which is
+                        // immutable across updates, so the bucket component of
+                        // the tuple never moves and `allow_original` keeps its
+                        // meaning — the tuple changed exactly when one of the
+                        // index's other properties changed.
+                        let mut resolved_time_ranges = Vec::new();
+                        if let Some(transform) = &index.time_range {
+                            let Some(clause) = where_queries.get_mut(transform.source.as_str())
+                            else {
+                                // Unreachable: the transform's source is
+                                // validated to be the index's first property,
+                                // and the count check above established that
+                                // every property produced a clause.
+                                return Some(Err(Error::Drive(
+                                    DriveError::CorruptedCodeExecution(
+                                        "a time-range index's source must be one of its \
+                                         properties",
+                                    ),
+                                )));
+                            };
+                            // The clause value was built by `platform_value!`
+                            // from an `Option<TimestampMillis>`, so it is a
+                            // `U64`; `I64` is accepted defensively because a
+                            // non-system-timestamp source would arrive through
+                            // the document data map. Anything else is
+                            // unreachable under a validated contract and must
+                            // fail loudly: silently skipping this index's
+                            // check would let the collision surface later as
+                            // a corrupted-index insert error, because the
+                            // write path stores a non-timestamp value under
+                            // its raw key rather than dropping it.
+                            let timestamp =
+                                match &clause.value {
+                                    Value::U64(timestamp) => *timestamp,
+                                    Value::I64(timestamp) => match u64::try_from(*timestamp) {
+                                        Ok(timestamp) => timestamp,
+                                        Err(_) => return Some(Err(Error::Drive(
+                                            DriveError::CorruptedCodeExecution(
+                                                "a unique time-range index's source value must \
+                                                 be a millisecond timestamp",
+                                            ),
+                                        ))),
+                                    },
+                                    _ => {
+                                        return Some(Err(Error::Drive(
+                                            DriveError::CorruptedCodeExecution(
+                                                "a unique time-range index's source value must be \
+                                             a millisecond timestamp",
+                                            ),
+                                        )))
+                                    }
+                                };
+                            // A validated unique time-range index has overlap
+                            // factor 1 (range == step), so any real timestamp
+                            // yields exactly one containing bucket. An empty
+                            // result means the timestamp falls in the
+                            // sub-`step` epoch sliver before the grid's phase
+                            // anchor: such documents produce no index entries
+                            // at all, so they cannot collide with anything
+                            // under this index and the whole check is skipped
+                            // for it.
+                            let bucket_start = *transform.containing_buckets(timestamp).first()?;
+                            clause.value = platform_value!(bucket_start);
+                            resolved_time_ranges.push(ResolvedTimeRange {
+                                transform: transform.clone(),
+                            });
+                        }
+
                         let query = DriveDocumentQuery {
                             contract,
                             document_type,
@@ -368,6 +458,7 @@ impl Drive {
                             start_at: None,
                             start_at_included: false,
                             block_time_ms: None,
+                            resolved_time_ranges,
                         };
 
                         // todo: deal with cost of this operation
diff --git a/packages/rs-drive/src/drive/document/index_uniqueness/mod.rs b/packages/rs-drive/src/drive/document/index_uniqueness/mod.rs
index 5e1f8f3672d..faf6228b017 100644
--- a/packages/rs-drive/src/drive/document/index_uniqueness/mod.rs
+++ b/packages/rs-drive/src/drive/document/index_uniqueness/mod.rs
@@ -700,3 +700,485 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+#[cfg(feature = "server")]
+mod unique_time_range_index_tests {
+    //! A unique time-range index expresses "at most one document per
+    //! non-overlapping window per remaining key tuple" — one report per author
+    //! per day. Its uniqueness probe therefore has to look in the *bucket* the
+    //! candidate's `$createdAt` falls into: the index stores bucket starts, not
+    //! raw timestamps, so a probe on the raw value would look at a key no
+    //! document ever occupies and pronounce every duplicate unique.
+    //!
+    //! The rewritten equality is indistinguishable from a client-written one
+    //! once built, so the probe must also carry the resolution provenance —
+    //! without it index selection refuses to route a `$createdAt` equality to a
+    //! bucketed index and the probe would fail to find any index at all.
+    use std::borrow::Cow;
+    use std::collections::{BTreeMap, BTreeSet};
+
+    use dpp::block::block_info::BlockInfo;
+    use dpp::consensus::state::state_error::StateError;
+    use dpp::consensus::ConsensusError;
+    use dpp::data_contract::accessors::v0::DataContractV0Getters;
+    use dpp::data_contract::DataContractFactory;
+    use dpp::document::{Document, DocumentV0, DocumentV0Getters};
+    use dpp::identifier::Identifier;
+    use dpp::platform_value::{platform_value, Value};
+    use dpp::prelude::DataContract;
+    use dpp::validation::SimpleConsensusValidationResult;
+    use dpp::version::PlatformVersion;
+
+    use crate::drive::document::index_uniqueness::internal::validate_uniqueness_of_data::{
+        UniquenessOfDataRequest, UniquenessOfDataRequestUpdateType, UniquenessOfDataRequestV1,
+    };
+    use crate::drive::Drive;
+    use crate::util::object_size_info::DocumentInfo::DocumentRefInfo;
+    use crate::util::object_size_info::{DocumentAndContractInfo, OwnedDocumentInfo};
+    use crate::util::storage_flags::StorageFlags;
+    use crate::util::test_helpers::setup::setup_drive_with_initial_state_structure;
+
+    /// One day in each of the two units these tests deal in: the contract
+    /// declares its window in seconds, while every `$createdAt` and every
+    /// bucket start is a millisecond timestamp.
+    const DAY_SECONDS: u64 = 24 * 3_600;
+    const DAY_MS: u64 = 24 * 3_600_000;
+
+    /// Deterministic 32-byte fixture identifier derived from the document's
+    /// own fixture inputs. Identifiers here are plumbing, not test inputs:
+    /// fixed bytes keep a failing GroveDB fixture reproducible run-to-run and
+    /// avoid an OS-entropy dependency (and its unwrap) in
+    /// consensus-sensitive tests. `marker` separates namespaces (document id
+    /// vs owner) and same-timestamp siblings.
+    fn fixture_bytes(marker: u8, created_at: u64, tag: &str) -> [u8; 32] {
+        let mut bytes = [0u8; 32];
+        bytes[0] = marker;
+        bytes[1..9].copy_from_slice(&created_at.to_be_bytes());
+        for (i, byte) in tag.bytes().take(23).enumerate() {
+            bytes[9 + i] = byte;
+        }
+        bytes
+    }
+    /// Start of the window every "same window" timestamp below lands in —
+    /// a whole number of days, so it is a bucket start on the default
+    /// (phase 0) daily grid.
+    const WINDOW_MS: u64 = 100 * DAY_MS;
+    /// A half-day phase for the phased-grid test: bucket starts move to
+    /// `k * day + 12h`, and the only timestamps outside every window are the
+    /// first twelve hours of 1970 — the epoch sliver the probe must skip.
+    const PHASE_SECONDS: u64 = 12 * 3_600;
+    const PHASE_MS: u64 = 12 * 3_600_000;
+
+    /// A `report` document type with a UNIQUE
+    /// `(timeRange($createdAt, range = step = 1 day), author)` index: one
+    /// report per author per calendar day. Both index properties are required,
+    /// so neither can be null and the terminator always takes the unique
+    /// layout.
+    ///
+    /// `phase_seconds` shifts the window grid within one step (validation
+    /// requires `phase < step`); `None` leaves it at the default (0).
+    fn build_unique_daily_report_contract(phase_seconds: Option<u64>) -> DataContract {
+        let factory =
+            DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+        let mut time_range = vec![
+            (
+                Value::Text("on".to_string()),
+                Value::Text("$createdAt".to_string()),
+            ),
+            (Value::Text("range".to_string()), Value::U64(DAY_SECONDS)),
+            (Value::Text("step".to_string()), Value::U64(DAY_SECONDS)),
+        ];
+        if let Some(phase_seconds) = phase_seconds {
+            time_range.push((Value::Text("phase".to_string()), Value::U64(phase_seconds)));
+        }
+        let index_map = vec![
+            (
+                Value::Text("name".to_string()),
+                Value::Text("dailyReport".to_string()),
+            ),
+            (
+                Value::Text("properties".to_string()),
+                Value::Array(vec![
+                    platform_value!({"$createdAt": "asc"}),
+                    platform_value!({"author": "asc"}),
+                ]),
+            ),
+            (Value::Text("unique".to_string()), Value::Bool(true)),
+            (Value::Text("timeRange".to_string()), Value::Map(time_range)),
+        ];
+
+        let document_schema = platform_value!({
+            "type": "object",
+            "properties": {
+                "author": {"type": "string", "maxLength": 63, "position": 0},
+            },
+            "required": ["author", "$createdAt"],
+            "indices": Value::Array(vec![Value::Map(index_map)]),
+            "additionalProperties": false,
+        });
+        let schemas = platform_value!({ "report": document_schema });
+        factory
+            .create_with_value_config(Identifier::from([201u8; 32]), 0, schemas, None, None)
+            .expect("create contract")
+            .data_contract_owned()
+    }
+
+    fn setup(platform_version: &'static PlatformVersion) -> (Drive, DataContract) {
+        setup_with_phase(None, platform_version)
+    }
+
+    fn setup_with_phase(
+        phase_seconds: Option<u64>,
+        platform_version: &'static PlatformVersion,
+    ) -> (Drive, DataContract) {
+        let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+        let contract = build_unique_daily_report_contract(phase_seconds);
+        drive
+            .apply_contract(
+                &contract,
+                BlockInfo::default(),
+                true,
+                StorageFlags::optional_default_as_cow(),
+                None,
+                platform_version,
+            )
+            .expect("apply contract");
+        (drive, contract)
+    }
+
+    /// Stores a `report` and returns its id.
+    fn insert_report(
+        drive: &Drive,
+        contract: &DataContract,
+        created_at: u64,
+        author: &str,
+        platform_version: &PlatformVersion,
+    ) -> Identifier {
+        let document_type = contract.document_type_for_name("report").expect("report");
+        let owner_bytes = fixture_bytes(1, created_at, author);
+        let document = Document::V0(DocumentV0 {
+            id: Identifier::from(fixture_bytes(2, created_at, author)),
+            owner_id: Identifier::from(owner_bytes),
+            properties: BTreeMap::from([("author".to_string(), Value::Text(author.to_string()))]),
+            created_at: Some(created_at),
+            revision: Some(1),
+            ..Default::default()
+        });
+        let document_id = document.id();
+        drive
+            .add_document_for_contract(
+                DocumentAndContractInfo {
+                    owned_document_info: OwnedDocumentInfo {
+                        document_info: DocumentRefInfo((
+                            &document,
+                            StorageFlags::optional_default_as_cow(),
+                        )),
+                        owner_id: Some(owner_bytes),
+                    },
+                    contract,
+                    document_type,
+                },
+                false,
+                BlockInfo::default(),
+                true,
+                None,
+                platform_version,
+                None,
+            )
+            .expect("add document");
+        document_id
+    }
+
+    /// Runs the uniqueness validation for a candidate `report`.
+    fn check_uniqueness(
+        drive: &Drive,
+        contract: &DataContract,
+        document_id: Identifier,
+        created_at: u64,
+        author: &str,
+        update_type: UniquenessOfDataRequestUpdateType,
+        platform_version: &PlatformVersion,
+    ) -> SimpleConsensusValidationResult {
+        let document_type = contract.document_type_for_name("report").expect("report");
+        let data = BTreeMap::from([("author".to_string(), Value::Text(author.to_string()))]);
+        let request = UniquenessOfDataRequestV1 {
+            contract,
+            document_type,
+            owner_id: Identifier::from([0x01; 32]),
+            creator_id: None,
+            document_id,
+            created_at: Some(created_at),
+            updated_at: None,
+            transferred_at: None,
+            created_at_block_height: None,
+            updated_at_block_height: None,
+            transferred_at_block_height: None,
+            created_at_core_block_height: None,
+            updated_at_core_block_height: None,
+            transferred_at_core_block_height: None,
+            data: &data,
+            update_type,
+        };
+        drive
+            .validate_uniqueness_of_data(
+                UniquenessOfDataRequest::V1(request),
+                None,
+                platform_version,
+            )
+            .expect("uniqueness validation should run")
+    }
+
+    fn assert_duplicate(result: &SimpleConsensusValidationResult, context: &str) {
+        assert!(
+            matches!(
+                result.errors.first(),
+                Some(ConsensusError::StateError(
+                    StateError::DuplicateUniqueIndexError(_)
+                ))
+            ),
+            "{context}: expected a DuplicateUniqueIndexError, got: {:?}",
+            result.errors
+        );
+    }
+
+    /// The core of the feature: two documents whose raw `$createdAt` values
+    /// differ by hours still occupy the same day bucket, so the second one
+    /// violates the unique index. A probe that compared raw timestamps would
+    /// see an empty index and let it through.
+    #[test]
+    fn candidate_in_the_same_window_as_a_stored_document_is_a_duplicate() {
+        let platform_version = PlatformVersion::latest();
+        let (drive, contract) = setup(platform_version);
+
+        insert_report(
+            &drive,
+            &contract,
+            WINDOW_MS + 3_600_000,
+            "alice",
+            platform_version,
+        );
+
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            Identifier::from([0xAA; 32]),
+            // 8 hours later — a different timestamp, the same day bucket.
+            WINDOW_MS + 9 * 3_600_000,
+            "alice",
+            UniquenessOfDataRequestUpdateType::NewDocument,
+            platform_version,
+        );
+        assert_duplicate(&result, "same window, same author");
+    }
+
+    /// The next window is a different bucket, so the same author may report
+    /// again — and the write actually goes through, proving the probe agrees
+    /// with the layout the insert walker builds.
+    #[test]
+    fn candidate_in_the_next_window_is_unique_and_insertable() {
+        let platform_version = PlatformVersion::latest();
+        let (drive, contract) = setup(platform_version);
+
+        insert_report(
+            &drive,
+            &contract,
+            WINDOW_MS + 3_600_000,
+            "alice",
+            platform_version,
+        );
+
+        let next_window_timestamp = WINDOW_MS + DAY_MS + 3_600_000;
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            Identifier::from([0xAA; 32]),
+            next_window_timestamp,
+            "alice",
+            UniquenessOfDataRequestUpdateType::NewDocument,
+            platform_version,
+        );
+        assert!(
+            result.is_valid(),
+            "the next window is a different bucket: {:?}",
+            result.errors
+        );
+
+        insert_report(
+            &drive,
+            &contract,
+            next_window_timestamp,
+            "alice",
+            platform_version,
+        );
+    }
+
+    /// The bucket is only the first component of the tuple: a different author
+    /// in the same window is a different slot.
+    #[test]
+    fn candidate_in_the_same_window_with_a_different_suffix_is_unique() {
+        let platform_version = PlatformVersion::latest();
+        let (drive, contract) = setup(platform_version);
+
+        insert_report(
+            &drive,
+            &contract,
+            WINDOW_MS + 3_600_000,
+            "alice",
+            platform_version,
+        );
+
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            Identifier::from([0xAA; 32]),
+            WINDOW_MS + 9 * 3_600_000,
+            "bob",
+            UniquenessOfDataRequestUpdateType::NewDocument,
+            platform_version,
+        );
+        assert!(
+            result.is_valid(),
+            "a different author in the same window is a different tuple: {:?}",
+            result.errors
+        );
+
+        insert_report(
+            &drive,
+            &contract,
+            WINDOW_MS + 9 * 3_600_000,
+            "bob",
+            platform_version,
+        );
+    }
+
+    /// Update semantics. `$createdAt` is immutable — that is exactly why a
+    /// unique time-range index is allowed to bucket it — so on the
+    /// `ChangedDocument` path the bucket component of the tuple never moves and
+    /// `allow_original` keeps its ordinary meaning: a document may keep the
+    /// slot it already holds, but may not move into one another document holds.
+    #[test]
+    fn changed_document_keeps_its_own_slot_but_cannot_take_another_documents_slot() {
+        let platform_version = PlatformVersion::latest();
+        let (drive, contract) = setup(platform_version);
+
+        let alice_created_at = WINDOW_MS + 3_600_000;
+        let alice_id = insert_report(
+            &drive,
+            &contract,
+            alice_created_at,
+            "alice",
+            platform_version,
+        );
+        // A second document in the SAME window under a different author.
+        insert_report(
+            &drive,
+            &contract,
+            WINDOW_MS + 9 * 3_600_000,
+            "bob",
+            platform_version,
+        );
+
+        // Alice's document changing its author to "bob" walks into the slot
+        // bob's document already holds, in the same (unchanged) bucket.
+        let changed_author: BTreeSet<String> = BTreeSet::from(["author".to_string()]);
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            alice_id,
+            alice_created_at,
+            "bob",
+            UniquenessOfDataRequestUpdateType::ChangedDocument {
+                changed_owner_id: false,
+                changed_updated_at: false,
+                changed_transferred_at: false,
+                changed_updated_at_block_height: false,
+                changed_transferred_at_block_height: false,
+                changed_updated_at_core_block_height: false,
+                changed_transferred_at_core_block_height: false,
+                changed_data_values: Cow::Borrowed(&changed_author),
+            },
+            platform_version,
+        );
+        assert_duplicate(&result, "moving onto another document's tuple");
+
+        // The same document re-submitted with its own tuple finds itself in
+        // the bucket and is allowed to stay (`allow_original`).
+        let unchanged: BTreeSet<String> = BTreeSet::new();
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            alice_id,
+            alice_created_at,
+            "alice",
+            UniquenessOfDataRequestUpdateType::ChangedDocument {
+                changed_owner_id: false,
+                changed_updated_at: false,
+                changed_transferred_at: false,
+                changed_updated_at_block_height: false,
+                changed_transferred_at_block_height: false,
+                changed_updated_at_core_block_height: false,
+                changed_transferred_at_core_block_height: false,
+                changed_data_values: Cow::Borrowed(&unchanged),
+            },
+            platform_version,
+        );
+        assert!(
+            result.is_valid(),
+            "a document must be allowed to keep the slot it already holds: {:?}",
+            result.errors
+        );
+    }
+
+    /// A `$createdAt` inside the epoch sliver before the grid's phase anchor
+    /// produces no index entries at all (the insert walker writes none), so
+    /// such a document cannot collide with anything: the probe must skip this
+    /// index entirely rather than invent a bucket for a timestamp that
+    /// belongs to none. No real timestamp reaches the sliver — this pins the
+    /// defensive rule all three walkers and the probe share.
+    #[test]
+    fn epoch_sliver_candidate_skips_the_time_range_index_check() {
+        let platform_version = PlatformVersion::latest();
+        let (drive, contract) = setup_with_phase(Some(PHASE_SECONDS), platform_version);
+
+        // A stored report in the phased grid's first window `[12h, 36h)`.
+        insert_report(
+            &drive,
+            &contract,
+            PHASE_MS + 3_600_000,
+            "alice",
+            platform_version,
+        );
+
+        // Same author, timestamp one millisecond before the phase anchor: it
+        // belongs to no window, so there is nothing for it to duplicate.
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            Identifier::from([0xAA; 32]),
+            PHASE_MS - 1,
+            "alice",
+            UniquenessOfDataRequestUpdateType::NewDocument,
+            platform_version,
+        );
+        assert!(
+            result.is_valid(),
+            "an epoch-sliver document is not indexed, so it cannot collide: {:?}",
+            result.errors
+        );
+
+        // Contrast: inside the first window the same author does collide, so
+        // the skip above is the sliver talking and not a probe that silently
+        // stopped working on this contract.
+        let result = check_uniqueness(
+            &drive,
+            &contract,
+            Identifier::from([0xAA; 32]),
+            PHASE_MS + 9 * 3_600_000,
+            "alice",
+            UniquenessOfDataRequestUpdateType::NewDocument,
+            platform_version,
+        );
+        assert_duplicate(&result, "inside the first window");
+    }
+}
diff --git a/packages/rs-drive/src/drive/document/insert/add_document_for_contract/mod.rs b/packages/rs-drive/src/drive/document/insert/add_document_for_contract/mod.rs
index df06944d777..28310f15ada 100644
--- a/packages/rs-drive/src/drive/document/insert/add_document_for_contract/mod.rs
+++ b/packages/rs-drive/src/drive/document/insert/add_document_for_contract/mod.rs
@@ -62,3 +62,6 @@ impl Drive {
         }
     }
 }
+
+#[cfg(test)]
+mod time_range_index_e2e_tests;
diff --git a/packages/rs-drive/src/drive/document/insert/add_document_for_contract/time_range_index_e2e_tests.rs b/packages/rs-drive/src/drive/document/insert/add_document_for_contract/time_range_index_e2e_tests.rs
new file mode 100644
index 00000000000..d26fee42864
--- /dev/null
+++ b/packages/rs-drive/src/drive/document/insert/add_document_for_contract/time_range_index_e2e_tests.rs
@@ -0,0 +1,1635 @@
+//! End-to-end coverage for time-range index fan-out: a single document is
+//! indexed under every overlapping range bucket its `$createdAt` falls
+//! into, those buckets are queryable by exact bucket start, and deletion
+//! removes every entry.
+//!
+//! Also covers the other half of that contract: a bucket-start equality
+//! only means "bucket" when it came from `IN_TIME_RANGE` resolution, so
+//! index selection is pinned by
+//! [`DriveDocumentQuery::resolved_time_ranges`] rather than left to
+//! whichever index happens to cover the fields.
+use crate::config::DriveConfig;
+use crate::drive::Drive;
+use crate::error::query::QuerySyntaxError;
+use crate::error::Error;
+use crate::query::{
+    resolve_time_range_bucket_clause, DriveDocumentQuery, ResolvedTimeRange, TimeRangeGridSpec,
+    TimeRangeSelector,
+};
+use crate::util::object_size_info::DocumentInfo::DocumentRefInfo;
+use crate::util::object_size_info::{DocumentAndContractInfo, OwnedDocumentInfo};
+use crate::util::storage_flags::StorageFlags;
+use crate::util::test_helpers::setup::setup_drive_with_initial_state_structure;
+use dpp::block::block_info::BlockInfo;
+use dpp::data_contract::accessors::v0::DataContractV0Getters;
+use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
+use dpp::data_contract::document_type::DocumentTypeRef;
+use dpp::data_contract::DataContractFactory;
+use dpp::document::serialization_traits::DocumentPlatformConversionMethodsV0;
+use dpp::document::{Document, DocumentV0, DocumentV0Getters, DocumentV0Setters};
+use dpp::platform_value::{platform_value, Identifier, Value};
+use dpp::prelude::DataContract;
+use dpp::version::PlatformVersion;
+use std::collections::BTreeMap;
+
+/// One hour in each of the two units these tests deal in: `*_SECONDS`
+/// declares a contract's window, `*_MS` is a document timestamp, a bucket
+/// start or an index key. Scaling the wrong one silently shifts the
+/// buckets by a factor of a thousand, so they are kept apart by name.
+const HOUR_SECONDS: u64 = 3_600;
+const HOUR_MS: u64 = 3_600_000;
+
+/// Deterministic 32-byte fixture identifier derived from the document's
+/// own fixture inputs. Identifiers here are plumbing, not test inputs:
+/// fixed bytes keep a failing GroveDB fixture reproducible run-to-run and
+/// avoid an OS-entropy dependency (and its unwrap) in
+/// consensus-sensitive tests. `marker` separates namespaces (document id
+/// vs owner) and same-timestamp siblings.
+fn fixture_bytes(marker: u8, created_at: u64, tag: &str) -> [u8; 32] {
+    let mut bytes = [0u8; 32];
+    bytes[0] = marker;
+    bytes[1..9].copy_from_slice(&created_at.to_be_bytes());
+    for (i, byte) in tag.bytes().take(23).enumerate() {
+        bytes[9 + i] = byte;
+    }
+    bytes
+}
+
+/// A latest-protocol `post` document type with a `(timeRange($createdAt, range=6h,
+/// step=2h), hashtag)` countable index — i.e. trending hashtags over a
+/// 6-hour window refreshed every 2 hours (overlap factor 3).
+fn build_trending_contract() -> DataContract {
+    let factory =
+        DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+    let index_map = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("trending".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![
+                platform_value!({"$createdAt": "asc"}),
+                platform_value!({"hashtag": "asc"}),
+            ]),
+        ),
+        (
+            Value::Text("timeRange".to_string()),
+            Value::Map(vec![
+                (
+                    Value::Text("on".to_string()),
+                    Value::Text("$createdAt".to_string()),
+                ),
+                (
+                    Value::Text("range".to_string()),
+                    Value::U64(6 * HOUR_SECONDS),
+                ),
+                (
+                    Value::Text("step".to_string()),
+                    Value::U64(2 * HOUR_SECONDS),
+                ),
+            ]),
+        ),
+        (
+            Value::Text("countable".to_string()),
+            Value::Text("countable".to_string()),
+        ),
+    ];
+
+    let document_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "hashtag": {"type": "string", "maxLength": 63, "position": 0},
+        },
+        "required": ["hashtag", "$createdAt"],
+        "indices": Value::Array(vec![Value::Map(index_map)]),
+        "additionalProperties": false,
+    });
+    let schemas = platform_value!({ "post": document_schema });
+    let owner_id = Identifier::from([201u8; 32]);
+    factory
+        .create_with_value_config(owner_id, 0, schemas, None, None)
+        .expect("create contract")
+        .data_contract_owned()
+}
+
+/// Number of documents the `trending` index returns for an exact
+/// `$createdAt == bucket` lookup.
+///
+/// The equality is what `IN_TIME_RANGE` resolution produces, so the query
+/// is marked as such: without that provenance index selection refuses to
+/// bind a bare `$createdAt` equality to a bucketed index, exactly as it
+/// refuses a client-written one.
+fn count_in_bucket(
+    drive: &Drive,
+    contract: &DataContract,
+    bucket: u64,
+    platform_version: &PlatformVersion,
+) -> usize {
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let query = build_created_at_query(
+        contract,
+        document_type,
+        bucket,
+        None,
+        created_at_resolution(document_type),
+    );
+    query
+        .execute_raw_results_no_proof(drive, None, None, platform_version)
+        .expect("query")
+        .0
+        .len()
+}
+
+/// The provenance a real `IN_TIME_RANGE` resolution against this document
+/// type's (single) `$createdAt` grid would have produced: the field plus
+/// the exact transform, which is what pins index selection to the grid.
+fn created_at_resolution(document_type: DocumentTypeRef) -> Vec<ResolvedTimeRange> {
+    let transform = document_type
+        .indexes()
+        .values()
+        .find_map(|index| index.time_range.clone())
+        .expect("the fixture declares a time-range index");
+    vec![ResolvedTimeRange { transform }]
+}
+
+/// A `$createdAt == created_at` query, optionally ANDed with
+/// `hashtag == <hashtag>`, carrying `resolved_time_ranges` verbatim
+/// so tests can drive both the resolved and the raw (empty) provenance.
+fn build_created_at_query<'a>(
+    contract: &'a DataContract,
+    document_type: DocumentTypeRef<'a>,
+    created_at: u64,
+    hashtag: Option<&str>,
+    resolved_time_ranges: Vec<ResolvedTimeRange>,
+) -> DriveDocumentQuery<'a> {
+    let mut clauses = vec![Value::Array(vec![
+        Value::Text("$createdAt".to_string()),
+        Value::Text("==".to_string()),
+        Value::U64(created_at),
+    ])];
+    if let Some(hashtag) = hashtag {
+        clauses.push(Value::Array(vec![
+            Value::Text("hashtag".to_string()),
+            Value::Text("==".to_string()),
+            Value::Text(hashtag.to_string()),
+        ]));
+    }
+    let query_value = Value::Map(vec![(
+        Value::Text("where".to_string()),
+        Value::Array(clauses),
+    )]);
+    let mut query = DriveDocumentQuery::from_value(
+        query_value,
+        contract,
+        document_type,
+        &DriveConfig::default(),
+        PlatformVersion::latest(),
+    )
+    .expect("build query");
+    query.resolved_time_ranges = resolved_time_ranges;
+    query
+}
+
+#[test]
+fn time_range_insert_fans_out_to_overlapping_buckets_and_delete_removes_them() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_trending_contract();
+
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let transform = document_type
+        .indexes()
+        .get("trending")
+        .expect("trending index")
+        .time_range
+        .clone()
+        .expect("time range transform");
+    assert_eq!(transform.overlap_factor(), 3);
+
+    // A document created at 7h+ falls into the ranges starting at 6h, 4h, 2h.
+    let created_at = 7 * HOUR_MS + 123_456;
+    let expected_buckets = transform.containing_buckets(created_at);
+    assert_eq!(
+        expected_buckets,
+        vec![6 * HOUR_MS, 4 * HOUR_MS, 2 * HOUR_MS]
+    );
+
+    let owner_bytes = fixture_bytes(1, created_at, "ibiza");
+    let document = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(2, created_at, "ibiza")),
+        owner_id: Identifier::from(owner_bytes),
+        properties: BTreeMap::from([("hashtag".to_string(), Value::Text("ibiza".to_string()))]),
+        created_at: Some(created_at),
+        ..Default::default()
+    });
+    let document_id = document.id();
+
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &document,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(owner_bytes),
+                },
+                contract: &contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add document");
+
+    // The document is queryable under each of its 3 overlapping buckets.
+    for bucket in &expected_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            1,
+            "document should be indexed under bucket {bucket}"
+        );
+    }
+    // It is NOT stored under the raw timestamp (only under bucket starts)…
+    assert_eq!(
+        count_in_bucket(&drive, &contract, created_at, platform_version),
+        0,
+        "document must be indexed under bucket starts, not the raw timestamp"
+    );
+    // …nor under a range that does not contain it.
+    assert_eq!(
+        count_in_bucket(&drive, &contract, 0, platform_version),
+        0,
+        "an unrelated bucket must be empty"
+    );
+
+    // Deleting the document removes every bucket entry.
+    drive
+        .delete_document_for_contract(
+            document_id,
+            &contract,
+            "post",
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("delete document");
+
+    for bucket in &expected_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            0,
+            "bucket {bucket} should be empty after deletion"
+        );
+    }
+}
+
+/// Update-path set-diff coverage: moving a timestamp between bucket sets
+/// must delete the stale entries and insert the new ones, and a
+/// sub-property change at an unchanged timestamp must reinsert under the
+/// new suffix without duplicating entries. (Null transitions are
+/// unreachable through a valid contract: the transform's system-timestamp
+/// source must be a required field, so documents always carry it; the
+/// walkers' null-entry handling is defense-in-depth covered by
+/// `TimeRangeTransform::entry_keys_for_raw`'s unit tests.)
+#[test]
+fn time_range_update_moves_between_buckets_and_suffix_changes() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_trending_contract();
+
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let transform = document_type
+        .indexes()
+        .get("trending")
+        .expect("trending index")
+        .time_range
+        .clone()
+        .expect("time range transform");
+
+    let first_created_at = 7 * HOUR_MS + 123_456;
+    let first_buckets = transform.containing_buckets(first_created_at);
+    assert_eq!(first_buckets, vec![6 * HOUR_MS, 4 * HOUR_MS, 2 * HOUR_MS]);
+    let second_created_at = 13 * HOUR_MS + 42;
+    let second_buckets = transform.containing_buckets(second_created_at);
+    assert_eq!(
+        second_buckets,
+        vec![12 * HOUR_MS, 10 * HOUR_MS, 8 * HOUR_MS]
+    );
+
+    let owner_bytes = fixture_bytes(1, first_created_at, "ibiza");
+    let mut document = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(2, first_created_at, "ibiza")),
+        owner_id: Identifier::from(owner_bytes),
+        properties: BTreeMap::from([("hashtag".to_string(), Value::Text("ibiza".to_string()))]),
+        created_at: Some(first_created_at),
+        revision: Some(1),
+        ..Default::default()
+    });
+
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &document,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(owner_bytes),
+                },
+                contract: &contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add document");
+
+    let update = |document: &Document, step: &str| {
+        drive
+            .update_document_for_contract(
+                document,
+                &contract,
+                document_type,
+                Some(owner_bytes),
+                BlockInfo::default(),
+                true,
+                None,
+                None,
+                platform_version,
+                None,
+            )
+            .unwrap_or_else(|e| panic!("update document ({step}): {e:?}"));
+    };
+
+    // Move the timestamp to a disjoint bucket set: the stale entries must
+    // be deleted and the new ones inserted.
+    document.set_created_at(Some(second_created_at));
+    document.set_revision(Some(2));
+    update(&document, "move buckets");
+    for bucket in &first_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            0,
+            "old bucket {bucket} should be empty after the timestamp moved"
+        );
+    }
+    for bucket in &second_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            1,
+            "new bucket {bucket} should hold the document after the timestamp moved"
+        );
+    }
+
+    // A sub-property change at an unchanged timestamp reinserts under the
+    // new suffix without duplicating bucket entries.
+    document.set("hashtag", Value::Text("mykonos".to_string()));
+    document.set_revision(Some(3));
+    update(&document, "suffix change");
+    for bucket in &second_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            1,
+            "bucket {bucket} should still hold exactly one entry after a suffix change"
+        );
+    }
+
+    // Deleting the document (now holding bucket entries created by the
+    // update path) removes every entry.
+    drive
+        .delete_document_for_contract(
+            document.id(),
+            &contract,
+            "post",
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("delete document");
+    for bucket in &second_buckets {
+        assert_eq!(
+            count_in_bucket(&drive, &contract, *bucket, platform_version),
+            0,
+            "bucket {bucket} should be empty after deletion"
+        );
+    }
+}
+
+/// The `post` type of [`build_trending_contract`] plus two plain indexes
+/// over the same fields, storing raw timestamps:
+///
+/// - `byHashtag` — `(hashtag, $createdAt)`. Covers exactly the fields the
+///   bucketed `trending` index covers, and sorts before it, so a search
+///   that only scores field coverage — ties broken by the index map's name
+///   order — always prefers it. Which of the two is correct depends
+///   entirely on where the `$createdAt` value came from.
+/// - `byHashtagAndAuthor` — `(hashtag, $createdAt, author)`. The only
+///   index that can also serve an ordering by `author`, so it is what an
+///   unpinned search falls back to for a time-range query that orders by
+///   a property the bucketed index does not carry.
+///
+/// Both plain indexes start with `hashtag` rather than `$createdAt` so
+/// their `$createdAt` entries hold raw timestamps at a non-leading
+/// position — the competing-coverage shape these tests need. (A plain
+/// index MAY lead with a bucketed field: grids fork into sibling
+/// subtrees via grid-qualified level keys, so no cross-index agreement
+/// rule exists; safety comes from provenance-pinned index selection.)
+fn build_competing_index_trending_contract() -> DataContract {
+    let factory =
+        DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+    let trending_index = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("trending".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![
+                platform_value!({"$createdAt": "asc"}),
+                platform_value!({"hashtag": "asc"}),
+            ]),
+        ),
+        (
+            Value::Text("timeRange".to_string()),
+            Value::Map(vec![
+                (
+                    Value::Text("on".to_string()),
+                    Value::Text("$createdAt".to_string()),
+                ),
+                (
+                    Value::Text("range".to_string()),
+                    Value::U64(6 * HOUR_SECONDS),
+                ),
+                (
+                    Value::Text("step".to_string()),
+                    Value::U64(2 * HOUR_SECONDS),
+                ),
+            ]),
+        ),
+        (
+            Value::Text("countable".to_string()),
+            Value::Text("countable".to_string()),
+        ),
+    ];
+    let by_hashtag_index = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("byHashtag".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![
+                platform_value!({"hashtag": "asc"}),
+                platform_value!({"$createdAt": "asc"}),
+            ]),
+        ),
+    ];
+    let by_hashtag_and_author_index = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("byHashtagAndAuthor".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![
+                platform_value!({"hashtag": "asc"}),
+                platform_value!({"$createdAt": "asc"}),
+                platform_value!({"author": "asc"}),
+            ]),
+        ),
+    ];
+
+    let document_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "hashtag": {"type": "string", "maxLength": 63, "position": 0},
+            "author": {"type": "string", "maxLength": 63, "position": 1},
+        },
+        "required": ["hashtag", "$createdAt"],
+        "indices": Value::Array(vec![
+            Value::Map(by_hashtag_index),
+            Value::Map(by_hashtag_and_author_index),
+            Value::Map(trending_index),
+        ]),
+        "additionalProperties": false,
+    });
+    let schemas = platform_value!({ "post": document_schema });
+    let owner_id = Identifier::from([201u8; 32]);
+    factory
+        .create_with_value_config(owner_id, 0, schemas, None, None)
+        .expect("create contract")
+        .data_contract_owned()
+}
+
+/// Stores one `post` with the given timestamp and hashtag.
+fn insert_post(
+    drive: &Drive,
+    contract: &DataContract,
+    created_at: u64,
+    hashtag: &str,
+    platform_version: &PlatformVersion,
+) {
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let owner_bytes = fixture_bytes(1, created_at, hashtag);
+    let document = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(2, created_at, hashtag)),
+        owner_id: Identifier::from(owner_bytes),
+        properties: BTreeMap::from([("hashtag".to_string(), Value::Text(hashtag.to_string()))]),
+        created_at: Some(created_at),
+        ..Default::default()
+    });
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &document,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(owner_bytes),
+                },
+                contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add document");
+}
+
+/// With two indexes covering the same fields, the value's provenance —
+/// not the index map's name order — decides which index serves the query:
+/// a resolved bucket start goes to the bucketed index, a raw timestamp to
+/// the plain one. Getting this wrong returns a validly-proven empty result
+/// in either direction, so both halves are asserted.
+#[test]
+fn resolved_time_range_equality_pins_the_bucketed_index_while_a_raw_one_uses_the_plain_index() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_competing_index_trending_contract();
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+
+    let document_type = contract.document_type_for_name("post").expect("post");
+    assert_eq!(
+        document_type.indexes().keys().next().map(String::as_str),
+        Some("byHashtag"),
+        "the plain index must sort first for this to reproduce the tie-break the \
+         pinning fixes"
+    );
+
+    let created_at = 7 * HOUR_MS + 123_456;
+    let bucket = 6 * HOUR_MS;
+    insert_post(&drive, &contract, created_at, "ibiza", platform_version);
+    // A second post in the same bucket under a different hashtag: the
+    // hashtag equality must still narrow the result to one document.
+    insert_post(&drive, &contract, created_at, "mykonos", platform_version);
+
+    let resolved = build_created_at_query(
+        &contract,
+        document_type,
+        bucket,
+        Some("ibiza"),
+        created_at_resolution(document_type),
+    );
+    assert_eq!(
+        resolved
+            .find_best_index(platform_version)
+            .expect("the bucketed index covers the resolved query")
+            .name,
+        "trending"
+    );
+    assert_eq!(
+        resolved
+            .execute_raw_results_no_proof(&drive, None, None, platform_version)
+            .expect("resolved query executes")
+            .0
+            .len(),
+        1,
+        "the resolved bucket equality must find the document stored under that bucket"
+    );
+
+    let raw = build_created_at_query(&contract, document_type, created_at, Some("ibiza"), vec![]);
+    assert_eq!(
+        raw.find_best_index(platform_version)
+            .expect("the plain index covers the raw query")
+            .name,
+        "byHashtag",
+        "a raw `$createdAt` equality must never bind to bucket keys"
+    );
+    assert_eq!(
+        raw.execute_raw_results_no_proof(&drive, None, None, platform_version)
+            .expect("raw query executes")
+            .0
+            .len(),
+        1,
+        "the plain index stores raw timestamps, so the raw equality finds the document"
+    );
+
+    // The converse of the raw case: a bucket start is not a timestamp any
+    // document carries, so the plain index legitimately matches nothing.
+    let raw_on_bucket =
+        build_created_at_query(&contract, document_type, bucket, Some("ibiza"), vec![]);
+    assert_eq!(
+        raw_on_bucket
+            .execute_raw_results_no_proof(&drive, None, None, platform_version)
+            .expect("raw query executes")
+            .0
+            .len(),
+        0
+    );
+}
+
+/// A contract whose only index buckets `$createdAt` alone — the shape
+/// where a resolved bucket equality is the query's *last* clause with no
+/// left-over index properties, so cursor pagination has nothing below the
+/// transformed level except the document-id terminal.
+///
+/// `unique` flips the index's uniqueness: the grid already satisfies the
+/// unique shape (`range == step` on `$createdAt`), and the unique terminal
+/// layout stores the reference AT the value tree rather than under an id
+/// terminal — the other arm the in-bucket cursor rule must handle.
+fn build_single_property_trending_contract(unique: bool) -> DataContract {
+    let factory =
+        DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+    let index_map = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("byBucket".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![platform_value!({"$createdAt": "asc"})]),
+        ),
+        (
+            Value::Text("timeRange".to_string()),
+            Value::Map(vec![
+                (
+                    Value::Text("on".to_string()),
+                    Value::Text("$createdAt".to_string()),
+                ),
+                (
+                    Value::Text("range".to_string()),
+                    Value::U64(6 * HOUR_SECONDS),
+                ),
+                (
+                    Value::Text("step".to_string()),
+                    Value::U64(6 * HOUR_SECONDS),
+                ),
+            ]),
+        ),
+        (Value::Text("unique".to_string()), Value::Bool(unique)),
+    ];
+
+    let document_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "hashtag": {"type": "string", "maxLength": 63, "position": 0},
+        },
+        "required": ["hashtag", "$createdAt"],
+        "indices": Value::Array(vec![Value::Map(index_map)]),
+        "additionalProperties": false,
+    });
+    let schemas = platform_value!({ "post": document_schema });
+    let owner_id = Identifier::from([202u8; 32]);
+    factory
+        .create_with_value_config(owner_id, 0, schemas, None, None)
+        .expect("create contract")
+        .data_contract_owned()
+}
+
+/// The ids of raw query results, in returned order.
+fn result_ids(
+    results: &[Vec<u8>],
+    document_type: DocumentTypeRef,
+    platform_version: &PlatformVersion,
+) -> Vec<[u8; 32]> {
+    results
+        .iter()
+        .map(|serialized| {
+            Document::from_bytes(serialized, document_type, platform_version)
+                .expect("deserialize result")
+                .id()
+                .to_buffer()
+        })
+        .collect()
+}
+
+/// The transformed level stores bucket starts, so a cursor document's raw
+/// timestamp must never be compared against this level's keys: an
+/// included cursor created *inside* the selected bucket (07:10 in a
+/// bucket starting at 06:00) orders after the bucket-start key, and
+/// applying it at the transformed level suppresses the only key — a
+/// validly-proven empty page while later document ids still exist in the
+/// bucket. The cursor belongs to the document-id terminal instead.
+#[test]
+fn included_cursor_inside_the_bucket_continues_a_single_property_time_range_query() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_single_property_trending_contract(false);
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+    let document_type = contract.document_type_for_name("post").expect("post");
+
+    // Three posts inside the [06:00, 12:00) bucket, none at its start.
+    let bucket = 6 * HOUR_MS;
+    let timestamps: [(u64, &str); 3] = [
+        (6 * HOUR_MS + 600_000, "early"),
+        (7 * HOUR_MS + 123_456, "mid"),
+        (8 * HOUR_MS, "late"),
+    ];
+    for (created_at, hashtag) in timestamps {
+        insert_post(&drive, &contract, created_at, hashtag, platform_version);
+    }
+
+    // The document-id terminal walks ids ascending; the cursor is the
+    // mid-bucket post, so the expected continuation is every id at or
+    // after it in that order.
+    let mut ids: Vec<[u8; 32]> = timestamps
+        .iter()
+        .map(|(created_at, hashtag)| fixture_bytes(2, *created_at, hashtag))
+        .collect();
+    ids.sort();
+    let cursor_id = fixture_bytes(2, 7 * HOUR_MS + 123_456, "mid");
+    let cursor_position = ids.iter().position(|id| *id == cursor_id).expect("cursor");
+
+    let mut query = build_created_at_query(
+        &contract,
+        document_type,
+        bucket,
+        None,
+        created_at_resolution(document_type),
+    );
+    query.start_at = Some(cursor_id);
+    query.start_at_included = true;
+
+    let (results, _, _) = query
+        .execute_raw_results_no_proof(&drive, None, None, platform_version)
+        .expect("query with an in-bucket cursor");
+    assert_eq!(
+        result_ids(&results, document_type, platform_version),
+        &ids[cursor_position..],
+        "an included in-bucket cursor must return itself and every later id \
+         in the bucket, in id order"
+    );
+
+    query.start_at_included = false;
+    let (results, _, _) = query
+        .execute_raw_results_no_proof(&drive, None, None, platform_version)
+        .expect("query with an excluded in-bucket cursor");
+    assert_eq!(
+        result_ids(&results, document_type, platform_version),
+        &ids[cursor_position + 1..],
+        "an excluded in-bucket cursor must return every id after it in the \
+         bucket, in id order"
+    );
+}
+
+/// The unique arm of the in-bucket cursor rule: a unique single-property
+/// time-range index (`range == step` on `$createdAt`) stores the bucket's
+/// sole reference AT the value tree, with no document-id terminal below
+/// it. An included cursor must retain the bucket's one document; an
+/// excluded cursor must produce an empty page — never an error, and never
+/// the full page again.
+#[test]
+fn in_bucket_cursor_on_a_unique_single_property_time_range_index() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_single_property_trending_contract(true);
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+    let document_type = contract.document_type_for_name("post").expect("post");
+
+    // One document in the [06:00, 12:00) bucket — the most a unique
+    // single-property grid admits.
+    let created_at = 7 * HOUR_MS + 123_456;
+    insert_post(&drive, &contract, created_at, "solo", platform_version);
+    let document_id = fixture_bytes(2, created_at, "solo");
+    let bucket = 6 * HOUR_MS;
+
+    let mut query = build_created_at_query(
+        &contract,
+        document_type,
+        bucket,
+        None,
+        created_at_resolution(document_type),
+    );
+    query.start_at = Some(document_id);
+    query.start_at_included = true;
+
+    let (results, _, _) = query
+        .execute_raw_results_no_proof(&drive, None, None, platform_version)
+        .expect("included cursor on the unique layout");
+    assert_eq!(
+        result_ids(&results, document_type, platform_version),
+        vec![document_id],
+        "an included cursor must retain the bucket's sole document"
+    );
+
+    query.start_at_included = false;
+    let (results, _, _) = query
+        .execute_raw_results_no_proof(&drive, None, None, platform_version)
+        .expect("excluded cursor on the unique layout");
+    assert!(
+        results.is_empty(),
+        "an excluded cursor must empty the page — the bucket holds exactly the cursor"
+    );
+}
+
+/// One index can bucket only one field (a transform's source must be its
+/// index's first property), so a query resolving two time ranges has no
+/// servable shape and is refused rather than routed to whichever index
+/// happens to cover the fields.
+#[test]
+fn two_resolved_time_ranges_are_rejected() {
+    let contract = build_competing_index_trending_contract();
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let query = build_created_at_query(&contract, document_type, 6 * HOUR_MS, Some("ibiza"), {
+        let mut resolutions = created_at_resolution(document_type);
+        let mut second = resolutions[0].clone();
+        second.transform.source = "hashtag".to_string();
+        resolutions.push(second);
+        resolutions
+    });
+    let error = query
+        .find_best_index(PlatformVersion::latest())
+        .expect_err("two resolved time-range fields cannot be served");
+    assert!(
+        matches!(error, Error::Query(QuerySyntaxError::Unsupported(_))),
+        "expected an Unsupported rejection, got {error:?}"
+    );
+}
+
+/// Ordering by a property the bucketed index does not carry must fail
+/// loudly. `byHashtagAndAuthor` covers the same where fields *and* the
+/// ordering, so an unpinned search would take it and match the bucket
+/// start against raw timestamps — a validly-proven empty result.
+#[test]
+fn resolved_time_range_query_ordering_off_the_bucketed_index_errors_rather_than_falling_back() {
+    let contract = build_competing_index_trending_contract();
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let query_value = Value::Map(vec![
+        (
+            Value::Text("where".to_string()),
+            Value::Array(vec![
+                Value::Array(vec![
+                    Value::Text("hashtag".to_string()),
+                    Value::Text("==".to_string()),
+                    Value::Text("ibiza".to_string()),
+                ]),
+                Value::Array(vec![
+                    Value::Text("$createdAt".to_string()),
+                    Value::Text("==".to_string()),
+                    Value::U64(6 * HOUR_MS),
+                ]),
+            ]),
+        ),
+        (
+            Value::Text("orderBy".to_string()),
+            Value::Array(vec![Value::Array(vec![
+                Value::Text("author".to_string()),
+                Value::Text("asc".to_string()),
+            ])]),
+        ),
+    ]);
+    let mut query = DriveDocumentQuery::from_value(
+        query_value,
+        &contract,
+        document_type,
+        &DriveConfig::default(),
+        PlatformVersion::latest(),
+    )
+    .expect("build query");
+    // Sanity: without the provenance this query has a covering index, so
+    // the rejection below is the pinning talking and not a query that
+    // nothing could serve.
+    assert_eq!(
+        query
+            .find_best_index(PlatformVersion::latest())
+            .expect("a plain index covers the where fields and the ordering")
+            .name,
+        "byHashtagAndAuthor"
+    );
+
+    query.resolved_time_ranges = created_at_resolution(document_type);
+    let error = query
+        .find_best_index(PlatformVersion::latest())
+        .expect_err("no bucketed index covers the ordering");
+    assert!(
+        matches!(
+            error,
+            Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(_))
+        ),
+        "expected a no-covering-index rejection, got {error:?}"
+    );
+}
+
+const DAY_SECONDS: u64 = 24 * HOUR_SECONDS;
+const DAY_MS: u64 = 24 * HOUR_MS;
+
+/// A `report` document type with a **unique**
+/// `(timeRange($createdAt, range = step = 1 day), author)` index — one
+/// report per author per calendar day.
+///
+/// `range == step` makes the windows a partition (overlap factor 1), which
+/// is what lets uniqueness mean anything here, and `$createdAt` is
+/// immutable so a document's bucket never moves. Both index properties are
+/// required, so the terminator always takes the unique layout (the
+/// reference stored AT `[0]`, with no per-document subtree).
+fn build_unique_daily_report_contract() -> DataContract {
+    let factory =
+        DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+    let index_map = vec![
+        (
+            Value::Text("name".to_string()),
+            Value::Text("dailyReport".to_string()),
+        ),
+        (
+            Value::Text("properties".to_string()),
+            Value::Array(vec![
+                platform_value!({"$createdAt": "asc"}),
+                platform_value!({"author": "asc"}),
+            ]),
+        ),
+        (Value::Text("unique".to_string()), Value::Bool(true)),
+        (
+            Value::Text("timeRange".to_string()),
+            Value::Map(vec![
+                (
+                    Value::Text("on".to_string()),
+                    Value::Text("$createdAt".to_string()),
+                ),
+                (Value::Text("range".to_string()), Value::U64(DAY_SECONDS)),
+                (Value::Text("step".to_string()), Value::U64(DAY_SECONDS)),
+            ]),
+        ),
+    ];
+
+    let document_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "author": {"type": "string", "maxLength": 63, "position": 0},
+        },
+        "required": ["author", "$createdAt"],
+        "indices": Value::Array(vec![Value::Map(index_map)]),
+        "additionalProperties": false,
+    });
+    let schemas = platform_value!({ "report": document_schema });
+    let owner_id = Identifier::from([201u8; 32]);
+    factory
+        .create_with_value_config(owner_id, 0, schemas, None, None)
+        .expect("create contract")
+        .data_contract_owned()
+}
+
+/// Number of `report`s stored under the exact `(bucket, author)` tuple of
+/// the unique index. Carries the `IN_TIME_RANGE` provenance for the same
+/// reason [`count_in_bucket`] does.
+fn count_reports_for(
+    drive: &Drive,
+    contract: &DataContract,
+    bucket: u64,
+    author: &str,
+    platform_version: &PlatformVersion,
+) -> usize {
+    let document_type = contract.document_type_for_name("report").expect("report");
+    let query_value = Value::Map(vec![(
+        Value::Text("where".to_string()),
+        Value::Array(vec![
+            Value::Array(vec![
+                Value::Text("$createdAt".to_string()),
+                Value::Text("==".to_string()),
+                Value::U64(bucket),
+            ]),
+            Value::Array(vec![
+                Value::Text("author".to_string()),
+                Value::Text("==".to_string()),
+                Value::Text(author.to_string()),
+            ]),
+        ]),
+    )]);
+    let mut query = DriveDocumentQuery::from_value(
+        query_value,
+        contract,
+        document_type,
+        &DriveConfig::default(),
+        PlatformVersion::latest(),
+    )
+    .expect("build query");
+    query.resolved_time_ranges = created_at_resolution(document_type);
+    query
+        .execute_raw_results_no_proof(drive, None, None, platform_version)
+        .expect("query")
+        .0
+        .len()
+}
+
+/// A suffix change under a **unique** bucketed index exercises the update
+/// walker's unique terminator layout end to end: the old `(bucket, author)`
+/// slot must be vacated and the new one occupied. Under the non-unique
+/// layout the walker would delete a doc-id key that does not exist and
+/// write the reference one level too deep, leaving the old entry in place
+/// and the new one unfindable.
+#[test]
+fn unique_time_range_index_update_moves_the_entry_between_suffixes() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_unique_daily_report_contract();
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+
+    let document_type = contract.document_type_for_name("report").expect("report");
+    let index = document_type
+        .indexes()
+        .get("dailyReport")
+        .expect("dailyReport index");
+    assert!(index.unique, "the index under test must be unique");
+    let transform = index
+        .time_range
+        .clone()
+        .expect("dailyReport buckets $createdAt");
+    assert_eq!(transform.overlap_factor(), 1);
+
+    let created_at = 100 * DAY_MS + 3 * HOUR_MS;
+    let bucket = *transform
+        .containing_buckets(created_at)
+        .first()
+        .expect("a post-origin timestamp has exactly one bucket");
+    assert_eq!(bucket, 100 * DAY_MS);
+
+    let owner_bytes = fixture_bytes(1, created_at, "alice");
+    let mut document = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(2, created_at, "alice")),
+        owner_id: Identifier::from(owner_bytes),
+        properties: BTreeMap::from([("author".to_string(), Value::Text("alice".to_string()))]),
+        created_at: Some(created_at),
+        revision: Some(1),
+        ..Default::default()
+    });
+
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &document,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(owner_bytes),
+                },
+                contract: &contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add document");
+
+    // The insert walker's unique terminator is readable through the
+    // bucketed index.
+    assert_eq!(
+        count_reports_for(&drive, &contract, bucket, "alice", platform_version),
+        1,
+        "the inserted report must be found under its (bucket, author) tuple"
+    );
+
+    // Change the suffix. `$createdAt` is untouched — it cannot change —
+    // so the bucket stays and only the author component of the tuple moves.
+    document.set("author", Value::Text("bob".to_string()));
+    document.set_revision(Some(2));
+    drive
+        .update_document_for_contract(
+            &document,
+            &contract,
+            document_type,
+            Some(owner_bytes),
+            BlockInfo::default(),
+            true,
+            None,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("update document");
+
+    assert_eq!(
+        count_reports_for(&drive, &contract, bucket, "alice", platform_version),
+        0,
+        "the old (bucket, author) slot must be vacated by the update"
+    );
+    assert_eq!(
+        count_reports_for(&drive, &contract, bucket, "bob", platform_version),
+        1,
+        "the new (bucket, author) slot must hold the document after the update"
+    );
+
+    // The vacated slot is genuinely free again: a second document may take
+    // it, which only holds if the update actually removed the reference
+    // rather than leaving a stale one behind.
+    let second_owner = fixture_bytes(3, created_at, "alice");
+    let second = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(4, created_at, "alice")),
+        owner_id: Identifier::from(second_owner),
+        properties: BTreeMap::from([("author".to_string(), Value::Text("alice".to_string()))]),
+        created_at: Some(created_at + HOUR_MS),
+        revision: Some(1),
+        ..Default::default()
+    });
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &second,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(second_owner),
+                },
+                contract: &contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add second document into the vacated slot");
+    assert_eq!(
+        count_reports_for(&drive, &contract, bucket, "alice", platform_version),
+        1
+    );
+
+    // Deleting the updated document clears its slot too — the delete
+    // walker and the update walker must agree on where the reference is.
+    drive
+        .delete_document_for_contract(
+            document.id(),
+            &contract,
+            "report",
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("delete document");
+    assert_eq!(
+        count_reports_for(&drive, &contract, bucket, "bob", platform_version),
+        0,
+        "the updated document's slot must be empty after deletion"
+    );
+}
+
+/// The mirror case: when every index covering the query buckets the
+/// field, a raw query has nowhere to go and must be refused instead of
+/// silently matching a timestamp against bucket starts.
+#[test]
+fn raw_query_on_a_doctype_whose_only_covering_index_is_bucketed_errors() {
+    let contract = build_trending_contract();
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let query = build_created_at_query(
+        &contract,
+        document_type,
+        7 * HOUR_MS + 123_456,
+        None,
+        vec![],
+    );
+    let error = query
+        .find_best_index(PlatformVersion::latest())
+        .expect_err("a raw equality cannot be served by a bucketed index");
+    assert!(
+        matches!(
+            error,
+            Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(_))
+        ),
+        "expected a no-covering-index rejection, got {error:?}"
+    );
+}
+/// The multi-grid contract: one timestamp, two grids, sibling subtrees.
+/// A 6h/2h "trending" grid and a 24h/24h "daily" grid both bucket
+/// `$createdAt`; each level is keyed by the grid-qualified storage key,
+/// so the two coexist — including bucket starts that are numerically
+/// identical across grids (every daily start is also a trending start).
+fn build_two_grid_contract() -> DataContract {
+    let factory =
+        DataContractFactory::new(PlatformVersion::latest().protocol_version).expect("factory");
+    let grid_index = |name: &str, range_seconds: u64, step_seconds: u64| {
+        Value::Map(vec![
+            (
+                Value::Text("name".to_string()),
+                Value::Text(name.to_string()),
+            ),
+            (
+                Value::Text("properties".to_string()),
+                Value::Array(vec![
+                    platform_value!({"$createdAt": "asc"}),
+                    platform_value!({"hashtag": "asc"}),
+                ]),
+            ),
+            (
+                Value::Text("timeRange".to_string()),
+                Value::Map(vec![
+                    (
+                        Value::Text("on".to_string()),
+                        Value::Text("$createdAt".to_string()),
+                    ),
+                    (Value::Text("range".to_string()), Value::U64(range_seconds)),
+                    (Value::Text("step".to_string()), Value::U64(step_seconds)),
+                ]),
+            ),
+            (
+                Value::Text("countable".to_string()),
+                Value::Text("countable".to_string()),
+            ),
+        ])
+    };
+    let document_schema = platform_value!({
+        "type": "object",
+        "properties": {
+            "hashtag": {"type": "string", "maxLength": 63, "position": 0},
+        },
+        "required": ["hashtag", "$createdAt"],
+        "indices": Value::Array(vec![
+            grid_index("trending", 6 * HOUR_SECONDS, 2 * HOUR_SECONDS),
+            grid_index("daily", 24 * HOUR_SECONDS, 24 * HOUR_SECONDS),
+        ]),
+        "additionalProperties": false,
+    });
+    let schemas = platform_value!({ "post": document_schema });
+    factory
+        .create_with_value_config(Identifier::from([202u8; 32]), 0, schemas, None, None)
+        .expect("a contract may bucket one timestamp with several grids")
+        .data_contract_owned()
+}
+
+/// The provenance of a resolution against one named grid of a
+/// multi-grid document type.
+fn grid_resolution(contract: &DataContract, index_name: &str) -> Vec<ResolvedTimeRange> {
+    let transform = contract
+        .document_type_for_name("post")
+        .expect("post")
+        .indexes()
+        .get(index_name)
+        .expect("the fixture declares this index")
+        .time_range
+        .clone()
+        .expect("the index carries a transform");
+    vec![ResolvedTimeRange { transform }]
+}
+
+/// Two grids over `$createdAt`: a document fans out into each grid's own
+/// subtree, a resolution against one grid reads only that grid's bucket
+/// — even when the two grids' bucket starts are the same number — and
+/// deletion empties both. The bucket start chosen here (24h) is
+/// deliberately a start on BOTH grids: without grid-qualified level keys
+/// the two entry sets would interleave in one keyspace and the counts
+/// below would be wrong in both directions.
+#[test]
+fn two_grids_over_one_timestamp_write_and_read_independently() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_two_grid_contract();
+
+    drive
+        .apply_contract(
+            &contract,
+            BlockInfo::default(),
+            true,
+            StorageFlags::optional_default_as_cow(),
+            None,
+            platform_version,
+        )
+        .expect("apply contract");
+
+    let document_type = contract.document_type_for_name("post").expect("post");
+
+    // 25h10m: the daily grid buckets it at 24h; the trending grid at
+    // [24h, 22h, 20h]. 24h is a bucket start on BOTH grids.
+    let created_at = 25 * HOUR_MS + 10 * 60_000;
+    let shared_bucket = 24 * HOUR_MS;
+
+    let trending = grid_resolution(&contract, "trending");
+    let daily = grid_resolution(&contract, "daily");
+    assert_eq!(
+        trending[0]
+            .transform
+            .containing_buckets(created_at)
+            .first()
+            .copied(),
+        Some(shared_bucket)
+    );
+    assert_eq!(
+        daily[0].transform.containing_buckets(created_at),
+        vec![shared_bucket],
+        "the same numeric start on both grids is the point of this fixture"
+    );
+
+    let owner_bytes = fixture_bytes(1, created_at, "ibiza");
+    let document = Document::V0(DocumentV0 {
+        id: Identifier::from(fixture_bytes(2, created_at, "ibiza")),
+        owner_id: Identifier::from(owner_bytes),
+        properties: BTreeMap::from([("hashtag".to_string(), Value::Text("ibiza".to_string()))]),
+        created_at: Some(created_at),
+        ..Default::default()
+    });
+    drive
+        .add_document_for_contract(
+            DocumentAndContractInfo {
+                owned_document_info: OwnedDocumentInfo {
+                    document_info: DocumentRefInfo((
+                        &document,
+                        StorageFlags::optional_default_as_cow(),
+                    )),
+                    owner_id: Some(owner_bytes),
+                },
+                contract: &contract,
+                document_type,
+            },
+            false,
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("add document");
+
+    let count_for = |resolutions: &Vec<ResolvedTimeRange>, bucket: u64| -> usize {
+        let query = build_created_at_query(
+            &contract,
+            document_type,
+            bucket,
+            Some("ibiza"),
+            resolutions.clone(),
+        );
+        query
+            .execute_raw_results_no_proof(&drive, None, None, platform_version)
+            .expect("query")
+            .0
+            .len()
+    };
+
+    // Selection pins to the resolved grid's index.
+    let trending_query = build_created_at_query(
+        &contract,
+        document_type,
+        shared_bucket,
+        Some("ibiza"),
+        trending.clone(),
+    );
+    assert_eq!(
+        trending_query
+            .find_best_index(platform_version)
+            .expect("the trending grid's index serves its own resolution")
+            .name,
+        "trending"
+    );
+    let daily_query = build_created_at_query(
+        &contract,
+        document_type,
+        shared_bucket,
+        Some("ibiza"),
+        daily.clone(),
+    );
+    assert_eq!(
+        daily_query
+            .find_best_index(platform_version)
+            .expect("the daily grid's index serves its own resolution")
+            .name,
+        "daily"
+    );
+
+    // Each grid's subtree holds the document under the shared start, and
+    // the trending grid additionally holds it under its two older
+    // overlapping starts — which the daily grid must NOT see.
+    assert_eq!(count_for(&trending, shared_bucket), 1);
+    assert_eq!(count_for(&daily, shared_bucket), 1);
+    assert_eq!(count_for(&trending, 22 * HOUR_MS), 1);
+    assert_eq!(
+        count_for(&daily, 22 * HOUR_MS),
+        0,
+        "22h is a trending fan-out entry only; leaking it into the daily \
+         grid would mean the levels share a keyspace again"
+    );
+
+    // Deletion empties both grids' subtrees.
+    drive
+        .delete_document_for_contract(
+            document.id(),
+            &contract,
+            "post",
+            BlockInfo::default(),
+            true,
+            None,
+            platform_version,
+            None,
+        )
+        .expect("delete document");
+    assert_eq!(count_for(&trending, shared_bucket), 0);
+    assert_eq!(count_for(&trending, 22 * HOUR_MS), 0);
+    assert_eq!(count_for(&daily, shared_bucket), 0);
+}
+
+/// Resolution over a multi-grid field: the bare selector is ambiguous
+/// and refused; a grid spec picks exactly the named grid; a spec no
+/// index declares is refused. This is the query-language half of the
+/// storage fork the previous test pins.
+#[test]
+fn multi_grid_resolution_requires_and_honors_a_grid_spec() {
+    let contract = build_two_grid_contract();
+    let document_type = contract.document_type_for_name("post").expect("post");
+    let now_ms = 25 * HOUR_MS;
+
+    let error = resolve_time_range_bucket_clause(
+        "$createdAt",
+        TimeRangeSelector::Newest,
+        None,
+        document_type,
+        now_ms,
+    )
+    .expect_err("two grids on the field make the bare selector ambiguous");
+    assert!(
+        matches!(error, Error::Query(QuerySyntaxError::Unsupported(_))),
+        "expected the ambiguity rejection, got {error:?}"
+    );
+
+    let (clause, resolution) = resolve_time_range_bucket_clause(
+        "$createdAt",
+        TimeRangeSelector::Newest,
+        Some(TimeRangeGridSpec {
+            range_seconds: 24 * HOUR_SECONDS,
+            step_seconds: 24 * HOUR_SECONDS,
+            phase_seconds: 0,
+        }),
+        document_type,
+        now_ms,
+    )
+    .expect("naming the daily grid resolves against it");
+    assert_eq!(clause.value, Value::U64(24 * HOUR_MS));
+    assert_eq!(resolution.transform.range_seconds, 24 * HOUR_SECONDS);
+
+    let (clause, resolution) = resolve_time_range_bucket_clause(
+        "$createdAt",
+        TimeRangeSelector::Newest,
+        Some(TimeRangeGridSpec {
+            range_seconds: 6 * HOUR_SECONDS,
+            step_seconds: 2 * HOUR_SECONDS,
+            phase_seconds: 0,
+        }),
+        document_type,
+        now_ms,
+    )
+    .expect("naming the trending grid resolves against it");
+    assert_eq!(
+        clause.value,
+        Value::U64(24 * HOUR_MS),
+        "at 25h both grids' newest start is 24h — same number, different \
+         subtree, which is exactly why provenance carries the grid"
+    );
+    assert_eq!(resolution.transform.step_seconds, 2 * HOUR_SECONDS);
+
+    let error = resolve_time_range_bucket_clause(
+        "$createdAt",
+        TimeRangeSelector::Newest,
+        Some(TimeRangeGridSpec {
+            range_seconds: 12 * HOUR_SECONDS,
+            step_seconds: 12 * HOUR_SECONDS,
+            phase_seconds: 0,
+        }),
+        document_type,
+        now_ms,
+    )
+    .expect_err("a grid no index declares must be refused");
+    assert!(
+        matches!(error, Error::Query(QuerySyntaxError::Unsupported(_))),
+        "expected the unknown-grid rejection, got {error:?}"
+    );
+}
+
+/// The multiple-`In` execution lowering picks its index directly
+/// (without `find_best_index`), so it must run the shared
+/// resolved-source shape guard itself: a direct caller pairing
+/// fabricated provenance with an `In` clause ON the bucketed source
+/// would otherwise have its raw `In` values serialized as bucket
+/// keys — a validly-proven answer over arbitrary buckets.
+#[test]
+fn multiple_in_route_refuses_an_in_clause_on_the_bucketed_source() {
+    let platform_version = PlatformVersion::latest();
+    let drive = setup_drive_with_initial_state_structure(Some(platform_version));
+    let contract = build_trending_contract();
+    let document_type = contract.document_type_for_name("post").expect("post");
+
+    let query_value = Value::Map(vec![(
+        Value::Text("where".to_string()),
+        Value::Array(vec![
+            Value::Array(vec![
+                Value::Text("$createdAt".to_string()),
+                Value::Text("in".to_string()),
+                Value::Array(vec![Value::U64(2 * HOUR_MS), Value::U64(4 * HOUR_MS)]),
+            ]),
+            Value::Array(vec![
+                Value::Text("hashtag".to_string()),
+                Value::Text("in".to_string()),
+                Value::Array(vec![
+                    Value::Text("dash".to_string()),
+                    Value::Text("evo".to_string()),
+                ]),
+            ]),
+        ]),
+    )]);
+    let mut query = DriveDocumentQuery::from_value(
+        query_value,
+        &contract,
+        document_type,
+        &DriveConfig::default(),
+        platform_version,
+    )
+    .expect("two In clauses are a valid protocol-version-14 query shape");
+    query.resolved_time_ranges = created_at_resolution(document_type);
+
+    let error = query
+        .execute_raw_results_no_proof(&drive, None, None, platform_version)
+        .expect_err("an In on the bucketed source must not reach bucket keys");
+    assert!(
+        matches!(error, Error::Query(QuerySyntaxError::Unsupported(_))),
+        "expected the source-shape rejection, got {error:?}"
+    );
+}
diff --git a/packages/rs-drive/src/drive/document/insert/add_indices_for_top_index_level_for_contract_operations/v2/mod.rs b/packages/rs-drive/src/drive/document/insert/add_indices_for_top_index_level_for_contract_operations/v2/mod.rs
index f7f465faddc..fde3fc84f34 100644
--- a/packages/rs-drive/src/drive/document/insert/add_indices_for_top_index_level_for_contract_operations/v2/mod.rs
+++ b/packages/rs-drive/src/drive/document/insert/add_indices_for_top_index_level_for_contract_operations/v2/mod.rs
@@ -4,7 +4,9 @@ use crate::util::type_constants::DEFAULT_HASH_SIZE_U8;
 use crate::util::grove_operations::BatchInsertTreeApplyType;
 
 use crate::drive::Drive;
-use crate::util::object_size_info::{DocumentAndContractInfo, DocumentInfoV0Methods, PathInfo};
+use crate::util::object_size_info::{
+    DocumentAndContractInfo, DocumentInfoV0Methods, DriveKeyInfo, PathInfo,
+};
 
 use crate::error::fee::FeeError;
 use crate::error::Error;
@@ -16,7 +18,9 @@ use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::version::PlatformVersion;
 
 use crate::drive::document::estimation_costs::estimated_sum_trees_for_value_tree_type::estimated_sum_trees_for_value_tree_type;
-use crate::drive::document::index_level_tree_types::index_level_tree_types_with_continuation_demotion;
+use crate::drive::document::index_level_tree_types::{
+    index_level_tree_types_with_continuation_demotion, time_range_index_keys,
+};
 use crate::drive::document::paths::contract_document_type_path_vec;
 use grovedb::batch::KeyInfoPath;
 use grovedb::EstimatedLayerCount::{ApproximateElements, PotentiallyAtMaxElements};
@@ -115,13 +119,23 @@ impl Drive {
             let mut index_path: Vec<Vec<u8>> = contract_document_type_path.clone();
             index_path.push(Vec::from(name.as_bytes()));
 
+            // The level key is the path segment; the document value is read
+            // from the *source property*. They coincide except on a
+            // time-range level, whose key is the property name qualified
+            // with the grid (`TimeRangeTransform::storage_key`) while the
+            // timestamp still lives under the bare property name.
+            let property_name = sub_level
+                .time_range()
+                .map(|transform| transform.source.as_str())
+                .unwrap_or(name.as_str());
+
             // with the example of the dashpay contract's first index
             // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId
             let document_top_field = document_and_contract_info
                 .owned_document_info
                 .document_info
                 .get_raw_for_document_type(
-                    name,
+                    property_name,
                     document_type,
                     document_and_contract_info.owned_document_info.owner_id,
                     Some((sub_level, event_id)),
@@ -129,12 +143,11 @@ impl Drive {
                 )?
                 .unwrap_or_default();
 
-            // The zero will not matter here, because the PathKeyInfo is variable
-            let path_key_info = document_top_field.clone().add_path::<0>(index_path.clone());
             // here we are inserting the value tree (per distinct property value)
             // under the top-level property-name tree. The top-level property-name
             // tree itself is created at contract setup, so the apply_type's
             // `in_tree_type` reflects whichever variant the contract setup used.
+            // Same for every bucket key when this is a time-range node.
             let value_apply_type = if estimated_costs_only_with_layer_info.is_none() {
                 BatchInsertTreeApplyType::StatefulBatchInsertTree
             } else {
@@ -146,23 +159,17 @@ impl Drive {
                         .unwrap_or_default(),
                 }
             };
-            self.batch_insert_empty_tree_if_not_exists(
-                path_key_info.clone(),
-                value_tree_type,
-                storage_flags,
-                value_apply_type,
-                transaction,
-                previous_batch_operations,
-                batch_operations,
-                drive_version,
-            )?;
 
             if let Some(estimated_costs_only_with_layer_info) = estimated_costs_only_with_layer_info
             {
                 let document_top_field_estimated_size = document_and_contract_info
                     .owned_document_info
                     .document_info
-                    .get_estimated_size_for_document_type(name, document_type, platform_version)?;
+                    .get_estimated_size_for_document_type(
+                        property_name,
+                        document_type,
+                        platform_version,
+                    )?;
 
                 if document_top_field_estimated_size > u8::MAX as u16 {
                     return Err(Error::Fee(FeeError::Overflow(
@@ -192,40 +199,85 @@ impl Drive {
             let any_fields_null = document_top_field.is_empty();
             let all_fields_null = document_top_field.is_empty();
 
-            let mut index_path_info = if document_and_contract_info
-                .owned_document_info
-                .document_info
-                .is_document_size()
-            {
-                // This is a stateless operation
-                PathInfo::PathWithSizes(KeyInfoPath::from_known_owned_path(index_path))
-            } else {
-                PathInfo::PathAsVec::<0>(index_path)
-            };
+            // A time-range first-property node expands the document's single
+            // timestamp into one index entry per overlapping range bucket (the
+            // bucket *start*, encoded exactly like the timestamp). A normal
+            // property keeps its single key. The entry-key rule (null keeps
+            // its single null entry, pre-origin timestamps produce no entries,
+            // undecodable values keep their raw key) lives in ONE place —
+            // [`TimeRangeTransform::entry_keys_for_raw`] — shared with the
+            // delete and update walkers so the three can never disagree.
+            let index_keys: Vec<DriveKeyInfo> = time_range_index_keys(
+                sub_level.time_range(),
+                document_top_field,
+                // A validated contract cannot exceed this; the clamp only
+                // bounds estimation work for unvalidated transforms. The
+                // `unwrap_or(1)` arm is a protocol version without
+                // time-range indexes, where no transform can exist.
+                platform_version
+                    .system_limits
+                    .max_time_range_overlap_factor
+                    .unwrap_or(1),
+            );
 
-            // we push the actual value of the index path
-            index_path_info.push(document_top_field)?;
-            // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId/<ownerId>
-
-            // Propagate the exact (post-demotion) `value_tree_type` we
-            // just inserted forward as the recursive level's
-            // `parent_value_tree_type` so its continuation children pick
-            // the right zero-contribution op.
-            self.add_indices_for_index_level_for_contract_operations(
-                document_and_contract_info,
-                index_path_info,
-                sub_level,
-                any_fields_null,
-                all_fields_null,
-                value_tree_type,
-                previous_batch_operations,
-                &storage_flags,
-                estimated_costs_only_with_layer_info,
-                event_id,
-                transaction,
-                batch_operations,
-                platform_version,
-            )?;
+            let bucket_count = index_keys.len();
+            for (bucket, index_key) in index_keys.into_iter().enumerate() {
+                // The zero will not matter here, because the PathKeyInfo is variable
+                let path_key_info = index_key.clone().add_path::<0>(index_path.clone());
+                self.batch_insert_empty_tree_if_not_exists(
+                    path_key_info,
+                    value_tree_type,
+                    storage_flags,
+                    value_apply_type,
+                    transaction,
+                    previous_batch_operations,
+                    batch_operations,
+                    drive_version,
+                )?;
+
+                // The final bucket takes ownership of `index_path`; earlier
+                // buckets (only a time-range fan-out has more than one)
+                // clone it.
+                let own_index_path = if bucket + 1 == bucket_count {
+                    std::mem::take(&mut index_path)
+                } else {
+                    index_path.clone()
+                };
+                let mut index_path_info = if document_and_contract_info
+                    .owned_document_info
+                    .document_info
+                    .is_document_size()
+                {
+                    // This is a stateless operation
+                    PathInfo::PathWithSizes(KeyInfoPath::from_known_owned_path(own_index_path))
+                } else {
+                    PathInfo::PathAsVec::<0>(own_index_path)
+                };
+
+                // we push the actual value of the index path
+                index_path_info.push(index_key)?;
+                // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId/<ownerId>
+
+                // Propagate the exact (post-demotion) `value_tree_type` we
+                // just inserted forward as the recursive level's
+                // `parent_value_tree_type` so its continuation children pick
+                // the right zero-contribution op.
+                self.add_indices_for_index_level_for_contract_operations(
+                    document_and_contract_info,
+                    index_path_info,
+                    sub_level,
+                    any_fields_null,
+                    all_fields_null,
+                    value_tree_type,
+                    previous_batch_operations,
+                    &storage_flags,
+                    estimated_costs_only_with_layer_info,
+                    event_id,
+                    transaction,
+                    batch_operations,
+                    platform_version,
+                )?;
+            }
         }
         Ok(())
     }
diff --git a/packages/rs-drive/src/drive/document/insert/mod.rs b/packages/rs-drive/src/drive/document/insert/mod.rs
index b02044b4781..fbaa278f2e5 100644
--- a/packages/rs-drive/src/drive/document/insert/mod.rs
+++ b/packages/rs-drive/src/drive/document/insert/mod.rs
@@ -455,7 +455,9 @@ mod tests {
                     &EPOCH_CHANGE_FEE_VERSION_TEST,
                     StorageDiskUsageCreditPerByte,
                 ),
-            processing_fee: 73253660,
+            // estimated_size v1 adds the contract-version stamp varint to
+            // the worst-case document size
+            processing_fee: 73323060,
             ..Default::default()
         };
 
diff --git a/packages/rs-drive/src/drive/document/update/internal/update_document_for_contract_operations/v1/mod.rs b/packages/rs-drive/src/drive/document/update/internal/update_document_for_contract_operations/v1/mod.rs
index c245802038e..45771bede30 100644
--- a/packages/rs-drive/src/drive/document/update/internal/update_document_for_contract_operations/v1/mod.rs
+++ b/packages/rs-drive/src/drive/document/update/internal/update_document_for_contract_operations/v1/mod.rs
@@ -1,5 +1,7 @@
 use crate::drive::constants::CONTRACT_DOCUMENTS_PATH_HEIGHT;
-use crate::drive::document::index_level_tree_types::index_level_tree_types_with_continuation_demotion;
+use crate::drive::document::index_level_tree_types::{
+    index_level_tree_types_with_continuation_demotion, IndexLevelTreeTypes,
+};
 use crate::drive::document::{
     make_document_reference, make_document_reference_with_sum_item, read_document_sum_contribution,
 };
@@ -16,7 +18,7 @@ use crate::util::object_size_info::DocumentInfo::DocumentOwnedInfo;
 use crate::util::object_size_info::DriveKeyInfo::{Key, KeyRef, KeySize};
 use crate::util::object_size_info::PathKeyElementInfo::PathKeyRefElement;
 use crate::util::object_size_info::{
-    DocumentAndContractInfo, DocumentInfoV0Methods, DriveKeyInfo, PathKeyInfo,
+    DocumentAndContractInfo, DocumentInfo, DocumentInfoV0Methods, DriveKeyInfo, PathKeyInfo,
 };
 use crate::util::storage_flags::StorageFlags;
 use dpp::block::block_info::BlockInfo;
@@ -33,7 +35,9 @@ use crate::drive::document::paths::{
     contract_documents_primary_key_path,
 };
 use dpp::data_contract::document_type::methods::DocumentTypeBasicMethods;
-use dpp::data_contract::document_type::IndexCountability;
+use dpp::data_contract::document_type::{
+    DocumentTypeRef, Index, IndexCountability, IndexLevel, TimeRangeTransform,
+};
 use dpp::version::PlatformVersion;
 use grovedb::batch::key_info::KeyInfo;
 use grovedb::batch::key_info::KeyInfo::KnownKey;
@@ -307,7 +311,16 @@ impl Drive {
             let top_index_property = index.properties.first().ok_or(Error::Drive(
                 DriveError::CorruptedContractIndexes("invalid contract indices".to_string()),
             ))?;
-            index_path.push(Vec::from(top_index_property.name.as_bytes()));
+            // A time-range index's top level is keyed by the property name
+            // qualified with the grid (`TimeRangeTransform::storage_key`),
+            // so different grids over one timestamp live in sibling
+            // subtrees; a plain index keeps the bare name. The same key is
+            // both the path segment and the `IndexLevel` lookup below.
+            let top_level_key = match index.time_range.as_ref() {
+                Some(transform) => transform.storage_key(&top_index_property.name),
+                None => top_index_property.name.clone(),
+            };
+            index_path.push(Vec::from(top_level_key.as_bytes()));
 
             // Mirror the insert path's IndexLevel descent. We
             // start at the top-level property's `IndexLevel` node —
@@ -324,15 +337,16 @@ impl Drive {
             // there). Using `has_index_with_type()` on the descended
             // node ensures we pick that upgrade rather than the
             // currently-iterated index's own per-level flags.
-            let mut current_index_level = index_structure
-                .sub_levels()
-                .get(&top_index_property.name)
-                .ok_or(Error::Drive(DriveError::CorruptedContractIndexes(format!(
-                    "index structure missing top property '{}' for index '{}' — \
+            let mut current_index_level =
+                index_structure
+                    .sub_levels()
+                    .get(&top_level_key)
+                    .ok_or(Error::Drive(DriveError::CorruptedContractIndexes(format!(
+                        "index structure missing top level '{}' for index '{}' — \
                          doctype's IndexLevel tree must contain every property of every \
                          registered index",
-                    top_index_property.name, index.name
-                ))))?;
+                        top_level_key, index.name
+                    ))))?;
 
             // Per-index reference variant. Mirror of the insert path's
             // dispatch in
@@ -357,6 +371,38 @@ impl Drive {
                 document_reference.clone()
             };
 
+            // Time-range indexes store one entry per overlapping range bucket,
+            // so they need a set-diff update rather than the single old→new
+            // value transition below. `current_index_level` is still the
+            // top-level node and `index_path` is the base
+            // (…/<document_type>/<grid-qualified source>) at this point. The
+            // transform is read off the `IndexLevel` node — the same source
+            // the insert and delete walkers branch on — so all three walkers
+            // agree even on a document type constructed outside full
+            // validation. (A level's key embeds its grid, so the node's
+            // transform is exactly the grid every index sharing this level
+            // declared.)
+            if let Some(transform) = current_index_level.time_range() {
+                self.update_time_range_index_for_contract_operations_v1(
+                    index,
+                    transform,
+                    document,
+                    &old_document_info,
+                    owner_id,
+                    document_type,
+                    &index_path,
+                    current_index_level,
+                    &index_document_reference,
+                    storage_flags,
+                    &mut batch_insertion_cache,
+                    previous_batch_operations,
+                    &mut batch_operations,
+                    transaction,
+                    platform_version,
+                )?;
+                continue;
+            }
+
             // with the example of the dashpay contract's first index
             // the index path is now something likeDataContracts/ContractID/Documents(1)/$ownerId
             let document_top_field = document
@@ -809,4 +855,403 @@ impl Drive {
         }
         Ok(batch_operations)
     }
+
+    /// Updates the index entries for a single **time-range** index.
+    ///
+    /// A time-range index stores one entry per overlapping range bucket the
+    /// document's timestamp falls into, so an update is a set diff rather than
+    /// the single old→new transition the normal-index path performs:
+    /// - entry keys present only in the old timestamp's set are removed,
+    /// - entry keys present only in the new timestamp's set are inserted,
+    /// - keys present in both are refreshed, or (when a later index property
+    ///   changed) deleted under the old sub-values and reinserted under the new
+    ///   ones.
+    ///
+    /// The entry-key set for a document mirrors the insert walker exactly: a
+    /// decodable timestamp yields one key per containing bucket (none when the
+    /// timestamp predates the transform's origin), a null timestamp yields the
+    /// single ordinary null key, and a non-null value that fails to decode
+    /// yields its raw key — so null→value, value→null and null→null
+    /// transitions maintain the same entries insert and delete would.
+    ///
+    /// Time-range indexes are validated to be non-contested, but they may be
+    /// unique when the windows do not overlap (`range == step`) and the source
+    /// is `$createdAt`, so both terminator layouts occur here and are chosen
+    /// exactly as the insert and delete walkers choose them
+    /// (`!unique || any_fields_null`): the non-unique layout stores the
+    /// reference under `…/<value>/[0]/<doc_id>`, the unique layout stores it
+    /// AT `…/<value>/[0]`. The predicate is evaluated separately for the new
+    /// and the old document, because the layout an entry was *written* under
+    /// is the layout it must be *deleted* under.
+    ///
+    /// (With a `$createdAt` source and overlap factor 1 the bucket set can
+    /// never change on an update — the timestamp is immutable and yields
+    /// exactly one bucket — so on a unique index only the suffix-change arms
+    /// below are reachable. The layout dispatch is nonetheless applied to
+    /// every arm rather than reasoned away per arm: the arms are shared with
+    /// non-unique indexes, and a future relaxation of the uniqueness rules
+    /// must not silently resurrect the wrong layout.)
+    ///
+    /// The estimated-cost / document-size update path never reaches this
+    /// method — it delegates to the insert path, which has its own bucket
+    /// fan-out.
+    #[allow(clippy::too_many_arguments)]
+    fn update_time_range_index_for_contract_operations_v1(
+        &self,
+        index: &Index,
+        transform: &TimeRangeTransform,
+        document: &Document,
+        old_document_info: &DocumentInfo,
+        owner_id: Option<[u8; 32]>,
+        document_type: DocumentTypeRef,
+        base_index_path: &[Vec<u8>],
+        top_index_level: &IndexLevel,
+        index_document_reference: &Element,
+        storage_flags: Option<&StorageFlags>,
+        batch_insertion_cache: &mut HashSet<Vec<Vec<u8>>>,
+        previous_batch_operations: &mut Option<&mut Vec<LowLevelDriveOperation>>,
+        batch_operations: &mut Vec<LowLevelDriveOperation>,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        let drive_version = &platform_version.drive;
+
+        // New/old raw values for the bucketed source property → entry key
+        // sets, mirroring the insert walker's fan-out (see the doc comment).
+        let new_raw = document.get_raw_for_document_type(
+            &transform.source,
+            document_type,
+            owner_id,
+            platform_version,
+        )?;
+        let old_raw = match old_document_info.get_raw_for_document_type(
+            &transform.source,
+            document_type,
+            None, // We want to use the old owner id
+            None,
+            platform_version,
+        )? {
+            Some(Key(k)) => Some(k),
+            Some(KeyRef(k)) => Some(k.to_vec()),
+            _ => None,
+        };
+
+        // The entry-key rule (null → single null entry, pre-origin → no
+        // entries, undecodable → raw key, decodable → containing buckets) is
+        // shared with the insert and delete walkers via
+        // `TimeRangeTransform::entry_keys_for_raw` — one definition, so the
+        // three walkers can never disagree.
+        let new_entry_keys = transform.entry_keys_for_raw(new_raw.as_deref().unwrap_or_default());
+        let old_entry_keys = transform.entry_keys_for_raw(old_raw.as_deref().unwrap_or_default());
+
+        // Terminator-layout inputs, tracked separately for the new and the old
+        // document and accumulated over the suffix properties in the loop
+        // below. The insert and delete walkers demote a unique index to the
+        // non-unique layout as soon as ANY indexed field is null
+        // (`any_fields_null`, accumulated with OR down the level recursion), so
+        // an entry's layout is a property of the document that wrote it — the
+        // delete below must therefore use the OLD document's verdict, not the
+        // new one's. A null source raw value yields the single empty entry key,
+        // which is exactly the null case here.
+        let mut new_any_fields_null = new_raw.as_deref().unwrap_or_default().is_empty();
+        let mut old_any_fields_null = old_raw.as_deref().unwrap_or_default().is_empty();
+
+        // Sub-property suffix (positions 1..) interleaved as [name, value, …]
+        // for both the new and old document, plus the IndexLevel node at each
+        // depth with its (pure, hoisted) tree-type derivation — the bucket
+        // loop below runs up to `overlap_factor` times and must not re-derive
+        // per iteration.
+        let mut levels: Vec<(&IndexLevel, IndexLevelTreeTypes)> = Vec::new();
+        let mut new_suffix: Vec<Vec<u8>> = Vec::new();
+        let mut old_suffix: Vec<Vec<u8>> = Vec::new();
+        let mut current_level = top_index_level;
+        for index_property in index.properties.iter().skip(1) {
+            current_level =
+                current_level
+                    .sub_levels()
+                    .get(&index_property.name)
+                    .ok_or(Error::Drive(DriveError::CorruptedContractIndexes(format!(
+                        "index structure missing sub_level '{}' under time-range index '{}'",
+                        index_property.name, index.name
+                    ))))?;
+            levels.push((
+                current_level,
+                index_level_tree_types_with_continuation_demotion(current_level)?,
+            ));
+
+            let new_val = document
+                .get_raw_for_document_type(
+                    &index_property.name,
+                    document_type,
+                    owner_id,
+                    platform_version,
+                )?
+                .unwrap_or_default();
+            let old_val = match old_document_info.get_raw_for_document_type(
+                &index_property.name,
+                document_type,
+                None,
+                None,
+                platform_version,
+            )? {
+                Some(Key(k)) => k,
+                Some(KeyRef(k)) => k.to_vec(),
+                _ => Vec::new(),
+            };
+            new_any_fields_null |= new_val.is_empty();
+            old_any_fields_null |= old_val.is_empty();
+
+            new_suffix.push(index_property.name.as_bytes().to_vec());
+            new_suffix.push(new_val);
+            old_suffix.push(index_property.name.as_bytes().to_vec());
+            old_suffix.push(old_val);
+        }
+
+        // The two terminator layouts, mirroring
+        // `add_reference_for_index_level_for_contract_operations_v0`'s
+        // `!index_type.index_type.is_unique() || any_fields_null` dispatch.
+        let new_terminator_is_unique = index.unique && !new_any_fields_null;
+        let old_terminator_is_unique = index.unique && !old_any_fields_null;
+
+        let suffix_changed = new_suffix != old_suffix;
+        let reference_tree_type =
+            reference_tree_type_for_index(index.countable, &index.summable, index.range_summable);
+        let top_level_tree_types =
+            index_level_tree_types_with_continuation_demotion(top_index_level)?;
+        let top_value_tree_type = top_level_tree_types.value_tree_type;
+        let doc_id = document.id();
+
+        let new_set: HashSet<&Vec<u8>> = new_entry_keys.iter().collect();
+        let old_set: HashSet<&Vec<u8>> = old_entry_keys.iter().collect();
+
+        // Insert/refresh new entries FIRST (see the ordering note on the
+        // delete loop below): added keys are inserted; common keys are
+        // refreshed when unchanged or reinserted when the suffix changed.
+        for entry_key in &new_entry_keys {
+            if old_set.contains(entry_key) && !suffix_changed {
+                // Unchanged entry — refresh the stored reference in place
+                // (its content can still differ via storage flags). An entry
+                // key can only be in both sets when the source value's
+                // null-ness matched (a null raw yields the empty key, a
+                // non-null one an 8-byte bucket start), and the suffix is
+                // unchanged here, so the old and new layouts coincide and
+                // either verdict describes the entry on disk.
+                let mut path: Vec<Vec<u8>> = base_index_path.to_vec();
+                path.push(entry_key.clone());
+                for segment in &new_suffix {
+                    path.push(segment.clone());
+                }
+                let (refresh_key, refresh_path) = if new_terminator_is_unique {
+                    // Unique layout: the reference lives AT `[0]`.
+                    (vec![0], path)
+                } else {
+                    // Non-unique layout: `[0]` is a tree of doc-id-keyed
+                    // references.
+                    path.push(vec![0]);
+                    (doc_id.to_vec(), path)
+                };
+                self.batch_refresh_reference(
+                    refresh_path,
+                    refresh_key,
+                    index_document_reference.clone(),
+                    storage_flags.is_none(),
+                    batch_operations,
+                    drive_version,
+                )?;
+                continue;
+            }
+
+            // Materialize every tree along the entry path — the same
+            // post-demotion tree types and zero-contribution wrappers the
+            // insert walkers use — then store the reference. The insertion
+            // cache prevents duplicate empty-tree operations when several
+            // indexes produce the same qualified path. Indexes sharing a
+            // first property need NOT share a transform (grids fork into
+            // sibling subtrees via their grid-qualified level keys), which
+            // is exactly why the cache keys on the full qualified path
+            // rather than the property name.
+            let mut path: Vec<Vec<u8>> = base_index_path.to_vec();
+            let mut qualified_path = path.clone();
+            qualified_path.push(entry_key.clone());
+            if !batch_insertion_cache.contains(&qualified_path) {
+                let inserted = self.batch_insert_empty_tree_if_not_exists(
+                    PathKeyInfo::PathKeyRef::<0>((path.clone(), entry_key.as_slice())),
+                    top_value_tree_type,
+                    storage_flags,
+                    BatchInsertTreeApplyType::StatefulBatchInsertTree,
+                    transaction,
+                    previous_batch_operations,
+                    batch_operations,
+                    drive_version,
+                )?;
+                if inserted {
+                    batch_insertion_cache.insert(qualified_path);
+                }
+            }
+            path.push(entry_key.clone());
+
+            let mut parent_value_tree_type = top_value_tree_type;
+            for (i, (_level, sub_level_tree_types)) in levels.iter().enumerate() {
+                let property_name = &new_suffix[i * 2];
+                let value = &new_suffix[i * 2 + 1];
+
+                let mut qualified_path = path.clone();
+                qualified_path.push(property_name.clone());
+                if !batch_insertion_cache.contains(&qualified_path) {
+                    // Continuation property-name tree: contributes zero on
+                    // every axis its aggregating parent maintains, exactly
+                    // as on the insert path.
+                    let property_name_tree_type = sub_level_tree_types.property_name_tree_type;
+                    let ranked_axes = sub_level_tree_types.ranked_axes.as_slice();
+                    let inserted = if matches!(parent_value_tree_type, TreeType::NormalTree) {
+                        self.batch_insert_empty_index_tree_if_not_exists(
+                            PathKeyInfo::PathKeyRef::<0>((path.clone(), property_name.as_slice())),
+                            property_name_tree_type,
+                            ranked_axes,
+                            storage_flags,
+                            BatchInsertTreeApplyType::StatefulBatchInsertTree,
+                            transaction,
+                            previous_batch_operations,
+                            batch_operations,
+                            drive_version,
+                        )?
+                    } else {
+                        self.batch_insert_empty_tree_contributing_zero_to_aggregating_parent_if_not_exists(
+                            PathKeyInfo::PathKeyRef::<0>((path.clone(), property_name.as_slice())),
+                            parent_value_tree_type,
+                            property_name_tree_type,
+                            ranked_axes,
+                            storage_flags,
+                            BatchInsertTreeApplyType::StatefulBatchInsertTree,
+                            transaction,
+                            previous_batch_operations,
+                            batch_operations,
+                            drive_version,
+                        )?
+                    };
+                    if inserted {
+                        batch_insertion_cache.insert(qualified_path);
+                    }
+                }
+                path.push(property_name.clone());
+
+                let mut qualified_path = path.clone();
+                qualified_path.push(value.clone());
+                if !batch_insertion_cache.contains(&qualified_path) {
+                    let inserted = self.batch_insert_empty_tree_if_not_exists(
+                        PathKeyInfo::PathKeyRef::<0>((path.clone(), value.as_slice())),
+                        sub_level_tree_types.value_tree_type,
+                        storage_flags,
+                        BatchInsertTreeApplyType::StatefulBatchInsertTree,
+                        transaction,
+                        previous_batch_operations,
+                        batch_operations,
+                        drive_version,
+                    )?;
+                    if inserted {
+                        batch_insertion_cache.insert(qualified_path);
+                    }
+                }
+                path.push(value.clone());
+
+                parent_value_tree_type = sub_level_tree_types.value_tree_type;
+            }
+
+            if new_terminator_is_unique {
+                // Unique layout: no per-document subtree — the reference IS
+                // the element at `[0]`, so the slot must be free. Insertion
+                // failure means two documents claim the same (bucket, …)
+                // tuple, which the uniqueness validation should have caught
+                // before we got here; treat it as index corruption exactly as
+                // the non-time-range branch does.
+                let inserted = self.batch_insert_if_not_exists(
+                    PathKeyRefElement::<0>((path, &[0], index_document_reference.clone())),
+                    BatchInsertApplyType::StatefulBatchInsert,
+                    transaction,
+                    batch_operations,
+                    drive_version,
+                )?;
+                if !inserted {
+                    return Err(Error::Drive(DriveError::CorruptedContractIndexes(
+                        "index already exists".to_string(),
+                    )));
+                }
+            } else {
+                // Non-unique layout: materialize the `[0]` reference bucket
+                // (it carries the index's count/sum aggregates) and store the
+                // reference under the document id.
+                self.batch_insert_empty_tree_if_not_exists(
+                    PathKeyInfo::PathKeyRef::<0>((path.clone(), &[0])),
+                    reference_tree_type,
+                    storage_flags,
+                    BatchInsertTreeApplyType::StatefulBatchInsertTree,
+                    transaction,
+                    previous_batch_operations,
+                    batch_operations,
+                    drive_version,
+                )?;
+                path.push(vec![0]);
+
+                self.batch_insert(
+                    PathKeyRefElement::<0>((
+                        path,
+                        doc_id.as_slice(),
+                        index_document_reference.clone(),
+                    )),
+                    batch_operations,
+                    drive_version,
+                )?;
+            }
+        }
+        // Delete old entries LAST: removed keys, plus common keys whose
+        // sub-values changed (their old-suffix path no longer matches). The
+        // ordering is load-bearing: `batch_delete_up_tree_while_empty` folds
+        // the already-accumulated batch operations into its emptiness walk,
+        // so with the inserts above in place it stops before deleting a
+        // shared ancestor tree (bucket / property-name) that this same batch
+        // re-populates — e.g. on a suffix change at an unchanged timestamp.
+        // Deletes first would emit a delete of that ancestor alongside
+        // inserts into it, which grovedb's batch consistency check rejects.
+        for entry_key in &old_entry_keys {
+            if new_set.contains(entry_key) && !suffix_changed {
+                continue; // unchanged entry — already refreshed by the insert loop above
+            }
+            let mut key_info_path: Vec<KeyInfo> = base_index_path
+                .iter()
+                .map(|s| KnownKey(s.clone()))
+                .collect();
+            key_info_path.push(KnownKey(entry_key.clone()));
+            for segment in &old_suffix {
+                key_info_path.push(KnownKey(segment.clone()));
+            }
+            // The entry is removed under the layout the OLD document wrote it
+            // with: under the unique layout `[0]` IS the reference and is the
+            // key being deleted, under the non-unique layout `[0]` is the
+            // enclosing tree and the document id is the key. The stop height
+            // is unaffected — the emptiness walk still climbs the suffix
+            // values, the property-name trees and the bucket, and still stops
+            // at the document-type level, whose per-index property-name trees
+            // belong to contract registration rather than to any document.
+            let delete_key: Vec<u8> = if old_terminator_is_unique {
+                vec![0]
+            } else {
+                key_info_path.push(KnownKey(vec![0]));
+                doc_id.to_vec()
+            };
+            self.batch_delete_up_tree_while_empty(
+                KeyInfoPath::from_vec(key_info_path),
+                delete_key.as_slice(),
+                Some(CONTRACT_DOCUMENTS_PATH_HEIGHT),
+                BatchDeleteUpTreeApplyType::StatefulBatchDelete {
+                    is_known_to_be_subtree_with_sum: Some(MaybeTree::NotTree),
+                },
+                transaction,
+                previous_batch_operations,
+                batch_operations,
+                drive_version,
+            )?;
+        }
+
+        Ok(())
+    }
 }
diff --git a/packages/rs-drive/src/drive/document/update/mod.rs b/packages/rs-drive/src/drive/document/update/mod.rs
index 8c878a8e407..5f4addfe4d6 100644
--- a/packages/rs-drive/src/drive/document/update/mod.rs
+++ b/packages/rs-drive/src/drive/document/update/mod.rs
@@ -3148,6 +3148,7 @@ mod tests {
         properties_initial.insert("color".to_string(), Value::Text("red".to_string()));
         properties_initial.insert("amount".to_string(), Value::U64(5));
         let document_initial: dpp::document::Document = DocumentV0 {
+            contract_version: None,
             id: doc_id,
             owner_id: Identifier::from([0u8; 32]),
             properties: properties_initial,
@@ -3196,6 +3197,7 @@ mod tests {
         properties_updated.insert("color".to_string(), Value::Text("red".to_string()));
         properties_updated.insert("amount".to_string(), Value::U64(42));
         let document_updated: dpp::document::Document = DocumentV0 {
+            contract_version: None,
             id: doc_id,
             owner_id: Identifier::from([0u8; 32]),
             properties: properties_updated,
@@ -3262,6 +3264,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_response = drive
             .execute_document_sum_request(sum_request, None, platform_version)
@@ -3399,6 +3402,7 @@ mod tests {
         properties_initial.insert("color".to_string(), Value::Text("red".to_string()));
         properties_initial.insert("amount".to_string(), Value::U64(11));
         let document_initial: dpp::document::Document = DocumentV0 {
+            contract_version: None,
             id: doc_id,
             owner_id: Identifier::from([0u8; 32]),
             properties: properties_initial,
@@ -3444,6 +3448,7 @@ mod tests {
         properties_updated.insert("color".to_string(), Value::Text("blue".to_string()));
         properties_updated.insert("amount".to_string(), Value::U64(17));
         let document_updated: dpp::document::Document = DocumentV0 {
+            contract_version: None,
             id: doc_id,
             owner_id: Identifier::from([0u8; 32]),
             properties: properties_updated,
@@ -3497,6 +3502,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_response = drive
             .execute_document_sum_request(sum_request, None, platform_version)
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/calculate_current_withdrawal_limit/v1/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/calculate_current_withdrawal_limit/v1/mod.rs
index 4e6fbbf9747..523cbe6d075 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/calculate_current_withdrawal_limit/v1/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/calculate_current_withdrawal_limit/v1/mod.rs
@@ -1,67 +1,183 @@
 use crate::drive::identity::withdrawals::calculate_current_withdrawal_limit::WithdrawalLimitInfo;
 use crate::drive::identity::withdrawals::paths::{
-    get_withdrawal_root_path, WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
+    get_withdrawal_credit_inflows_sum_tree_path_vec, get_withdrawal_transactions_sum_tree_path_vec,
 };
+use crate::drive::identity::withdrawals::DAY_AND_A_HOUR_IN_MS;
 use crate::drive::Drive;
 use crate::error::drive::DriveError;
 use crate::error::Error;
-use crate::util::grove_operations::DirectQueryType;
 use dpp::block::block_info::BlockInfo;
 use dpp::withdrawal::daily_withdrawal_limit::daily_withdrawal_limit;
-use grovedb::TransactionArg;
+use grovedb::query_result_type::{QueryResultElement, QueryResultType};
+use grovedb::{Element, PathQuery, Query, QueryItem, TransactionArg};
 use platform_version::version::PlatformVersion;
 
+/// The error messages `sum_expiry_keyed_entries_at_or_after` uses for one tree's entries.
+struct ExpiryKeyedEntryErrors {
+    not_a_sum_item: &'static str,
+    negative: &'static str,
+    overflow: &'static str,
+}
+
+const CREDIT_INFLOW_ERRORS: ExpiryKeyedEntryErrors = ExpiryKeyedEntryErrors {
+    not_a_sum_item: "credit inflow entry is not a sum item",
+    negative: "credit inflow entry is negative",
+    overflow: "credit inflow entries overflow",
+};
+
+const WITHDRAWAL_RESERVATION_ERRORS: ExpiryKeyedEntryErrors = ExpiryKeyedEntryErrors {
+    not_a_sum_item: "withdrawal reservation entry is not a sum item",
+    negative: "withdrawal reservation entry is negative",
+    overflow: "withdrawal reservation entries overflow",
+};
+
 impl Drive {
     /// Calculates the current withdrawal limit from the total credits Platform held a day ago
-    /// and the amount already withdrawn in the last 24 hours.
+    /// and the credit inflows and withdrawal reservations recorded since that snapshot.
+    ///
+    /// Version 1 differs from version 0 in the daily maximum and the counted reservations:
     ///
-    /// Version 1 differs from version 0 only in the base of the daily maximum: instead of the
-    /// current total credits it hands `daily_withdrawal_limit` the total credits recorded at the
-    /// latest block at least 24 hours before `block_info` (see
-    /// `fetch_total_credits_in_platform_a_day_ago`), so a sudden jump in the total credits does
-    /// not raise the limit for a day. While no such entry exists (the history is younger than a
-    /// day) the limit method receives `None` and applies its bootstrap rule.
+    /// * the base is not the current total credits but the total credits recorded at the latest
+    ///   block at least 24 hours before `block_info` (see
+    ///   `fetch_total_credits_in_platform_a_day_ago`), so a sudden jump in the total credits
+    ///   does not raise the limit for a day. While no such entry exists (the history is younger
+    ///   than a day) the limit method receives `None` and applies its bootstrap rule;
+    /// * the credit inflows recorded since that base snapshot (asset locks, epoch Core
+    ///   rewards — money that verifiably entered Platform, so a Platform minting bug cannot
+    ///   forge it) are added on top, making the limit one on net outflow instead of gross: a
+    ///   deposit and the withdrawal it funds cancel out and consume none of the budget of
+    ///   other users. Only inflows younger than the snapshot count — an older one is already
+    ///   inside the base, and adding it again would allow the pool level to drop below the
+    ///   guaranteed share of the day-old total — and only unexpired ones, so an entry the
+    ///   bounded cleanup has not deleted yet cannot outlive its 25 hours here. The base
+    ///   stays capped by `max_daily_withdrawal_amount` (Core's unlock capacity per day) but
+    ///   the inflows ride above the cap: capping the sum would hand the whole capped budget
+    ///   back to a deposit-withdraw cycle whenever the base reaches the cap, and outflow
+    ///   funded by same-window deposits mirrors the net credit pool rule Core adopts
+    ///   alongside this;
+    /// * the withdrawal reservations are bounded the same way: one pooled at or before the
+    ///   snapshot describes an outflow the base already reflects (the history is recorded
+    ///   after state transitions executed), so subtracting it again would deny budget the
+    ///   guarantee does not require — a deposit-withdraw cycle would stay debited for the
+    ///   hour its reservation outlives the snapshot instead of cancelling exactly.
     ///
-    /// The formula stays `daily_maximum - withdrawal_amount_in_last_day`, floored at zero.
+    /// The formula stays `daily_maximum - withdrawals_amount`, floored at zero, with both
+    /// sides counted over the interval after the snapshot.
     pub(super) fn calculate_current_withdrawal_limit_v1(
         &self,
         block_info: &BlockInfo,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<WithdrawalLimitInfo, Error> {
-        let mut drive_operations = vec![];
+        let recorded_a_day_ago = self.fetch_total_credits_in_platform_a_day_ago(
+            block_info.time_ms,
+            transaction,
+            platform_version,
+        )?;
 
-        let total_credits_a_day_ago = self
-            .fetch_total_credits_in_platform_a_day_ago(
-                block_info.time_ms,
-                transaction,
-                platform_version,
-            )?
-            .map(|recorded| recorded.total_credits);
-
-        let daily_maximum = daily_withdrawal_limit(total_credits_a_day_ago, platform_version)?;
-
-        let withdrawal_amount_in_last_day: u64 = self
-            .grove_get_sum_tree_total_value(
-                (&get_withdrawal_root_path()).into(),
-                &WITHDRAWAL_TRANSACTIONS_SUM_AMOUNT_TREE_KEY,
-                DirectQueryType::StatefulDirectQuery,
-                transaction,
-                &mut drive_operations,
-                &platform_version.drive,
-            )?
-            .try_into()
-            .map_err(|_| {
-                Error::Drive(DriveError::CriticalCorruptedState(
-                    "Withdrawal amount in last day is negative",
-                ))
-            })?;
+        // Entries of both trees are keyed by their expiration, 25 hours after the recording
+        // block, so an entry counts while its key is at or past two bounds: the block time
+        // (unexpired — matching the strict cutoff of the cleanup, whose bounded batch may lag
+        // behind), and just past the base snapshot plus 25 hours (recorded after the
+        // snapshot). An inflow at or before the snapshot is already inside the base — adding
+        // it again would let the pool level drop below the guaranteed share of the day-old
+        // total — and a reservation at or before it describes an outflow the base already
+        // reflects, so subtracting it again would deny budget the guarantee does not require.
+        let counted_from = {
+            let unexpired = block_info.time_ms;
+            match &recorded_a_day_ago {
+                Some(recorded) => unexpired.max(
+                    recorded
+                        .time_ms
+                        .saturating_add(DAY_AND_A_HOUR_IN_MS)
+                        .saturating_add(1),
+                ),
+                None => unexpired,
+            }
+        };
+
+        let credit_inflows_since_the_snapshot = self.sum_expiry_keyed_entries_at_or_after(
+            get_withdrawal_credit_inflows_sum_tree_path_vec(),
+            counted_from,
+            CREDIT_INFLOW_ERRORS,
+            transaction,
+            platform_version,
+        )?;
+
+        let total_credits_a_day_ago = recorded_a_day_ago.map(|recorded| recorded.total_credits);
+
+        // The base is capped at Core's unlock capacity inside `daily_withdrawal_limit`; the
+        // inflows ride on top of the capped base, not under the cap. Capping the sum would
+        // discard the inflows exactly when the base reaches the cap — at that point a
+        // deposit-withdraw cycle would consume the whole capped budget again (#4471 under
+        // mainnet totals). Outflow funded by same-window deposits mirrors the net credit
+        // pool rule Core adopts alongside this (see #4471), so it may exceed the cap.
+        let daily_maximum = daily_withdrawal_limit(total_credits_a_day_ago, platform_version)?
+            .saturating_add(credit_inflows_since_the_snapshot);
+
+        let withdrawals_since_the_snapshot = self.sum_expiry_keyed_entries_at_or_after(
+            get_withdrawal_transactions_sum_tree_path_vec(),
+            counted_from,
+            WITHDRAWAL_RESERVATION_ERRORS,
+            transaction,
+            platform_version,
+        )?;
 
         Ok(WithdrawalLimitInfo {
             daily_maximum,
-            withdrawals_amount: withdrawal_amount_in_last_day,
+            withdrawals_amount: withdrawals_since_the_snapshot,
         })
     }
+
+    /// Sums the sum-item entries of `path` whose expiration key is at or after
+    /// `from_time_ms`. Each tree only ever holds the recording blocks of one 25-hour window
+    /// plus whatever the bounded cleanup has not deleted yet, so walking the range stays
+    /// small; `what` names the entries in errors.
+    fn sum_expiry_keyed_entries_at_or_after(
+        &self,
+        path: Vec<Vec<u8>>,
+        from_time_ms: u64,
+        what: ExpiryKeyedEntryErrors,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
+    ) -> Result<u64, Error> {
+        let path_query = PathQuery::new_unsized(
+            path,
+            Query::new_single_query_item(QueryItem::RangeFrom(
+                from_time_ms.to_be_bytes().to_vec()..,
+            )),
+        );
+
+        let (results, _) = self.grove_get_raw_path_query(
+            &path_query,
+            transaction,
+            QueryResultType::QueryElementResultType,
+            &mut vec![],
+            &platform_version.drive,
+        )?;
+
+        let mut total: u64 = 0;
+        for result in results.into_iterator() {
+            let QueryResultElement::ElementResultItem(element) = result else {
+                return Err(Error::Drive(DriveError::CorruptedCodeExecution(
+                    "element query returned a non-element result",
+                )));
+            };
+            let Element::SumItem(amount, _) = element else {
+                return Err(Error::Drive(DriveError::CorruptedElementType(
+                    what.not_a_sum_item,
+                )));
+            };
+            let amount: u64 = amount
+                .try_into()
+                .map_err(|_| Error::Drive(DriveError::CriticalCorruptedState(what.negative)))?;
+            total = total.checked_add(amount).ok_or(Error::Drive(
+                DriveError::CriticalCorruptedState(what.overflow),
+            ))?;
+        }
+
+        Ok(total)
+    }
 }
 
 #[cfg(test)]
@@ -145,4 +261,441 @@ mod tests {
             dash_to_credits!(3600)
         );
     }
+
+    /// The regression guard for the gross-accounting starvation of issue #4471: a
+    /// deposit -> withdraw cycle of one user's own coins must not consume the withdrawal
+    /// budget of everyone else. The deposit lands as a recorded credit inflow
+    /// (recorded per block by `record_credit_inflow`, fed by the mints every asset-lock
+    /// emits), which records it in the credit inflows sum tree; the limit adds those inflows
+    /// to the daily maximum, so the cycle nets out to the untouched base.
+    #[test]
+    fn deposit_then_withdraw_cycling_should_not_consume_the_budget_of_others() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let mut platform_version = PlatformVersion::latest().clone();
+        platform_version
+            .system_limits
+            .daily_withdrawal_limit_percent = Some(15);
+        let transaction = drive.grove.start_transaction();
+
+        let t0 = 10 * DAY_IN_MS;
+        let block = |time_ms: u64| BlockInfo {
+            time_ms,
+            ..Default::default()
+        };
+        let limit = |time_ms: u64| {
+            drive
+                .calculate_current_withdrawal_limit(
+                    &block(time_ms),
+                    Some(&transaction),
+                    &platform_version,
+                )
+                .expect("expected the limit")
+        };
+
+        // Platform holds 10,000 Dash. The direct `add_to_system_credits` call is state setup,
+        // not a minting operation, so it records no inflow.
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(10000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add credits");
+        drive
+            .record_total_credits_history(&block(t0), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // A day later the base is 15% of 10,000 = 1,500 Dash and no inflows are recorded.
+        let day_one = t0 + DAY_IN_MS;
+        assert_eq!(limit(day_one).daily_maximum, dash_to_credits!(1500));
+
+        // The user deposits 1,000 Dash of their own money; the block records the mint as a
+        // credit inflow, which extends the daily maximum by the same amount.
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(1000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add the deposit");
+        drive
+            .record_credit_inflow(
+                dash_to_credits!(1000),
+                &block(day_one),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to record the inflow");
+        assert_eq!(limit(day_one).daily_maximum, dash_to_credits!(2500));
+
+        // ... and withdraws the same 1,000 Dash again: pooling reserves the amount and the
+        // executed withdrawal takes the credits back out of Platform.
+        let mut drive_operations = vec![];
+        drive
+            .add_enqueue_untied_withdrawal_transaction_operations(
+                vec![(1, vec![0u8; 32])],
+                dash_to_credits!(1000),
+                &mut drive_operations,
+                &platform_version,
+            )
+            .expect("expected to enqueue the withdrawal");
+        drive
+            .apply_drive_operations(
+                drive_operations,
+                true,
+                &block(day_one),
+                Some(&transaction),
+                &platform_version,
+                None,
+            )
+            .expect("expected to apply the pooling operations");
+        drive
+            .remove_from_system_credits(
+                dash_to_credits!(1000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to remove the withdrawn credits");
+
+        // The cycle nets out: everyone else still has the full 1,500 Dash base available.
+        let info = limit(day_one);
+        assert_eq!(info.daily_maximum, dash_to_credits!(2500));
+        assert_eq!(info.withdrawals_amount, dash_to_credits!(1000));
+        assert_eq!(info.available(), dash_to_credits!(1500));
+    }
+
+    /// Inflows extend the daily maximum past the capped base: the cap bounds what Core mines
+    /// out of the standing pool per day, and capping the sum instead would hand the whole
+    /// capped budget back to a deposit-withdraw cycle whenever the base reaches the cap —
+    /// #4471 under mainnet totals. At a 30,000 Dash total the base is capped at 4,000; a
+    /// 4,000 Dash deposit-withdraw cycle must leave the full 4,000 available to others.
+    #[test]
+    fn a_cycle_at_the_capped_base_should_not_consume_the_budget_of_others() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let mut platform_version = PlatformVersion::latest().clone();
+        platform_version
+            .system_limits
+            .daily_withdrawal_limit_percent = Some(15);
+        let transaction = drive.grove.start_transaction();
+
+        let t0 = 10 * DAY_IN_MS;
+        let block = |time_ms: u64| BlockInfo {
+            time_ms,
+            ..Default::default()
+        };
+        let limit = |time_ms: u64| {
+            drive
+                .calculate_current_withdrawal_limit(
+                    &block(time_ms),
+                    Some(&transaction),
+                    &platform_version,
+                )
+                .expect("expected the limit")
+        };
+
+        // Platform holds 30,000 Dash: 15% would be 4,500, so the base sits at the 4,000 Dash
+        // cap — the network conditions of #4471.
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(30000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add credits");
+        drive
+            .record_total_credits_history(&block(t0), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        let day_one = t0 + DAY_IN_MS;
+        assert_eq!(limit(day_one).daily_maximum, dash_to_credits!(4000));
+
+        // The attacker deposits the whole capped budget and withdraws it again.
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(4000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add the deposit");
+        drive
+            .record_credit_inflow(
+                dash_to_credits!(4000),
+                &block(day_one),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to record the inflow");
+        let mut drive_operations = vec![];
+        drive
+            .add_enqueue_untied_withdrawal_transaction_operations(
+                vec![(1, vec![0u8; 32])],
+                dash_to_credits!(4000),
+                &mut drive_operations,
+                &platform_version,
+            )
+            .expect("expected to enqueue the withdrawal");
+        drive
+            .apply_drive_operations(
+                drive_operations,
+                true,
+                &block(day_one),
+                Some(&transaction),
+                &platform_version,
+                None,
+            )
+            .expect("expected to apply the pooling operations");
+        drive
+            .remove_from_system_credits(
+                dash_to_credits!(4000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to remove the withdrawn credits");
+
+        // The inflow rides above the cap, so the cycle nets out: everyone else still has the
+        // full capped budget available.
+        let info = limit(day_one);
+        assert_eq!(info.daily_maximum, dash_to_credits!(8000));
+        assert_eq!(info.withdrawals_amount, dash_to_credits!(4000));
+        assert_eq!(info.available(), dash_to_credits!(4000));
+    }
+
+    /// An inflow that is already part of the day-old base must not extend the daily maximum a
+    /// second time: while the deposit block is younger than a day the inflow counts against
+    /// the older snapshot, and the moment the deposit block itself becomes the snapshot the
+    /// inflow is inside the base and drops out of the sum.
+    #[test]
+    fn an_inflow_inside_the_day_old_base_should_not_count_again() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let mut platform_version = PlatformVersion::latest().clone();
+        platform_version
+            .system_limits
+            .daily_withdrawal_limit_percent = Some(15);
+        let transaction = drive.grove.start_transaction();
+
+        let hour = DAY_IN_MS / 24;
+        let t0 = 10 * DAY_IN_MS;
+        let block = |time_ms: u64| BlockInfo {
+            time_ms,
+            ..Default::default()
+        };
+        let limit = |time_ms: u64| {
+            drive
+                .calculate_current_withdrawal_limit(
+                    &block(time_ms),
+                    Some(&transaction),
+                    &platform_version,
+                )
+                .expect("expected the limit")
+        };
+
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(20000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add credits");
+        drive
+            .record_total_credits_history(&block(t0), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // An hour later 500 Dash is deposited and the new total of 20,500 recorded.
+        let t1 = t0 + hour;
+        drive
+            .add_to_system_credits(dash_to_credits!(500), Some(&transaction), &platform_version)
+            .expect("expected to add the deposit");
+        drive
+            .record_credit_inflow(
+                dash_to_credits!(500),
+                &block(t1),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to record the inflow");
+        drive
+            .record_total_credits_history(&block(t1), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // 23 hours after the deposit the base is still the 20,000 Dash snapshot from before
+        // it, so the inflow counts: 15% of 20,000 + 500.
+        assert_eq!(limit(t1 + 23 * hour).daily_maximum, dash_to_credits!(3500));
+
+        // An hour later the deposit block is the base snapshot: the 500 Dash sits inside the
+        // 20,500 and only the percentage applies. Counting it again would have allowed
+        // 15% of 20,500 + 500 and let the pool level drop below 85% of the day-old total.
+        assert_eq!(limit(t1 + DAY_IN_MS).daily_maximum, dash_to_credits!(3075));
+    }
+
+    /// An inflow entry the bounded per-block cleanup has not deleted yet must still stop
+    /// counting the moment it expires, mirroring the strict cutoff the cleanup uses.
+    #[test]
+    fn an_expired_but_not_yet_pruned_inflow_should_not_count() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let mut platform_version = PlatformVersion::latest().clone();
+        platform_version
+            .system_limits
+            .daily_withdrawal_limit_percent = Some(15);
+        let transaction = drive.grove.start_transaction();
+
+        let hour = DAY_IN_MS / 24;
+        let t0 = 10 * DAY_IN_MS;
+        let block = |time_ms: u64| BlockInfo {
+            time_ms,
+            ..Default::default()
+        };
+        let limit = |time_ms: u64| {
+            drive
+                .calculate_current_withdrawal_limit(
+                    &block(time_ms),
+                    Some(&transaction),
+                    &platform_version,
+                )
+                .expect("expected the limit")
+        };
+
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(20000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add credits");
+        drive
+            .record_total_credits_history(&block(t0), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // A day later 500 Dash is deposited; its inflow entry expires 25 hours after that.
+        let t1 = t0 + DAY_IN_MS;
+        drive
+            .add_to_system_credits(dash_to_credits!(500), Some(&transaction), &platform_version)
+            .expect("expected to add the deposit");
+        drive
+            .record_credit_inflow(
+                dash_to_credits!(500),
+                &block(t1),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to record the inflow");
+
+        // At the exact expiration block the entry still counts, exactly like a reservation
+        // with that key would still be held: the cleanup deletes strictly older keys only.
+        assert_eq!(limit(t1 + 25 * hour).daily_maximum, dash_to_credits!(3500));
+
+        // A millisecond past expiration it no longer counts, even though no cleanup ran and
+        // the entry is still in the tree.
+        assert_eq!(
+            limit(t1 + 25 * hour + 1).daily_maximum,
+            dash_to_credits!(3000)
+        );
+    }
+
+    /// A reservation whose outflow the day-old base already reflects must not be subtracted
+    /// again: once the post-withdrawal total is the snapshot, both the deposit's inflow and
+    /// the withdrawal's reservation drop out together and the cycle has cancelled exactly.
+    /// Before the fix the reservation kept debiting `available()` for the hour it outlived
+    /// the snapshot.
+    #[test]
+    fn a_reservation_inside_the_day_old_base_should_not_be_subtracted_again() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let mut platform_version = PlatformVersion::latest().clone();
+        platform_version
+            .system_limits
+            .daily_withdrawal_limit_percent = Some(15);
+        let transaction = drive.grove.start_transaction();
+
+        let hour = DAY_IN_MS / 24;
+        let t0 = 10 * DAY_IN_MS;
+        let block = |time_ms: u64| BlockInfo {
+            time_ms,
+            ..Default::default()
+        };
+        let limit = |time_ms: u64| {
+            drive
+                .calculate_current_withdrawal_limit(
+                    &block(time_ms),
+                    Some(&transaction),
+                    &platform_version,
+                )
+                .expect("expected the limit")
+        };
+
+        drive
+            .add_to_system_credits(
+                dash_to_credits!(20000),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to add credits");
+        drive
+            .record_total_credits_history(&block(t0), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // An hour later 500 Dash is deposited, and an hour after that withdrawn again:
+        // the withdrawal executes (the total returns to 20,000) and is pooled, reserving
+        // 500 Dash until t2 + 25h.
+        let t1 = t0 + hour;
+        drive
+            .add_to_system_credits(dash_to_credits!(500), Some(&transaction), &platform_version)
+            .expect("expected to add the deposit");
+        drive
+            .record_credit_inflow(
+                dash_to_credits!(500),
+                &block(t1),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to record the inflow");
+        drive
+            .record_total_credits_history(&block(t1), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        let t2 = t0 + 2 * hour;
+        drive
+            .remove_from_system_credits(
+                dash_to_credits!(500),
+                Some(&transaction),
+                &platform_version,
+            )
+            .expect("expected to remove the withdrawn credits");
+        let mut drive_operations = vec![];
+        drive
+            .add_enqueue_untied_withdrawal_transaction_operations(
+                vec![(1, vec![0u8; 32])],
+                dash_to_credits!(500),
+                &mut drive_operations,
+                &platform_version,
+            )
+            .expect("expected to enqueue the withdrawal");
+        drive
+            .apply_drive_operations(
+                drive_operations,
+                true,
+                &block(t2),
+                Some(&transaction),
+                &platform_version,
+                None,
+            )
+            .expect("expected to apply the pooling operations");
+        drive
+            .record_total_credits_history(&block(t2), 64, Some(&transaction), &platform_version)
+            .expect("expected to record");
+
+        // A millisecond before the withdrawal block becomes the snapshot the base is the
+        // 20,500 Dash recorded at the deposit: its inflow is inside that base and the
+        // reservation counts against it.
+        let info = limit(t2 + DAY_IN_MS - 1);
+        assert_eq!(info.daily_maximum, dash_to_credits!(3075));
+        assert_eq!(info.withdrawals_amount, dash_to_credits!(500));
+        assert_eq!(info.available(), dash_to_credits!(2575));
+
+        // The moment the post-withdrawal 20,000 Dash is the snapshot, the reservation's
+        // outflow is inside the base too and both sides of the cycle drop out together:
+        // the full 15% of 20,000 is available again, an hour before the reservation expires.
+        let info = limit(t2 + DAY_IN_MS);
+        assert_eq!(info.daily_maximum, dash_to_credits!(3000));
+        assert_eq!(info.withdrawals_amount, 0);
+        assert_eq!(info.available(), dash_to_credits!(3000));
+    }
 }
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/document/fetch_oldest_withdrawal_documents_by_status/v0/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/document/fetch_oldest_withdrawal_documents_by_status/v0/mod.rs
index e7aada7b4d8..ececc853c9c 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/document/fetch_oldest_withdrawal_documents_by_status/v0/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/document/fetch_oldest_withdrawal_documents_by_status/v0/mod.rs
@@ -65,6 +65,7 @@ impl Drive {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // todo: deal with cost of this operation
@@ -111,6 +112,7 @@ impl Drive {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // Fetch all documents
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v0/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v0/mod.rs
index 95633f0b2e9..57fcf6ab630 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v0/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v0/mod.rs
@@ -84,6 +84,7 @@ impl Drive {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // todo: deal with cost of this operation
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v1/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v1/mod.rs
index 64e84b84754..0f2e5b017e3 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v1/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/document/find_withdrawal_documents_by_status_and_transaction_indices/v1/mod.rs
@@ -87,6 +87,7 @@ impl Drive {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // todo: deal with cost of this operation
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/mod.rs
index 2630a7a8872..0f00b43abf6 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/mod.rs
@@ -2,10 +2,18 @@
 pub mod document;
 
 mod calculate_current_withdrawal_limit;
+
+/// How long an entry counts against (a withdrawal reservation) or toward (a credit inflow) the
+/// daily withdrawal limit: 25 hours, a day plus an hour of slack. The two must expire on the
+/// same schedule so a deposit and the withdrawal it funds cancel exactly over the whole window.
+// Best to use a constant here and not a versioned item as this most likely will not change
+pub const DAY_AND_A_HOUR_IN_MS: dpp::prelude::TimestampMillis = 90_000_000; //25 hours
 /// Functions related to the per-block record of total credits the daily withdrawal limit reads
 pub mod fetch_total_credits_in_platform_a_day_ago;
 /// Functions and constants related to GroveDB paths
 pub mod paths;
+/// Functions related to the per-block record of credit inflows the daily withdrawal limit adds
+pub mod record_credit_inflow;
 /// Functions related to the per-block record of total credits the daily withdrawal limit reads
 pub mod record_total_credits_history;
 /// Functions related to withdrawal transactions
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/paths.rs b/packages/rs-drive/src/drive/identity/withdrawals/paths.rs
index dda9bfe7819..d0b6d9d0843 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/paths.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/paths.rs
@@ -16,6 +16,12 @@ pub const WITHDRAWAL_TRANSACTIONS_BROADCASTED_KEY: [u8; 1] = [3];
 /// time in milliseconds, big-endian; value: total credits, big-endian), which the day-lagged
 /// daily withdrawal limit reads. Exists from protocol version 14.
 pub const WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY: [u8; 1] = [4];
+/// constant id for the sum tree of credit inflows (key: expiration of the entry as a block time
+/// in milliseconds, big-endian; value: credits minted, as a sum item). The daily withdrawal
+/// limit adds this sum to the daily maximum so it counts net outflow instead of gross: credits
+/// that entered Platform within the window may leave again without consuming the budget of
+/// other users. Exists from protocol version 14.
+pub const WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY: [u8; 1] = [5];
 
 impl Drive {
     /// Add operations for creating initial withdrawal state structure
@@ -50,6 +56,10 @@ impl Drive {
                 vec![vec![RootTree::WithdrawalTransactions as u8]],
                 WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY.to_vec(),
             );
+            batch.add_insert_empty_sum_tree(
+                vec![vec![RootTree::WithdrawalTransactions as u8]],
+                WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY.to_vec(),
+            );
         }
     }
 }
@@ -127,3 +137,19 @@ pub fn get_withdrawal_total_credits_history_path() -> [&'static [u8]; 2] {
         &WITHDRAWAL_TOTAL_CREDITS_HISTORY_KEY,
     ]
 }
+
+/// Helper function to get the credit inflows sum tree path as Vec
+pub fn get_withdrawal_credit_inflows_sum_tree_path_vec() -> Vec<Vec<u8>> {
+    vec![
+        vec![RootTree::WithdrawalTransactions as u8],
+        WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY.to_vec(),
+    ]
+}
+
+/// Helper function to get the credit inflows sum tree path as [u8]
+pub fn get_withdrawal_credit_inflows_sum_tree_path() -> [&'static [u8]; 2] {
+    [
+        Into::<&[u8; 1]>::into(RootTree::WithdrawalTransactions),
+        &WITHDRAWAL_CREDIT_INFLOWS_SUM_TREE_KEY,
+    ]
+}
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/mod.rs
new file mode 100644
index 00000000000..650fd97ec91
--- /dev/null
+++ b/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/mod.rs
@@ -0,0 +1,45 @@
+mod v0;
+
+use crate::drive::Drive;
+use crate::error::drive::DriveError;
+use crate::error::Error;
+use dpp::block::block_info::BlockInfo;
+use dpp::fee::Credits;
+use grovedb::TransactionArg;
+use platform_version::version::PlatformVersion;
+
+impl Drive {
+    /// Records `amount` in the credit inflows sum tree under the withdrawals tree, keyed by
+    /// the moment it expires, 25 hours after the block time. The daily withdrawal limit adds
+    /// unexpired inflows younger than its day-old base snapshot to the daily maximum, making
+    /// it a limit on net outflow. Called once per block with the block's total credit mints
+    /// (asset locks, epoch Core rewards); an `amount` of zero records nothing.
+    pub fn record_credit_inflow(
+        &self,
+        amount: Credits,
+        block_info: &BlockInfo,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        match platform_version
+            .drive
+            .methods
+            .identity
+            .withdrawals
+            .record_credit_inflows
+        {
+            Some(0) => {
+                self.record_credit_inflow_v0(amount, block_info, transaction, platform_version)
+            }
+            Some(version) => Err(Error::Drive(DriveError::UnknownVersionMismatch {
+                method: "record_credit_inflow".to_string(),
+                known_versions: vec![0],
+                received: version,
+            })),
+            None => Err(Error::Drive(DriveError::VersionNotActive {
+                method: "record_credit_inflow".to_string(),
+                known_versions: vec![0],
+            })),
+        }
+    }
+}
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/v0/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/v0/mod.rs
new file mode 100644
index 00000000000..d3d5a05dc58
--- /dev/null
+++ b/packages/rs-drive/src/drive/identity/withdrawals/record_credit_inflow/v0/mod.rs
@@ -0,0 +1,55 @@
+use crate::drive::identity::withdrawals::paths::get_withdrawal_credit_inflows_sum_tree_path_vec;
+use crate::drive::identity::withdrawals::DAY_AND_A_HOUR_IN_MS;
+use crate::drive::Drive;
+use crate::error::Error;
+use crate::util::grove_operations::BatchInsertApplyType;
+use crate::util::object_size_info::PathKeyElementInfo;
+use dpp::block::block_info::BlockInfo;
+use dpp::fee::{Credits, SignedCredits};
+use grovedb::{Element, TransactionArg};
+use platform_version::version::PlatformVersion;
+
+impl Drive {
+    pub(super) fn record_credit_inflow_v0(
+        &self,
+        amount: Credits,
+        block_info: &BlockInfo,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
+    ) -> Result<(), Error> {
+        if amount == 0 {
+            return Ok(());
+        }
+
+        let mut drive_operations = vec![];
+
+        // Keyed by when the inflow stops counting toward the limit, on the same 25 hour
+        // schedule the withdrawal reservations expire on, and pruned by the same per-block
+        // cleanup. Saturating: a block time near the end of u64 must not panic, and an entry
+        // that never expires only ever raises the limit toward the gross cap. Adding to an
+        // existing entry keeps one entry per block time even if a caller records twice.
+        let expiration_date = block_info.time_ms.saturating_add(DAY_AND_A_HOUR_IN_MS);
+
+        self.batch_insert_sum_item_or_add_to_if_already_exists(
+            PathKeyElementInfo::PathKeyElement::<0>((
+                get_withdrawal_credit_inflows_sum_tree_path_vec(),
+                expiration_date.to_be_bytes().to_vec(),
+                Element::SumItem(amount as SignedCredits, None),
+            )),
+            BatchInsertApplyType::StatefulBatchInsert,
+            transaction,
+            &mut drive_operations,
+            &platform_version.drive,
+        )?;
+
+        self.apply_batch_low_level_drive_operations(
+            None,
+            transaction,
+            drive_operations,
+            &mut vec![],
+            &platform_version.drive,
+        )?;
+
+        Ok(())
+    }
+}
diff --git a/packages/rs-drive/src/drive/identity/withdrawals/transaction/queue/add_enqueue_untied_withdrawal_transaction_operations/v0/mod.rs b/packages/rs-drive/src/drive/identity/withdrawals/transaction/queue/add_enqueue_untied_withdrawal_transaction_operations/v0/mod.rs
index 1df5e12da9d..4fdf1c83ca7 100644
--- a/packages/rs-drive/src/drive/identity/withdrawals/transaction/queue/add_enqueue_untied_withdrawal_transaction_operations/v0/mod.rs
+++ b/packages/rs-drive/src/drive/identity/withdrawals/transaction/queue/add_enqueue_untied_withdrawal_transaction_operations/v0/mod.rs
@@ -1,10 +1,9 @@
+use crate::drive::identity::withdrawals::DAY_AND_A_HOUR_IN_MS;
 use crate::drive::Drive;
 use crate::util::batch::drive_op_batch::WithdrawalOperationType;
 use crate::util::batch::DriveOperation;
 use dpp::fee::Credits;
-use dpp::prelude::TimestampMillis;
 use dpp::withdrawal::WithdrawalTransactionIndexAndBytes;
-const DAY_AND_A_HOUR_IN_MS: TimestampMillis = 90_000_000; //25 hours
 
 impl Drive {
     pub(super) fn add_enqueue_untied_withdrawal_transaction_operations_v0(
@@ -22,7 +21,6 @@ impl Drive {
             drive_operation_types.push(DriveOperation::WithdrawalOperation(
                 WithdrawalOperationType::ReserveWithdrawalAmount {
                     amount: total_sum,
-                    // Best to use a constant here and not a versioned item as this most likely will not change
                     expiration_after: DAY_AND_A_HOUR_IN_MS,
                 },
             ));
diff --git a/packages/rs-drive/src/lib.rs b/packages/rs-drive/src/lib.rs
index f5c5426bec3..a53a3216012 100644
--- a/packages/rs-drive/src/lib.rs
+++ b/packages/rs-drive/src/lib.rs
@@ -30,6 +30,10 @@ pub use dpp;
 #[cfg(any(feature = "server", feature = "verify"))]
 pub use grovedb;
 
+/// Re-exported so downstream crates can build `AxisQuery`-shaped
+/// [`grovedb::PathQuery`]s without a direct dependency.
+pub use grovedb_query;
+
 #[cfg(feature = "server")]
 pub use grovedb_path;
 
diff --git a/packages/rs-drive/src/query/canonicalize.rs b/packages/rs-drive/src/query/canonicalize.rs
new file mode 100644
index 00000000000..f8b57f510c7
--- /dev/null
+++ b/packages/rs-drive/src/query/canonicalize.rs
@@ -0,0 +1,190 @@
+//! Shared where-clause validation + canonicalization for the aggregate
+//! query surfaces (count / sum / average / joint count-and-sum) and
+//! their SDK proof verifiers.
+//!
+//! Lives outside the per-surface dispatcher modules because the shape
+//! contract must be identical on every route: the server dispatchers
+//! canonicalize before mode detection, and the proof verifiers must run
+//! the very same canonicalization before *their* mode detection or a
+//! proof the server produced for the canonical shape is rejected
+//! client-side (the count dispatcher promises callers "the bounded form
+//! and the pre-merged form get equivalent mode detection" — that promise
+//! only holds if verifiers canonicalize too).
+
+use crate::error::query::QuerySyntaxError;
+use crate::error::Error;
+use crate::query::drive_document_count_query::DriveDocumentCountQuery;
+use crate::query::WhereClause;
+use dpp::version::PlatformVersion;
+
+/// Run the system-wide where-clause validator on a structured
+/// `Vec<WhereClause>` and canonicalize same-field range pairs into
+/// their `between*` form. Single source of truth for the aggregate
+/// shape contract; called by the count / sum / average / joint
+/// dispatchers, the legacy CBOR-decoded count entry, and the SDK
+/// count / sum / average proof verifiers.
+///
+/// The validator (`WhereClause::group_clauses`) rejects:
+/// - Duplicate `Equal` clauses on the same field
+///   (`DuplicateNonGroupableClauseSameField`).
+/// - Multiple `In` clauses (`MultipleInClauses`) — rejected here: the
+///   shared grammar accepts them for protocol version 14+ document
+///   queries, but the aggregate surfaces do not.
+/// - Multiple non-groupable range clauses (`MultipleRangeClauses`).
+/// - Equality + `In` on the same field, range + equality/In on the
+///   same field (`DuplicateNonGroupableClauseSameField` /
+///   `InvalidWhereClauseComponents`).
+///
+/// Without this validation, downstream
+/// [`DriveDocumentCountQuery::find_countable_index_for_where_clauses`]
+/// collapses repeated fields into a `BTreeSet` and
+/// [`DriveDocumentCountQuery::point_lookup_count_path_query`]
+/// resolves each index property with a single `.find(...)` — both
+/// of which silently pick the first clause on a duplicated field
+/// and return a count for an arbitrarily reduced query rather than
+/// rejecting the malformed request.
+///
+/// **Exception**: `MultipleRangeClauses` is intentionally tolerated
+/// here. The regular-query parser rejects two ranges on different
+/// fields wholesale (its callers expect
+/// `(equal_clauses, in_clause, range_clause)` triples), but the
+/// count-query path accepts the carrier-aggregate shape
+/// (`outer_range + inner_ACOR_range` on different fields, e.g.
+/// G8). Structural validation for that shape lives in
+/// [`DriveDocumentCountQuery::detect_mode`] (which knows about
+/// `CountMode::GroupByRange`-with-two-ranges and routes to
+/// `DocumentCountMode::RangeAggregateCarrierProof`); replicating
+/// it here would be redundant.
+///
+/// After validation, [`merge_same_field_range_pairs`] collapses
+/// `[field > A, field < B]` (and analogous pairs with `>=` / `<=`)
+/// into the canonical `between*` operator that
+/// [`DriveDocumentCountQuery::range_clause_to_query_item`] knows
+/// how to convert into a single `QueryItem`. The regular-query
+/// parser does the same merge before its grouped-triple
+/// validation; for aggregate queries we do it explicitly here so
+/// callers can pass either the bounded form (e.g.
+/// `[brand > A, brand < B]`) or the pre-merged form (e.g.
+/// `[brand BetweenExcludeBounds [A, B]]`) and get equivalent
+/// mode detection downstream. Without this merge, G8a's natural
+/// wire shape (four range clauses, two per field) would slip past
+/// the catch-`MultipleRangeClauses` block above and then get
+/// rejected by `detect_mode`'s `range_count > 1` structural check.
+pub fn validate_and_canonicalize_where_clauses(
+    clauses: Vec<WhereClause>,
+    platform_version: &PlatformVersion,
+) -> Result<Vec<WhereClause>, Error> {
+    match WhereClause::group_clauses(&clauses, platform_version) {
+        // Multiple `In` clauses are a document-query-only shape (protocol
+        // version 14+); the aggregate surfaces keep rejecting them since
+        // their mode detection and index pickers assume a single `In`.
+        Ok((_, _, in_clauses)) if in_clauses.len() > 1 => {
+            return Err(Error::Query(QuerySyntaxError::MultipleInClauses(
+                "aggregate queries support at most one in clause",
+            )));
+        }
+        Ok(_) => {}
+        Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(_))) => {}
+        Err(e) => return Err(e),
+    }
+    merge_same_field_range_pairs(clauses)
+}
+
+/// Collapse `[field > A, field < B]` (and analogous pairs with
+/// `>=` / `<=`) into a single `field between* [A, B]` clause per
+/// field. Equality / In clauses pass through unchanged.
+///
+/// Returns an error if a field has more than two range clauses
+/// (structurally meaningless — a third bound would either
+/// contradict an existing one or be redundant) or if the pair
+/// isn't one lower-bound + one upper-bound (e.g. two `>` on the
+/// same field).
+fn merge_same_field_range_pairs(clauses: Vec<WhereClause>) -> Result<Vec<WhereClause>, Error> {
+    use crate::query::conditions::WhereOperator::{
+        Between, BetweenExcludeBounds, BetweenExcludeLeft, BetweenExcludeRight, GreaterThan,
+        GreaterThanOrEquals, LessThan, LessThanOrEquals,
+    };
+    use std::collections::BTreeMap;
+
+    let mut by_field: BTreeMap<String, Vec<WhereClause>> = BTreeMap::new();
+    let mut non_range: Vec<WhereClause> = Vec::new();
+    for wc in clauses {
+        if DriveDocumentCountQuery::is_range_operator(wc.operator) {
+            by_field.entry(wc.field.clone()).or_default().push(wc);
+        } else {
+            non_range.push(wc);
+        }
+    }
+    let mut result = non_range;
+    for (field, mut ranges) in by_field {
+        match ranges.len() {
+            0 => {}
+            1 => result.push(ranges.remove(0)),
+            2 => {
+                let (mut lower, mut upper): (Option<WhereClause>, Option<WhereClause>) =
+                    (None, None);
+                for r in ranges {
+                    match r.operator {
+                        GreaterThan | GreaterThanOrEquals => {
+                            if lower.is_some() {
+                                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                                    "two lower-bound range clauses on the same field cannot be \
+                                     merged; combine via `between*` or remove the redundant clause",
+                                )));
+                            }
+                            lower = Some(r);
+                        }
+                        LessThan | LessThanOrEquals => {
+                            if upper.is_some() {
+                                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                                    "two upper-bound range clauses on the same field cannot be \
+                                     merged; combine via `between*` or remove the redundant clause",
+                                )));
+                            }
+                            upper = Some(r);
+                        }
+                        _ => {
+                            // The other range operators (Between*,
+                            // StartsWith) are themselves bounded
+                            // already; a second range clause on the
+                            // same field is structurally redundant.
+                            return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                                "cannot pair a `between*`/`startsWith` range clause with \
+                                 another range on the same field; use the pre-merged form",
+                            )));
+                        }
+                    }
+                }
+                let lower = lower.ok_or(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                    "two range clauses on the same field require one lower bound (> or >=) \
+                     and one upper bound (< or <=)",
+                )))?;
+                let upper = upper.ok_or(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                    "two range clauses on the same field require one lower bound (> or >=) \
+                     and one upper bound (< or <=)",
+                )))?;
+                let merged_op = match (
+                    lower.operator == GreaterThanOrEquals,
+                    upper.operator == LessThanOrEquals,
+                ) {
+                    (true, true) => Between,                // [a, b]
+                    (false, false) => BetweenExcludeBounds, // (a, b)
+                    (true, false) => BetweenExcludeRight,   // [a, b)
+                    (false, true) => BetweenExcludeLeft,    // (a, b]
+                };
+                result.push(WhereClause {
+                    field,
+                    operator: merged_op,
+                    value: dpp::platform_value::Value::Array(vec![lower.value, upper.value]),
+                });
+            }
+            _ => {
+                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
+                    "more than two range clauses on the same field are not supported; a \
+                     bounded range needs exactly one lower bound and one upper bound",
+                )));
+            }
+        }
+    }
+    Ok(result)
+}
diff --git a/packages/rs-drive/src/query/conditions.rs b/packages/rs-drive/src/query/conditions.rs
index 7fb394f3ef0..7d4dfd71591 100644
--- a/packages/rs-drive/src/query/conditions.rs
+++ b/packages/rs-drive/src/query/conditions.rs
@@ -1538,6 +1538,7 @@ mod tests {
 
     fn cursor_document(field: &str, value: Value) -> dpp::document::Document {
         DocumentV0 {
+            contract_version: None,
             id: Identifier::from([3u8; 32]),
             owner_id: Identifier::from([4u8; 32]),
             properties: BTreeMap::from([(field.to_string(), value)]),
diff --git a/packages/rs-drive/src/query/drive_document_average_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_average_query/drive_dispatcher.rs
index 526a5c86b57..da9f8de2de6 100644
--- a/packages/rs-drive/src/query/drive_document_average_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_average_query/drive_dispatcher.rs
@@ -55,6 +55,9 @@ use crate::query::drive_document_sum_query::index_picker::{
     find_range_summable_index_for_where_clauses, find_summable_index_for_where_clauses,
 };
 use crate::query::drive_document_sum_query::{is_range_operator, DriveDocumentSumQuery};
+use crate::query::{
+    validate_and_canonicalize_where_clauses, validate_resolved_time_range_clause_shapes,
+};
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::accessors::{DocumentTypeV0Getters, DocumentTypeV2Getters};
 use dpp::version::PlatformVersion;
@@ -72,11 +75,30 @@ impl Drive {
     ///   dispatcher that reads `(count, sum)` together.
     pub fn execute_document_average_request(
         &self,
-        request: DocumentAverageRequest,
+        mut request: DocumentAverageRequest,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<DocumentAverageResponse, Error> {
+        // Provenance-vs-shape contract, BEFORE the prove/no-prove split: the
+        // no-prove path re-checks inside the joint dispatcher, but the prove
+        // path would otherwise reach its executors unguarded — a direct
+        // caller marking an `In`/range clause as time-range-resolved could
+        // have the pickers admit the bucketed index and prove an aggregate
+        // that counts a document once per overlapping bucket. The guard only
+        // inspects Equal clauses, so running it before range-pair
+        // canonicalization is equivalent to running it after.
+        validate_resolved_time_range_clause_shapes(
+            &request.where_clauses,
+            &request.resolved_time_ranges,
+        )?;
         if request.prove {
+            // The no-prove path canonicalizes inside the joint dispatcher;
+            // run the identical shared step (see
+            // [`crate::query::canonicalize`]) on the prove path so both
+            // accept the bounded pair form (`[f > A, f < B]`) as well as
+            // the pre-merged `between*` form.
+            request.where_clauses =
+                validate_and_canonicalize_where_clauses(request.where_clauses, platform_version)?;
             return self.execute_document_average_prove(request, transaction, platform_version);
         }
         self.execute_document_count_and_sum_request(request, transaction, platform_version)
@@ -176,6 +198,7 @@ impl Drive {
                 request.document_type.indexes(),
                 &request.where_clauses,
                 &request.sum_property,
+                &request.resolved_time_ranges,
             )
             .filter(|idx| idx.range_countable)
             .ok_or_else(|| {
@@ -262,6 +285,7 @@ impl Drive {
                 request.document_type.indexes(),
                 &request.where_clauses,
                 &request.sum_property,
+                &request.resolved_time_ranges,
             )
             .filter(|idx| idx.range_countable)
             .ok_or_else(|| {
@@ -350,6 +374,7 @@ impl Drive {
                 request.document_type.indexes(),
                 &request.where_clauses,
                 &request.sum_property,
+                &request.resolved_time_ranges,
             )
             .filter(|idx| idx.countable.is_countable())
             .ok_or_else(|| {
@@ -394,6 +419,7 @@ impl Drive {
 #[cfg(all(test, feature = "server"))]
 mod tests {
     use super::*;
+    use crate::query::ResolvedTimeRange;
 
     // ── Dispatcher limit-policy regression tests ───────────────────
     //
@@ -495,6 +521,7 @@ mod tests {
         properties.insert("color".to_string(), Value::Text(color.to_string()));
         properties.insert("amount".to_string(), Value::U64(amount));
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from([(i + 1) as u8; 32]),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -598,6 +625,7 @@ mod tests {
             limit: None,
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -615,6 +643,7 @@ mod tests {
             document_type.indexes(),
             std::slice::from_ref(&color_gt_blue),
             "amount",
+            &[],
         )
         .filter(|idx| idx.range_countable)
         .expect("byColor rangeAverageable index covers `color > blue`");
@@ -692,6 +721,7 @@ mod tests {
             limit: Some(over_max),
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let err = drive
@@ -806,6 +836,7 @@ mod tests {
             limit: None,
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -883,6 +914,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_request = DocumentSumRequest {
             contract,
@@ -894,6 +926,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config,
+            resolved_time_ranges: vec![],
         };
         let count_resp = drive
             .execute_document_count_request(count_request, None, platform_version)
@@ -1008,6 +1041,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let joint_response = drive
@@ -1119,6 +1153,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let joint_response = drive
@@ -1139,6 +1174,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_request = DocumentSumRequest {
             contract: &data_contract,
@@ -1150,6 +1186,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let count_resp = drive
             .execute_document_count_request(count_request, None, platform_version)
@@ -1253,6 +1290,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let joint_response = drive
@@ -1273,6 +1311,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_request = DocumentSumRequest {
             contract: &data_contract,
@@ -1284,6 +1323,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let count_resp = drive
             .execute_document_count_request(count_request, None, platform_version)
@@ -1376,6 +1416,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let joint_response = drive
@@ -1508,6 +1549,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let joint_response = drive
@@ -1528,6 +1570,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let sum_request = DocumentSumRequest {
             contract: &data_contract,
@@ -1539,6 +1582,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
         let count_resp = drive
             .execute_document_count_request(count_request, None, platform_version)
@@ -1641,6 +1685,7 @@ mod tests {
             limit: Some(2),
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -1719,6 +1764,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -1797,6 +1843,7 @@ mod tests {
             limit: Some(4),
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -1852,6 +1899,7 @@ mod tests {
             limit: None,
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let err = drive
@@ -1914,6 +1962,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let err = drive
@@ -1932,6 +1981,67 @@ mod tests {
         );
     }
 
+    /// The prove path returns before the joint dispatcher, so the
+    /// provenance-vs-shape guard must run at the shared entry: without it a
+    /// direct caller marking an `In` clause as time-range-resolved would
+    /// reach the prove executors, have the pickers admit a bucketed index,
+    /// and prove an aggregate that counts a document once per overlapping
+    /// bucket.
+    #[test]
+    fn avg_prove_path_rejects_resolved_time_range_provenance_on_an_in_clause() {
+        let drive = setup_drive_with_initial_state_structure(None);
+        let platform_version = PlatformVersion::latest();
+        let data_contract = build_widget_contract_pcps();
+        drive
+            .apply_contract(
+                &data_contract,
+                BlockInfo::default(),
+                true,
+                StorageFlags::optional_default_as_cow(),
+                None,
+                platform_version,
+            )
+            .expect("apply contract");
+
+        let document_type = data_contract
+            .document_type_for_name("widget")
+            .expect("widget");
+        let drive_config = DriveConfig::default();
+
+        let in_on_resolved_field = WhereClause {
+            field: "$createdAt".to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![Value::U64(0), Value::U64(7_200_000)]),
+        };
+        let request = DocumentAverageRequest {
+            contract: &data_contract,
+            document_type,
+            sum_property: "amount".to_string(),
+            where_clauses: vec![in_on_resolved_field],
+            order_clauses: Vec::new(),
+            mode: AverageMode::Aggregate,
+            limit: None,
+            prove: true,
+            drive_config: &drive_config,
+            resolved_time_ranges: vec![ResolvedTimeRange {
+                transform: dpp::data_contract::document_type::TimeRangeTransform {
+                    source: "$createdAt".to_string(),
+                    range_seconds: 21_600,
+                    step_seconds: 7_200,
+                    phase_seconds: 0,
+                },
+            }],
+        };
+
+        let err = drive
+            .execute_document_average_request(request, None, platform_version)
+            .expect_err("AVG prove must reject provenance attached to an In clause");
+        assert!(
+            format!("{err:?}").contains("InvalidWhereClauseComponents"),
+            "expected the provenance shape guard, got: {err:?}"
+        );
+    }
+
     /// `PerInValue` no-proof AVG must honor `request.limit` on the
     /// returned entry list. Regression for the reviewer's "joint
     /// dispatcher drops `request.limit`" finding on the PerInValue
@@ -2016,6 +2126,7 @@ mod tests {
             limit: Some(2),
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -2096,6 +2207,7 @@ mod tests {
             let mut properties = std::collections::BTreeMap::new();
             properties.insert("amount".to_string(), Value::U64(*amount));
             let document: Document = DocumentV0 {
+                contract_version: None,
                 id: Identifier::from([(i + 1) as u8; 32]),
                 owner_id: Identifier::from([0u8; 32]),
                 properties,
@@ -2144,6 +2256,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -2250,6 +2363,7 @@ mod tests {
             limit: None,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
diff --git a/packages/rs-drive/src/query/drive_document_average_query/mod.rs b/packages/rs-drive/src/query/drive_document_average_query/mod.rs
index e7576ff2499..35d7975b311 100644
--- a/packages/rs-drive/src/query/drive_document_average_query/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_average_query/mod.rs
@@ -30,7 +30,7 @@
 pub mod drive_dispatcher;
 
 #[cfg(feature = "server")]
-use crate::query::{OrderClause, WhereClause};
+use crate::query::{OrderClause, ResolvedTimeRange, WhereClause};
 
 #[cfg(feature = "server")]
 use crate::config::DriveConfig;
@@ -114,6 +114,13 @@ pub struct DocumentAverageRequest<'a> {
     pub sum_property: String,
     /// Structured where-clauses.
     pub where_clauses: Vec<WhereClause>,
+    /// The fields among `where_clauses` whose equality clause was produced by
+    /// `IN_TIME_RANGE` resolution rather than written by the caller. Same
+    /// contract and same purpose as
+    /// [`crate::query::DriveDocumentQuery::resolved_time_ranges`]:
+    /// it is what gates which indexes the sum pickers (which average rides)
+    /// may select.
+    pub resolved_time_ranges: Vec<ResolvedTimeRange>,
     /// Structured order-clauses.
     pub order_clauses: Vec<OrderClause>,
     /// The average mode requested.
diff --git a/packages/rs-drive/src/query/drive_document_count_and_sum_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_count_and_sum_query/drive_dispatcher.rs
index 1442184ddc7..2dd988f08e9 100644
--- a/packages/rs-drive/src/query/drive_document_count_and_sum_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_count_and_sum_query/drive_dispatcher.rs
@@ -37,11 +37,13 @@
 use super::super::drive_document_average_query::{
     AverageMode, DocumentAverageRequest, DocumentAverageResponse,
 };
-use super::super::drive_document_count_query::drive_dispatcher::validate_and_canonicalize_where_clauses;
 use super::super::drive_document_sum_query::mode_detection::detect_sum_mode_from_inputs;
 use super::super::drive_document_sum_query::{DocumentSumMode, SumMode};
 use crate::drive::Drive;
 use crate::error::Error;
+use crate::query::{
+    validate_and_canonicalize_where_clauses, validate_resolved_time_range_clause_shapes,
+};
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::version::PlatformVersion;
@@ -111,6 +113,8 @@ impl Drive {
         // the catalog of rejections.
         let where_clauses =
             validate_and_canonicalize_where_clauses(request.where_clauses, platform_version)?;
+        let resolved_time_ranges = request.resolved_time_ranges;
+        validate_resolved_time_range_clause_shapes(&where_clauses, &resolved_time_ranges)?;
 
         // Convert AverageMode → SumMode (1:1 by construction); sum's
         // routing table is the single source of truth for the
@@ -145,6 +149,7 @@ impl Drive {
                 request.document_type,
                 document_type_name,
                 where_clauses,
+                &resolved_time_ranges,
                 sum_property,
                 transaction,
                 platform_version,
@@ -170,6 +175,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     order_by_ascending,
                     per_in_limit as u16,
@@ -214,6 +220,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     return_distinct,
                     order_by_ascending,
diff --git a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/per_in_value.rs b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/per_in_value.rs
index 5a88ea33ecf..c4a3eeaef81 100644
--- a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/per_in_value.rs
+++ b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/per_in_value.rs
@@ -22,6 +22,7 @@ use super::super::super::drive_document_sum_query::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::{WhereClause, WhereOperator};
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -48,6 +49,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         left_to_right: bool,
         limit: u16,
@@ -122,6 +124,7 @@ impl Drive {
                 document_type.indexes(),
                 &clauses_for_value,
                 &sum_property,
+                resolved_time_ranges,
             )
             .filter(|idx| idx.countable.is_countable())
             .ok_or_else(|| {
diff --git a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/range_no_proof.rs b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/range_no_proof.rs
index 70fbbf09ab5..7fc349b0d0f 100644
--- a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/range_no_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/range_no_proof.rs
@@ -41,6 +41,7 @@ use super::super::super::drive_document_sum_query::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::{WhereClause, WhereOperator};
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::methods::DocumentTypeV0Methods;
@@ -71,6 +72,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         return_distinct: bool,
         left_to_right: bool,
@@ -82,6 +84,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .filter(|idx| idx.range_countable)
         .ok_or_else(|| {
diff --git a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/total.rs b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/total.rs
index 1ea08baea67..facc40b8d8d 100644
--- a/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/total.rs
+++ b/packages/rs-drive/src/query/drive_document_count_and_sum_query/executors/total.rs
@@ -32,6 +32,7 @@ use super::super::super::drive_document_sum_query::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -54,6 +55,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -89,6 +91,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .filter(|idx| idx.countable.is_countable())
         .ok_or_else(|| {
diff --git a/packages/rs-drive/src/query/drive_document_count_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_count_query/drive_dispatcher.rs
index 6237e3f009a..7f865587fc9 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/drive_dispatcher.rs
@@ -22,6 +22,12 @@ use super::{DocumentCountMode, DriveDocumentCountQuery, SplitCountEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
+// Shared with the sum / average / joint dispatchers and the SDK proof
+// verifiers — see `crate::query::canonicalize` for the shape contract.
+use crate::query::{
+    validate_and_canonicalize_where_clauses, validate_resolved_time_range_clause_shapes,
+};
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -62,6 +68,12 @@ pub struct DocumentCountRequest<'a> {
     /// the catalog of rejections this enables and the In/range +
     /// `between*` canonicalization rules) before mode detection.
     pub where_clauses: Vec<WhereClause>,
+    /// The fields among `where_clauses` whose equality clause was produced by
+    /// `IN_TIME_RANGE` resolution rather than written by the caller. Same
+    /// contract and same purpose as
+    /// [`crate::query::DriveDocumentQuery::resolved_time_ranges`]:
+    /// it is what gates which indexes the count pickers may select.
+    pub resolved_time_ranges: Vec<ResolvedTimeRange>,
     /// Structured `order_by` clauses. The first clause's direction
     /// governs split-mode entry ordering (per-`In`-value /
     /// per-distinct-value-in-range) and, on the
@@ -196,178 +208,6 @@ pub fn where_clauses_from_value(
     validate_and_canonicalize_where_clauses(clauses, platform_version)
 }
 
-/// Run the system-wide where-clause validator on a structured
-/// `Vec<WhereClause>` and canonicalize same-field range pairs into
-/// their `between*` form. Single source of truth for the
-/// count-endpoint shape contract; called both from the legacy
-/// CBOR-decoded entry [`where_clauses_from_value`] and from the
-/// dispatcher's typed entry, [`Drive::execute_document_count_request`].
-///
-/// The validator (`WhereClause::group_clauses`) rejects:
-/// - Duplicate `Equal` clauses on the same field
-///   (`DuplicateNonGroupableClauseSameField`).
-/// - Multiple `In` clauses (`MultipleInClauses`) — rejected here: the
-///   shared grammar accepts them for protocol version 14+ document
-///   queries, but the aggregate surfaces do not.
-/// - Multiple non-groupable range clauses (`MultipleRangeClauses`).
-/// - Equality + `In` on the same field, range + equality/In on the
-///   same field (`DuplicateNonGroupableClauseSameField` /
-///   `InvalidWhereClauseComponents`).
-///
-/// Without this validation, downstream
-/// [`DriveDocumentCountQuery::find_countable_index_for_where_clauses`]
-/// collapses repeated fields into a `BTreeSet` and
-/// [`DriveDocumentCountQuery::point_lookup_count_path_query`]
-/// resolves each index property with a single `.find(...)` — both
-/// of which silently pick the first clause on a duplicated field
-/// and return a count for an arbitrarily reduced query rather than
-/// rejecting the malformed request.
-///
-/// **Exception**: `MultipleRangeClauses` is intentionally tolerated
-/// here. The regular-query parser rejects two ranges on different
-/// fields wholesale (its callers expect
-/// `(equal_clauses, in_clause, range_clause)` triples), but the
-/// count-query path accepts the carrier-aggregate shape
-/// (`outer_range + inner_ACOR_range` on different fields, e.g.
-/// G8). Structural validation for that shape lives in
-/// [`DriveDocumentCountQuery::detect_mode`] (which knows about
-/// `CountMode::GroupByRange`-with-two-ranges and routes to
-/// `DocumentCountMode::RangeAggregateCarrierProof`); replicating
-/// it here would be redundant.
-///
-/// After validation, [`merge_same_field_range_pairs`] collapses
-/// `[field > A, field < B]` (and analogous pairs with `>=` / `<=`)
-/// into the canonical `between*` operator that
-/// [`DriveDocumentCountQuery::range_clause_to_query_item`] knows
-/// how to convert into a single `QueryItem`. The regular-query
-/// parser does the same merge before its grouped-triple
-/// validation; for count queries we do it explicitly here so
-/// callers can pass either the bounded form (e.g.
-/// `[brand > A, brand < B]`) or the pre-merged form (e.g.
-/// `[brand BetweenExcludeBounds [A, B]]`) and get equivalent
-/// mode detection downstream. Without this merge, G8a's natural
-/// wire shape (four range clauses, two per field) would slip past
-/// the catch-`MultipleRangeClauses` block above and then get
-/// rejected by `detect_mode`'s `range_count > 1` structural check.
-pub fn validate_and_canonicalize_where_clauses(
-    clauses: Vec<WhereClause>,
-    platform_version: &PlatformVersion,
-) -> Result<Vec<WhereClause>, Error> {
-    match WhereClause::group_clauses(&clauses, platform_version) {
-        // Multiple `In` clauses are a document-query-only shape (protocol
-        // version 14+); the aggregate surfaces keep rejecting them since
-        // their mode detection and index pickers assume a single `In`.
-        Ok((_, _, in_clauses)) if in_clauses.len() > 1 => {
-            return Err(Error::Query(QuerySyntaxError::MultipleInClauses(
-                "aggregate queries support at most one in clause",
-            )));
-        }
-        Ok(_) => {}
-        Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(_))) => {}
-        Err(e) => return Err(e),
-    }
-    merge_same_field_range_pairs(clauses)
-}
-
-/// Collapse `[field > A, field < B]` (and analogous pairs with
-/// `>=` / `<=`) into a single `field between* [A, B]` clause per
-/// field. Equality / In clauses pass through unchanged.
-///
-/// Returns an error if a field has more than two range clauses
-/// (structurally meaningless — a third bound would either
-/// contradict an existing one or be redundant) or if the pair
-/// isn't one lower-bound + one upper-bound (e.g. two `>` on the
-/// same field).
-fn merge_same_field_range_pairs(clauses: Vec<WhereClause>) -> Result<Vec<WhereClause>, Error> {
-    use crate::query::conditions::WhereOperator::{
-        Between, BetweenExcludeBounds, BetweenExcludeLeft, BetweenExcludeRight, GreaterThan,
-        GreaterThanOrEquals, LessThan, LessThanOrEquals,
-    };
-    use std::collections::BTreeMap;
-
-    let mut by_field: BTreeMap<String, Vec<WhereClause>> = BTreeMap::new();
-    let mut non_range: Vec<WhereClause> = Vec::new();
-    for wc in clauses {
-        if DriveDocumentCountQuery::is_range_operator(wc.operator) {
-            by_field.entry(wc.field.clone()).or_default().push(wc);
-        } else {
-            non_range.push(wc);
-        }
-    }
-    let mut result = non_range;
-    for (field, mut ranges) in by_field {
-        match ranges.len() {
-            0 => {}
-            1 => result.push(ranges.remove(0)),
-            2 => {
-                let (mut lower, mut upper): (Option<WhereClause>, Option<WhereClause>) =
-                    (None, None);
-                for r in ranges {
-                    match r.operator {
-                        GreaterThan | GreaterThanOrEquals => {
-                            if lower.is_some() {
-                                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                                    "two lower-bound range clauses on the same field cannot be \
-                                     merged; combine via `between*` or remove the redundant clause",
-                                )));
-                            }
-                            lower = Some(r);
-                        }
-                        LessThan | LessThanOrEquals => {
-                            if upper.is_some() {
-                                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                                    "two upper-bound range clauses on the same field cannot be \
-                                     merged; combine via `between*` or remove the redundant clause",
-                                )));
-                            }
-                            upper = Some(r);
-                        }
-                        _ => {
-                            // The other range operators (Between*,
-                            // StartsWith) are themselves bounded
-                            // already; a second range clause on the
-                            // same field is structurally redundant.
-                            return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                                "cannot pair a `between*`/`startsWith` range clause with \
-                                 another range on the same field; use the pre-merged form",
-                            )));
-                        }
-                    }
-                }
-                let lower = lower.ok_or(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                    "two range clauses on the same field require one lower bound (> or >=) \
-                     and one upper bound (< or <=)",
-                )))?;
-                let upper = upper.ok_or(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                    "two range clauses on the same field require one lower bound (> or >=) \
-                     and one upper bound (< or <=)",
-                )))?;
-                let merged_op = match (
-                    lower.operator == GreaterThanOrEquals,
-                    upper.operator == LessThanOrEquals,
-                ) {
-                    (true, true) => Between,                // [a, b]
-                    (false, false) => BetweenExcludeBounds, // (a, b)
-                    (true, false) => BetweenExcludeRight,   // [a, b)
-                    (false, true) => BetweenExcludeLeft,    // (a, b]
-                };
-                result.push(WhereClause {
-                    field,
-                    operator: merged_op,
-                    value: dpp::platform_value::Value::Array(vec![lower.value, upper.value]),
-                });
-            }
-            _ => {
-                return Err(Error::Query(QuerySyntaxError::MultipleRangeClauses(
-                    "more than two range clauses on the same field are not supported; a \
-                     bounded range needs exactly one lower bound and one upper bound",
-                )));
-            }
-        }
-    }
-    Ok(result)
-}
-
 /// Parse the decoded `order_by` value into structured [`OrderClause`]s.
 ///
 /// Same shape as [`where_clauses_from_value`] for `order_by`:
@@ -445,6 +285,8 @@ impl Drive {
         // for the catalog of rejections / canonicalization rules.
         let where_clauses =
             validate_and_canonicalize_where_clauses(request.where_clauses, platform_version)?;
+        let resolved_time_ranges = request.resolved_time_ranges;
+        validate_resolved_time_range_clause_shapes(&where_clauses, &resolved_time_ranges)?;
         let order_clauses = request.order_clauses;
 
         // Split-mode entry direction is whatever the first orderBy
@@ -476,6 +318,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     transaction,
                     platform_version,
                 )?;
@@ -497,6 +340,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         options,
                         transaction,
                         platform_version,
@@ -537,6 +381,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     options,
                     transaction,
                     platform_version,
@@ -558,6 +403,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     transaction,
                     platform_version,
                 )?,
@@ -617,6 +463,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         limit_u16,
                         left_to_right,
                         transaction,
@@ -630,6 +477,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     transaction,
                     platform_version,
                 )?,
@@ -717,6 +565,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         effective_limit,
                         left_to_right,
                         transaction,
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/per_in_value.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/per_in_value.rs
index 5c9778d1efe..3ab683cdf8d 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/per_in_value.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/per_in_value.rs
@@ -9,6 +9,7 @@ use super::super::{DriveDocumentCountQuery, SplitCountEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
 use grovedb::TransactionArg;
@@ -37,6 +38,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         options: RangeCountOptions,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -97,6 +99,7 @@ impl Drive {
             let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
                 document_type.indexes(),
                 &clauses_for_value,
+                resolved_time_ranges,
             )
             .ok_or_else(|| {
                 Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/point_lookup_proof.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/point_lookup_proof.rs
index a483f1343d1..56b31399008 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/point_lookup_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/point_lookup_proof.rs
@@ -9,6 +9,7 @@ use super::super::DriveDocumentCountQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -32,12 +33,14 @@ impl Drive {
     /// fast path doesn't apply), rejects with
     /// `WhereClauseOnNonIndexedProperty`. Same contract on both
     /// prove and no-proof paths — no silent fallback.
+    #[allow(clippy::too_many_arguments)]
     pub fn execute_document_count_point_lookup_proof(
         &self,
         contract_id: [u8; 32],
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<Vec<u8>, Error> {
@@ -69,6 +72,7 @@ impl Drive {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/range_aggregate_carrier_proof.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/range_aggregate_carrier_proof.rs
index 3a782e1ae68..4f236843b68 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/range_aggregate_carrier_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/range_aggregate_carrier_proof.rs
@@ -27,6 +27,7 @@ use super::super::DriveDocumentCountQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -55,6 +56,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         limit: Option<u16>,
         left_to_right: bool,
         transaction: TransactionArg,
@@ -63,6 +65,7 @@ impl Drive {
         let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/range_distinct_proof.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/range_distinct_proof.rs
index 3a340a22454..de6841417fb 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/range_distinct_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/range_distinct_proof.rs
@@ -10,6 +10,7 @@ use super::super::DriveDocumentCountQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -36,6 +37,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         limit: u16,
         left_to_right: bool,
         transaction: TransactionArg,
@@ -44,6 +46,7 @@ impl Drive {
         let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/range_no_proof.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/range_no_proof.rs
index 4b2e677daf7..998cdf8da00 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/range_no_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/range_no_proof.rs
@@ -10,6 +10,7 @@ use super::super::{DriveDocumentCountQuery, SplitCountEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -26,6 +27,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         options: RangeCountOptions,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -33,6 +35,7 @@ impl Drive {
         let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/range_proof.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/range_proof.rs
index 3436eeae738..9a8835fa9e6 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/range_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/range_proof.rs
@@ -9,6 +9,7 @@ use super::super::DriveDocumentCountQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -18,18 +19,21 @@ impl Drive {
     /// Range-count proof via grovedb's `AggregateCountOnRange`.
     /// Returns proof bytes that the client verifies via
     /// `GroveDb::verify_aggregate_count_query`.
+    #[allow(clippy::too_many_arguments)]
     pub fn execute_document_count_range_proof(
         &self,
         contract_id: [u8; 32],
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<Vec<u8>, Error> {
         let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/executors/total.rs b/packages/rs-drive/src/query/drive_document_count_query/executors/total.rs
index 6a00660b4c5..74770889d79 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/executors/total.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/executors/total.rs
@@ -6,6 +6,7 @@ use super::super::{DriveDocumentCountQuery, SplitCountEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
 use grovedb::TransactionArg;
@@ -18,12 +19,14 @@ impl Drive {
     /// tree's root).
     ///
     /// Single summed entry with empty key.
+    #[allow(clippy::too_many_arguments)]
     pub fn execute_document_count_total_no_proof(
         &self,
         contract_id: [u8; 32],
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<Vec<SplitCountEntry>, Error> {
@@ -56,6 +59,7 @@ impl Drive {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             &where_clauses,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_count_query/index_picker.rs b/packages/rs-drive/src/query/drive_document_count_query/index_picker.rs
index 30ff6ed939c..9c3f4a773a1 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/index_picker.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/index_picker.rs
@@ -6,6 +6,8 @@
 
 use super::super::conditions::WhereClause;
 use super::DriveDocumentCountQuery;
+use crate::query::index_admissible_for_resolved_time_range;
+use crate::query::ResolvedTimeRange;
 use dpp::data_contract::document_type::Index;
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -33,9 +35,16 @@ impl DriveDocumentCountQuery<'_> {
     /// clauses), the dispatcher reads the document-type primary-key tree's
     /// CountTree directly — that path doesn't use this picker because no
     /// index is involved.
+    ///
+    /// `resolved_time_ranges` names the fields whose equality clause was
+    /// produced by `IN_TIME_RANGE` resolution (see
+    /// [`crate::query::resolve_time_range_bucket_clause`]); it gates which
+    /// indexes are candidates at all — see
+    /// [`index_admissible_for_resolved_time_range`].
     pub fn find_countable_index_for_where_clauses<'b>(
         indexes: &'b BTreeMap<String, Index>,
         where_clauses: &[WhereClause],
+        resolved_time_ranges: &[ResolvedTimeRange],
     ) -> Option<&'b Index> {
         if Self::has_unsupported_operator(where_clauses) {
             return None;
@@ -56,6 +65,14 @@ impl DriveDocumentCountQuery<'_> {
         }
 
         for index in indexes.values() {
+            // A time-range index holds one entry per bucket containing the
+            // document, keyed by bucket start: counting over it multi-counts
+            // every document unless the query pins a single bucket, and only
+            // a resolution-produced equality does that. Conversely a raw
+            // clause must never bind to bucket keys.
+            if !index_admissible_for_resolved_time_range(index, resolved_time_ranges) {
+                continue;
+            }
             if !index.countable.is_countable() {
                 continue;
             }
@@ -93,9 +110,18 @@ impl DriveDocumentCountQuery<'_> {
     /// walks the current model doesn't support). Pure point-lookup queries
     /// (no range operator) should fall back to
     /// [`Self::find_countable_index_for_where_clauses`].
+    ///
+    /// `resolved_time_ranges` gates the candidate set exactly as in
+    /// [`Self::find_countable_index_for_where_clauses`]. A resolved field
+    /// never arrives as a range clause — resolution always produces an
+    /// equality — so with a non-empty list the only bucketed index this can
+    /// return is one whose resolved equality is a prefix property and whose
+    /// range terminator is a different property. That is the intended shape:
+    /// a range over one property within a single time bucket.
     pub fn find_range_countable_index_for_where_clauses<'b>(
         indexes: &'b BTreeMap<String, Index>,
         where_clauses: &[WhereClause],
+        resolved_time_ranges: &[ResolvedTimeRange],
     ) -> Option<&'b Index> {
         let range_clauses: Vec<&WhereClause> = where_clauses
             .iter()
@@ -147,6 +173,13 @@ impl DriveDocumentCountQuery<'_> {
             .collect();
 
         for index in indexes.values() {
+            // Same admissibility rule as the point-lookup picker: bucketed
+            // indexes store one entry per containing bucket, so only a query
+            // pinned to a single bucket by a resolution-produced equality may
+            // walk them, and raw clauses may never bind to bucket keys.
+            if !index_admissible_for_resolved_time_range(index, resolved_time_ranges) {
+                continue;
+            }
             if !index.range_countable || !index.countable.is_countable() {
                 continue;
             }
@@ -174,14 +207,26 @@ impl DriveDocumentCountQuery<'_> {
                 // properties. For the widget contract there are no
                 // such middle properties on byBrandColor, but the
                 // builder handles the general case.
+                let intermediate_props = &index.properties[1..index.properties.len() - 1];
                 let mut intermediate_props_ok = true;
-                for prop in &index.properties[1..index.properties.len() - 1] {
+                for prop in intermediate_props {
                     if !prefix_fields.contains(prop.name.as_str()) {
                         intermediate_props_ok = false;
                         break;
                     }
                 }
-                if intermediate_props_ok {
+                // Strict-coverage check, mirroring sum's picker: every
+                // Equal/In prefix field must appear in the index's
+                // intermediate properties. Without this
+                // `intermediate_props.len() == prefix_fields.len()` guard,
+                // a query with extra prefix fields would silently pick an
+                // index that *doesn't* cover them — the carrier path-query
+                // builder iterates only index properties, so the uncovered
+                // clause would simply be dropped and the per-group counts
+                // would span all its values (an over-broad result that
+                // even verifies, since the verifier rebuilds the same
+                // path query from the same picker).
+                if intermediate_props_ok && intermediate_props.len() == prefix_fields.len() {
                     return Some(index);
                 }
                 continue;
diff --git a/packages/rs-drive/src/query/drive_document_count_query/path_query.rs b/packages/rs-drive/src/query/drive_document_count_query/path_query.rs
index 8018b8367f2..041ade14dd4 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/path_query.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/path_query.rs
@@ -223,7 +223,7 @@ impl DriveDocumentCountQuery<'_> {
                     ),
                 ));
             }
-            path.push(prop.name.as_bytes().to_vec());
+            path.push(self.index.level_key_for_property(&prop.name).into_bytes());
             path.push(self.document_type.serialize_value_for_key(
                 prop.name.as_str(),
                 &clause.value,
@@ -240,7 +240,11 @@ impl DriveDocumentCountQuery<'_> {
                 ),
             ))?
             .name;
-        path.push(range_prop_name.as_bytes().to_vec());
+        path.push(
+            self.index
+                .level_key_for_property(range_prop_name)
+                .into_bytes(),
+        );
 
         Ok(PathQuery::new_aggregate_count_on_range(path, query_item))
     }
@@ -363,7 +367,7 @@ impl DriveDocumentCountQuery<'_> {
             )?;
             match (&carrier, clause.operator) {
                 (Carrier::Pending, WhereOperator::Equal) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     base_path.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -371,15 +375,16 @@ impl DriveDocumentCountQuery<'_> {
                     )?);
                 }
                 (Carrier::Pending, WhereOperator::In) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::In(clause.clone());
                 }
                 (Carrier::Pending, op) if Self::is_range_operator(op) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::Range(clause.clone());
                 }
                 (Carrier::In(_) | Carrier::Range(_), WhereOperator::Equal) => {
-                    subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                    subquery_path_extension
+                        .push(self.index.level_key_for_property(&prop.name).into_bytes());
                     subquery_path_extension.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -404,7 +409,11 @@ impl DriveDocumentCountQuery<'_> {
                 }
             }
         }
-        subquery_path_extension.push(terminator_prop_name.as_bytes().to_vec());
+        subquery_path_extension.push(
+            self.index
+                .level_key_for_property(terminator_prop_name)
+                .into_bytes(),
+        );
 
         let mut outer_query = Query::new_with_direction(left_to_right);
         match carrier {
@@ -582,10 +591,11 @@ impl DriveDocumentCountQuery<'_> {
                         platform_version,
                     )?;
                     if in_outer_keys.is_some() {
-                        subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                        subquery_path_extension
+                            .push(self.index.level_key_for_property(&prop.name).into_bytes());
                         subquery_path_extension.push(serialized);
                     } else {
-                        base_path.push(prop.name.as_bytes().to_vec());
+                        base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                         base_path.push(serialized);
                     }
                 }
@@ -600,7 +610,7 @@ impl DriveDocumentCountQuery<'_> {
                     }
                     // Path stops at the In-bearing prop's property-
                     // name subtree; outer Query lives at that level.
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     let in_values = clause.in_values().into_data_with_error()??;
                     let mut keys: Vec<Vec<u8>> = in_values
                         .iter()
@@ -843,7 +853,11 @@ impl DriveDocumentCountQuery<'_> {
         let mut in_outer_keys: Option<Vec<Vec<u8>>> = None;
         let mut subquery_path_extension: Vec<Vec<u8>> = vec![];
 
-        for prop in self.index.properties.iter() {
+        for (position, prop) in self.index.properties.iter().enumerate() {
+            // The path segment is the level key — grid-qualified for a
+            // time-range index's first property — while the clause lookup
+            // and value serialization stay on the bare property name.
+            let level_key = self.index.level_key(position, &prop.name);
             let clause = self
                 .where_clauses
                 .iter()
@@ -871,10 +885,10 @@ impl DriveDocumentCountQuery<'_> {
                         // path. Any number of these may accumulate —
                         // one for each Equal that sits *after* the In
                         // in the index ordering.
-                        subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                        subquery_path_extension.push(level_key.as_bytes().to_vec());
                         subquery_path_extension.push(serialized);
                     } else {
-                        base_path.push(prop.name.as_bytes().to_vec());
+                        base_path.push(level_key.as_bytes().to_vec());
                         base_path.push(serialized);
                     }
                 }
@@ -891,7 +905,7 @@ impl DriveDocumentCountQuery<'_> {
                     // property-name subtree; outer Query lives at
                     // that level. Any trailing Equal property then
                     // routes through `subquery_path_extension`.
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     let in_values = clause.in_values().into_data_with_error()??;
                     let mut keys: Vec<Vec<u8>> = in_values
                         .iter()
diff --git a/packages/rs-drive/src/query/drive_document_count_query/tests.rs b/packages/rs-drive/src/query/drive_document_count_query/tests.rs
index da54e064fc9..327b37a4104 100644
--- a/packages/rs-drive/src/query/drive_document_count_query/tests.rs
+++ b/packages/rs-drive/src/query/drive_document_count_query/tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 use crate::drive::Drive;
+use crate::query::ResolvedTimeRange;
 use crate::util::object_size_info::DocumentInfo::DocumentRefInfo;
 use crate::util::object_size_info::{DocumentAndContractInfo, OwnedDocumentInfo};
 use crate::util::storage_flags::StorageFlags;
@@ -69,6 +70,7 @@ fn insert_person_doc(
     properties.insert("age".to_string(), Value::U64(age));
 
     let document: Document = DocumentV0 {
+        contract_version: None,
         id: Identifier::from(id),
         owner_id: Identifier::from([0u8; 32]),
         properties,
@@ -141,6 +143,7 @@ fn test_count_query_fully_covered_equal_succeeds_on_both_paths() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&age_eq_30),
+        &[],
     )
     .expect("expected picker to accept fully-covered byAge index");
 
@@ -199,6 +202,7 @@ fn test_count_query_picker_rejects_partial_coverage() {
     let no_match = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &[],
+        &[],
     );
     assert!(
         no_match.is_none(),
@@ -216,6 +220,7 @@ fn test_count_query_picker_rejects_partial_coverage() {
     let no_match_partial = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &first_name_only,
+        &[],
     );
     assert!(
         no_match_partial.is_none(),
@@ -233,6 +238,7 @@ fn test_count_query_picker_rejects_partial_coverage() {
     let picked = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &age_only,
+        &[],
     )
     .expect("byAge is exactly covered");
     assert_eq!(picked.properties.len(), 1);
@@ -266,6 +272,7 @@ fn test_find_countable_index_for_where_clauses_no_match() {
     let result = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &[where_clause],
+        &[],
     );
 
     assert!(
@@ -341,6 +348,7 @@ fn test_find_countable_index_rejects_unsupported_operator() {
         DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             std::slice::from_ref(&gt_clause),
+            &[],
         )
         .is_none()
     );
@@ -373,6 +381,7 @@ fn test_count_query_total_count_with_in_operator() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&in_clause),
+        &[],
     )
     .expect("expected to find countable index for In on age");
 
@@ -418,6 +427,7 @@ fn test_count_query_total_count_with_in_operator_no_matches() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&in_clause),
+        &[],
     )
     .expect("expected to find countable index for In on age");
 
@@ -532,6 +542,7 @@ fn test_aggregate_count_in_fan_out_ignores_default_query_limit() {
         limit: None,
         prove: false,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
 
     let response = drive
@@ -602,6 +613,7 @@ fn test_count_query_in_operator_rejects_duplicate_values() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&in_clause),
+        &[],
     )
     .expect("expected to find countable index for In on age");
 
@@ -690,6 +702,7 @@ fn test_count_query_in_on_before_last_with_trailing_equal_succeeds_on_both_paths
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("expected picker to accept byFirstNameLastName for In + Equal coverage");
     // Sanity-check the picker really chose the 2-prop index, not the
@@ -813,6 +826,7 @@ fn test_count_query_in_on_first_of_three_with_two_trailing_equals_succeeds_on_bo
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("expected picker to accept the 3-prop covering index");
     // Sanity-pin the picker actually chose the 3-prop unique
@@ -942,6 +956,7 @@ fn test_point_lookup_proof_omits_absent_in_branches_from_entries() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&in_clause),
+        &[],
     )
     .expect("expected picker to accept byAge for In on age");
     // Sanity-pin the picker chose the single-property `byAge` index —
@@ -1091,6 +1106,7 @@ fn test_count_query_in_operator_accepts_max_sized_array() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&in_clause),
+        &[],
     )
     .expect("expected picker to accept byAge for In on age");
     assert_eq!(index.properties.len(), 1);
@@ -1262,6 +1278,7 @@ fn test_compound_range_in_summed_no_proof_uses_per_in_aggregate_fanout() {
         properties.insert("brand".to_string(), Value::Text(brand.to_string()));
         properties.insert("color".to_string(), Value::Text(color.to_string()));
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from([(i + 1) as u8; 32]),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -1329,6 +1346,7 @@ fn test_compound_range_in_summed_no_proof_uses_per_in_aggregate_fanout() {
         limit: None,
         prove: false,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
 
     let response = drive
@@ -1403,6 +1421,7 @@ fn test_count_request_with_duplicate_equality_clauses_is_rejected() {
         limit: None,
         prove: false,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
 
     let err = drive
@@ -1536,6 +1555,7 @@ fn test_range_distinct_proof_uses_compile_time_default_query_limit_not_operator_
         let mut properties = StdBTreeMap::new();
         properties.insert("color".to_string(), Value::Text(color.to_string()));
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from([(i + 1) as u8; 32]),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -1598,6 +1618,7 @@ fn test_range_distinct_proof_uses_compile_time_default_query_limit_not_operator_
         limit: None,
         prove: true,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
 
     let response = drive
@@ -1626,6 +1647,7 @@ fn test_range_distinct_proof_uses_compile_time_default_query_limit_not_operator_
     let index = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&color_gt_blue),
+        &[],
     )
     .expect("byColor range_countable index covers `color > blue`");
     let count_query = DriveDocumentCountQuery {
@@ -1721,6 +1743,7 @@ fn test_range_distinct_no_proof_rejects_zero_effective_limit() {
         limit: None,
         prove: false,
         drive_config: &drive_config,
+        resolved_time_ranges: vec![],
     };
 
     let result = drive.execute_document_count_request(request, None, platform_version);
@@ -1767,6 +1790,7 @@ fn test_count_query_in_operator_rejects_oversized_array() {
             document_type,
             "person".to_string(),
             vec![in_clause],
+            &[],
             super::RangeCountOptions {
                 distinct: false,
                 limit: Some(50),
@@ -2003,6 +2027,7 @@ fn test_countable_allowing_offset_variant_end_to_end() {
     let picked = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         std::slice::from_ref(&first_name_eq_alice),
+        &[],
     )
     .expect("expected picker to accept CountableAllowingOffset index");
     assert_eq!(picked.countable, IndexCountability::CountableAllowingOffset);
@@ -2076,6 +2101,7 @@ fn test_count_query_unique_countable_index_returns_correct_count() {
     let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
         document_type.indexes(),
         &where_clauses,
+        &[],
     )
     .expect("expected to find a countable index covering all 3 properties");
 
@@ -2143,6 +2169,8 @@ mod range_countable_picker_tests {
             ranked_countable: false,
             ranked_summable: false,
             ranked_averageable: false,
+            time_range: None,
+            terminal: None,
         }
     }
 
@@ -2168,6 +2196,7 @@ mod range_countable_picker_tests {
         let picked = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             &indexes,
             &where_clauses,
+            &[],
         );
         assert!(picked.is_some());
         assert_eq!(picked.unwrap().name, "byColor");
@@ -2201,6 +2230,7 @@ mod range_countable_picker_tests {
         let picked = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
             &indexes,
             &where_clauses,
+            &[],
         );
         assert!(picked.is_some());
         assert_eq!(picked.unwrap().name, "byBrandColor");
@@ -2227,6 +2257,7 @@ mod range_countable_picker_tests {
             DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
                 &indexes,
                 &where_clauses,
+                &[],
             )
             .is_none(),
             "a range on a non-terminator property must not match — the storage \
@@ -2234,6 +2265,89 @@ mod range_countable_picker_tests {
         );
     }
 
+    /// Carrier arm (two ranges on distinct fields): an extra Equal clause
+    /// on a field the index does not carry must disqualify the index —
+    /// the carrier path-query builder iterates only index properties, so
+    /// an admitted index would silently drop the clause and produce an
+    /// over-broad per-group count that still verifies (the verifier
+    /// rebuilds the same path query from the same picker). Mirrors sum's
+    /// strict-coverage guard.
+    #[test]
+    fn carrier_arm_rejects_index_missing_an_equality_field() {
+        let indexes = make_indexes(vec![make_index(
+            "byBrandColor",
+            &["brand", "color"],
+            IndexCountability::Countable,
+            true,
+        )]);
+        let where_clauses = vec![
+            WhereClause {
+                field: "brand".to_string(),
+                operator: WhereOperator::GreaterThan,
+                value: Value::Text("a".to_string()),
+            },
+            WhereClause {
+                field: "color".to_string(),
+                operator: WhereOperator::GreaterThan,
+                value: Value::Text("f".to_string()),
+            },
+            WhereClause {
+                field: "material".to_string(),
+                operator: WhereOperator::Equal,
+                value: Value::Text("wood".to_string()),
+            },
+        ];
+        assert!(
+            DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
+                &indexes,
+                &where_clauses,
+                &[],
+            )
+            .is_none(),
+            "an equality clause the index cannot cover must disqualify it"
+        );
+    }
+
+    /// Positive control for the strict-coverage guard: the identical
+    /// query shape against an index that carries the equality field as
+    /// its intermediate property is covered and picked.
+    #[test]
+    fn carrier_arm_picks_index_covering_the_equality_field() {
+        let indexes = make_indexes(vec![make_index(
+            "byBrandMaterialColor",
+            &["brand", "material", "color"],
+            IndexCountability::Countable,
+            true,
+        )]);
+        let where_clauses = vec![
+            WhereClause {
+                field: "brand".to_string(),
+                operator: WhereOperator::GreaterThan,
+                value: Value::Text("a".to_string()),
+            },
+            WhereClause {
+                field: "color".to_string(),
+                operator: WhereOperator::GreaterThan,
+                value: Value::Text("f".to_string()),
+            },
+            WhereClause {
+                field: "material".to_string(),
+                operator: WhereOperator::Equal,
+                value: Value::Text("wood".to_string()),
+            },
+        ];
+        let picked = DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
+            &indexes,
+            &where_clauses,
+            &[],
+        );
+        assert_eq!(
+            picked.map(|index| index.name.as_str()),
+            Some("byBrandMaterialColor"),
+            "with the equality field covered, the carrier index is picked"
+        );
+    }
+
     /// An index without `range_countable: true` must not match even if
     /// the property structure aligns. The storage layout for these is
     /// plain NormalTree — no CountTree counts to walk.
@@ -2254,6 +2368,7 @@ mod range_countable_picker_tests {
             DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
                 &indexes,
                 &where_clauses,
+                &[],
             )
             .is_none()
         );
@@ -2285,6 +2400,7 @@ mod range_countable_picker_tests {
             DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
                 &indexes,
                 &where_clauses,
+                &[],
             )
             .is_none(),
             "two separate range operators must be rejected (use Between to express a bounded range)"
@@ -2310,6 +2426,7 @@ mod range_countable_picker_tests {
             DriveDocumentCountQuery::find_range_countable_index_for_where_clauses(
                 &indexes,
                 &where_clauses,
+                &[],
             )
             .is_none(),
             "no range operator → not the range picker's job"
@@ -2767,6 +2884,7 @@ mod range_countable_point_lookup_tests {
             properties.insert("color".to_string(), Value::Text(c.to_string()));
         }
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from(id),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -2815,6 +2933,7 @@ mod range_countable_point_lookup_tests {
         let mut properties = StdBTreeMap::new();
         properties.insert("category".to_string(), Value::Text(category.to_string()));
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from(id),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -2895,6 +3014,7 @@ mod range_countable_point_lookup_tests {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             std::slice::from_ref(&brand_eq),
+            &[],
         )
         .expect("byBrand covers brand==acme");
         assert!(
@@ -3011,6 +3131,7 @@ mod range_countable_point_lookup_tests {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             std::slice::from_ref(&brand_in),
+            &[],
         )
         .expect("byBrand covers brand IN [...]");
         assert!(index.range_countable);
@@ -3178,6 +3299,7 @@ mod range_countable_point_lookup_tests {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             &clauses,
+            &[],
         )
         .expect("byBrandColor covers brand IN + color =");
         assert!(index.range_countable);
@@ -3297,6 +3419,7 @@ mod range_countable_point_lookup_tests {
         let index = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
             document_type.indexes(),
             std::slice::from_ref(&category_eq),
+            &[],
         )
         .expect("byCategory covers category=tools");
         assert!(
@@ -3370,3 +3493,218 @@ mod range_countable_point_lookup_tests {
         assert_eq!(summed, 2);
     }
 }
+
+#[cfg(test)]
+mod time_range_picker_tests {
+    //! Coverage for the transform gate the count pickers apply before
+    //! scoring a candidate — see
+    //! [`crate::query::index_admissible_for_resolved_time_range`].
+    //!
+    //! A bucketed index stores one entry per bucket containing a document,
+    //! keyed by bucket start. Counting over it is only meaningful when the
+    //! query pins a single bucket, and the only thing that can pin one is an
+    //! equality produced by `IN_TIME_RANGE` resolution. Both directions of
+    //! the mismatch return a wrong count rather than an error, so the picker
+    //! is where they have to be stopped.
+
+    use super::*;
+    use dpp::data_contract::document_type::{
+        Index, IndexCountability, IndexProperty, TimeRangeTransform,
+    };
+
+    /// One hour as a transform declares a window (seconds) and as the clause
+    /// values below are expressed (milliseconds, the unit of a bucket start).
+    const HOUR_SECONDS: u64 = 3_600;
+    const HOUR_MS: u64 = 3_600_000;
+    const SOURCE: &str = "$createdAt";
+
+    fn make_index(
+        name: &str,
+        properties: &[&str],
+        time_range: Option<TimeRangeTransform>,
+    ) -> Index {
+        Index {
+            name: name.to_string(),
+            properties: properties
+                .iter()
+                .map(|p| IndexProperty {
+                    name: p.to_string(),
+                    ascending: true,
+                })
+                .collect(),
+            unique: false,
+            null_searchable: true,
+            contested_index: None,
+            countable: IndexCountability::Countable,
+            range_countable: false,
+            summable: None,
+            range_summable: false,
+            ranked_countable: false,
+            ranked_summable: false,
+            ranked_averageable: false,
+            time_range,
+            terminal: None,
+        }
+    }
+
+    /// `trending` buckets `$createdAt` into 6h windows every 2h; `byHashtag`
+    /// covers the same two fields with raw timestamps and sorts first.
+    fn indexes() -> std::collections::BTreeMap<String, Index> {
+        [
+            make_index("byHashtag", &["hashtag", SOURCE], None),
+            make_index(
+                "trending",
+                &[SOURCE, "hashtag"],
+                Some(TimeRangeTransform {
+                    source: SOURCE.to_string(),
+                    range_seconds: 6 * HOUR_SECONDS,
+                    step_seconds: 2 * HOUR_SECONDS,
+                    phase_seconds: 0,
+                }),
+            ),
+        ]
+        .into_iter()
+        .map(|index| (index.name.clone(), index))
+        .collect()
+    }
+
+    /// The provenance a real `IN_TIME_RANGE` resolution against the
+    /// `trending` grid produces: the source field plus the exact transform.
+    /// Constructed directly (not read from the candidate map) so tests that
+    /// remove the trending index can still present the resolution.
+    fn source_resolution() -> Vec<ResolvedTimeRange> {
+        vec![ResolvedTimeRange {
+            transform: TimeRangeTransform {
+                source: SOURCE.to_string(),
+                range_seconds: 6 * HOUR_SECONDS,
+                step_seconds: 2 * HOUR_SECONDS,
+                phase_seconds: 0,
+            },
+        }]
+    }
+
+    fn equal(field: &str, value: Value) -> WhereClause {
+        WhereClause {
+            field: field.to_string(),
+            operator: WhereOperator::Equal,
+            value,
+        }
+    }
+
+    /// The resolved equality names the bucketed index's source, so that index
+    /// — and only that index — may serve the count.
+    #[test]
+    fn resolved_source_equality_selects_the_bucketed_index() {
+        let indexes = indexes();
+        let where_clauses = vec![
+            equal(SOURCE, Value::U64(6 * HOUR_MS)),
+            equal("hashtag", Value::Text("ibiza".to_string())),
+        ];
+        let picked = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+            &indexes,
+            &where_clauses,
+            &source_resolution(),
+        )
+        .expect("the bucketed index exactly covers the resolved clause set");
+        assert_eq!(picked.name, "trending");
+    }
+
+    /// The same clause set without the provenance must not reach the bucketed
+    /// index. `byHashtag` covers it and sorts first, so this also pins that
+    /// the gate does not merely reorder candidates.
+    #[test]
+    fn raw_equality_on_the_source_never_selects_the_bucketed_index() {
+        let indexes = indexes();
+        let where_clauses = vec![
+            equal(SOURCE, Value::U64(1_700_000_000_000)),
+            equal("hashtag", Value::Text("ibiza".to_string())),
+        ];
+        let picked = DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+            &indexes,
+            &where_clauses,
+            &[],
+        )
+        .expect("the plain index covers a raw equality on both fields");
+        assert_eq!(picked.name, "byHashtag");
+    }
+
+    /// An `In` over the source enumerates bucket starts, and a document
+    /// appears under every bucket containing it, so any hit would be counted
+    /// once per overlapping bucket. Resolution never produces an `In`, so the
+    /// only way this shape reaches the picker is a client writing it by hand.
+    #[test]
+    fn raw_in_on_the_source_does_not_select_the_bucketed_index() {
+        let mut indexes = indexes();
+        // Drop the plain index so a `None` here can only mean the bucketed
+        // one was refused, not that a raw index happened to win.
+        indexes.remove("byHashtag");
+        let where_clauses = vec![
+            WhereClause {
+                field: SOURCE.to_string(),
+                operator: WhereOperator::In,
+                value: Value::Array(vec![
+                    Value::U64(2 * HOUR_MS),
+                    Value::U64(4 * HOUR_MS),
+                    Value::U64(6 * HOUR_MS),
+                ]),
+            },
+            equal("hashtag", Value::Text("ibiza".to_string())),
+        ];
+        assert!(
+            DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+                &indexes,
+                &where_clauses,
+                &[],
+            )
+            .is_none()
+        );
+    }
+
+    /// The converse gate: with a resolved field named, an index that stores
+    /// raw timestamps is not a candidate even when it exactly covers the
+    /// clause fields — matching a bucket start against raw values would
+    /// return a proven-empty result.
+    #[test]
+    fn plain_index_is_not_selected_when_a_time_range_field_was_resolved() {
+        let mut indexes = indexes();
+        indexes.remove("trending");
+        let where_clauses = vec![
+            equal(SOURCE, Value::U64(6 * HOUR_MS)),
+            equal("hashtag", Value::Text("ibiza".to_string())),
+        ];
+        assert!(
+            DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+                &indexes,
+                &where_clauses,
+                &source_resolution(),
+            )
+            .is_none()
+        );
+    }
+
+    /// Provenance names its field through the transform itself
+    /// ([`ResolvedTimeRange::field`] is derived from `transform.source`), so
+    /// the fabricated field/transform mismatch this test used to construct is
+    /// unrepresentable. What remains fabricatable is a resolution whose grid
+    /// no index declares — it must admit nothing.
+    #[test]
+    fn provenance_with_a_grid_no_index_declares_admits_nothing() {
+        let indexes = indexes();
+        let where_clauses = vec![
+            equal(SOURCE, Value::U64(6 * HOUR_MS)),
+            equal("hashtag", Value::Text("ibiza".to_string())),
+        ];
+        let mut mismatched = source_resolution();
+        mismatched[0].transform.step_seconds /= 2;
+        assert!(
+            DriveDocumentCountQuery::find_countable_index_for_where_clauses(
+                &indexes,
+                &where_clauses,
+                &mismatched,
+            )
+            .is_none(),
+            "a resolution carrying a grid no index declares must not admit \
+             the bucketed index (nor, being a resolution, the plain one)"
+        );
+    }
+}
diff --git a/packages/rs-drive/src/query/drive_document_having_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_having_query/drive_dispatcher.rs
index b484460081b..92797b73022 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/drive_dispatcher.rs
@@ -5,10 +5,11 @@
 use super::super::drive_document_ranked_query::{RankedEntry, RankedPaginationInputs};
 use super::mode_detection::detect_having_mode;
 use crate::drive::Drive;
+use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::having::HavingClause;
 use crate::query::projection::SelectProjection;
-use crate::query::{OrderClause, WhereClause};
+use crate::query::{OrderClause, ResolvedTimeRange, WhereClause};
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -44,9 +45,21 @@ pub struct DocumentHavingRequest<'a> {
     /// one, naming the selected aggregate.
     pub order_by: &'a [OrderClause],
     /// Structured `where` clauses. Empty for the single-property form;
-    /// equality pins on the covering compound index's leading
-    /// properties for the pinned-prefix form.
+    /// pins on the covering compound index's leading properties for
+    /// the pinned-prefix form: one equality pin per property, of which
+    /// at most one may instead be a bounded `IN` (one branch per
+    /// element, merged; entries then carry `in_key`).
     pub where_clauses: &'a [WhereClause],
+    /// The fields among `where_clauses` whose equality clause was produced by
+    /// `IN_TIME_RANGE` resolution (see
+    /// [`crate::query::DriveDocumentQuery::resolved_time_ranges`]).
+    /// Must be empty: HAVING's equality prefixes pin plain ranked indexes
+    /// (its picker excludes transformed ones), so a resolved bucket-start
+    /// equality would authenticate raw-timestamp matches at the bucket
+    /// boundary instead of window membership. Carried (and rejected) here
+    /// for the same reason the ranked request carries it: drive owns the
+    /// rejection regardless of which upstream path built the request.
+    pub resolved_time_ranges: &'a [ResolvedTimeRange],
     /// Request `limit`. **Required**; `1 ..= MAX_HAVING_LIMIT`.
     pub limit: Option<u32>,
     /// Request `offset`. Must be `None` — the range walk has no skip.
@@ -104,6 +117,20 @@ impl Drive {
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<DocumentHavingResponse, Error> {
+        // Before mode detection reads `where_clauses`: a resolved bucket
+        // equality is indistinguishable from a hand-written equality pin, and
+        // the pinned-prefix form would accept it against a plain ranked index
+        // over raw timestamps — a validly-proven answer to a different
+        // question. See `DocumentHavingRequest::resolved_time_ranges`.
+        if !request.resolved_time_ranges.is_empty() {
+            return Err(Error::Query(QuerySyntaxError::Unsupported(
+                "a HAVING query cannot carry a time-range (IN_TIME_RANGE) selection: its \
+                 equality prefixes pin plain ranked indexes, so a resolved bucket-start \
+                 equality would match raw timestamps at the bucket boundary instead of the \
+                 selected window"
+                    .to_string(),
+            )));
+        }
         let mode = detect_having_mode(
             &request.select,
             request.group_by,
diff --git a/packages/rs-drive/src/query/drive_document_having_query/execute_range.rs b/packages/rs-drive/src/query/drive_document_having_query/execute_range.rs
index 6707461d8d5..12e732da890 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/execute_range.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/execute_range.rs
@@ -11,14 +11,19 @@
 //! Whole module is gated `feature = "server"` via the parent's
 //! `pub mod execute_range;` declaration.
 
-use super::super::drive_document_ranked_query::{RankedAxis, RankedEntry, RankedEntryValue};
-use super::{AxisRangeBounds, DriveDocumentHavingQuery};
+use super::super::drive_document_ranked_query::branches::{
+    axis_keys_to_ranked, decompose_branch_paths, read_branched_union,
+};
+use super::super::drive_document_ranked_query::RankedEntry;
+use super::DriveDocumentHavingQuery;
 use crate::drive::Drive;
 use crate::error::drive::DriveError;
 use crate::error::Error;
 use dpp::version::PlatformVersion;
-use grovedb::TransactionArg;
+use grovedb::query_result_type::QueryResultType;
+use grovedb::{PathQuery, PathQueryRun, TransactionArg};
 use grovedb_costs::CostContext;
+use grovedb_query::AxisQuery;
 
 impl DriveDocumentHavingQuery<'_> {
     /// Read the matching groups directly from the axis secondary: every
@@ -27,92 +32,92 @@ impl DriveDocumentHavingQuery<'_> {
     ///
     /// Fewer than `limit` entries is normal (fewer groups match) and is
     /// not an error; exactly `limit` entries may mean the match set was
-    /// cut. A missing path *is* an error rather than an empty result,
-    /// for the same reason as on the ranked surface: the indexed
-    /// property-name tree is created at contract registration, so its
-    /// absence means the contract-level state is not what the request
-    /// claims. (An index with no documents has the tree, with an empty
-    /// secondary, and yields an empty entry list.)
+    /// cut.
+    ///
+    /// Missing paths follow the ranked surface's rule. Under a single
+    /// `==` pin (or no pins) a missing path *is* an error rather than an
+    /// empty result: the indexed property-name tree is created at
+    /// contract registration, so its absence means the contract-level
+    /// state is not what the request claims. On an `IN`-pinned request,
+    /// an element whose branch chain is missing at ANY depth — the
+    /// branch key, or any deeper pinned segment under a *present* key —
+    /// contributes an **empty branch** instead (union semantics, exactly
+    /// as the proved envelope authenticates it), and the union is served
+    /// from one committed state (a `None` read runs under a grovedb
+    /// snapshot read transaction). An index with no documents has the
+    /// tree, with an empty secondary, and yields an empty entry list.
     pub fn execute_range_no_proof(
         &self,
         drive: &Drive,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
+    ) -> Result<Vec<RankedEntry>, Error> {
+        if self.prefix_branches.len() > 1 {
+            // ONE grovedb call for the whole union, pinned to one
+            // committed state — the entire sequence lives in the ranked
+            // surface's `branches::read_branched_union`, shared with the
+            // ranked executor so the two cannot drift.
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let axis = self.bounds.axis();
+            let (lo, hi) = self.bounds.inclusive_bounds_i128();
+            return read_branched_union(
+                &drive.grove,
+                "having",
+                &self.prefix_branches,
+                &paths,
+                axis,
+                AxisQuery::bounded(axis.into(), lo, hi, self.limit, self.descending),
+                self.limit as usize,
+                self.descending,
+                transaction,
+                &platform_version.drive.grove_version,
+            );
+        }
+        self.execute_range_no_proof_branch(0, drive, transaction, platform_version)
+    }
+
+    /// One branch's in-bound page — the entire pre-`IN` executor,
+    /// parameterized by which prefix branch's terminal tree it walks.
+    fn execute_range_no_proof_branch(
+        &self,
+        branch: usize,
+        drive: &Drive,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
     ) -> Result<Vec<RankedEntry>, Error> {
         let grove_version = &platform_version.drive.grove_version;
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
+        let path = self.indexed_property_name_tree_path(branch)?;
+        let axis = self.bounds.axis();
+        let (lo, hi) = self.bounds.inclusive_bounds_i128();
 
         // Costs are destructured away rather than `.unwrap()`-ed, same
         // as the ranked executors: `CostContext::unwrap` is infallible
         // but reads like a panicking unwrap at the call site.
-        let entries = match self.bounds {
-            AxisRangeBounds::Count { lo, hi } => {
-                let CostContext { value, cost: _ } = drive.grove.indexed_count_range_keys(
-                    path_refs.as_slice(),
-                    lo,
-                    hi,
-                    self.descending,
-                    self.limit,
-                    transaction,
-                    grove_version,
-                );
-                value
-                    .map_err(|e| Error::GroveDB(Box::new(e)))?
-                    .into_iter()
-                    .map(|(count, key)| RankedEntry {
-                        key,
-                        value: RankedEntryValue::Count(count),
-                    })
-                    .collect::<Vec<_>>()
-            }
-            AxisRangeBounds::Sum { lo, hi } => {
-                let CostContext { value, cost: _ } = drive.grove.indexed_sum_range_keys(
-                    path_refs.as_slice(),
-                    lo,
-                    hi,
-                    self.descending,
-                    self.limit,
-                    transaction,
-                    grove_version,
-                );
-                value
-                    .map_err(|e| Error::GroveDB(Box::new(e)))?
-                    .into_iter()
-                    .map(|(sum, key)| RankedEntry {
-                        key,
-                        value: RankedEntryValue::Sum(sum),
-                    })
-                    .collect::<Vec<_>>()
-            }
-            AxisRangeBounds::Avg { lo, hi } => {
-                let CostContext { value, cost: _ } = drive.grove.indexed_avg_range_keys(
-                    path_refs.as_slice(),
-                    lo,
-                    hi,
-                    self.descending,
-                    self.limit,
-                    transaction,
-                    grove_version,
-                );
-                value
-                    .map_err(|e| Error::GroveDB(Box::new(e)))?
-                    .into_iter()
-                    .map(|(avg, key)| RankedEntry {
-                        key,
-                        value: RankedEntryValue::AvgFixedPoint(avg),
-                    })
-                    .collect::<Vec<_>>()
-            }
+        let path_query = PathQuery::new_axis(
+            path,
+            AxisQuery::bounded(axis.into(), lo, hi, self.limit, self.descending).keys_only(),
+        );
+        let CostContext { value, cost: _ } = drive.grove.run_path_query(
+            &path_query,
+            true,
+            true,
+            true,
+            QueryResultType::QueryKeyElementPairResultType,
+            transaction,
+            grove_version,
+        );
+        let run = value.map_err(|e| Error::GroveDB(Box::new(e)))?;
+        let PathQueryRun::AxisKeys { keys, skipped: _ } = run else {
+            return Err(Error::Drive(DriveError::CorruptedDriveState(
+                "a keys-only having read returned a different result shape".to_string(),
+            )));
         };
-
-        // The limit is the contract with the caller, and on the prove
-        // path it is re-checked inside the proof envelope. Asserting it
-        // here keeps the no-proof and prove responses shape-identical.
+        let entries = axis_keys_to_ranked(axis, keys)?;
         if entries.len() > self.limit as usize {
             return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
-                "having {:?} range read returned {} entries for limit = {}",
-                self.bounds.axis(),
+                "having {axis:?} read returned {} entries for limit = {}",
                 entries.len(),
                 self.limit
             ))));
@@ -125,14 +130,15 @@ impl DriveDocumentHavingQuery<'_> {
     /// The envelope commits the in-range secondary entries, the
     /// primary's root hash, the sibling axes' root hashes, and a
     /// per-ancestor attestation chain up to the grovedb root — so the
-    /// client reconstructs the platform root hash from it. The Merk
-    /// query (the encoded bounds and walk direction) and the limit are
-    /// echoed and re-checked by grovedb's verifier against the client's
-    /// own reconstruction via [`AxisRangeBounds::merk_query`] — which is
-    /// why the bounds are validated rather than clamped upstream, and
-    /// why completeness needs no extra machinery: a Merk range proof
-    /// over a sorted keyspace commits its boundaries, so an in-range
-    /// group the server omitted fails reconstruction.
+    /// client reconstructs the platform root hash from it. The bounds,
+    /// direction and limit bind by RECONSTRUCTION: the verifier rebuilds
+    /// the same `Bounded` axis `PathQuery` from the request
+    /// ([`AxisRangeBounds::inclusive_bounds_i128`]) and re-executes the
+    /// proof against it — which is why the bounds are validated rather
+    /// than clamped upstream, and why completeness needs no extra
+    /// machinery: a Merk range proof over a sorted keyspace commits its
+    /// boundaries, so an in-range group the server omitted fails
+    /// reconstruction.
     ///
     /// Verified by
     /// [`DriveDocumentHavingQuery::verify_having_range_proof`](crate::query::DriveDocumentHavingQuery::verify_having_range_proof).
@@ -142,35 +148,65 @@ impl DriveDocumentHavingQuery<'_> {
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<Vec<u8>, Error> {
-        let grove_version = &platform_version.drive.grove_version;
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
-        let secondary_query = self.bounds.merk_query(self.descending);
+        // Same fail-closed rule as the ranked prover: grovedb's
+        // `prove_query` proves committed state only and cannot see the
+        // caller's transaction — single-prefix and branched alike.
+        if transaction.is_some() {
+            return Err(Error::Drive(DriveError::NotSupported(
+                "a having-range proof is generated from committed state only: grovedb's \
+                 prove_query cannot see the caller's transaction — commit first",
+            )));
+        }
+        if self.prefix_branches.len() > 1 {
+            // One grovedb **branched** envelope — see the ranked
+            // executor's multi-branch arm for the shape.
+            let grove_version = &platform_version.drive.grove_version;
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let (prefix, keys, suffix) = decompose_branch_paths(&paths)?;
+            let (lo, hi) = self.bounds.inclusive_bounds_i128();
+            let path_query = PathQuery::new_branched_axis(
+                prefix,
+                keys,
+                suffix,
+                AxisQuery::bounded(
+                    self.bounds.axis().into(),
+                    lo,
+                    hi,
+                    self.limit,
+                    self.descending,
+                ),
+            );
+            let CostContext { value, cost: _ } =
+                drive.grove.prove_query(&path_query, None, grove_version);
+            return value.map_err(|e| Error::GroveDB(Box::new(e)));
+        }
+        self.execute_range_with_proof_branch(0, drive, platform_version)
+    }
 
+    /// One branch's proof — the entire pre-`IN` prover, parameterized by
+    /// the prefix branch.
+    fn execute_range_with_proof_branch(
+        &self,
+        branch: usize,
+        drive: &Drive,
+        platform_version: &PlatformVersion,
+    ) -> Result<Vec<u8>, Error> {
+        let grove_version = &platform_version.drive.grove_version;
+        let path = self.indexed_property_name_tree_path(branch)?;
+        let (lo, hi) = self.bounds.inclusive_bounds_i128();
+        let path_query = PathQuery::new_axis_bounded(
+            path,
+            self.bounds.axis().into(),
+            lo,
+            hi,
+            self.limit,
+            self.descending,
+        );
         // Same destructure-don't-unwrap rationale as the no-proof arm.
-        let CostContext { value, cost: _ } = match self.bounds.axis() {
-            RankedAxis::Count => drive.grove.prove_indexed_count_query(
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
-                transaction,
-                grove_version,
-            ),
-            RankedAxis::Sum => drive.grove.prove_indexed_sum_query(
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
-                transaction,
-                grove_version,
-            ),
-            RankedAxis::Avg => drive.grove.prove_indexed_avg_query(
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
-                transaction,
-                grove_version,
-            ),
-        };
+        let CostContext { value, cost: _ } =
+            drive.grove.prove_query(&path_query, None, grove_version);
         value.map_err(|e| Error::GroveDB(Box::new(e)))
     }
 }
diff --git a/packages/rs-drive/src/query/drive_document_having_query/mod.rs b/packages/rs-drive/src/query/drive_document_having_query/mod.rs
index f0418fc798a..8efc4949d87 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/mod.rs
@@ -37,13 +37,14 @@
 //! rank `offset`); having-range addresses them by **value bound**
 //! (`aggregate ∈ [lo, hi]`). Three consequences:
 //!
-//! 1. **The bound is part of the proof contract.** The grovedb envelope
-//!    for a range read echoes the Merk query itself, and the verifier
-//!    re-builds that query from the request's bounds
-//!    ([`AxisRangeBounds::merk_query`]) — so prover and verifier must
-//!    share one bounds-to-query translation, exactly as they share the
-//!    grove path. Completeness comes from the Merk range proof: the
-//!    boundary commitments show no in-range group was omitted.
+//! 1. **The bound is part of the proof contract.** Prover and verifier
+//!    build the same `Bounded` axis `PathQuery` from the request's
+//!    inclusive bounds ([`AxisRangeBounds::inclusive_bounds_i128`]),
+//!    and grovedb re-executes the proof against that traversal — so the
+//!    two sides share one bounds-to-query translation, exactly as they
+//!    share the grove path. Completeness comes from the Merk range
+//!    proof: the boundary commitments show no in-range group was
+//!    omitted.
 //! 2. **No `OFFSET`, no `start_at` — and no full pagination.** The
 //!    range primitives take a limit but no skip, and a request carrying
 //!    either knob is rejected loudly. A page cut at `limit` can only be
@@ -65,21 +66,21 @@
 #[cfg(any(feature = "server", feature = "verify"))]
 use dpp::data_contract::document_type::{DocumentTypeRef, Index};
 #[cfg(any(feature = "server", feature = "verify"))]
-use dpp::platform_value::Value;
-#[cfg(any(feature = "server", feature = "verify"))]
 use dpp::version::PlatformVersion;
 #[cfg(any(feature = "server", feature = "verify"))]
 use std::collections::BTreeMap;
 
 #[cfg(any(feature = "server", feature = "verify"))]
 use super::drive_document_ranked_query::index_picker::{
-    encode_equality_prefix_values, find_ranked_index_for_axis, no_covering_index_message,
+    encode_prefix_branches, find_ranked_index_for_axis, no_covering_index_message,
 };
 #[cfg(any(feature = "server", feature = "verify"))]
 use super::drive_document_ranked_query::{
-    path::indexed_property_name_tree_path_for_index, RankedAxis,
+    path::indexed_property_name_tree_path_for_index, PrefixPin, RankedAxis,
 };
 #[cfg(any(feature = "server", feature = "verify"))]
+use crate::error::drive::DriveError;
+#[cfg(any(feature = "server", feature = "verify"))]
 use crate::error::query::QuerySyntaxError;
 #[cfg(any(feature = "server", feature = "verify"))]
 use crate::error::Error;
@@ -109,8 +110,9 @@ mod tests;
 /// rationale as [`super::drive_document_ranked_query::MAX_RANKED_LIMIT`]:
 /// the proof commits one secondary entry per returned group, so proof
 /// bytes grow linearly in the limit, and the ceiling is a hard rejection
-/// rather than a clamp because the limit is echoed in the proof envelope
-/// and re-checked by the verifier.
+/// rather than a clamp because the limit is part of the traversal the
+/// verifier re-executes: a server-side clamp would truncate the walk
+/// and fail coverage under the client's own reconstruction.
 #[cfg(any(feature = "server", feature = "verify"))]
 pub const MAX_HAVING_LIMIT: u16 = 100;
 
@@ -163,6 +165,18 @@ impl AxisRangeBounds {
         }
     }
 
+    /// The bounds as inclusive `i128` values in the axis's own domain —
+    /// the form `AxisTraversal::Bounded` carries in the unified
+    /// `PathQuery`. Count and sum widen losslessly; avg is already
+    /// `i128` fixed point.
+    pub fn inclusive_bounds_i128(&self) -> (i128, i128) {
+        match *self {
+            AxisRangeBounds::Count { lo, hi } => (lo as i128, hi as i128),
+            AxisRangeBounds::Sum { lo, hi } => (lo as i128, hi as i128),
+            AxisRangeBounds::Avg { lo, hi } => (lo, hi),
+        }
+    }
+
     /// The bounds as a byte range over the axis secondary's keyspace:
     /// `(inclusive_lower, exclusive_upper)`, with `None` for an upper
     /// bound at the axis's type maximum (no representable successor —
@@ -223,7 +237,7 @@ impl AxisRangeBounds {
 /// Produced by [`mode_detection::detect_having_mode`]. Parallels
 /// [`super::drive_document_ranked_query::DocumentRankedMode`].
 ///
-/// Not `Eq`: the equality pins carry [`Value`]s, whose float variant
+/// Not `Eq`: the prefix pins carry [`Value`]s, whose float variant
 /// keeps the type at `PartialEq`.
 #[derive(Debug, Clone, PartialEq)]
 #[cfg(any(feature = "server", feature = "verify"))]
@@ -243,11 +257,14 @@ pub struct DocumentHavingMode {
     /// The field the aggregate applies to. Empty for `COUNT(*)`; the
     /// index's `summable` property for `SUM` / `AVG`.
     pub aggregate_field: String,
-    /// The equality `where` pins, `(property, value)` per clause —
-    /// exactly one per leading property of the covering compound index,
-    /// in request order (the resolver re-orders them into index order
-    /// when it encodes the path). Empty for the single-property form.
-    pub equality_pins: Vec<(String, Value)>,
+    /// The `where` prefix pins — one [`PrefixPin`] per clause, exactly
+    /// one per leading property of the covering compound index, in
+    /// request order (the resolver re-orders them into index order when
+    /// it encodes the path). A pin normally carries one value (an `==`
+    /// clause); at most one pin carries several (the single permitted
+    /// branching `IN`, whose elements fan the bound out across one
+    /// prefix branch each). Empty for the single-property form.
+    pub prefix_pins: Vec<PrefixPin>,
 }
 
 /// A resolved having-range query. Shared by the prover and the verifier —
@@ -267,15 +284,18 @@ pub struct DriveDocumentHavingQuery<'a> {
     pub document_type_name: String,
     /// The covering ranked index. Its **last** property is the `GROUP
     /// BY` property and the final path segment; any leading properties
-    /// are pinned by [`Self::equality_prefix_values`].
+    /// are pinned by [`Self::prefix_branches`].
     pub index: &'a Index,
-    /// Encoded index-key bytes of each leading index property's pinned
-    /// value, in index-property order — empty for a single-property
-    /// index. Part of the prover/verifier agreement exactly as on the
-    /// ranked surface: the segments feed straight into the shared path
-    /// builder. Produced by
-    /// [`super::drive_document_ranked_query::index_picker::encode_equality_prefix_values`].
-    pub equality_prefix_values: Vec<Vec<u8>>,
+    /// The prefix **branches** — one inner `Vec<Vec<u8>>` of encoded
+    /// path segments per branch, in index-property order; always at
+    /// least one branch, several exactly when the request carried a
+    /// multi-element `IN` pin. Part of the prover/verifier agreement
+    /// exactly as on the ranked surface. Produced by
+    /// [`super::drive_document_ranked_query::index_picker::encode_prefix_branches`]
+    /// — crate-private so the resolver is the only public constructor
+    /// and the encoder's invariants hold on every externally obtainable
+    /// value.
+    pub(crate) prefix_branches: Vec<Vec<Vec<u8>>>,
     /// Inclusive bounds on the aggregate. Carry the axis; the index must
     /// declare the matching `ranked_*` flag.
     pub bounds: AxisRangeBounds,
@@ -297,17 +317,35 @@ pub struct DriveDocumentHavingQuery<'a> {
 
 #[cfg(any(feature = "server", feature = "verify"))]
 impl DriveDocumentHavingQuery<'_> {
-    /// Path of the terminal property-name tree the axis secondary hangs
-    /// off — identical to the ranked surface's path (including the
-    /// pinned-prefix segments of a compound index), because both read
-    /// the same indexed tree. See
+    /// The resolved prefix branches, in canonical order — one per `IN`
+    /// element (a single branch without an `IN`). Read-only: the field is
+    /// crate-private so the resolver's encoder invariants cannot be
+    /// bypassed by construction or mutation.
+    pub fn prefix_branches(&self) -> &[Vec<Vec<u8>>] {
+        &self.prefix_branches
+    }
+}
+
+#[cfg(any(feature = "server", feature = "verify"))]
+impl DriveDocumentHavingQuery<'_> {
+    /// Path of one branch's terminal property-name tree — identical to
+    /// the ranked surface's path (including the pinned-prefix segments
+    /// of a compound index), because both read the same indexed
+    /// tree(s). See
     /// [`DriveDocumentRankedQuery::indexed_property_name_tree_path`](super::drive_document_ranked_query::DriveDocumentRankedQuery::indexed_property_name_tree_path).
-    pub fn indexed_property_name_tree_path(&self) -> Result<Vec<Vec<u8>>, Error> {
+    pub fn indexed_property_name_tree_path(&self, branch: usize) -> Result<Vec<Vec<u8>>, Error> {
+        let prefix_values =
+            self.prefix_branches
+                .get(branch)
+                .ok_or(Error::Drive(DriveError::NotSupported(
+                    "ranked and having-range queries addressed a prefix branch outside the \
+                 query's resolved branch set",
+                )))?;
         indexed_property_name_tree_path_for_index(
             &self.contract_id,
             &self.document_type_name,
             self.index,
-            &self.equality_prefix_values,
+            prefix_values,
         )
     }
 }
@@ -315,8 +353,9 @@ impl DriveDocumentHavingQuery<'_> {
 /// Resolve a validated [`DocumentHavingMode`] against a document type's
 /// indexes into the executable [`DriveDocumentHavingQuery`]: pick the
 /// covering index (shared with the ranked surface — both read the same
-/// indexed tree), encode the equality pins into prefix-value path
-/// segments, and assemble the query.
+/// indexed tree), encode the prefix pins into prefix **branches** (one
+/// branch for all-`==` pins, one branch per element of the single
+/// permitted `IN`), and assemble the query.
 ///
 /// The **one** resolution path for the having surface, mirroring
 /// [`super::drive_document_ranked_query::index_picker::resolve_ranked_query_for_mode`]:
@@ -338,9 +377,9 @@ pub fn resolve_having_query_for_mode<'a>(
 ) -> Result<DriveDocumentHavingQuery<'a>, Error> {
     let axis = mode.bounds.axis();
     let pin_fields: Vec<String> = mode
-        .equality_pins
+        .prefix_pins
         .iter()
-        .map(|(field, _)| field.clone())
+        .map(|pin| pin.field.clone())
         .collect();
     let index = find_ranked_index_for_axis(
         indexes,
@@ -355,19 +394,19 @@ pub fn resolve_having_query_for_mode<'a>(
                 "having-range",
                 axis,
                 &mode.group_by_property,
-                &mode.equality_pins,
+                &mode.prefix_pins,
                 &mode.aggregate_field,
             ),
         ))
     })?;
-    let equality_prefix_values =
-        encode_equality_prefix_values(document_type, index, &mode.equality_pins, platform_version)?;
+    let prefix_branches =
+        encode_prefix_branches(document_type, index, &mode.prefix_pins, platform_version)?;
     Ok(DriveDocumentHavingQuery {
         document_type,
         contract_id,
         document_type_name,
         index,
-        equality_prefix_values,
+        prefix_branches,
         bounds: mode.bounds,
         descending: mode.descending,
         limit: mode.limit,
diff --git a/packages/rs-drive/src/query/drive_document_having_query/mode_detection/mod.rs b/packages/rs-drive/src/query/drive_document_having_query/mode_detection/mod.rs
index 274dda5a872..957f69ee608 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/mode_detection/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/mode_detection/mod.rs
@@ -8,8 +8,9 @@
 //! indexes. Available under `server` and `verify` for the same reason as
 //! [`super::super::drive_document_ranked_query::mode_detection`]: both
 //! sides must agree on which requests are well-formed and on the exact
-//! bounds a well-formed one resolves to, because the bounds are echoed
-//! (as a Merk query) inside the proof envelope.
+//! bounds a well-formed one resolves to, because the verifier rebuilds
+//! the bounded traversal from those bounds and re-executes the proof
+//! against it.
 //!
 //! Versioned through
 //! `platform_version.drive.methods.document.query.detect_having_mode` —
diff --git a/packages/rs-drive/src/query/drive_document_having_query/mode_detection/v0/mod.rs b/packages/rs-drive/src/query/drive_document_having_query/mode_detection/v0/mod.rs
index 9cefa259130..4bcfe7fbf8d 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/mode_detection/v0/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/mode_detection/v0/mod.rs
@@ -7,7 +7,7 @@ use super::{AxisRangeBounds, DocumentHavingMode, MAX_HAVING_LIMIT};
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::drive_document_ranked_query::mode_detection::{
-    equality_pins_from_where_clauses, ranked_order_key,
+    prefix_pins_from_where_clauses, ranked_order_key,
 };
 use crate::query::drive_document_ranked_query::{RankedAxis, RankedPaginationInputs};
 use crate::query::having::{
@@ -29,10 +29,12 @@ use grovedb::element::indexed::AVG_FIXED_POINT_SCALE;
 /// ```
 ///
 /// with no `OFFSET`, no `START AT` / `START AFTER`, exactly one
-/// `GROUP BY` property, `WHERE` clauses (when present) that are
-/// equality pins on distinct properties — one per leading property of a
-/// covering compound ranked index, selecting which prefix's secondary
-/// the bound reads — exactly one `HAVING` clause whose aggregate
+/// `GROUP BY` property, `WHERE` clauses (when present) that pin the
+/// covering compound ranked index's leading properties — one clause per
+/// property, each an equality except that **at most one** clause may be
+/// an `IN` whose elements fan the bound out across one prefix branch
+/// per element (merged deterministically; see the ranked surface's
+/// `prefix_pins_from_where_clauses`) — exactly one `HAVING` clause whose aggregate
 /// **is the selected aggregate** (same function, same field), an operator
 /// from the contiguous-range family (`=`, `>`, `>=`, `<`, `<=`, and the
 /// four `BETWEEN*` variants — `!=` and `IN` describe non-contiguous
@@ -79,13 +81,15 @@ pub fn detect_having_mode_v0(
     // covering index's LAST property, whose distinct values are the
     // secondary's group keys. A compound ranked index filters each
     // prefix's groups separately — its leading properties are pinned by
-    // equality `where` clauses, never grouped over.
+    // `where` clauses (`==`, at most one of them a bounded `IN`), never
+    // grouped over.
     if group_by.len() != 1 {
         return Err(Error::Query(QuerySyntaxError::InvalidParameter(format!(
             "having-range queries require exactly one `group_by` property (the covering \
              ranked index's trailing property); got {}. A compound ranked index bounds \
-             each prefix's groups separately — pin every leading index property with an \
-             equality `where` clause and `group_by` the trailing property.",
+             each prefix's groups separately — pin every leading index property with a \
+             `where` clause (`==`, or a bounded `IN` on at most one of them) and \
+             `group_by` the trailing property.",
             group_by.len()
         ))));
     }
@@ -237,28 +241,29 @@ pub fn detect_having_mode_v0(
         }
     };
 
-    // ---- WHERE: equality pins on the compound prefix ------------------
+    // ---- WHERE: pins on the compound prefix ---------------------------
     //
     // Identical contract to the ranked surface: empty for the
-    // single-property form; for a compound ranked index, one equality
-    // pin per leading property selects which prefix's secondary the
-    // bound reads. Shape-only here; the index picker enforces the
-    // exact-cover rule.
-    let equality_pins = equality_pins_from_where_clauses(where_clauses)?;
+    // single-property form; for a compound ranked index, one pin per
+    // leading property — `==`, except at most one bounded branching
+    // `IN` — selects which prefix secondary or secondaries the bound
+    // reads. Shape-only here; the index picker enforces the exact-cover
+    // rule.
+    let prefix_pins = prefix_pins_from_where_clauses(where_clauses)?;
 
     // ---- LIMIT: required, 1 ..= MAX_HAVING_LIMIT ---------------------
     //
     // Required rather than defaulted for the same reason as ranked: the
-    // limit is echoed inside the proof envelope and re-checked by the
-    // verifier, so there is no server default a client could reproduce.
+    // limit is part of the traversal the verifier re-executes the proof
+    // against, so there is no server default a client could reproduce.
     // Required *especially* here, because a threshold can match
     // unboundedly many groups.
     let limit = pagination.limit.ok_or_else(|| {
         Error::Query(QuerySyntaxError::InvalidLimit(format!(
             "having-range queries require an explicit `limit` (1 ..= {MAX_HAVING_LIMIT}): \
              a bound can match any number of groups, the walk stops at `limit`, and the \
-             limit is echoed in the proof envelope and re-checked by the verifier, so \
-             there is no server-side default a client could reproduce."
+             verifier re-executes the proof under the limit it rebuilds from the request, \
+             so there is no server-side default a client could reproduce."
         )))
     })?;
     if limit == 0 {
@@ -270,9 +275,10 @@ pub fn detect_having_mode_v0(
         return Err(Error::Query(QuerySyntaxError::InvalidLimit(format!(
             "`LIMIT {limit}` exceeds the having-range ceiling of {MAX_HAVING_LIMIT}; the \
              proof commits one secondary entry per returned group, so its size grows \
-             linearly in the limit. The ceiling is a hard limit, not a clamp, because the \
-             limit is echoed in the proof envelope and re-checked by the verifier. Narrow \
-             the bound to shrink the result set."
+             linearly in the limit. The ceiling is a hard limit, not a clamp, because \
+             the limit is part of the traversal the client rebuilds to verify — a clamped \
+             walk is one the client's reconstruction did not ask for. Narrow the bound to \
+             shrink the result set."
         ))));
     }
     // Bounded by MAX_HAVING_LIMIT (a u16) immediately above.
@@ -312,7 +318,7 @@ pub fn detect_having_mode_v0(
         limit,
         group_by_property,
         aggregate_field,
-        equality_pins,
+        prefix_pins,
     })
 }
 
diff --git a/packages/rs-drive/src/query/drive_document_having_query/tests.rs b/packages/rs-drive/src/query/drive_document_having_query/tests.rs
index 9bfd3277323..7123569eee2 100644
--- a/packages/rs-drive/src/query/drive_document_having_query/tests.rs
+++ b/packages/rs-drive/src/query/drive_document_having_query/tests.rs
@@ -336,7 +336,7 @@ mod grammar {
         let message = format!("{error}");
         assert!(
             message.contains("exactly one `group_by` property")
-                && message.contains("equality `where` clause"),
+                && message.contains("pin every leading index property"),
             "the rejection must steer to the pinned-prefix form, got: {error}"
         );
     }
@@ -759,6 +759,7 @@ mod execution {
                 having: &having,
                 order_by: &order_by,
                 where_clauses: &[],
+                resolved_time_ranges: &[],
                 limit: case.limit,
                 offset: None,
                 has_start_at: false,
@@ -1047,25 +1048,19 @@ mod execution {
     fn an_empty_match_set_reads_empty_and_proves_empty() {
         let (drive, contract) = setup_restaurants();
 
-        // Empty secondary (no documents at all): the unproven read
-        // returns the empty list, but grovedb's range prover — unlike
-        // the ranked surface's paginated prover — has no absence-proof
-        // shape for a completely empty tree and refuses. drive-abci
-        // maps this exact failure class onto an `InvalidArgument`
-        // telling the caller to retry unproved
-        // (`empty_ranking_proof_rejection`); at the drive level it
-        // surfaces as the grovedb error asserted here. If a future
-        // grovedb pin makes empty range proofs work, this arm should
-        // flip to a round-trip assertion.
+        // Empty secondary (no documents at all): both the unproven read
+        // and — since the unified PathQuery prover replaced grovedb's
+        // standalone range prover — the PROVED read serve the empty
+        // answer: the envelope commits the element's empty secondary
+        // (NULL_HASH convention), so complete absence is authenticated
+        // rather than refused, exactly as on the ranked surface. (The
+        // retired standalone prover refused with "Cannot create proof
+        // for empty tree"; drive-abci's InvalidArgument mapping for
+        // that class is vestigial on this surface now.)
         let case = HavingCase::count(HavingOperator::GreaterThan, Value::U64(100), 10);
         let entries = entries_of(run(&drive, &contract, &case, false).expect("read succeeds"));
         assert!(entries.is_empty());
-        let error = run(&drive, &contract, &case, true)
-            .expect_err("proving against an empty secondary is refused by grovedb");
-        assert!(
-            format!("{error}").contains("Cannot create proof for empty tree"),
-            "the failure must be the recognized empty-tree class, got: {error}"
-        );
+        assert_proof_round_trips(&drive, &contract, &case, &entries);
 
         // Populated secondary, bound above every count: a genuine
         // absence proof, which works — the tree has content to anchor
@@ -1145,11 +1140,36 @@ mod execution {
             .verify_having_range_proof(&proof, platform_version())
             .is_err());
 
+        // The limit is a CAP, not an identity parameter: the unified
+        // verifier re-executes the proof under the queried limit rather
+        // than comparing echoes, so a proof whose walk EXHAUSTED the
+        // bound (one entry here) is a complete, valid answer under any
+        // cap that admits it — the `limit 10` proof verifies under
+        // `limit 5` too, and that is sound.
         tampered_query = client_side_query(&contract, &over_two);
         tampered_query.limit = 5;
-        assert!(tampered_query
-            .verify_having_range_proof(&proof, platform_version())
-            .is_err());
+        assert!(
+            tampered_query
+                .verify_having_range_proof(&proof, platform_version())
+                .is_ok(),
+            "an exhausted-walk proof is a complete answer under a smaller cap too"
+        );
+
+        // What must NOT verify is the truncation direction: a proof cut
+        // by a SMALLER limit (2 of the 3 groups matching `> 0`, with
+        // more in range) misrepresents completeness under a larger cap,
+        // and the reconstruction rejects it for missing coverage of the
+        // rest of the bound.
+        let truncated = HavingCase::count(HavingOperator::GreaterThan, Value::U64(0), 2);
+        let truncated_proof =
+            proof_of(run(&drive, &contract, &truncated, true).expect("prove succeeds"));
+        let widened = HavingCase::count(HavingOperator::GreaterThan, Value::U64(0), 10);
+        assert!(
+            client_side_query(&contract, &widened)
+                .verify_having_range_proof(&truncated_proof, platform_version())
+                .is_err(),
+            "a limit-truncated proof must not verify under a larger cap"
+        );
     }
 
     /// A `having` on an axis no index declares is refused with the
@@ -1379,6 +1399,7 @@ mod identifier_group_keys {
                     having: &having,
                     order_by,
                     where_clauses: &[],
+                    resolved_time_ranges: &[],
                     limit: Some(10),
                     offset: None,
                     has_start_at: false,
@@ -1496,10 +1517,12 @@ mod identifier_group_keys {
             entries,
             vec![
                 RankedEntry {
+                    in_key: None,
                     key: just_above.to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(161, 2)),
                 },
                 RankedEntry {
+                    in_key: None,
                     key: well_above.to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(180, 2)),
                 },
@@ -1672,6 +1695,7 @@ mod pinned_prefix {
                 having: &having,
                 order_by,
                 where_clauses,
+                resolved_time_ranges: &[],
                 limit: Some(10),
                 offset: None,
                 has_start_at: false,
@@ -1817,10 +1841,12 @@ mod pinned_prefix {
             entries,
             vec![
                 RankedEntry {
+                    in_key: None,
                     key: b"english".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(161, 2)),
                 },
                 RankedEntry {
+                    in_key: None,
                     key: b"art".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(180, 2)),
                 },
@@ -1852,10 +1878,12 @@ mod pinned_prefix {
             y_entries,
             vec![
                 RankedEntry {
+                    in_key: None,
                     key: b"math".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(185, 2)),
                 },
                 RankedEntry {
+                    in_key: None,
                     key: b"science".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(190, 2)),
                 },
@@ -1888,34 +1916,59 @@ mod pinned_prefix {
         }
     }
 
-    /// `IN` on the prefix is rejected at detection with the
-    /// not-yet-supported message (v1 pins are equality-only), and a pin
-    /// on a property that is not the index's leading property fails
-    /// resolution.
+    /// `IN` on the leading prefix property resolves to one branch per
+    /// element, each bounded separately and merged (entries carrying
+    /// `in_key`), while a pin on a property that is not the index's
+    /// leading property still fails resolution.
     #[test]
-    fn in_prefix_and_wrong_pins_are_rejected() {
+    fn in_prefix_merges_branches_and_wrong_pins_are_rejected() {
         let (drive, contract) = setup_grades_compound_ranked();
         insert_two_identities(&drive, &contract);
 
+        // `identityId IN [X, Y]` bounds each identity's own secondary
+        // and merges: ascending aggregate order, with every X entry
+        // (in_key = X's 32 bytes, all `1`s) sorting before Y's on the
+        // branch tie-break where aggregates tie. Bound is AVG > 80.
         let in_clause = vec![WhereClause {
             field: PREFIX_PROPERTY.to_string(),
             operator: WhereOperator::In,
             value: Value::Array(vec![
-                Value::Identifier(IDENTITY_X),
                 Value::Identifier(IDENTITY_Y),
+                Value::Identifier(IDENTITY_X),
             ]),
         }];
-        let error = run(&drive, &contract, &in_clause, &[], false)
-            .expect_err("IN prefixes are not yet supported");
-        match error {
-            Error::Query(QuerySyntaxError::Unsupported(message)) => {
-                assert!(
-                    message.contains("IN") && message.contains("not yet supported"),
-                    "the IN rejection must say it is a not-yet capability, got: {message}"
-                );
-            }
-            other => panic!("expected Unsupported for an IN prefix, got {other:?}"),
-        }
+        let entries = entries_of(
+            run(&drive, &contract, &in_clause, &[], false).expect("the IN bound is served"),
+        );
+        assert_eq!(
+            entries,
+            vec![
+                RankedEntry {
+                    in_key: Some(IDENTITY_X.to_vec()),
+                    key: b"english".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(161, 2)),
+                },
+                RankedEntry {
+                    in_key: Some(IDENTITY_X.to_vec()),
+                    key: b"art".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(180, 2)),
+                },
+                RankedEntry {
+                    in_key: Some(IDENTITY_Y.to_vec()),
+                    key: b"math".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(185, 2)),
+                },
+                RankedEntry {
+                    in_key: Some(IDENTITY_Y.to_vec()),
+                    key: b"science".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(190, 2)),
+                },
+            ],
+            "the merged bound: X's english 80.5 and art 90, then Y's math \
+             92.5 and science 95, in ascending aggregate order with \
+             branch-tagged entries — element order in the request must \
+             not matter"
+        );
 
         // A pin on the wrong property: `grade` is not the index's
         // leading property, so nothing covers [grade, class].
@@ -2030,6 +2083,7 @@ mod pinned_prefix {
             having: &having,
             order_by: &[],
             where_clauses: &null_pin,
+            resolved_time_ranges: &[],
             limit: Some(10),
             offset: None,
             has_start_at: false,
@@ -2049,6 +2103,7 @@ mod pinned_prefix {
         assert_eq!(
             entries,
             vec![RankedEntry {
+                in_key: None,
                 key: b"math".to_vec(),
                 value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(170, 2)),
             }],
@@ -2091,8 +2146,8 @@ mod pinned_prefix {
         )
         .expect("the compound index covers the null-pinned request");
         assert_eq!(
-            query.equality_prefix_values,
-            vec![Vec::<u8>::new()],
+            query.prefix_branches,
+            vec![vec![Vec::<u8>::new()]],
             "a null pin must encode as the write path's empty segment"
         );
         let (root_hash, verified) = query
@@ -2108,4 +2163,194 @@ mod pinned_prefix {
                 .expect("root hash must be readable"),
         );
     }
+
+    /// A `null` element mixed with a real value in one `IN` pin: the
+    /// null branch is the write path's empty segment, which sorts
+    /// **first** in canonical branch order, and the merged bound covers
+    /// both subtrees — proved through the branched envelope.
+    #[test]
+    fn a_mixed_null_in_pin_bounds_both_prefixes_and_proves() {
+        const TAGGED_DOCTYPE: &str = "taggedGrade";
+        let (drive, contract) = setup_grades_compound_ranked();
+        let pv = platform_version();
+        let document_type = contract
+            .document_type_for_name(TAGGED_DOCTYPE)
+            .expect("taggedGrade doctype exists");
+
+        for (i, (tag, class, grade)) in [
+            (None, "math", 90i64),
+            (Some("honors"), "math", 95),
+            (Some("honors"), "art", 60),
+        ]
+        .iter()
+        .enumerate()
+        {
+            let mut doc: Document = document_type
+                .random_document(Some(9000 + i as u64), pv)
+                .expect("random document");
+            let mut props = BTreeMap::new();
+            if let Some(tag) = tag {
+                props.insert("tag".to_string(), Value::Text(tag.to_string()));
+            }
+            props.insert(GROUP_PROPERTY.to_string(), Value::Text(class.to_string()));
+            props.insert("grade".to_string(), Value::I64(*grade));
+            doc.set_properties(props);
+            drive
+                .add_document_for_contract(
+                    DocumentAndContractInfo {
+                        owned_document_info: OwnedDocumentInfo {
+                            document_info: DocumentRefInfo((&doc, None)),
+                            owner_id: None,
+                        },
+                        contract: &contract,
+                        document_type,
+                    },
+                    false,
+                    BlockInfo::default(),
+                    true,
+                    None,
+                    pv,
+                    None,
+                )
+                .expect("expected to insert a tagged grade document");
+        }
+
+        let mixed_pin = vec![WhereClause {
+            field: "tag".to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![Value::Text("honors".to_string()), Value::Null]),
+        }];
+        let group_by = vec![GROUP_PROPERTY.to_string()];
+        let having = vec![clause(
+            HavingAggregateFunction::Avg,
+            "grade",
+            HavingOperator::GreaterThan,
+            Value::U64(80),
+        )];
+        let request = |prove: bool| DocumentHavingRequest {
+            contract: &contract,
+            document_type,
+            group_by: &group_by,
+            select: SelectProjection::avg("grade"),
+            having: &having,
+            order_by: &[],
+            where_clauses: &mixed_pin,
+            resolved_time_ranges: &[],
+            limit: Some(10),
+            offset: None,
+            has_start_at: false,
+            prove,
+        };
+
+        let entries = match drive
+            .execute_document_having_request(request(false), None, pv)
+            .expect("the mixed-null IN bound is served")
+        {
+            DocumentHavingResponse::Entries(entries) => entries,
+            DocumentHavingResponse::Proof(_) => panic!("expected entries, got a proof"),
+        };
+        assert_eq!(
+            entries,
+            vec![
+                RankedEntry {
+                    in_key: Some(Vec::new()),
+                    key: b"math".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+                },
+                RankedEntry {
+                    in_key: Some(b"honors".to_vec()),
+                    key: b"math".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(95, 1)),
+                },
+            ],
+            "both prefixes' in-bound groups, ascending; the same group key \
+             appears twice, disambiguated by in_key, with the null branch's \
+             empty in_key present (not None)"
+        );
+
+        let proof = match drive
+            .execute_document_having_request(request(true), None, pv)
+            .expect("the mixed-null IN prove succeeds")
+        {
+            DocumentHavingResponse::Proof(proof) => proof,
+            DocumentHavingResponse::Entries(_) => panic!("expected a proof, got entries"),
+        };
+        let mode = detect_having_mode(
+            &SelectProjection::avg("grade"),
+            &group_by,
+            &having,
+            &[],
+            &mixed_pin,
+            RankedPaginationInputs {
+                limit: Some(10),
+                offset: None,
+                has_start_at: false,
+            },
+            pv,
+        )
+        .expect("the mixed-null case is well-formed");
+        let query = resolve_having_query_for_mode(
+            contract.id_ref().to_buffer(),
+            document_type,
+            TAGGED_DOCTYPE.to_string(),
+            contract
+                .document_types()
+                .get(TAGGED_DOCTYPE)
+                .expect("taggedGrade doctype exists")
+                .indexes(),
+            &mode,
+            pv,
+        )
+        .expect("the compound index covers the mixed-null request");
+        assert_eq!(
+            query.prefix_branches,
+            vec![vec![Vec::new()], vec![b"honors".to_vec()]],
+            "canonical branch order: the empty (null) segment first"
+        );
+        let (root_hash, verified) = query
+            .verify_having_range_proof(&proof, pv)
+            .expect("the mixed-null branched envelope must verify");
+        assert_eq!(verified, entries);
+        assert_eq!(
+            root_hash,
+            drive
+                .grove
+                .root_hash(None, &pv.drive.grove_version)
+                .unwrap()
+                .expect("root hash must be readable"),
+        );
+    }
+
+    /// The having sibling of the ranked surface's absent-element test:
+    /// `identityId IN [X, never-written]` bounds X's groups and treats
+    /// the absent branch as empty, on both the read and the proved
+    /// path.
+    #[test]
+    fn an_absent_in_element_contributes_an_empty_branch() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(&drive, &contract, 3000, &[(IDENTITY_X, "art", 90)]);
+
+        let never_written = [9u8; 32];
+        let pins = vec![WhereClause {
+            field: PREFIX_PROPERTY.to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![
+                Value::Identifier(IDENTITY_X),
+                Value::Identifier(never_written),
+            ]),
+        }];
+        let entries =
+            entries_of(run(&drive, &contract, &pins, &[], false).expect("the read succeeds"));
+        assert_eq!(
+            entries,
+            vec![RankedEntry {
+                in_key: Some(IDENTITY_X.to_vec()),
+                key: b"art".to_vec(),
+                value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+            }],
+            "only the existing branch is bounded; the absent one is empty, not an error"
+        );
+
+        assert_proof_round_trips(&drive, &contract, &pins, &[], &entries);
+    }
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/branches.rs b/packages/rs-drive/src/query/drive_document_ranked_query/branches.rs
new file mode 100644
index 00000000000..8f7e9c24bcb
--- /dev/null
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/branches.rs
@@ -0,0 +1,386 @@
+//! Branch mechanics for `IN`-pinned ranked / having-range queries —
+//! shared by the executors (walk one secondary per branch, merge) and
+//! the verifiers (verify one branched envelope, re-merge), so both
+//! sides implement one comparator and one grove-path decomposition.
+//!
+//! ## Why a merge needs no proof of its own
+//!
+//! Each branch's walk is proved complete inside one grovedb **branched
+//! envelope** (shared ancestor layers once, one multi-key proof at the
+//! branching level, one secondary proof per branch, one root hash),
+//! and the merged page is a *deterministic function* of the branch
+//! pages: any union entry that precedes a returned entry in the merge
+//! order is preceded, within its own branch, by fewer than `limit`
+//! entries — so it is in its branch's returned page. The union's first
+//! `limit` entries are therefore contained in the union of the branch
+//! pages, and re-merging verified branch pages reconstructs a
+//! complete, correctly ordered page. (This is the same argument for
+//! both surfaces: "first `limit` in merge order restricted to the
+//! branch" is top-k for ranked and the in-bound range prefix for
+//! having.)
+//!
+//! ## The merge order
+//!
+//! `(aggregate in walk direction, branch segment ascending, group key in
+//! walk direction)`. The middle term is the canonical branch tie-break:
+//! the **encoded** segment bytes of the branch's `IN` position, fixed
+//! ascending regardless of walk direction, independent of the caller's
+//! element order — which also makes `null` (the empty segment) sort
+//! first deterministically.
+
+use super::{RankedAxis, RankedEntry, RankedEntryValue};
+use crate::error::drive::DriveError;
+use crate::error::Error;
+use grovedb::operations::proof::indexed_axis::AxisEntries;
+#[cfg(feature = "server")]
+use grovedb::{
+    query_result_type::QueryResultType, AxisKeys, GroveDb, PathQuery, PathQueryRun, TransactionArg,
+};
+#[cfg(feature = "server")]
+use grovedb_costs::CostContext;
+#[cfg(feature = "server")]
+use grovedb_query::AxisQuery;
+#[cfg(feature = "server")]
+use grovedb_version::version::GroveVersion;
+use std::cmp::Ordering;
+
+/// The position (index into a branch's segment list) at which the
+/// branches differ — the `IN` pin's position in the covering index's
+/// leading properties. `None` when there is a single branch (no `IN`),
+/// or when branches are degenerate duplicates (the encoder rejects
+/// those, so it is unreachable off the resolver path).
+pub fn varying_position(branches: &[Vec<Vec<u8>>]) -> Option<usize> {
+    let first = branches.first()?;
+    for other in &branches[1..] {
+        for (position, (a, b)) in first.iter().zip(other.iter()).enumerate() {
+            if a != b {
+                return Some(position);
+            }
+        }
+    }
+    None
+}
+
+/// The `in_key` for one branch: the encoded segment at the varying
+/// position. `None` for single-branch queries — entries of an un-branched
+/// response carry no discriminator, keeping the shape byte-identical to
+/// the pre-`IN` surface.
+pub fn branch_in_key(branches: &[Vec<Vec<u8>>], branch: usize) -> Option<Vec<u8>> {
+    if branches.len() < 2 {
+        return None;
+    }
+    let position = varying_position(branches)?;
+    branches.get(branch)?.get(position).cloned()
+}
+
+/// Compare two entries' aggregates on the same axis. The executors and
+/// verifiers only ever merge entries of one axis, so a variant mismatch
+/// is corrupted state, reported rather than ordered.
+fn aggregate_cmp(a: &RankedEntryValue, b: &RankedEntryValue) -> Result<Ordering, Error> {
+    match (a, b) {
+        (RankedEntryValue::Count(a), RankedEntryValue::Count(b)) => Ok(a.cmp(b)),
+        (RankedEntryValue::Sum(a), RankedEntryValue::Sum(b)) => Ok(a.cmp(b)),
+        (RankedEntryValue::AvgFixedPoint(a), RankedEntryValue::AvgFixedPoint(b)) => Ok(a.cmp(b)),
+        _ => Err(Error::Drive(DriveError::CorruptedDriveState(
+            "branch merge compared entries from different aggregate axes".to_string(),
+        ))),
+    }
+}
+
+/// Merge per-branch pages into the final page: tag each entry with its
+/// branch's `in_key`, order by the merge comparator, cut at `limit`.
+///
+/// `per_branch` must be indexed identically to `branches` (the resolver
+/// produces both in canonical branch order). Branch pages arrive sorted
+/// by the walk; the merged set is small (≤ branches × limit), so a
+/// plain total sort is used instead of a k-way heap — simpler to keep
+/// byte-identical between server and verifier.
+pub fn merge_branch_pages(
+    per_branch: Vec<Vec<RankedEntry>>,
+    branches: &[Vec<Vec<u8>>],
+    descending: bool,
+    limit: usize,
+) -> Result<Vec<RankedEntry>, Error> {
+    let mut merged: Vec<RankedEntry> = Vec::with_capacity(per_branch.iter().map(Vec::len).sum());
+    for (branch, entries) in per_branch.into_iter().enumerate() {
+        let in_key = branch_in_key(branches, branch);
+        merged.extend(entries.into_iter().map(|mut entry| {
+            entry.in_key = in_key.clone();
+            entry
+        }));
+    }
+    let mut comparison_error: Option<Error> = None;
+    merged.sort_by(|a, b| {
+        let aggregate = match aggregate_cmp(&a.value, &b.value) {
+            Ok(ordering) => ordering,
+            Err(e) => {
+                comparison_error.get_or_insert(e);
+                Ordering::Equal
+            }
+        };
+        let directional = |ordering: Ordering| {
+            if descending {
+                ordering.reverse()
+            } else {
+                ordering
+            }
+        };
+        directional(aggregate)
+            .then_with(|| a.in_key.cmp(&b.in_key))
+            .then_with(|| directional(a.key.cmp(&b.key)))
+    });
+    if let Some(e) = comparison_error {
+        return Err(e);
+    }
+    merged.truncate(limit);
+    Ok(merged)
+}
+
+/// The `(shared prefix, branch keys, shared suffix)` decomposition of a
+/// branch path set — the triple `PathQuery::new_branched_axis` takes.
+pub type BranchPathDecomposition = (Vec<Vec<u8>>, Vec<Vec<u8>>, Vec<Vec<u8>>);
+
+/// Decompose per-branch grove paths into the `(shared prefix, branch
+/// keys, shared suffix)` triple grovedb's branched proof primitives
+/// take. The paths differ at exactly one segment position by
+/// construction (one `IN` pin); anything else is an internal
+/// resolution error.
+pub fn decompose_branch_paths(paths: &[Vec<Vec<u8>>]) -> Result<BranchPathDecomposition, Error> {
+    let first = paths.first().ok_or_else(|| {
+        Error::Drive(DriveError::CorruptedDriveState(
+            "branch decomposition over zero paths".to_string(),
+        ))
+    })?;
+    let mut varying: Option<usize> = None;
+    for other in &paths[1..] {
+        if other.len() != first.len() {
+            return Err(Error::Drive(DriveError::CorruptedDriveState(
+                "branch paths of different lengths".to_string(),
+            )));
+        }
+        for (position, (a, b)) in first.iter().zip(other.iter()).enumerate() {
+            if a != b {
+                match varying {
+                    None => varying = Some(position),
+                    Some(existing) if existing == position => {}
+                    Some(_) => {
+                        return Err(Error::Drive(DriveError::CorruptedDriveState(
+                            "branch paths differ at more than one segment".to_string(),
+                        )));
+                    }
+                }
+            }
+        }
+    }
+    let position = varying.ok_or_else(|| {
+        Error::Drive(DriveError::CorruptedDriveState(
+            "branch paths are identical; the encoder rejects duplicate branches".to_string(),
+        ))
+    })?;
+    let prefix = first[..position].to_vec();
+    let keys = paths
+        .iter()
+        .map(|path| path[position].clone())
+        .collect::<Vec<_>>();
+    let suffix = first[position + 1..].to_vec();
+    Ok((prefix, keys, suffix))
+}
+
+/// Translate one branch's keys-only [`AxisKeys`] page into drive entries
+/// on the requested axis — the unproved twin of [`axis_entries_to_ranked`],
+/// used by the single-snapshot branched reads.
+#[cfg(feature = "server")]
+pub(crate) fn axis_keys_to_ranked(
+    axis: RankedAxis,
+    keys: AxisKeys,
+) -> Result<Vec<RankedEntry>, Error> {
+    match (axis, keys) {
+        (RankedAxis::Count, AxisKeys::Count(pairs)) => Ok(pairs
+            .into_iter()
+            .map(|(count, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::Count(count),
+            })
+            .collect()),
+        (RankedAxis::Sum, AxisKeys::Sum(pairs)) => Ok(pairs
+            .into_iter()
+            .map(|(sum, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::Sum(sum),
+            })
+            .collect()),
+        (RankedAxis::Avg, AxisKeys::Avg(pairs)) => Ok(pairs
+            .into_iter()
+            .map(|(avg, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::AvgFixedPoint(avg),
+            })
+            .collect()),
+        (axis, _) => Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+            "a branch of a {axis:?} read returned keys of a different axis shape"
+        )))),
+    }
+}
+
+/// The entire unproved branched-read sequence, shared by the ranked and
+/// having-range executors so the read/prove contract has exactly ONE
+/// implementation: decompose the branch paths, run one branched
+/// keys-only grovedb call, validate the run shape and the branch-set
+/// identity, translate and cap each branch's page, and merge with the
+/// shared comparator.
+///
+/// The union is served from **one committed state**: the call always
+/// runs under a grovedb snapshot read transaction taken here, so every
+/// per-branch absence probe and axis walk inside grovedb's branched arm
+/// reads the same RocksDB snapshot and a block commit landing mid-read
+/// cannot mix committed states into the merged page.
+///
+/// A caller-supplied transaction is **rejected**, mirroring the
+/// branched provers: an ordinary grovedb transaction reads the latest
+/// committed state on every operation, so forwarding it would reopen
+/// the exact tear the snapshot closes — and there is no way to tell an
+/// ordinary transaction from a snapshot-pinned one at this boundary.
+/// Transactional callers read per prefix element (each single-branch
+/// read is one grovedb operation and honors the transaction exactly),
+/// or commit first.
+///
+/// `page_cap` is the surface's page bound (`k` for ranked, `limit` for
+/// having-range): each branch may return at most that many entries and
+/// the merged union is cut at it. `surface` names the caller in the
+/// corrupted-state messages.
+#[cfg(feature = "server")]
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn read_branched_union(
+    grove: &GroveDb,
+    surface: &'static str,
+    prefix_branches: &[Vec<Vec<u8>>],
+    paths: &[Vec<Vec<u8>>],
+    axis: RankedAxis,
+    axis_query: AxisQuery,
+    page_cap: usize,
+    descending: bool,
+    transaction: TransactionArg,
+    grove_version: &GroveVersion,
+) -> Result<Vec<RankedEntry>, Error> {
+    if transaction.is_some() {
+        return Err(Error::Drive(DriveError::NotSupported(
+            "an IN-pinned (branched) unproved read under a caller transaction is not \
+             supported: an ordinary grovedb transaction reads the latest committed state on \
+             every operation, so a concurrent commit could tear the union across branches — \
+             read per prefix element under the transaction, or pass no transaction (the read \
+             then runs under an internal snapshot)",
+        )));
+    }
+    let (prefix, keys, suffix) = decompose_branch_paths(paths)?;
+    let path_query =
+        PathQuery::new_branched_axis(prefix, keys.clone(), suffix, axis_query.keys_only());
+    let snapshot_transaction = grove.start_snapshot_read_transaction();
+    // Test-only seam: lets a regression test land a commit deterministically
+    // INSIDE the window — after the snapshot is taken, before the read runs —
+    // proving the automatic snapshot selection on the production `None` path.
+    #[cfg(test)]
+    test_hooks::AFTER_BRANCHED_SNAPSHOT.with(|hook| {
+        if let Some(hook) = hook.borrow_mut().as_mut() {
+            hook();
+        }
+    });
+    let CostContext { value, cost: _ } = grove.run_path_query(
+        &path_query,
+        true,
+        true,
+        true,
+        QueryResultType::QueryKeyElementPairResultType,
+        Some(&snapshot_transaction),
+        grove_version,
+    );
+    let run = value.map_err(|e| Error::GroveDB(Box::new(e)))?;
+    let PathQueryRun::BranchedAxisKeys(branches) = run else {
+        return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+            "a branched keys-only {surface} read returned a non-branched shape"
+        ))));
+    };
+    if branches.len() != keys.len() || branches.iter().map(|(key, _)| key).ne(keys.iter()) {
+        return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+            "a branched {surface} read returned a different branch set than the request resolved"
+        ))));
+    }
+    let per_branch = branches
+        .into_iter()
+        .map(|(_key, page)| {
+            let entries = match page {
+                None => Vec::new(),
+                Some(page) => axis_keys_to_ranked(axis, page)?,
+            };
+            if entries.len() > page_cap {
+                return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+                    "a branch of a {surface} read returned {} entries for a page cap of \
+                     {page_cap}",
+                    entries.len(),
+                ))));
+            }
+            Ok(entries)
+        })
+        .collect::<Result<Vec<_>, Error>>()?;
+    merge_branch_pages(per_branch, prefix_branches, descending, page_cap)
+}
+
+/// Translate one branch's verified [`AxisEntries`] into drive entries
+/// on the requested axis — the same mapping the single-path verifiers
+/// perform, shared here so both surfaces' branched verifiers agree.
+pub fn axis_entries_to_ranked(
+    axis: RankedAxis,
+    entries: AxisEntries,
+) -> Result<Vec<RankedEntry>, Error> {
+    match (axis, entries) {
+        (RankedAxis::Count, AxisEntries::Count(entries)) => Ok(entries
+            .into_iter()
+            .map(|entry| entry.key_pair())
+            .map(|(count, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::Count(count),
+            })
+            .collect()),
+        (RankedAxis::Sum, AxisEntries::Sum(entries)) => Ok(entries
+            .into_iter()
+            .map(|entry| entry.key_pair())
+            .map(|(sum, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::Sum(sum),
+            })
+            .collect()),
+        (RankedAxis::Avg, AxisEntries::Avg(entries)) => Ok(entries
+            .into_iter()
+            .map(|entry| entry.key_pair())
+            .map(|(avg, key)| RankedEntry {
+                in_key: None,
+                key,
+                value: RankedEntryValue::AvgFixedPoint(avg),
+            })
+            .collect()),
+        (axis, other) => Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+            "a branch of a {axis:?} proof verified to {} entries of a different axis shape",
+            other.len()
+        )))),
+    }
+}
+
+/// Test-only seam for [`read_branched_union`]: invoked after the
+/// internal snapshot transaction is taken and before the branched call
+/// runs, so a test can land a commit deterministically inside the
+/// window and prove the production `None` path's automatic snapshot
+/// selection end-to-end. Last in the file: clippy's
+/// `items_after_test_module` forbids items after a `#[cfg(test)]`
+/// module.
+#[cfg(test)]
+pub(crate) mod test_hooks {
+    use std::cell::RefCell;
+    thread_local! {
+        pub(crate) static AFTER_BRANCHED_SNAPSHOT: RefCell<Option<Box<dyn FnMut()>>> =
+            const { RefCell::new(None) };
+    }
+}
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_ranked_query/drive_dispatcher.rs
index 23bd902fe6e..bfba7788bef 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/drive_dispatcher.rs
@@ -17,9 +17,11 @@
 use super::mode_detection::detect_ranked_mode;
 use super::{RankedPage, RankedPaginationInputs};
 use crate::drive::Drive;
+use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::having::HavingClause;
 use crate::query::projection::SelectProjection;
+use crate::query::ResolvedTimeRange;
 use crate::query::{OrderClause, WhereClause};
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
@@ -61,9 +63,21 @@ pub struct DocumentRankedRequest<'a> {
     /// field); its direction is the ranking direction.
     pub order_by: &'a [OrderClause],
     /// Structured `where` clauses. Empty for the single-property form;
-    /// equality pins on the covering compound index's leading
-    /// properties for the pinned-prefix form.
+    /// pins on the covering compound index's leading properties for
+    /// the pinned-prefix form: one equality pin per property, of which
+    /// at most one may instead be a bounded `IN` (one branch per
+    /// element, merged; entries then carry `in_key`).
     pub where_clauses: &'a [WhereClause],
+    /// The fields among `where_clauses` whose equality clause was produced by
+    /// `IN_TIME_RANGE` resolution (see
+    /// [`crate::query::DriveDocumentQuery::resolved_time_ranges`]).
+    /// Must be empty: `where_clauses` must be empty, so there is nothing to
+    /// have resolved, and ranking over bucket keys is undesigned — a document
+    /// belongs to `overlap_factor` buckets at once, so it would contribute to
+    /// that many groups. Carried (and rejected) here for the same reason
+    /// `where_clauses` is: drive owns the rejection regardless of which
+    /// upstream path built the request.
+    pub resolved_time_ranges: &'a [ResolvedTimeRange],
     /// Request `limit` — the ranking's `k`. **Required**; there is no
     /// server default a verifying client could reproduce.
     pub limit: Option<u32>,
@@ -128,6 +142,19 @@ impl Drive {
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<DocumentRankedResponse, Error> {
+        // Unreachable behind the empty-`where_clauses` rule `detect_ranked_mode`
+        // enforces below — a resolved equality is a where clause — but stated
+        // here so the ranked surface's exclusion of bucketed indexes is a
+        // rejection rather than a silent fallback to another index.
+        if !request.resolved_time_ranges.is_empty() {
+            return Err(Error::Query(QuerySyntaxError::Unsupported(
+                "a ranked query cannot carry a time-range (IN_TIME_RANGE) selection: ranking \
+                 groups by an index's only property, and a document belongs to every bucket \
+                 that contains its timestamp, so it would be ranked into several groups at once"
+                    .to_string(),
+            )));
+        }
+
         let mode = detect_ranked_mode(
             &request.select,
             request.group_by,
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/execute_top_k.rs b/packages/rs-drive/src/query/drive_document_ranked_query/execute_top_k.rs
index 9cda62c9234..b049038174f 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/execute_top_k.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/execute_top_k.rs
@@ -10,13 +10,16 @@
 //! Whole module is gated `feature = "server"` via the parent's
 //! `pub mod execute_top_k;` declaration.
 
-use super::{DriveDocumentRankedQuery, RankedAxis, RankedEntry, RankedEntryValue, RankedPage};
+use super::branches::{axis_keys_to_ranked, decompose_branch_paths, read_branched_union};
+use super::{DriveDocumentRankedQuery, RankedPage};
 use crate::drive::Drive;
 use crate::error::drive::DriveError;
 use crate::error::Error;
 use dpp::version::PlatformVersion;
-use grovedb::{IndexedTopKKeysPage, TransactionArg};
+use grovedb::query_result_type::QueryResultType;
+use grovedb::{PathQuery, PathQueryRun, TransactionArg};
 use grovedb_costs::CostContext;
+use grovedb_query::AxisQuery;
 
 impl DriveDocumentRankedQuery<'_> {
     /// Read one page of the ranking directly from the axis secondary:
@@ -25,13 +28,22 @@ impl DriveDocumentRankedQuery<'_> {
     /// the direction and the tie contract.
     ///
     /// Fewer than `k` entries is normal (the index simply has fewer
-    /// groups than `offset + k`) and is not an error. A missing path
-    /// *is* an error rather than an empty result: the indexed
-    /// property-name tree is created when the contract is registered, so
-    /// its absence means the contract-level state is not what the
-    /// request claims, not that the ranking is empty. (An index with no
-    /// documents yet has the tree, with an empty secondary, and yields
-    /// an empty entry list.)
+    /// groups than `offset + k`) and is not an error. On an `IN`-pinned
+    /// request, an element whose branch chain is missing at ANY depth —
+    /// the branch key itself, or any deeper pinned segment under a
+    /// *present* key — contributes an **empty branch** (union
+    /// semantics), exactly as the proved envelope authenticates it, and
+    /// the union is served from **one committed state**: the branched
+    /// read always runs under a grovedb snapshot read transaction, so
+    /// every per-branch probe and walk reads the same RocksDB snapshot
+    /// (a caller transaction is rejected on this shape, mirroring the
+    /// branched prover — read per prefix element under a transaction).
+    /// A missing path under a single `==` pin *is* an error rather than
+    /// an empty result: the indexed property-name tree is created when
+    /// the contract is registered, so its absence means the
+    /// contract-level state is not what the request claims, not that
+    /// the ranking is empty. (An index with no documents yet has the
+    /// tree, with an empty secondary, and yields an empty entry list.)
     ///
     /// The paginated grovedb primitive is used unconditionally, with
     /// `offset = 0` standing in for an unpaginated request, so the
@@ -70,89 +82,94 @@ impl DriveDocumentRankedQuery<'_> {
         drive: &Drive,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
+    ) -> Result<RankedPage, Error> {
+        self.reject_offset_with_branches()?;
+        if self.prefix_branches.len() > 1 {
+            // ONE grovedb call for the whole union, pinned to one
+            // committed state and merged with the shared comparator —
+            // the entire sequence lives in
+            // `branches::read_branched_union`, shared with the
+            // having-range surface so the two cannot drift. `offset` is
+            // grammar-rejected with `IN`, so `skipped` is always 0 here.
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let entries = read_branched_union(
+                &drive.grove,
+                "ranked",
+                &self.prefix_branches,
+                &paths,
+                self.axis,
+                AxisQuery::top_k(
+                    self.axis.into(),
+                    self.k,
+                    self.offset as u64,
+                    self.descending,
+                ),
+                self.k as usize,
+                self.descending,
+                transaction,
+                &platform_version.drive.grove_version,
+            )?;
+            return Ok(RankedPage {
+                skipped: 0,
+                entries,
+            });
+        }
+        self.execute_top_k_no_proof_branch(0, drive, transaction, platform_version)
+    }
+
+    /// One branch's page — the entire pre-`IN` executor, parameterized
+    /// by which prefix branch's terminal tree it walks.
+    fn execute_top_k_no_proof_branch(
+        &self,
+        branch: usize,
+        drive: &Drive,
+        transaction: TransactionArg,
+        platform_version: &PlatformVersion,
     ) -> Result<RankedPage, Error> {
         let grove_version = &platform_version.drive.grove_version;
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
-        let offset = self.offset as u64;
+        let path = self.indexed_property_name_tree_path(branch)?;
 
         // The cost is dropped rather than `.unwrap()`-ed:
         // `CostContext::unwrap` is infallible (it drops the cost field)
         // but reads like a panicking unwrap at the call site. Dropping it
         // is all there is to do with it — nothing meters a query on this
-        // surface: neither this executor's caller nor the dispatcher
-        // above it accumulates or charges the cost, and no credit is
-        // debited for a read. grovedb computes the `OperationCost`
-        // because its API always does, and it ends here.
-        let (entries, skipped) = match self.axis {
-            RankedAxis::Count => {
-                let CostContext { value, cost: _ } =
-                    drive.grove.indexed_count_top_k_paginated_keys(
-                        path_refs.as_slice(),
-                        self.k,
-                        offset,
-                        self.descending,
-                        transaction,
-                        grove_version,
-                    );
-                let IndexedTopKKeysPage { entries, skipped } =
-                    value.map_err(|e| Error::GroveDB(Box::new(e)))?;
-                (
-                    entries
-                        .into_iter()
-                        .map(|(count, key)| RankedEntry {
-                            key,
-                            value: RankedEntryValue::Count(count),
-                        })
-                        .collect::<Vec<_>>(),
-                    skipped,
-                )
-            }
-            RankedAxis::Sum => {
-                let CostContext { value, cost: _ } = drive.grove.indexed_sum_top_k_paginated_keys(
-                    path_refs.as_slice(),
-                    self.k,
-                    offset,
-                    self.descending,
-                    transaction,
-                    grove_version,
-                );
-                let IndexedTopKKeysPage { entries, skipped } =
-                    value.map_err(|e| Error::GroveDB(Box::new(e)))?;
-                (
-                    entries
-                        .into_iter()
-                        .map(|(sum, key)| RankedEntry {
-                            key,
-                            value: RankedEntryValue::Sum(sum),
-                        })
-                        .collect::<Vec<_>>(),
-                    skipped,
-                )
-            }
-            RankedAxis::Avg => {
-                let CostContext { value, cost: _ } = drive.grove.indexed_avg_top_k_paginated_keys(
-                    path_refs.as_slice(),
-                    self.k,
-                    offset,
-                    self.descending,
-                    transaction,
-                    grove_version,
-                );
-                let IndexedTopKKeysPage { entries, skipped } =
-                    value.map_err(|e| Error::GroveDB(Box::new(e)))?;
-                (
-                    entries
-                        .into_iter()
-                        .map(|(avg, key)| RankedEntry {
-                            key,
-                            value: RankedEntryValue::AvgFixedPoint(avg),
-                        })
-                        .collect::<Vec<_>>(),
-                    skipped,
-                )
-            }
+        // surface. grovedb computes the `OperationCost` because its API
+        // always does, and it ends here.
+        let path_query = PathQuery::new_axis(
+            path,
+            AxisQuery::top_k(
+                self.axis.into(),
+                self.k,
+                self.offset as u64,
+                self.descending,
+            )
+            .keys_only(),
+        );
+        let CostContext { value, cost: _ } = drive.grove.run_path_query(
+            &path_query,
+            true,
+            true,
+            true,
+            QueryResultType::QueryKeyElementPairResultType,
+            transaction,
+            grove_version,
+        );
+        let run = value.map_err(|e| Error::GroveDB(Box::new(e)))?;
+        let PathQueryRun::AxisKeys { keys, skipped } = run else {
+            return Err(Error::Drive(DriveError::CorruptedDriveState(
+                "a keys-only ranked read returned a different result shape".to_string(),
+            )));
         };
+        let entries = axis_keys_to_ranked(self.axis, keys)?;
+        // A `RankedPage` traversal always attests its skip; its absence
+        // would mean grovedb answered a different traversal than asked.
+        let skipped = skipped.ok_or_else(|| {
+            Error::Drive(DriveError::CorruptedDriveState(
+                "a paginated ranked read carried no skip attestation".to_string(),
+            ))
+        })?;
 
         // `k` is the contract with the caller, and on the prove path it
         // is re-checked inside the proof envelope. Asserting it here too
@@ -177,12 +194,14 @@ impl DriveDocumentRankedQuery<'_> {
     /// entries skipped to reach them, the primary's root hash, the
     /// sibling axes' root hashes, and a per-ancestor attestation chain
     /// up to the grovedb root — so the client reconstructs the platform
-    /// root hash from it. It also echoes `(axis, k, offset,
-    /// descending)`, which
-    /// [`grovedb::GroveDb::verify_indexed_axis_top_k_paginated`]
-    /// re-checks against what the client asked for; that is why `k` is
-    /// validated rather than clamped upstream (a clamped `k` would
-    /// produce a proof the client's own reconstruction rejects).
+    /// root hash from it. `(axis, k, offset, descending)` bind by
+    /// RECONSTRUCTION, not echo: the verifier rebuilds the same
+    /// `PathQuery` from the request and
+    /// [`grovedb::GroveDb::verify_path_query`] re-executes the proof
+    /// against that traversal, so a proof for a different ranking or a
+    /// different page fails to cover it; that is why `k` is validated
+    /// rather than clamped upstream (a clamped `k` would produce a page
+    /// the client's reconstruction did not ask for).
     ///
     /// The paginated primitive is used unconditionally, with
     /// `offset = 0` for offset-free requests, so there is exactly one
@@ -207,20 +226,71 @@ impl DriveDocumentRankedQuery<'_> {
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<Vec<u8>, Error> {
-        let grove_version = &platform_version.drive.grove_version;
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
+        self.reject_offset_with_branches()?;
+        // grovedb's `prove_query` — since the indexed-axis prover
+        // retirement, the only proof surface — proves COMMITTED state
+        // only: it takes one internal snapshot and threads it through
+        // every proof layer, and cannot see the caller's transaction.
+        // Serving a proof for a different snapshot than the unproved
+        // read would silently desynchronize the two paths, so a
+        // transactional prove fails closed, single-prefix and branched
+        // alike.
+        if transaction.is_some() {
+            return Err(Error::Drive(DriveError::NotSupported(
+                "a ranked proof is generated from committed state only: grovedb's \
+                 prove_query cannot see the caller's transaction — commit first",
+            )));
+        }
+        if self.prefix_branches.len() > 1 {
+            // One grovedb **branched** envelope: shared ancestor layers
+            // once, one multi-key proof at the branching level, one
+            // secondary proof per branch — a single proof with a single
+            // root hash. The verifier re-derives the branch set from
+            // the request, so a dropped, duplicated, or reordered
+            // branch fails there.
+            let grove_version = &platform_version.drive.grove_version;
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let (prefix, keys, suffix) = decompose_branch_paths(&paths)?;
+            let path_query = PathQuery::new_branched_axis(
+                prefix,
+                keys,
+                suffix,
+                AxisQuery::top_k(
+                    self.axis.into(),
+                    self.k,
+                    self.offset as u64,
+                    self.descending,
+                ),
+            );
+            let CostContext { value, cost: _ } =
+                drive.grove.prove_query(&path_query, None, grove_version);
+            return value.map_err(|e| Error::GroveDB(Box::new(e)));
+        }
+        self.execute_top_k_with_proof_branch(0, drive, platform_version)
+    }
 
-        // Same destructure-don't-unwrap rationale as the no-proof arm.
-        let CostContext { value, cost: _ } = drive.grove.prove_indexed_axis_top_k_paginated(
-            path_refs.as_slice(),
+    /// One branch's proof — the entire pre-`IN` prover, parameterized by
+    /// the prefix branch.
+    fn execute_top_k_with_proof_branch(
+        &self,
+        branch: usize,
+        drive: &Drive,
+        platform_version: &PlatformVersion,
+    ) -> Result<Vec<u8>, Error> {
+        let grove_version = &platform_version.drive.grove_version;
+        let path = self.indexed_property_name_tree_path(branch)?;
+        let path_query = PathQuery::new_axis_top_k(
+            path,
             self.axis.into(),
             self.k,
             self.offset as u64,
             self.descending,
-            transaction,
-            grove_version,
         );
+        // Same destructure-don't-unwrap rationale as the no-proof arm.
+        let CostContext { value, cost: _ } =
+            drive.grove.prove_query(&path_query, None, grove_version);
         value.map_err(|e| Error::GroveDB(Box::new(e)))
     }
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/index_picker.rs b/packages/rs-drive/src/query/drive_document_ranked_query/index_picker.rs
index 5f5408fbf30..bce9c36351e 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/index_picker.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/index_picker.rs
@@ -7,12 +7,11 @@
 //! and the SDK verifier both call these so they land on the same index
 //! (and therefore the same grove path) for the same request.
 
-use super::{DocumentRankedMode, DriveDocumentRankedQuery, RankedAxis};
+use super::{DocumentRankedMode, DriveDocumentRankedQuery, PrefixPin, RankedAxis};
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use dpp::data_contract::document_type::methods::DocumentTypeV0Methods;
 use dpp::data_contract::document_type::{DocumentTypeRef, Index};
-use dpp::platform_value::Value;
 use dpp::version::PlatformVersion;
 use std::collections::BTreeMap;
 
@@ -28,7 +27,7 @@ use std::collections::BTreeMap;
 /// - every **leading** property is pinned: each appears (by name) among
 ///   `equality_pin_fields`. Lengths matching plus the pins being
 ///   distinct (enforced upstream by
-///   [`super::mode_detection::equality_pins_from_where_clauses`]) makes
+///   [`super::mode_detection::prefix_pins_from_where_clauses`]) makes
 ///   this set equality, so no pin is left over either;
 /// - it declares the ranking keyword for `axis`
 ///   ([`RankedAxis::required_index_keyword`]);
@@ -36,7 +35,8 @@ use std::collections::BTreeMap;
 ///   property is exactly `aggregate_field`. Both axes are derived from
 ///   the same running sum the index maintains (`Avg` is that sum over the
 ///   group's count), so summing a *different* field than the one the
-///   index accumulates would silently answer about the wrong property.
+///   index accumulates would silently answer about the wrong property;
+/// - it carries no time-range transform.
 ///
 /// With no pins this degenerates to the original single-property rule.
 /// A partial pin (some but not all leading properties) matches nothing —
@@ -85,6 +85,14 @@ pub fn find_ranked_index_for_axis<'b>(
         {
             return false;
         }
+        // Ranking over bucket keys is an undesigned surface: a document is
+        // stored once per bucket that contains it, so it would contribute to
+        // `overlap_factor` groups at once, and a ranked query carries no
+        // where clauses that could pin a single bucket. Exclude bucketed
+        // indexes until the semantics are deliberately designed.
+        if index.time_range.is_some() {
+            return false;
+        }
         match axis {
             RankedAxis::Count => index.ranked_countable,
             RankedAxis::Sum => {
@@ -104,9 +112,9 @@ pub fn find_ranked_index_for_mode<'b>(
     mode: &DocumentRankedMode,
 ) -> Option<&'b Index> {
     let pin_fields: Vec<String> = mode
-        .equality_pins
+        .prefix_pins
         .iter()
-        .map(|(field, _)| field.clone())
+        .map(|pin| pin.field.clone())
         .collect();
     find_ranked_index_for_axis(
         indexes,
@@ -119,8 +127,9 @@ pub fn find_ranked_index_for_mode<'b>(
 
 /// Resolve a validated [`DocumentRankedMode`] against a document type's
 /// indexes into the executable [`DriveDocumentRankedQuery`]: pick the
-/// covering index, encode the equality pins into prefix-value path
-/// segments, and assemble the query.
+/// covering index, encode the prefix pins into prefix **branches** (one
+/// branch for all-`==` pins, one branch per element of the single
+/// permitted `IN`), and assemble the query.
 ///
 /// This is the **one** resolution path — the server's executors and the
 /// SDK's proof helpers both call it, which is what guarantees a proof
@@ -152,19 +161,19 @@ pub fn resolve_ranked_query_for_mode<'a>(
                 "ranked",
                 mode.axis,
                 &mode.group_by_property,
-                &mode.equality_pins,
+                &mode.prefix_pins,
                 &mode.aggregate_field,
             ),
         ))
     })?;
-    let equality_prefix_values =
-        encode_equality_prefix_values(document_type, index, &mode.equality_pins, platform_version)?;
+    let prefix_branches =
+        encode_prefix_branches(document_type, index, &mode.prefix_pins, platform_version)?;
     Ok(DriveDocumentRankedQuery {
         document_type,
         contract_id,
         document_type_name,
         index,
-        equality_prefix_values,
+        prefix_branches,
         axis: mode.axis,
         descending: mode.descending,
         k: mode.k,
@@ -182,32 +191,32 @@ pub fn no_covering_index_message(
     surface: &str,
     axis: RankedAxis,
     group_by_property: &str,
-    equality_pins: &[(String, Value)],
+    prefix_pins: &[PrefixPin],
     aggregate_field: &str,
 ) -> String {
     let pin_fields = || {
-        equality_pins
+        prefix_pins
             .iter()
-            .map(|(field, _)| field.as_str())
+            .map(|pin| pin.field.as_str())
             .collect::<Vec<_>>()
             .join(", ")
     };
-    let index_shape = if equality_pins.is_empty() {
+    let index_shape = if prefix_pins.is_empty() {
         format!("a single-property index on `{group_by_property}`")
     } else {
         format!(
             "a compound index on [{}, {group_by_property}] (every leading property pinned \
-             by an equality `where` clause, the trailing property grouped over)",
+             by an equality or `IN` `where` clause, the trailing property grouped over)",
             pin_fields()
         )
     };
     format!(
         "no ranked index covers `group_by = [{group_by_property}]`{} on the {axis:?} axis \
          for this {surface} query: the document type needs {index_shape} declaring `{}`{}",
-        if equality_pins.is_empty() {
+        if prefix_pins.is_empty() {
             String::new()
         } else {
-            format!(" with equality pins on [{}]", pin_fields())
+            format!(" with pins on [{}]", pin_fields())
         },
         axis.required_index_keyword(),
         if aggregate_field.is_empty() {
@@ -218,61 +227,185 @@ pub fn no_covering_index_message(
     )
 }
 
-/// Encode the equality pins into the grove path's prefix-value
-/// segments: for each **leading** property of `index`, in index order,
-/// the pinned value's index-key bytes
-/// (`DocumentType::serialize_value_for_key` — the same encoding the
-/// write path used to key that prefix's value tree).
+/// Encode the resolved prefix pins into **branches** — one
+/// `Vec<Vec<u8>>` of prefix path segments per branch, in index-property
+/// order (the same order and encoding the write path used to key those
+/// prefix value trees). A request with only `==` pins yields exactly
+/// one branch; the (at most one) `IN` pin yields one branch per
+/// element.
 ///
 /// This is part of the prover/verifier agreement: server executors and
 /// the SDK's proof helpers both come through here, so a pinned value
-/// can only ever name one subtree, identically on both sides.
+/// can only ever name one subtree — and a branch *set* only ever one
+/// ordered subtree list — identically on both sides. Branch order is
+/// canonical: ascending by encoded segment bytes, independent of the
+/// caller's element order (which also makes `null`, the empty segment,
+/// sort first deterministically).
 ///
 /// `index` must have been picked by [`find_ranked_index_for_axis`]
 /// against these same pins — every leading property is then guaranteed
-/// a pin. A value the property's type cannot encode (a string against
-/// an integer property, an out-of-range integer) is a caller error,
-/// reported as a query-syntax rejection naming the property.
-pub fn encode_equality_prefix_values(
+/// a pin. A value the property's type cannot encode is a caller error
+/// naming the property; two `IN` elements that encode to the same
+/// segment (two spellings of one value) are one branch and are rejected
+/// as a duplicate rather than walked twice.
+pub fn encode_prefix_branches(
     document_type: DocumentTypeRef,
     index: &Index,
-    equality_pins: &[(String, Value)],
+    prefix_pins: &[PrefixPin],
     platform_version: &PlatformVersion,
-) -> Result<Vec<Vec<u8>>, Error> {
+) -> Result<Vec<Vec<Vec<u8>>>, Error> {
     let leading = &index.properties[..index.properties.len().saturating_sub(1)];
-    leading
+    // Enforced BEFORE any encoding: the ceiling bounds every downstream
+    // cost (encode, sort, clone, walk, proof size), so an oversized pin
+    // must not buy that work first. The post-product branch count check
+    // below stays as a backstop.
+    if prefix_pins
+        .iter()
+        .any(|pin| pin.values.len() > super::MAX_PREFIX_IN_BRANCHES)
+    {
+        return Err(Error::Query(
+            QuerySyntaxError::InvalidWhereClauseComponents(
+                "an `IN` prefix pin fans out into more branches than the ranked surface serves \
+             — narrow the element list or issue several requests",
+            ),
+        ));
+    }
+    let per_property: Vec<Vec<Vec<u8>>> = leading
         .iter()
         .map(|property| {
-            let (_, value) = equality_pins
+            let pin = prefix_pins
                 .iter()
-                .find(|(field, _)| field == &property.name)
+                .find(|pin| pin.field == property.name)
                 .ok_or_else(|| {
                     Error::Query(QuerySyntaxError::InvalidWhereClauseComponents(
                         "internal resolution mismatch: the picked compound ranked index has \
-                         a leading property with no equality pin — the index picker and the \
-                         prefix encoder disagreed on the pins",
+                         a leading property with no pin — the index picker and the prefix \
+                         encoder disagreed on the pins",
                     ))
                 })?;
-            // A null pin addresses the subtree the write walkers create
-            // for an **absent** value: they encode it as
-            // `get_raw_for_document_type(..).unwrap_or_default()` — an
-            // empty path segment — for user and system properties alike.
-            // Null must short-circuit here because the system-property
-            // encoders (`$updatedAt`, `$creatorId`, …) reject null before
-            // any encoding happens, which would make the stored
-            // empty-segment prefix unaddressable.
-            if value.is_null() {
-                return Ok(Vec::new());
-            }
-            document_type
-                .serialize_value_for_key(&property.name, value, platform_version)
-                .map_err(|e| {
-                    Error::Query(QuerySyntaxError::InvalidParameter(format!(
-                        "the equality pin on `{}` does not encode as that property's \
-                         index key: {e}",
-                        property.name
-                    )))
+            let mut encoded = pin
+                .values
+                .iter()
+                .map(|value| {
+                    // A null pin addresses the subtree the write walkers
+                    // create for an **absent** value: they encode it as
+                    // `get_raw_for_document_type(..).unwrap_or_default()`
+                    // — an empty path segment — for user and system
+                    // properties alike. Null must short-circuit here
+                    // because the system-property encoders (`$updatedAt`,
+                    // `$creatorId`, …) reject null before any encoding
+                    // happens, which would make the stored empty-segment
+                    // prefix unaddressable.
+                    if value.is_null() {
+                        return Ok(Vec::new());
+                    }
+                    document_type
+                        .serialize_value_for_key(&property.name, value, platform_version)
+                        .map_err(|e| {
+                            Error::Query(QuerySyntaxError::InvalidParameter(format!(
+                                "the pin on `{}` does not encode as that property's \
+                                 index key: {e}",
+                                property.name
+                            )))
+                        })
                 })
+                .collect::<Result<Vec<_>, Error>>()?;
+            if encoded.len() > 1 {
+                encoded.sort();
+                if encoded.windows(2).any(|pair| pair[0] == pair[1]) {
+                    return Err(Error::Query(
+                        QuerySyntaxError::InvalidWhereClauseComponents(
+                            "an `IN` pin's elements encode to the same index key: two \
+                             spellings of one value are one prefix branch — deduplicate \
+                             the element list",
+                        ),
+                    ));
+                }
+            }
+            Ok(encoded)
         })
-        .collect()
+        .collect::<Result<Vec<_>, Error>>()?;
+
+    // Defense in depth at the shared choke point: the grammar enforces
+    // both invariants upstream, but this function is `pub` and the
+    // prover/verifier agreement hangs off it, so a mis-built pin set
+    // must fail here rather than collapse to zero branches (a
+    // downstream panic) or fan out into an unbounded cartesian product
+    // (which would also break the one-varying-position assumption
+    // `in_key` and the merge order rely on).
+    if per_property.iter().any(|candidates| candidates.is_empty()) {
+        return Err(Error::Query(
+            QuerySyntaxError::InvalidWhereClauseComponents(
+                "internal resolution mismatch: a prefix pin carries no values",
+            ),
+        ));
+    }
+    if per_property
+        .iter()
+        .filter(|candidates| candidates.len() > 1)
+        .count()
+        > 1
+    {
+        return Err(Error::Query(
+            QuerySyntaxError::InvalidWhereClauseComponents(
+                "internal resolution mismatch: more than one branching pin — the grammar \
+             admits at most one `IN` across the prefix properties",
+            ),
+        ));
+    }
+
+    // A single `null` pin encodes as the empty path segment; the branched
+    // proof grammar (`PathQuery::new_branched_axis`) cannot address an
+    // empty segment in the shared prefix or suffix, so a null `==` pin
+    // combined with an `IN` would serve the unproved read and fail the
+    // prove — the exact proved/unproved divergence this surface forbids.
+    // Rejected for any non-branching pin position, conservatively: issue
+    // one request per `IN` element to combine null pins with multiple
+    // prefixes. `null` as an ELEMENT of the `IN` itself stays legal — it
+    // is a branch key, which the envelope addresses and authenticates
+    // like any other.
+    let has_branching_pin = per_property.iter().any(|candidates| candidates.len() > 1);
+    if has_branching_pin
+        && per_property
+            .iter()
+            .any(|candidates| candidates.len() == 1 && candidates[0].is_empty())
+    {
+        return Err(Error::Query(
+            QuerySyntaxError::InvalidWhereClauseComponents(
+                "an `IN` prefix pin cannot be combined with a `null` pin: null addresses the \
+             absent-value prefix through an empty path segment, which the branched proof \
+             cannot express — issue one request per `IN` element instead",
+            ),
+        ));
+    }
+
+    // The grammar admits at most one multi-value pin, so this product
+    // is |IN| branches (or exactly one), already in canonical order
+    // because the only varying position was sorted above.
+    let mut branches: Vec<Vec<Vec<u8>>> = vec![Vec::with_capacity(leading.len())];
+    for candidates in per_property {
+        branches = branches
+            .into_iter()
+            .flat_map(|prefix| {
+                candidates.iter().map(move |segment| {
+                    let mut branch = prefix.clone();
+                    branch.push(segment.clone());
+                    branch
+                })
+            })
+            .collect();
+    }
+    // The documented hard ceiling on branch fan-out, enforced at the
+    // shared choke point too: this function is `pub`, and everything
+    // downstream (encoding, sorting, per-branch walks, proof size) is
+    // linear in the branch count.
+    if branches.len() > super::MAX_PREFIX_IN_BRANCHES {
+        return Err(Error::Query(
+            QuerySyntaxError::InvalidWhereClauseComponents(
+                "an `IN` prefix pin fans out into more branches than the ranked surface serves \
+             — narrow the element list or issue several requests",
+            ),
+        ));
+    }
+    Ok(branches)
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/mod.rs b/packages/rs-drive/src/query/drive_document_ranked_query/mod.rs
index a72ccd7b7f4..5b54a342116 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/mod.rs
@@ -50,8 +50,15 @@
 //!    on the grouped (terminal) property itself would ask for a
 //!    *filtered* ranking, which no secondary can express — it is sorted
 //!    by aggregate, not by group key — and is rejected rather than
-//!    silently ignored, as is any non-equality prefix clause (`IN`
-//!    included: one walk per element is a future multi-`IN` capability).
+//!    silently ignored, as is any non-equality prefix clause except one
+//!    `IN`: exactly one leading pin may carry 2..=[`MAX_PREFIX_IN_BRANCHES`]
+//!    distinct elements (a single-element `IN` normalizes to the
+//!    equality pin), read as one walk per element and merged by
+//!    `(aggregate, encoded pin, group key)`, proved in a single branched
+//!    `PathQuery` envelope with per-element authenticated absence. A
+//!    `null` pin cannot combine with an `IN` (null addresses its prefix
+//!    through an empty path segment the branched proof cannot express),
+//!    and `OFFSET` is rejected together with `IN`.
 //! 2. **`limit` is mandatory, `offset` is depth-bounded, `start_at` is
 //!    refused.**
 //!    `limit` is the `k` of the walk and the ranked surface has no
@@ -84,6 +91,8 @@ use dpp::platform_value::Value;
 #[cfg(any(feature = "server", feature = "verify"))]
 pub use grovedb::element::indexed::AVG_FIXED_POINT_SCALE as RANKED_AVG_SCALE;
 
+#[cfg(any(feature = "server", feature = "verify"))]
+pub(crate) mod branches;
 #[cfg(any(feature = "server", feature = "verify"))]
 pub mod index_picker;
 #[cfg(any(feature = "server", feature = "verify"))]
@@ -117,16 +126,29 @@ mod tests;
 /// is rejected with
 /// [`crate::error::query::QuerySyntaxError::InvalidLimit`] rather than
 /// silently truncated. Truncation would be especially treacherous here
-/// because `k` is echoed inside the proof envelope and re-checked by
-/// [`grovedb::GroveDb::verify_indexed_axis_top_k_paginated`] — a
-/// server-side clamp would produce a proof the client's own
-/// reconstruction rejects.
+/// because `k` is part of the traversal the client reconstructs for
+/// [`grovedb::GroveDb::verify_path_query`] — a server-side clamp would
+/// produce a page the client's reconstruction did not ask for.
 ///
 /// There is deliberately **no companion ceiling on `OFFSET`**; see the
 /// module docs and [`DriveDocumentRankedQuery::offset`].
 #[cfg(any(feature = "server", feature = "verify"))]
 pub const MAX_RANKED_LIMIT: u16 = 100;
 
+/// Hard ceiling on the element count of the (at most one) `IN` prefix
+/// pin — the number of prefix **branches** one ranked / having-range
+/// request may fan out into.
+///
+/// Each element is one full secondary walk and one proof branch, each
+/// carrying up to `limit` committed entries plus boundary commitments,
+/// so worst-case proof size is `MAX_PREFIX_IN_BRANCHES ×
+/// MAX_RANKED_LIMIT` entries (≈100–150 KB at the ceiling). A hard
+/// rejection rather than a clamp, for the same reason as the limit: the
+/// branch set is bound into the branched proof envelope and re-checked
+/// by the verifier.
+#[cfg(any(feature = "server", feature = "verify"))]
+pub const MAX_PREFIX_IN_BRANCHES: usize = 10;
+
 /// The `ORDER BY` field name that means "the group's `COUNT(*)`".
 ///
 /// `COUNT(*)` has no field to name, so the ranked grammar needs some
@@ -145,7 +167,8 @@ pub const RANKED_COUNT_ORDER_KEY: &str = "$count";
 /// Which per-group aggregate the groups are ranked by.
 ///
 /// Maps 1:1 onto [`grovedb::element::IndexAxis`], the axis tag stored in
-/// an indexed tree's TLV and echoed in the proof envelope. Kept as a
+/// an indexed tree's TLV and rebuilt into the `PathQuery` a verifier
+/// re-executes proofs against. Kept as a
 /// separate drive-side type (rather than re-exporting grovedb's) so the
 /// query surface's error messages and validation can talk about
 /// `rankedCountable` / `rankedSummable` / `rankedAverageable` — contract
@@ -256,6 +279,13 @@ pub struct RankedEntry {
     pub key: Vec<u8>,
     /// The group's aggregate on the requested axis.
     pub value: RankedEntryValue,
+    /// The branch this entry came from, on an `IN`-pinned request: the
+    /// encoded index-key segment of the `IN` position's pinned value
+    /// (empty bytes for the `null` branch). `None` on single-branch
+    /// responses — the same group key can appear under two prefixes, so
+    /// only a merged page needs the discriminator. See
+    /// [`branches::branch_in_key`].
+    pub in_key: Option<Vec<u8>>,
 }
 
 /// A resolved ranked query. Shared by the prover and the verifier — both
@@ -279,17 +309,23 @@ pub struct DriveDocumentRankedQuery<'a> {
     pub document_type_name: String,
     /// The covering ranked index. Its **last** property is the `GROUP
     /// BY` property and the final path segment; any leading properties
-    /// are pinned by [`Self::equality_prefix_values`].
+    /// are pinned by [`Self::prefix_branches`].
     pub index: &'a Index,
-    /// Encoded index-key bytes of each leading index property's pinned
-    /// value, in index-property order — empty for a single-property
-    /// index. Together with `index` these determine the grove path
-    /// (each leading property contributes a name segment and a value
-    /// segment), so they are as much a part of the prover/verifier
-    /// agreement as the path builder itself. Produced by
-    /// [`index_picker::encode_equality_prefix_values`] from the
-    /// request's equality `where` pins.
-    pub equality_prefix_values: Vec<Vec<u8>>,
+    /// The prefix **branches** — one inner `Vec<Vec<u8>>` of encoded
+    /// index-key path segments per branch, each in index-property
+    /// order. Always at least one branch; a single-property index or an
+    /// all-`==` pinned request has exactly one (possibly empty) branch,
+    /// and the (at most one) `IN` pin contributes one branch per
+    /// element, in canonical encoded-ascending order. Together with
+    /// `index` these determine the grove path(s), so the branch set is
+    /// as much a part of the prover/verifier agreement as the path
+    /// builder itself. Produced by
+    /// [`index_picker::encode_prefix_branches`] from the request's
+    /// `where` pins — crate-private so the resolver is the only public
+    /// constructor and the encoder's invariants (nonempty, canonical
+    /// order, distinct keys, one varying position, the fan-out ceiling)
+    /// hold on every externally obtainable value.
+    pub(crate) prefix_branches: Vec<Vec<Vec<u8>>>,
     /// Which aggregate the groups are ranked by. Must be covered by
     /// `index`'s matching `ranked_*` flag.
     pub axis: RankedAxis,
@@ -332,6 +368,44 @@ pub struct DriveDocumentRankedQuery<'a> {
     pub offset: u32,
 }
 
+#[cfg(any(feature = "server", feature = "verify"))]
+impl DriveDocumentRankedQuery<'_> {
+    /// The resolved prefix branches, in canonical order — one per `IN`
+    /// element (a single branch without an `IN`). Read-only: the field is
+    /// crate-private so the resolver's encoder invariants cannot be
+    /// bypassed by construction or mutation.
+    pub fn prefix_branches(&self) -> &[Vec<Vec<u8>>] {
+        &self.prefix_branches
+    }
+
+    /// Reject the one cross-field combination the request grammar
+    /// forbids but public construction can still express: a
+    /// multi-branch (`IN`) query carrying a non-zero `offset`.
+    /// Rank-skip is attested from ONE secondary's counted commitments;
+    /// applied independently per branch it would page each branch
+    /// separately, merge the independently skipped pages, and report
+    /// `skipped: 0` — and the verifier, reconstructing the same
+    /// malformed per-branch traversal, would not reject it. Enforced at
+    /// every execution, proving and verification boundary, because
+    /// `offset` is a public field and the mode-detection grammar check
+    /// can be bypassed by building a mode or mutating a resolved query
+    /// directly.
+    pub(crate) fn reject_offset_with_branches(&self) -> Result<(), crate::error::Error> {
+        if self.prefix_branches.len() > 1 && self.offset != 0 {
+            return Err(crate::error::Error::Query(
+                crate::error::query::QuerySyntaxError::InvalidLimit(
+                    "`OFFSET` cannot combine with an `IN` prefix pin: rank-skip is attested \
+                     from one secondary's counted commitments, and an `IN` merges several \
+                     secondaries with no counted structure over the union. Page one prefix \
+                     at a time (`==` pin + `OFFSET`), or drop the offset."
+                        .to_string(),
+                ),
+            ));
+        }
+        Ok(())
+    }
+}
+
 /// A page of a ranked result: the entries, plus how many ranks were
 /// actually skipped to reach them.
 ///
@@ -403,7 +477,7 @@ pub struct RankedPaginationInputs {
 /// one executor pair (no-proof / proof) and all of its variation is in
 /// these values.
 ///
-/// Not `Eq`: the equality pins carry [`Value`]s, whose float variant
+/// Not `Eq`: the prefix pins carry [`Value`]s, whose float variant
 /// keeps the type at `PartialEq`.
 #[derive(Debug, Clone, PartialEq)]
 #[cfg(any(feature = "server", feature = "verify"))]
@@ -423,12 +497,29 @@ pub struct DocumentRankedMode {
     /// [`RankedAxis::Count`] (`COUNT(*)`); the index's `summable`
     /// property for [`RankedAxis::Sum`] / [`RankedAxis::Avg`].
     pub aggregate_field: String,
-    /// The equality `where` pins, `(property, value)` per clause —
-    /// exactly one per leading property of the covering compound index,
-    /// in whatever order the request supplied them (the resolver
-    /// re-orders them into index-property order when it encodes the
-    /// path). Empty for the single-property form. Shape-validated only:
-    /// the index-aware checks (does a compound index exist whose leading
-    /// properties these pin?) live in [`index_picker`].
-    pub equality_pins: Vec<(String, Value)>,
+    /// The `where` prefix pins — one [`PrefixPin`] per clause, exactly
+    /// one per leading property of the covering compound index, in
+    /// whatever order the request supplied them (the resolver re-orders
+    /// them into index-property order when it encodes the path). A pin
+    /// normally carries one value (an `==` clause); at most one carries
+    /// several (the single permitted branching `IN`). Empty for the
+    /// single-property form. Shape-validated only: the index-aware
+    /// checks (does a compound index exist whose leading properties
+    /// these pin?) live in [`index_picker`].
+    pub prefix_pins: Vec<PrefixPin>,
+}
+
+/// One pinned leading property of the covering compound index.
+///
+/// An `==` clause pins exactly one value; the (at most one) `IN` clause
+/// pins several, each element selecting its own prefix **branch** — the
+/// executors walk one secondary per branch and merge deterministically.
+/// A single-element `IN` is normalized to an equality pin at grammar
+/// time, so `values.len() > 1` is exactly "this is the branching pin".
+#[derive(Debug, Clone, PartialEq)]
+pub struct PrefixPin {
+    /// The pinned property's name.
+    pub field: String,
+    /// The pinned value(s); never empty.
+    pub values: Vec<Value>,
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/mod.rs b/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/mod.rs
index 17b2d46b5f5..2c80fe16696 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/mod.rs
@@ -88,4 +88,4 @@ pub fn ranked_order_key(select: &SelectProjection) -> &str {
 mod v0;
 // Re-exported so the dispatcher's callers (`drive_dispatcher`, the
 // test suites) keep addressing the frozen grammar by its old path.
-pub use v0::{detect_ranked_mode_v0, equality_pins_from_where_clauses};
+pub use v0::{detect_ranked_mode_v0, prefix_pins_from_where_clauses};
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/v0/mod.rs b/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/v0/mod.rs
index abe883991e6..2dcae92d5ac 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/v0/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/mode_detection/v0/mod.rs
@@ -3,6 +3,7 @@
 //! this file is a v0 internal: a later grammar version gets its own
 //! `vN/` sibling rather than editing this one.
 
+use super::super::{PrefixPin, MAX_PREFIX_IN_BRANCHES};
 use super::ranked_order_key;
 use super::{
     DocumentRankedMode, RankedAxis, RankedPaginationInputs, MAX_RANKED_LIMIT,
@@ -15,53 +16,34 @@ use crate::query::projection::{SelectFunction, SelectProjection};
 use crate::query::{OrderClause, WhereClause, WhereOperator};
 use dpp::platform_value::Value;
 
-/// Translate a request's `where` clauses into equality pins —
-/// `(property, value)` pairs, one per clause — for the ranked and
-/// having-range surfaces.
+/// Translate a request's `where` clauses into prefix pins — one
+/// [`PrefixPin`] per clause, carrying the pinned property and its
+/// value(s): one value from an `==` clause, several from the (at most
+/// one) `IN` — for the ranked and having-range surfaces.
 ///
 /// Both surfaces read a compound index's per-prefix secondary by
 /// descending through one prefix value tree per **leading** index
 /// property, and only an equality clause names a single value tree to
-/// descend into. So the grammar is: every `where` clause must be an
-/// equality (`==`), each on a distinct property. `IN` is rejected
-/// separately from the other operators because it *will* eventually be
-/// serviceable (one branch per element, once multi-`IN` branching lands
-/// on the document query surface) — the message says so — while a range
-/// operator on a prefix property can never pin a single subtree.
+/// descend into. So the grammar is: every `where` clause is an equality
+/// (`==`) on a distinct property, except that **at most one** clause may
+/// be an `IN` — each of its elements selects its own prefix *branch*,
+/// and the executors walk one secondary per branch and merge (see
+/// [`MAX_PREFIX_IN_BRANCHES`] for the fan-out ceiling). A
+/// range operator on a prefix property can never pin a subtree and is
+/// rejected outright. A single-element `IN` is normalized to an
+/// equality pin, so the degenerate case is byte-identical to `==`.
 ///
 /// Shape-only, like everything in this module: whether the pinned
 /// properties are exactly the leading properties of a covering compound
-/// index is the index picker's call.
-pub fn equality_pins_from_where_clauses(
+/// index is the index picker's call, and element distinctness is
+/// enforced post-encoding by the prefix encoder (two spellings of one
+/// value are one branch, and must be rejected as a duplicate).
+pub fn prefix_pins_from_where_clauses(
     where_clauses: &[WhereClause],
-) -> Result<Vec<(String, Value)>, Error> {
-    let mut pins: Vec<(String, Value)> = Vec::with_capacity(where_clauses.len());
+) -> Result<Vec<PrefixPin>, Error> {
+    let mut pins: Vec<PrefixPin> = Vec::with_capacity(where_clauses.len());
+    let mut branching_field: Option<&str> = None;
     for clause in where_clauses {
-        match clause.operator {
-            WhereOperator::Equal => {}
-            WhereOperator::In => {
-                return Err(Error::Query(QuerySyntaxError::Unsupported(format!(
-                    "`{} IN …` is not yet supported on a ranked / having-range query's \
-                     prefix properties: each `IN` element names a different prefix value \
-                     tree, so serving it means one secondary walk per element and a merged \
-                     result — a future capability layered on multi-`IN` branching. Pin \
-                     each leading index property with `==`, or issue one request per \
-                     value.",
-                    clause.field
-                ))));
-            }
-            _ => {
-                return Err(Error::Query(
-                    QuerySyntaxError::InvalidWhereClauseComponents(
-                        "a ranked / having-range query's `where` clauses must pin the covering \
-                     compound index's leading properties with `==`: the per-prefix \
-                     secondary lives under one prefix value tree per leading property, and \
-                     only an equality names a single value tree to descend into — a range \
-                     operator cannot pin a prefix",
-                    ),
-                ));
-            }
-        }
         if clause.field.is_empty() {
             return Err(Error::Query(
                 QuerySyntaxError::InvalidWhereClauseComponents(
@@ -69,15 +51,76 @@ pub fn equality_pins_from_where_clauses(
                 ),
             ));
         }
-        if pins.iter().any(|(field, _)| field == &clause.field) {
+        if pins.iter().any(|pin| pin.field == clause.field) {
             return Err(Error::Query(
                 QuerySyntaxError::InvalidWhereClauseComponents(
                     "a ranked / having-range query pins the same property twice: each leading \
-                 index property takes exactly one equality pin",
+                 index property takes exactly one pin",
                 ),
             ));
         }
-        pins.push((clause.field.clone(), clause.value.clone()));
+        let values = match clause.operator {
+            WhereOperator::Equal => vec![clause.value.clone()],
+            WhereOperator::In => {
+                let Value::Array(elements) = &clause.value else {
+                    return Err(Error::Query(
+                        QuerySyntaxError::InvalidWhereClauseComponents(
+                            "an `IN` pin's right operand must be an array of candidate values",
+                        ),
+                    ));
+                };
+                if elements.is_empty() {
+                    return Err(Error::Query(
+                        QuerySyntaxError::InvalidWhereClauseComponents(
+                            "an `IN` pin's element list is empty: it can match nothing, and \
+                             a pin that cannot match any prefix is a caller error",
+                        ),
+                    ));
+                }
+                if elements.len() > MAX_PREFIX_IN_BRANCHES {
+                    return Err(Error::Query(QuerySyntaxError::InvalidParameter(format!(
+                        "an `IN` pin fans out into one secondary walk (and one proof \
+                         branch) per element; {} elements exceeds the ceiling of {}. \
+                         Split the request.",
+                        elements.len(),
+                        MAX_PREFIX_IN_BRANCHES
+                    ))));
+                }
+                // Only a multi-element `IN` branches; a singleton is an
+                // equality pin and never counts against the one-`IN`
+                // budget — in either clause order.
+                if elements.len() > 1 {
+                    if let Some(first) = branching_field {
+                        return Err(Error::Query(QuerySyntaxError::Unsupported(format!(
+                            "a ranked / having-range query takes at most one branching \
+                             `IN` across its prefix properties (`{first}` already carries \
+                             it): several `IN`s multiply into a cartesian product of \
+                             prefix branches, each a separate secondary walk inside one \
+                             proof — a fan-out the branch ceiling exists to prevent. Pin \
+                             `{}` with `==` or a single-element `IN`.",
+                            clause.field
+                        ))));
+                    }
+                    branching_field = Some(clause.field.as_str());
+                }
+                elements.clone()
+            }
+            _ => {
+                return Err(Error::Query(
+                    QuerySyntaxError::InvalidWhereClauseComponents(
+                        "a ranked / having-range query's `where` clauses must pin the covering \
+                     compound index's leading properties with `==` (or one `IN`): the \
+                     per-prefix secondary lives under one prefix value tree per leading \
+                     property, and only equality names value trees to descend into — a \
+                     range operator cannot pin a prefix",
+                    ),
+                ));
+            }
+        };
+        pins.push(PrefixPin {
+            field: clause.field.clone(),
+            values,
+        });
     }
     Ok(pins)
 }
@@ -95,12 +138,19 @@ pub fn equality_pins_from_where_clauses(
 /// with no `HAVING`, no `START AT` / `START AFTER`, exactly one
 /// `GROUP BY` property, exactly one `ORDER BY` clause naming the
 /// selected aggregate, `1 ≤ n ≤` [`MAX_RANKED_LIMIT`], and any
-/// `m ≥ 0`. `WHERE` clauses, when present, must be **equality pins** on
-/// distinct properties — one per leading property of a covering
-/// compound ranked index (see
-/// [`equality_pins_from_where_clauses`]); the ranking then reads that
-/// pinned prefix's own secondary. With no `where` the covering index is
-/// single-property, exactly as before.
+/// `m ≥ 0`. `WHERE` clauses, when present, pin distinct properties —
+/// one per leading property of a covering compound ranked index — each
+/// an **equality**, except that at most one may be a bounded **`IN`**
+/// (2..=10 distinct elements; a singleton `IN` normalizes to `==` — see
+/// [`prefix_pins_from_where_clauses`]). A `==`-pinned request reads
+/// that pinned prefix's own secondary; an `IN` fans the read out into
+/// one prefix branch per element, walked separately and merged
+/// deterministically, with merged entries carrying their branch's
+/// `in_key`. A **non-zero** `OFFSET` is rejected together with the
+/// `IN`: the counted rank-skip is attested per-secondary and cannot
+/// span the union (`OFFSET 0` stays legal as the offset-free
+/// spelling). With no `where` the covering index is single-property,
+/// exactly as before.
 ///
 /// `DESC` walks the axis from the largest aggregate down (the "top n"
 /// reading), `ASC` from the smallest up (the "bottom n" reading).
@@ -141,14 +191,16 @@ pub fn detect_ranked_mode_v0(
     // Zero group_by would ask to rank a single global aggregate against
     // itself. Two or more is rejected because a compound ranked index
     // ranks per prefix, not across a compound grouping: its leading
-    // properties are pinned by equality `where` clauses, and only the
-    // trailing property is grouped over.
+    // properties are pinned by `where` clauses (`==`, at most one of
+    // them a bounded `IN`), and only the trailing property is grouped
+    // over.
     if group_by.len() != 1 {
         return Err(Error::Query(QuerySyntaxError::InvalidParameter(format!(
             "ranked queries require exactly one `group_by` property (the covering ranked \
              index's trailing property); got {}. A compound ranked index ranks each \
-             prefix's groups separately — pin every leading index property with an \
-             equality `where` clause and `group_by` the trailing property.",
+             prefix's groups separately — pin every leading index property with a \
+             `where` clause (`==`, or a bounded `IN` on at most one of them) and \
+             `group_by` the trailing property.",
             group_by.len()
         ))));
     }
@@ -257,26 +309,27 @@ pub fn detect_ranked_mode_v0(
     // ---- WHERE: equality pins on the compound prefix ------------------
     //
     // Empty for the single-property form. For a compound ranked index,
-    // each `where` clause must pin one leading index property with `==`
-    // — that is what selects which prefix's secondary the walk reads
-    // (per-prefix semantics: there is no global cross-prefix ordering to
-    // serve). Anything other than a distinct-property equality is
-    // rejected loudly here; whether the pinned set matches a covering
-    // index's leading properties exactly is the index picker's call.
-    let equality_pins = equality_pins_from_where_clauses(where_clauses)?;
+    // each `where` clause pins one leading index property with `==`,
+    // except that at most one may use a bounded branching `IN` (a
+    // singleton `IN` normalizes to equality). These pins select the
+    // prefix secondary or secondaries the walk reads (per-prefix
+    // semantics: the only cross-prefix ordering is the branch merge);
+    // whether the pinned property set exactly matches a covering
+    // index's leading properties is the index picker's call.
+    let prefix_pins = prefix_pins_from_where_clauses(where_clauses)?;
 
     // ---- LIMIT: required, 1 ..= MAX_RANKED_LIMIT ---------------------
     //
-    // Required rather than defaulted: `k` is echoed inside the proof
-    // envelope and re-checked by the verifier, so a server-chosen
+    // Required rather than defaulted: `k` is part of the traversal the
+    // verifier re-executes the proof against, so a server-chosen
     // default would be a number the client never agreed to and could
     // not reproduce when rebuilding the query to verify.
     let limit = pagination.limit.ok_or_else(|| {
         Error::Query(QuerySyntaxError::InvalidLimit(format!(
             "ranked queries require an explicit `limit` (1 ..= {MAX_RANKED_LIMIT}): it is \
-             the number of groups the walk returns, and it is echoed in the proof envelope \
-             and re-checked by the verifier, so there is no server-side default a client \
-             could reproduce. Write `ORDER BY {expected_order_key} DESC LIMIT 1` for the \
+             the number of groups the walk returns, and the verifier re-executes the \
+             proof against the traversal it rebuilds from the request, so there is no \
+             server-side default a client could reproduce. Write `ORDER BY {expected_order_key} DESC LIMIT 1` for the \
              single best-ranked group."
         )))
     })?;
@@ -290,8 +343,8 @@ pub fn detect_ranked_mode_v0(
             "`LIMIT {limit}` exceeds the ranked-query ceiling of {MAX_RANKED_LIMIT}; the \
              proof commits one secondary entry per returned group, so its size grows \
              linearly in the limit. Narrow the request — the ceiling is a hard limit, not \
-             a clamp, because `k` is echoed in the proof envelope and re-checked by the \
-             verifier. Deep results are reached with `OFFSET`, whose skip work is bounded by \
+             a clamp, because `k` is part of the traversal the client rebuilds to \
+             verify — a clamped page is one the client's reconstruction did not ask for. Deep results are reached with `OFFSET`, whose skip work is bounded by \
              tree depth and does not grow with the offset."
         ))));
     }
@@ -328,6 +381,24 @@ pub fn detect_ranked_mode_v0(
         )));
     }
 
+    // ---- OFFSET × IN: mutually exclusive -----------------------------
+    //
+    // Rank-skip is served from counted subtree commitments *inside one
+    // secondary*; there is no counted structure spanning a branch
+    // union, so a cross-branch offset would have to walk (and prove)
+    // the skipped region in every branch — silently expensive. Callers
+    // who need deep pages issue per-prefix requests, where offset works
+    // exactly as documented.
+    if offset > 0 && prefix_pins.iter().any(|pin| pin.values.len() > 1) {
+        return Err(Error::Query(QuerySyntaxError::InvalidLimit(
+            "`OFFSET` cannot combine with an `IN` prefix pin: rank-skip is attested from \
+             one secondary's counted commitments, and an `IN` merges several secondaries \
+             with no counted structure over the union. Page one prefix at a time (`==` \
+             pin + `OFFSET`), or drop the offset."
+                .to_string(),
+        )));
+    }
+
     Ok(DocumentRankedMode {
         axis,
         descending,
@@ -335,6 +406,6 @@ pub fn detect_ranked_mode_v0(
         offset,
         group_by_property,
         aggregate_field,
-        equality_pins,
+        prefix_pins,
     })
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/path.rs b/packages/rs-drive/src/query/drive_document_ranked_query/path.rs
index ed3dccf0620..fe4beeeccc0 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/path.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/path.rs
@@ -1,10 +1,10 @@
 //! The grove path a ranked read / proof / verification is issued against.
 //!
-//! This is the **prover/verifier-agreement boundary** for the ranked
-//! surface. Unlike the count and sum surfaces there is no `PathQuery` to
-//! agree on — grovedb's indexed-axis envelope carries the query shape
-//! itself and re-checks `(axis, k, descending)` at verification time — so
-//! the entire shared contract is these path segments. Prover and verifier
+//! This is one half of the **prover/verifier-agreement boundary** for
+//! the ranked surface: both sides build the same axis `PathQuery` —
+//! these path segments plus the traversal (`axis, k, offset,
+//! descending`) — and grovedb re-executes the proof against that
+//! reconstruction at verification time. Prover and verifier
 //! both call [`DriveDocumentRankedQuery::indexed_property_name_tree_path`];
 //! a divergence here surfaces as a failed root-hash reconstruction, not a
 //! wrong answer, but it is still the one place the two sides must not
@@ -24,14 +24,14 @@ use dpp::data_contract::document_type::Index;
 /// tree. See [`DriveDocumentRankedQuery::indexed_property_name_tree_path`]
 /// for the segment layout.
 ///
-/// `equality_prefix_values` carries the **encoded index-key bytes** of
+/// The branch's prefix segments carry the **encoded index-key bytes** of
 /// each leading property's pinned value, in index-property order — one
 /// per property before the terminal one. Empty for a single-property
 /// index. The arity must match exactly: a compound index's terminal
 /// tree sits under one prefix value tree per leading property, and only
-/// an equality `where` clause can name those values, so a missing or
-/// surplus value means the caller resolved the wrong index — a typed
-/// error, not a guess.
+/// a `where` pin (an equality, or one element of the single permitted
+/// `IN`) can name those values, so a missing or surplus value means the
+/// caller resolved the wrong index — a typed error, not a guess.
 pub(crate) fn indexed_property_name_tree_path_for_index(
     contract_id: &[u8; 32],
     document_type_name: &str,
@@ -49,8 +49,8 @@ pub(crate) fn indexed_property_name_tree_path_for_index(
             "ranked and having-range queries over a compound index require exactly one \
              encoded equality value per leading index property: the axis secondary lives \
              on the index's terminal property-name tree, which for a compound index sits \
-             under one prefix value tree per leading property, and only an equality \
-             `where` clause can name those values",
+             under one prefix value tree per leading property, and only a `where` pin (an \
+             equality, or one element of the single permitted `IN`) can name those values",
         )));
     }
     let mut path = Vec::with_capacity(5 + 2 * leading_properties.len());
@@ -84,7 +84,7 @@ impl DriveDocumentRankedQuery<'_> {
     /// For a compound index `[p1, …, pn]`, each leading property
     /// contributes two segments — its name and the **encoded index-key
     /// bytes of its pinned value** (from
-    /// [`Self::equality_prefix_values`]) — and the terminal property
+    /// [`Self::prefix_branches`]) — and the terminal property
     /// name closes the path:
     ///
     /// ```text
@@ -101,12 +101,22 @@ impl DriveDocumentRankedQuery<'_> {
     /// Errors when the number of encoded prefix values does not match
     /// the index's leading-property count — the fail-closed backstop
     /// for a caller that resolved the query against the wrong index.
-    pub fn indexed_property_name_tree_path(&self) -> Result<Vec<Vec<u8>>, Error> {
+    ///
+    /// `branch` indexes into [`Self::prefix_branches`]; single-branch
+    /// queries (no `IN` pin) always pass `0`.
+    pub fn indexed_property_name_tree_path(&self, branch: usize) -> Result<Vec<Vec<u8>>, Error> {
+        let prefix_values =
+            self.prefix_branches
+                .get(branch)
+                .ok_or(Error::Drive(DriveError::NotSupported(
+                    "ranked and having-range queries addressed a prefix branch outside the \
+                 query's resolved branch set",
+                )))?;
         indexed_property_name_tree_path_for_index(
             &self.contract_id,
             &self.document_type_name,
             self.index,
-            &self.equality_prefix_values,
+            prefix_values,
         )
     }
 }
diff --git a/packages/rs-drive/src/query/drive_document_ranked_query/tests.rs b/packages/rs-drive/src/query/drive_document_ranked_query/tests.rs
index 0052ab8388e..27e7237c2b3 100644
--- a/packages/rs-drive/src/query/drive_document_ranked_query/tests.rs
+++ b/packages/rs-drive/src/query/drive_document_ranked_query/tests.rs
@@ -256,8 +256,9 @@ fn count_star_is_ordered_by_the_dollar_count_sentinel() {
 }
 
 /// `LIMIT 0` selects nothing and `LIMIT > MAX_RANKED_LIMIT` is refused
-/// rather than clamped — a clamp would produce a proof whose echoed `k`
-/// the client's own reconstruction rejects. The boundary itself is
+/// rather than clamped — a clamp would truncate the server's walk below
+/// the cap the client's rebuilt `PathQuery` demands coverage for, so the
+/// client's own reconstruction rejects the proof. The boundary itself is
 /// accepted.
 #[test]
 fn k_is_bounded_to_one_through_max_ranked_limit() {
@@ -280,9 +281,9 @@ fn k_is_bounded_to_one_through_max_ranked_limit() {
 }
 
 /// `LIMIT` is mandatory in ranked mode. There is no server-side default
-/// because `k` is echoed inside the proof envelope and re-checked by the
-/// verifier: a number the client never chose is a number it cannot
-/// reproduce when rebuilding the query to verify.
+/// because the verifier re-executes proofs against a `PathQuery` rebuilt
+/// from the request: a number the client never chose is a number it
+/// cannot reproduce when rebuilding the query to verify.
 #[test]
 fn limit_is_required() {
     let error = detect_avg(false, None, None).expect_err(
@@ -495,9 +496,9 @@ fn sum_and_avg_selects_require_a_field() {
 /// properties. Detection is shape-only: an equality clause becomes a
 /// pin (whether a compound index actually covers it is the resolver's
 /// call — see `pins_without_a_covering_compound_index_are_rejected`);
-/// anything that is not a distinct-property equality is refused
-/// loudly, `IN` with its own not-yet message because it will become
-/// serviceable once multi-`IN` branching lands.
+/// anything that is not a distinct-property equality — or the one
+/// permitted `IN`, which resolves to a multi-value branching pin — is
+/// refused loudly.
 #[test]
 fn where_clauses_resolve_to_equality_pins_and_reject_everything_else() {
     // Equality pin: accepted at detection, carried in the mode.
@@ -516,8 +517,11 @@ fn where_clauses_resolve_to_equality_pins_and_reject_everything_else() {
     )
     .expect("an equality pin is a well-formed prefix pin");
     assert_eq!(
-        mode.equality_pins,
-        vec![("chefId".to_string(), Value::Text("alpha".to_string()))]
+        mode.prefix_pins,
+        vec![PrefixPin {
+            field: "chefId".to_string(),
+            values: vec![Value::Text("alpha".to_string())],
+        }]
     );
 
     // A range operator can never pin a single prefix value tree.
@@ -540,14 +544,17 @@ fn where_clauses_resolve_to_equality_pins_and_reject_everything_else() {
         Error::Query(QuerySyntaxError::InvalidWhereClauseComponents(_))
     ));
 
-    // `IN` is rejected with its own message: v1 pins are equality-only,
-    // multi-`IN` branching is a future capability.
+    // `IN` resolves to a branching pin — one value per element — and a
+    // single-element `IN` is exactly an equality pin.
     let in_clause = vec![WhereClause {
         field: "chefId".to_string(),
         operator: WhereOperator::In,
-        value: Value::Array(vec![Value::Text("alpha".to_string())]),
+        value: Value::Array(vec![
+            Value::Text("beta".to_string()),
+            Value::Text("alpha".to_string()),
+        ]),
     }];
-    let error = detect_ranked_mode_v0(
+    let mode = detect_ranked_mode_v0(
         &SelectProjection::avg("grade"),
         &group_by(),
         &[],
@@ -555,16 +562,19 @@ fn where_clauses_resolve_to_equality_pins_and_reject_everything_else() {
         &in_clause,
         page(Some(2), None),
     )
-    .expect_err("IN prefixes are not yet supported");
-    match error {
-        Error::Query(QuerySyntaxError::Unsupported(message)) => {
-            assert!(
-                message.contains("IN") && message.contains("not yet supported"),
-                "the IN rejection must say it is a not-yet capability, got: {message}"
-            );
-        }
-        other => panic!("expected Unsupported for an IN prefix, got {other:?}"),
-    }
+    .expect("an IN pin is a well-formed branching pin");
+    assert_eq!(
+        mode.prefix_pins,
+        vec![PrefixPin {
+            field: "chefId".to_string(),
+            values: vec![
+                Value::Text("beta".to_string()),
+                Value::Text("alpha".to_string()),
+            ],
+        }],
+        "the pin carries the elements verbatim; canonical branch order \
+         is the encoder's job, not the grammar's"
+    );
 
     // The same property pinned twice is a caller error, not a silent
     // last-write-wins.
@@ -690,6 +700,8 @@ fn test_index(name: &str, properties: &[&str], summable: Option<&str>) -> Index
         ranked_countable: false,
         ranked_summable: false,
         ranked_averageable: false,
+        time_range: None,
+        terminal: None,
     }
 }
 
@@ -961,6 +973,7 @@ fn run(
             offset: case.offset,
             has_start_at: false,
             prove,
+            resolved_time_ranges: &[],
         },
         None,
         platform_version(),
@@ -1199,8 +1212,9 @@ fn count_axis_ranks_reads_and_proves_consistently() {
     assert_proof_round_trips(&drive, &contract, &bottom_one, &entries);
 
     // A missing LIMIT is refused end to end, not just in the pure
-    // detector: `k` is echoed in the proof envelope, so there is no
-    // server-side default a verifying client could reproduce.
+    // detector: `k` binds verification through the client's rebuilt
+    // `PathQuery`, so there is no server-side default a verifying
+    // client could reproduce.
     let mut no_limit = RankedCase::count(true, None);
     no_limit.limit = None;
     let error = run(&drive, &contract, &no_limit, false)
@@ -1385,8 +1399,8 @@ fn offset_pages_through_the_ranking_and_the_proof_attests_the_starting_rank() {
 }
 
 /// A proof of one page must not verify as another page of the same
-/// ranking. `offset` is echoed in the envelope and re-checked, which is
-/// what stops a server from answering "the 5th best" with a proof of
+/// ranking. `offset` shifts where the verifier's re-executed walk must
+/// start, which is what stops a server from answering "the 5th best" with a proof of
 /// "the best" — the entries would look perfectly valid, and only the
 /// offset binding distinguishes them.
 #[test]
@@ -1441,7 +1455,7 @@ fn a_proof_does_not_verify_under_a_different_offset() {
 /// has no entries", so a freshly registered contract queried with
 /// `prove = true` got an error until the first document landed.
 ///
-/// `prove_indexed_axis_top_k_paginated` closes that gap — it emits a
+/// The unified `PathQuery` prover closes that gap — it emits a
 /// guaranteed-empty range against the secondary rather than refusing —
 /// so the two paths now agree on empty state, and this test is the
 /// tripwire that says so. The attested `skipped` is `0`, which for an
@@ -1610,8 +1624,9 @@ fn a_tampered_proof_never_verifies_to_the_honest_root_hash() {
 
 /// The verifier must be checking the ranking it was asked about: a proof
 /// generated for one `(axis, k, descending)` triple must not verify under
-/// another. grovedb echoes all three in the envelope and re-checks them,
-/// and this pins that drive passes each of them through faithfully — a
+/// another. grovedb rebuilds the traversal from all three and re-executes
+/// the proof against it, and this pins that drive passes each of them
+/// through faithfully — a
 /// dropped argument here would let a client accept a proof of a
 /// different question.
 #[test]
@@ -2120,8 +2135,9 @@ mod pinned_prefix {
     //! and its paginated proof.
 
     use super::super::drive_dispatcher::{DocumentRankedRequest, DocumentRankedResponse};
-    use super::super::index_picker::resolve_ranked_query_for_mode;
-    use super::super::mode_detection::detect_ranked_mode;
+    use super::super::index_picker::{encode_prefix_branches, resolve_ranked_query_for_mode};
+    use super::super::mode_detection::{detect_ranked_mode, detect_ranked_mode_v0};
+    use super::super::PrefixPin;
     use super::super::{DriveDocumentRankedQuery, RankedEntry, RankedEntryValue};
     use crate::drive::Drive;
     use crate::error::query::QuerySyntaxError;
@@ -2143,6 +2159,7 @@ mod pinned_prefix {
     use dpp::tests::json_document::json_document_to_contract;
     use dpp::version::PlatformVersion;
     use grovedb::element::indexed::compute_avg_fixed_point;
+    use grovedb::TransactionArg;
     use std::collections::BTreeMap;
 
     const PREFIX_PROPERTY: &str = "identityId";
@@ -2243,6 +2260,7 @@ mod pinned_prefix {
                 having: &[],
                 order_by: &order_by,
                 where_clauses,
+                resolved_time_ranges: &[],
                 limit: Some(limit),
                 offset: None,
                 has_start_at: false,
@@ -2335,10 +2353,12 @@ mod pinned_prefix {
             page.entries,
             vec![
                 RankedEntry {
+                    in_key: None,
                     key: b"art".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(180, 2)),
                 },
                 RankedEntry {
+                    in_key: None,
                     key: b"english".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(161, 2)),
                 },
@@ -2464,6 +2484,7 @@ mod pinned_prefix {
             offset: None,
             has_start_at: false,
             prove,
+            resolved_time_ranges: &[],
         };
 
         let page = match drive
@@ -2477,10 +2498,12 @@ mod pinned_prefix {
             page.entries,
             vec![
                 RankedEntry {
+                    in_key: None,
                     key: b"math".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(170, 2)),
                 },
                 RankedEntry {
+                    in_key: None,
                     key: b"science".to_vec(),
                     value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(60, 1)),
                 },
@@ -2526,8 +2549,8 @@ mod pinned_prefix {
         )
         .expect("the compound index covers the null-pinned request");
         assert_eq!(
-            query.equality_prefix_values,
-            vec![Vec::<u8>::new()],
+            query.prefix_branches,
+            vec![vec![Vec::<u8>::new()]],
             "a null pin must encode as the write path's empty segment"
         );
         let (root_hash, verified) = query
@@ -2544,6 +2567,412 @@ mod pinned_prefix {
         );
     }
 
+    fn in_pin(identities: &[[u8; 32]]) -> Vec<WhereClause> {
+        vec![WhereClause {
+            field: PREFIX_PROPERTY.to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(
+                identities
+                    .iter()
+                    .map(|identity| Value::Identifier(*identity))
+                    .collect(),
+            ),
+        }]
+    }
+
+    /// `identityId IN [X, Y]` walks each identity's own secondary and
+    /// merges: descending aggregate order, entries tagged with their
+    /// branch's `in_key`, and a **cross-prefix aggregate tie** breaking
+    /// by encoded prefix ascending (X's 32 `1`-bytes before Y's `2`s) —
+    /// the comparator's middle term, observable only here. The proof is
+    /// one branched `PathQuery` envelope, round-tripped through the
+    /// shared resolver against the live root hash.
+    #[test]
+    fn in_pinned_top_k_merges_branches_and_proves() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(
+            &drive,
+            &contract,
+            &[
+                // X: art 90, math 80. Y: science 95, history 90 — the
+                // two 90s are the cross-prefix tie.
+                (IDENTITY_X, "art", 90),
+                (IDENTITY_X, "math", 80),
+                (IDENTITY_Y, "science", 95),
+                (IDENTITY_Y, "history", 90),
+            ],
+        );
+
+        // Request order [Y, X] deliberately reversed: canonical branch
+        // order is by encoded prefix, not by element order.
+        let pins = in_pin(&[IDENTITY_Y, IDENTITY_X]);
+        let page = match run(&drive, &contract, &pins, 3, false).expect("read succeeds") {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries, got a proof"),
+        };
+        assert_eq!(page.skipped, 0);
+        assert_eq!(
+            page.entries,
+            vec![
+                RankedEntry {
+                    in_key: Some(IDENTITY_Y.to_vec()),
+                    key: b"science".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(95, 1)),
+                },
+                RankedEntry {
+                    in_key: Some(IDENTITY_X.to_vec()),
+                    key: b"art".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+                },
+                RankedEntry {
+                    in_key: Some(IDENTITY_Y.to_vec()),
+                    key: b"history".to_vec(),
+                    value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+                },
+            ],
+            "top 3 across the union: science 95, then the 90–90 tie broken \
+             by encoded prefix ascending (X's art before Y's history)"
+        );
+
+        let proof = match run(&drive, &contract, &pins, 3, true).expect("prove succeeds") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof, got entries"),
+        };
+        let query = client_side_query(&contract, &pins, 3);
+        assert_eq!(query.prefix_branches.len(), 2, "two branches resolved");
+        let (root_hash, verified) = query
+            .verify_ranked_top_k_proof(&proof, platform_version())
+            .expect("the branched envelope must verify");
+        assert_eq!(verified.entries, page.entries);
+        assert_eq!(
+            root_hash,
+            drive
+                .grove
+                .root_hash(None, &platform_version().drive.grove_version)
+                .unwrap()
+                .expect("root hash must be readable"),
+        );
+    }
+
+    /// Platform-level tamper cases on the branched envelope. The deep
+    /// matrix — reordered branch keys, duplicated or dropped branch
+    /// tails, echo mismatches — is pinned in grovedb's
+    /// `indexed_axis_branched_proof_tests`, since the envelope is one
+    /// grovedb proof now; here we pin what the platform layer itself
+    /// must not confuse: corrupted bytes, and the single-branch /
+    /// multi-branch envelope shapes never cross-verifying.
+    #[test]
+    fn tampered_or_mismatched_branched_proofs_do_not_verify() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(
+            &drive,
+            &contract,
+            &[(IDENTITY_X, "art", 90), (IDENTITY_Y, "science", 95)],
+        );
+        let pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        let proof = match run(&drive, &contract, &pins, 2, true).expect("prove succeeds") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof, got entries"),
+        };
+        let query = client_side_query(&contract, &pins, 2);
+
+        // Baseline sanity: untampered verifies.
+        query
+            .verify_ranked_top_k_proof(&proof, platform_version())
+            .expect("untampered branched envelope verifies");
+
+        // Corrupted bytes.
+        let mut corrupted = proof.clone();
+        let mid = corrupted.len() / 2;
+        corrupted[mid] ^= 0xFF;
+        assert!(
+            query
+                .verify_ranked_top_k_proof(&corrupted, platform_version())
+                .is_err(),
+            "a flipped byte must not verify"
+        );
+
+        // Truncated bytes.
+        let truncated = &proof[..proof.len() - 8];
+        assert!(
+            query
+                .verify_ranked_top_k_proof(truncated, platform_version())
+                .is_err(),
+            "a truncated envelope must not verify"
+        );
+
+        // A single-pin proof must not verify under the branched query,
+        // nor a branched proof under a single-pin query — the two
+        // envelope shapes are distinct grovedb types.
+        let single = pin(IDENTITY_X);
+        let single_proof = match run(&drive, &contract, &single, 2, true).expect("prove") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof"),
+        };
+        assert!(
+            query
+                .verify_ranked_top_k_proof(&single_proof, platform_version())
+                .is_err(),
+            "a single-branch envelope must not verify under an IN query"
+        );
+        let single_query = client_side_query(&contract, &single, 2);
+        assert!(
+            single_query
+                .verify_ranked_top_k_proof(&proof, platform_version())
+                .is_err(),
+            "a branched envelope must not verify under a single-pin query"
+        );
+    }
+
+    /// A single-element `IN` is normalized to an equality pin at
+    /// grammar time: same resolved branch set, same entries, and the
+    /// **same proof bytes** — the degenerate case is byte-identical to
+    /// `==`, so no client can observe which spelling was used.
+    #[test]
+    fn single_element_in_is_byte_identical_to_an_equality_pin() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "art", 90)]);
+
+        let equality = pin(IDENTITY_X);
+        let single_in = in_pin(&[IDENTITY_X]);
+
+        let eq_query = client_side_query(&contract, &equality, 2);
+        let in_query = client_side_query(&contract, &single_in, 2);
+        assert_eq!(eq_query.prefix_branches, in_query.prefix_branches);
+
+        let eq_proof = match run(&drive, &contract, &equality, 2, true).expect("prove") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof"),
+        };
+        let in_proof = match run(&drive, &contract, &single_in, 2, true).expect("prove") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof"),
+        };
+        assert_eq!(eq_proof, in_proof, "no container for a single branch");
+
+        let eq_page = match run(&drive, &contract, &equality, 2, false).expect("read") {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        let in_page = match run(&drive, &contract, &single_in, 2, false).expect("read") {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        assert_eq!(
+            eq_page.entries, in_page.entries,
+            "a singleton IN reads exactly what the equality pin reads"
+        );
+        assert!(
+            eq_page.entries.iter().all(|e| e.in_key.is_none()),
+            "single-branch entries carry no in_key"
+        );
+    }
+
+    /// `OFFSET` is rejected together with an `IN` pin — rank-skip is
+    /// attested per-secondary and has no meaning across a branch union.
+    #[test]
+    fn offset_is_rejected_with_an_in_pin() {
+        let error = detect_ranked_mode_v0(
+            &SelectProjection::avg("grade"),
+            &[CLASS_PROPERTY.to_string()],
+            &[],
+            &[OrderClause {
+                field: "grade".to_string(),
+                ascending: false,
+            }],
+            &in_pin(&[IDENTITY_X, IDENTITY_Y]),
+            RankedPaginationInputs {
+                limit: Some(2),
+                offset: Some(1),
+                has_start_at: false,
+            },
+        )
+        .expect_err("offset cannot combine with IN");
+        match error {
+            Error::Query(QuerySyntaxError::InvalidLimit(message)) => {
+                assert!(
+                    message.contains("OFFSET") && message.contains("IN"),
+                    "the rejection must name the offset × IN exclusion, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidLimit, got {other:?}"),
+        }
+    }
+
+    /// Grammar rejections around the `IN` pin: over-cap element lists,
+    /// empty lists, a second `IN`, a non-array operand, and elements
+    /// that encode to the same segment.
+    #[test]
+    fn in_pin_shape_rejections() {
+        let detect = |where_clauses: &[WhereClause]| {
+            detect_ranked_mode_v0(
+                &SelectProjection::avg("grade"),
+                &[CLASS_PROPERTY.to_string()],
+                &[],
+                &[OrderClause {
+                    field: "grade".to_string(),
+                    ascending: false,
+                }],
+                where_clauses,
+                RankedPaginationInputs {
+                    limit: Some(2),
+                    offset: None,
+                    has_start_at: false,
+                },
+            )
+        };
+
+        // Over the branch ceiling.
+        let identities: Vec<[u8; 32]> = (0..11).map(|i| [i as u8 + 1; 32]).collect();
+        let error = detect(&in_pin(&identities)).expect_err("11 branches is over the cap");
+        match error {
+            Error::Query(QuerySyntaxError::InvalidParameter(message)) => {
+                assert!(
+                    message.contains("ceiling of 10"),
+                    "the rejection must name the ceiling, got: {message}"
+                );
+            }
+            other => panic!("expected InvalidParameter, got {other:?}"),
+        }
+
+        // Empty element list.
+        let empty = vec![WhereClause {
+            field: PREFIX_PROPERTY.to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![]),
+        }];
+        assert!(detect(&empty).is_err(), "an empty IN list must be rejected");
+
+        // Two *branching* INs are rejected in either clause order.
+        let multi = |field: &str| WhereClause {
+            field: field.to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![Value::U64(1), Value::U64(2)]),
+        };
+        for two_ins in [
+            vec![multi(PREFIX_PROPERTY), multi("other")],
+            vec![multi("other"), multi(PREFIX_PROPERTY)],
+        ] {
+            let error = detect(&two_ins).expect_err("two branching INs must be rejected");
+            assert!(
+                matches!(error, Error::Query(QuerySyntaxError::Unsupported(_))),
+                "expected Unsupported for a second branching IN, got {error:?}"
+            );
+        }
+
+        // A singleton IN is an equality pin and never counts against
+        // the one-`IN` budget — in either clause order relative to the
+        // branching one.
+        let singleton = WhereClause {
+            field: "other".to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![Value::U64(1)]),
+        };
+        for mixed in [
+            vec![multi(PREFIX_PROPERTY), singleton.clone()],
+            vec![singleton.clone(), multi(PREFIX_PROPERTY)],
+        ] {
+            let mode = detect(&mixed)
+                .expect("a singleton IN alongside a branching IN is well-formed either way");
+            assert_eq!(
+                mode.prefix_pins
+                    .iter()
+                    .map(|pin| pin.values.len())
+                    .collect::<Vec<_>>(),
+                if mixed[0].field == "other" {
+                    vec![1, 2]
+                } else {
+                    vec![2, 1]
+                },
+                "one branching pin and one singleton pin, in clause order"
+            );
+        }
+
+        // Non-array operand.
+        let scalar = vec![WhereClause {
+            field: PREFIX_PROPERTY.to_string(),
+            operator: WhereOperator::In,
+            value: Value::U64(7),
+        }];
+        assert!(
+            detect(&scalar).is_err(),
+            "a scalar IN operand must be rejected"
+        );
+
+        // Duplicate elements surface at the encoder (post-encoding
+        // distinctness), through the resolver.
+        let (_, contract) = setup_grades_compound_ranked();
+        let duplicated = in_pin(&[IDENTITY_X, IDENTITY_X]);
+        let mode = detect(&duplicated).expect("shape-valid; duplicates are the encoder's call");
+        let error = resolve_ranked_query_for_mode(
+            contract.id_ref().to_buffer(),
+            contract
+                .document_type_for_name(DOCUMENT_TYPE)
+                .expect("grade doctype exists"),
+            DOCUMENT_TYPE.to_string(),
+            contract
+                .document_types()
+                .get(DOCUMENT_TYPE)
+                .expect("grade doctype exists")
+                .indexes(),
+            &mode,
+            platform_version(),
+        )
+        .expect_err("duplicate encoded elements must be rejected");
+        assert!(
+            matches!(
+                error,
+                Error::Query(QuerySyntaxError::InvalidWhereClauseComponents(_))
+            ),
+            "expected the duplicate-encoding rejection, got {error:?}"
+        );
+    }
+
+    /// An `IN` element whose prefix was never written contributes the
+    /// **empty branch** — union semantics — while the single-`==`-pin
+    /// contract keeps erroring on an unknown value (pinned separately
+    /// by `unknown_prefix_value_errors_rather_than_fabricating_an_empty_page`).
+    /// The proved path authenticates the absence inside the branched
+    /// envelope, so read, proof, and verification agree.
+    #[test]
+    fn an_absent_in_element_contributes_an_empty_branch() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "art", 90)]);
+
+        let never_written = [9u8; 32];
+        let pins = in_pin(&[IDENTITY_X, never_written]);
+        let page = match run(&drive, &contract, &pins, 2, false).expect("read succeeds") {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries, got a proof"),
+        };
+        assert_eq!(
+            page.entries,
+            vec![RankedEntry {
+                in_key: Some(IDENTITY_X.to_vec()),
+                key: b"art".to_vec(),
+                value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+            }],
+            "only the existing branch contributes; the absent one is empty, not an error"
+        );
+
+        let proof = match run(&drive, &contract, &pins, 2, true).expect("prove succeeds") {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof, got entries"),
+        };
+        let (root_hash, verified) = client_side_query(&contract, &pins, 2)
+            .verify_ranked_top_k_proof(&proof, platform_version())
+            .expect("the envelope authenticates the absent branch");
+        assert_eq!(verified.entries, page.entries);
+        assert_eq!(
+            root_hash,
+            drive
+                .grove
+                .root_hash(None, &platform_version().drive.grove_version)
+                .unwrap()
+                .expect("root hash must be readable"),
+        );
+    }
+
     /// An unpinned request over the compound-only contract has no
     /// covering index — there is no global cross-prefix ordering to
     /// serve, so the rejection names the missing coverage.
@@ -2562,4 +2991,588 @@ mod pinned_prefix {
             "expected a no-covering-index rejection, got {error:?}"
         );
     }
+
+    const DUAL_DOCTYPE: &str = "dualGrade";
+
+    fn insert_dual_grades(
+        drive: &Drive,
+        contract: &DataContract,
+        rows: &[([u8; 32], &str, &str, i64)],
+    ) {
+        let pv = platform_version();
+        let document_type = contract
+            .document_type_for_name(DUAL_DOCTYPE)
+            .expect("dualGrade doctype exists");
+        for (i, (identity, tag, class, grade)) in rows.iter().enumerate() {
+            let mut doc: Document = document_type
+                .random_document(Some(8000 + i as u64), pv)
+                .expect("random document");
+            let mut props = BTreeMap::new();
+            props.insert(PREFIX_PROPERTY.to_string(), Value::Identifier(*identity));
+            props.insert("tag".to_string(), Value::Text(tag.to_string()));
+            props.insert(CLASS_PROPERTY.to_string(), Value::Text(class.to_string()));
+            props.insert("grade".to_string(), Value::I64(*grade));
+            doc.set_properties(props);
+            drive
+                .add_document_for_contract(
+                    DocumentAndContractInfo {
+                        owned_document_info: OwnedDocumentInfo {
+                            document_info: DocumentRefInfo((&doc, None)),
+                            owner_id: None,
+                        },
+                        contract,
+                        document_type,
+                    },
+                    false,
+                    BlockInfo::default(),
+                    true,
+                    None,
+                    pv,
+                    None,
+                )
+                .expect("expected to insert a dualGrade document");
+        }
+    }
+
+    fn run_dual(
+        drive: &Drive,
+        contract: &DataContract,
+        where_clauses: &[WhereClause],
+        limit: u32,
+        prove: bool,
+        transaction: TransactionArg,
+    ) -> Result<DocumentRankedResponse, Error> {
+        let group_by = vec![CLASS_PROPERTY.to_string()];
+        let order_by = vec![OrderClause {
+            field: "grade".to_string(),
+            ascending: false,
+        }];
+        drive.execute_document_ranked_request(
+            DocumentRankedRequest {
+                contract,
+                document_type: contract
+                    .document_type_for_name(DUAL_DOCTYPE)
+                    .expect("dualGrade doctype exists"),
+                group_by: &group_by,
+                select: SelectProjection::avg("grade"),
+                having: &[],
+                order_by: &order_by,
+                where_clauses,
+                resolved_time_ranges: &[],
+                limit: Some(limit),
+                offset: None,
+                has_start_at: false,
+                prove,
+            },
+            transaction,
+            platform_version(),
+        )
+    }
+
+    /// An `IN` element whose branch-key tree EXISTS (another pin value was
+    /// written under it) but whose deeper pinned path was never written is
+    /// an ABSENT branch — empty page, union semantics — not an error that
+    /// discards the other branches' results. grovedb's branched reader and
+    /// prover authenticate absence at any depth of the branch chain, so the
+    /// unproved executor must walk the whole chain too.
+    #[test]
+    fn an_in_element_with_an_absent_deeper_pin_contributes_an_empty_branch() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        // Y's tree exists (via tag "t2"), but Y/t1 was never written.
+        insert_dual_grades(
+            &drive,
+            &contract,
+            &[
+                (IDENTITY_X, "t1", "math", 90),
+                (IDENTITY_Y, "t2", "math", 80),
+            ],
+        );
+
+        let mut pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        pins.push(WhereClause {
+            field: "tag".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::Text("t1".to_string()),
+        });
+
+        let page = match run_dual(&drive, &contract, &pins, 2, false, None)
+            .expect("a present branch key with an absent deeper pin must not error")
+        {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries, got a proof"),
+        };
+        assert_eq!(
+            page.entries,
+            vec![RankedEntry {
+                in_key: Some(IDENTITY_X.to_vec()),
+                key: b"math".to_vec(),
+                value: RankedEntryValue::AvgFixedPoint(compute_avg_fixed_point(90, 1)),
+            }],
+            "X/t1 contributes; Y (present key, absent t1 suffix) is an empty branch"
+        );
+
+        // The proved path must agree byte-for-byte with the unproved one.
+        let proof = match run_dual(&drive, &contract, &pins, 2, true, None)
+            .expect("the branched envelope authenticates the absent suffix")
+        {
+            DocumentRankedResponse::Proof(proof) => proof,
+            DocumentRankedResponse::Entries(_) => panic!("expected a proof, got entries"),
+        };
+        let group_by = vec![CLASS_PROPERTY.to_string()];
+        let order_by = vec![OrderClause {
+            field: "grade".to_string(),
+            ascending: false,
+        }];
+        let pv = platform_version();
+        let mode = detect_ranked_mode(
+            &SelectProjection::avg("grade"),
+            &group_by,
+            &[],
+            &order_by,
+            &pins,
+            RankedPaginationInputs {
+                limit: Some(2),
+                offset: None,
+                has_start_at: false,
+            },
+            pv,
+        )
+        .expect("well-formed");
+        let query = resolve_ranked_query_for_mode(
+            contract.id_ref().to_buffer(),
+            contract
+                .document_type_for_name(DUAL_DOCTYPE)
+                .expect("dualGrade doctype exists"),
+            DUAL_DOCTYPE.to_string(),
+            contract
+                .document_types()
+                .get(DUAL_DOCTYPE)
+                .expect("dualGrade doctype exists")
+                .indexes(),
+            &mode,
+            pv,
+        )
+        .expect("covered");
+        let (root_hash, verified) = query
+            .verify_ranked_top_k_proof(&proof, pv)
+            .expect("the proof verifies");
+        assert_eq!(verified.entries, page.entries);
+        assert_eq!(
+            root_hash,
+            drive
+                .grove
+                .root_hash(None, &pv.drive.grove_version)
+                .unwrap()
+                .expect("root hash must be readable"),
+        );
+    }
+
+    /// A `null` pin addresses its prefix through an EMPTY path segment,
+    /// which the branched proof grammar cannot express — so combining it
+    /// with an `IN` is rejected at the grammar instead of serving the
+    /// unproved read and failing the prove.
+    #[test]
+    fn a_null_pin_cannot_combine_with_an_in() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_dual_grades(&drive, &contract, &[(IDENTITY_X, "t1", "math", 90)]);
+
+        let mut pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        pins.push(WhereClause {
+            field: "tag".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::Null,
+        });
+
+        let error = run_dual(&drive, &contract, &pins, 2, false, None)
+            .expect_err("null x IN must be rejected");
+        assert!(
+            matches!(
+                &error,
+                Error::Query(QuerySyntaxError::InvalidWhereClauseComponents(message))
+                    if message.contains("`null` pin")
+            ),
+            "the rejection must name the null x IN exclusion, got {error:?}"
+        );
+    }
+
+    /// A branched unproved read REJECTS a caller transaction, mirroring
+    /// the branched prover: an ordinary grovedb transaction reads the
+    /// latest committed state on every operation, so forwarding it could
+    /// tear the union across branches. Per-element reads keep the
+    /// transactional capability exactly — a single-pin read is one
+    /// grovedb operation and serves the transaction's own writes — and
+    /// the committed (`None`) branched read is unaffected.
+    #[test]
+    fn a_branched_unproved_read_rejects_an_ordinary_transaction() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        let pv = platform_version();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "math", 80)]);
+
+        let transaction = drive.grove.start_transaction();
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("grade doctype exists");
+        let mut doc: Document = document_type
+            .random_document(Some(9000), pv)
+            .expect("random document");
+        let mut props = BTreeMap::new();
+        props.insert(PREFIX_PROPERTY.to_string(), Value::Identifier(IDENTITY_Y));
+        props.insert(
+            CLASS_PROPERTY.to_string(),
+            Value::Text("science".to_string()),
+        );
+        props.insert("grade".to_string(), Value::I64(95));
+        doc.set_properties(props);
+        drive
+            .add_document_for_contract(
+                DocumentAndContractInfo {
+                    owned_document_info: OwnedDocumentInfo {
+                        document_info: DocumentRefInfo((&doc, None)),
+                        owner_id: None,
+                    },
+                    contract: &contract,
+                    document_type,
+                },
+                false,
+                BlockInfo::default(),
+                true,
+                Some(&transaction),
+                pv,
+                None,
+            )
+            .expect("expected to insert Y's grade inside the transaction");
+
+        let pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        let group_by = vec![CLASS_PROPERTY.to_string()];
+        let order_by = vec![OrderClause {
+            field: "grade".to_string(),
+            ascending: false,
+        }];
+        let request = || DocumentRankedRequest {
+            contract: &contract,
+            document_type,
+            group_by: &group_by,
+            select: SelectProjection::avg("grade"),
+            having: &[],
+            order_by: &order_by,
+            where_clauses: &pins,
+            resolved_time_ranges: &[],
+            limit: Some(4),
+            offset: None,
+            has_start_at: false,
+            prove: false,
+        };
+
+        let error = drive
+            .execute_document_ranked_request(request(), Some(&transaction), pv)
+            .expect_err("a transactional branched read must fail closed");
+        assert!(
+            matches!(
+                &error,
+                Error::Drive(crate::error::drive::DriveError::NotSupported(message))
+                    if message.contains("tear the union")
+            ),
+            "expected the caller-transaction rejection, got {error:?}"
+        );
+
+        // Per-element under the SAME transaction: the single-pin read is
+        // one grovedb operation and serves the branch written only
+        // inside it.
+        let y_pin = pin(IDENTITY_Y);
+        let y_request = DocumentRankedRequest {
+            contract: &contract,
+            document_type,
+            group_by: &group_by,
+            select: SelectProjection::avg("grade"),
+            having: &[],
+            order_by: &order_by,
+            where_clauses: &y_pin,
+            resolved_time_ranges: &[],
+            limit: Some(4),
+            offset: None,
+            has_start_at: false,
+            prove: false,
+        };
+        let with_tx = match drive
+            .execute_document_ranked_request(y_request, Some(&transaction), pv)
+            .expect("the transactional single-pin read serves")
+        {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        assert_eq!(
+            with_tx
+                .entries
+                .iter()
+                .map(|e| (e.key.clone(), e.in_key.clone()))
+                .collect::<Vec<_>>(),
+            vec![(b"science".to_vec(), None)],
+            "the single-pin read serves the transaction's own branch"
+        );
+
+        let without_tx = match drive
+            .execute_document_ranked_request(request(), None, pv)
+            .expect("the committed branched read serves")
+        {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        assert_eq!(
+            without_tx
+                .entries
+                .iter()
+                .map(|e| e.in_key.clone())
+                .collect::<Vec<_>>(),
+            vec![Some(IDENTITY_X.to_vec())],
+            "without the transaction Y's uncommitted branch is authenticated absent"
+        );
+    }
+
+    /// grovedb's unified `prove_query` proves committed state only, so an
+    /// `IN`-pinned prove under a caller transaction fails closed instead of
+    /// silently proving a different snapshot than the unproved read serves.
+    #[test]
+    fn a_branched_prove_rejects_a_transaction() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "math", 80)]);
+
+        let transaction = drive.grove.start_transaction();
+        let pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        let group_by = vec![CLASS_PROPERTY.to_string()];
+        let order_by = vec![OrderClause {
+            field: "grade".to_string(),
+            ascending: false,
+        }];
+        let error = drive
+            .execute_document_ranked_request(
+                DocumentRankedRequest {
+                    contract: &contract,
+                    document_type: contract
+                        .document_type_for_name(DOCUMENT_TYPE)
+                        .expect("grade doctype exists"),
+                    group_by: &group_by,
+                    select: SelectProjection::avg("grade"),
+                    having: &[],
+                    order_by: &order_by,
+                    where_clauses: &pins,
+                    resolved_time_ranges: &[],
+                    limit: Some(2),
+                    offset: None,
+                    has_start_at: false,
+                    prove: true,
+                },
+                Some(&transaction),
+                platform_version(),
+            )
+            .expect_err("a transactional branched prove must fail closed");
+        assert!(
+            matches!(
+                &error,
+                Error::Drive(crate::error::drive::DriveError::NotSupported(message))
+                    if message.contains("committed state")
+            ),
+            "expected the committed-state-only rejection, got {error:?}"
+        );
+
+        // The unproved read is unaffected by the failed prove; it serves
+        // committed state (a transactional branched read is likewise
+        // rejected — pinned by
+        // `a_branched_unproved_read_rejects_an_ordinary_transaction`).
+        let page = match run(&drive, &contract, &pins, 2, false)
+            .expect("the committed unproved read is unaffected")
+        {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        assert_eq!(page.entries.len(), 1);
+    }
+
+    /// The offset x `IN` exclusion survives resolution: the grammar
+    /// rejects the combination, but `offset` is a public field and a
+    /// mode is publicly constructible, so every execution, proving and
+    /// verification boundary re-checks it — a resolved query mutated
+    /// into the forbidden shape is refused, not served as a page-broken
+    /// merge that reports `skipped: 0`.
+    #[test]
+    fn a_mutated_offset_cannot_combine_with_branches() {
+        let (drive, contract) = setup_grades_compound_ranked();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "math", 80)]);
+
+        let mut query = client_side_query(&contract, &in_pin(&[IDENTITY_X, IDENTITY_Y]), 2);
+        query.offset = 1;
+        let pv = platform_version();
+
+        let read = query
+            .execute_top_k_no_proof(&drive, None, pv)
+            .expect_err("a branched read with a mutated offset must be refused");
+        assert!(
+            matches!(&read, Error::Query(QuerySyntaxError::InvalidLimit(m)) if m.contains("cannot combine")),
+            "expected the offset x IN rejection on the read path, got {read:?}"
+        );
+        let prove = query
+            .execute_top_k_with_proof(&drive, None, pv)
+            .expect_err("a branched prove with a mutated offset must be refused");
+        assert!(
+            matches!(&prove, Error::Query(QuerySyntaxError::InvalidLimit(_))),
+            "expected the offset x IN rejection on the prove path, got {prove:?}"
+        );
+        let verify = query
+            .verify_ranked_top_k_proof(&[], pv)
+            .expect_err("verification with a mutated offset must be refused");
+        assert!(
+            matches!(&verify, Error::Query(QuerySyntaxError::InvalidLimit(_))),
+            "expected the offset x IN rejection on the verify path, got {verify:?}"
+        );
+    }
+
+    /// The public encoder enforces the documented branch ceiling itself:
+    /// its callers' grammar checks are not the only line of defense.
+    #[test]
+    fn the_prefix_encoder_enforces_the_branch_ceiling() {
+        let (_drive, contract) = setup_grades_compound_ranked();
+        let document_type = contract
+            .document_type_for_name(DOCUMENT_TYPE)
+            .expect("grade doctype exists");
+        let index = contract
+            .document_types()
+            .get(DOCUMENT_TYPE)
+            .expect("grade doctype exists")
+            .indexes()
+            .values()
+            .next()
+            .expect("the compound ranked index exists");
+        let pins = vec![PrefixPin {
+            field: PREFIX_PROPERTY.to_string(),
+            values: (0u8..=10).map(|i| Value::Identifier([i; 32])).collect(),
+        }];
+        let error = encode_prefix_branches(document_type, index, &pins, platform_version())
+            .expect_err("11 branches must exceed the ceiling");
+        assert!(
+            matches!(
+                &error,
+                Error::Query(QuerySyntaxError::InvalidWhereClauseComponents(message))
+                    if message.contains("more branches")
+            ),
+            "expected the fan-out ceiling rejection, got {error:?}"
+        );
+    }
+
+    /// The `IN` union is served from ONE committed state through the
+    /// production `None` path itself: the executor takes a snapshot
+    /// read transaction internally, and the test-only seam
+    /// (`branches::test_hooks::AFTER_BRANCHED_SNAPSHOT`) lands a commit
+    /// deterministically INSIDE the window — after that snapshot is
+    /// taken, before the branched call runs. The `None` read must
+    /// return the pre-commit union (the new branch still absent, the
+    /// changed page unchanged); a second `None` read after the window
+    /// returns the post-commit union. Removing the executor's internal
+    /// snapshot selection fails this test.
+    #[test]
+    fn a_branched_read_is_pinned_to_one_committed_state() {
+        use std::time::Duration;
+
+        let (drive, contract) = setup_grades_compound_ranked();
+        let pv = platform_version();
+        insert_grades(&drive, &contract, &[(IDENTITY_X, "math", 80)]);
+
+        // The mid-window "block commit": Y's branch springs into
+        // existence and X gains a class. Documents are built with
+        // distinct seeds so they cannot collide with `insert_grades`'.
+        let commit_post_snapshot_rows = || {
+            let document_type = contract
+                .document_type_for_name(DOCUMENT_TYPE)
+                .expect("grade doctype exists");
+            for (seed, identity, class, grade) in [
+                (9100u64, IDENTITY_Y, "science", 95i64),
+                (9101u64, IDENTITY_X, "art", 90i64),
+            ] {
+                let mut doc: Document = document_type
+                    .random_document(Some(seed), pv)
+                    .expect("random document");
+                let mut props = BTreeMap::new();
+                props.insert(PREFIX_PROPERTY.to_string(), Value::Identifier(identity));
+                props.insert(CLASS_PROPERTY.to_string(), Value::Text(class.to_string()));
+                props.insert("grade".to_string(), Value::I64(grade));
+                doc.set_properties(props);
+                drive
+                    .add_document_for_contract(
+                        DocumentAndContractInfo {
+                            owned_document_info: OwnedDocumentInfo {
+                                document_info: DocumentRefInfo((&doc, None)),
+                                owner_id: None,
+                            },
+                            contract: &contract,
+                            document_type,
+                        },
+                        false,
+                        BlockInfo::default(),
+                        true,
+                        None,
+                        pv,
+                        None,
+                    )
+                    .expect("expected to commit the mid-window grade");
+            }
+        };
+
+        // Rendezvous: when the executor's hook fires (snapshot taken,
+        // read not yet run), wake the writer, wait for its commit to
+        // land, then let the read proceed.
+        let (enter_window_tx, enter_window_rx) = std::sync::mpsc::channel::<()>();
+        let (commit_done_tx, commit_done_rx) = std::sync::mpsc::channel::<()>();
+        super::super::branches::test_hooks::AFTER_BRANCHED_SNAPSHOT.with(|hook| {
+            *hook.borrow_mut() = Some(Box::new(move || {
+                let _ = enter_window_tx.send(());
+                let _ = commit_done_rx.recv_timeout(Duration::from_secs(20));
+            }));
+        });
+
+        let pins = in_pin(&[IDENTITY_X, IDENTITY_Y]);
+        let pinned = std::thread::scope(|scope| {
+            scope.spawn(move || {
+                if enter_window_rx
+                    .recv_timeout(Duration::from_secs(20))
+                    .is_ok()
+                {
+                    commit_post_snapshot_rows();
+                    let _ = commit_done_tx.send(());
+                }
+            });
+            match run(&drive, &contract, &pins, 4, false)
+                .expect("the branched read serves across the mid-window commit")
+            {
+                DocumentRankedResponse::Entries(page) => page,
+                DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+            }
+        });
+        super::super::branches::test_hooks::AFTER_BRANCHED_SNAPSHOT.with(|hook| {
+            *hook.borrow_mut() = None;
+        });
+
+        // The `None` read observed the pre-commit state even though the
+        // commit landed inside its window: Y's branch still absent
+        // (empty, not an error), X still math-only.
+        assert_eq!(
+            pinned
+                .entries
+                .iter()
+                .map(|e| e.key.clone())
+                .collect::<Vec<_>>(),
+            vec![b"math".to_vec()],
+            "the automatic snapshot pins the union to the pre-commit state"
+        );
+
+        // A fresh committed read sees the post-commit union.
+        let fresh = match run(&drive, &contract, &pins, 4, false)
+            .expect("the committed branched read serves")
+        {
+            DocumentRankedResponse::Entries(page) => page,
+            DocumentRankedResponse::Proof(_) => panic!("expected entries"),
+        };
+        assert_eq!(
+            fresh.entries.len(),
+            3,
+            "the committed union reflects the commit"
+        );
+    }
 }
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/drive_dispatcher.rs b/packages/rs-drive/src/query/drive_document_sum_query/drive_dispatcher.rs
index 11d3ef38db8..da3cf1652ef 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/drive_dispatcher.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/drive_dispatcher.rs
@@ -10,13 +10,18 @@
 //! CBOR-decoded `Value::Array` input into structured `Vec<WhereClause>` /
 //! `Vec<OrderClause>`. Identical input contract to count.
 
+use crate::config::DriveConfig;
 use crate::drive::Drive;
+use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::drive_document_sum_query::{
     DocumentSumMode, DocumentSumRequest, DocumentSumResponse, RangeSumOptions, RangeSumWalkMode,
     SumMode,
 };
-use crate::query::{OrderClause, WhereClause};
+use crate::query::{
+    validate_and_canonicalize_where_clauses, validate_resolved_time_range_clause_shapes,
+    OrderClause, WhereClause,
+};
 use dpp::data_contract::accessors::v0::DataContractV0Getters;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::platform_value::Value;
@@ -25,18 +30,16 @@ use grovedb::TransactionArg;
 
 fn effective_no_proof_distinct_limit(
     requested_limit: Option<u32>,
-    drive_config: &crate::config::DriveConfig,
+    drive_config: &DriveConfig,
 ) -> Result<u16, Error> {
     let effective_limit = requested_limit
         .unwrap_or(drive_config.default_query_limit as u32)
         .min(drive_config.max_query_limit as u32);
 
     if effective_limit == 0 {
-        return Err(Error::Query(
-            crate::error::query::QuerySyntaxError::InvalidLimit(
-                "effective distinct SUM limit must be greater than zero".to_string(),
-            ),
-        ));
+        return Err(Error::Query(QuerySyntaxError::InvalidLimit(
+            "effective distinct SUM limit must be greater than zero".to_string(),
+        )));
     }
 
     // Both configuration limits are u16, and the `min` above bounds every
@@ -53,15 +56,28 @@ impl Drive {
     /// Mirrors [`Drive::execute_document_count_request`].
     pub fn execute_document_sum_request(
         &self,
-        request: DocumentSumRequest,
+        mut request: DocumentSumRequest,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
     ) -> Result<DocumentSumResponse, Error> {
+        // Canonicalize exactly as the count and joint dispatchers do (the
+        // shared step in [`crate::query::canonicalize`]), so callers can
+        // pass either the bounded pair form (`[f > A, f < B]`) or the
+        // pre-merged `between*` form and get equivalent mode detection.
+        request.where_clauses =
+            validate_and_canonicalize_where_clauses(request.where_clauses, platform_version)?;
+        // Same provenance-vs-shape contract as the count and joint
+        // dispatchers, anchored before mode detection just as there.
+        validate_resolved_time_range_clause_shapes(
+            &request.where_clauses,
+            &request.resolved_time_ranges,
+        )?;
         let resolved_mode = super::mode_detection::detect_sum_mode(&request, platform_version)?;
 
         let contract_id = request.contract.id().to_buffer();
         let document_type_name = request.document_type.name().to_string();
         let where_clauses = request.where_clauses;
+        let resolved_time_ranges = request.resolved_time_ranges;
         let sum_property = request.sum_property;
         // Default direction is ascending; the first order clause's
         // direction (if any) wins. Mirrors count's analog.
@@ -78,6 +94,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     transaction,
                     platform_version,
@@ -97,6 +114,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         sum_property,
                         options,
                         transaction,
@@ -127,6 +145,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     options,
                     transaction,
@@ -145,6 +164,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     transaction,
                     platform_version,
@@ -196,6 +216,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         sum_property,
                         limit_u16,
                         order_by_ascending,
@@ -210,6 +231,7 @@ impl Drive {
                     request.document_type,
                     document_type_name,
                     where_clauses,
+                    &resolved_time_ranges,
                     sum_property,
                     transaction,
                     platform_version,
@@ -254,6 +276,7 @@ impl Drive {
                         request.document_type,
                         document_type_name,
                         where_clauses,
+                        &resolved_time_ranges,
                         sum_property,
                         limit_u16,
                         order_by_ascending,
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/per_in_value.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/per_in_value.rs
index 251cf2917f8..e54dedd6187 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/per_in_value.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/per_in_value.rs
@@ -11,6 +11,7 @@ use super::super::{DriveDocumentSumQuery, RangeSumOptions, SumEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::{WhereClause, WhereOperator};
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -29,6 +30,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         options: RangeSumOptions,
         transaction: TransactionArg,
@@ -82,6 +84,7 @@ impl Drive {
                 document_type.indexes(),
                 &clauses_for_value,
                 &sum_property,
+                resolved_time_ranges,
             )
             .ok_or_else(|| {
                 Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/point_lookup_proof.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/point_lookup_proof.rs
index 0c65b144623..2de39655fa6 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/point_lookup_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/point_lookup_proof.rs
@@ -6,6 +6,7 @@ use super::super::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -25,6 +26,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -59,6 +61,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_aggregate_carrier_proof.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_aggregate_carrier_proof.rs
index 67cde266e34..305348b28a4 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_aggregate_carrier_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_aggregate_carrier_proof.rs
@@ -15,6 +15,7 @@ use super::super::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -45,6 +46,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         limit: Option<u16>,
         left_to_right: bool,
@@ -55,6 +57,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_distinct_proof.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_distinct_proof.rs
index e06555e1c7f..d448b7a8f83 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_distinct_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_distinct_proof.rs
@@ -7,6 +7,7 @@ use super::super::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -26,6 +27,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         limit: u16,
         left_to_right: bool,
@@ -36,6 +38,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_no_proof.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_no_proof.rs
index be1ad9c44f7..deffdc15c58 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_no_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_no_proof.rs
@@ -6,6 +6,7 @@ use super::super::{DriveDocumentSumQuery, RangeSumOptions, SumEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -23,6 +24,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         options: RangeSumOptions,
         transaction: TransactionArg,
@@ -32,6 +34,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_proof.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_proof.rs
index ef2b0e843f2..b166203ea8e 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/range_proof.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/range_proof.rs
@@ -8,6 +8,7 @@ use super::super::DriveDocumentSumQuery;
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::DocumentTypeRef;
@@ -25,6 +26,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -33,6 +35,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/executors/total.rs b/packages/rs-drive/src/query/drive_document_sum_query/executors/total.rs
index 600868a045d..c872b803b38 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/executors/total.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/executors/total.rs
@@ -10,6 +10,7 @@ use super::super::{DriveDocumentSumQuery, SumEntry};
 use crate::drive::Drive;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
+use crate::query::ResolvedTimeRange;
 use crate::query::WhereClause;
 use dpp::data_contract::document_type::DocumentTypeRef;
 use dpp::version::PlatformVersion;
@@ -30,6 +31,7 @@ impl Drive {
         document_type: DocumentTypeRef,
         document_type_name: String,
         where_clauses: Vec<WhereClause>,
+        resolved_time_ranges: &[ResolvedTimeRange],
         sum_property: String,
         transaction: TransactionArg,
         platform_version: &PlatformVersion,
@@ -65,6 +67,7 @@ impl Drive {
             document_type.indexes(),
             &where_clauses,
             &sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/index_picker.rs b/packages/rs-drive/src/query/drive_document_sum_query/index_picker.rs
index 61f425b06fb..0d3c5251e7f 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/index_picker.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/index_picker.rs
@@ -15,7 +15,8 @@
 //! prover and verifier reject the same set of inputs (same as count).
 
 use crate::query::drive_document_sum_query::{is_indexable_for_sum, is_range_operator};
-use crate::query::{WhereClause, WhereOperator};
+use crate::query::ResolvedTimeRange;
+use crate::query::{index_admissible_for_resolved_time_range, WhereClause, WhereOperator};
 use dpp::data_contract::document_type::Index;
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -26,10 +27,16 @@ use std::collections::{BTreeMap, BTreeSet};
 /// Mirror of count's `find_countable_index_for_where_clauses` with the
 /// additional `summable == Some(sum_property)` predicate on top of the
 /// strict-coverage match.
+///
+/// `resolved_time_ranges` names the fields whose equality clause was
+/// produced by `IN_TIME_RANGE` resolution (see
+/// [`crate::query::resolve_time_range_bucket_clause`]) and gates which indexes
+/// are candidates — see [`index_admissible_for_resolved_time_range`].
 pub fn find_summable_index_for_where_clauses<'b>(
     indexes: &'b BTreeMap<String, Index>,
     where_clauses: &[WhereClause],
     sum_property: &str,
+    resolved_time_ranges: &[ResolvedTimeRange],
 ) -> Option<&'b Index> {
     // Defense-in-depth: any non-indexable operator immediately disqualifies
     // — the sum point-lookup path can only serve Equal/In.
@@ -51,6 +58,14 @@ pub fn find_summable_index_for_where_clauses<'b>(
     }
 
     for index in indexes.values() {
+        // A time-range index holds one entry per bucket containing the
+        // document, keyed by bucket start: summing over it double-counts
+        // every document unless the query pins a single bucket, and only a
+        // resolution-produced equality does that. Conversely a raw clause
+        // must never bind to bucket keys.
+        if !index_admissible_for_resolved_time_range(index, resolved_time_ranges) {
+            continue;
+        }
         // Skip if not summable OR if summable property doesn't match.
         match &index.summable {
             Some(prop) if prop == sum_property => {}
@@ -77,10 +92,19 @@ pub fn find_summable_index_for_where_clauses<'b>(
 /// `sum_property`.
 ///
 /// Mirror of count's `find_range_countable_index_for_where_clauses`.
+///
+/// `resolved_time_ranges` gates the candidate set exactly as in
+/// [`find_summable_index_for_where_clauses`]. A resolved field never arrives
+/// as a range clause — resolution always produces an equality — so with a
+/// non-empty list the only bucketed index this can return is one whose
+/// resolved equality is a prefix property and whose range terminator is a
+/// different property. That is the intended shape: a range over one property
+/// within a single time bucket.
 pub fn find_range_summable_index_for_where_clauses<'b>(
     indexes: &'b BTreeMap<String, Index>,
     where_clauses: &[WhereClause],
     sum_property: &str,
+    resolved_time_ranges: &[ResolvedTimeRange],
 ) -> Option<&'b Index> {
     let range_clauses: Vec<&WhereClause> = where_clauses
         .iter()
@@ -121,6 +145,13 @@ pub fn find_range_summable_index_for_where_clauses<'b>(
         .collect();
 
     for index in indexes.values() {
+        // Same admissibility rule as the point-lookup picker: bucketed
+        // indexes store one entry per containing bucket, so only a query
+        // pinned to a single bucket by a resolution-produced equality may
+        // walk them, and raw clauses may never bind to bucket keys.
+        if !index_admissible_for_resolved_time_range(index, resolved_time_ranges) {
+            continue;
+        }
         if !index.range_summable {
             continue;
         }
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/mod.rs b/packages/rs-drive/src/query/drive_document_sum_query/mod.rs
index c1fb5d6fe6b..50a544cbdde 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/mod.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/mod.rs
@@ -53,6 +53,8 @@ pub mod executors;
 #[cfg(test)]
 mod tests;
 
+#[cfg(feature = "server")]
+use crate::query::ResolvedTimeRange;
 #[cfg(any(feature = "server", feature = "verify"))]
 use crate::query::{WhereClause, WhereOperator};
 
@@ -180,6 +182,12 @@ pub struct DocumentSumRequest<'a> {
     /// [`drive_dispatcher::where_clauses_from_value`] from the
     /// wire-CBOR shape).
     pub where_clauses: Vec<WhereClause>,
+    /// The fields among `where_clauses` whose equality clause was produced by
+    /// `IN_TIME_RANGE` resolution rather than written by the caller. Same
+    /// contract and same purpose as
+    /// [`crate::query::DriveDocumentQuery::resolved_time_ranges`]:
+    /// it is what gates which indexes the sum pickers may select.
+    pub resolved_time_ranges: Vec<ResolvedTimeRange>,
     /// Structured order-clauses (parsed via
     /// [`drive_dispatcher::order_clauses_from_value`]).
     pub order_clauses: Vec<OrderClause>,
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/path_query.rs b/packages/rs-drive/src/query/drive_document_sum_query/path_query.rs
index 3af9b4540cc..39a1ff70b3f 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/path_query.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/path_query.rs
@@ -22,6 +22,7 @@ use crate::drive::RootTree;
 use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::drive_document_sum_query::{is_range_operator, DriveDocumentSumQuery};
+use crate::query::ResolvedTimeRange;
 use crate::query::{WhereClause, WhereOperator};
 // `serialize_value_for_key` is a `DocumentTypeV0Methods` method, NOT
 // `DocumentTypeBasicMethods` (which is the trait of versionless basic
@@ -112,10 +113,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                         platform_version,
                     )?;
                     if in_outer_keys.is_some() {
-                        subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                        subquery_path_extension
+                            .push(self.index.level_key_for_property(&prop.name).into_bytes());
                         subquery_path_extension.push(serialized);
                     } else {
-                        base_path.push(prop.name.as_bytes().to_vec());
+                        base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                         base_path.push(serialized);
                     }
                 }
@@ -128,7 +130,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                             ),
                         ));
                     }
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     let in_values = clause.in_values().into_data_with_error()??;
                     let mut keys: Vec<Vec<u8>> = in_values
                         .iter()
@@ -285,7 +287,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                     ),
                 ));
             }
-            path.push(prop.name.as_bytes().to_vec());
+            path.push(self.index.level_key_for_property(&prop.name).into_bytes());
             path.push(self.document_type.serialize_value_for_key(
                 prop.name.as_str(),
                 &clause.value,
@@ -302,7 +304,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 ),
             ))?
             .name;
-        path.push(range_prop_name.as_bytes().to_vec());
+        path.push(
+            self.index
+                .level_key_for_property(range_prop_name)
+                .into_bytes(),
+        );
 
         // grovedb PR 670 surface: `Query::new_aggregate_sum_on_range`.
         let query = Query::new_aggregate_sum_on_range(query_item);
@@ -371,7 +377,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                     ),
                 ));
             }
-            path.push(prop.name.as_bytes().to_vec());
+            path.push(self.index.level_key_for_property(&prop.name).into_bytes());
             path.push(self.document_type.serialize_value_for_key(
                 prop.name.as_str(),
                 &clause.value,
@@ -388,7 +394,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 ),
             ))?
             .name;
-        path.push(range_prop_name.as_bytes().to_vec());
+        path.push(
+            self.index
+                .level_key_for_property(range_prop_name)
+                .into_bytes(),
+        );
 
         let query = grovedb::Query::new_aggregate_count_and_sum_on_range(query_item);
         Ok(PathQuery::new(
@@ -602,10 +612,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                         platform_version,
                     )?;
                     if in_outer_keys.is_some() {
-                        subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                        subquery_path_extension
+                            .push(self.index.level_key_for_property(&prop.name).into_bytes());
                         subquery_path_extension.push(serialized);
                     } else {
-                        base_path.push(prop.name.as_bytes().to_vec());
+                        base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                         base_path.push(serialized);
                     }
                 }
@@ -620,7 +631,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                     }
                     // Path stops at the In-bearing prop's property-
                     // name subtree; outer Query lives at that level.
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     let in_values = clause.in_values().into_data_with_error()??;
                     let mut keys: Vec<Vec<u8>> = in_values
                         .iter()
@@ -813,7 +824,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 ))?;
             match (&carrier, clause.operator) {
                 (Carrier::Pending, WhereOperator::Equal) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     base_path.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -821,15 +832,16 @@ impl<'a> DriveDocumentSumQuery<'a> {
                     )?);
                 }
                 (Carrier::Pending, WhereOperator::In) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::In(clause.clone());
                 }
                 (Carrier::Pending, op) if is_range_operator(op) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::Range(clause.clone());
                 }
                 (Carrier::In(_) | Carrier::Range(_), WhereOperator::Equal) => {
-                    subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                    subquery_path_extension
+                        .push(self.index.level_key_for_property(&prop.name).into_bytes());
                     subquery_path_extension.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -854,7 +866,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 }
             }
         }
-        subquery_path_extension.push(terminator_prop_name.as_bytes().to_vec());
+        subquery_path_extension.push(
+            self.index
+                .level_key_for_property(terminator_prop_name)
+                .into_bytes(),
+        );
 
         let mut outer_query = Query::new_with_direction(left_to_right);
         match carrier {
@@ -1001,7 +1017,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 ))?;
             match (&carrier, clause.operator) {
                 (Carrier::Pending, WhereOperator::Equal) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     base_path.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -1009,15 +1025,16 @@ impl<'a> DriveDocumentSumQuery<'a> {
                     )?);
                 }
                 (Carrier::Pending, WhereOperator::In) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::In(clause.clone());
                 }
                 (Carrier::Pending, op) if is_range_operator(op) => {
-                    base_path.push(prop.name.as_bytes().to_vec());
+                    base_path.push(self.index.level_key_for_property(&prop.name).into_bytes());
                     carrier = Carrier::Range(clause.clone());
                 }
                 (Carrier::In(_) | Carrier::Range(_), WhereOperator::Equal) => {
-                    subquery_path_extension.push(prop.name.as_bytes().to_vec());
+                    subquery_path_extension
+                        .push(self.index.level_key_for_property(&prop.name).into_bytes());
                     subquery_path_extension.push(self.document_type.serialize_value_for_key(
                         prop.name.as_str(),
                         &clause.value,
@@ -1043,7 +1060,11 @@ impl<'a> DriveDocumentSumQuery<'a> {
                 }
             }
         }
-        subquery_path_extension.push(terminator_prop_name.as_bytes().to_vec());
+        subquery_path_extension.push(
+            self.index
+                .level_key_for_property(terminator_prop_name)
+                .into_bytes(),
+        );
 
         let mut outer_query = Query::new_with_direction(left_to_right);
         match carrier {
@@ -1107,6 +1128,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
         document_type: DocumentTypeRef,
         sum_property: &str,
         where_clauses: &[WhereClause],
+        resolved_time_ranges: &[ResolvedTimeRange],
         platform_version: &PlatformVersion,
     ) -> Result<PathQuery, Error> {
         use crate::query::drive_document_sum_query::index_picker::find_summable_index_for_where_clauses;
@@ -1117,6 +1139,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
             document_type.indexes(),
             where_clauses,
             sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
@@ -1145,6 +1168,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
         document_type: DocumentTypeRef,
         sum_property: &str,
         where_clauses: &[WhereClause],
+        resolved_time_ranges: &[ResolvedTimeRange],
         platform_version: &PlatformVersion,
     ) -> Result<PathQuery, Error> {
         use crate::query::drive_document_sum_query::index_picker::find_range_summable_index_for_where_clauses;
@@ -1155,6 +1179,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
             document_type.indexes(),
             where_clauses,
             sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
@@ -1183,11 +1208,13 @@ impl<'a> DriveDocumentSumQuery<'a> {
     /// Used by the SDK verifier-side rebuild via
     /// `GroveDb::verify_aggregate_sum_query_per_key` (grovedb PR #670
     /// head `e98bab5f`).
+    #[allow(clippy::too_many_arguments)]
     pub fn carrier_aggregate_sum_path_query_static(
         contract: &DataContract,
         document_type: DocumentTypeRef,
         sum_property: &str,
         where_clauses: &[WhereClause],
+        resolved_time_ranges: &[ResolvedTimeRange],
         limit: Option<u16>,
         left_to_right: bool,
         platform_version: &PlatformVersion,
@@ -1200,6 +1227,7 @@ impl<'a> DriveDocumentSumQuery<'a> {
             document_type.indexes(),
             where_clauses,
             sum_property,
+            resolved_time_ranges,
         )
         .ok_or_else(|| {
             Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(
diff --git a/packages/rs-drive/src/query/drive_document_sum_query/tests.rs b/packages/rs-drive/src/query/drive_document_sum_query/tests.rs
index 1688669039b..6f12282a0ee 100644
--- a/packages/rs-drive/src/query/drive_document_sum_query/tests.rs
+++ b/packages/rs-drive/src/query/drive_document_sum_query/tests.rs
@@ -45,6 +45,8 @@ fn summable_index(name: &str, props: &[&str], summable: Option<&str>) -> Index {
         ranked_countable: false,
         ranked_summable: false,
         ranked_averageable: false,
+        time_range: None,
+        terminal: None,
     }
 }
 
@@ -64,6 +66,8 @@ fn range_summable_index(name: &str, props: &[&str], summable: &str) -> Index {
         ranked_countable: false,
         ranked_summable: false,
         ranked_averageable: false,
+        time_range: None,
+        terminal: None,
     }
 }
 
@@ -104,7 +108,8 @@ fn summable_picker_matches_single_prop_exactly() {
         &["recipient"],
         Some("amount"),
     )]);
-    let found = find_summable_index_for_where_clauses(&indexes, &[wc_equal("recipient")], "amount");
+    let found =
+        find_summable_index_for_where_clauses(&indexes, &[wc_equal("recipient")], "amount", &[]);
     assert_eq!(found.map(|i| i.name.as_str()), Some("byRecipient"));
 }
 
@@ -113,7 +118,7 @@ fn summable_picker_rejects_partial_coverage() {
     // Two-prop index with only one of the props matched by where clauses.
     let indexes = make_index_map(vec![summable_index("byAB", &["a", "b"], Some("amount"))]);
     assert!(
-        find_summable_index_for_where_clauses(&indexes, &[wc_equal("a")], "amount").is_none(),
+        find_summable_index_for_where_clauses(&indexes, &[wc_equal("a")], "amount", &[]).is_none(),
         "partial coverage must miss the strict picker"
     );
 }
@@ -127,7 +132,8 @@ fn summable_picker_rejects_property_mismatch() {
         Some("amount"),
     )]);
     assert!(
-        find_summable_index_for_where_clauses(&indexes, &[wc_equal("recipient")], "fee").is_none()
+        find_summable_index_for_where_clauses(&indexes, &[wc_equal("recipient")], "fee", &[])
+            .is_none()
     );
 }
 
@@ -135,10 +141,13 @@ fn summable_picker_rejects_property_mismatch() {
 fn summable_picker_rejects_non_summable_index() {
     // No `summable` declaration → never picked, even if properties match.
     let indexes = make_index_map(vec![summable_index("byRecipient", &["recipient"], None)]);
-    assert!(
-        find_summable_index_for_where_clauses(&indexes, &[wc_equal("recipient")], "amount")
-            .is_none()
-    );
+    assert!(find_summable_index_for_where_clauses(
+        &indexes,
+        &[wc_equal("recipient")],
+        "amount",
+        &[]
+    )
+    .is_none());
 }
 
 #[test]
@@ -149,7 +158,8 @@ fn summable_picker_rejects_range_operator() {
         Some("amount"),
     )]);
     assert!(
-        find_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "amount").is_none(),
+        find_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "amount", &[])
+            .is_none(),
         "any range operator disqualifies the point-lookup picker"
     );
 }
@@ -161,7 +171,8 @@ fn summable_picker_accepts_in_clause() {
         &["recipient"],
         Some("amount"),
     )]);
-    let found = find_summable_index_for_where_clauses(&indexes, &[wc_in("recipient")], "amount");
+    let found =
+        find_summable_index_for_where_clauses(&indexes, &[wc_in("recipient")], "amount", &[]);
     assert_eq!(found.map(|i| i.name.as_str()), Some("byRecipient"));
 }
 
@@ -177,7 +188,7 @@ fn range_summable_picker_matches_terminator_range() {
         "amount",
     )]);
     let found =
-        find_range_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "amount");
+        find_range_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "amount", &[]);
     assert_eq!(found.map(|i| i.name.as_str()), Some("bySentAt"));
 }
 
@@ -191,7 +202,8 @@ fn range_summable_picker_matches_prefix_equal_plus_terminator_range() {
         "amount",
     )]);
     let where_clauses = vec![wc_equal("recipient"), wc_gt("sentAt", 0)];
-    let found = find_range_summable_index_for_where_clauses(&indexes, &where_clauses, "amount");
+    let found =
+        find_range_summable_index_for_where_clauses(&indexes, &where_clauses, "amount", &[]);
     assert_eq!(found.map(|i| i.name.as_str()), Some("byRecipientTime"));
 }
 
@@ -203,10 +215,13 @@ fn range_summable_picker_rejects_property_mismatch() {
         &["sentAt"],
         "amount",
     )]);
-    assert!(
-        find_range_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "fee")
-            .is_none()
-    );
+    assert!(find_range_summable_index_for_where_clauses(
+        &indexes,
+        &[wc_gt("sentAt", 0)],
+        "fee",
+        &[]
+    )
+    .is_none());
 }
 
 #[test]
@@ -216,10 +231,13 @@ fn range_summable_picker_rejects_non_range_summable() {
     let mut idx = range_summable_index("bySentAt", &["sentAt"], "amount");
     idx.range_summable = false;
     let indexes = make_index_map(vec![idx]);
-    assert!(
-        find_range_summable_index_for_where_clauses(&indexes, &[wc_gt("sentAt", 0)], "amount")
-            .is_none()
-    );
+    assert!(find_range_summable_index_for_where_clauses(
+        &indexes,
+        &[wc_gt("sentAt", 0)],
+        "amount",
+        &[]
+    )
+    .is_none());
 }
 
 #[test]
@@ -233,7 +251,8 @@ fn range_summable_picker_rejects_range_not_on_terminator() {
     )]);
     let where_clauses = vec![wc_gt("recipient", 0)];
     assert!(
-        find_range_summable_index_for_where_clauses(&indexes, &where_clauses, "amount").is_none()
+        find_range_summable_index_for_where_clauses(&indexes, &where_clauses, "amount", &[])
+            .is_none()
     );
 }
 
@@ -334,6 +353,7 @@ mod limit_policy_regression {
         properties.insert("color".to_string(), Value::Text(color.to_string()));
         properties.insert("amount".to_string(), Value::U64(amount));
         let document: Document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from([(i + 1) as u8; 32]),
             owner_id: Identifier::from([0u8; 32]),
             properties,
@@ -451,6 +471,7 @@ mod limit_policy_regression {
             limit: None,
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let response = drive
@@ -471,6 +492,7 @@ mod limit_policy_regression {
             document_type.indexes(),
             std::slice::from_ref(&color_gt_blue),
             "amount",
+            &[],
         )
         .expect("byColor rangeSummable index covers `color > blue`");
         let sum_query = DriveDocumentSumQuery {
@@ -547,6 +569,7 @@ mod limit_policy_regression {
             limit: Some(over_max),
             prove: true,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         let err = drive
@@ -618,6 +641,7 @@ mod limit_policy_regression {
             limit,
             prove: false,
             drive_config: &drive_config,
+            resolved_time_ranges: vec![],
         };
 
         for (requested, expected) in [(None, 2), (Some(1), 1), (Some(10_000), 3)] {
diff --git a/packages/rs-drive/src/query/mod.rs b/packages/rs-drive/src/query/mod.rs
index 7d6e98f3c5b..4907fb1eb64 100644
--- a/packages/rs-drive/src/query/mod.rs
+++ b/packages/rs-drive/src/query/mod.rs
@@ -1,3 +1,4 @@
+use dpp::data_contract::document_type::TimeRangeTransform;
 use std::sync::Arc;
 
 #[cfg(any(feature = "server", feature = "verify"))]
@@ -142,6 +143,10 @@ use crate::util::grove_operations::QueryType::StatefulQuery;
 
 // Module declarations that are conditional on either "server" or "verify" features
 #[cfg(any(feature = "server", feature = "verify"))]
+pub mod canonicalize;
+#[cfg(any(feature = "server", feature = "verify"))]
+pub use canonicalize::validate_and_canonicalize_where_clauses;
+#[cfg(any(feature = "server", feature = "verify"))]
 pub mod conditions;
 #[cfg(any(feature = "server", feature = "verify"))]
 mod defaults;
@@ -570,6 +575,292 @@ impl From<InternalClauses> for Vec<WhereClause> {
     }
 }
 
+/// Which active time range a `TOP(timeRange(...))` selection resolves to,
+/// when the index's ranges overlap (`range > step`). Time-range queries are a
+/// v1-only feature; the v0 query surface is unaffected.
+#[cfg(any(feature = "server", feature = "verify"))]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[cfg_attr(feature = "serde", serde(rename_all = "lowercase"))]
+pub enum TimeRangeSelector {
+    /// The freshest started range (largest start ≤ now). Covers the latest
+    /// partial slice (0..step of history).
+    Newest,
+    /// The oldest range still active at now. Covers a near-full trailing
+    /// window of ~range of history. Best for "trending over the last window".
+    Oldest,
+}
+
+#[cfg(any(feature = "server", feature = "verify"))]
+impl TimeRangeSelector {
+    /// The selector's wire spelling — the `IN_TIME_RANGE` clause's operand on
+    /// the v1 `getDocuments` wire. The single source of truth for the string
+    /// form: the SDK encoder, the drive-abci decoder and the wasm-sdk JSON
+    /// parser all go through these two functions (and the serde derive above
+    /// is renamed to match), so the spellings cannot drift apart.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            TimeRangeSelector::Newest => "newest",
+            TimeRangeSelector::Oldest => "oldest",
+        }
+    }
+
+    /// Parses the wire spelling. Returns `None` for anything but the exact
+    /// strings [`Self::as_str`] produces.
+    pub fn from_string(value: &str) -> Option<Self> {
+        match value {
+            "newest" => Some(TimeRangeSelector::Newest),
+            "oldest" => Some(TimeRangeSelector::Oldest),
+            _ => None,
+        }
+    }
+}
+
+/// A concrete grid specification, matching a contract's `timeRange`
+/// declaration verbatim (`range` / `step` / `phase`, in seconds).
+///
+/// The structured `IN_TIME_RANGE` operand carries one of these when the
+/// queried field is bucketed by more than one grid: the bare selector
+/// (`"newest"` / `"oldest"`) is unambiguous only while exactly one time-range
+/// index exists on the field, so a multi-grid field requires the query to
+/// name the grid it wants.
+#[cfg(any(feature = "server", feature = "verify"))]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct TimeRangeGridSpec {
+    /// Window length in seconds, as the contract declares it.
+    pub range_seconds: u64,
+    /// Interval between window starts in seconds, as the contract declares it.
+    pub step_seconds: u64,
+    /// Grid alignment phase in seconds (0 when the contract omits `phase`).
+    pub phase_seconds: u64,
+}
+
+#[cfg(any(feature = "server", feature = "verify"))]
+impl TimeRangeGridSpec {
+    /// Whether this spec names exactly the given transform's grid.
+    pub fn matches(&self, transform: &TimeRangeTransform) -> bool {
+        self.range_seconds == transform.range_seconds
+            && self.step_seconds == transform.step_seconds
+            && self.phase_seconds == transform.phase_seconds
+    }
+}
+
+/// Resolution provenance for one `IN_TIME_RANGE` clause: the field the
+/// selector named and the exact grid the resolution used. Recorded by the
+/// resolver's caller on the query (see
+/// [`DriveDocumentQuery::resolved_time_ranges`]) and consumed by the index
+/// pickers through [`index_admissible_for_resolved_time_range`], which pins
+/// selection to the index carrying exactly this grid — a field may be
+/// bucketed by several grids, so the field name alone no longer identifies
+/// the index the resolution was computed against.
+#[cfg(any(feature = "server", feature = "verify"))]
+#[derive(Debug, Clone, PartialEq)]
+pub struct ResolvedTimeRange {
+    /// The grid the bucket start was computed from. The transform carries its
+    /// own source field, so the provenance cannot name a field the grid does
+    /// not bucket — [`Self::field`] reads it from here.
+    pub transform: TimeRangeTransform,
+}
+
+#[cfg(any(feature = "server", feature = "verify"))]
+impl ResolvedTimeRange {
+    /// The bucketed source field the resolved equality is on — always the
+    /// transform's own source.
+    pub fn field(&self) -> &str {
+        &self.transform.source
+    }
+}
+
+/// Resolves a time-range selection on `field` into a concrete equality
+/// [`WhereClause`] on the bucketed source field, using the named grid's
+/// `timeRange` transform and an authoritative `block_time_ms`.
+///
+/// The server supplies `block_time_ms` from current block time and the
+/// verifier re-derives it from the quorum-signed response metadata `time_ms`,
+/// so both produce the identical concrete equality query — the existing
+/// index/count proofs apply unchanged and the engine never needs a dedicated
+/// time-range operator.
+///
+/// `grid` selects among several time-range indexes on the same field: `None`
+/// is accepted only while exactly one grid buckets the field (the common
+/// case); with two or more grids the caller must name one, and naming a grid
+/// no index declares is an error either way.
+///
+/// What comes back is an ordinary equality clause, byte-identical to one a
+/// client could have written by hand against a raw timestamp, plus the
+/// [`ResolvedTimeRange`] provenance callers must record on the query (see
+/// [`DriveDocumentQuery::resolved_time_ranges`]), which
+/// [`DriveDocumentQuery::find_best_index`] and the aggregate index pickers
+/// consume through [`index_admissible_for_resolved_time_range`] to pin
+/// selection to the grid's index — and to keep raw queries off it.
+#[cfg(any(feature = "server", feature = "verify"))]
+pub fn resolve_time_range_bucket_clause(
+    field: &str,
+    selector: TimeRangeSelector,
+    grid: Option<TimeRangeGridSpec>,
+    document_type: DocumentTypeRef,
+    block_time_ms: u64,
+) -> Result<(WhereClause, ResolvedTimeRange), Error> {
+    // Distinct grids bucketing `field` — several indexes may share one grid
+    // (they share the storage level too), so dedupe by transform.
+    let mut grids: Vec<&TimeRangeTransform> = Vec::new();
+    for index in document_type.indexes().values() {
+        if let Some(transform) = index
+            .time_range
+            .as_ref()
+            .filter(|transform| transform.source == field)
+        {
+            if !grids.contains(&transform) {
+                grids.push(transform);
+            }
+        }
+    }
+    if grids.is_empty() {
+        return Err(Error::Query(
+            QuerySyntaxError::WhereClauseOnNonIndexedProperty(format!(
+                "no time-range index is defined on field \"{}\"",
+                field
+            )),
+        ));
+    }
+
+    let transform = match grid {
+        Some(spec) => *grids
+            .iter()
+            .find(|transform| spec.matches(transform))
+            .ok_or(Error::Query(QuerySyntaxError::Unsupported(format!(
+                "no time-range index on \"{}\" declares the grid range={}s step={}s phase={}s",
+                field, spec.range_seconds, spec.step_seconds, spec.phase_seconds
+            ))))?,
+        None => {
+            if grids.len() > 1 {
+                return Err(Error::Query(QuerySyntaxError::Unsupported(format!(
+                    "field \"{}\" is bucketed by {} different grids; the IN_TIME_RANGE operand \
+                     must name one as [selector, range, step] or [selector, range, step, phase] \
+                     (seconds, as the contract declares them)",
+                    field,
+                    grids.len()
+                ))));
+            }
+            grids[0]
+        }
+    };
+
+    let bucket_start = match selector {
+        TimeRangeSelector::Newest => transform.newest_active_start(block_time_ms),
+        TimeRangeSelector::Oldest => transform.oldest_active_start(block_time_ms),
+    }
+    .ok_or(Error::Query(QuerySyntaxError::Unsupported(format!(
+        "no time range on \"{}\" is active yet: the block time predates the grid's phase \
+         anchor (only possible within the first step after the epoch)",
+        field
+    ))))?;
+
+    Ok((
+        WhereClause {
+            field: field.to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::U64(bucket_start),
+        },
+        ResolvedTimeRange {
+            transform: transform.clone(),
+        },
+    ))
+}
+
+/// Whether `index` may serve a query whose equality clauses on
+/// `resolved_time_ranges` were produced by
+/// [`resolve_time_range_bucket_clause`].
+///
+/// A time-range index does not store the source field's raw values: under its
+/// grid-qualified first level it stores bucket *starts*, and one document is
+/// stored once per bucket that contains its timestamp. So a bucketed index, a
+/// raw index and another grid's bucketed index are never interchangeable, and
+/// every mismatch is silent — a validly-proven wrong answer rather than an
+/// error:
+///
+/// - A raw query (`resolved_time_ranges` empty) that landed on a bucketed
+///   index would compare a real timestamp against bucket starts and see
+///   nothing (or, for range/IN shapes, walk overlapping buckets and count the
+///   same document up to `overlap_factor` times).
+/// - A resolved query that landed on a raw index would compare a bucket start
+///   against real timestamps and see nothing.
+/// - A resolved query that landed on a *different grid's* index would compare
+///   one grid's bucket start against another grid's — every 6-hour start is
+///   also a 3-hour start, so this can silently return the wrong window.
+///
+/// Hence the rule: with no resolution only non-bucketed indexes are
+/// admissible, and with one resolution only an index bucketing exactly that
+/// field *with exactly that grid* is. Two resolutions can never be served by
+/// a single index — a transform's source must be its index's first property,
+/// so one index buckets exactly one field — and are rejected by the caller.
+#[cfg(any(feature = "server", feature = "verify"))]
+pub fn index_admissible_for_resolved_time_range(
+    index: &Index,
+    resolved_time_ranges: &[ResolvedTimeRange],
+) -> bool {
+    match resolved_time_ranges {
+        [] => index.time_range.is_none(),
+        // The provenance's transform must equal the candidate's — grid AND
+        // source field, since the transform carries its own source. The
+        // provenance cannot name a field its grid does not bucket
+        // ([`ResolvedTimeRange::field`] is derived from the transform), so a
+        // fabricated field/transform pair is unrepresentable rather than
+        // guarded against.
+        [resolved] => index
+            .time_range
+            .as_ref()
+            .is_some_and(|transform| *transform == resolved.transform),
+        _ => false,
+    }
+}
+
+/// Rejects a query whose resolution provenance and clause shapes disagree:
+/// every field in `resolved_time_ranges` must appear in the where
+/// clauses as exactly one `Equal` clause — the only shape
+/// [`resolve_time_range_bucket_clause`] produces.
+///
+/// A range or `In` clause on a resolved field means the caller attached
+/// provenance to a clause the resolver never built. Executors that fan a
+/// clause out per value (the per-`In`-value count/sum paths rewrite each `In`
+/// value into an equality) would then present raw client values to the index
+/// pickers as if they were resolved bucket starts, and the pickers would
+/// admit the bucketed index for them. The wire path can never produce the
+/// mismatch — provenance is not parseable from the wire, and the abci handler
+/// pushes the resolved equality itself — so this guards direct API callers,
+/// and it runs identically under `server` and `verify`.
+#[cfg(any(feature = "server", feature = "verify"))]
+pub fn validate_resolved_time_range_clause_shapes(
+    where_clauses: &[WhereClause],
+    resolved_time_ranges: &[ResolvedTimeRange],
+) -> Result<(), Error> {
+    for field in resolved_time_ranges.iter().map(|resolved| resolved.field()) {
+        let mut equalities = 0usize;
+        for clause in where_clauses.iter().filter(|c| c.field == field) {
+            if clause.operator == WhereOperator::Equal {
+                equalities += 1;
+            } else {
+                return Err(Error::Query(
+                    QuerySyntaxError::InvalidWhereClauseComponents(
+                        "a time-range-resolved field may only carry the single equality its \
+                         resolution produced, not a range or In clause",
+                    ),
+                ));
+            }
+        }
+        if equalities != 1 {
+            return Err(Error::Query(
+                QuerySyntaxError::InvalidWhereClauseComponents(
+                    "a time-range-resolved field must carry exactly one equality clause — the \
+                     one its resolution produced",
+                ),
+            ));
+        }
+    }
+    Ok(())
+}
+
 #[cfg(any(feature = "server", feature = "verify"))]
 /// Drive query struct
 #[derive(Debug, PartialEq, Clone)]
@@ -592,6 +883,22 @@ pub struct DriveDocumentQuery<'a> {
     pub start_at_included: bool,
     /// Block time
     pub block_time_ms: Option<u64>,
+    /// The fields whose equality clause in `internal_clauses` was produced by
+    /// `IN_TIME_RANGE` resolution — i.e. by
+    /// [`resolve_time_range_bucket_clause`], on the server from committed
+    /// block time and in the verifier from the quorum-signed response metadata
+    /// time.
+    ///
+    /// Never parsed from the wire: every `from_cbor` / `from_value` /
+    /// `from_typed_clauses` entry point leaves this empty, so a client cannot
+    /// claim resolution it did not go through. It is what
+    /// [`Self::find_best_index`] uses to pin index selection to the index that
+    /// buckets the field (see [`index_admissible_for_resolved_time_range`]),
+    /// which is required because the resolved clause is an ordinary equality
+    /// and cannot be told apart from a raw-timestamp lookup once built.
+    ///
+    /// Empty for every raw query.
+    pub resolved_time_ranges: Vec<ResolvedTimeRange>,
 }
 
 impl<'a> DriveDocumentQuery<'a> {
@@ -622,6 +929,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         }
     }
 
@@ -638,6 +946,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at: None,
             start_at_included: true,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         }
     }
 
@@ -658,6 +967,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at: None,
             start_at_included: true,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         }
     }
 
@@ -884,6 +1194,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at,
             start_at_included,
             block_time_ms,
+            resolved_time_ranges: vec![],
         })
     }
 
@@ -1030,6 +1341,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at,
             start_at_included,
             block_time_ms,
+            resolved_time_ranges: vec![],
         })
     }
 
@@ -1194,6 +1506,7 @@ impl<'a> DriveDocumentQuery<'a> {
             start_at,
             start_at_included,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         })
     }
 
@@ -1611,10 +1924,37 @@ impl<'a> DriveDocumentQuery<'a> {
     /// ([`Self::find_best_index_for_multiple_in_clauses`]); they only
     /// reach it through the v1 (protocol version 14+) path-query
     /// lowering, since the v0 lowering rejects them first.
+    ///
+    /// Selection is restricted to the indexes admissible for this query's
+    /// [`Self::resolved_time_ranges`]: a query carrying an
+    /// `IN_TIME_RANGE`-resolved equality may only be served by the index that
+    /// buckets that field, and a raw query may never be served by a bucketed
+    /// index. See [`index_admissible_for_resolved_time_range`] for why either
+    /// mismatch would produce a validly-proven wrong answer. The rule applies
+    /// on both routes, including the multiple-`In` selection.
     pub fn find_best_index(&self, platform_version: &PlatformVersion) -> Result<&Index, Error> {
+        // A transform's source must be its index's first property, so one
+        // index buckets exactly one field and no index can carry two resolved
+        // equalities. Serving such a query would need a join across two
+        // bucketed indexes, which the engine has no shape for. This runs
+        // before any routing so the multiple-`In` path cannot bypass it.
+        if self.resolved_time_ranges.len() > 1 {
+            return Err(Error::Query(QuerySyntaxError::Unsupported(format!(
+                "at most one time-range selection (IN_TIME_RANGE) is supported per query; this \
+                 one resolves {:?}, and no single index can bucket more than one field",
+                self.resolved_time_ranges
+            ))));
+        }
+
+        // One shared source-shape guard for every selection route — see its
+        // doc for the contract. Running it before routing keeps the single-
+        // and multiple-`In` routes rejecting the same shapes.
+        self.validate_resolved_source_shape()?;
+
         if self.internal_clauses.in_clauses.len() > 1 {
             return Ok(self.find_best_index_for_multiple_in_clauses()?.0);
         }
+
         let equal_fields = self
             .internal_clauses
             .equal_clauses
@@ -1654,26 +1994,115 @@ impl<'a> DriveDocumentQuery<'a> {
 
         let (index, difference) = self
             .document_type
-            .index_for_types(
+            .index_for_types_matching(
                 fields.as_slice(),
                 in_field,
                 order_by_keys.as_slice(),
+                |index| index_admissible_for_resolved_time_range(index, &self.resolved_time_ranges),
                 platform_version,
             )?
-            .ok_or(Error::Query(
-                QuerySyntaxError::WhereClauseOnNonIndexedProperty(format!(
-                    "query must be for valid indexes, valid indexes are: {:?}",
-                    self.document_type.indexes()
-                )),
-            ))?;
+            .ok_or_else(|| match self.resolved_time_ranges.first() {
+                // A time-range query is only servable by the index that
+                // buckets the field with the resolved grid, so "no index"
+                // here is a narrower fact than the generic case: some index
+                // buckets the field (the clause could not have been resolved
+                // otherwise), but none with that grid also covers the rest
+                // of the query.
+                Some(resolved) => {
+                    Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(format!(
+                        "a time-range query on \"{}\" requires an index that buckets it with \
+                         the resolved grid AND covers the query's other where and order-by \
+                         fields; valid indexes are: {:?}",
+                        resolved.field(),
+                        self.document_type.indexes()
+                    )))
+                }
+                None => {
+                    // A raw query never binds to a bucketed index; when one
+                    // exists, say so — the caller may be holding a
+                    // time-range proof on a surface that cannot supply
+                    // resolution provenance (e.g. the standalone wasm
+                    // verifiers), where this refusal is otherwise opaque.
+                    let has_bucketed_index = self
+                        .document_type
+                        .indexes()
+                        .values()
+                        .any(|index| index.time_range.is_some());
+                    if has_bucketed_index {
+                        Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(format!(
+                            "query must be for valid indexes, valid indexes are: {:?}; note: \
+                             this document type's time-range (timeRange) indexes only serve \
+                             IN_TIME_RANGE selections carrying their resolution — a raw clause \
+                             on the bucketed field never binds to them",
+                            self.document_type.indexes()
+                        )))
+                    } else {
+                        Error::Query(QuerySyntaxError::WhereClauseOnNonIndexedProperty(format!(
+                            "query must be for valid indexes, valid indexes are: {:?}",
+                            self.document_type.indexes()
+                        )))
+                    }
+                }
+            })?;
         if difference > defaults::MAX_INDEX_DIFFERENCE {
             return Err(Error::Query(QuerySyntaxError::QueryTooFarFromIndex(
                 "query must better match an existing index",
             )));
         }
+
+        // The residual source-shape contract already ran at the top of this
+        // function ([`Self::validate_resolved_source_shape`]) — with a
+        // resolution present, admissibility restricts candidates to the one
+        // index bucketing exactly the resolved field, so guarding by
+        // provenance there is equivalent to guarding by the selected index's
+        // transform here.
         Ok(index)
     }
 
+    /// The residual source-shape contract for a query carrying a
+    /// time-range resolution: the resolved equality must be present on the
+    /// bucketed source, and the source must not ALSO carry an `In`, a
+    /// range, or an ordering — those walk overlapping bucket keys and
+    /// return each document up to `overlap_factor` times with a perfectly
+    /// valid proof. The `!has_equality_on_source` arm is defensive:
+    /// resolution always pushes the equality, so reaching it means the
+    /// provenance and the clauses disagree.
+    ///
+    /// Runs identically on the server and in proof verification, and on
+    /// every selection route: [`Self::find_best_index`] calls it before
+    /// routing, and [`Self::find_best_index_for_multiple_in_clauses`]
+    /// calls it itself because the multiple-`In` execution lowering picks
+    /// its index directly, without going through `find_best_index`.
+    #[cfg(any(feature = "server", feature = "verify"))]
+    pub(crate) fn validate_resolved_source_shape(&self) -> Result<(), Error> {
+        let Some(source) = self
+            .resolved_time_ranges
+            .first()
+            .map(|resolved| resolved.field())
+        else {
+            return Ok(());
+        };
+        let has_equality_on_source = self.internal_clauses.equal_clauses.contains_key(source);
+        let range_or_in_on_source = self
+            .internal_clauses
+            .range_clause
+            .as_ref()
+            .is_some_and(|clause| clause.field == source)
+            || self
+                .internal_clauses
+                .in_clauses
+                .iter()
+                .any(|clause| clause.field == source);
+        if !has_equality_on_source || range_or_in_on_source || self.order_by.contains_key(source) {
+            return Err(Error::Query(QuerySyntaxError::Unsupported(format!(
+                "the index on \"{source}\" buckets it into time ranges: it can only be queried \
+                 through a time-range selection (IN_TIME_RANGE, which resolves to an exact \
+                 bucket equality), not with ranges, IN, or ordering on that property"
+            ))));
+        }
+        Ok(())
+    }
+
     #[cfg(any(feature = "server", feature = "verify"))]
     /// Returns a `QueryItem` given a start key and query direction.
     pub fn query_item_for_starts_at_key(starts_at_key: Vec<u8>, left_to_right: bool) -> QueryItem {
@@ -2399,6 +2828,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let path_query = query_asc
@@ -2779,6 +3209,55 @@ mod tests {
         .expect_err("starts with can not start with an empty string");
     }
 
+    #[test]
+    fn resolved_time_range_shape_guard_accepts_only_the_single_resolution_equality() {
+        use crate::query::{validate_resolved_time_range_clause_shapes, ResolvedTimeRange};
+        use dpp::data_contract::document_type::TimeRangeTransform;
+
+        let resolved = vec![ResolvedTimeRange {
+            transform: TimeRangeTransform {
+                source: "$createdAt".to_string(),
+                range_seconds: 21_600,
+                step_seconds: 7_200,
+                phase_seconds: 0,
+            },
+        }];
+        let equality = WhereClause {
+            field: "$createdAt".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::U64(21_600_000),
+        };
+        let other = WhereClause {
+            field: "hashtag".to_string(),
+            operator: WhereOperator::Equal,
+            value: Value::Text("ibiza".to_string()),
+        };
+
+        validate_resolved_time_range_clause_shapes(&[equality.clone(), other.clone()], &resolved)
+            .expect("one equality on the resolved field is the resolution shape");
+
+        // An `In` on the resolved field would be fanned out per raw value by
+        // the aggregate executors and admitted against bucket keys.
+        let in_clause = WhereClause {
+            field: "$createdAt".to_string(),
+            operator: WhereOperator::In,
+            value: Value::Array(vec![Value::U64(0), Value::U64(7_200_000)]),
+        };
+        validate_resolved_time_range_clause_shapes(&[in_clause, other.clone()], &resolved)
+            .expect_err("an In clause on a resolved field must be rejected");
+
+        let range_clause = WhereClause {
+            field: "$createdAt".to_string(),
+            operator: WhereOperator::GreaterThan,
+            value: Value::U64(0),
+        };
+        validate_resolved_time_range_clause_shapes(&[equality.clone(), range_clause], &resolved)
+            .expect_err("a range clause riding along on a resolved field must be rejected");
+
+        validate_resolved_time_range_clause_shapes(&[other], &resolved)
+            .expect_err("a resolved field with no equality at all must be rejected");
+    }
+
     #[test]
     fn test_withdrawal_query_with_missing_transaction_index() {
         // Setup the withdrawal contract
@@ -2832,6 +3311,7 @@ mod tests {
             start_at: Some([3u8; 32]),
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // Create a document that we are starting at, which may be missing 'transactionIndex'
@@ -2840,6 +3320,7 @@ mod tests {
         // We intentionally omit 'transactionIndex' to simulate missing field
 
         let starts_at_document = DocumentV0 {
+            contract_version: None,
             id: Identifier::from([3u8; 32]), // The same as start_at
             owner_id: Identifier::random(),
             properties,
@@ -2947,6 +3428,7 @@ mod tests {
                 start_at: None,
                 start_at_included: false,
                 block_time_ms: None,
+                resolved_time_ranges: vec![],
             }
         }
 
diff --git a/packages/rs-drive/src/query/non_primary_key_path_query/multiple_in_path_query/v0/mod.rs b/packages/rs-drive/src/query/non_primary_key_path_query/multiple_in_path_query/v0/mod.rs
index 0cf2bb67207..11e13e9d1a2 100644
--- a/packages/rs-drive/src/query/non_primary_key_path_query/multiple_in_path_query/v0/mod.rs
+++ b/packages/rs-drive/src/query/non_primary_key_path_query/multiple_in_path_query/v0/mod.rs
@@ -11,7 +11,7 @@ use crate::error::query::QuerySyntaxError;
 use crate::error::Error;
 use crate::query::conditions::WhereClause;
 use crate::query::ordering::OrderClause;
-use crate::query::{defaults, DriveDocumentQuery};
+use crate::query::{defaults, index_admissible_for_resolved_time_range, DriveDocumentQuery};
 use dpp::data_contract::document_type::accessors::DocumentTypeV0Getters;
 use dpp::data_contract::document_type::methods::DocumentTypeV0Methods;
 use dpp::data_contract::document_type::{Index, IndexProperty};
@@ -230,14 +230,21 @@ impl<'a> DriveDocumentQuery<'a> {
             .map_err(Error::from)?;
 
         let mut path = document_type_path;
+        // Path segments are level keys: grid-qualified for a time-range
+        // index's first property (`Index::level_key_for_property`), the bare
+        // property name everywhere else.
         for (intermediate_index, intermediate_value) in index.properties[..equality_len]
             .iter()
             .zip(intermediate_values.iter())
         {
-            path.push(intermediate_index.name.as_bytes().to_vec());
+            path.push(
+                index
+                    .level_key_for_property(&intermediate_index.name)
+                    .into_bytes(),
+            );
             path.push(intermediate_value.as_slice().to_vec());
         }
-        path.push(child_field.as_bytes().to_vec());
+        path.push(index.level_key_for_property(&child_field).into_bytes());
 
         Ok(PathQuery::new(
             path,
@@ -260,6 +267,13 @@ impl<'a> DriveDocumentQuery<'a> {
     pub(in crate::query) fn find_best_index_for_multiple_in_clauses(
         &self,
     ) -> Result<(&Index, Vec<&WhereClause>, usize), Error> {
+        // The execution lowering reaches this selection directly, without
+        // going through `find_best_index` — enforce the resolved-source
+        // shape contract here too, so a direct caller cannot ride an `In`
+        // or range on the bucketed source into per-value bucket keys.
+        // (`find_best_index` also runs this; the re-run is cheap.)
+        self.validate_resolved_source_shape()?;
+
         let equal_clauses = &self.internal_clauses.equal_clauses;
         let in_clauses = &self.internal_clauses.in_clauses;
         let range_field = self
@@ -292,6 +306,13 @@ impl<'a> DriveDocumentQuery<'a> {
         let equality_len = equal_clauses.len();
         let mut best: Option<(&Index, Vec<&WhereClause>, u16)> = None;
         for index in self.document_type.indexes().values() {
+            // Same admissibility rule as the single-`In` selection in
+            // `find_best_index`: a bucketed index only for a query whose
+            // resolved equality names its transform source, never for a raw
+            // query. See `index_admissible_for_resolved_time_range`.
+            if !index_admissible_for_resolved_time_range(index, &self.resolved_time_ranges) {
+                continue;
+            }
             let mut positioned: Vec<(usize, &WhereClause)> = Vec::with_capacity(in_clauses.len());
             for in_clause in in_clauses {
                 match index
diff --git a/packages/rs-drive/src/query/non_primary_key_path_query/single_in_path_query/v0/mod.rs b/packages/rs-drive/src/query/non_primary_key_path_query/single_in_path_query/v0/mod.rs
index 891b87b7918..e7b4363da61 100644
--- a/packages/rs-drive/src/query/non_primary_key_path_query/single_in_path_query/v0/mod.rs
+++ b/packages/rs-drive/src/query/non_primary_key_path_query/single_in_path_query/v0/mod.rs
@@ -459,8 +459,24 @@ impl<'a> DriveDocumentQuery<'a> {
                 // We should set the starts at document to be included for the query if there are
                 // left over index properties.
 
+                // A time-range index's transformed first level stores bucket
+                // *starts*, so the cursor document's raw timestamp is not
+                // comparable to this level's keys: an included cursor created
+                // mid-bucket orders after the bucket-start key and would
+                // suppress it, validly proving an empty page. The resolved
+                // equality already pins this level to one key; the terminal
+                // document-id query attached below applies the cursor.
+                let last_clause_is_on_transformed_source = index
+                    .time_range
+                    .as_ref()
+                    .is_some_and(|transform| transform.source == where_clause.field);
+
                 let query_starts_at_document = if left_over_index_properties.is_empty() {
-                    &starts_at_document
+                    if last_clause_is_on_transformed_source {
+                        &None
+                    } else {
+                        &starts_at_document
+                    }
                 } else if sibling_aware_cursor_lowering {
                     // The cursor's branch always stays included at this level,
                     // trimming only the branches ordered before it; whether
@@ -534,6 +550,72 @@ impl<'a> DriveDocumentQuery<'a> {
                                 &self.order_by,
                                 platform_version,
                             )?;
+                        } else if last_clause_is_on_transformed_source
+                            && left_over_index_properties.is_empty()
+                        {
+                            // The cursor was deliberately withheld from the
+                            // bucket-keyed level above; apply it here by
+                            // bucket membership instead. A cursor inside the
+                            // selected bucket continues the walk at its
+                            // document id (for a unique index the bucket
+                            // holds exactly the cursor document, so excluded
+                            // means the page is exhausted); a cursor from
+                            // outside the bucket cannot order within it and
+                            // is ignored.
+                            let cursor_in_bucket = match &starts_at_document {
+                                None => None,
+                                Some((document, included)) => {
+                                    let transform = index
+                                        .time_range
+                                        .as_ref()
+                                        .expect("checked by last_clause_is_on_transformed_source");
+                                    let bucket_key = self.document_type.serialize_value_for_key(
+                                        where_clause.field.as_str(),
+                                        &where_clause.value,
+                                        platform_version,
+                                    )?;
+                                    document
+                                        .get_raw_for_document_type(
+                                            where_clause.field.as_str(),
+                                            self.document_type,
+                                            None,
+                                            platform_version,
+                                        )?
+                                        .filter(|raw| {
+                                            transform.entry_keys_for_raw(raw).contains(&bucket_key)
+                                        })
+                                        .map(|_| (document, *included))
+                                }
+                            };
+                            match cursor_in_bucket {
+                                Some((document, included)) if !index.unique => {
+                                    query.set_subquery_key(vec![0]);
+                                    query.set_subquery(Self::inner_query_from_starts_at_for_id(
+                                        Some(&StartAtDocument {
+                                            document: document.clone(),
+                                            document_type: self.document_type,
+                                            included,
+                                        }),
+                                        left_to_right,
+                                    ));
+                                }
+                                cursor => {
+                                    if matches!(cursor, Some((_, false))) {
+                                        // Unique: the excluded cursor is the
+                                        // bucket's only document.
+                                        query = Query::new_with_direction(left_to_right);
+                                    }
+                                    Self::recursive_insert_on_query_ordered_with_cursor(
+                                        &mut query,
+                                        left_over_index_properties.as_slice(),
+                                        index.unique,
+                                        None,
+                                        left_to_right,
+                                        &self.order_by,
+                                        platform_version,
+                                    )?;
+                                }
+                            }
                         } else {
                             Self::recursive_insert_on_query_ordered_with_cursor(
                                 &mut query,
@@ -602,14 +684,22 @@ impl<'a> DriveDocumentQuery<'a> {
 
         let mut path = document_type_path;
 
+        // Path segments are level keys: grid-qualified for a time-range
+        // index's first property (`Index::level_key_for_property`), the bare
+        // property name everywhere else. The values pushed between them are
+        // untouched — a bucket start is encoded exactly like a timestamp.
         for (intermediate_index, intermediate_value) in
             intermediate_indexes.iter().zip(intermediate_values.iter())
         {
-            path.push(intermediate_index.name.as_bytes().to_vec());
+            path.push(
+                index
+                    .level_key_for_property(&intermediate_index.name)
+                    .into_bytes(),
+            );
             path.push(intermediate_value.as_slice().to_vec());
         }
 
-        path.push(last_index.name.as_bytes().to_vec());
+        path.push(index.level_key_for_property(&last_index.name).into_bytes());
 
         Ok(PathQuery::new(
             path,
diff --git a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/address_funds/address_credit_withdrawal_transition.rs b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/address_funds/address_credit_withdrawal_transition.rs
index b93406ec832..0b76c034f34 100644
--- a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/address_funds/address_credit_withdrawal_transition.rs
+++ b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/address_funds/address_credit_withdrawal_transition.rs
@@ -96,6 +96,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0x11; 32]),
             owner_id: Identifier::from([0x22; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/identity/identity_credit_withdrawal_transition.rs b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/identity/identity_credit_withdrawal_transition.rs
index 520e54e765e..203b9d0ad10 100644
--- a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/identity/identity_credit_withdrawal_transition.rs
+++ b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/identity/identity_credit_withdrawal_transition.rs
@@ -77,6 +77,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0xDD; 32]),
             owner_id: Identifier::from([0xAA; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/shielded/shielded_withdrawal_transition.rs b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/shielded/shielded_withdrawal_transition.rs
index 6df19016c54..458fb0cd2ec 100644
--- a/packages/rs-drive/src/state_transition_action/action_convert_to_operations/shielded/shielded_withdrawal_transition.rs
+++ b/packages/rs-drive/src/state_transition_action/action_convert_to_operations/shielded/shielded_withdrawal_transition.rs
@@ -119,6 +119,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0x11; 32]),
             owner_id: Identifier::from([0x22; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/mod.rs b/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/mod.rs
index 28f9438d2ee..85d1fee5e0d 100644
--- a/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/mod.rs
@@ -86,6 +86,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0x11; 32]),
             owner_id: Identifier::from([0x22; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/v0/transformer.rs b/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/v0/transformer.rs
index 862b2d052c9..0c44dcd19c5 100644
--- a/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/v0/transformer.rs
+++ b/packages/rs-drive/src/state_transition_action/address_funds/address_credit_withdrawal/v0/transformer.rs
@@ -93,6 +93,7 @@ impl AddressCreditWithdrawalTransitionActionV0 {
         });
 
         let withdrawal_document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties: document_data.into_btree_string_map().unwrap(),
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/mod.rs
index e529985db76..5584aec2faf 100644
--- a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/mod.rs
@@ -1,6 +1,7 @@
 /// transformer
 pub mod transformer;
 mod v0;
+mod v1;
 
 use derive_more::From;
 
@@ -14,6 +15,7 @@ use dpp::fee::Credits;
 use dpp::ProtocolError;
 
 pub use v0::*;
+pub use v1::*;
 use crate::state_transition_action::batch::batched_transition::document_transition::document_base_transition_action::{DocumentBaseTransitionAction};
 use dpp::version::PlatformVersion;
 use dpp::voting::vote_info_storage::contested_document_vote_poll_stored_info::ContestedDocumentVotePollStoredInfo;
@@ -150,7 +152,21 @@ impl DocumentFromCreateTransitionAction for Document {
     ) -> Result<Self, ProtocolError> {
         match document_create_transition_action {
             DocumentCreateTransitionAction::V0(v0) => {
-                Self::try_from_create_transition_action_v0(v0, owner_id, platform_version)
+                match platform_version
+                    .drive
+                    .methods
+                    .state_transitions
+                    .document_from_action
+                    .document_from_create_transition_action
+                {
+                    0 => Self::try_from_create_transition_action_v0(v0, owner_id, platform_version),
+                    1 => Self::try_from_create_transition_action_v1(v0, owner_id, platform_version),
+                    version => Err(ProtocolError::UnknownVersionMismatch {
+                        method: "Document::try_from_create_transition_action".to_string(),
+                        known_versions: vec![0, 1],
+                        received: version,
+                    }),
+                }
             }
         }
     }
@@ -162,7 +178,29 @@ impl DocumentFromCreateTransitionAction for Document {
     ) -> Result<Self, ProtocolError> {
         match document_create_transition_action {
             DocumentCreateTransitionAction::V0(v0) => {
-                Self::try_from_owned_create_transition_action_v0(v0, owner_id, platform_version)
+                match platform_version
+                    .drive
+                    .methods
+                    .state_transitions
+                    .document_from_action
+                    .document_from_create_transition_action
+                {
+                    0 => Self::try_from_owned_create_transition_action_v0(
+                        v0,
+                        owner_id,
+                        platform_version,
+                    ),
+                    1 => Self::try_from_owned_create_transition_action_v1(
+                        v0,
+                        owner_id,
+                        platform_version,
+                    ),
+                    version => Err(ProtocolError::UnknownVersionMismatch {
+                        method: "Document::try_from_owned_create_transition_action".to_string(),
+                        known_versions: vec![0, 1],
+                        received: version,
+                    }),
+                }
             }
         }
     }
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v0/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v0/mod.rs
index 8cb8c278692..73193343490 100644
--- a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v0/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v0/mod.rs
@@ -188,6 +188,7 @@ impl DocumentFromCreateTransitionActionV0 for Document {
                     .document_structure_version
                 {
                     0 => Ok(DocumentV0 {
+                        contract_version: None,
                         id,
                         owner_id,
                         properties: data,
@@ -320,6 +321,7 @@ impl DocumentFromCreateTransitionActionV0 for Document {
                     .document_structure_version
                 {
                     0 => Ok(DocumentV0 {
+                        contract_version: None,
                         id: *id,
                         owner_id,
                         properties: data,
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v1/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v1/mod.rs
new file mode 100644
index 00000000000..d15e0792fad
--- /dev/null
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_create_transition_action/v1/mod.rs
@@ -0,0 +1,70 @@
+//! Generation 1 of the create-action → `Document` conversion: generation 0
+//! plus the contract-version stamp. The built document records the version
+//! of the contract it was validated against, which selects each
+//! `requiredSince` property's byte layout in document serialization format
+//! 3. This generation must only be selected by platform versions whose
+//! document serialization format writes the stamp (format 3, protocol
+//! v14+); the version table pairs the two.
+
+use dpp::data_contract::accessors::v0::DataContractV0Getters;
+use dpp::document::{Document, DocumentV0Setters};
+use dpp::platform_value::Identifier;
+use dpp::version::PlatformVersion;
+use dpp::ProtocolError;
+
+use crate::state_transition_action::batch::batched_transition::document_transition::document_base_transition_action::{DocumentBaseTransitionAction, DocumentBaseTransitionActionAccessorsV0};
+use super::{DocumentCreateTransitionActionV0, DocumentFromCreateTransitionActionV0};
+
+/// documents from create transition v1
+pub trait DocumentFromCreateTransitionActionV1 {
+    /// Attempts to create a new `Document` from the given `DocumentCreateTransitionActionV0`
+    /// instance and `owner_id`, stamped with the contract version the
+    /// document was created against.
+    fn try_from_owned_create_transition_action_v1(
+        v0: DocumentCreateTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError>
+    where
+        Self: Sized;
+    /// Attempts to create a new `Document` from the given `DocumentCreateTransitionActionV0`
+    /// reference and `owner_id`, stamped with the contract version the
+    /// document was created against.
+    fn try_from_create_transition_action_v1(
+        v0: &DocumentCreateTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError>
+    where
+        Self: Sized;
+}
+
+fn action_contract_version(base: &DocumentBaseTransitionAction) -> u32 {
+    base.data_contract_fetch_info_ref().contract.version()
+}
+
+impl DocumentFromCreateTransitionActionV1 for Document {
+    fn try_from_owned_create_transition_action_v1(
+        v0: DocumentCreateTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError> {
+        let contract_version = action_contract_version(&v0.base);
+        let mut document =
+            Self::try_from_owned_create_transition_action_v0(v0, owner_id, platform_version)?;
+        document.set_contract_version(Some(contract_version));
+        Ok(document)
+    }
+
+    fn try_from_create_transition_action_v1(
+        v0: &DocumentCreateTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError> {
+        let contract_version = action_contract_version(&v0.base);
+        let mut document =
+            Self::try_from_create_transition_action_v0(v0, owner_id, platform_version)?;
+        document.set_contract_version(Some(contract_version));
+        Ok(document)
+    }
+}
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/mod.rs
index 136c1f9e6dc..21836bef237 100644
--- a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/mod.rs
@@ -1,4 +1,5 @@
 mod v0;
+mod v1;
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -10,6 +11,7 @@ use dpp::platform_value::{Identifier, Value};
 use dpp::prelude::{BlockHeight, CoreBlockHeight, Revision};
 use dpp::ProtocolError;
 pub use v0::*;
+pub use v1::*;
 
 use crate::state_transition_action::batch::batched_transition::document_transition::document_base_transition_action::DocumentBaseTransitionAction;
 use dpp::version::PlatformVersion;
@@ -172,7 +174,25 @@ impl DocumentFromReplaceTransitionAction for Document {
     ) -> Result<Self, ProtocolError> {
         match document_replace_transition_action {
             DocumentReplaceTransitionAction::V0(v0) => {
-                Self::try_from_replace_transition_action_v0(v0, owner_id, platform_version)
+                match platform_version
+                    .drive
+                    .methods
+                    .state_transitions
+                    .document_from_action
+                    .document_from_replace_transition_action
+                {
+                    0 => {
+                        Self::try_from_replace_transition_action_v0(v0, owner_id, platform_version)
+                    }
+                    1 => {
+                        Self::try_from_replace_transition_action_v1(v0, owner_id, platform_version)
+                    }
+                    version => Err(ProtocolError::UnknownVersionMismatch {
+                        method: "Document::try_from_replace_transition_action".to_string(),
+                        known_versions: vec![0, 1],
+                        received: version,
+                    }),
+                }
             }
         }
     }
@@ -184,7 +204,29 @@ impl DocumentFromReplaceTransitionAction for Document {
     ) -> Result<Self, ProtocolError> {
         match document_replace_transition_action {
             DocumentReplaceTransitionAction::V0(v0) => {
-                Self::try_from_owned_replace_transition_action_v0(v0, owner_id, platform_version)
+                match platform_version
+                    .drive
+                    .methods
+                    .state_transitions
+                    .document_from_action
+                    .document_from_replace_transition_action
+                {
+                    0 => Self::try_from_owned_replace_transition_action_v0(
+                        v0,
+                        owner_id,
+                        platform_version,
+                    ),
+                    1 => Self::try_from_owned_replace_transition_action_v1(
+                        v0,
+                        owner_id,
+                        platform_version,
+                    ),
+                    version => Err(ProtocolError::UnknownVersionMismatch {
+                        method: "Document::try_from_owned_replace_transition_action".to_string(),
+                        known_versions: vec![0, 1],
+                        received: version,
+                    }),
+                }
             }
         }
     }
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v0/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v0/mod.rs
index 2a458a70f2e..ac82cd6d4f7 100644
--- a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v0/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v0/mod.rs
@@ -157,6 +157,7 @@ impl DocumentFromReplaceTransitionActionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 owner_id,
                 properties: data.clone(),
@@ -211,6 +212,7 @@ impl DocumentFromReplaceTransitionActionV0 for Document {
             .document_structure_version
         {
             0 => Ok(DocumentV0 {
+                contract_version: None,
                 id,
                 owner_id,
                 properties: data,
diff --git a/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v1/mod.rs b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v1/mod.rs
new file mode 100644
index 00000000000..9b1b631e1fc
--- /dev/null
+++ b/packages/rs-drive/src/state_transition_action/batch/batched_transition/document_transition/document_replace_transition_action/v1/mod.rs
@@ -0,0 +1,63 @@
+//! Generation 1 of the replace-action → `Document` conversion: generation 0
+//! plus the contract-version stamp. A replace re-supplies the full document
+//! contents, so the document is re-stamped with the current contract
+//! version. This generation must only be selected by platform versions
+//! whose document serialization format writes the stamp (format 3, protocol
+//! v14+); the version table pairs the two.
+
+use dpp::data_contract::accessors::v0::DataContractV0Getters;
+use dpp::document::{Document, DocumentV0Setters};
+use dpp::platform_value::Identifier;
+use dpp::version::PlatformVersion;
+use dpp::ProtocolError;
+
+use crate::state_transition_action::batch::batched_transition::document_transition::document_base_transition_action::DocumentBaseTransitionActionAccessorsV0;
+use super::{DocumentFromReplaceTransitionActionV0, DocumentReplaceTransitionActionV0};
+
+/// document from replace transition v1
+pub trait DocumentFromReplaceTransitionActionV1 {
+    /// Attempts to create a new `Document` from the given `DocumentReplaceTransitionAction`
+    /// reference and `owner_id`, re-stamped with the current contract version.
+    fn try_from_replace_transition_action_v1(
+        value: &DocumentReplaceTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError>
+    where
+        Self: Sized;
+    /// Attempts to create a new `Document` from the given `DocumentReplaceTransitionAction`
+    /// instance and `owner_id`, re-stamped with the current contract version.
+    fn try_from_owned_replace_transition_action_v1(
+        value: DocumentReplaceTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError>
+    where
+        Self: Sized;
+}
+
+impl DocumentFromReplaceTransitionActionV1 for Document {
+    fn try_from_replace_transition_action_v1(
+        value: &DocumentReplaceTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError> {
+        let contract_version = value.base.data_contract_fetch_info_ref().contract.version();
+        let mut document =
+            Self::try_from_replace_transition_action_v0(value, owner_id, platform_version)?;
+        document.set_contract_version(Some(contract_version));
+        Ok(document)
+    }
+
+    fn try_from_owned_replace_transition_action_v1(
+        value: DocumentReplaceTransitionActionV0,
+        owner_id: Identifier,
+        platform_version: &PlatformVersion,
+    ) -> Result<Self, ProtocolError> {
+        let contract_version = value.base.data_contract_fetch_info_ref().contract.version();
+        let mut document =
+            Self::try_from_owned_replace_transition_action_v0(value, owner_id, platform_version)?;
+        document.set_contract_version(Some(contract_version));
+        Ok(document)
+    }
+}
diff --git a/packages/rs-drive/src/state_transition_action/batch/tests.rs b/packages/rs-drive/src/state_transition_action/batch/tests.rs
index f441b6d7636..8ffacdeb10b 100644
--- a/packages/rs-drive/src/state_transition_action/batch/tests.rs
+++ b/packages/rs-drive/src/state_transition_action/batch/tests.rs
@@ -8,10 +8,10 @@ use std::collections::{BTreeMap, BTreeSet};
 use std::sync::Arc;
 
 use dpp::block::block_info::BlockInfo;
-use dpp::data_contract::accessors::v0::DataContractV0Getters;
+use dpp::data_contract::accessors::v0::{DataContractV0Getters, DataContractV0Setters};
 use dpp::data_contract::associated_token::token_configuration_item::TokenConfigurationChangeItem;
 use dpp::data_contract::associated_token::token_distribution_key::TokenDistributionInfo;
-use dpp::document::{Document, DocumentV0};
+use dpp::document::{Document, DocumentV0, DocumentV0Getters};
 use dpp::identifier::Identifier;
 use dpp::platform_value::Value;
 use dpp::tokens::emergency_action::TokenEmergencyAction;
@@ -28,15 +28,15 @@ use crate::state_transition_action::batch::batched_transition::document_transiti
 };
 use crate::state_transition_action::batch::batched_transition::document_transition::document_create_transition_action::{
     DocumentCreateTransitionAction, DocumentCreateTransitionActionAccessorsV0,
-    DocumentCreateTransitionActionV0,
+    DocumentCreateTransitionActionV0, DocumentFromCreateTransitionAction,
 };
 use crate::state_transition_action::batch::batched_transition::document_transition::document_delete_transition_action::DocumentDeleteTransitionAction;
 use crate::state_transition_action::batch::batched_transition::document_transition::document_delete_transition_action::v0::{
     DocumentDeleteTransitionActionAccessorsV0, DocumentDeleteTransitionActionV0,
 };
 use crate::state_transition_action::batch::batched_transition::document_transition::document_replace_transition_action::{
-    DocumentReplaceTransitionAction, DocumentReplaceTransitionActionAccessorsV0,
-    DocumentReplaceTransitionActionV0,
+    DocumentFromReplaceTransitionAction, DocumentReplaceTransitionAction,
+    DocumentReplaceTransitionActionAccessorsV0, DocumentReplaceTransitionActionV0,
 };
 use crate::state_transition_action::batch::batched_transition::document_transition::document_transfer_transition_action::{
     DocumentTransferTransitionAction, DocumentTransferTransitionActionAccessorsV0,
@@ -2900,3 +2900,142 @@ fn test_batched_transition_from_bump_action() {
     let batched: BatchedTransitionAction = bump.into();
     assert!(batched.as_bump_identity_nonce_action().is_ok());
 }
+
+// ============================================================
+// 10. Contract-version stamp on create/replace conversions
+// ============================================================
+//
+// The document built from a create or replace action carries a
+// contract-version stamp from generation 1 of the conversion (protocol
+// v14, document serialization format 3) and no stamp under generation 0.
+// These tests go through the version-dispatched entry points so they fail
+// on a wrong Drive version-table selection, a missing stamp in one
+// conversion path, or a stamp that isn't the fetched contract's version.
+
+/// Contract version deliberately different from the fixture default (1) so a
+/// hardcoded stamp can't pass by accident.
+const STAMP_TEST_CONTRACT_VERSION: u32 = 7;
+
+fn stamp_test_contract_info(protocol_version: u32) -> Arc<DataContractFetchInfo> {
+    let mut info = DataContractFetchInfo::dpns_contract_fixture(protocol_version);
+    info.contract.set_version(STAMP_TEST_CONTRACT_VERSION);
+    Arc::new(info)
+}
+
+fn stamp_test_create_action(protocol_version: u32) -> DocumentCreateTransitionAction {
+    let base = DocumentBaseTransitionAction::V0(DocumentBaseTransitionActionV0 {
+        id: Identifier::from([0xAA; 32]),
+        identity_contract_nonce: 1,
+        document_type_name: "domain".to_string(),
+        data_contract: stamp_test_contract_info(protocol_version),
+        token_cost: None,
+        gas_fees_paid_by: GasFeesPaidBy::default(),
+    });
+    DocumentCreateTransitionAction::V0(DocumentCreateTransitionActionV0 {
+        base,
+        block_info: BlockInfo::default(),
+        data: BTreeMap::from([("key".to_string(), Value::Text("value".to_string()))]),
+        prefunded_voting_balance: None,
+        current_store_contest_info: None,
+        should_store_contest_info: None,
+    })
+}
+
+fn stamp_test_replace_action(protocol_version: u32) -> DocumentReplaceTransitionAction {
+    let base = DocumentBaseTransitionAction::V0(DocumentBaseTransitionActionV0 {
+        id: Identifier::from([0xAA; 32]),
+        identity_contract_nonce: 1,
+        document_type_name: "domain".to_string(),
+        data_contract: stamp_test_contract_info(protocol_version),
+        token_cost: None,
+        gas_fees_paid_by: GasFeesPaidBy::default(),
+    });
+    DocumentReplaceTransitionAction::V0(DocumentReplaceTransitionActionV0 {
+        base,
+        revision: 2,
+        created_at: Some(1000),
+        updated_at: Some(2000),
+        transferred_at: Some(3000),
+        created_at_block_height: Some(10),
+        updated_at_block_height: Some(20),
+        transferred_at_block_height: Some(30),
+        created_at_core_block_height: Some(100),
+        updated_at_core_block_height: Some(200),
+        transferred_at_core_block_height: Some(300),
+        data: BTreeMap::from([("field".to_string(), Value::U64(42))]),
+        changed_data_fields: BTreeSet::from(["field".to_string()]),
+        creator_id: Some(Identifier::from([0xCC; 32])),
+    })
+}
+
+#[test]
+fn should_not_stamp_contract_version_on_create_conversion_before_format_3() {
+    let platform_version = PlatformVersion::get(13).expect("expected protocol version 13");
+    let owner_id = Identifier::from([0xDD; 32]);
+
+    let action = stamp_test_create_action(platform_version.protocol_version);
+    let borrowed = Document::try_from_create_transition_action(&action, owner_id, platform_version)
+        .expect("borrowed create conversion");
+    assert_eq!(borrowed.contract_version(), None);
+
+    let owned =
+        Document::try_from_owned_create_transition_action(action, owner_id, platform_version)
+            .expect("owned create conversion");
+    assert_eq!(owned.contract_version(), None);
+}
+
+#[test]
+fn should_stamp_fetched_contract_version_on_create_conversion() {
+    let platform_version = PlatformVersion::latest();
+    let owner_id = Identifier::from([0xDD; 32]);
+
+    let action = stamp_test_create_action(platform_version.protocol_version);
+    let borrowed = Document::try_from_create_transition_action(&action, owner_id, platform_version)
+        .expect("borrowed create conversion");
+    assert_eq!(
+        borrowed.contract_version(),
+        Some(STAMP_TEST_CONTRACT_VERSION)
+    );
+
+    let owned =
+        Document::try_from_owned_create_transition_action(action, owner_id, platform_version)
+            .expect("owned create conversion");
+    assert_eq!(owned.contract_version(), Some(STAMP_TEST_CONTRACT_VERSION));
+}
+
+#[test]
+fn should_not_stamp_contract_version_on_replace_conversion_before_format_3() {
+    let platform_version = PlatformVersion::get(13).expect("expected protocol version 13");
+    let owner_id = Identifier::from([0xDD; 32]);
+
+    let action = stamp_test_replace_action(platform_version.protocol_version);
+    let borrowed =
+        Document::try_from_replace_transition_action(&action, owner_id, platform_version)
+            .expect("borrowed replace conversion");
+    assert_eq!(borrowed.contract_version(), None);
+
+    let owned =
+        Document::try_from_owned_replace_transition_action(action, owner_id, platform_version)
+            .expect("owned replace conversion");
+    assert_eq!(owned.contract_version(), None);
+}
+
+#[test]
+fn should_stamp_fetched_contract_version_on_replace_conversion() {
+    let platform_version = PlatformVersion::latest();
+    let owner_id = Identifier::from([0xDD; 32]);
+
+    let action = stamp_test_replace_action(platform_version.protocol_version);
+    let borrowed =
+        Document::try_from_replace_transition_action(&action, owner_id, platform_version)
+            .expect("borrowed replace conversion");
+    assert_eq!(
+        borrowed.contract_version(),
+        Some(STAMP_TEST_CONTRACT_VERSION)
+    );
+
+    let owned =
+        Document::try_from_owned_replace_transition_action(action, owner_id, platform_version)
+            .expect("owned replace conversion");
+    assert_eq!(owned.contract_version(), Some(STAMP_TEST_CONTRACT_VERSION));
+}
diff --git a/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/mod.rs b/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/mod.rs
index d83af986f2d..9e508a14a06 100644
--- a/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/mod.rs
@@ -75,6 +75,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0xDD; 32]),
             owner_id: Identifier::from([0xAA; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/v0/transformer.rs b/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/v0/transformer.rs
index e7f8d622d16..3f74eb99ba8 100644
--- a/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/v0/transformer.rs
+++ b/packages/rs-drive/src/state_transition_action/identity/identity_credit_withdrawal/v0/transformer.rs
@@ -52,6 +52,7 @@ impl IdentityCreditWithdrawalTransitionActionV0 {
         });
 
         let withdrawal_document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id: identity_credit_withdrawal.identity_id,
             properties: document_data.into_btree_string_map().unwrap(),
@@ -176,6 +177,7 @@ impl IdentityCreditWithdrawalTransitionActionV0 {
         });
 
         let withdrawal_document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id: identity_credit_withdrawal.identity_id,
             properties: document_data.into_btree_string_map()?,
diff --git a/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/mod.rs b/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/mod.rs
index ed54c01c824..11ab32792bf 100644
--- a/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/mod.rs
+++ b/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/mod.rs
@@ -96,6 +96,7 @@ mod tests {
 
     fn make_document() -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0x11; 32]),
             owner_id: Identifier::from([0x22; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/v0/transformer.rs b/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/v0/transformer.rs
index d674e99c965..86166ffd29d 100644
--- a/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/v0/transformer.rs
+++ b/packages/rs-drive/src/state_transition_action/shielded/shielded_withdrawal/v0/transformer.rs
@@ -90,6 +90,7 @@ impl ShieldedWithdrawalTransitionActionV0 {
         });
 
         let withdrawal_document = DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties: document_data
diff --git a/packages/rs-drive/src/util/batch/drive_op_batch/mod.rs b/packages/rs-drive/src/util/batch/drive_op_batch/mod.rs
index ecaed96055b..a113bdbefdf 100644
--- a/packages/rs-drive/src/util/batch/drive_op_batch/mod.rs
+++ b/packages/rs-drive/src/util/batch/drive_op_batch/mod.rs
@@ -17,6 +17,7 @@ use crate::drive::Drive;
 use crate::error::Error;
 use crate::fees::op::LowLevelDriveOperation;
 use dpp::block::block_info::BlockInfo;
+use dpp::fee::Credits;
 
 pub use address_funds::AddressFundsOperationType;
 pub use contract::DataContractOperationType;
@@ -243,6 +244,22 @@ impl DriveOperation<'_> {
             _ => Ok(None),
         }
     }
+
+    /// Sums the credits the batch mints into Platform (its `AddToSystemCredits` operations,
+    /// saturating). This is the gross inflow of the batch — the net rule of the daily
+    /// withdrawal limit records it per block, and netting against removals here instead would
+    /// let a same-block deposit and withdrawal hide the inflow.
+    pub fn credit_mints(operations: &[DriveOperation]) -> Credits {
+        operations
+            .iter()
+            .filter_map(|operation| match operation {
+                DriveOperation::SystemOperation(SystemOperationType::AddToSystemCredits {
+                    amount,
+                }) => Some(*amount),
+                _ => None,
+            })
+            .fold(0u64, |total, amount| total.saturating_add(amount))
+    }
 }
 
 #[cfg(feature = "server")]
diff --git a/packages/rs-drive/src/util/object_size_info/document_info.rs b/packages/rs-drive/src/util/object_size_info/document_info.rs
index 086d34ed46d..8fe04f45b03 100644
--- a/packages/rs-drive/src/util/object_size_info/document_info.rs
+++ b/packages/rs-drive/src/util/object_size_info/document_info.rs
@@ -304,6 +304,7 @@ mod tests {
     /// Helper: build a minimal Document (V0) with a given 32-byte id.
     fn make_document(id_bytes: [u8; 32]) -> Document {
         Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::new(id_bytes),
             owner_id: Identifier::new([0xAA; 32]),
             properties: BTreeMap::new(),
diff --git a/packages/rs-drive/src/verify/document/verify_proof/mod.rs b/packages/rs-drive/src/verify/document/verify_proof/mod.rs
index 46cde078b47..d7a383f4220 100644
--- a/packages/rs-drive/src/verify/document/verify_proof/mod.rs
+++ b/packages/rs-drive/src/verify/document/verify_proof/mod.rs
@@ -77,6 +77,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let result = query.verify_proof(&[], &platform_version);
diff --git a/packages/rs-drive/src/verify/document/verify_proof_keep_serialized/mod.rs b/packages/rs-drive/src/verify/document/verify_proof_keep_serialized/mod.rs
index 7909d0eb6bf..b19f32d2693 100644
--- a/packages/rs-drive/src/verify/document/verify_proof_keep_serialized/mod.rs
+++ b/packages/rs-drive/src/verify/document/verify_proof_keep_serialized/mod.rs
@@ -82,6 +82,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let result = query.verify_proof_keep_serialized(&[], &platform_version);
diff --git a/packages/rs-drive/src/verify/document/verify_start_at_document_in_proof/mod.rs b/packages/rs-drive/src/verify/document/verify_start_at_document_in_proof/mod.rs
index b2dc87e9a23..854902b78c1 100644
--- a/packages/rs-drive/src/verify/document/verify_start_at_document_in_proof/mod.rs
+++ b/packages/rs-drive/src/verify/document/verify_start_at_document_in_proof/mod.rs
@@ -94,6 +94,7 @@ mod tests {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         let result =
diff --git a/packages/rs-drive/src/verify/document_having/mod.rs b/packages/rs-drive/src/verify/document_having/mod.rs
index a3ddcec97e1..e21cfc913f7 100644
--- a/packages/rs-drive/src/verify/document_having/mod.rs
+++ b/packages/rs-drive/src/verify/document_having/mod.rs
@@ -10,9 +10,9 @@
 //!
 //! Only one verifier exists here, for the same reason as on the ranked
 //! surface: every having-range request — any of the three axes, either
-//! direction, any contiguous bound — resolves to one
-//! `prove_indexed_axis_query` envelope that differs only in the Merk
-//! query (the encoded bounds + direction) and limit it echoes.
+//! direction, any contiguous bound — resolves to one `Bounded` axis
+//! traversal proved through grovedb's unified `prove_query`, against
+//! the same `PathQuery` the verifier reconstructs from the request.
 
 /// Indexed-axis range proof verification — returns the groups the proof
 /// commits to as falling inside the bound, in axis order.
diff --git a/packages/rs-drive/src/verify/document_having/verify_having_range_proof/mod.rs b/packages/rs-drive/src/verify/document_having/verify_having_range_proof/mod.rs
index 893a2766bbb..9f202485af0 100644
--- a/packages/rs-drive/src/verify/document_having/verify_having_range_proof/mod.rs
+++ b/packages/rs-drive/src/verify/document_having/verify_having_range_proof/mod.rs
@@ -14,8 +14,8 @@ impl DriveDocumentHavingQuery<'_> {
     /// [`execute_range_with_proof`](Self::execute_range_with_proof).
     /// Both sides derive the proved subtree from
     /// [`indexed_property_name_tree_path`](Self::indexed_property_name_tree_path)
-    /// and the secondary query from
-    /// [`AxisRangeBounds::merk_query`](crate::query::drive_document_having_query::AxisRangeBounds::merk_query),
+    /// and the same bounded axis `PathQuery` from
+    /// [`AxisRangeBounds::i128_bounds`](crate::query::drive_document_having_query::AxisRangeBounds::i128_bounds),
     /// so the verifier cannot drift from the prover on *which* bound over
     /// *which* tree it is checking.
     ///
diff --git a/packages/rs-drive/src/verify/document_having/verify_having_range_proof/v0/mod.rs b/packages/rs-drive/src/verify/document_having/verify_having_range_proof/v0/mod.rs
index 9caf4f9df85..0f58f625769 100644
--- a/packages/rs-drive/src/verify/document_having/verify_having_range_proof/v0/mod.rs
+++ b/packages/rs-drive/src/verify/document_having/verify_having_range_proof/v0/mod.rs
@@ -1,120 +1,158 @@
 use crate::error::drive::DriveError;
 use crate::error::Error;
-use crate::query::{DriveDocumentHavingQuery, RankedAxis, RankedEntry, RankedEntryValue};
+use crate::query::drive_document_ranked_query::branches::{
+    axis_entries_to_ranked, decompose_branch_paths, merge_branch_pages,
+};
+use crate::query::{DriveDocumentHavingQuery, RankedEntry};
 use crate::verify::RootHash;
 use dpp::version::PlatformVersion;
-use grovedb::operations::proof::indexed_axis::AxisEntries;
+use grovedb::operations::proof::VerifiedPathQuery;
 use grovedb::GroveDb;
+use grovedb::PathQuery;
+use grovedb_query::AxisQuery;
 
 impl DriveDocumentHavingQuery<'_> {
     /// v0 of [`Self::verify_having_range_proof`].
     ///
-    /// Rebuilds the proved subtree path with
-    /// [`Self::indexed_property_name_tree_path`] and the secondary query
-    /// with
-    /// [`AxisRangeBounds::merk_query`](crate::query::drive_document_having_query::AxisRangeBounds::merk_query),
-    /// then hands the proof to the matching
-    /// `GroveDb::verify_indexed_*_query` — an associated function, no
+    /// Rebuilds the same `PathQuery` the prover built — the subtree
+    /// path via [`Self::indexed_property_name_tree_path`], the
+    /// `Bounded` traversal from the request's inclusive bounds
+    /// ([`AxisRangeBounds::inclusive_bounds_i128`](crate::query::drive_document_having_query::AxisRangeBounds::inclusive_bounds_i128)),
+    /// limit and direction — and hands the proof to
+    /// [`GroveDb::verify_path_query`], an associated function: no
     /// database handle, so this compiles and runs in a verifier-only
     /// build.
     ///
     /// Three things are checked before the entries are returned:
     ///
-    /// 1. **The envelope matches this query.** grovedb re-checks the
-    ///    proof against the reconstructed Merk query (the encoded bounds
-    ///    and walk direction) and the expected limit, so a proof
-    ///    generated for a different bound — or a different direction, or
-    ///    a different limit — is rejected rather than silently
-    ///    reinterpreted. Completeness rides on the same check: a Merk
-    ///    range proof commits its boundaries, so an in-range group the
-    ///    prover omitted fails reconstruction.
+    /// 1. **The proof covers this query's own traversal.** Binding is by
+    ///    RECONSTRUCTION, not echo comparison: the verifier re-executes
+    ///    the proof against the bounds, direction and limit it rebuilt
+    ///    from the request, so a proof for a different bound or
+    ///    direction fails to cover it. The limit binds as a CAP under
+    ///    re-execution — an exhausted-walk proof is a complete answer
+    ///    under any admitting cap (sound, and pinned by the
+    ///    limit-tamper test), while a proof truncated by a smaller limit
+    ///    fails a larger cap for missing coverage of the rest of the
+    ///    bound. Completeness rides on the Merk range proof itself: its
+    ///    boundary commitments show no in-range group was omitted.
     /// 2. **The result's axis shape matches the requested axis** — the
     ///    same belt-and-braces check the ranked verifier does.
     /// 3. **At most `limit` entries.** Fewer is normal — fewer groups
     ///    may match the bound — but more would mean the proof committed
     ///    a longer walk than the request authorized.
-    ///
-    /// No `platform_version` argument: the parent dispatcher already
-    /// consumed it to select this version, and verification derives
-    /// everything else from the proof bytes plus the query.
     #[inline(always)]
     pub(super) fn verify_having_range_proof_v0(
         &self,
         proof: &[u8],
         platform_version: &PlatformVersion,
     ) -> Result<(RootHash, Vec<RankedEntry>), Error> {
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
-        let secondary_query = self.bounds.merk_query(self.descending);
-
-        let result = match self.bounds.axis() {
-            RankedAxis::Count => GroveDb::verify_indexed_count_query(
-                proof,
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
-                &platform_version.drive.grove_version,
-            ),
-            RankedAxis::Sum => GroveDb::verify_indexed_sum_query(
-                proof,
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
-                &platform_version.drive.grove_version,
-            ),
-            RankedAxis::Avg => GroveDb::verify_indexed_avg_query(
+        if self.prefix_branches.len() > 1 {
+            // `IN`-pinned request: one grovedb branched envelope — same
+            // discipline as the ranked verifier (branch set from this
+            // query's own resolution, tails bound to keys by the
+            // branching-level proof, one root hash, page re-derived by
+            // the shared merge).
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let (prefix, keys, suffix) = decompose_branch_paths(&paths)?;
+            let axis = self.bounds.axis();
+            let (lo, hi) = self.bounds.inclusive_bounds_i128();
+            let path_query = PathQuery::new_branched_axis(
+                prefix,
+                keys.clone(),
+                suffix,
+                AxisQuery::bounded(axis.into(), lo, hi, self.limit, self.descending),
+            );
+            let verified = GroveDb::verify_path_query(
                 proof,
-                path_refs.as_slice(),
-                secondary_query,
-                Some(self.limit),
+                &path_query,
                 &platform_version.drive.grove_version,
-            ),
-        }
-        .map_err(|e| Error::GroveDB(Box::new(e)))?;
-
-        let entries = match (self.bounds.axis(), result.entries) {
-            (RankedAxis::Count, AxisEntries::Count(entries)) => entries
-                .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(count, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::Count(count),
-                })
-                .collect::<Vec<_>>(),
-            (RankedAxis::Sum, AxisEntries::Sum(entries)) => entries
-                .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(sum, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::Sum(sum),
-                })
-                .collect::<Vec<_>>(),
-            (RankedAxis::Avg, AxisEntries::Avg(entries)) => entries
+            )
+            .map_err(|e| Error::GroveDB(Box::new(e)))?;
+            let VerifiedPathQuery::BranchedAxisEntries {
+                root_hash,
+                branches,
+            } = verified
+            else {
+                return Err(Error::Drive(DriveError::CorruptedDriveState(
+                    "a branched having range proof verified to a non-branched shape".to_string(),
+                )));
+            };
+            if branches.len() != keys.len() || branches.iter().map(|(key, _)| key).ne(keys.iter()) {
+                return Err(Error::Drive(DriveError::CorruptedDriveState(
+                    "a branched having range proof verified a different branch set than the \
+                     request resolved"
+                        .to_string(),
+                )));
+            }
+            let per_branch = branches
                 .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(avg, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::AvgFixedPoint(avg),
+                .map(|(_key, entries)| {
+                    // Authenticated absence of a branch key = an empty page,
+                    // the same reading the unproved path gives an absent
+                    // `IN` element.
+                    let entries = match entries {
+                        None => Vec::new(),
+                        Some(entries) => axis_entries_to_ranked(axis, entries)?,
+                    };
+                    if entries.len() > self.limit as usize {
+                        return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+                            "a branch of a having range proof verified to {} entries for \
+                             limit = {}",
+                            entries.len(),
+                            self.limit
+                        ))));
+                    }
+                    Ok(entries)
                 })
-                .collect::<Vec<_>>(),
-            (axis, other) => {
-                return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
-                    "having range proof for the {axis:?} axis verified to {} entries of a \
-                     different axis shape",
-                    other.len()
-                ))));
-            }
-        };
+                .collect::<Result<Vec<_>, Error>>()?;
+            let entries = merge_branch_pages(
+                per_branch,
+                &self.prefix_branches,
+                self.descending,
+                self.limit as usize,
+            )?;
+            return Ok((root_hash, entries));
+        }
+        self.verify_having_range_proof_v0_branch(0, proof, platform_version)
+    }
 
+    /// One branch's verification — the entire pre-`IN` verifier,
+    /// parameterized by the prefix branch.
+    fn verify_having_range_proof_v0_branch(
+        &self,
+        branch: usize,
+        proof: &[u8],
+        platform_version: &PlatformVersion,
+    ) -> Result<(RootHash, Vec<RankedEntry>), Error> {
+        let path = self.indexed_property_name_tree_path(branch)?;
+        let axis = self.bounds.axis();
+        let (lo, hi) = self.bounds.inclusive_bounds_i128();
+        let path_query =
+            PathQuery::new_axis_bounded(path, axis.into(), lo, hi, self.limit, self.descending);
+        let verified =
+            GroveDb::verify_path_query(proof, &path_query, &platform_version.drive.grove_version)
+                .map_err(|e| Error::GroveDB(Box::new(e)))?;
+        let VerifiedPathQuery::AxisEntries {
+            root_hash,
+            entries,
+            skipped: _,
+        } = verified
+        else {
+            return Err(Error::Drive(DriveError::CorruptedDriveState(
+                "a having range proof verified to a different shape".to_string(),
+            )));
+        };
+        let entries = axis_entries_to_ranked(axis, entries)?;
         if entries.len() > self.limit as usize {
             return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
-                "having range proof for the {:?} axis verified to {} entries for limit = {}",
-                self.bounds.axis(),
+                "having range proof verified to {} entries for limit = {}",
                 entries.len(),
                 self.limit
             ))));
         }
-
-        Ok((result.root_hash, entries))
+        Ok((root_hash, entries))
     }
 }
diff --git a/packages/rs-drive/src/verify/document_ranked/mod.rs b/packages/rs-drive/src/verify/document_ranked/mod.rs
index 0a5a0e0b8a7..e9a4ebbe671 100644
--- a/packages/rs-drive/src/verify/document_ranked/mod.rs
+++ b/packages/rs-drive/src/verify/document_ranked/mod.rs
@@ -12,8 +12,9 @@
 //! single proof shape. Where the count surface has five verifiers because
 //! five different grovedb primitives can answer a count, every ranked
 //! request — either direction, at any offset, on any of the three axes —
-//! resolves to one `prove_indexed_axis_top_k_paginated` envelope that
-//! differs only in the `(axis, k, descending, offset)` tuple it echoes.
+//! resolves to one `RankedPage` axis traversal proved through grovedb's
+//! unified `prove_query`, against the same `PathQuery` the verifier
+//! reconstructs from the request.
 
 /// Indexed-axis top-k proof verification — returns the ranked groups the
 /// proof commits to, in ranking order.
diff --git a/packages/rs-drive/src/verify/document_ranked/verify_ranked_top_k_proof/v0/mod.rs b/packages/rs-drive/src/verify/document_ranked/verify_ranked_top_k_proof/v0/mod.rs
index 82f5b0a2320..4973d1a5431 100644
--- a/packages/rs-drive/src/verify/document_ranked/verify_ranked_top_k_proof/v0/mod.rs
+++ b/packages/rs-drive/src/verify/document_ranked/verify_ranked_top_k_proof/v0/mod.rs
@@ -1,29 +1,37 @@
 use crate::error::drive::DriveError;
 use crate::error::Error;
-use crate::query::{
-    DriveDocumentRankedQuery, RankedAxis, RankedEntry, RankedEntryValue, RankedPage,
+use crate::query::drive_document_ranked_query::branches::{
+    axis_entries_to_ranked, decompose_branch_paths, merge_branch_pages,
 };
+use crate::query::{DriveDocumentRankedQuery, RankedPage};
 use crate::verify::RootHash;
 use dpp::version::PlatformVersion;
-use grovedb::operations::proof::indexed_axis::AxisEntries;
+use grovedb::operations::proof::VerifiedPathQuery;
 use grovedb::GroveDb;
+use grovedb::PathQuery;
+use grovedb_query::AxisQuery;
 
 impl DriveDocumentRankedQuery<'_> {
     /// v0 of [`Self::verify_ranked_top_k_proof`].
     ///
-    /// Rebuilds the proved subtree path with
-    /// [`Self::indexed_property_name_tree_path`] and hands the proof to
-    /// [`GroveDb::verify_indexed_axis_top_k_paginated`], which is an
-    /// associated function — no database handle is involved, so this
+    /// Rebuilds the same `PathQuery` the prover built — the subtree
+    /// path via [`Self::indexed_property_name_tree_path`], the
+    /// `RankedPage` traversal from `(axis, k, offset, descending)` —
+    /// and hands the proof to [`GroveDb::verify_path_query`], an
+    /// associated function: no database handle is involved, so this
     /// compiles and runs in a verifier-only build.
     ///
     /// Three things are checked before the page is returned:
     ///
-    /// 1. **The envelope's `(axis, k, offset, descending)` match this
-    ///    query.** grovedb does this itself: the values are echoed in
-    ///    the proof and compared against the arguments, so a proof
-    ///    generated for a different ranking — or a different page of the
-    ///    same ranking — is rejected rather than silently reinterpreted.
+    /// 1. **The proof covers this query's own traversal.** Binding is by
+    ///    RECONSTRUCTION, not echo comparison: the verifier re-executes
+    ///    the proof against the traversal it rebuilt from the request,
+    ///    so a proof generated for a different ranking — or a different
+    ///    page of the same ranking — fails to cover it rather than being
+    ///    silently reinterpreted. (Coverage semantics make one benign
+    ///    case verifiable that the retired exact-echo check refused: an
+    ///    exhausted-walk proof is a complete answer under any admitting
+    ///    cap — see the having surface's limit-tamper test for the pin.)
     /// 2. **The result's axis shape matches the requested axis** — a
     ///    `Count` request must not come back holding `Sum` entries. This
     ///    is belt-and-braces on top of (1) (the tag check already rules
@@ -51,69 +59,136 @@ impl DriveDocumentRankedQuery<'_> {
         proof: &[u8],
         platform_version: &PlatformVersion,
     ) -> Result<(RootHash, RankedPage), Error> {
-        let path = self.indexed_property_name_tree_path()?;
-        let path_refs: Vec<&[u8]> = path.iter().map(|segment| segment.as_slice()).collect();
+        self.reject_offset_with_branches()?;
+        if self.prefix_branches.len() > 1 {
+            // `IN`-pinned request: the proof is one grovedb branched
+            // envelope. The branch set (and its order) comes from
+            // *this* query's own resolution; grovedb binds each branch
+            // tail to its branch key through the branching-level
+            // multi-key proof, reconstructs one root hash, and
+            // re-executes each branch's page against the traversal
+            // rebuilt from THIS query — coverage, not echo comparison.
+            // The page is then re-derived by the shared merge — the
+            // client never trusts a server-side merge.
+            let paths = (0..self.prefix_branches.len())
+                .map(|branch| self.indexed_property_name_tree_path(branch))
+                .collect::<Result<Vec<_>, Error>>()?;
+            let (prefix, keys, suffix) = decompose_branch_paths(&paths)?;
+            let path_query = PathQuery::new_branched_axis(
+                prefix,
+                keys.clone(),
+                suffix,
+                AxisQuery::top_k(
+                    self.axis.into(),
+                    self.k,
+                    self.offset as u64,
+                    self.descending,
+                ),
+            );
+            let verified = GroveDb::verify_path_query(
+                proof,
+                &path_query,
+                &platform_version.drive.grove_version,
+            )
+            .map_err(|e| Error::GroveDB(Box::new(e)))?;
+            let VerifiedPathQuery::BranchedAxisEntries {
+                root_hash,
+                branches,
+            } = verified
+            else {
+                return Err(Error::Drive(DriveError::CorruptedDriveState(
+                    "a branched ranked top-k proof verified to a non-branched shape".to_string(),
+                )));
+            };
+            if branches.len() != keys.len() || branches.iter().map(|(key, _)| key).ne(keys.iter()) {
+                return Err(Error::Drive(DriveError::CorruptedDriveState(
+                    "a branched ranked top-k proof verified a different branch set than the \
+                     request resolved"
+                        .to_string(),
+                )));
+            }
+            let per_branch = branches
+                .into_iter()
+                .map(|(_key, entries)| {
+                    // A branch key whose absence the branching-level Merk
+                    // proof authenticates contributes an empty page — the
+                    // same reading the unproved path gives an absent `IN`
+                    // element.
+                    let entries = match entries {
+                        None => Vec::new(),
+                        Some(entries) => axis_entries_to_ranked(self.axis, entries)?,
+                    };
+                    if entries.len() > self.k as usize {
+                        return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
+                            "a branch of a ranked top-k proof verified to {} entries for \
+                             k = {}",
+                            entries.len(),
+                            self.k
+                        ))));
+                    }
+                    Ok(entries)
+                })
+                .collect::<Result<Vec<_>, Error>>()?;
+            let entries = merge_branch_pages(
+                per_branch,
+                &self.prefix_branches,
+                self.descending,
+                self.k as usize,
+            )?;
+            return Ok((
+                root_hash,
+                RankedPage {
+                    skipped: 0,
+                    entries,
+                },
+            ));
+        }
+        self.verify_ranked_top_k_proof_v0_branch(0, proof, platform_version)
+    }
 
-        let result = GroveDb::verify_indexed_axis_top_k_paginated(
-            proof,
-            path_refs.as_slice(),
+    /// One branch's verification — the entire pre-`IN` verifier,
+    /// parameterized by the prefix branch.
+    fn verify_ranked_top_k_proof_v0_branch(
+        &self,
+        branch: usize,
+        proof: &[u8],
+        platform_version: &PlatformVersion,
+    ) -> Result<(RootHash, RankedPage), Error> {
+        let path = self.indexed_property_name_tree_path(branch)?;
+        let path_query = PathQuery::new_axis_top_k(
+            path,
             self.axis.into(),
             self.k,
             self.offset as u64,
             self.descending,
-            &platform_version.drive.grove_version,
-        )
-        .map_err(|e| Error::GroveDB(Box::new(e)))?;
-
-        let entries = match (self.axis, result.entries) {
-            (RankedAxis::Count, AxisEntries::Count(entries)) => entries
-                .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(count, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::Count(count),
-                })
-                .collect::<Vec<_>>(),
-            (RankedAxis::Sum, AxisEntries::Sum(entries)) => entries
-                .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(sum, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::Sum(sum),
-                })
-                .collect::<Vec<_>>(),
-            (RankedAxis::Avg, AxisEntries::Avg(entries)) => entries
-                .into_iter()
-                .map(|entry| entry.key_pair())
-                .map(|(avg, key)| RankedEntry {
-                    key,
-                    value: RankedEntryValue::AvgFixedPoint(avg),
-                })
-                .collect::<Vec<_>>(),
-            (axis, other) => {
-                return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
-                    "ranked top-k proof for the {axis:?} axis verified to {} entries of a \
-                     different axis shape",
-                    other.len()
-                ))));
-            }
+        );
+        let verified =
+            GroveDb::verify_path_query(proof, &path_query, &platform_version.drive.grove_version)
+                .map_err(|e| Error::GroveDB(Box::new(e)))?;
+        let VerifiedPathQuery::AxisEntries {
+            root_hash,
+            entries,
+            skipped,
+        } = verified
+        else {
+            return Err(Error::Drive(DriveError::CorruptedDriveState(
+                "a ranked top-k proof verified to a different shape".to_string(),
+            )));
         };
-
+        let entries = axis_entries_to_ranked(self.axis, entries)?;
         if entries.len() > self.k as usize {
             return Err(Error::Drive(DriveError::CorruptedDriveState(format!(
-                "ranked top-k proof for the {:?} axis verified to {} entries for k = {}",
-                self.axis,
+                "ranked top-k proof verified to {} entries for k = {}",
                 entries.len(),
                 self.k
             ))));
         }
-
-        Ok((
-            result.root_hash,
-            RankedPage {
-                skipped: result.skipped,
-                entries,
-            },
-        ))
+        // A paginated traversal's proof always attests its skip.
+        let skipped = skipped.ok_or_else(|| {
+            Error::Drive(DriveError::CorruptedDriveState(
+                "a paginated ranked proof carried no skip attestation".to_string(),
+            ))
+        })?;
+        Ok((root_hash, RankedPage { skipped, entries }))
     }
 }
diff --git a/packages/rs-drive/tests/drive_storage_ops_coverage.rs b/packages/rs-drive/tests/drive_storage_ops_coverage.rs
index 36342c497ae..25ea15b592e 100644
--- a/packages/rs-drive/tests/drive_storage_ops_coverage.rs
+++ b/packages/rs-drive/tests/drive_storage_ops_coverage.rs
@@ -887,6 +887,7 @@ mod document_operation_tests {
         use dpp::document::Document;
 
         let doc = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: dpp::prelude::Identifier::new([1u8; 32]),
             owner_id: dpp::prelude::Identifier::new([2u8; 32]),
             properties: Default::default(),
@@ -920,6 +921,7 @@ mod document_operation_tests {
         use dpp::document::Document;
 
         let doc = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: dpp::prelude::Identifier::new([1u8; 32]),
             owner_id: dpp::prelude::Identifier::new([2u8; 32]),
             properties: Default::default(),
diff --git a/packages/rs-drive/tests/query_tests.rs b/packages/rs-drive/tests/query_tests.rs
index 92ba675e11e..31c72050120 100644
--- a/packages/rs-drive/tests/query_tests.rs
+++ b/packages/rs-drive/tests/query_tests.rs
@@ -7275,8 +7275,8 @@ mod tests {
             .expect("there is always a root hash");
 
         let expected_app_hash = vec![
-            237, 198, 157, 236, 20, 182, 87, 85, 216, 64, 84, 25, 163, 231, 107, 173, 155, 152, 34,
-            64, 34, 142, 234, 16, 99, 134, 153, 156, 24, 208, 150, 115,
+            224, 113, 139, 209, 16, 163, 116, 151, 213, 152, 169, 13, 158, 228, 31, 124, 88, 139,
+            165, 2, 152, 27, 85, 54, 21, 40, 183, 80, 104, 140, 198, 119,
         ];
 
         assert_eq!(root_hash.as_slice(), expected_app_hash);
@@ -7356,8 +7356,8 @@ mod tests {
             .expect("there is always a root hash");
 
         let expected_app_hash = vec![
-            237, 198, 157, 236, 20, 182, 87, 85, 216, 64, 84, 25, 163, 231, 107, 173, 155, 152, 34,
-            64, 34, 142, 234, 16, 99, 134, 153, 156, 24, 208, 150, 115,
+            224, 113, 139, 209, 16, 163, 116, 151, 213, 152, 169, 13, 158, 228, 31, 124, 88, 139,
+            165, 2, 152, 27, 85, 54, 21, 40, 183, 80, 104, 140, 198, 119,
         ];
 
         assert_eq!(root_hash.as_slice(), expected_app_hash);
@@ -7458,8 +7458,8 @@ mod tests {
             .expect("there is always a root hash");
 
         let expected_app_hash = vec![
-            237, 198, 157, 236, 20, 182, 87, 85, 216, 64, 84, 25, 163, 231, 107, 173, 155, 152, 34,
-            64, 34, 142, 234, 16, 99, 134, 153, 156, 24, 208, 150, 115,
+            224, 113, 139, 209, 16, 163, 116, 151, 213, 152, 169, 13, 158, 228, 31, 124, 88, 139,
+            165, 2, 152, 27, 85, 54, 21, 40, 183, 80, 104, 140, 198, 119,
         ];
 
         assert_eq!(root_hash.as_slice(), expected_app_hash);
@@ -9055,6 +9055,7 @@ mod withdrawal_in_clause_placement_equivalence {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         // The current shape: the In clause in in_clauses
@@ -9076,6 +9077,7 @@ mod withdrawal_in_clause_placement_equivalence {
             start_at: None,
             start_at_included: false,
             block_time_ms: None,
+            resolved_time_ranges: vec![],
         };
 
         for protocol_version in [13u32, 14u32] {
diff --git a/packages/rs-drive/tests/supporting_files/contract/grades/grades-compound-ranked-contract.json b/packages/rs-drive/tests/supporting_files/contract/grades/grades-compound-ranked-contract.json
index df4179096ce..b1e5959910a 100644
--- a/packages/rs-drive/tests/supporting_files/contract/grades/grades-compound-ranked-contract.json
+++ b/packages/rs-drive/tests/supporting_files/contract/grades/grades-compound-ranked-contract.json
@@ -95,6 +95,62 @@
         "grade"
       ],
       "additionalProperties": false
+    },
+    "dualGrade": {
+      "type": "object",
+      "documentsMutable": false,
+      "canBeDeleted": false,
+      "indices": [
+        {
+          "name": "byIdentityTagAndClass",
+          "properties": [
+            {
+              "identityId": "asc"
+            },
+            {
+              "tag": "asc"
+            },
+            {
+              "class": "asc"
+            }
+          ],
+          "averageable": "grade",
+          "rangeAverageable": true,
+          "rankedAverageable": true
+        }
+      ],
+      "properties": {
+        "identityId": {
+          "type": "array",
+          "byteArray": true,
+          "minItems": 32,
+          "maxItems": 32,
+          "position": 0,
+          "contentMediaType": "application/x.dash.dpp.identifier"
+        },
+        "tag": {
+          "type": "string",
+          "maxLength": 32,
+          "position": 1
+        },
+        "class": {
+          "type": "string",
+          "maxLength": 32,
+          "position": 2
+        },
+        "grade": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100,
+          "position": 3
+        }
+      },
+      "required": [
+        "identityId",
+        "class",
+        "grade"
+      ],
+      "additionalProperties": false
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/rs-json-schema-compatibility-validator/src/rules/rule_set.rs b/packages/rs-json-schema-compatibility-validator/src/rules/rule_set.rs
index 6718805e19f..3984cfb261e 100644
--- a/packages/rs-json-schema-compatibility-validator/src/rules/rule_set.rs
+++ b/packages/rs-json-schema-compatibility-validator/src/rules/rule_set.rs
@@ -1369,6 +1369,54 @@ pub static KEYWORD_COMPATIBILITY_RULES: Lazy<CompatibilityRulesCollection> = Laz
                 ],
             },
         ),
+        // `requiredSince` (the contract version a property is required from)
+        // is frozen on existing properties: a document's byte layout is
+        // resolved from the latest schema by comparing each property's
+        // `requiredSince` against the document's contract-version stamp, so
+        // changing the annotation retroactively would misparse stored
+        // documents. A brand-new property carrying the keyword arrives as a
+        // single Add of the whole property subschema and never resolves this
+        // rule; introducing it there is judged by the document type's
+        // required-fields update validation, not by this differ.
+        (
+            "requiredSince",
+            CompatibilityRules {
+                allow_addition: false,
+                allow_removal: false,
+                allow_replacement_callback: FALSE_CALLBACK.clone(),
+                subschema_levels_depth: None,
+                inner: None,
+                #[cfg(any(test, feature = "examples"))]
+                examples: vec![
+                    (
+                        json!({}),
+                        json!({ "requiredSince": 2 }),
+                        Some(JsonSchemaChange::Add(AddOperation {
+                            path: "/requiredSince".to_string(),
+                            value: json!(2),
+                        })),
+                    )
+                        .into(),
+                    (
+                        json!({ "requiredSince": 2 }),
+                        json!({}),
+                        Some(JsonSchemaChange::Remove(RemoveOperation {
+                            path: "/requiredSince".to_string(),
+                        })),
+                    )
+                        .into(),
+                    (
+                        json!({ "requiredSince": 2 }),
+                        json!({ "requiredSince": 3 }),
+                        Some(JsonSchemaChange::Replace(ReplaceOperation {
+                            path: "/requiredSince".to_string(),
+                            value: json!(3),
+                        })),
+                    )
+                        .into(),
+                ],
+            },
+        ),
         (
             "$defs",
             CompatibilityRules {
diff --git a/packages/rs-platform-version/Cargo.toml b/packages/rs-platform-version/Cargo.toml
index 4ee353c872e..74faf5deaf6 100644
--- a/packages/rs-platform-version/Cargo.toml
+++ b/packages/rs-platform-version/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 thiserror = { version = "2.0.12" }
 bincode = { version = "=2.0.1" }
 versioned-feature-core = { git = "https://github.com/dashpay/versioned-feature-core", version = "1.0.0" }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e" }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45" }
 
 [features]
 mock-versions = []
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/mod.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/mod.rs
index e66bb564083..ec80ba92ca8 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/mod.rs
@@ -82,6 +82,11 @@ pub struct DocumentTypeSchemaVersions {
     /// `None` on versions that predate the keyword: they ignore it entirely,
     /// exactly as they parsed before it existed.
     pub apply_property_reference: OptionalFeatureVersion,
+    /// Parses the `requiredSince` property keyword (the contract version from
+    /// which a property is required). `None` on versions that predate the
+    /// keyword: they ignore it entirely, exactly as they parsed before it
+    /// existed.
+    pub apply_required_since: OptionalFeatureVersion,
     pub validate_max_depth: FeatureVersion,
     pub max_depth: u16,
     pub recursive_schema_validator_versions: RecursiveSchemaValidatorVersions,
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v1.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v1.rs
index 156436fbd24..bd6eda1e693 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v1.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v1.rs
@@ -43,6 +43,7 @@ pub const CONTRACT_VERSIONS_V1: DPPContractVersions = DPPContractVersions {
             find_identifier_and_binary_paths: 0,
             // This version predates the `refersTo` reference keyword
             apply_property_reference: None,
+            apply_required_since: None,
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v2.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v2.rs
index 45a29d6b353..1aec3222db0 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v2.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v2.rs
@@ -43,6 +43,7 @@ pub const CONTRACT_VERSIONS_V2: DPPContractVersions = DPPContractVersions {
             find_identifier_and_binary_paths: 0,
             // This version predates the `refersTo` reference keyword
             apply_property_reference: None,
+            apply_required_since: None,
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v3.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v3.rs
index 143f2719c93..5d513cc8506 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v3.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v3.rs
@@ -45,6 +45,7 @@ pub const CONTRACT_VERSIONS_V3: DPPContractVersions = DPPContractVersions {
             find_identifier_and_binary_paths: 0,
             // This version predates the `refersTo` reference keyword
             apply_property_reference: None,
+            apply_required_since: None,
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v4.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v4.rs
index fd12634279e..3c9f484e8c4 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v4.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v4.rs
@@ -45,6 +45,7 @@ pub const CONTRACT_VERSIONS_V4: DPPContractVersions = DPPContractVersions {
             find_identifier_and_binary_paths: 0,
             // This version predates the `refersTo` reference keyword
             apply_property_reference: None,
+            apply_required_since: None,
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v5.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v5.rs
index 1ca91eedd68..674f8593997 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v5.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v5.rs
@@ -47,6 +47,7 @@ pub const CONTRACT_VERSIONS_V5: DPPContractVersions = DPPContractVersions {
             find_identifier_and_binary_paths: 0,
             // This version predates the `refersTo` reference keyword
             apply_property_reference: None,
+            apply_required_since: None,
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v6.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v6.rs
index f61a7db2c4b..37db8c03037 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v6.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_contract_versions/v6.rs
@@ -48,7 +48,12 @@ pub const CONTRACT_VERSIONS_V6: DPPContractVersions = DPPContractVersions {
     },
     methods: DataContractMethodVersions {
         validate_document: 0,
-        validate_update: 0,
+        // Generation 1 (requiredSince): feeds the new contract version into
+        // per-document-type update validation and validates requiredSince
+        // annotations on document types introduced by the update, which the
+        // per-type pass never sees. Generation 0 stays byte-identical for
+        // replay of pre-v14 blocks.
+        validate_update: 1,
         schema: 0,
         validate_groups: 0,
         equal_ignoring_time_fields: 0,
@@ -69,6 +74,7 @@ pub const CONTRACT_VERSIONS_V6: DPPContractVersions = DPPContractVersions {
             enrich_with_base_schema: 1,
             find_identifier_and_binary_paths: 0,
             apply_property_reference: Some(0), // changed: the meta-schema v3 `refersTo` keyword is folded into the parsed property type; None before this version means the keyword is ignored, as it was before it existed
+            apply_required_since: Some(0), // changed: the meta-schema v3 `requiredSince` keyword (contract version a property is required from) is parsed onto the property; None before this version means the keyword is ignored, as it was before it existed
             validate_max_depth: 0,
             max_depth: 256,
             recursive_schema_validator_versions: RecursiveSchemaValidatorVersions {
@@ -81,7 +87,7 @@ pub const CONTRACT_VERSIONS_V6: DPPContractVersions = DPPContractVersions {
             create_document_with_prevalidated_properties: 0,
             prefunded_voting_balance_for_document: 0,
             contested_vote_poll_for_document: 0,
-            estimated_size: 0,
+            estimated_size: 1, // changed: adds the document serialization format 3 contract-version stamp varint (worst case 5 bytes) to the estimate
             index_for_types: 0,
             max_size: 0,
             serialize_value_for_key: 0,
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/mod.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/mod.rs
index 22148d7eeaf..bbb55fefa6d 100644
--- a/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/mod.rs
@@ -3,6 +3,7 @@ use versioned_feature_core::{FeatureVersion, FeatureVersionBounds};
 pub mod v1;
 pub mod v2;
 pub mod v3;
+pub mod v4;
 
 #[derive(Clone, Debug, Default)]
 pub struct DPPDocumentVersions {
diff --git a/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/v4.rs b/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/v4.rs
new file mode 100644
index 00000000000..dbcc34f6117
--- /dev/null
+++ b/packages/rs-platform-version/src/version/dpp_versions/dpp_document_versions/v4.rs
@@ -0,0 +1,37 @@
+use crate::version::dpp_versions::dpp_document_versions::{
+    DPPDocumentVersions, DocumentMethodVersions,
+};
+use versioned_feature_core::FeatureVersionBounds;
+
+/// Document serialization moves to format 3: the document is stamped with the
+/// data contract version its bytes conform to, right after the format prefix.
+/// The stamp lets a property carry `requiredSince` (required from a given
+/// contract version) while documents written before that version keep the
+/// presence-flagged layout they were serialized with. Formats 0-2 predate the
+/// stamp and deserialize with an unstamped (pre-annotation) layout.
+pub const DOCUMENT_VERSIONS_V4: DPPDocumentVersions = DPPDocumentVersions {
+    document_structure_version: 0,
+    document_serialization_version: FeatureVersionBounds {
+        min_version: 0,
+        max_version: 3,
+        default_current_version: 3,
+    },
+    document_cbor_serialization_version: FeatureVersionBounds {
+        min_version: 0,
+        max_version: 0,
+        default_current_version: 0,
+    },
+    extended_document_structure_version: 0,
+    extended_document_serialization_version: FeatureVersionBounds {
+        min_version: 0,
+        max_version: 0,
+        default_current_version: 0,
+    },
+    document_method_versions: DocumentMethodVersions {
+        is_equal_ignoring_timestamps: 0,
+        hash: 0,
+        get_raw_for_contract: 0,
+        get_raw_for_document_type: 0,
+        try_into_asset_unlock_base_transaction_info: 0,
+    },
+};
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/mod.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/mod.rs
index 051837c7f4f..a1bf5fdd754 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/mod.rs
@@ -164,6 +164,9 @@ pub struct DriveAbciIdentityCreditWithdrawalMethodVersions {
     pub rebroadcast_expired_withdrawal_documents: FeatureVersion,
     pub append_signatures_and_broadcast_withdrawal_transactions: FeatureVersion,
     pub cleanup_expired_locks_of_withdrawal_amounts: FeatureVersion,
+    /// Records the block's credit mints as an inflow that increases the net daily withdrawal
+    /// limit's daily maximum; exists from protocol version 14.
+    pub record_credit_inflows_for_withdrawals: OptionalFeatureVersion,
     pub record_total_credits_history_for_withdrawals: OptionalFeatureVersion,
 }
 
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v1.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v1.rs
index ec3439c79f5..9798d693037 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v1.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v1.rs
@@ -88,6 +88,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V1: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 0,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v10.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v10.rs
index f9935de1b40..38be834a186 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v10.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v10.rs
@@ -14,8 +14,10 @@ use crate::version::drive_abci_versions::drive_abci_method_versions::{
 
 /// Drive ABCI method versions 10. Introduced in protocol v14: turns on
 /// `record_total_credits_history_for_withdrawals` (`Some(0)`), the per-block record of the total
-/// credits in Platform that the day-lagged daily withdrawal limit reads. Everything else matches
-/// `DRIVE_ABCI_METHOD_VERSIONS_V9`.
+/// credits in Platform that the day-lagged daily withdrawal limit reads, and bumps
+/// `cleanup_expired_locks_of_withdrawal_amounts` to 1 so the per-block cleanup also prunes the
+/// expired entries of the credit inflows sum tree the net daily withdrawal limit reads.
+/// Everything else matches `DRIVE_ABCI_METHOD_VERSIONS_V9`.
 pub const DRIVE_ABCI_METHOD_VERSIONS_V10: DriveAbciMethodVersions = DriveAbciMethodVersions {
     engine: DriveAbciEngineMethodVersions {
         init_chain: 0,
@@ -91,7 +93,8 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V10: DriveAbciMethodVersions = DriveAbciMet
         update_broadcasted_withdrawal_statuses: 0,
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
-        cleanup_expired_locks_of_withdrawal_amounts: 0,
+        cleanup_expired_locks_of_withdrawal_amounts: 1, // changed in v14: also prunes expired entries of the credit inflows sum tree
+        record_credit_inflows_for_withdrawals: Some(0), // new in v14: the block's credit mints recorded as an inflow for the net daily withdrawal limit
         record_total_credits_history_for_withdrawals: Some(0), // changed in v14: per-block total credits history for the day-lagged daily withdrawal limit
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v2.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v2.rs
index e5aa0a81ddb..c3177e006f7 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v2.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v2.rs
@@ -89,6 +89,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V2: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 0,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v3.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v3.rs
index 1fee641ae15..06fe75413e5 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v3.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v3.rs
@@ -88,6 +88,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V3: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 0,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v4.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v4.rs
index 3055c2c298b..843e71c6d40 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v4.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v4.rs
@@ -88,6 +88,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V4: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 0,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v5.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v5.rs
index 2b0ff767922..bed7af26bf2 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v5.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v5.rs
@@ -92,6 +92,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V5: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v6.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v6.rs
index 5a6121fea16..df56f534d95 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v6.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v6.rs
@@ -90,6 +90,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V6: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v7.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v7.rs
index f42e4cead74..da44e9b81a9 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v7.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v7.rs
@@ -97,6 +97,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V7: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v8.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v8.rs
index 6fd49ead8c7..d9a461cc62f 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v8.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v8.rs
@@ -99,6 +99,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V8: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v9.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v9.rs
index df134131054..434f216c461 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v9.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_method_versions/v9.rs
@@ -108,6 +108,7 @@ pub const DRIVE_ABCI_METHOD_VERSIONS_V9: DriveAbciMethodVersions = DriveAbciMeth
         rebroadcast_expired_withdrawal_documents: 1,
         append_signatures_and_broadcast_withdrawal_transactions: 0,
         cleanup_expired_locks_of_withdrawal_amounts: 0,
+        record_credit_inflows_for_withdrawals: None,
         record_total_credits_history_for_withdrawals: None,
     },
     voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v10.rs b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v10.rs
index 33394779fec..f9e0afbabf0 100644
--- a/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v10.rs
+++ b/packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v10.rs
@@ -95,7 +95,7 @@ pub const DRIVE_ABCI_VALIDATION_VERSIONS_V10: DriveAbciValidationVersions =
             },
             masternode_vote_state_transition_balance_pre_check: 0,
             contract_create_state_transition: DriveAbciStateTransitionValidationVersion {
-                basic_structure: Some(1),
+                basic_structure: Some(2), // changed: rejects `requiredSince` other than 1 on a newly created contract — the annotation must name the version the change arrives with, and a fresh contract is version 1
                 advanced_structure: Some(1),
                 identity_signatures: None,
                 nonce: Some(0),
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/mod.rs b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/mod.rs
index 570b8a1ce0d..315fdfcc5f7 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/mod.rs
@@ -23,6 +23,10 @@ pub struct DriveIdentityWithdrawalMethodVersions {
     /// The total credits history under the withdrawals tree exists from protocol version 14.
     pub record_total_credits_history: OptionalFeatureVersion,
     pub fetch_total_credits_in_platform_a_day_ago: OptionalFeatureVersion,
+    /// Record every credit mint (asset locks, epoch Core rewards) in the credit inflows sum
+    /// tree the net daily withdrawal limit reads back. The subtree exists from protocol
+    /// version 14.
+    pub record_credit_inflows: OptionalFeatureVersion,
 }
 
 #[derive(Clone, Debug, Default)]
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v1.rs b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v1.rs
index b9e0c8c051e..06d66e723d6 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v1.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v1.rs
@@ -159,5 +159,6 @@ pub const DRIVE_IDENTITY_METHOD_VERSIONS_V1: DriveIdentityMethodVersions =
             calculate_current_withdrawal_limit: 0,
             record_total_credits_history: None,
             fetch_total_credits_in_platform_a_day_ago: None,
+            record_credit_inflows: None,
         },
     };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v2.rs b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v2.rs
index 149545691c6..482c0bc7252 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v2.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_identity_method_versions/v2.rs
@@ -26,12 +26,20 @@ use crate::version::drive_versions::drive_identity_method_versions::{
 ///   behavior change; v0 stays byte-frozen for protocol versions up to 13.
 /// * `withdrawals.calculate_current_withdrawal_limit` 0 -> 1: the daily
 ///   maximum derives from the total credits Platform held a day ago (the
-///   relative daily withdrawal limit) instead of the current total.
+///   relative daily withdrawal limit) instead of the current total. The
+///   `max_daily_withdrawal_amount` cap applies to that day-old base; credit
+///   inflows from the active window are added after the cap so matching
+///   deposit-withdraw cycles do not consume the capped budget.
 /// * `withdrawals.record_total_credits_history` and
 ///   `withdrawals.fetch_total_credits_in_platform_a_day_ago` `None -> Some(0)`:
 ///   the per-block total credits history under the withdrawals tree that the
 ///   lagged limit reads; the subtree does not exist before v14, so V1 keeps
 ///   both slots `None`.
+/// * `withdrawals.record_credit_inflows` `None -> Some(0)`: every credit mint
+///   (asset locks, epoch Core rewards) is recorded in the credit inflows sum
+///   tree so the daily withdrawal limit counts net outflow instead of gross —
+///   a deposit -> withdraw cycle no longer consumes the budget of other users.
+///   The subtree does not exist before v14, so V1 keeps the slot `None`.
 pub const DRIVE_IDENTITY_METHOD_VERSIONS_V2: DriveIdentityMethodVersions =
     DriveIdentityMethodVersions {
         fetch: DriveIdentityFetchMethodVersions {
@@ -175,8 +183,9 @@ pub const DRIVE_IDENTITY_METHOD_VERSIONS_V2: DriveIdentityMethodVersions =
                     move_broadcasted_withdrawal_transactions_back_to_queue_operations: 0,
                 },
             },
-            calculate_current_withdrawal_limit: 1, // changed in v14: daily maximum is a percentage of the total credits a day ago
+            calculate_current_withdrawal_limit: 1, // changed in v14: daily maximum is a percentage of the total credits a day ago plus the credit inflows of the last 25 hours
             record_total_credits_history: Some(0), // new in v14: total credits history for the day-lagged daily withdrawal limit
             fetch_total_credits_in_platform_a_day_ago: Some(0), // new in v14
+            record_credit_inflows: Some(0), // new in v14: credit inflows sum tree for the net daily withdrawal limit
         },
     };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/mod.rs b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/mod.rs
index 31387c4a28d..b2b4f08c977 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/mod.rs
@@ -1,6 +1,7 @@
 pub mod v1;
 pub mod v2;
 pub mod v3;
+pub mod v4;
 
 use crate::version::drive_versions::DriveDataContractOperationMethodVersions;
 use versioned_feature_core::FeatureVersion;
@@ -10,6 +11,18 @@ pub struct DriveStateTransitionMethodVersions {
     pub operations: DriveStateTransitionOperationMethodVersions,
     pub convert_to_high_level_operations:
         DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions,
+    pub document_from_action: DriveDocumentFromActionVersions,
+}
+
+/// Versions of the action → `Document` conversions. Generation 1 stamps the
+/// built document with the data contract version its bytes conform to
+/// (create assigns, replace re-assigns); it must only be selected by
+/// platform versions whose document serialization format writes the stamp
+/// (format 3, protocol v14+).
+#[derive(Clone, Debug, Default)]
+pub struct DriveDocumentFromActionVersions {
+    pub document_from_create_transition_action: FeatureVersion,
+    pub document_from_replace_transition_action: FeatureVersion,
 }
 
 #[derive(Clone, Debug, Default)]
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v1.rs b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v1.rs
index 204d3058747..aaebe7aa3f7 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v1.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v1.rs
@@ -1,4 +1,5 @@
 use crate::version::drive_versions::drive_state_transition_method_versions::{
+    DriveDocumentFromActionVersions,
     DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions,
     DriveStateTransitionMethodVersions, DriveStateTransitionOperationMethodVersions,
 };
@@ -56,4 +57,8 @@ pub const DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V1: DriveStateTransitionMethodV
                 shielded_withdrawal_transition: 0,
                 identity_create_from_shielded_pool_transition: 0,
             },
+        document_from_action: DriveDocumentFromActionVersions {
+            document_from_create_transition_action: 0,
+            document_from_replace_transition_action: 0,
+        },
     };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v2.rs b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v2.rs
index babf9bc6fd1..48e4c7d8f8e 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v2.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v2.rs
@@ -1,4 +1,5 @@
 use crate::version::drive_versions::drive_state_transition_method_versions::{
+    DriveDocumentFromActionVersions,
     DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions,
     DriveStateTransitionMethodVersions, DriveStateTransitionOperationMethodVersions,
 };
@@ -57,4 +58,8 @@ pub const DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V2: DriveStateTransitionMethodV
                 shielded_withdrawal_transition: 0,
                 identity_create_from_shielded_pool_transition: 0,
             },
+        document_from_action: DriveDocumentFromActionVersions {
+            document_from_create_transition_action: 0,
+            document_from_replace_transition_action: 0,
+        },
     };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v3.rs b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v3.rs
index 5993c538df9..801fdaf5437 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v3.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v3.rs
@@ -1,4 +1,5 @@
 use crate::version::drive_versions::drive_state_transition_method_versions::{
+    DriveDocumentFromActionVersions,
     DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions,
     DriveStateTransitionMethodVersions, DriveStateTransitionOperationMethodVersions,
 };
@@ -61,4 +62,8 @@ pub const DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V3: DriveStateTransitionMethodV
                 shielded_withdrawal_transition: 0,
                 identity_create_from_shielded_pool_transition: 0,
             },
+        document_from_action: DriveDocumentFromActionVersions {
+            document_from_create_transition_action: 0,
+            document_from_replace_transition_action: 0,
+        },
     };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v4.rs b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v4.rs
new file mode 100644
index 00000000000..466d006a06c
--- /dev/null
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_state_transition_method_versions/v4.rs
@@ -0,0 +1,69 @@
+use crate::version::drive_versions::drive_state_transition_method_versions::{
+    DriveDocumentFromActionVersions,
+    DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions,
+    DriveStateTransitionMethodVersions, DriveStateTransitionOperationMethodVersions,
+};
+use crate::version::drive_versions::DriveDataContractOperationMethodVersions;
+
+// This started at protocol 14: document_from_action generation 1 stamps built documents with the contract version (paired with document serialization format 3)
+pub const DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V4: DriveStateTransitionMethodVersions =
+    DriveStateTransitionMethodVersions {
+        operations: DriveStateTransitionOperationMethodVersions {
+            finalization_tasks: 0,
+            contracts: DriveDataContractOperationMethodVersions {
+                finalization_tasks: 0,
+            },
+        },
+        convert_to_high_level_operations:
+            DriveStateTransitionActionConvertToHighLevelOperationsMethodVersions {
+                data_contract_create_transition: 0,
+                data_contract_update_transition: 0,
+                document_create_transition: 0,
+                document_delete_transition: 0,
+                // PROTOCOL_VERSION_13: v1 rewrites a transferred or purchased
+                // DPNS domain document's `records.identity` to the new owner
+                // so the username resolves to the buyer. v0 stays for
+                // PROTOCOL_VERSION_12 chain replay.
+                document_purchase_transition: 1, // changed
+                document_replace_transition: 0,
+                document_transfer_transition: 1,     // changed
+                document_update_price_transition: 1, // changed
+                token_burn_transition: 0,
+                token_mint_transition: 0,
+                token_transfer_transition: 0,
+                documents_batch_transition: 0,
+                identity_create_transition: 0,
+                identity_create_from_addresses_transition: 0,
+                identity_credit_transfer_transition: 0,
+                identity_credit_withdrawal_transition: 0,
+                identity_top_up_transition: 0,
+                identity_top_up_from_addresses_transition: 0,
+                identity_update_transition: 1,
+                masternode_vote_transition: 0,
+                bump_identity_data_contract_nonce: 0,
+                bump_identity_nonce: 0,
+                partially_use_asset_lock: 0,
+                token_freeze_transition: 0,
+                token_unfreeze_transition: 0,
+                token_emergency_action_transition: 0,
+                token_destroy_frozen_funds_transition: 0,
+                token_config_update_transition: 0,
+                token_claim_transition: 0,
+                token_direct_purchase_transition: 0,
+                token_set_price_for_direct_purchase_transition: 0,
+                identity_credit_transfer_to_addresses_transition: 0,
+                address_funds_transfer_transition: 0,
+                address_credit_withdrawal_transition: 0,
+                address_funding_from_asset_lock_transition: 0,
+                shield_transition: 0,
+                shield_from_asset_lock_transition: 0,
+                shielded_transfer_transition: 0,
+                unshield_transition: 0,
+                shielded_withdrawal_transition: 0,
+                identity_create_from_shielded_pool_transition: 0,
+            },
+        document_from_action: DriveDocumentFromActionVersions {
+            document_from_create_transition_action: 1,  // changed
+            document_from_replace_transition_action: 1, // changed
+        },
+    };
diff --git a/packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/mod.rs b/packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/mod.rs
index 84af8082e48..58280be26b8 100644
--- a/packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/mod.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/mod.rs
@@ -76,8 +76,8 @@ pub struct DriveVerifyDocumentSumMethodVersions {
 /// Versions for the indexed-axis prove-path verifiers: the ranked
 /// (top-k) verifier and the boolean-`HAVING` range verifier. Both are
 /// implemented on the respective drive query types and delegate to
-/// grovedb's indexed-axis proof verification
-/// (`verify_indexed_axis_top_k_paginated` / `verify_indexed_axis_query`).
+/// grovedb's unified `verify_path_query` over the query's axis
+/// `PathQuery` (`new_axis_top_k` / `new_axis_bounded`).
 #[derive(Clone, Debug, Default)]
 pub struct DriveVerifyDocumentRankedMethodVersions {
     pub verify_ranked_top_k_proof: FeatureVersion,
diff --git a/packages/rs-platform-version/src/version/drive_versions/v9.rs b/packages/rs-platform-version/src/version/drive_versions/v9.rs
index 54f4e357c57..fade08c521d 100644
--- a/packages/rs-platform-version/src/version/drive_versions/v9.rs
+++ b/packages/rs-platform-version/src/version/drive_versions/v9.rs
@@ -6,7 +6,7 @@ use crate::version::drive_versions::drive_group_method_versions::v1::DRIVE_GROUP
 use crate::version::drive_versions::drive_group_method_versions::DriveShieldedMethodVersions;
 use crate::version::drive_versions::drive_grove_method_versions::v1::DRIVE_GROVE_METHOD_VERSIONS_V1;
 use crate::version::drive_versions::drive_identity_method_versions::v2::DRIVE_IDENTITY_METHOD_VERSIONS_V2;
-use crate::version::drive_versions::drive_state_transition_method_versions::v3::DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V3;
+use crate::version::drive_versions::drive_state_transition_method_versions::v4::DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V4;
 use crate::version::drive_versions::drive_structure_version::v1::DRIVE_STRUCTURE_V1;
 use crate::version::drive_versions::drive_token_method_versions::v1::DRIVE_TOKEN_METHOD_VERSIONS_V1;
 use crate::version::drive_versions::drive_verify_method_versions::v2::DRIVE_VERIFY_METHOD_VERSIONS_V2;
@@ -98,7 +98,7 @@ pub const DRIVE_VERSION_V9: DriveVersion = DriveVersion {
             apply_batch_low_level_drive_operations: 0,
             apply_batch_grovedb_operations: 0,
         },
-        state_transitions: DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V3, // changed in v8: DPNS domain records.identity rewrite on transfer/purchase
+        state_transitions: DRIVE_STATE_TRANSITION_METHOD_VERSIONS_V4, // changed: document_from_action generation 1 stamps built documents with the contract version (create assigns, replace re-assigns; paired with document serialization format 3)
         batch_operations: DriveBatchOperationsMethodVersion {
             convert_drive_operations_to_grove_operations: 0,
             apply_drive_operations: 0,
diff --git a/packages/rs-platform-version/src/version/mocks/v2_test.rs b/packages/rs-platform-version/src/version/mocks/v2_test.rs
index 192028514d2..76579f3a0d7 100644
--- a/packages/rs-platform-version/src/version/mocks/v2_test.rs
+++ b/packages/rs-platform-version/src/version/mocks/v2_test.rs
@@ -515,6 +515,7 @@ pub const TEST_PLATFORM_V2: PlatformVersion = PlatformVersion {
         max_contract_group_size: 256,
         max_token_redemption_cycles: 128,
         max_shielded_transition_actions: 16,
+        max_time_range_overlap_factor: None,
     },
     consensus: ConsensusVersions {
         tenderdash_consensus_version: 0,
diff --git a/packages/rs-platform-version/src/version/mocks/v3_test.rs b/packages/rs-platform-version/src/version/mocks/v3_test.rs
index f5dc6981c74..e5cfd15b1bb 100644
--- a/packages/rs-platform-version/src/version/mocks/v3_test.rs
+++ b/packages/rs-platform-version/src/version/mocks/v3_test.rs
@@ -123,6 +123,7 @@ pub const TEST_PLATFORM_V3: PlatformVersion = PlatformVersion {
                 rebroadcast_expired_withdrawal_documents: 1,
                 append_signatures_and_broadcast_withdrawal_transactions: 0,
                 cleanup_expired_locks_of_withdrawal_amounts: 0,
+                record_credit_inflows_for_withdrawals: None,
                 record_total_credits_history_for_withdrawals: None,
             },
             voting: DriveAbciVotingMethodVersions {
diff --git a/packages/rs-platform-version/src/version/system_limits/mod.rs b/packages/rs-platform-version/src/version/system_limits/mod.rs
index 4e5a8881c9d..0854a6c6f3b 100644
--- a/packages/rs-platform-version/src/version/system_limits/mod.rs
+++ b/packages/rs-platform-version/src/version/system_limits/mod.rs
@@ -86,6 +86,20 @@ pub struct SystemLimits {
     // do this that much
     pub max_token_redemption_cycles: u32,
     pub max_shielded_transition_actions: u16,
+    /// Maximum overlap factor (`range / step`) a `timeRange` index transform
+    /// may declare, enforced at contract registration.
+    ///
+    /// The overlap factor is the number of buckets that contain any given
+    /// timestamp — i.e. the write amplification of the index: every document
+    /// insert, delete, and (on a bucket-set change) update fans out into that
+    /// many index entries. The bound of 24 covers the natural worst case, a
+    /// day-long window sliding hourly, without letting a contract buy a
+    /// 256-entry fan-out per document.
+    ///
+    /// `None` preserves the behavior of protocol versions that predate
+    /// time-range indexes (nothing to bound: the `timeRange` keyword does not
+    /// parse there).
+    pub max_time_range_overlap_factor: Option<u64>,
 }
 
 #[cfg(test)]
diff --git a/packages/rs-platform-version/src/version/system_limits/v1.rs b/packages/rs-platform-version/src/version/system_limits/v1.rs
index 9f6a9218ac1..352d3ee490c 100644
--- a/packages/rs-platform-version/src/version/system_limits/v1.rs
+++ b/packages/rs-platform-version/src/version/system_limits/v1.rs
@@ -42,4 +42,5 @@ pub const SYSTEM_LIMITS_V1: SystemLimits = SystemLimits {
     // only becomes reachable if the size limit is raised. Pinned by dpp's
     // `seed_pool_batch_fits_max_state_transition_size` signing test.
     max_shielded_transition_actions: 16,
+    max_time_range_overlap_factor: None,
 };
diff --git a/packages/rs-platform-version/src/version/system_limits/v2.rs b/packages/rs-platform-version/src/version/system_limits/v2.rs
index 0aff7000acd..3b3f46d5e43 100644
--- a/packages/rs-platform-version/src/version/system_limits/v2.rs
+++ b/packages/rs-platform-version/src/version/system_limits/v2.rs
@@ -30,4 +30,5 @@ pub const SYSTEM_LIMITS_V2: SystemLimits = SystemLimits {
     // only becomes reachable if the size limit is raised. Pinned by dpp's
     // `seed_pool_batch_fits_max_state_transition_size` signing test.
     max_shielded_transition_actions: 16,
+    max_time_range_overlap_factor: None,
 };
diff --git a/packages/rs-platform-version/src/version/system_limits/v3.rs b/packages/rs-platform-version/src/version/system_limits/v3.rs
index 92dda4cf3d6..cdf3248de17 100644
--- a/packages/rs-platform-version/src/version/system_limits/v3.rs
+++ b/packages/rs-platform-version/src/version/system_limits/v3.rs
@@ -32,4 +32,5 @@ pub const SYSTEM_LIMITS_V3: SystemLimits = SystemLimits {
     // only becomes reachable if the size limit is raised. Pinned by dpp's
     // `seed_pool_batch_fits_max_state_transition_size` signing test.
     max_shielded_transition_actions: 16,
+    max_time_range_overlap_factor: None,
 };
diff --git a/packages/rs-platform-version/src/version/system_limits/v4.rs b/packages/rs-platform-version/src/version/system_limits/v4.rs
index 486a50c77b9..efc8d72578e 100644
--- a/packages/rs-platform-version/src/version/system_limits/v4.rs
+++ b/packages/rs-platform-version/src/version/system_limits/v4.rs
@@ -2,13 +2,18 @@ use crate::version::system_limits::SystemLimits;
 
 /// System limits for protocol version 14 and above.
 ///
-/// Identical to [`super::v3::SYSTEM_LIMITS_V3`] except that the daily withdrawal limit becomes
-/// relative: `daily_withdrawal_limit_percent` is set to 15, so Platform pools at most 15% of the
-/// total credits it held a day ago into asset unlock transactions per 24 hours — never below one
-/// maximal withdrawal and never above `max_daily_withdrawal_amount`, Core's 4000 Dash unlock
-/// capacity per day — instead of the flat 2000 Dash that applied from v8 (matching Core v22's
-/// `LimitAmountV22`). v13 is already live on networks with the flat limit, so the change gates
-/// here.
+/// Identical to [`super::v3::SYSTEM_LIMITS_V3`] except for two changes:
+///
+/// * The daily withdrawal limit becomes relative: `daily_withdrawal_limit_percent` is set to 15,
+///   so Platform pools at most 15% of the total credits it held a day ago into asset unlock
+///   transactions per 24 hours — never below one maximal withdrawal and never above
+///   `max_daily_withdrawal_amount`, Core's 4000 Dash unlock capacity per day — instead of the
+///   flat 2000 Dash that applied from v8 (matching Core v22's `LimitAmountV22`). v13 is already
+///   live on networks with the flat limit, so the change gates here.
+/// * `max_time_range_overlap_factor` is set: a `timeRange` index transform may declare at most
+///   24 overlapping windows per timestamp (a day-long window sliding hourly). The rule cannot
+///   exist before v14 because the `timeRange` keyword itself is only admitted by the v14
+///   document meta-schema.
 pub const SYSTEM_LIMITS_V4: SystemLimits = SystemLimits {
     estimated_contract_max_serialized_size: 16384,
     max_field_value_size: 5120, //5 KiB
@@ -35,4 +40,5 @@ pub const SYSTEM_LIMITS_V4: SystemLimits = SystemLimits {
     // only becomes reachable if the size limit is raised. Pinned by dpp's
     // `seed_pool_batch_fits_max_state_transition_size` signing test.
     max_shielded_transition_actions: 16,
+    max_time_range_overlap_factor: Some(24),
 };
diff --git a/packages/rs-platform-version/src/version/v14.rs b/packages/rs-platform-version/src/version/v14.rs
index 46420f0b487..2e6101d1e91 100644
--- a/packages/rs-platform-version/src/version/v14.rs
+++ b/packages/rs-platform-version/src/version/v14.rs
@@ -2,7 +2,7 @@ use crate::version::consensus_versions::ConsensusVersions;
 use crate::version::dpp_versions::dpp_asset_lock_versions::v1::DPP_ASSET_LOCK_VERSIONS_V1;
 use crate::version::dpp_versions::dpp_contract_versions::v6::CONTRACT_VERSIONS_V6;
 use crate::version::dpp_versions::dpp_costs_versions::v1::DPP_COSTS_VERSIONS_V1;
-use crate::version::dpp_versions::dpp_document_versions::v3::DOCUMENT_VERSIONS_V3;
+use crate::version::dpp_versions::dpp_document_versions::v4::DOCUMENT_VERSIONS_V4;
 use crate::version::dpp_versions::dpp_factory_versions::v1::DPP_FACTORY_VERSIONS_V1;
 use crate::version::dpp_versions::dpp_identity_versions::v1::IDENTITY_VERSIONS_V1;
 use crate::version::dpp_versions::dpp_method_versions::v3::DPP_METHOD_VERSIONS_V3;
@@ -30,7 +30,7 @@ use crate::version::ProtocolVersion;
 
 pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 
-/// v14 hosts four consensus changes:
+/// v14 hosts five consensus changes:
 ///
 /// 1. **Contract-level ranked aggregates** (this branch): an index can
 ///    declare that its groups are rankable by an aggregate, so a query like
@@ -71,10 +71,19 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 ///    (`SYSTEM_LIMITS_V4.daily_withdrawal_limit_percent`, read by
 ///    `daily_withdrawal_limit` v2 through `DPP_METHOD_VERSIONS_V3`), never below
 ///    one maximal withdrawal (`max_withdrawal_amount`) so every accepted
-///    withdrawal eventually fits and cannot block the pooling queue, and never
-///    above `max_daily_withdrawal_amount` (4000 Dash, Core's unlock capacity per
-///    day under V24) since pooling more than Core mines only cycles through
-///    expiry and re-signing. The base is
+///    withdrawal eventually fits and cannot block the pooling queue. The base is
+///    capped at `max_daily_withdrawal_amount` (4000 Dash, Core's unlock capacity
+///    per day under V24 as written); the credit inflows of the active window —
+///    every credit mint, recorded per block by
+///    `record_credit_inflows_for_withdrawals` in the credit inflows sum tree —
+///    are added after the cap, so the limit counts net outflow and a matching
+///    deposit -> withdraw cycle does not consume the capped budget of other
+///    users (#4471). Outflow funded by same-window deposits may therefore
+///    exceed the cap; this mirrors the net credit-pool rule Core adopts for V24
+///    alongside this change (tracked in #4471), which must land before V24
+///    activates. Both the inflows and the pooled reservations count over the
+///    interval after the base snapshot only — an entry the snapshot already
+///    reflects is neither added nor subtracted again. The base is
 ///    the total credits recorded at the latest block at least 24 hours before
 ///    the current one: `DRIVE_ABCI_METHOD_VERSIONS_V10` turns on
 ///    `record_total_credits_history_for_withdrawals`, which checks the total
@@ -88,11 +97,29 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 ///    the total before or at activation. The lag is the guardrail: a sudden
 ///    jump in the total credits does not raise the limit for a day. Amounts
 ///    already pooled in the last 24 hours keep counting against the maximum
-///    exactly as before. Core's own unlock limit is unaffected: pre-V24 Core
-///    caps unlocks at `LimitAmountV22` (2000 Dash) per *block*, with the amount
-///    checked only at block level, so any daily total is still minable across
-///    blocks; after V24 it enforces 4000 Dash per 576-block window, which the
-///    cap above never exceeds.
+///    exactly as before. Pre-V24 Core caps unlocks at `LimitAmountV22` (2000
+///    Dash) per *block*, with the amount checked only at block level, so any
+///    daily total is still minable across blocks; V24's 4000 Dash per 576-block
+///    window matches the capped base and is raised to the same net rule before
+///    activation (see above).
+/// 5. **Time-range indexes**: an index can declare a `timeRange` transform
+///    that buckets a required system timestamp (`$createdAt` /
+///    `$updatedAt` / `$transferredAt`) into fixed-length, regularly-spaced,
+///    optionally overlapping windows declared in seconds (`range` / `step`,
+///    plus an optional `phase < step` alignment offset). Each grid gets its
+///    own index subtree — the level is keyed by the property name qualified
+///    with the grid — so several grids may bucket one timestamp side by
+///    side. A document is stored once per containing bucket per grid (the
+///    v2 insert/delete and v1 update walkers carry the fan-out; the
+///    per-document write amplification is capped per index by
+///    `SystemLimits::max_time_range_overlap_factor`), and the v1
+///    `getDocuments` handler resolves the new `IN_TIME_RANGE` operator —
+///    bare `"newest"`/`"oldest"` on a single-grid field, or a structured
+///    `[selector, range, step(, phase)]` operand naming one grid — into a
+///    bucket-start equality from committed block time, making "newest
+///    window" trending/leaderboard document and count/sum/avg queries
+///    provable. `unique: true` is admitted only for non-overlapping windows
+///    (`range == step`) sourced from the immutable `$createdAt`.
 ///
 /// The first two are orthogonal by construction: the ranked upgrade decides the
 /// *property-name* tree type, the demotion decides the *value* tree type
@@ -101,16 +128,17 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 /// variant did — so ranked secondaries keep ranking correctly over
 /// shared-prefix shapes.
 ///
-/// Until a contract uses the ranked grammar, the only v14 behavior changes
-/// are the shared-prefix fix, the contested-index cross-check, the
-/// index-reorder schema-compatibility fix and the relative daily withdrawal
-/// limit; everything else matches v13:
+/// Until a contract uses the ranked or time-range grammar, the only v14
+/// behavior changes are the shared-prefix fix, the contested-index
+/// cross-check, the index-reorder schema-compatibility fix and the relative
+/// daily withdrawal limit; everything else matches v13:
 ///
 /// * `CONTRACT_VERSIONS_V6` points `document_type_schema` at the v3 document
 ///   meta-schema, which hosts the ranked index keywords
-///   (`rankedCountable` / `rankedSummable` / `rankedAverageable`). v13 keeps
-///   validating against meta-schema v2, where those keys are rejected as
-///   unknown properties, so a pre-v14 contract cannot smuggle them in.
+///   (`rankedCountable` / `rankedSummable` / `rankedAverageable`), the
+///   `refersTo` reference keyword and the `timeRange` index transform. v13
+///   keeps validating against meta-schema v2, where those keys are rejected
+///   as unknown properties, so a pre-v14 contract cannot smuggle them in.
 ///   It also bumps `validate_schema_compatibility` to 1, which strips the
 ///   top-level `indices` key before diffing the old and new document type
 ///   schemas: index immutability is enforced by `validate_update` v1's
@@ -122,7 +150,8 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 ///   creating the three indexed tree variants and the verify-method slot for
 ///   `verify_ranked_top_k_proof`. All are 0 today. The same table bumps the
 ///   four index walkers to v2 and the document update walker to v1 for the
-///   shared-prefix fix.
+///   shared-prefix fix; those same walker versions carry the time-range
+///   bucket fan-out, so both features gate on one table entry.
 /// * `DRIVE_ABCI_QUERY_VERSIONS_V3` bumps
 ///   `document_query_helpers.compute_aggregate_mode_and_check_limit` 0 → 2,
 ///   opening two routes on the v1 document-query handler: the ranked path
@@ -144,11 +173,25 @@ pub const PROTOCOL_VERSION_14: ProtocolVersion = 14;
 ///   reference property names an identity or contract that does not exist
 ///   is rejected. v13 keeps the v9 table and therefore keeps
 ///   accepting all of these, so replay of pre-upgrade blocks is unchanged.
+/// * `DOCUMENT_VERSIONS_V4` bumps `document_serialization_version` to
+///   default 3: documents are stamped with the contract version their bytes
+///   conform to (a varint after the format prefix), enabling the
+///   `requiredSince` property keyword — a contract update may add a new
+///   required property annotated with the version that update creates.
+///   Documents stamped below a property's `requiredSince` keep the
+///   presence-flagged layout they were written with, so the latest contract
+///   alone reconstructs every stamp's layout and no historical contract
+///   lookups are ever needed. Reads dispatch on the byte prefix, so
+///   formats 0–2 (all pre-v14 documents) deserialize exactly as before with
+///   an unstamped (pre-annotation) layout.
 ///
-/// The wire surface is deliberately unchanged: `GetDocumentsRequestV1`
+/// The wire surface changes only additively: `GetDocumentsRequestV1`
 /// already carries `selects` / `group_by` / `order_by` / `limit` /
 /// `offset`; the ranked response is an additive `ResultData.ranked`
-/// variant, whose `skipped` field is likewise additive.
+/// variant, whose `skipped` field is likewise additive; and the v1
+/// where-clause operator enum gains `IN_TIME_RANGE = 11`, which pre-v14
+/// servers reject as an unknown operator rather than misread (the v0 wire
+/// has no time-range operator at all).
 pub const PLATFORM_V14: PlatformVersion = PlatformVersion {
     protocol_version: PROTOCOL_VERSION_14,
     drive: DRIVE_VERSION_V9, // changed: drive document method versions v4 — v2 index walkers (shared-prefix aggregate indexes become insertable) + the detect_ranked_mode slot
@@ -157,7 +200,7 @@ pub const PLATFORM_V14: PlatformVersion = PlatformVersion {
         methods: DRIVE_ABCI_METHOD_VERSIONS_V10, // changed: records the per-block total credits history for the daily withdrawal limit
         validation_and_processing: DRIVE_ABCI_VALIDATION_VERSIONS_V10, // changed: contested-index cross-check + refersTo document reference validation
         withdrawal_constants: DRIVE_ABCI_WITHDRAWAL_CONSTANTS_V3, // changed: prune bound for the total credits history
-        query: DRIVE_ABCI_QUERY_VERSIONS_V3, // changed: ranked + boolean-HAVING routing gate
+        query: DRIVE_ABCI_QUERY_VERSIONS_V3, // changed: ranked + boolean-HAVING routing gate; the v1 handler also resolves IN_TIME_RANGE from committed block time
         checkpoints: DRIVE_ABCI_CHECKPOINT_PARAMETERS_V1,
     },
     dpp: DPPVersion {
@@ -167,8 +210,8 @@ pub const PLATFORM_V14: PlatformVersion = PlatformVersion {
         state_transition_conversion_versions: STATE_TRANSITION_CONVERSION_VERSIONS_V2,
         state_transition_method_versions: STATE_TRANSITION_METHOD_VERSIONS_V1,
         state_transitions: STATE_TRANSITION_VERSIONS_V3,
-        contract_versions: CONTRACT_VERSIONS_V6, // changed: v3 document meta-schema hosts the ranked index keywords
-        document_versions: DOCUMENT_VERSIONS_V3,
+        contract_versions: CONTRACT_VERSIONS_V6, // changed: v3 document meta-schema hosts the ranked, refersTo, requiredSince and timeRange keywords
+        document_versions: DOCUMENT_VERSIONS_V4, // changed: document serialization format 3 — the contract version stamp that enables `requiredSince` properties
         identity_versions: IDENTITY_VERSIONS_V1,
         voting_versions: VOTING_VERSION_V2,
         token_versions: TOKEN_VERSIONS_V2,
@@ -178,7 +221,7 @@ pub const PLATFORM_V14: PlatformVersion = PlatformVersion {
     },
     system_data_contracts: SYSTEM_DATA_CONTRACT_VERSIONS_V3, // changed: DashPay v2 adds profile payment address fields (DIP-33)
     fee_version: FEE_VERSION2,
-    system_limits: SYSTEM_LIMITS_V4, // changed: daily withdrawal limit becomes 15% of the total credits a day ago
+    system_limits: SYSTEM_LIMITS_V4, // changed: daily withdrawal limit becomes 15% of the total credits a day ago + time-range overlap-factor cap (24)
     consensus: ConsensusVersions {
         tenderdash_consensus_version: 1,
     },
diff --git a/packages/rs-platform-wallet-ffi/ERROR_CODE_REGISTRY.md b/packages/rs-platform-wallet-ffi/ERROR_CODE_REGISTRY.md
new file mode 100644
index 00000000000..336d2ef5c20
--- /dev/null
+++ b/packages/rs-platform-wallet-ffi/ERROR_CODE_REGISTRY.md
@@ -0,0 +1,675 @@
+# FFI Error-Code Registry
+
+Single source of truth for the integer values of
+`PlatformWalletFFIResultCode` (`packages/rs-platform-wallet-ffi/src/error.rs`).
+
+Every value in that enum is **public ABI**. `cbindgen` emits it into the
+generated C header, and hosts compare against the integer — Swift
+(`packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift`)
+mirrors it as a `RawRepresentable` enum, Kotlin
+(`packages/kotlin-sdk/.../errors/DashSdkError.kt`) branches on it in
+`fromPlatformWalletNative`. A shipped host binary that was compiled against
+one numbering keeps using that numbering.
+
+This file exists because several feature branches allocate into the same
+integer range in parallel, and a duplicate integer across two branches never
+produces a textual merge conflict. What happens after the merge depends on the
+shape of the duplication, and only one of the two shapes is caught by a
+compiler:
+
+* **Two different variant names on the same integer.** The merged Rust enum has
+  two variants with one discriminant, so `rustc` refuses it with
+  `error[E0081]: discriminant value N assigned more than once`. Loud, but only
+  *after* someone actually merges both branches into one tree — neither
+  branch's own CI can see it, because neither branch contains both variants.
+  This is how the code-32 collision below was finally caught.
+* **The same meaning moving to a different integer**, or a host mirror left
+  un-updated. Nothing fails to compile. A shipped host binary keeps the
+  numbering it was built against, so it silently reads the new integer as
+  whatever the old one meant — or, for an unmirrored code, loses the identity
+  entirely (`.errorUnknown` in Swift). This is the failure this file mainly
+  exists to prevent, and nothing in either branch's diff shows it.
+
+So allocations have to be reconciled here, in one place, rather than in each
+branch's diff.
+
+## Rules
+
+1. **Claim the next free integer** from the table below — the first value not
+   listed as merged, proposed, or reserved. Do not reuse a gap unless this file
+   marks it free.
+2. **Record the claim in this file in the same PR** that adds the variant. A PR
+   that adds a code without a row here is incomplete.
+3. **Never renumber a code after it has shipped in a release.** Deprecate
+   instead: leave the row, mark it deprecated, and allocate a new integer. Codes
+   that are still only proposed (unmerged) may be renumbered to resolve a
+   collision; codes on `v4.2-dev` may not.
+4. **Do not reuse a retired integer.** Mark it reserved and move on.
+5. **Update the mirrors in the same PR.** Swift needs **three** edits, not one,
+   and they fail in different ways:
+   1. `PlatformWalletResultCode` — the raw case.
+   2. `PlatformWalletResultCode.init(ffi:)` — the arm mapping the generated C
+      constant. This switch has a `default:` that yields `.errorUnknown`, so
+      omitting the arm compiles fine and silently loses the code's identity
+      *before* any typed handling sees it.
+   3. `PlatformWalletError` — the typed case, **and** its `init(result:)` arm.
+      That switch is exhaustive with no `default:`, so adding a raw case in (1)
+      without the matching arm here makes it non-exhaustive and the Swift
+      package stops compiling.
+
+   Then, where the code deserves typed handling, the Kotlin
+   `fromPlatformWalletNative` mapping and `DashSdkErrorTest`. Kotlin is allowed
+   to be non-exhaustive: unmapped codes fall through to
+   `PlatformWallet.Generic(code, …)`, which preserves the integer.
+6. **Blocks 98–99 are terminal sentinels** (`NotFound`, `ErrorUnknown`) and are
+   not an allocation frontier. New codes go after the highest allocated value
+   below them.
+
+## Merged allocations (`v4.2-dev`)
+
+These are shipped ABI. Do not renumber.
+
+| Code | Name | Notes |
+| ---: | --- | --- |
+| 0 | `Success` | |
+| 1 | `ErrorInvalidHandle` | |
+| 2 | `ErrorInvalidParameter` | |
+| 3 | `ErrorNullPointer` | |
+| 4 | `ErrorSerialization` | |
+| 5 | `ErrorDeserialization` | |
+| 6 | `ErrorWalletOperation` | |
+| 7 | `ErrorIdentityNotFound` | |
+| 8 | `ErrorContactNotFound` | |
+| 9 | `ErrorInvalidNetwork` | |
+| 10 | `ErrorInvalidIdentifier` | |
+| 11 | `ErrorMemoryAllocation` | |
+| 12 | `ErrorUtf8Conversion` | |
+| 13 | `ErrorArithmeticOverflow` | Produced in-tree by `shielded_send.rs` (the shielded-send amount/fee overflow guard). Its rustdoc was corrected by #4360 (`e0b8baa850`), which documents the `PlatformWalletError::InputSumOverflow` mapping — the stale no-producer comment this row used to track is gone |
+| 14 | `ErrorNoSelectableInputs` | |
+| 15 | `ErrorWalletAlreadyExists` | |
+| 16 | `ErrorShieldedBroadcastFailed` | |
+| 17 | `ErrorShieldedBroadcastUnconfirmed` | |
+| 18 | `ErrorShieldedSpendUnconfirmed` | |
+| 19 | `ErrorShieldedNoRecordedAnchor` | |
+| 20 | `ErrorTransactionBroadcastUnconfirmed` | |
+| 21 | `ErrorAddressNonceMismatch` | |
+| 22 | `ErrorCoreInsufficientFunds` | |
+| 23 | `ErrorAssetLockNotTracked` | |
+| 24 | `ErrorAssetLockAlreadyConsumed` | |
+| 25 | `ErrorAssetLockFundingMismatch` | |
+| 26 | `ErrorTransactionBroadcastRejected` | Merged in `9302c62e8b`; took a number several open branches had been treating as free |
+| 27 | `ErrorShutdownIncomplete` | Merged 2026-08-02 by **#4268** (`429667e723`). A quiesce/drain barrier missed its budget. **Took the number #4185 had held since before this file existed** — see the collision history below |
+| 29 | `ErrorAssetLockInsufficientFunds` | Merged 2026-08-26 by **#4361** (`699d25704a`) — the typed asset-lock shortfall, landed alongside the coinjoin-drain shielded funding binding. Lineage: fork-era #4184 → #4316 (closed unmerged) → #4361. Complete across all three layers at merge: the Rust discriminant with its raw-value test pin, Swift's `errorAssetLockInsufficientFunds = 29` raw case *and* its `init(ffi:)` arm *and* the typed `PlatformWalletError.assetLockInsufficientFunds` case with its arm in `init(code:message:)` (which `init(result:)` delegates to) and an `ErrorHandlingTests` pin, and Kotlin's typed `PlatformWallet.AssetLockInsufficientFunds` with the `29 ->` arm in `fromPlatformWalletNative` and a `DashSdkErrorTest` pin. **Rule 5 was satisfied only as of `15aa2caea1`, late in review.** Kotlin had mirrored 29 since the branch's binding commit `a711c55eca`; Swift carried none of rule 5's three edits until `15aa2caea1`, so 29 fell to `init(ffi:)`'s `default:` and lost its identity as `.errorUnknown` — the rule-5 failure this file exists to catch, one host typed and the other blind. Its Rust sibling `2eac8a897e` is what lets the code reach either host on the exact-amount funding path, which flattened the variant to `ErrorWalletOperation` (6) in `map_asset_lock_funding_result` before the blanket `From` arm could run |
+| 31 | `ErrorSigningKeyUnavailable` | Merged 2026-08-04 by **#4183** (merge commit `189a3abb1c`, stacked on #4191). The signer holds no usable private key for a requested public key. Landed complete in that one commit: the Rust C-facing discriminant, Swift's `errorSigningKeyUnavailable = 31` raw case *and* its `init(ffi:)` arm *and* the typed `PlatformWalletError` case with its `init(result:)` arm, and Kotlin's `31 -> PlatformWallet.SigningKeyUnavailable`. Rule 3 now protects it — see the 31-vs-33 note below |
+| 34 | `ErrorStaleReservationToken` | Merged 2026-08-06 by **#4308** (`438153da39`) — the reservation trio landed with the split build/broadcast surface (successor of fork-era #4185's claim) |
+| 35 | `ErrorReservationTokenConsumed` | Merged 2026-08-06 by **#4308** (`438153da39`) |
+| 36 | `ErrorReservationWalletMismatch` | Merged 2026-08-06 by **#4308** (`438153da39`) |
+| 37 | `ErrorDocumentNotForSale` | Merged 2026-08-09 by **#4348** (`6373e00f0c`). **Took the number the fork-era shielded-invite claim held** — see the proposed table's 37 note |
+| 38 | `ErrorDocumentPriceChanged` | Merged 2026-08-09 by **#4348** (`6373e00f0c`) |
+| 39 | `ErrorInsufficientIdentityCredits` | Merged 2026-08-09 by **#4348** (`6373e00f0c`) |
+| 40 | `ErrorContestedNameNotTradable` | Merged 2026-08-09 by **#4348** (`6373e00f0c`) |
+| 41 | `ErrorShieldedInsufficientBalance` | Merged 2026-08-11 by **#4360** (`e0b8baa850`) |
+| 42 | `ErrorMasternodeWithdrawalUnconfirmed` | Merged 2026-08-22 by **#4451** (masternode-credit claiming). **Took the number active #4356 had claimed** for `ErrorAssetLockInputConflict` — see the proposed table's 42 note; #4356 renumbers via the frontier |
+| 46 | `ErrorMasternodeListUnavailable` | Merged 2026-08-24 by **#4465** (`8dd964277`). Initially minted as 43 (already held by active #4313's `ErrorShieldedInviteAlreadyClaimed` across all three layers) — collision flagged in review and renumbered to the then-frontier same day, Rust and Swift together |
+| 98 | `NotFound` | Sentinel — `Option` returned as an error |
+| 99 | `ErrorUnknown` | Sentinel — unmapped/flattened errors |
+
+**Next allocatable integer: 50** — 27–49 are all claimed (27, 29, 31, 34–42
+and 46 merged; 43–45 proposed by active #4313 at head `0302b188ab`; 47
+proposed by active #4356 (renumbered from 42 — see its row below); 48–49
+proposed by active #3968 (the persister pair, renumbered from 42/43 on
+2026-08-27 — see its rows below); 28, 30,
+32 and 33 reserved). **28, 30,
+32 and 33 are RESERVED, not free**: 28 and 30 were vacated when the
+reservation trio moved to 34–36; 32 and 33 lapsed when their in-repo owners
+(#4310, #4311) closed without merging. All four are deliberately left
+unclaimed rather than back-filled, so no number is reused within a single
+review cycle. Rule 1's "do not reuse a gap unless this file marks it free"
+applies — this file does **not** mark any of them free, so the frontier is
+the only allocation source and a new code takes 50. (42 is a cautionary tale:
+merged #4451 minted it while active #4356 held the claim — merged ABI wins,
+the open PR renumbers. 46's near-miss went the other way: caught in review,
+renumbered before merge.)
+
+## Proposed allocations (open PRs)
+
+Not yet ABI. Numbers here may still move; they move by agreement recorded in
+this file.
+
+**Ownership migrated 2026-08-11, then largely settled the same week.** The
+fork-era PRs that originally held these allocations (#4184, #4185, #4204,
+plus #4247 and #4256) were closed and recreated in-repository per repo
+policy. Of the successors: #4308 **merged** (the trio, 34–36 — now in the
+merged table); three others — #4316, #4310 and #4311 — **closed without
+merging** (32 and 33 lapse to RESERVED; 29 passed to #4361, which **merged**
+on 2026-08-26 — it is in the merged table now, and 29 is ABI under rule 3);
+and #4313 (the shielded-invite claim) lost 37 to merged #4348, revived, and
+now holds 43–45 from the frontier at head `0302b188ab` — see its three rows
+below.
+Fork-era numbers remain in the collision history, which is immutable record.
+
+| Code | Name | Owning PR | Status |
+| ---: | --- | --- | --- |
+| 28 | *(reserved — vacated)* | — | Vacated by #4185/#4256 on 2026-08-02; RESERVED, not reissuable — the next-free frontier is the only allocation source |
+| 47 | `ErrorAssetLockInputConflict` | #4356 | Proposed — **47 is reserved for this active PR, but the three-layer renumber is still PENDING.** Merged #4451 took 42 for `ErrorMasternodeWithdrawalUnconfirmed` on 2026-08-22, and merged ABI wins. At the cited #4356 head `7d9be71a08`, Rust still defines and tests `ErrorAssetLockInputConflict = 42`, Swift still declares `errorAssetLockInputConflict = 42`, and Kotlin still maps and tests native 42 — #4356 must move all three layers and their tests together to 47 before it can merge. Rule 1 makes 47 unavailable to any other contributor while #4356 is active |
+| 48 | `ErrorPersisterTransient` | #3968 | Proposed — claimed from the frontier on 2026-08-27, in the same change that merged `v4.2-dev` into the branch. Replaces the non-conforming 42 (see below): merged #4451 owns 42, so the collision was a hard E0081 in #3968's own tree. Renumbered across all layers together — the Rust discriminant, its `result_code_discriminants_remain_stable` pin, Swift's `errorPersisterTransient` raw case, and its `ErrorHandlingTests` pin. Swift's other two rule-5 edits (the `init(ffi:)` arm and the typed `PlatformWalletError.persisterTransient` case with its `init(code:message:)` arm) were already present and are number-independent. No Kotlin mirror: the persister pair is host-agnostic and falls through to `PlatformWallet.Generic`, which preserves the integer |
+| 49 | `ErrorPersisterFatal` | #3968 | Proposed — claimed from the frontier on 2026-08-27 alongside 48. Replaces the non-conforming 43, which collided silently with active #4313's `ErrorShieldedInviteAlreadyClaimed = 43`; neither tree carried both variants, so only this file showed it. Same four-site renumber and the same rule-5/Kotlin notes as 48 |
+| 30 | *(reserved — vacated)* | — | Vacated by #4185/#4256 on 2026-08-02; RESERVED, not reissuable — the next-free frontier is the only allocation source |
+| 32 | *(reserved — lapsed)* | — | Owner #4310 (successor of fork-era #4247) closed without merging; RESERVED, not reissuable |
+| 33 | *(reserved — lapsed)* | — | Owner #4311 (successor of fork-era #4256) closed without merging; RESERVED, not reissuable |
+| 43 | `ErrorShieldedInviteAlreadyClaimed` | #4313 | In review — **ACTIVE; the former "on hold — holds no number" row is obsolete.** The branch revived and renumbered to the frontier exactly as that row prescribed. Lineage: fork-era #4204's 32 → 37 move, then 37 **taken by merged #4348** (`ErrorDocumentNotForSale = 37`, ABI since 2026-08-09), then 37 → 43 on revival. `ErrorShieldedInviteAlreadyClaimed = 43` at head `0302b188ab`. **Rule 5 is satisfied at that head**: Swift carries all three edits — the raw case, the `init(ffi:)` arm, and the typed `PlatformWalletError.shieldedInviteAlreadyClaimed` case with its arm in `init(code:message:)` (which `init(result:)` delegates to) — plus `errorDescription`; Kotlin has the typed terminal `PlatformWallet.ShieldedInviteAlreadyClaimed`, the `43 ->` arm in `fromPlatformWalletNative`, and a `DashSdkErrorTest` pin on 43. Swift's 43 mirror predates `0302b188ab` on the branch; the raw-value test pin for 43 is Kotlin's (Swift's `ErrorHandlingTests` pins 44 and 45 only) |
+| 44 | `ErrorShieldedScanBudgetExhausted` | #4313 | In review — claimed from the frontier; carries the #4306 scan-budget semantics (retryable — progress is checkpointed). **Rule 5 is satisfied as of `0302b188ab`, and was not before it.** At that commit's parent Kotlin already mirrored 44 (typed `ShieldedScanBudgetExhausted`, the `fromPlatformWalletNative` arm, a `DashSdkErrorTest` pin) while Swift carried none of rule 5's three edits, so 44 fell to `init(ffi:)`'s `default:` and lost its identity as `.errorUnknown` — one host typed, the other blind, the same failure shape as merged row 29's. `0302b188ab` adds the raw case, the `init(ffi:)` arm, the typed case with its `init(code:message:)` arm and `errorDescription`, and an `ErrorHandlingTests` pin of raw value 44 |
+| 45 | `ErrorShieldedLifecycleBusy` | #4313 | In review — claimed from the frontier. A shielded lifecycle operation refused because teardown/clear holds the wallet (retryable — nothing consumed); the FFI remove path passes the refusal through as 45 instead of flattening it to `ErrorWalletOperation` (6). Same rule-5 history as 44: Kotlin mirrored 45 at the parent commit already; Swift's three edits and an `ErrorHandlingTests` pin of raw value 45 landed in `0302b188ab`. **Rule 5 is satisfied at that head** |
+
+**Code 31 left this table on 2026-08-04.** `ErrorSigningKeyUnavailable` sat here
+as #4183's proposal until #4183 merged (`189a3abb1c`); it is now in the merged
+table above and rule 3 applies to it in full. It has since had company: the
+reservation trio (34–36, #4308) and the 37–41 block (#4348, #4360) also
+merged out of proposal — see the merged table, and take the current
+frontier only from the frontier note above (46 as of 2026-08-19).
+
+PRs that touch `rs-platform-wallet-ffi` but claim **no** new code, verified
+2026-08-04 against each PR's file list and the `error.rs` at its head (a
+fork-era snapshot; #4186, #4194 and #4195 have since been closed and
+recreated in-repository, carrying the same no-code property, while #4243
+remains open at its fork-era head):
+`#3417`, `#3549`, `#3992`, `#4186`, `#4194`, `#4195`, `#4243`.
+
+Five entries this list used to carry have been removed, each for a stated
+reason, so they are not silently re-added:
+
+| Was listed | Why it is gone |
+| --- | --- |
+| `#4240` | Its head touches no file under `rs-platform-wallet-ffi` at all — still true at `a167afe84c` |
+| `#4251` | Was listed as touching no file under this crate; **merged into `v4.2-dev` on 2026-08-04** (`7afc8a8ff3`) having touched none, so nothing here changes |
+| `#4258` | Merged into `v4.2-dev` on 2026-08-03 (`ce8233edb7`); it claimed no code, so the merged table is unchanged |
+| `#4264` | Closed. Its `error.rs` change (mapping new wallet errors onto the existing `ErrorInvalidParameter`) is carried by `#4243`, which is still open and is listed above |
+| `#4191` | **Merged into `v4.2-dev` on 2026-08-04** (`0e2282b586`). In this crate it only ever touched `dashpay.rs`; it claimed no code, so the merged table gained nothing from it — though #4183, which was stacked on it, did |
+
+`#4186`, `#4194`, `#4195` and `#4243` are worth naming explicitly: each *does*
+modify `error.rs`, but none of them adds a discriminant — `#4243`'s change maps
+new wallet errors onto the **existing** `ErrorInvalidParameter`. Touching
+`error.rs` is not the same as claiming an integer, and this list tracks the
+latter.
+
+**`#4277` is the merged precedent for that distinction.** It merged into
+`v4.2-dev` on 2026-08-04 (`6704a41a85`) with a change to this crate's
+`error.rs`, and it claimed no integer: it routes
+`PlatformWalletError::TxMetadataPayloadTooLarge` onto the existing
+`ErrorInvalidParameter`, with an in-line comment saying it does so deliberately
+"so no new numeric code churns the Swift/Kotlin mirror enums". The merged table
+is unchanged by it.
+
+The **inherited-code table** has been reduced to one row and retained for
+provenance:
+
+| Code | Name | Carried by | Allocated to |
+| ---: | --- | --- | --- |
+| 31 | `ErrorSigningKeyUnavailable` | #4204, #4259 | #4183 |
+
+`#4183` merged on 2026-08-04, so 31 is no longer an allocation anyone can inherit
+— it is trunk. Every branch that has rebased onto current `v4.2-dev` carries it
+from the base, which is not a claim and cannot be double-counted. Verified
+2026-08-04 at the heads of #4184, #4185, #4186, #4194, #4195, #4196, #4204,
+`#4240`, #4247, #4256 and #4259: all eleven show `ErrorSigningKeyUnavailable = 31`
+inherited from the merged base.
+
+PR `#4196` also claims no new integer: it adds a token-less
+`PlatformWalletError::StaleReservation` variant and deliberately routes it
+through the **existing** `ErrorStaleReservationToken`, so it allocates nothing
+and only has to follow that code's number. As of 2026-08-04 (head `9909f77546`)
+it is restacked onto #4185 and follows 34 (see below).
+
+### Non-conforming allocations (withdraw and reissue)
+
+These branches allocate below the frontier without a row here. They are listed
+here rather than in the proposed table because their numbers cannot stand as
+written — each row is a claim to be **withdrawn and reissued**, not an
+allocation of record.
+
+**#3968's branch state, re-read 2026-08-26 at its current head
+`396977be4e7c`.** The stale-base half of its old defect is cured: the branch
+merged `v4.2-dev` in on 2026-08-20 (merge commit `9d0dd5a49d`) and again on
+2026-08-25 (`c86d237117`, `4dbf38f5da`), so `ErrorTransactionBroadcastRejected`
+is back on its merged-ABI 26, `ErrorShutdownIncomplete = 27` comes in from the
+base, and the rule-3 renumber (26 → 28) this table used to record is gone.
+But the 2026-08-20 merge also renumbered the two persister codes to **42 and
+43** — below the frontier, with no row here (rule 2), and onto numbers this
+file records as taken. This file's earlier prediction stands
+half-vindicated: rebasing cured what the base could cure, and the enum edit
+that was always required was made — onto the wrong integers.
+
+| Code | Name | Owning PR | Conflict |
+| ---: | --- | --- | --- |
+| 42 | `ErrorPersisterTransient` | #3968 | **RESOLVED 2026-08-27 — withdrawn and reissued as 48.** Contradicted **merged ABI**: 42 is #4451's `ErrorMasternodeWithdrawalUnconfirmed` (merged 2026-08-22). Not a paper conflict — after the 2026-08-25 base merges #3968's **own tree** carried both variants, a hard E0081 in `error.rs` (`= 42` at both) plus a duplicate raw value 42 in Swift's `PlatformWalletResultCode`, so the branch did not compile as-is. Cleared when the branch next merged `v4.2-dev`, in the same change that imported this file |
+| 43 | `ErrorPersisterFatal` | #3968 | **RESOLVED 2026-08-27 — withdrawn and reissued as 49.** Collided with **active #4313**, whose recorded claim is `ErrorShieldedInviteAlreadyClaimed = 43`. The silent shape: nothing conflicted textually and neither tree carried both variants, so only this file showed it — which is how it was caught |
+
+PR `#3954`'s `ErrorShutdownIncomplete = 27` used to sit in this table. It is
+gone because that claim **won**: #3954 was closed and superseded by **#4268**,
+which merged 27 into `v4.2-dev` on 2026-08-02. See the collision history below.
+
+The 42 is the instructive half, because its timeline shows why "check the
+table on the day you allocate" is not enough. When `9d0dd5a49d` minted
+`ErrorPersisterTransient = 42` on 2026-08-20, 42 was not yet merged ABI — it
+was **#4356's recorded claim** in this file's proposed table, so the mint
+violated rule 1 against a *proposed* allocation. Two days later #4451 merged
+42 as `ErrorMasternodeWithdrawalUnconfirmed` and it became unrenumberable ABI
+(the same event that pushed #4356 to 47); three days after that, #3968's own
+base merges imported the merged variant and turned the paper conflict into an
+E0081 in its own tree. A registry row filed with the mint (rule 2) would have
+been challenged on day one. Both persister codes must now take fresh integers
+**from the frontier note above, which is the single canonical source; no
+number is copied here because any copy goes stale the moment another PR
+merges** (as the original "46+" copy in this paragraph did when #4465 shipped
+46). That is what happened: on 2026-08-27 the pair took **48 and 49** from the
+frontier, and the claim is recorded in the proposed table and the frontier
+note above. 26 and
+27 need nothing: they are the merged base's own values, correctly inherited,
+and rule 3 keeps them where they are.
+
+## Contested and pending
+
+### 32 — RESOLVED: #4204 moved to 37 (first collision this file actually caught)
+
+Found 2026-08-03 while assembling the `v41int13` QA integration. #4204's head
+commit `b6992a5dbc` — a review round, not the original feature work — added
+`ErrorShieldedInviteAlreadyClaimed = 32` with **no row in this file**, in
+direct violation of rule 2. 32 is allocated to `ErrorTransactionBuild` (#4247,
+also carried by #4256).
+
+Unlike every other entry in this section, this one was not a paper conflict:
+merging #4204 into an integration that already carried
+`ErrorTransactionBuild = 32` produced a hard
+`error[E0081]: discriminant value 32 assigned more than once`. Resolution of
+record: **#4204 moves 32 → 37**, the frontier. `ErrorTransactionBuild` keeps 32.
+
+The numbering was the lesser half of the defect. The code was **unmirrored on
+both hosts** — absent from Swift's `PlatformWalletResultCode` and from Kotlin's
+`fromPlatformWalletNative`. Per rule 5 that means Swift rendered it
+`.errorUnknown` (identity lost), while Kotlin fell through to `Generic(32, …)`
+— and in any tree also carrying the competing #4247 mapping for 32, Kotlin
+actively **misclassified** "shielded invite already claimed" as "transaction
+build failed". `ErrorReservationWalletMismatch` was never the peer here: its
+allocation history runs 26/28 → 30 → 36 and never passes through 32.
+
+The three host outcomes therefore differ, and only the third is a
+misclassification: Swift loses the code's identity as `.errorUnknown`, Kotlin
+on #4204 alone preserves `Generic(32, …)`, and Kotlin misclassifies only where
+the competing code-32 mapping is also present. That is the cross-host ABI
+failure this file's preamble describes, and it landed on the shielded-invite
+claim-recovery path (the error is raised from four sites in
+`wallet/shielded/operations.rs`, three of them inside the recovery function).
+
+Fixed on #4204 together with the renumber. Landed at head
+`d78b940a03`: the typed Kotlin
+`PlatformWallet.ShieldedInviteAlreadyClaimed` (terminal, `isRetryable = false`),
+the Swift `PlatformWalletResultCode.errorShieldedInviteAlreadyClaimed = 37` raw
+case with its `init(ffi:)` arm, and a `DashSdkErrorTest` assertion that pins 37
+so a future move off the frontier fails the suite instead of the hosts.
+
+The Swift half of that fix was **incomplete at `d78b940a03`, and is complete
+now.** At that head `PlatformWalletError` had no `.shieldedInviteAlreadyClaimed`
+case even though `init(result:)` switches exhaustively over
+`PlatformWalletResultCode` with no `default:` — adding the raw case without the
+matching arm makes that switch non-exhaustive, so the Swift package did not
+build. **Closed since.** Verified 2026-08-04 at #4204's current head
+`4efecd5b71`: the raw case, its `init(ffi:)` arm, the typed
+`PlatformWalletError.shieldedInviteAlreadyClaimed` case and its `init(result:)`
+arm are all present. Rule 5's Swift clause is satisfied. Kept here because the
+sequence is the lesson — one of rule 5's three Swift edits landed a full review
+round after the other two.
+
+**Lesson for rule 2:** the violation entered on a *review-round* commit, well
+after the PR's numbering had been reviewed and recorded as settled. Re-check
+discriminants on every push that touches `error.rs`, not only at first review.
+
+### 29 — RESOLVED: #4184 keeps 29 (#4185 moved away, twice)
+
+Both PR heads defined code 29. Resolution of record: **#4184 keeps
+`29 = ErrorAssetLockInsufficientFunds`; #4185 moves `ErrorReservationWalletMismatch`
+to 30.**
+
+**#4184's 29 is settled and has not moved.** #4185's third code moved to 30 to
+clear it, and then — with the rest of the trio — to **36** when #4268 merged 27
+(see the collision history above), which is why 30 is reserved rather than
+free. Nothing about this section's resolution changed: 29 is #4184's.
+
+Note that neither #4184 nor #4256 was ever blocked by CI on this. Both are
+MERGEABLE with green checks, because two branches assigning the same
+discriminant produce no textual conflict — the collision surfaces only as an
+E0081 after a textual merge, or silently as a wrong error code on the host.
+That is the whole reason this file exists.
+
+**#4196 closed out 2026-08-03** — restacked onto the trio at 34/35/36 (see
+"26 — RESOLVED" below); nothing remains outstanding from this collision.
+
+### 30 — vacated, then RESERVED (not free)
+
+`ErrorAssetLockCrossDomainConsentRequired` was named as the holder of 30 in
+in-tree comments on #4183 and #4204, and in #4256's pre-renumber numbering
+rationale. It is **not defined anywhere** — #4184, the PR that would have
+introduced it, does not contain it after a re-scope. Those comments are all gone
+now: grepping `packages` at `v4.2-dev` `97904ed2fc` on 2026-08-04 returns no
+occurrence of the name, and neither does #4204's head `4efecd5b71`.
+
+Verified 2026-08-01 by reading `packages/rs-platform-wallet-ffi/src/error.rs` at
+the head of **every one of the 62 open PRs**. Stated precisely, because the
+unqualified version of this sentence is false: **no PR unrelated to #4185
+defines a code 30.** #4185 itself, and #4256 downstream of it, did define
+`ErrorReservationWalletMismatch = 30` at their surveyed heads — that was the
+allocation, not a competing claim. So nothing contested 30, #4185's claim stood,
+and the stale consent-code reservation never conflicted with it.
+
+PR #4185 then vacated 30 on 2026-08-02 when the trio moved to 34–36. Vacating
+is not the same as freeing: **30 is now RESERVED and must not be reissued** (see
+the collision history below for why). The stale "reserved for the consent code"
+comments should be dropped by whichever PR touches them next.
+
+Three branches have now done so:
+
+* **#4256** — as of `8febac177c` its `ErrorTransactionSigning` rationale names
+  #4268 as the owner of 27 and records where the trio went.
+* **#4183** — its enum comment no longer describes 27–28 as reserved for the
+  trio; on the 2026-08-03 rebase it was rewritten to say 28 and 30 are reserved
+  and 29 belongs to #4184, and to point here. **#4183 merged on 2026-08-04**, so
+  that corrected comment is now the in-tree text at `v4.2-dev` — the reservation
+  of 28 and 30 and #4184's claim on 29 are recorded in `error.rs` itself, not
+  only here.
+* **#4184** — same rebase, same correction. Its note used to read "Codes 27-28
+  are reserved" while naming **three** codes, which was correct only while the
+  trio sat at 27/28/29. It now says 28 is skipped, 28 and 30 are reserved, and
+  the trio is at 34–36. The discriminant itself
+  (`ErrorAssetLockInsufficientFunds = 29`) never moved and remains the
+  resolution of record.
+
+The equivalent stale comment on **#4204** is gone too. It was not fixed by hand:
+`#4204` rebased onto the merged base, and its `error.rs` at `4efecd5b71` now
+carried #4183's corrected 28/29/30 note verbatim from trunk. All four branches
+that ever held the stale reservation text — #4256, #4183, #4184, #4204 — were
+clear at those surveyed heads, and #4183's version of the note became trunk.
+
+**The stale wording has since RETURNED to trunk.** Merged #4308
+(`438153da39`) introduced allocation comments that call 28 and 30 *free* —
+`error.rs` ("28 (free — vacated by this PR)", "30 (free — …)", "28 and 30 are
+nominally free") and the Swift mirror ("28 and 30 are free") — contradicting
+rule 1 and the primary table, which RESERVE both values. Until a follow-up
+corrects those in-tree comments, this registry is the authority: 28 and 30
+are reserved, not allocatable.
+
+### 27 / 28 — #3968's original collision, since moved to 42 / 43; #3954's claim merged as #4268
+
+Found by the same 2026-08-01 sweep. #3968's live rows — now at 42 and 43 —
+are in **Non-conforming allocations** above; #3954's story is there too, and
+the inherited-code table covers #4259. The detail below is the 2026-08-01
+record of the original 26 / 27 / 28 layout, kept because the branch's later
+history (see the closing paragraph) repeated the same mistake against a fresh
+pair of numbers:
+
+* **#3968** (`5931df745a`) numbers `ErrorPersisterTransient = 26`,
+  `ErrorPersisterFatal = 27`, `ErrorTransactionBroadcastRejected = 28`. It
+  branched before `26 = ErrorTransactionBroadcastRejected` merged, so it both
+  contradicts merged ABI at 26 **and** collides with #4185 at 27 and 28.
+
+  The 28 is the more serious half and is easy to miss, because it does not look
+  like an allocation at all: #3968 is not claiming 28 for something new, it is
+  *moving a code that has already shipped* out of the way of its own 26. Rule 3
+  forbids that outright. A host compiled against merged ABI returns 26 for a
+  broadcast rejection; after #3968 the same condition returns 28, and 26 means
+  a transient persister failure. Nothing in either branch's diff shows the
+  contradiction. #3968 must leave 26 alone and take fresh integers for both
+  persister codes.
+* **#3954** (`93d0bd49b7`) numbered `ErrorShutdownIncomplete = 27`. This file
+  previously called that a proposed-vs-proposed collision and said #4185's older
+  claim should stand. **That was wrong, and it resolved the other way.** #3954
+  was closed; its work landed as **#4268**, which merged 27 into `v4.2-dev` on
+  2026-08-02. #4185 and #4256 moved their trio to 34–36 in response. Merging
+  decides an ABI number; being the older open claim does not.
+* **#4259** carries `ErrorSigningKeyUnavailable = 31` — the same number and name
+  as #4183, i.e. inherited rather than a new allocation, like #4204. No
+  conflict; recorded so the number is not double-counted. This is now moot:
+  #4183 merged on 2026-08-04, so at #4259's current head `5b77dfd8f1` the 31 is
+  simply the merged base's, and there is no second claim to reconcile.
+
+That 26 / 27 / 28 layout is now history, resolved the only way half of it
+could be: by the branch merging its base. At head `396977be4e7c`
+(re-read 2026-08-26) the 2026-08-20 merge `9d0dd5a49d` and the 2026-08-25
+follow-ups have `ErrorTransactionBroadcastRejected` back on 26,
+`ErrorShutdownIncomplete = 27` inherited from trunk, and the rule-3 renumber
+gone. But the same 2026-08-20 merge moved the persister pair to
+`ErrorPersisterTransient = 42` / `ErrorPersisterFatal = 43` — numbers already
+spoken for: 42 was the recorded claim of #4356 (since merged out from under
+it by #4451) and 43 was held in-tree by #4313. So the branch now collides at
+42 (hard:
+E0081 plus a duplicate Swift raw value in its own tree, since the 08-25 base
+merges imported merged 42) and at 43 (silent, against an active proposal).
+The full account, timeline included, is in **Non-conforming allocations**
+above. Both debts were settled on 2026-08-27: the pair took 48 and 49 from the
+frontier and filed its rows under rule 2, in the same change that merged
+`v4.2-dev` into the branch.
+
+### 26 — RESOLVED: #4196 restacked onto #4185 and is on 34 / 35 / 36
+
+**Closed out 2026-08-03.** PR #4196 (stacked on #4185) branched before
+`26 = ErrorTransactionBroadcastRejected` merged, and for most of this file's
+life its head still numbered the reservation trio **26 / 27 / 28** — two moves
+behind, in a state where merging it would have given 26 two meanings, given 27
+two meanings against #4268's merged `ErrorShutdownIncomplete`, and contradicted
+the **34 / 35 / 36** of #4185 for the same three names.
+
+That is no longer the case. At head `12492e8c54` the restack is done:
+`ErrorStaleReservationToken = 34`, `ErrorReservationTokenConsumed = 35`,
+`ErrorReservationWalletMismatch = 36`, `ErrorShutdownIncomplete = 27` present
+from the merged base, #4185's head `8813e98533` is an ancestor, and the PR is
+MERGEABLE against `v4.2-dev`. It still allocates no integer of its own.
+
+The numeric references #4196 owns were carried along with it. Verified at
+`12492e8c54`:
+
+* `DashSdkError.kt` — the `StaleReservationToken` KDoc reads "native code 34",
+  and `fromPlatformWalletNative` maps `34 -> PlatformWallet.StaleReservationToken`.
+* `ManagedCoreWallet.kt` — its V2 broadcast KDoc reads "native code 34, shared
+  with the deferred-token surface"; the remaining mentions are symbolic
+  `[StaleReservationToken]` links carrying no number.
+* `PlatformWalletError::StaleReservation` — refers to the FFI code symbolically
+  and has never contained a number, so it needed no update.
+
+**Kept for the record, because the delay was the interesting part.** The restack
+was not mechanical. Rebasing the three commits #4196 owned onto #4185's head
+conflicted in three files (10 hunks): `error.rs` (3),
+`wallet/core/broadcast.rs` (1), `wallet/signed_payment_registry.rs` (6). Only
+the `error.rs` hunks were mechanical, because #4185 had redesigned the registry
+underneath #4196 after it branched:
+
+* `registered_height` changed from `Option<u32>` to a mandatory `u32`, and
+  #4196's age guard was built around the `None` case meaning "guard disabled".
+* #4185 added a `SignedPaymentError::WalletRemoved` variant and an
+  owner-stamped `funding_reservation_token` field, both of which #4196 predated.
+* #4196 wanted to *move* `RESERVATION_MAX_AGE_BLOCKS` and `reservation_expired`
+  into `wallet/reservations.rs`; #4185 had since rewritten both in place.
+* #4196's V2 guard documented "leave the stale reservation for the TTL rather
+  than release by outpoint", while #4185 now releases by owner-guarded *token*.
+
+Re-deriving the age guard against the new registry shape was author work, not
+conflict resolution — which is why this sat for as long as it did rather than
+being forced through by whoever was maintaining this file.
+
+### 31 vs 33 — two signing-related codes, deliberately distinct
+
+Review on #4256 suggested mapping its signing failure onto 31. #4256 declined and
+took 33, on the grounds that 31 (`ErrorSigningKeyUnavailable`, #4183) asserts a
+specific contract — the signer holds no usable private key for a requested public
+key, restored from a typed signer completion code — whereas #4256's
+`BuilderError::SigningFailed` also covers unresolved derivation paths, sighash
+failures, and malformed signature encodings.
+
+**That question is now fully settled — by merging and by closure, not by
+agreement.** #4183 merged on 2026-08-04, so **31 is ABI** and rule 3 forbids
+renumbering or retiring it; it ships with complete Swift and Kotlin mirrors.
+The other side of the decision died with its owners: #4256 closed unmerged on
+2026-08-06 and its in-repository successor #4311 closed unmerged on
+2026-08-10, so no open PR holds the `BuilderError::SigningFailed` mapping and
+33 sits RESERVED in the allocation table above. A future PR that revives that
+mapping chooses fresh: route onto the existing 31 where the contract fits, or
+claim a new code from the frontier — 33 itself is not reissuable.
+
+## Collision history — the 27 / 28 / 30 → 34 / 35 / 36 move
+
+Recorded because the reservation trio has now been renumbered three times, and
+because the reason it kept moving is the failure mode this file exists to catch.
+
+| When | Trio numbering | Why it moved |
+| --- | --- | --- |
+| original (#4185, #4196) | 26 / 27 / 28 | — |
+| 2026-07 | 27 / 28 / 30 | `26 = ErrorTransactionBroadcastRejected` merged (`9302c62e8b`); 29 went to #4184 by agreement, so the third code took 30 |
+| **2026-08-02** | **34 / 35 / 36** | **#4268 merged `ErrorShutdownIncomplete = 27` into the `v4.2-dev` ABI** |
+
+The third move is the instructive one. On 2026-08-01 this file recorded
+the `ErrorShutdownIncomplete = 27` of #3954 as a *non-conforming* claim that
+had to be withdrawn, on the reasoning that #4185's 27 was the older claim and
+should stand. That reasoning was wrong in the only way that matters: seniority among
+open PRs does not decide an ABI number — **merging does**. #3954 was closed and
+its work landed as #4268, which merged 27 first. An unmerged claim, however old,
+has no standing against merged ABI (rule 3, read from the other side).
+
+So the trio moved again, and this time it moved **above every number claimed by
+anything** — merged or proposed — rather than into the next free gap:
+
+* 27 `ErrorShutdownIncomplete` (merged, #4268)
+* 29 `ErrorAssetLockInsufficientFunds` (#4184)
+* 31 `ErrorSigningKeyUnavailable` (**merged 2026-08-04, #4183**; was proposed when the trio jumped it)
+* 32 `ErrorTransactionBuild` (#4247/#4256)
+* 33 `ErrorTransactionSigning` (#4256)
+
+Two of those five are now shipped ABI rather than proposals: 27 already was when
+the trio moved, and 31 has merged since. That is the argument for the move made
+retroactively — a number that looked merely "claimed by an open PR" on
+2026-08-02 is unrenumberable ABI two days later, and anything sitting on it
+would now be stuck there.
+
+Taking 34–36 rather than back-filling the vacated 28 and 30 costs two integers
+in a space that is nowhere near exhausted, and buys two things: the trio reads
+as one contiguous family, and it cannot be hit again by anything currently in
+flight. **28 and 30 are therefore RESERVED, not free.** Do not reissue them in
+this review cycle — a reviewer who saw the earlier numbering would otherwise
+find a familiar number attached to an unfamiliar meaning. Rule 1 only permits
+reusing a gap this file marks free, and this file marks neither of them free.
+
+The move landed on both branches on 2026-08-02: **#4185** (`3dec774929`) and
+**#4256** (`8febac177c`), each across the Rust enum discriminants and every
+rustdoc cross-reference, the two `signed_payment.rs` doc references, the JNI
+rustdoc (`rs-unified-sdk-jni/src/wallet_manager.rs`), the Swift
+`PlatformWalletResultCode` raw values, and Kotlin's `fromPlatformWalletNative`
+branches, class KDoc, `WalletManagerNative.kt` KDoc and the `DashSdkErrorTest`
+offset assertions. Both `switch`es in Swift are symbolic — `init(ffi:)` matches
+cbindgen `PLATFORM_WALLET_FFI_RESULT_CODE_*` constants — so only the enum's raw
+values carried a number there.
+
+Neither branch's CI could have caught the collision, for the reason given at the
+top of this file: a duplicate integer across two branches produces no textual
+conflict, and neither branch's tree contains both variants, so neither
+compiler ever sees the E0081. Both were MERGEABLE and green throughout.
+
+### Mirror gap on #4256 — CLOSED (was never a numbering issue)
+
+Noted while grepping the mirrors for this move: #4256 declared
+`ErrorTransactionBuild = 32` and `ErrorTransactionSigning = 33` in Rust and
+mapped both in Kotlin, but its Swift `PlatformWalletResultCode` declared
+**neither** — no `case`, and no arm in `init(ffi:)`, so both fell into that
+switch's `default:` and would have reached Swift hosts as `.errorUnknown`,
+losing their identity. That is rule 5's Swift clause. It was left for #4256's
+author rather than folded into the renumber, since it was a missing mirror and
+not a wrong number.
+
+**Fixed.** Verified 2026-08-04 at #4256's head `862036b18d`:
+`errorTransactionBuild = 32` and `errorTransactionSigning = 33` raw cases, both
+`init(ffi:)` arms, the typed `PlatformWalletError.transactionBuild` /
+`.transactionSigning` cases and their `init(result:)` arms are all present. Both
+of this file's outstanding Swift mirror gaps — this one and #4204's — closed
+between the 2026-08-03 and 2026-08-04 passes.
+
+## Sibling FFI crates
+
+`rs-sdk-ffi`'s `DashSDKErrorCode` (`packages/rs-sdk-ffi/src/error.rs`) is a
+**separate** integer space (0–10, plus `InternalError = 99`) and is not contested
+by any of the PRs above — none of them modify it. Do not assume a number means
+the same thing in both enums.
+
+## Survey provenance
+
+Compiled 2026-08-01 against `v4.2-dev` at `ed4116b26c`, re-verified 2026-08-02
+against `v4.2-dev` at `5d68612a45` (where `ErrorShutdownIncomplete = 27`,
+PR #4268 `429667e723`, entered the merged table), re-verified 2026-08-03 against
+that same base, and **re-verified again 2026-08-04 against `v4.2-dev` at
+`97904ed2fc`** (the head on that date; the branch has advanced substantially
+since — this whole section is the dated survey, and its merged/frontier
+conclusions are superseded by the merged table and frontier note above).
+
+The base moved on 2026-08-04, which is what made that pass necessary: four PRs
+merged into `v4.2-dev` that day — **#4191** (`0e2282b586`), **#4183**
+(`189a3abb1c`), **#4277** (`6704a41a85`) and **#4251** (`7afc8a8ff3`) — and one
+of them, #4183, moved a number out of this file's proposed table and into the
+ABI. Each of those four SHAs is the **merge commit on `v4.2-dev`**, confirmed by
+`git merge-base --is-ancestor` against `97904ed2fc`, not a PR head SHA.
+
+The 2026-08-04 pass re-read the discriminants directly, in-tree and at the
+*current* head of every open PR that touches `error.rs`, `DashSdkError.kt` or
+`PlatformWalletResult.swift`, and separately re-checked each PR's file list. It
+confirmed — a **2026-08-04 verification snapshot, retained as record** (the
+merged table and frontier note above are the current state; 34–41 have merged
+since and the frontier has moved on — see the frontier note):
+
+* in-tree at `97904ed2fc`, `error.rs` runs 0–27 contiguously and then **31**,
+  with 28, 29, 30 and everything from 32 up absent. So 31 is the only number
+  this file had listed as proposed that is now merged, and the frontier is
+  unchanged at 38;
+* `31 = ErrorSigningKeyUnavailable` has **complete** host mirrors on `v4.2-dev`
+  — Swift's raw case, its `init(ffi:)` arm, the typed `PlatformWalletError` case
+  and its `init(result:)` arm, and Kotlin's
+  `31 -> PlatformWallet.SigningKeyUnavailable` — all introduced by
+  `189a3abb1c` itself, so rule 5 was satisfied in the merging commit;
+* 29 is still #4184's; 32 and 33 are still #4247/#4256's, which is why the trio
+  sits at 34–36; 37 is still #4204's;
+* nothing in flight has taken 28, 30, or 38;
+* #3968 is unchanged and still numbers 26 / 27 / 28;
+* the two Swift mirror gaps this file was tracking — #4204's typed-case gap and
+  #4256's missing raw cases — have both been closed.
+
+PR heads of record — a **historical snapshot, read 2026-08-04 (fork era)**
+and retained as record. Most non-merged PRs below have since been closed and,
+where still needed, recreated in-repository (see the migration note above) —
+the exceptions being **#3968 and #4243, which GitHub still reports OPEN** (each
+row notes its live status):
+
+| PR | Head | Note |
+| --- | --- | --- |
+| #3954 | `31e22d5a90` | Closed; superseded by #4268 |
+| #3968 | `5931df745a` | Head unchanged since 2026-08-03; still numbers 26 / 27 / 28. Contains base `ed4116b26c` but not `5d68612a45`, and so not `97904ed2fc` either |
+| #4183 | `189a3abb1c` | **Merged 2026-08-04** (merge commit); 31 is now ABI |
+| #4184 | `11c3677b1c` | Keeps 29 |
+| #4185 | `326cd3eab6` | Trio at 34/35/36 |
+| #4186 | `1fcdfd6b37` | Modifies `error.rs`; adds no discriminant |
+| #4191 | `0e2282b586` | **Merged 2026-08-04** (merge commit); claimed no code |
+| #4194 | `560f66a31d` | Modifies `error.rs`; adds no discriminant |
+| #4195 | `7d20a638e5` | Modifies `error.rs`; adds no discriminant |
+| #4196 | `9909f77546` | Restacked onto #4185; trio 34/35/36; allocates nothing of its own |
+| #4204 | `4efecd5b71` | 37; rebased onto the merged base, so it now carries 27 and 31 from trunk; Swift mirror complete |
+| #4240 | `a167afe84c` | No file under this crate |
+| #4243 | `f4be5b32f0` | Head unchanged; modifies `error.rs`, claims no integer |
+| #4247 | `8541073247` | 32, plus #4185's trio |
+| #4251 | `7afc8a8ff3` | **Merged 2026-08-04** (merge commit); no file under this crate |
+| #4256 | `862036b18d` | 32 / 33 plus the trio; Swift mirror now complete |
+| #4258 | `ce8233edb7` | Merged 2026-08-03; claimed no code |
+| #4259 | `5b77dfd8f1` | Carries 31 from the merged base |
+| #4264 | `bf88c92b85` | Closed; work carried by #4243 |
+| #4277 | `6704a41a85` | **Merged 2026-08-04** (merge commit); modifies `error.rs`, claims no integer |
+
+Rows describing open PRs reflect those heads and go stale as the PRs are
+updated; the merged table does not.
+
+That churn is the point of dating the table. An earlier revision of this list
+carried `#4185 0b0d5c76d6 (post-renumber)`, which was wrong twice over:
+`0b0d5c76d6` is the *parent* of the renumber commit `d854debb`, so it was
+pre-renumber, and the branch had already moved on. Every head above was read
+from GitHub on the date given, not copied forward from a previous revision of
+this file, and the claims attributed to #3968, #3954, #4204 and #4259 were
+confirmed by reading `error.rs` at each of those heads directly.
diff --git a/packages/rs-platform-wallet-ffi/README.md b/packages/rs-platform-wallet-ffi/README.md
index 7a94d2a01f9..2380c9a1529 100644
--- a/packages/rs-platform-wallet-ffi/README.md
+++ b/packages/rs-platform-wallet-ffi/README.md
@@ -175,6 +175,12 @@ Error codes:
 - `PLATFORM_WALLET_FFI_ERROR_CONTACT_NOT_FOUND` - Contact not found
 - And more...
 
+The result codes are **public ABI**: their integer values are consumed by the
+generated C header and mirrored by the Swift and Kotlin SDKs. Before adding a
+new code, read [ERROR_CODE_REGISTRY.md](ERROR_CODE_REGISTRY.md) — it holds the
+authoritative integer→name allocation, the rule for claiming the next free
+value, and the currently contested allocations across open PRs.
+
 ## Testing
 
 Run the test suite:
diff --git a/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs b/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
index 57e1e044c84..462d5c2bdd1 100644
--- a/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
+++ b/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
@@ -916,7 +916,14 @@ fn transaction_type_to_u8(
 /// [`MasternodeRecord`], built by [`masternode_entry_ffi`] and
 /// returned by `platform_wallet_manager_list_masternodes`. Inline
 /// fixed-size hashes with `has_*` gates (mirroring `TransactionRecordFFI`)
-/// keep heap ownership to the three C strings.
+/// keep heap ownership to the C strings.
+///
+/// # ABI stability
+///
+/// This is the original, frozen layout returned by the unversioned
+/// `platform_wallet_manager_list_masternodes` entry point. Do not add, remove,
+/// or reorder fields. New projections belong in a versioned wrapper such as
+/// [`MasternodeEntryV2FFI`].
 #[repr(C)]
 pub struct MasternodeEntryFFI {
     /// proTxHash (32 wire bytes) — group key; also the registration txid.
@@ -994,12 +1001,6 @@ pub struct MasternodeEntryFFI {
     pub platform_in_wallet: bool,
     pub platform_account_type: u8,
     pub platform_key_index: u32,
-    /// Where this record came from: 0 = one of the wallet's own masternodes
-    /// (aggregated from its provider transactions), 1 = tracked by the user
-    /// independently of every wallet.
-    pub source: u8,
-    /// User label of a tracked masternode, or null.
-    pub label: *mut c_char,
     /// Whether the platform-node ownership check was actually *possible* for
     /// this query: `true` when the wallet's derived platform-node index had
     /// entries to compare against, `false` when it was empty/unavailable (no
@@ -1011,6 +1012,20 @@ pub struct MasternodeEntryFFI {
     pub platform_ownership_checked: bool,
 }
 
+/// Version 2 masternode projection. The frozen V1 entry remains the first
+/// field, preserving one canonical definition for all established fields;
+/// V2 adds record provenance and the optional tracked-node label.
+#[repr(C)]
+pub struct MasternodeEntryV2FFI {
+    pub v1: MasternodeEntryFFI,
+    /// Where this record came from: 0 = one of the wallet's own masternodes
+    /// (aggregated from its provider transactions), 1 = tracked by the user
+    /// independently of every wallet.
+    pub source: u8,
+    /// User label of a tracked masternode, or null.
+    pub label: *mut c_char,
+}
+
 /// Encode a hash160 as a network-specific base58 P2PKH address string
 /// (heap C string), or null on the (impossible-for-a-valid-hash) CString
 /// interior-nul error.
@@ -1138,14 +1153,26 @@ pub(crate) fn masternode_entry_ffi(
         platform_in_wallet,
         platform_account_type,
         platform_key_index,
+        platform_ownership_checked: mn.platform_ownership_checked,
+    }
+}
+
+/// Flatten one record into the additive V2 C-ABI entry.
+pub(crate) fn masternode_entry_v2_ffi(
+    mn: &MasternodeRecord,
+    network: dashcore::Network,
+) -> MasternodeEntryV2FFI {
+    use std::ffi::CString;
+
+    MasternodeEntryV2FFI {
+        v1: masternode_entry_ffi(mn, network),
         source: mn.source.as_u8(),
         label: mn
             .label
             .clone()
-            .and_then(|l| CString::new(l).ok())
+            .and_then(|label| CString::new(label).ok())
             .map(CString::into_raw)
             .unwrap_or(std::ptr::null_mut()),
-        platform_ownership_checked: mn.platform_ownership_checked,
     }
 }
 
@@ -1491,4 +1518,97 @@ mod tests {
         let entries = Box::into_raw(vec![entry].into_boxed_slice()) as *mut MasternodeEntryFFI;
         unsafe { crate::wallet::platform_wallet_manager_free_masternodes(entries, 1) };
     }
+
+    /// Pin the original array element layout used by already-built C/Swift
+    /// consumers. A field addition or reorder here is an ABI break even when
+    /// all Rust callers are recompiled together.
+    #[test]
+    #[cfg(target_pointer_width = "64")]
+    fn masternode_entry_v1_layout_is_frozen() {
+        assert_eq!(std::mem::size_of::<MasternodeEntryFFI>(), 296);
+        assert_eq!(std::mem::align_of::<MasternodeEntryFFI>(), 8);
+        assert_eq!(
+            std::mem::offset_of!(MasternodeEntryFFI, service_address),
+            144
+        );
+        assert_eq!(std::mem::offset_of!(MasternodeEntryFFI, owner_address), 160);
+        assert_eq!(
+            std::mem::offset_of!(MasternodeEntryFFI, operator_public_key),
+            176
+        );
+        assert_eq!(
+            std::mem::offset_of!(MasternodeEntryFFI, payout_address),
+            248
+        );
+        assert_eq!(
+            std::mem::offset_of!(MasternodeEntryFFI, platform_key_index),
+            284
+        );
+        assert_eq!(
+            std::mem::offset_of!(MasternodeEntryFFI, platform_ownership_checked),
+            288
+        );
+        assert_eq!(std::mem::offset_of!(MasternodeEntryV2FFI, v1), 0);
+    }
+
+    #[test]
+    fn masternode_entry_v2_carries_additive_fields_and_frees_them() {
+        let mut mn = MasternodeRecord::default();
+        mn.source = platform_wallet::masternode::MasternodeSource::Tracked;
+        mn.label = Some("tracked label".to_string());
+        let entry = masternode_entry_v2_ffi(&mn, dashcore::Network::Testnet);
+        assert_eq!(entry.source, 1);
+        assert_eq!(
+            unsafe { std::ffi::CStr::from_ptr(entry.label) }
+                .to_str()
+                .unwrap(),
+            "tracked label"
+        );
+        let entries = Box::into_raw(vec![entry].into_boxed_slice()) as *mut MasternodeEntryV2FFI;
+        unsafe { crate::wallet::platform_wallet_manager_free_masternodes_v2(entries, 1) };
+    }
+
+    #[test]
+    fn masternode_v1_and_v2_arrays_preserve_second_element_stride() {
+        let mut first = MasternodeRecord::default();
+        first.pro_tx_hash = [1; 32];
+        first.service_address = Some("1.1.1.1:9999".to_string());
+        first.source = platform_wallet::masternode::MasternodeSource::Tracked;
+        first.label = Some("first".to_string());
+        let mut second = MasternodeRecord::default();
+        second.pro_tx_hash = [2; 32];
+        second.service_address = Some("2.2.2.2:9999".to_string());
+        second.source = platform_wallet::masternode::MasternodeSource::Tracked;
+        second.label = Some("second".to_string());
+
+        let v1 = vec![
+            masternode_entry_ffi(&first, dashcore::Network::Testnet),
+            masternode_entry_ffi(&second, dashcore::Network::Testnet),
+        ];
+        let v1 = Box::into_raw(v1.into_boxed_slice()) as *mut MasternodeEntryFFI;
+        let v1_slice = unsafe { std::slice::from_raw_parts(v1, 2) };
+        assert_eq!(v1_slice[1].pro_tx_hash, [2; 32]);
+        assert_eq!(
+            unsafe { std::ffi::CStr::from_ptr(v1_slice[1].service_address) }
+                .to_str()
+                .unwrap(),
+            "2.2.2.2:9999"
+        );
+        unsafe { crate::wallet::platform_wallet_manager_free_masternodes(v1, 2) };
+
+        let v2 = vec![
+            masternode_entry_v2_ffi(&first, dashcore::Network::Testnet),
+            masternode_entry_v2_ffi(&second, dashcore::Network::Testnet),
+        ];
+        let v2 = Box::into_raw(v2.into_boxed_slice()) as *mut MasternodeEntryV2FFI;
+        let v2_slice = unsafe { std::slice::from_raw_parts(v2, 2) };
+        assert_eq!(v2_slice[1].v1.pro_tx_hash, [2; 32]);
+        assert_eq!(
+            unsafe { std::ffi::CStr::from_ptr(v2_slice[1].label) }
+                .to_str()
+                .unwrap(),
+            "second"
+        );
+        unsafe { crate::wallet::platform_wallet_manager_free_masternodes_v2(v2, 2) };
+    }
 }
diff --git a/packages/rs-platform-wallet-ffi/src/document.rs b/packages/rs-platform-wallet-ffi/src/document.rs
index 32509bc3356..79c18bc2e1f 100644
--- a/packages/rs-platform-wallet-ffi/src/document.rs
+++ b/packages/rs-platform-wallet-ffi/src/document.rs
@@ -532,6 +532,7 @@ mod tests {
         );
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([1u8; 32]),
             owner_id: Identifier::from([2u8; 32]),
             properties,
diff --git a/packages/rs-platform-wallet-ffi/src/error.rs b/packages/rs-platform-wallet-ffi/src/error.rs
index 859b2fab092..b7430ebfb1e 100644
--- a/packages/rs-platform-wallet-ffi/src/error.rs
+++ b/packages/rs-platform-wallet-ffi/src/error.rs
@@ -217,6 +217,24 @@ pub enum PlatformWalletFFIResultCode {
     /// join instead of erroring. Swift mirror:
     /// `PlatformWalletResultCode.errorShutdownIncomplete`.
     ErrorShutdownIncomplete = 27,
+    /// Asset-lock coin selection came up short over the *permitted* funding
+    /// set (dashpay/platform#4073). Carries the structured
+    /// `available`/`required` duff amounts in the message string — the
+    /// by-value `PlatformWalletFFIResult` is ABI-frozen (code + message only),
+    /// so the figures ride the typed `Display` rendering or not at all.
+    ///
+    /// Distinct from [`Self::ErrorCoreInsufficientFunds`] (22), which is the
+    /// atomic Core-send selector rather than the asset-lock builder. What the
+    /// figures cover depends on the build's funding form: an exact-amount
+    /// build pools the default source list (BIP44 + BIP32 + every DashPay
+    /// contact-receiving account), so its shortfall describes that whole
+    /// permitted union — not any single account — while a whole-account
+    /// *drain* build names exactly one account's shortfall. CoinJoin funds
+    /// only through the drain form (never pooled).
+    ///
+    /// Reached by the CoinJoin → shielded migration when the mixed account
+    /// cannot cover the lock, which is why the Android binding needs it typed.
+    ErrorAssetLockInsufficientFunds = 29,
     /// A state transition could not be signed because the signer has no
     /// usable private key for the requested public key — the stored blob is
     /// missing, stranded, or written under a different Keystore/Keychain
@@ -249,7 +267,10 @@ pub enum PlatformWalletFFIResultCode {
     //
     //   27  ErrorShutdownIncomplete         MERGED on v4.2-dev (dashpay/platform#4268)
     //   28  (free — vacated by this PR)
-    //   29  ErrorAssetLockInsufficientFunds dashpay/platform#4184
+    //   29  ErrorAssetLockInsufficientFunds ALLOCATED above. Claimed by
+    //       dashpay/platform#4184, which was closed unmerged along with its
+    //       successor #4316; this PR salvages the code at its reserved number
+    //       so the ABI matches what every host mirror already documents.
     //   30  (free — vacated by this PR)
     //   31  ErrorSigningKeyUnavailable      dashpay/platform#4183, #4259
     //   32  ErrorTransactionBuild           dashpay/platform#4247, #4256
@@ -392,14 +413,14 @@ pub enum PlatformWalletFFIResultCode {
     ErrorMasternodeListUnavailable = 46,
 
     // -----------------------------------------------------------------
-    // Embedded-persister failures (42-43). A fresh contiguous block above
-    // every current claim, per the registry note above: 28 and 30 are
-    // nominally free but reusing a vacated slot restarts the churn.
+    // Embedded-persister failures (48-49), claimed from the allocation
+    // frontier in the error-code registry (#4318). 28, 30, 32 and 33 are
+    // reserved-not-free, so the frontier is the only allocation source.
     // -----------------------------------------------------------------
     /// A persister operation failed transiently; callers may retry.
-    ErrorPersisterTransient = 42,
+    ErrorPersisterTransient = 48,
     /// A persister operation failed permanently; callers must not retry.
-    ErrorPersisterFatal = 43,
+    ErrorPersisterFatal = 49,
 
     /// The named thing does not exist.
     ///
@@ -683,6 +704,16 @@ impl From<PlatformWalletError> for PlatformWalletFFIResult {
             PlatformWalletError::AssetLockFundingMismatch { .. } => {
                 PlatformWalletFFIResultCode::ErrorAssetLockFundingMismatch
             }
+            // The asset-lock coin-selection shortfall (dashpay/platform#4073).
+            // Without this arm it flattens to `ErrorUnknown` (99), hiding a
+            // typed shortfall behind the catch-all and forcing hosts to
+            // string-match the Display text. The structured
+            // `available`/`required` duff amounts still travel in the message
+            // (there are no out-params for them), but the code now lets a host
+            // branch on the shortfall without parsing text.
+            PlatformWalletError::AssetLockInsufficientFunds { .. } => {
+                PlatformWalletFFIResultCode::ErrorAssetLockInsufficientFunds
+            }
             PlatformWalletError::PersisterLoad(..)
             | PlatformWalletError::PersisterStore(..)
             | PlatformWalletError::PersisterRestore(..) => {
@@ -986,9 +1017,9 @@ mod tests {
     fn result_code_discriminants_remain_stable() {
         assert_eq!(
             PlatformWalletFFIResultCode::ErrorPersisterTransient as i32,
-            42
+            48
         );
-        assert_eq!(PlatformWalletFFIResultCode::ErrorPersisterFatal as i32, 43);
+        assert_eq!(PlatformWalletFFIResultCode::ErrorPersisterFatal as i32, 49);
         assert_eq!(
             PlatformWalletFFIResultCode::ErrorTransactionBroadcastRejected as i32,
             26
@@ -1235,6 +1266,59 @@ mod tests {
         }
     }
 
+    /// The asset-lock coin-selection shortfall must cross the FFI boundary as
+    /// the dedicated `ErrorAssetLockInsufficientFunds` (29) code — NOT
+    /// `ErrorUnknown` (99) as it did before this arm existed
+    /// (dashpay/platform#4073) — and its structured `available`/`required`
+    /// duffs must survive verbatim in the message so hosts can parse the
+    /// amounts.
+    #[test]
+    fn asset_lock_insufficient_funds_maps_to_dedicated_code() {
+        let err = PlatformWalletError::AssetLockInsufficientFunds {
+            available: 18_000_000,
+            required: 100_000_000,
+        };
+        let rendered = err.to_string();
+        // Guard the exact text hosts (dash-wallet) substring-match on.
+        assert!(
+            rendered.contains("asset lock coin selection is short"),
+            "shortfall Display text changed — coordinate dash-wallet's matcher \
+             (rendered: {rendered})"
+        );
+        let result: PlatformWalletFFIResult = err.into();
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorAssetLockInsufficientFunds,
+            "must not flatten to ErrorUnknown(99) (rendered: {rendered})"
+        );
+        assert_ne!(
+            result.code as i32,
+            PlatformWalletFFIResultCode::ErrorUnknown as i32
+        );
+        assert!(!result.message.is_null());
+        let msg = unsafe { std::ffi::CStr::from_ptr(result.message) }
+            .to_string_lossy()
+            .into_owned();
+        assert_eq!(
+            msg, rendered,
+            "structured available/required duffs must survive the FFI boundary verbatim"
+        );
+    }
+
+    /// The numeric value of `ErrorAssetLockInsufficientFunds` is ABI, mirrored
+    /// by hand in the Swift and Kotlin host enums. Pin it so a future
+    /// renumbering of the surrounding block cannot silently re-point a host's
+    /// shortfall branch at some other error.
+    #[test]
+    fn asset_lock_insufficient_funds_code_is_pinned_at_29() {
+        assert_eq!(
+            PlatformWalletFFIResultCode::ErrorAssetLockInsufficientFunds as i32,
+            29,
+            "code 29 is reserved for the asset-lock shortfall in the FFI \
+             error-code registry; hosts mirror the number, not the name"
+        );
+    }
+
     /// `WalletAlreadyExists` maps to the dedicated
     /// `ErrorWalletAlreadyExists` FFI code rather than flattening to
     /// `ErrorUnknown`, so multi-network wallet create/enable callers can
diff --git a/packages/rs-platform-wallet-ffi/src/identity_registration_with_signer.rs b/packages/rs-platform-wallet-ffi/src/identity_registration_with_signer.rs
index 83102a1306a..f6e58733d0f 100644
--- a/packages/rs-platform-wallet-ffi/src/identity_registration_with_signer.rs
+++ b/packages/rs-platform-wallet-ffi/src/identity_registration_with_signer.rs
@@ -94,9 +94,12 @@ use crate::{unwrap_option_or_return, unwrap_result_or_return};
 /// the caller retains ownership. Compressed secp256k1 pubkeys are
 /// always 33 bytes (`pubkey_len == 33`); BLS would be 48; etc.
 ///
-/// **Contract bounds** — Encryption / Decryption keys carry a
-/// reference to the contract (and optionally a document type)
-/// they're allowed to operate within. Encoded inline as:
+/// **Contract bounds** — keys may optionally carry a reference to
+/// the contract (and optionally a document type) they're allowed to
+/// operate within. Consensus accepts unbounded keys for every
+/// purpose, including Encryption / Decryption; bounds only become
+/// meaningful when the target contract or document type explicitly
+/// requires a bounded key. Encoded inline as:
 ///   - `contract_bounds_kind == 0` → no bounds.
 ///   - `contract_bounds_kind == 1` → `SingleContract`. The first
 ///     32 bytes at `contract_bounds_id` are the contract id; the
@@ -129,24 +132,24 @@ pub struct IdentityPubkeyFFI {
 /// Decode the optional `contract_bounds_*` payload off an
 /// [`IdentityPubkeyFFI`] row.
 ///
-/// Shared by the registration and update FFI paths so
-/// Encryption / Decryption keys can carry their bounds through
-/// either entry point. `kind == 0` is "no bounds"; `1` is
+/// Shared by the registration and update FFI paths so optional
+/// key bounds can flow through either entry point. `kind == 0` is
+/// "no bounds"; `1` is
 /// `SingleContract { id }`; `2` is
 /// `SingleContractDocumentType { id, document_type_name }`.
 ///
-/// **Encryption / Decryption purposes require contract bounds.**
-/// Drive scopes those purposes to a single contract (and optionally
-/// a document type), so registering or updating an identity with an
-/// unbounded encryption / decryption key produces a key that cannot
-/// be used. We reject `kind == 0` for those purposes here so the
-/// failure surfaces as a clean FFI error rather than a key Drive
-/// silently can't use.
+/// Consensus does not require bounds for Encryption / Decryption
+/// purposes: an unbounded key is valid, and bounds are only checked
+/// when the caller actually supplies them. In that bounded case,
+/// consensus then constrains which purposes may carry bounds and
+/// whether the referenced contract or document type opted in.
 ///
-/// `purpose` is the parsed `Purpose` discriminant for the row, used
-/// only for the encryption / decryption guard above. `row_index` and
-/// `field_label` only flavour error messages (different callers want
-/// different prefixes — `add_public_keys[i]` for update,
+/// `purpose` is the parsed `Purpose` discriminant for the row. It is
+/// not needed for `kind == 0`, but remains part of the shared helper
+/// signature so callers can keep their error-message context stable if
+/// future validation needs it. `row_index` and `field_label` only
+/// flavour error messages (different callers want different prefixes —
+/// `add_public_keys[i]` for update,
 /// `identity_pubkeys[i]` for registration).
 ///
 /// Returns `Err(PlatformWalletFFIResult)` carrying the FFI error the
@@ -154,24 +157,12 @@ pub struct IdentityPubkeyFFI {
 /// caller does `unwrap_result_or_return!(decode_contract_bounds(...))`.
 pub(crate) unsafe fn decode_contract_bounds(
     row: &IdentityPubkeyFFI,
-    purpose: Purpose,
+    _purpose: Purpose,
     row_index: usize,
     field_label: &str,
 ) -> Result<Option<ContractBounds>, PlatformWalletFFIResult> {
     match row.contract_bounds_kind {
-        0 => {
-            if matches!(purpose, Purpose::ENCRYPTION | Purpose::DECRYPTION) {
-                return Err(PlatformWalletFFIResult::err(
-                    PlatformWalletFFIResultCode::ErrorInvalidParameter,
-                    format!(
-                        "{field_label}[{row_index}].contract_bounds_kind = 0 (no bounds) but \
-                         purpose = {purpose:?} requires bounds — Drive scopes Encryption / \
-                         Decryption keys to a specific contract (use kind 1 or 2)"
-                    ),
-                ));
-            }
-            Ok(None)
-        }
+        0 => Ok(None),
         1 => {
             if row.contract_bounds_id.is_null() {
                 return Err(PlatformWalletFFIResult::err(
@@ -257,8 +248,9 @@ pub(crate) unsafe fn decode_contract_bounds(
 ///   `ErrorInvalidParameter` instead of silently coercing.
 /// - `pubkey_bytes` must be non-null and non-empty.
 /// - `contract_bounds` decoded via [`decode_contract_bounds`], which
-///   enforces that Encryption / Decryption keys carry bounds
-///   (Drive rejects unbounded ones).
+///   mirrors consensus: unbounded keys are accepted, while supplied
+///   bounds still have to decode cleanly here and satisfy chain rules
+///   later.
 ///
 /// Returns `Err(PlatformWalletFFIResult)` carrying the FFI error the
 /// caller should bubble up directly via
@@ -880,21 +872,98 @@ mod tests {
         assert_eq!(map.len(), 2);
     }
 
-    /// An ENCRYPTION key with no contract bounds is still rejected after the
-    /// refactor (Drive scopes those keys to a contract, so an unbounded one is
-    /// unusable). Confirms `decode_contract_bounds`' guard survives.
+    /// Consensus accepts an unbounded ENCRYPTION key, so the shared FFI decoder
+    /// must do the same instead of being stricter than the chain.
     #[test]
-    fn decode_identity_pubkeys_rejects_unbounded_encryption_key() {
+    fn decode_identity_pubkeys_accepts_unbounded_encryption_key() {
         let pk = [0x02u8; 33];
         let mut enc = ffi_row(4, &pk);
         enc.purpose = 1; // Purpose::ENCRYPTION
         enc.security_level = 3; // SecurityLevel::MEDIUM
-                                // contract_bounds_kind stays 0 → unbounded → rejected.
+                                // contract_bounds_kind stays 0 → unbounded → accepted.
         let rows = [ffi_row(0, &pk), enc];
         // SAFETY: `rows` (and the pubkey array it borrows) outlive the call.
-        let mut err = unsafe { decode_identity_pubkeys(rows.as_ptr(), rows.len()) }
-            .expect_err("unbounded encryption key must be rejected");
-        assert_eq!(err.code, PlatformWalletFFIResultCode::ErrorInvalidParameter);
+        let map = unsafe { decode_identity_pubkeys(rows.as_ptr(), rows.len()) }
+            .expect("unbounded encryption key must decode");
+        assert_eq!(map.len(), 2);
+    }
+
+    #[test]
+    fn decode_contract_bounds_accepts_none_for_authentication_encryption_and_decryption() {
+        let pk = [0x02u8; 33];
+
+        for purpose in [
+            Purpose::AUTHENTICATION,
+            Purpose::ENCRYPTION,
+            Purpose::DECRYPTION,
+        ] {
+            let row = ffi_row(0, &pk);
+            let bounds = unsafe { decode_contract_bounds(&row, purpose, 0, "identity_pubkeys") }
+                .expect("kind == 0 must decode to no bounds for every supported purpose");
+            assert_eq!(bounds, None);
+        }
+    }
+
+    #[test]
+    fn decode_contract_bounds_kind_1_still_decodes_and_rejects_null_id() {
+        let pk = [0x02u8; 33];
+        let contract_id = [0x11u8; 32];
+        let mut row = ffi_row(0, &pk);
+        row.contract_bounds_kind = 1;
+        row.contract_bounds_id = contract_id.as_ptr();
+
+        let bounds =
+            unsafe { decode_contract_bounds(&row, Purpose::ENCRYPTION, 0, "identity_pubkeys") }
+                .expect("kind == 1 must still decode");
+        assert_eq!(
+            bounds,
+            Some(ContractBounds::SingleContract {
+                id: Identifier::from(contract_id),
+            })
+        );
+
+        row.contract_bounds_id = ptr::null();
+        let mut err =
+            unsafe { decode_contract_bounds(&row, Purpose::ENCRYPTION, 0, "identity_pubkeys") }
+                .expect_err("kind == 1 must still reject a null contract id");
+        assert_eq!(err.code, PlatformWalletFFIResultCode::ErrorNullPointer);
+        unsafe { platform_wallet_ffi_result_free(&mut err) };
+    }
+
+    #[test]
+    fn decode_contract_bounds_kind_2_still_decodes_and_rejects_null_payloads() {
+        let pk = [0x02u8; 33];
+        let contract_id = [0x22u8; 32];
+        let doc_type = CString::new("profile").expect("static string is valid CString");
+        let mut row = ffi_row(0, &pk);
+        row.contract_bounds_kind = 2;
+        row.contract_bounds_id = contract_id.as_ptr();
+        row.contract_bounds_document_type = doc_type.as_ptr();
+
+        let bounds =
+            unsafe { decode_contract_bounds(&row, Purpose::DECRYPTION, 0, "identity_pubkeys") }
+                .expect("kind == 2 must still decode");
+        assert_eq!(
+            bounds,
+            Some(ContractBounds::SingleContractDocumentType {
+                id: Identifier::from(contract_id),
+                document_type_name: "profile".to_string(),
+            })
+        );
+
+        row.contract_bounds_id = ptr::null();
+        let mut err =
+            unsafe { decode_contract_bounds(&row, Purpose::DECRYPTION, 0, "identity_pubkeys") }
+                .expect_err("kind == 2 must still reject a null contract id");
+        assert_eq!(err.code, PlatformWalletFFIResultCode::ErrorNullPointer);
+        unsafe { platform_wallet_ffi_result_free(&mut err) };
+
+        row.contract_bounds_id = contract_id.as_ptr();
+        row.contract_bounds_document_type = ptr::null();
+        let mut err =
+            unsafe { decode_contract_bounds(&row, Purpose::DECRYPTION, 0, "identity_pubkeys") }
+                .expect_err("kind == 2 must still reject a null document type");
+        assert_eq!(err.code, PlatformWalletFFIResultCode::ErrorNullPointer);
         unsafe { platform_wallet_ffi_result_free(&mut err) };
     }
 
diff --git a/packages/rs-platform-wallet-ffi/src/identity_update.rs b/packages/rs-platform-wallet-ffi/src/identity_update.rs
index 326062c9c85..c4319894ae6 100644
--- a/packages/rs-platform-wallet-ffi/src/identity_update.rs
+++ b/packages/rs-platform-wallet-ffi/src/identity_update.rs
@@ -5,11 +5,19 @@
 //! supplied `signer_handle` (typically the iOS-side `KeychainSigner`).
 
 use std::convert::TryFrom;
+use std::ffi::CString;
+use std::os::raw::c_char;
+use std::ptr;
 use std::slice;
 
+use dpp::identity::identity_public_key::contract_bounds::ContractBounds;
 use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
 use dpp::identity::{IdentityPublicKey, KeyType, Purpose, SecurityLevel};
 use dpp::platform_value::BinaryData;
+use dpp::serialization::PlatformDeserializable;
+use dpp::state_transition::identity_update_transition::accessors::IdentityUpdateTransitionAccessorsV0;
+use dpp::state_transition::public_key_in_creation::accessors::IdentityPublicKeyInCreationV0Getters;
+use dpp::state_transition::StateTransition;
 use rs_sdk_ffi::{SignerHandle, VTableSigner};
 
 use crate::check_ptr;
@@ -20,6 +28,269 @@ use crate::runtime::block_on_worker;
 use crate::types::*;
 use crate::{unwrap_option_or_return, unwrap_result_or_return};
 
+const IDENTITY_UPDATE_VARIANT_TAG: u8 = 6;
+
+/// Owned C representation of one public key carried by a parsed
+/// `IdentityUpdateTransition`.
+///
+/// The `data_ptr` buffer and optional `contract_bounds_document_type`
+/// string are heap allocations owned by Rust and must be released via
+/// [`platform_wallet_parse_identity_update_transition_free`].
+#[repr(C)]
+pub struct ParsedIdentityUpdatePublicKeyFFI {
+    pub key_id: u32,
+    pub key_type: u8,
+    pub purpose: u8,
+    pub security_level: u8,
+    pub read_only: bool,
+    pub data_ptr: *mut u8,
+    pub data_len: usize,
+    /// 0 = none, 1 = SingleContract, 2 = SingleContractDocumentType.
+    pub contract_bounds_kind: u8,
+    pub contract_bounds_id: [u8; 32],
+    pub contract_bounds_document_type: *mut c_char,
+}
+
+/// Owned C representation of the inspectable parts of a parsed
+/// `IdentityUpdateTransition`.
+#[repr(C)]
+pub struct ParsedIdentityUpdateFFI {
+    pub identity_id: [u8; 32],
+    pub add_public_keys: *mut ParsedIdentityUpdatePublicKeyFFI,
+    pub add_public_keys_count: usize,
+    pub disable_public_key_ids: *mut u32,
+    pub disable_public_key_ids_count: usize,
+}
+
+impl Default for ParsedIdentityUpdateFFI {
+    fn default() -> Self {
+        Self {
+            identity_id: [0u8; 32],
+            add_public_keys: ptr::null_mut(),
+            add_public_keys_count: 0,
+            disable_public_key_ids: ptr::null_mut(),
+            disable_public_key_ids_count: 0,
+        }
+    }
+}
+
+fn parse_identity_update_transition_bytes(
+    bytes: &[u8],
+) -> Result<
+    dpp::state_transition::identity_update_transition::IdentityUpdateTransition,
+    PlatformWalletFFIResult,
+> {
+    let mut prefixed = Vec::with_capacity(bytes.len() + 1);
+    prefixed.push(IDENTITY_UPDATE_VARIANT_TAG);
+    prefixed.extend_from_slice(bytes);
+
+    // A leading variant tag usually means the payload is already framed as a
+    // state transition, and Yappr's tagless framing needs the tag prepended.
+    // Neither test is conclusive — a tagless body can start with the tag byte
+    // by coincidence — so the likelier framing is only tried first, and the
+    // other one is still tried before the payload is rejected.
+    let (first, first_label, second, second_label) =
+        if bytes.first().copied() == Some(IDENTITY_UPDATE_VARIANT_TAG) {
+            (bytes, "as-is", prefixed.as_slice(), "variant tag prepended")
+        } else {
+            (prefixed.as_slice(), "variant tag prepended", bytes, "as-is")
+        };
+
+    let state_transition = match StateTransition::deserialize_from_bytes(first) {
+        Ok(state_transition) => state_transition,
+        Err(first_error) => match StateTransition::deserialize_from_bytes(second) {
+            Ok(state_transition) => state_transition,
+            Err(second_error) => {
+                return Err(PlatformWalletFFIResult::err(
+                    PlatformWalletFFIResultCode::ErrorDeserialization,
+                    format!(
+                        "Failed to deserialize IdentityUpdateTransition in either framing \
+                         ({first_label}: {first_error}; {second_label}: {second_error})"
+                    ),
+                ));
+            }
+        },
+    };
+
+    match state_transition {
+        StateTransition::IdentityUpdate(identity_update) => Ok(identity_update),
+        other => Err(PlatformWalletFFIResult::err(
+            PlatformWalletFFIResultCode::ErrorInvalidParameter,
+            format!("Expected IdentityUpdateTransition, got {other:?}"),
+        )),
+    }
+}
+
+/// Reporting a narrower bound than the transition declares would let the user
+/// approve a broader scope than the one they were shown, so a document type
+/// that cannot cross the FFI as a C string is an error rather than a fallback
+/// to the contract-only bound.
+fn encode_contract_bounds(
+    bounds: Option<&ContractBounds>,
+) -> Result<(u8, [u8; 32], *mut c_char), PlatformWalletFFIResult> {
+    match bounds {
+        Some(ContractBounds::SingleContract { id }) => Ok((1u8, id.to_buffer(), ptr::null_mut())),
+        Some(ContractBounds::SingleContractDocumentType {
+            id,
+            document_type_name,
+        }) => match CString::new(document_type_name.as_str()) {
+            Ok(value) => Ok((2u8, id.to_buffer(), value.into_raw())),
+            Err(error) => Err(PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorInvalidParameter,
+                format!(
+                    "Contract-bounds document type name cannot be represented as a C string: \
+                     {error}"
+                ),
+            )),
+        },
+        None => Ok((0u8, [0u8; 32], ptr::null_mut())),
+    }
+}
+
+/// Frees the owned buffers behind already-projected keys. Shared by the free
+/// entry point and the error path in [`project_parsed_identity_update`], which
+/// has to release what it allocated before the caller ever sees the struct.
+///
+/// # Safety
+/// Every non-null `data_ptr` / `contract_bounds_document_type` must be a
+/// pointer this module allocated and has not freed yet.
+unsafe fn free_parsed_public_keys(keys: &mut [ParsedIdentityUpdatePublicKeyFFI]) {
+    for key in keys.iter_mut() {
+        if !key.data_ptr.is_null() && key.data_len > 0 {
+            let data_slice = slice::from_raw_parts_mut(key.data_ptr, key.data_len);
+            let _ = Box::from_raw(data_slice as *mut [u8]);
+            key.data_ptr = ptr::null_mut();
+            key.data_len = 0;
+        }
+
+        if !key.contract_bounds_document_type.is_null() {
+            let _ = CString::from_raw(key.contract_bounds_document_type);
+            key.contract_bounds_document_type = ptr::null_mut();
+        }
+    }
+}
+
+fn project_parsed_identity_update(
+    transition: &dpp::state_transition::identity_update_transition::IdentityUpdateTransition,
+) -> Result<ParsedIdentityUpdateFFI, PlatformWalletFFIResult> {
+    let identity_id = transition.identity_id().to_buffer();
+
+    let public_keys_to_add = transition.public_keys_to_add();
+    let mut add_public_keys_vec: Vec<ParsedIdentityUpdatePublicKeyFFI> =
+        Vec::with_capacity(public_keys_to_add.len());
+
+    for public_key in public_keys_to_add.iter() {
+        // Encoded before the key data is boxed, so a rejected bound leaves
+        // nothing of this key to release.
+        let (contract_bounds_kind, contract_bounds_id, contract_bounds_document_type) =
+            match encode_contract_bounds(public_key.contract_bounds()) {
+                Ok(bounds) => bounds,
+                Err(error) => {
+                    // The caller never receives this struct, so nothing else
+                    // will ever free the keys projected so far.
+                    unsafe { free_parsed_public_keys(&mut add_public_keys_vec) };
+                    return Err(error);
+                }
+            };
+
+        let data = public_key.data().as_slice().to_vec().into_boxed_slice();
+        let data_len = data.len();
+        let data_ptr = Box::into_raw(data) as *mut u8;
+
+        add_public_keys_vec.push(ParsedIdentityUpdatePublicKeyFFI {
+            key_id: public_key.id(),
+            key_type: public_key.key_type() as u8,
+            purpose: public_key.purpose() as u8,
+            security_level: public_key.security_level() as u8,
+            read_only: public_key.read_only(),
+            data_ptr,
+            data_len,
+            contract_bounds_kind,
+            contract_bounds_id,
+            contract_bounds_document_type,
+        });
+    }
+
+    let add_public_keys_count = add_public_keys_vec.len();
+    let add_public_keys = if add_public_keys_count == 0 {
+        ptr::null_mut()
+    } else {
+        Box::into_raw(add_public_keys_vec.into_boxed_slice())
+            as *mut ParsedIdentityUpdatePublicKeyFFI
+    };
+
+    let disable_public_key_ids_vec = transition.public_key_ids_to_disable().to_vec();
+    let disable_public_key_ids_count = disable_public_key_ids_vec.len();
+    let disable_public_key_ids = if disable_public_key_ids_count == 0 {
+        ptr::null_mut()
+    } else {
+        Box::into_raw(disable_public_key_ids_vec.into_boxed_slice()) as *mut u32
+    };
+
+    Ok(ParsedIdentityUpdateFFI {
+        identity_id,
+        add_public_keys,
+        add_public_keys_count,
+        disable_public_key_ids,
+        disable_public_key_ids_count,
+    })
+}
+
+/// Deserializes a raw `IdentityUpdateTransition` (as carried by a DashConnect
+/// `dash-st:` QR) into its inspectable parts.
+///
+/// Accepts both normal tagged DPP state-transition bytes and Yappr's tagless
+/// framing, where the positional bincode enum variant tag `6` has to be
+/// prepended before deserialization.
+///
+/// Does NOT sign and does NOT broadcast — the caller validates the result and
+/// rebuilds the transition through the normal signing path.
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_parse_identity_update_transition(
+    transition_bytes: *const u8,
+    transition_len: usize,
+    out: *mut ParsedIdentityUpdateFFI,
+) -> PlatformWalletFFIResult {
+    check_ptr!(transition_bytes);
+    check_ptr!(out);
+
+    *out = ParsedIdentityUpdateFFI::default();
+
+    let bytes = slice::from_raw_parts(transition_bytes, transition_len);
+    let transition = unwrap_result_or_return!(parse_identity_update_transition_bytes(bytes));
+    *out = unwrap_result_or_return!(project_parsed_identity_update(&transition));
+    PlatformWalletFFIResult::ok()
+}
+
+/// Frees a parsed transition previously returned by
+/// [`platform_wallet_parse_identity_update_transition`].
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_parse_identity_update_transition_free(
+    out: *mut ParsedIdentityUpdateFFI,
+) {
+    if out.is_null() {
+        return;
+    }
+
+    let parsed = &mut *out;
+
+    if !parsed.add_public_keys.is_null() && parsed.add_public_keys_count > 0 {
+        let keys = slice::from_raw_parts_mut(parsed.add_public_keys, parsed.add_public_keys_count);
+        free_parsed_public_keys(keys);
+        let _ = Box::from_raw(keys as *mut [ParsedIdentityUpdatePublicKeyFFI]);
+    }
+
+    if !parsed.disable_public_key_ids.is_null() && parsed.disable_public_key_ids_count > 0 {
+        let disable_ids = slice::from_raw_parts_mut(
+            parsed.disable_public_key_ids,
+            parsed.disable_public_key_ids_count,
+        );
+        let _ = Box::from_raw(disable_ids as *mut [u32]);
+    }
+
+    *parsed = ParsedIdentityUpdateFFI::default();
+}
+
 /// Update an identity by adding new public keys and/or disabling
 /// existing key IDs, signing the resulting `IdentityUpdateTransition`
 /// with the supplied `signer_handle`.
@@ -102,3 +373,313 @@ pub unsafe extern "C" fn platform_wallet_update_identity_with_signer(
     unwrap_result_or_return!(result);
     PlatformWalletFFIResult::ok()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use dpp::identity::identity_public_key::contract_bounds::ContractBounds;
+    use dpp::platform_value::BinaryData;
+    use dpp::prelude::Identifier;
+    use dpp::serialization::PlatformSerializable;
+    use dpp::state_transition::identity_update_transition::v0::IdentityUpdateTransitionV0;
+    use dpp::state_transition::public_key_in_creation::v0::IdentityPublicKeyInCreationV0;
+
+    const YAPPR_TAGLESS_IDENTITY_UPDATE_FIXTURE_HEX: &str = concat!(
+        "0089fd6ddba75136a4fea02dc7d89ef0ca5bcc32ccf12fb8da6a1a03740567ae72",
+        "01010200060200020000145e24e38a86e720f61757647996957e322686abb70000",
+        "07000103000021035e8cfb0785b54e8902a3dc17bdaad8a5738c6019a18ebc527f",
+        "79d1c64a27826a4120dc911df1d1e6cccf8c95ec0d423c928433397933de6dd9ad",
+        "006bc40dc0334d6d270d50c6d5e2dcdc5560e40487ddfe28bd1066d0729fad4b26",
+        "f92ae33f12a04b00000000"
+    );
+
+    fn fixture_transition_bytes() -> Vec<u8> {
+        let identity_id = Identifier::from([0x11; 32]);
+        let contract_id = Identifier::from([0x44; 32]);
+
+        let transition = StateTransition::IdentityUpdate(
+            IdentityUpdateTransitionV0 {
+                signature: BinaryData::new(vec![0x99; 65]),
+                signature_public_key_id: 3,
+                identity_id,
+                revision: 7,
+                nonce: 9,
+                add_public_keys: vec![
+                    IdentityPublicKeyInCreationV0 {
+                        id: 17,
+                        key_type: KeyType::ECDSA_SECP256K1,
+                        purpose: Purpose::AUTHENTICATION,
+                        security_level: SecurityLevel::HIGH,
+                        read_only: false,
+                        data: BinaryData::new(vec![0x02; 33]),
+                        signature: BinaryData::new(vec![0xaa; 65]),
+                        contract_bounds: None,
+                    }
+                    .into(),
+                    IdentityPublicKeyInCreationV0 {
+                        id: 18,
+                        key_type: KeyType::ECDSA_SECP256K1,
+                        purpose: Purpose::ENCRYPTION,
+                        security_level: SecurityLevel::HIGH,
+                        read_only: true,
+                        data: BinaryData::new(vec![0x03; 33]),
+                        signature: BinaryData::new(vec![0xbb; 65]),
+                        contract_bounds: Some(ContractBounds::SingleContractDocumentType {
+                            id: contract_id,
+                            document_type_name: "profile".to_string(),
+                        }),
+                    }
+                    .into(),
+                ],
+                disable_public_keys: vec![4, 8],
+                user_fee_increase: 2,
+            }
+            .into(),
+        );
+
+        transition
+            .serialize_to_bytes()
+            .expect("fixture transition serializes")
+    }
+
+    #[test]
+    fn parses_tagged_identity_update_transition() {
+        let bytes = fixture_transition_bytes();
+        let mut out = ParsedIdentityUpdateFFI::default();
+
+        let result = unsafe {
+            platform_wallet_parse_identity_update_transition(bytes.as_ptr(), bytes.len(), &mut out)
+        };
+        assert_eq!(result.code, PlatformWalletFFIResultCode::Success);
+        assert_eq!(out.identity_id, [0x11; 32]);
+        assert_eq!(out.add_public_keys_count, 2);
+        assert_eq!(out.disable_public_key_ids_count, 2);
+
+        let keys = unsafe { slice::from_raw_parts(out.add_public_keys, out.add_public_keys_count) };
+        assert_eq!(keys[0].key_id, 17);
+        assert!(!keys[0].read_only);
+        assert!(keys[1].read_only);
+        assert_eq!(keys[1].contract_bounds_kind, 2);
+        assert_eq!(keys[1].contract_bounds_id, [0x44; 32]);
+        let doc_type = unsafe {
+            std::ffi::CStr::from_ptr(keys[1].contract_bounds_document_type)
+                .to_str()
+                .expect("doc type utf8")
+        };
+        assert_eq!(doc_type, "profile");
+
+        let disable_ids = unsafe {
+            slice::from_raw_parts(out.disable_public_key_ids, out.disable_public_key_ids_count)
+        };
+        assert_eq!(disable_ids, &[4, 8]);
+
+        unsafe { platform_wallet_parse_identity_update_transition_free(&mut out) };
+        assert!(out.add_public_keys.is_null());
+        assert!(out.disable_public_key_ids.is_null());
+    }
+
+    #[test]
+    fn parses_yappr_tagless_identity_update_transition() {
+        let tagless = hex::decode(YAPPR_TAGLESS_IDENTITY_UPDATE_FIXTURE_HEX)
+            .expect("valid Yappr fixture hex");
+        let mut out = ParsedIdentityUpdateFFI::default();
+
+        let result = unsafe {
+            platform_wallet_parse_identity_update_transition(
+                tagless.as_ptr(),
+                tagless.len(),
+                &mut out,
+            )
+        };
+
+        assert_eq!(result.code, PlatformWalletFFIResultCode::Success);
+        assert_eq!(
+            out.identity_id.as_slice(),
+            hex::decode("89fd6ddba75136a4fea02dc7d89ef0ca5bcc32ccf12fb8da6a1a03740567ae72")
+                .expect("valid identity id hex")
+                .as_slice()
+        );
+        assert_eq!(out.disable_public_key_ids_count, 0);
+        assert_eq!(out.add_public_keys_count, 2);
+
+        let keys = unsafe { slice::from_raw_parts(out.add_public_keys, out.add_public_keys_count) };
+
+        assert_eq!(keys[0].key_id, 6);
+        assert_eq!(
+            Purpose::try_from(keys[0].purpose).expect("recognized purpose"),
+            Purpose::AUTHENTICATION
+        );
+        assert_eq!(
+            SecurityLevel::try_from(keys[0].security_level).expect("recognized security level"),
+            SecurityLevel::HIGH
+        );
+        assert_eq!(
+            KeyType::try_from(keys[0].key_type).expect("recognized key type"),
+            KeyType::ECDSA_HASH160
+        );
+        assert!(!keys[0].read_only);
+        assert_eq!(keys[0].contract_bounds_kind, 0);
+        let key0_data = unsafe { slice::from_raw_parts(keys[0].data_ptr, keys[0].data_len) };
+        assert_eq!(
+            key0_data,
+            hex::decode("5e24e38a86e720f61757647996957e322686abb7")
+                .expect("valid authentication key hex")
+                .as_slice()
+        );
+
+        assert_eq!(keys[1].key_id, 7);
+        assert_eq!(
+            Purpose::try_from(keys[1].purpose).expect("recognized purpose"),
+            Purpose::ENCRYPTION
+        );
+        assert_eq!(
+            SecurityLevel::try_from(keys[1].security_level).expect("recognized security level"),
+            SecurityLevel::MEDIUM
+        );
+        assert_eq!(
+            KeyType::try_from(keys[1].key_type).expect("recognized key type"),
+            KeyType::ECDSA_SECP256K1
+        );
+        assert!(!keys[1].read_only);
+        // The real DashConnect ENCRYPTION key is intentionally unbounded, so
+        // this guards the decoder widening that now accepts absent bounds.
+        assert_eq!(keys[1].contract_bounds_kind, 0);
+        let key1_data = unsafe { slice::from_raw_parts(keys[1].data_ptr, keys[1].data_len) };
+        assert_eq!(
+            key1_data,
+            hex::decode("035e8cfb0785b54e8902a3dc17bdaad8a5738c6019a18ebc527f79d1c64a27826a")
+                .expect("valid encryption key hex")
+                .as_slice()
+        );
+
+        unsafe { platform_wallet_parse_identity_update_transition_free(&mut out) };
+    }
+
+    #[test]
+    fn parses_tagless_framing_by_prepending_the_variant_tag() {
+        let tagged = fixture_transition_bytes();
+        let tagless = tagged[1..].to_vec();
+        let mut out = ParsedIdentityUpdateFFI::default();
+
+        let result = unsafe {
+            platform_wallet_parse_identity_update_transition(
+                tagless.as_ptr(),
+                tagless.len(),
+                &mut out,
+            )
+        };
+
+        assert_eq!(result.code, PlatformWalletFFIResultCode::Success);
+        assert_eq!(out.identity_id, [0x11; 32]);
+        assert_eq!(out.add_public_keys_count, 2);
+
+        unsafe { platform_wallet_parse_identity_update_transition_free(&mut out) };
+    }
+
+    #[test]
+    fn rejects_malformed_identity_update_transition_bytes() {
+        let bytes = [0xde, 0xad, 0xbe, 0xef];
+        let mut out = ParsedIdentityUpdateFFI::default();
+
+        let result = unsafe {
+            platform_wallet_parse_identity_update_transition(bytes.as_ptr(), bytes.len(), &mut out)
+        };
+
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorDeserialization
+        );
+        assert!(out.add_public_keys.is_null());
+        assert!(out.disable_public_key_ids.is_null());
+        assert_eq!(out.add_public_keys_count, 0);
+        assert_eq!(out.disable_public_key_ids_count, 0);
+    }
+
+    #[test]
+    fn rejects_contract_bounds_document_type_that_cannot_cross_the_ffi() {
+        // A document type carrying an interior NUL cannot be handed over as a
+        // C string. Reporting the contract-only bound instead would show the
+        // user a broader scope than the transition declares, so this is an
+        // error rather than a narrowing.
+        let transition =
+            dpp::state_transition::identity_update_transition::IdentityUpdateTransition::V0(
+                IdentityUpdateTransitionV0 {
+                    signature: BinaryData::new(vec![0x99; 65]),
+                    signature_public_key_id: 3,
+                    identity_id: Identifier::from([0x11; 32]),
+                    revision: 7,
+                    nonce: 9,
+                    add_public_keys: vec![
+                        // Projected successfully, so its boxed data buffer and
+                        // contract-bounds string are live when the next key
+                        // fails. That makes the error path's
+                        // `free_parsed_public_keys` run over a non-empty
+                        // vector — with only the failing key present it would
+                        // free nothing and a leak here would go unnoticed.
+                        IdentityPublicKeyInCreationV0 {
+                            id: 16,
+                            key_type: KeyType::ECDSA_SECP256K1,
+                            purpose: Purpose::ENCRYPTION,
+                            security_level: SecurityLevel::MEDIUM,
+                            read_only: false,
+                            data: BinaryData::new(vec![0x03; 33]),
+                            signature: BinaryData::new(vec![0xcc; 65]),
+                            contract_bounds: Some(ContractBounds::SingleContractDocumentType {
+                                id: Identifier::from([0x55; 32]),
+                                document_type_name: "profile".to_string(),
+                            }),
+                        }
+                        .into(),
+                        IdentityPublicKeyInCreationV0 {
+                            id: 17,
+                            key_type: KeyType::ECDSA_SECP256K1,
+                            purpose: Purpose::ENCRYPTION,
+                            security_level: SecurityLevel::MEDIUM,
+                            read_only: false,
+                            data: BinaryData::new(vec![0x02; 33]),
+                            signature: BinaryData::new(vec![0xaa; 65]),
+                            contract_bounds: Some(ContractBounds::SingleContractDocumentType {
+                                id: Identifier::from([0x44; 32]),
+                                document_type_name: "pro\0file".to_string(),
+                            }),
+                        }
+                        .into(),
+                    ],
+                    disable_public_keys: vec![],
+                    user_fee_increase: 0,
+                },
+            );
+
+        // `ParsedIdentityUpdateFFI` is a raw-pointer C struct with no `Debug`,
+        // so the success case is rejected by hand rather than with `expect_err`.
+        let error = match project_parsed_identity_update(&transition) {
+            Ok(_) => panic!("a document type with an interior NUL must not be narrowed"),
+            Err(error) => error,
+        };
+
+        assert_eq!(
+            error.code,
+            PlatformWalletFFIResultCode::ErrorInvalidParameter
+        );
+    }
+
+    #[test]
+    fn rejects_truncated_identity_update_transition_bytes() {
+        let mut bytes = fixture_transition_bytes();
+        bytes.truncate(bytes.len() - 7);
+        let mut out = ParsedIdentityUpdateFFI::default();
+
+        let result = unsafe {
+            platform_wallet_parse_identity_update_transition(bytes.as_ptr(), bytes.len(), &mut out)
+        };
+
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorDeserialization
+        );
+        assert!(out.add_public_keys.is_null());
+        assert!(out.disable_public_key_ids.is_null());
+        assert_eq!(out.add_public_keys_count, 0);
+        assert_eq!(out.disable_public_key_ids_count, 0);
+    }
+}
diff --git a/packages/rs-platform-wallet-ffi/src/lib.rs b/packages/rs-platform-wallet-ffi/src/lib.rs
index 2ccd4f9097a..7bd2004b425 100644
--- a/packages/rs-platform-wallet-ffi/src/lib.rs
+++ b/packages/rs-platform-wallet-ffi/src/lib.rs
@@ -68,6 +68,7 @@ pub mod platform_addresses;
 pub mod platform_wallet_info;
 pub mod provider_key_at_index;
 mod runtime;
+pub mod secp256k1_primitives;
 #[cfg(feature = "shielded")]
 pub mod shielded_persistence;
 #[cfg(feature = "shielded")]
@@ -144,6 +145,7 @@ pub use platform_address_types::*;
 pub use platform_addresses::*;
 pub use platform_wallet_info::*;
 pub use provider_key_at_index::*;
+pub use secp256k1_primitives::*;
 #[cfg(feature = "shielded")]
 pub use shielded_send::*;
 #[cfg(feature = "shielded")]
diff --git a/packages/rs-platform-wallet-ffi/src/manager.rs b/packages/rs-platform-wallet-ffi/src/manager.rs
index 3a50ff916e4..4180a774462 100644
--- a/packages/rs-platform-wallet-ffi/src/manager.rs
+++ b/packages/rs-platform-wallet-ffi/src/manager.rs
@@ -8,8 +8,10 @@ use crate::event_handler::{
 };
 use crate::handle::*;
 use crate::persistence::{
-    FFIPersister, PersistenceCallbacks, PersistenceCallbacksExtension, PersistenceCapabilitiesFFI,
-    PersistenceExtensionCallbacks, PLATFORM_WALLET_PERSISTENCE_CALLBACKS_EXTENSION_VERSION,
+    FFIPersister, FreeTrackedMasternodesFn, LoadTrackedMasternodesFn, PersistDpnsNameStatesFn,
+    PersistTrackedMasternodesFn, PersistenceCallbacks, PersistenceCallbacksExtension,
+    PersistenceCapabilitiesFFI, PersistenceExtensionCallbacks,
+    PLATFORM_WALLET_PERSISTENCE_CALLBACKS_EXTENSION_VERSION,
 };
 use crate::runtime::runtime;
 use crate::types::{FFINetwork, Network};
@@ -187,9 +189,9 @@ unsafe fn persistence_extension_callbacks(
     /// Read one size-gated `Option<fn>` field: present only when the
     /// caller's `struct_size` proves the complete field exists.
     macro_rules! gated {
-        ($field:ident) => {{
+        ($field:ident, $callback:ty) => {{
             let end = std::mem::offset_of!(PersistenceCallbacksExtension, $field)
-                + std::mem::size_of_val(&(*extension).$field);
+                + std::mem::size_of::<Option<$callback>>();
             if supplied_size < end {
                 None
             } else {
@@ -199,10 +201,16 @@ unsafe fn persistence_extension_callbacks(
     }
 
     PersistenceExtensionCallbacks {
-        dpns_name_states: gated!(on_persist_dpns_name_states_fn),
-        persist_tracked_masternodes: gated!(on_persist_tracked_masternodes_fn),
-        load_tracked_masternodes: gated!(on_load_tracked_masternodes_fn),
-        load_tracked_masternodes_free: gated!(on_load_tracked_masternodes_free_fn),
+        dpns_name_states: gated!(on_persist_dpns_name_states_fn, PersistDpnsNameStatesFn),
+        persist_tracked_masternodes: gated!(
+            on_persist_tracked_masternodes_fn,
+            PersistTrackedMasternodesFn
+        ),
+        load_tracked_masternodes: gated!(on_load_tracked_masternodes_fn, LoadTrackedMasternodesFn),
+        load_tracked_masternodes_free: gated!(
+            on_load_tracked_masternodes_free_fn,
+            FreeTrackedMasternodesFn
+        ),
     }
 }
 
@@ -788,6 +796,16 @@ mod tests {
         0
     }
 
+    /// Exact allocation shape used by a host compiled before the tracked
+    /// callback trio was appended to `PersistenceCallbacksExtension`.
+    #[repr(C)]
+    struct DpnsOnlyPersistenceCallbacksExtension {
+        struct_size: usize,
+        version: u32,
+        reserved: u32,
+        on_persist_dpns_name_states_fn: Option<PersistDpnsNameStatesFn>,
+    }
+
     fn persistence_callbacks() -> PersistenceCallbacks {
         PersistenceCallbacks {
             on_changeset_begin_fn: Some(begin_changeset),
@@ -1120,16 +1138,24 @@ mod tests {
     /// yields the dpns callback and nothing else — additive size gating.
     #[test]
     fn dpns_only_sized_extension_reads_only_the_dpns_field() {
-        let dpns_only_size = std::mem::offset_of!(
-            PersistenceCallbacksExtension,
-            on_persist_tracked_masternodes_fn
-        );
-        let ext = PersistenceCallbacksExtension {
-            struct_size: dpns_only_size,
+        let ext = DpnsOnlyPersistenceCallbacksExtension {
+            struct_size: std::mem::size_of::<DpnsOnlyPersistenceCallbacksExtension>(),
+            version: PLATFORM_WALLET_PERSISTENCE_CALLBACKS_EXTENSION_VERSION,
+            reserved: 0,
             on_persist_dpns_name_states_fn: Some(persist_dpns_name_states),
-            ..Default::default()
         };
-        let read = unsafe { persistence_extension_callbacks(&ext) };
+        assert_eq!(
+            ext.struct_size,
+            std::mem::offset_of!(
+                PersistenceCallbacksExtension,
+                on_persist_tracked_masternodes_fn
+            )
+        );
+        let read = unsafe {
+            persistence_extension_callbacks(
+                (&ext as *const DpnsOnlyPersistenceCallbacksExtension).cast(),
+            )
+        };
         assert!(read.dpns_name_states.is_some());
         assert!(read.persist_tracked_masternodes.is_none());
         assert!(read.load_tracked_masternodes.is_none());
diff --git a/packages/rs-platform-wallet-ffi/src/secp256k1_primitives.rs b/packages/rs-platform-wallet-ffi/src/secp256k1_primitives.rs
new file mode 100644
index 00000000000..d97d5e5f149
--- /dev/null
+++ b/packages/rs-platform-wallet-ffi/src/secp256k1_primitives.rs
@@ -0,0 +1,256 @@
+//! Standalone secp256k1 primitives used by DashConnect.
+
+use std::slice;
+
+use dashcore::secp256k1::ecdh::shared_secret_point;
+use dashcore::secp256k1::{PublicKey, Secp256k1, SecretKey};
+use zeroize::Zeroizing;
+
+use crate::error::*;
+use crate::{check_ptr, unwrap_result_or_return};
+
+struct WipingSecretKey(SecretKey);
+
+impl Drop for WipingSecretKey {
+    fn drop(&mut self) {
+        self.0.non_secure_erase();
+    }
+}
+
+fn invalid_parameter(message: impl Into<String>) -> PlatformWalletFFIResult {
+    PlatformWalletFFIResult::err(
+        PlatformWalletFFIResultCode::ErrorInvalidParameter,
+        message.into(),
+    )
+}
+
+fn parse_secret_key(
+    private_key: *const u8,
+    private_key_len: usize,
+) -> Result<WipingSecretKey, PlatformWalletFFIResult> {
+    if private_key_len != 32 {
+        return Err(invalid_parameter(format!(
+            "secp256k1 private keys must be exactly 32 bytes, got {private_key_len}"
+        )));
+    }
+
+    // `SecretKey::from_slice` converts the slice into an unguarded local
+    // `[u8; 32]` on its way to the returned key, so parsing straight from the
+    // caller's slice would leave a second, unscrubbed copy of the scalar on
+    // the stack. Staging it here keeps every copy this side owns wiped.
+    let mut staged = Zeroizing::new([0u8; 32]);
+    staged.copy_from_slice(unsafe { slice::from_raw_parts(private_key, private_key_len) });
+
+    SecretKey::from_byte_array(&staged)
+        .map(WipingSecretKey)
+        .map_err(|error| invalid_parameter(format!("Invalid secp256k1 private key: {error}")))
+}
+
+fn parse_compressed_public_key(
+    public_key: *const u8,
+    public_key_len: usize,
+) -> Result<PublicKey, PlatformWalletFFIResult> {
+    if public_key_len != 33 {
+        return Err(invalid_parameter(format!(
+            "Compressed secp256k1 public keys must be exactly 33 bytes, got {public_key_len}"
+        )));
+    }
+
+    let bytes = unsafe { slice::from_raw_parts(public_key, public_key_len) };
+    if !matches!(bytes.first().copied(), Some(0x02) | Some(0x03)) {
+        return Err(invalid_parameter(
+            "Compressed secp256k1 public keys must start with 0x02 or 0x03".to_string(),
+        ));
+    }
+
+    PublicKey::from_slice(bytes)
+        .map_err(|error| invalid_parameter(format!("Invalid compressed secp256k1 point: {error}")))
+}
+
+/// Returns `1` when `pubkey` is a valid compressed secp256k1 point, `0` otherwise.
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_secp256k1_verify_compressed_point(
+    pubkey: *const u8,
+    pubkey_len: usize,
+) -> i32 {
+    if pubkey.is_null() || pubkey_len != 33 {
+        return 0;
+    }
+
+    match parse_compressed_public_key(pubkey, pubkey_len) {
+        Ok(_) => 1,
+        Err(_) => 0,
+    }
+}
+
+/// Derive the 33-byte compressed public key for a 32-byte secp256k1 scalar.
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_secp256k1_compressed_public_key(
+    seckey: *const u8,
+    seckey_len: usize,
+    out_pubkey: *mut u8,
+) -> PlatformWalletFFIResult {
+    check_ptr!(seckey);
+    check_ptr!(out_pubkey);
+
+    let secret_key = unwrap_result_or_return!(parse_secret_key(seckey, seckey_len));
+    let compressed = PublicKey::from_secret_key(&Secp256k1::new(), &secret_key.0).serialize();
+    std::ptr::copy_nonoverlapping(compressed.as_ptr(), out_pubkey, compressed.len());
+    PlatformWalletFFIResult::ok()
+}
+
+/// Derive the raw affine X coordinate of `seckey * pubkey` (unhashed ECDH output).
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_secp256k1_ecdh_shared_x(
+    seckey: *const u8,
+    seckey_len: usize,
+    pubkey: *const u8,
+    pubkey_len: usize,
+    out_shared_x: *mut u8,
+) -> PlatformWalletFFIResult {
+    check_ptr!(seckey);
+    check_ptr!(pubkey);
+    check_ptr!(out_shared_x);
+
+    let secret_key = unwrap_result_or_return!(parse_secret_key(seckey, seckey_len));
+    let public_key = unwrap_result_or_return!(parse_compressed_public_key(pubkey, pubkey_len));
+
+    // `shared_secret_point` uses libsecp256k1's constant-time ECDH path:
+    // the scalar here is the wallet's private ephemeral key and the point
+    // comes from the peer, so the multiplication must not branch on the
+    // secret. Returns `x || y`; DashConnect wants the raw, unhashed X.
+    let shared_point = Zeroizing::new(shared_secret_point(&public_key, &secret_key.0));
+    std::ptr::copy_nonoverlapping(shared_point.as_ptr(), out_shared_x, 32);
+    PlatformWalletFFIResult::ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PRIVATE_KEY_A: [u8; 32] = [0x01; 32];
+    const PRIVATE_KEY_B: [u8; 32] = [0x02; 32];
+    const PUBLIC_KEY_A: [u8; 33] = [
+        0x03, 0x1b, 0x84, 0xc5, 0x56, 0x7b, 0x12, 0x64, 0x40, 0x99, 0x5d, 0x3e, 0xd5, 0xaa, 0xba,
+        0x05, 0x65, 0xd7, 0x1e, 0x18, 0x34, 0x60, 0x48, 0x19, 0xff, 0x9c, 0x17, 0xf5, 0xe9, 0xd5,
+        0xdd, 0x07, 0x8f,
+    ];
+    const PUBLIC_KEY_B: [u8; 33] = [
+        0x02, 0x4d, 0x4b, 0x6c, 0xd1, 0x36, 0x10, 0x32, 0xca, 0x9b, 0xd2, 0xae, 0xb9, 0xd9, 0x00,
+        0xaa, 0x4d, 0x45, 0xd9, 0xea, 0xd8, 0x0a, 0xc9, 0x42, 0x33, 0x74, 0xc4, 0x51, 0xa7, 0x25,
+        0x4d, 0x07, 0x66,
+    ];
+    const SHARED_X_AB: [u8; 32] = [
+        0xd0, 0x15, 0x8a, 0x38, 0xfa, 0xf6, 0x11, 0x8a, 0xf1, 0x33, 0xaf, 0x12, 0xd9, 0xbf, 0xa3,
+        0x88, 0xea, 0xb4, 0xa0, 0x8d, 0x1a, 0x20, 0x88, 0xea, 0x6e, 0x6e, 0xc1, 0x26, 0x9e, 0x03,
+        0x56, 0x7f,
+    ];
+
+    #[test]
+    fn compressed_public_key_matches_known_vector() {
+        let mut out = [0u8; 33];
+        let result = unsafe {
+            platform_wallet_secp256k1_compressed_public_key(
+                PRIVATE_KEY_A.as_ptr(),
+                PRIVATE_KEY_A.len(),
+                out.as_mut_ptr(),
+            )
+        };
+
+        assert_eq!(result.code, PlatformWalletFFIResultCode::Success);
+        assert_eq!(out, PUBLIC_KEY_A);
+    }
+
+    #[test]
+    fn ecdh_shared_x_matches_known_vector() {
+        let mut out = [0u8; 32];
+        let result = unsafe {
+            platform_wallet_secp256k1_ecdh_shared_x(
+                PRIVATE_KEY_A.as_ptr(),
+                PRIVATE_KEY_A.len(),
+                PUBLIC_KEY_B.as_ptr(),
+                PUBLIC_KEY_B.len(),
+                out.as_mut_ptr(),
+            )
+        };
+
+        assert_eq!(result.code, PlatformWalletFFIResultCode::Success);
+        assert_eq!(out, SHARED_X_AB);
+    }
+
+    #[test]
+    fn verify_compressed_point_rejects_invalid_point() {
+        let mut invalid = [0u8; 33];
+        invalid[0] = 0x02;
+        let result = unsafe {
+            platform_wallet_secp256k1_verify_compressed_point(invalid.as_ptr(), invalid.len())
+        };
+
+        assert_eq!(result, 0);
+    }
+
+    #[test]
+    fn verify_compressed_point_accepts_known_vector() {
+        let result = unsafe {
+            platform_wallet_secp256k1_verify_compressed_point(
+                PUBLIC_KEY_A.as_ptr(),
+                PUBLIC_KEY_A.len(),
+            )
+        };
+
+        assert_eq!(result, 1);
+    }
+
+    #[test]
+    fn compressed_public_key_rejects_out_of_range_scalar() {
+        let invalid_scalar = [0xffu8; 32];
+        let mut out = [0u8; 33];
+        let result = unsafe {
+            platform_wallet_secp256k1_compressed_public_key(
+                invalid_scalar.as_ptr(),
+                invalid_scalar.len(),
+                out.as_mut_ptr(),
+            )
+        };
+
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorInvalidParameter
+        );
+    }
+
+    #[test]
+    fn ecdh_rejects_wrong_length_inputs() {
+        let mut out = [0u8; 32];
+        let short_private = [0x01u8; 31];
+        let short_public = [0x02u8; 32];
+
+        let private_error = unsafe {
+            platform_wallet_secp256k1_ecdh_shared_x(
+                short_private.as_ptr(),
+                short_private.len(),
+                PUBLIC_KEY_A.as_ptr(),
+                PUBLIC_KEY_A.len(),
+                out.as_mut_ptr(),
+            )
+        };
+        assert_eq!(
+            private_error.code,
+            PlatformWalletFFIResultCode::ErrorInvalidParameter
+        );
+
+        let public_error = unsafe {
+            platform_wallet_secp256k1_ecdh_shared_x(
+                PRIVATE_KEY_B.as_ptr(),
+                PRIVATE_KEY_B.len(),
+                short_public.as_ptr(),
+                short_public.len(),
+                out.as_mut_ptr(),
+            )
+        };
+        assert_eq!(
+            public_error.code,
+            PlatformWalletFFIResultCode::ErrorInvalidParameter
+        );
+    }
+}
diff --git a/packages/rs-platform-wallet-ffi/src/shielded_send.rs b/packages/rs-platform-wallet-ffi/src/shielded_send.rs
index 8ffe8799559..6e287c7933f 100644
--- a/packages/rs-platform-wallet-ffi/src/shielded_send.rs
+++ b/packages/rs-platform-wallet-ffi/src/shielded_send.rs
@@ -712,10 +712,65 @@ fn catch_spend_panic(
     )
 }
 
-/// Preserve the typed "already consumed" funding report across the FFI
+/// Post-panic guidance for the asset-lock funding exports. Paired with
+/// `ErrorTransactionBroadcastUnconfirmed` in [`catch_funding_panic`].
+const FUNDING_PANIC_GUIDANCE: &str = "The asset lock may or may not have been broadcast — do \
+     NOT retry; the funding UTXOs stay reserved, and the reservation TTL or the next sync \
+     reconciles the outcome (a tracked lock resumes via the resume entry point).";
+
+/// [`catch_panic_to_code`] specialized for the asset-lock funding exports.
+///
+/// The panic is mapped to
+/// [`PlatformWalletFFIResultCode::ErrorTransactionBroadcastUnconfirmed`], NOT to a definitive
+/// failure code: a panic can strike after the asset-lock transaction reached the wire (broadcast
+/// precedes the ChainLock wait, the Platform submit, and the note bookkeeping), so the outcome
+/// is genuinely ambiguous. That code's contract is exactly the conservative one this needs — the
+/// host must not auto-retry, the funding UTXOs' reservation is still held (`ReservationToken` is
+/// a plain id, not a drop-release guard, so the unwind does not free it and an immediate retry
+/// fails at input selection instead of double-spending), and the reservation TTL or a sync
+/// observing the transaction reconciles the outcome; a tracked lock is resumable through
+/// `platform_wallet_manager_shielded_resume_fund_from_asset_lock`.
+fn catch_funding_panic(
+    operation: &str,
+    body: impl FnOnce() -> PlatformWalletFFIResult,
+) -> PlatformWalletFFIResult {
+    catch_panic_to_code(
+        operation,
+        PlatformWalletFFIResultCode::ErrorTransactionBroadcastUnconfirmed,
+        FUNDING_PANIC_GUIDANCE,
+        body,
+    )
+}
+
+/// Preserve the typed funding reports that hosts branch on across the FFI
 /// boundary while keeping every other funding failure on the existing generic
-/// error path. The wallet retains nonterminal consumption-unknown state; the
-/// host must not interpret this code as authenticated completion.
+/// error path.
+///
+/// Both preserved variants reach their dedicated code through the blanket
+/// `From<PlatformWalletError> for PlatformWalletFFIResult` impl in
+/// [`crate::error`], so `e.into()` also carries each typed `Display`
+/// rendering verbatim — the structured figures ride the message string or
+/// not at all (`PlatformWalletFFIResult` is ABI-frozen at code + message).
+///
+/// - `AssetLockAlreadyConsumed` -> `ErrorAssetLockAlreadyConsumed` (24). The
+///   wallet retains nonterminal consumption-unknown state; the host must not
+///   interpret this code as authenticated completion.
+/// - `AssetLockInsufficientFunds` -> `ErrorAssetLockInsufficientFunds` (29).
+///   Coin selection came up short over the permitted funding set, so nothing
+///   was built or broadcast and no funding output was consumed; the host may
+///   re-run preflight and retry. Recovery depends on which funding form
+///   raised it, and BOTH reach this one code: an exact-amount build
+///   (`AssetLockFunding::FromWalletBalance`) can be re-confirmed at a smaller
+///   amount, but the whole-account CoinJoin *drain* takes no amount argument
+///   at all — there is nothing to lower. A drain shortfall means the account's
+///   drainable balance sits under the required minimum lock floor, so the
+///   host's only remedies are to add funds to that account or lower the
+///   floor. Do not surface "try a smaller amount" for the drain form.
+///
+///   Without this arm the shortfall flattened into the generic
+///   `ErrorWalletOperation` (6) catch-all below, hiding a typed error behind
+///   the code every unclassified failure already uses and forcing hosts back
+///   to substring-matching the Display text.
 fn map_asset_lock_funding_result(
     result: Result<(), PlatformWalletError>,
     operation: &str,
@@ -723,6 +778,7 @@ fn map_asset_lock_funding_result(
     match result {
         Ok(()) => PlatformWalletFFIResult::ok(),
         Err(e @ PlatformWalletError::AssetLockAlreadyConsumed(_)) => e.into(),
+        Err(e @ PlatformWalletError::AssetLockInsufficientFunds { .. }) => e.into(),
         Err(e) => PlatformWalletFFIResult::err(
             PlatformWalletFFIResultCode::ErrorWalletOperation,
             format!("{operation} failed: {e}"),
@@ -1402,6 +1458,38 @@ pub unsafe extern "C" fn platform_wallet_manager_shielded_fund_from_asset_lock_c
     account_index: u32,
     recipient_raw_43: *const u8,
     core_signer_handle: *mut MnemonicResolverHandle,
+) -> PlatformWalletFFIResult {
+    // The whole body runs under `catch_unwind`: a panic (most concretely `block_on_worker`'s
+    // `.expect` on a panicking funding/proving task) must NOT reach this `extern "C"` frame,
+    // where it would abort the process instead of surfacing to the host as a typed error — on
+    // Android that abort strikes before the JNI layer's `support::guard`, which sits on the far
+    // side of this export. A panic can land after the whole-account lock was broadcast, so the
+    // ambiguous broadcast-unconfirmed contract applies (the same code the flow's own
+    // ambiguous-outcome errors use); the host resumes a tracked lock via
+    // `platform_wallet_manager_shielded_resume_fund_from_asset_lock` rather than re-draining.
+    catch_funding_panic("shielded CoinJoin-drain fund-from-asset-lock", || {
+        shielded_fund_from_asset_lock_coinjoin_drain_inner(
+            handle,
+            wallet_id_bytes,
+            account_index,
+            recipient_raw_43,
+            core_signer_handle,
+        )
+    })
+}
+
+/// Body of [`platform_wallet_manager_shielded_fund_from_asset_lock_coinjoin_drain`], as an
+/// ordinary Rust function so a panic unwinds into [`catch_funding_panic`] instead of across
+/// the C ABI.
+///
+/// # Safety
+/// Identical contract to the export that calls it.
+unsafe fn shielded_fund_from_asset_lock_coinjoin_drain_inner(
+    handle: Handle,
+    wallet_id_bytes: *const u8,
+    account_index: u32,
+    recipient_raw_43: *const u8,
+    core_signer_handle: *mut MnemonicResolverHandle,
 ) -> PlatformWalletFFIResult {
     check_ptr!(wallet_id_bytes);
     check_ptr!(recipient_raw_43);
@@ -2141,6 +2229,35 @@ mod tests {
         );
     }
 
+    /// A panic inside the CoinJoin-drain funding export must NOT unwind into the `extern "C"`
+    /// frame (that aborts the Android process before the JNI layer's own guard can translate it
+    /// into a Java exception). It becomes `ErrorTransactionBroadcastUnconfirmed` — the
+    /// conservative "may already be on the wire, do NOT retry" contract — because a panic can
+    /// strike after the whole-account lock was broadcast. Same panic-hook note as the spend
+    /// sibling above.
+    #[test]
+    fn catch_funding_panic_maps_a_panic_to_the_broadcast_unconfirmed_contract() {
+        let result = catch_funding_panic("shielded CoinJoin-drain fund-from-asset-lock", || {
+            panic!("tokio worker panicked");
+        });
+
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorTransactionBroadcastUnconfirmed,
+            "a funding panic must map to the ambiguous, do-not-retry code"
+        );
+        let message = message_of(&result);
+        assert!(
+            message.contains("shielded CoinJoin-drain fund-from-asset-lock panicked")
+                && message.contains("tokio worker panicked"),
+            "the panic payload must survive into the FFI message: {message}"
+        );
+        assert!(
+            message.contains("do NOT retry"),
+            "the message must carry the do-not-retry guidance: {message}"
+        );
+    }
+
     /// `map_spend_result` pins the retry-relevant code split the three spend
     /// entry points depend on:
     /// - `ShieldedSpendUnconfirmed` → `ErrorShieldedSpendUnconfirmed` (host
@@ -2276,7 +2393,7 @@ mod tests {
     }
 
     #[test]
-    fn map_asset_lock_funding_result_preserves_already_consumed_code_only() {
+    fn map_asset_lock_funding_result_preserves_typed_funding_codes() {
         let out_point = dashcore::OutPoint {
             txid: dashcore::Txid::all_zeros(),
             vout: 7,
@@ -2305,4 +2422,68 @@ mod tests {
             PlatformWalletFFIResultCode::Success
         );
     }
+
+    /// The asset-lock coin-selection shortfall must reach hosts as the
+    /// dedicated `ErrorAssetLockInsufficientFunds` (29) through THIS entry
+    /// point — `platform_wallet_manager_shielded_fund_from_asset_lock`, the
+    /// exact-amount funding form, whose whole result path is this helper.
+    /// The blanket `From` impl has always produced 29
+    /// (`error::tests::asset_lock_insufficient_funds_maps_to_dedicated_code`),
+    /// but the helper's catch-all used to flatten the variant to
+    /// `ErrorWalletOperation` (6) before it ever got there, so the typed code
+    /// never actually crossed the boundary on this call. Kotlin already
+    /// mirrors 29 as
+    /// `DashSdkError.PlatformWallet.AssetLockInsufficientFunds`
+    /// (`DashSdkError.kt`) — this pins the Rust side that feeds it.
+    #[test]
+    fn map_asset_lock_funding_result_preserves_shortfall_code_29() {
+        let err = PlatformWalletError::AssetLockInsufficientFunds {
+            available: 18_000_000,
+            required: 100_000_000,
+        };
+        let rendered = err.to_string();
+        let result = map_asset_lock_funding_result(Err(err), "shielded fund-from-asset-lock");
+
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorAssetLockInsufficientFunds,
+            "must not flatten into the generic ErrorWalletOperation catch-all \
+             (rendered: {rendered})"
+        );
+        assert_ne!(
+            result.code as i32,
+            PlatformWalletFFIResultCode::ErrorWalletOperation as i32
+        );
+        // The number, not the name, is what Swift/Kotlin mirror by hand.
+        assert_eq!(result.code as i32, 29);
+
+        // The structured available/required duffs have no out-params, so they
+        // only survive if the arm hands the typed error to the blanket impl
+        // verbatim instead of re-wrapping it behind an operation prefix.
+        assert_eq!(
+            message_of(&result),
+            rendered,
+            "structured available/required duffs must cross the boundary verbatim"
+        );
+        assert!(message_of(&result).contains("asset lock coin selection is short"));
+    }
+
+    /// The resume sibling shares the helper, so the shortfall stays typed on
+    /// `platform_wallet_manager_shielded_resume_fund_from_asset_lock` too — a
+    /// host must not have to classify the same failure two different ways
+    /// depending on which funding entry point it came in through.
+    #[test]
+    fn map_asset_lock_funding_result_shortfall_is_typed_on_resume_too() {
+        let result = map_asset_lock_funding_result(
+            Err(PlatformWalletError::AssetLockInsufficientFunds {
+                available: 0,
+                required: 100_000_000,
+            }),
+            "shielded resume fund-from-asset-lock",
+        );
+        assert_eq!(
+            result.code,
+            PlatformWalletFFIResultCode::ErrorAssetLockInsufficientFunds
+        );
+    }
 }
diff --git a/packages/rs-platform-wallet-ffi/src/tracked_masternode.rs b/packages/rs-platform-wallet-ffi/src/tracked_masternode.rs
index 2d93ab52d67..7f51820e6fe 100644
--- a/packages/rs-platform-wallet-ffi/src/tracked_masternode.rs
+++ b/packages/rs-platform-wallet-ffi/src/tracked_masternode.rs
@@ -1,7 +1,7 @@
 //! FFI for tracked (wallet-independent) masternodes: track / untrack /
 //! rename, list, refresh, capabilities, and withdraw with a host-supplied
 //! key. Thin marshalling over `platform_wallet::masternode::tracked`; the
-//! records reuse [`MasternodeEntryFFI`] (`source == 1`) so hosts render
+//! records reuse [`MasternodeEntryV2FFI`] (`source == 1`) so hosts render
 //! wallet and tracked masternodes with the same code.
 
 use std::ffi::{c_char, CStr};
@@ -11,7 +11,7 @@ use platform_wallet::masternode::{
     capabilities_for_roles, LocatorSecret, MasternodeKeyRole, MasternodeRecord,
 };
 
-use crate::core_wallet_types::{masternode_entry_ffi, MasternodeEntryFFI};
+use crate::core_wallet_types::{masternode_entry_v2_ffi, MasternodeEntryV2FFI};
 use crate::error::*;
 use crate::handle::*;
 use crate::runtime::block_on_worker;
@@ -37,12 +37,12 @@ unsafe fn optional_string(ptr: *const c_char) -> Result<Option<String>, Platform
 unsafe fn write_records(
     records: Vec<MasternodeRecord>,
     network: dashcore::Network,
-    out_entries: *mut *const MasternodeEntryFFI,
+    out_entries: *mut *const MasternodeEntryV2FFI,
     out_count: *mut usize,
 ) {
-    let entries: Vec<MasternodeEntryFFI> = records
+    let entries: Vec<MasternodeEntryV2FFI> = records
         .iter()
-        .map(|record| masternode_entry_ffi(record, network))
+        .map(|record| masternode_entry_v2_ffi(record, network))
         .collect();
     let count = entries.len();
     if count == 0 {
@@ -59,7 +59,7 @@ unsafe fn write_records(
 /// the current masternode list when available — local, no network; call
 /// [`platform_wallet_manager_refresh_tracked_masternode`] afterwards for the
 /// Platform / registration details. Returns the new record as a one-entry
-/// array (free with `platform_wallet_manager_free_masternodes`).
+/// array (free with `platform_wallet_manager_free_masternodes_v2`).
 ///
 /// Whether the row survives a restart depends on the configured persister —
 /// see `PLATFORM_WALLET_PERSISTENCE_CAPABILITY_TRACKED_MASTERNODES`.
@@ -74,7 +74,7 @@ pub unsafe extern "C" fn platform_wallet_manager_track_masternode(
     manager_handle: Handle,
     pro_tx_hash: *const u8,
     label: *const c_char,
-    out_entry: *mut *const MasternodeEntryFFI,
+    out_entry: *mut *const MasternodeEntryV2FFI,
     out_count: *mut usize,
 ) -> PlatformWalletFFIResult {
     check_ptr!(pro_tx_hash);
@@ -153,18 +153,18 @@ pub unsafe extern "C" fn platform_wallet_manager_set_tracked_masternode_label(
     PlatformWalletFFIResult::ok()
 }
 
-/// Every tracked masternode as a [`MasternodeEntryFFI`] (`source == 1`,
+/// Every tracked masternode as a [`MasternodeEntryV2FFI`] (`source == 1`,
 /// `label` set when named), with its status resolved against the CURRENT
 /// masternode list (Active / Inactive / Retired, `Unknown` while the list
 /// is unavailable). Sorted by when they were tracked. Free with
-/// [`crate::wallet::platform_wallet_manager_free_masternodes`].
+/// [`crate::wallet::platform_wallet_manager_free_masternodes_v2`].
 ///
 /// # Safety
 /// `out_entries` / `out_count` must be writable.
 #[no_mangle]
 pub unsafe extern "C" fn platform_wallet_manager_list_tracked_masternodes(
     manager_handle: Handle,
-    out_entries: *mut *const MasternodeEntryFFI,
+    out_entries: *mut *const MasternodeEntryV2FFI,
     out_count: *mut usize,
 ) -> PlatformWalletFFIResult {
     check_ptr!(out_entries);
@@ -188,7 +188,7 @@ pub unsafe extern "C" fn platform_wallet_manager_list_tracked_masternodes(
 /// keys). Blocks on the network round-trips. Partial results are kept and
 /// persisted even when a step fails (the error is still returned). On
 /// success returns the refreshed record as a one-entry array (free with
-/// `platform_wallet_manager_free_masternodes`).
+/// `platform_wallet_manager_free_masternodes_v2`).
 ///
 /// # Safety
 /// `pro_tx_hash` must point at 32 readable bytes; `out_entry` / `out_count`
@@ -197,7 +197,7 @@ pub unsafe extern "C" fn platform_wallet_manager_list_tracked_masternodes(
 pub unsafe extern "C" fn platform_wallet_manager_refresh_tracked_masternode(
     manager_handle: Handle,
     pro_tx_hash: *const u8,
-    out_entry: *mut *const MasternodeEntryFFI,
+    out_entry: *mut *const MasternodeEntryV2FFI,
     out_count: *mut usize,
 ) -> PlatformWalletFFIResult {
     check_ptr!(pro_tx_hash);
@@ -342,7 +342,7 @@ mod tests {
     #[test]
     fn unknown_handles_are_invalid_handles() {
         let hash = [0u8; 32];
-        let mut entries: *const MasternodeEntryFFI = std::ptr::null();
+        let mut entries: *const MasternodeEntryV2FFI = std::ptr::null();
         let mut count = 5usize;
         let mut r = unsafe {
             platform_wallet_manager_track_masternode(
diff --git a/packages/rs-platform-wallet-ffi/src/wallet.rs b/packages/rs-platform-wallet-ffi/src/wallet.rs
index 49639627fe2..b27125b65da 100644
--- a/packages/rs-platform-wallet-ffi/src/wallet.rs
+++ b/packages/rs-platform-wallet-ffi/src/wallet.rs
@@ -256,6 +256,60 @@ pub unsafe extern "C" fn platform_wallet_manager_list_masternodes(
     PlatformWalletFFIResult::ok()
 }
 
+/// Version 2 of [`platform_wallet_manager_list_masternodes`]. It returns
+/// [`MasternodeEntryV2FFI`](crate::core_wallet_types::MasternodeEntryV2FFI),
+/// which adds record provenance and an optional tracked-node label without
+/// changing the frozen V1 array element size.
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_manager_list_masternodes_v2(
+    manager_handle: Handle,
+    wallet_id: *const u8,
+    out_entries: *mut *const crate::core_wallet_types::MasternodeEntryV2FFI,
+    out_count: *mut usize,
+) -> PlatformWalletFFIResult {
+    check_ptr!(wallet_id);
+    check_ptr!(out_entries);
+    check_ptr!(out_count);
+    *out_entries = std::ptr::null();
+    *out_count = 0;
+
+    let wid: [u8; 32] = std::ptr::read(wallet_id as *const [u8; 32]);
+    let option = PLATFORM_WALLET_MANAGER_STORAGE.with_item(manager_handle, |manager| {
+        manager.wallet_masternodes_blocking(&wid)
+    });
+    let inner = unwrap_option_or_return!(option);
+    let masternodes = unwrap_option_or_return!(inner);
+
+    let entries: Vec<crate::core_wallet_types::MasternodeEntryV2FFI> = masternodes
+        .records
+        .iter()
+        .map(|mn| crate::core_wallet_types::masternode_entry_v2_ffi(mn, masternodes.network))
+        .collect();
+    let count = entries.len();
+    if count == 0 {
+        return PlatformWalletFFIResult::ok();
+    }
+
+    *out_entries = Box::into_raw(entries.into_boxed_slice()) as *const _;
+    *out_count = count;
+    PlatformWalletFFIResult::ok()
+}
+
+unsafe fn free_masternode_entry_strings(entry: &crate::core_wallet_types::MasternodeEntryFFI) {
+    for ptr in [
+        entry.service_address,
+        entry.owner_address,
+        entry.voting_address,
+        entry.payout_address,
+        entry.operator_pseudo_address,
+        entry.platform_node_address,
+    ] {
+        if !ptr.is_null() {
+            let _ = std::ffi::CString::from_raw(ptr);
+        }
+    }
+}
+
 /// Free an array returned by [`platform_wallet_manager_list_masternodes`],
 /// including each entry's heap C strings.
 #[no_mangle]
@@ -268,18 +322,27 @@ pub unsafe extern "C" fn platform_wallet_manager_free_masternodes(
     }
     let slice = std::slice::from_raw_parts_mut(entries, count);
     for entry in slice.iter() {
-        for ptr in [
-            entry.service_address,
-            entry.owner_address,
-            entry.voting_address,
-            entry.payout_address,
-            entry.operator_pseudo_address,
-            entry.platform_node_address,
-            entry.label,
-        ] {
-            if !ptr.is_null() {
-                let _ = std::ffi::CString::from_raw(ptr);
-            }
+        free_masternode_entry_strings(entry);
+    }
+    let _ = Box::from_raw(std::ptr::slice_from_raw_parts_mut(entries, count));
+}
+
+/// Free an array returned by
+/// [`platform_wallet_manager_list_masternodes_v2`] or any tracked-masternode
+/// API returning `MasternodeEntryV2FFI`.
+#[no_mangle]
+pub unsafe extern "C" fn platform_wallet_manager_free_masternodes_v2(
+    entries: *mut crate::core_wallet_types::MasternodeEntryV2FFI,
+    count: usize,
+) {
+    if entries.is_null() || count == 0 {
+        return;
+    }
+    let slice = std::slice::from_raw_parts_mut(entries, count);
+    for entry in slice.iter() {
+        free_masternode_entry_strings(&entry.v1);
+        if !entry.label.is_null() {
+            let _ = std::ffi::CString::from_raw(entry.label);
         }
     }
     let _ = Box::from_raw(std::ptr::slice_from_raw_parts_mut(entries, count));
diff --git a/packages/rs-platform-wallet-storage/SCHEMA.md b/packages/rs-platform-wallet-storage/SCHEMA.md
index 0c8402e6f90..1f4729b9958 100644
--- a/packages/rs-platform-wallet-storage/SCHEMA.md
+++ b/packages/rs-platform-wallet-storage/SCHEMA.md
@@ -28,6 +28,8 @@ Schema evolution is version-gated by refinery. Every read-write connection turns
 - **`wallet_id`-scoped meta** (`meta_wallet`, `meta_contact`, `meta_platform_address`) carries a `wallet_id` column, so `cascade_meta_on_wallet_delete` brooms it directly — regardless of the lifecycle state of any typed parent and even for rows written ahead of (or without) a typed parent.
 - **identity-scoped meta** (`meta_identity`, `meta_token`) carries no `wallet_id` — only `identity_id` (+ `token_id`). It is cleaned by `cascade_meta_on_identity_delete` (AFTER DELETE ON `identities`), which fires for the wallet's own identities when the FK cascade removes them on a wallet delete.
 
+Deleting an `identities` row — on its own, or cascaded from a wallet delete — additionally fires `cascade_children_on_identity_delete` (V015), which brooms `identity_keys`, `contacts`, and `ignored_senders` by the deleted `identity_id`. That trigger exists because no live foreign key reaches those rows in every case: `identity_keys`' FK to `identities` is compound (`wallet_id, identity_id`), and SQLite's default MATCH SIMPLE skips FK enforcement entirely once ANY column of the child key is NULL, leaving it dormant for an out-of-wallet identity; `contacts` and `ignored_senders` are keyed by `owner_id` (an identity id) but carry no FK to `identities` at all. Keying the broom on `identity_id` alone covers the wallet-owned case too, as an idempotent overlap with the live cascade.
+
 ### Orphan metadata and future garbage collection
 
 Any `meta_*` row whose parent object does not exist — because it was never created, or because it was removed via a path the cascade does not cover — may persist indefinitely. This is an accepted limitation that applies to all metadata types and scopes. Examples:
@@ -122,7 +124,6 @@ erDiagram
         BLOB wallet_id FK "NULL = orphan identity (no parent wallet yet)"
         INTEGER identity_index "BIP-32 index; NULL for out-of-wallet identities"
         BLOB entry_blob "bincode-encoded IdentityEntry"
-        INTEGER tombstoned "0 | 1 (logical delete)"
     }
 
     IDENTITY_KEYS {
@@ -419,8 +420,18 @@ until a ChainLock has been applied and flushed.
 
 Platform identities, wallet-parented or orphan. `wallet_id` is nullable:
 NULL means the identity was written before a parent wallet was registered
-(orphan-to-parented promotion via COALESCE on upsert). `tombstoned = 1`
-marks a logical delete; the row is retained for cascade integrity.
+(orphan-to-parented promotion via COALESCE on upsert).
+
+Removal (`IdentityChangeSet.removed`) is a physical `DELETE`, scoped to
+the flush wallet, and it is terminal: every dependent row goes with it
+(see [How integrity is kept](#how-integrity-is-kept)), so re-adding the
+same `identity_id` later starts from a blank identity rather than
+inheriting the removed one's keys, contacts, or balances. The writer runs
+in two halves for this reason — `apply_upserts` sits with the other
+identity writers, `apply_removals` runs last in the transaction, after
+every identity-scoped child writer, so a changeset carrying both an
+upsert and a removal for one identity commits instead of pulling the FK
+parent out from under its own child inserts.
 
 - PK: `identity_id`.
 - FK: `wallet_id → wallets(wallet_id) ON DELETE CASCADE` (nullable).
@@ -437,7 +448,8 @@ reserved column for a future typed projection and is always NULL today
 
 - PK: `(wallet_id, identity_id, key_id)`.
 - FK: `wallet_id → wallets(wallet_id) ON DELETE CASCADE`.
-- FK: `identity_id → identities(identity_id) ON DELETE CASCADE`.
+- FK: `(wallet_id, identity_id) → identities(wallet_id, identity_id) ON DELETE CASCADE` — dormant under MATCH SIMPLE when `wallet_id` is NULL.
+- Trigger cleanup: `cascade_children_on_identity_delete` brooms by `identity_id`, closing the dormant case.
 - Index: `idx_identity_keys_wallet_identity(wallet_id, identity_id)`.
 
 ### `contacts`
@@ -454,6 +466,8 @@ bincode-encoded `Vec<u32>`.
 
 - PK: `(wallet_id, owner_id, contact_id)`.
 - FK: `wallet_id → wallets(wallet_id) ON DELETE CASCADE`.
+- Trigger cleanup: `cascade_children_on_identity_delete` brooms by `owner_id` — there is no FK to `identities`.
+- Index: `idx_contacts_owner(owner_id)`, the broom's access path (`owner_id` is not the leading PK column).
 - `state` CHECK: sourced from `sqlite::schema::contacts::CONTACT_STATE_LABELS`.
 
 ### `ignored_senders`
@@ -464,6 +478,8 @@ deleted; `ignored_at` records when the mute was applied.
 
 - PK: `(wallet_id, owner_id, sender_id)`.
 - FK: `wallet_id → wallets(wallet_id) ON DELETE CASCADE`.
+- Trigger cleanup: `cascade_children_on_identity_delete` brooms by `owner_id` — there is no FK to `identities`.
+- Index: `idx_ignored_senders_owner(owner_id)`, the broom's access path.
 - No enum-domain CHECK column.
 
 ### `platform_addresses`
@@ -698,3 +714,4 @@ having to grep this repo.
 | V008 | `V008__shielded_viewing_keys.rs` | Adds `shielded_viewing_keys` to persist Orchard full viewing keys by wallet and shielded account. |
 | V009 | `V009__single_source_core_confirmation_height.rs` | Rebuilds `core_transactions` with nullable `record_blob` for height-only rows, preserves existing transaction metadata and blobs, and drops `core_utxos.height` so UTXO confirmation height has one authority (#4178). |
 | V012 | `V012__purge_legacy_empty_script_spent_utxos.rs` | Deletes legacy `core_utxos` rows matching `spent = 1 AND length(script) = 0`, left by a producer that fabricated an empty script for a spend of an output the wallet never recorded. One such row rejects the load of the whole file, since `load_used_addresses` decodes every stored script with no load-policy escape hatch. Balance-neutral: the balance readers select `spent = 0` only. |
+| V015 | `V015__identity_hard_delete.rs` | Retires identity tombstoning. Adds `cascade_children_on_identity_delete` (brooms `identity_keys` / `contacts` / `ignored_senders` by the deleted `identity_id`, covering the rows no live FK reaches) plus its access-path indexes `idx_contacts_owner` and `idx_ignored_senders_owner`; purges every already-tombstoned identity and its dependents; drops `identities.tombstoned`. |
diff --git a/packages/rs-platform-wallet-storage/migrations/V003__unified.rs b/packages/rs-platform-wallet-storage/migrations/V003__unified.rs
index 08584c553a8..def1dcffe22 100644
--- a/packages/rs-platform-wallet-storage/migrations/V003__unified.rs
+++ b/packages/rs-platform-wallet-storage/migrations/V003__unified.rs
@@ -38,6 +38,14 @@
 //! No MAC column ships here — manifest authentication is deferred out of
 //! this workstream (dev-plan §7).
 
+// INTENTIONAL(account-type-unconstrained): `core_address_pool.account_type`
+// is plain `TEXT NOT NULL` with no `CHECK` allow-list. A constraint was
+// considered and deferred as low-priority defence-in-depth — the column is
+// written only from a closed Rust enum's own label, never from user input,
+// and the readers reject an unknown label anyway. Deliberately NOT added
+// inside the SQL below: this migration is already applied in the field, and
+// editing a rendered body is the schema-drift alarm `sqlite_schema_pinning`
+// exists to raise. A future CHECK belongs in a new migration.
 pub fn migration() -> String {
     "\
 CREATE TABLE core_address_pool (
diff --git a/packages/rs-platform-wallet-storage/migrations/V014__identity_keys_null_scope_requires_existing_identity.rs b/packages/rs-platform-wallet-storage/migrations/V014__identity_keys_null_scope_requires_existing_identity.rs
new file mode 100644
index 00000000000..422aa64bbad
--- /dev/null
+++ b/packages/rs-platform-wallet-storage/migrations/V014__identity_keys_null_scope_requires_existing_identity.rs
@@ -0,0 +1,52 @@
+//! Close the asymmetry in the `identity_keys` NULL-scope guard.
+//!
+//! V001's trigger pair aborts a NULL-scoped key whose identity is
+//! wallet-owned, but accepts one naming an identity that does not exist at
+//! all — `EXISTS(... AND wallet_id IS NOT NULL)` is false for a missing row
+//! just as it is for an unowned one. SQLite's MATCH SIMPLE leaves both of
+//! the table's foreign keys dormant whenever any child-key column is NULL,
+//! so nothing else constrains a NULL-scoped row either: the triggers are
+//! the whole guard, and that gap admits a key belonging to no identity.
+//!
+//! The condition is inverted to require the named identity to exist AND be
+//! unowned, which covers the wallet-owned case the original caught and the
+//! missing-identity case it did not.
+//!
+//! Recreated rather than edited into V001: refinery never re-runs an
+//! applied migration, so editing V001 would tighten only freshly created
+//! databases and leave every existing wallet on the permissive trigger.
+//! `V007__drop_core_utxo_metadata` sets the same precedent.
+//!
+//! The UPDATE twin is as load-bearing as the INSERT one — the writer's
+//! upsert resolves an existing key to `DO UPDATE`, and an UPDATE never
+//! fires a BEFORE INSERT trigger — so both move together.
+
+pub fn migration() -> String {
+    "\
+DROP TRIGGER identity_keys_null_scope_requires_unowned_identity;
+DROP TRIGGER identity_keys_null_scope_requires_unowned_identity_on_update;
+
+CREATE TRIGGER identity_keys_null_scope_requires_unowned_identity
+BEFORE INSERT ON identity_keys
+FOR EACH ROW WHEN NEW.wallet_id IS NULL
+BEGIN
+    SELECT RAISE(ABORT, 'identity_keys.wallet_id is NULL but the named identity is missing or wallet-owned')
+    WHERE NOT EXISTS (
+        SELECT 1 FROM identities i
+        WHERE i.identity_id = NEW.identity_id AND i.wallet_id IS NULL
+    );
+END;
+
+CREATE TRIGGER identity_keys_null_scope_requires_unowned_identity_on_update
+BEFORE UPDATE ON identity_keys
+FOR EACH ROW WHEN NEW.wallet_id IS NULL
+BEGIN
+    SELECT RAISE(ABORT, 'identity_keys.wallet_id is NULL but the named identity is missing or wallet-owned')
+    WHERE NOT EXISTS (
+        SELECT 1 FROM identities i
+        WHERE i.identity_id = NEW.identity_id AND i.wallet_id IS NULL
+    );
+END;
+"
+    .to_string()
+}
diff --git a/packages/rs-platform-wallet-storage/migrations/V015__identity_hard_delete.rs b/packages/rs-platform-wallet-storage/migrations/V015__identity_hard_delete.rs
new file mode 100644
index 00000000000..01cbab17cc2
--- /dev/null
+++ b/packages/rs-platform-wallet-storage/migrations/V015__identity_hard_delete.rs
@@ -0,0 +1,69 @@
+//! Retire identity tombstoning: a removed identity is deleted outright.
+//!
+//! The `tombstoned` flag kept a logically-deleted row on disk so its
+//! dependents were not wiped, at the cost of a permanent divergence: the
+//! in-memory `IdentityManager` drops the whole `ManagedIdentity` on
+//! removal, so a re-added identity was empty in memory while the next
+//! `load()` handed it the removed one's keys back.
+//!
+//! Deleting the row instead needs a broom for the dependents no foreign
+//! key reaches:
+//!
+//! - `identity_keys`' FK to `identities` is compound
+//!   (`wallet_id, identity_id`), and SQLite's MATCH SIMPLE skips FK
+//!   enforcement entirely once ANY child key column is NULL — so for an
+//!   out-of-wallet identity (`wallet_id IS NULL` on both sides) the
+//!   cascade is dormant and its keys would survive the delete.
+//! - `contacts` and `ignored_senders` are keyed by `owner_id` (an
+//!   identity id) but carry no FK to `identities` at all, only to
+//!   `wallets`. Left behind, they surface at load time as
+//!   `OrphanedIdentityEntry` and fail the whole wallet's `load()`.
+//!
+//! `token_balances`, `dashpay_profiles` and `dashpay_payments_overlay`
+//! need nothing new: their FK column is `identity_id NOT NULL`, so it is
+//! never dormant. `meta_identity` / `meta_token` keep riding V001's
+//! `cascade_meta_on_identity_delete`, which this migration leaves alone.
+
+pub fn migration() -> String {
+    "\
+CREATE TRIGGER cascade_children_on_identity_delete
+AFTER DELETE ON identities
+FOR EACH ROW
+BEGIN
+    DELETE FROM identity_keys   WHERE identity_id = OLD.identity_id;
+    DELETE FROM contacts        WHERE owner_id    = OLD.identity_id;
+    DELETE FROM ignored_senders WHERE owner_id    = OLD.identity_id;
+END;
+
+-- The broom's access path. `owner_id` is the SECOND column of each
+-- table's primary key, so an `owner_id`-only predicate cannot use it:
+-- without these indexes a wallet delete scans both tables once per
+-- cascaded identity.
+CREATE INDEX idx_contacts_owner ON contacts(owner_id);
+CREATE INDEX idx_ignored_senders_owner ON ignored_senders(owner_id);
+
+-- Purge what earlier schemas only flagged. Spelled out per table rather
+-- than left to the cascade and the trigger above, so the outcome does
+-- not depend on the migrating connection's `foreign_keys` pragma.
+DELETE FROM identity_keys
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM contacts
+    WHERE owner_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM ignored_senders
+    WHERE owner_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM token_balances
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM dashpay_profiles
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM dashpay_payments_overlay
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM meta_identity
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM meta_token
+    WHERE identity_id IN (SELECT identity_id FROM identities WHERE tombstoned = 1);
+DELETE FROM identities WHERE tombstoned = 1;
+
+ALTER TABLE identities DROP COLUMN tombstoned;
+"
+    .to_string()
+}
diff --git a/packages/rs-platform-wallet-storage/src/secrets/file/mod.rs b/packages/rs-platform-wallet-storage/src/secrets/file/mod.rs
index ba68e9c1b4a..077bad77ed7 100644
--- a/packages/rs-platform-wallet-storage/src/secrets/file/mod.rs
+++ b/packages/rs-platform-wallet-storage/src/secrets/file/mod.rs
@@ -778,6 +778,11 @@ fn do_write_vault_at(
     // ([`EncryptedFileStore::durability_uncertain_count`]).
     #[cfg(unix)]
     {
+        // INTENTIONAL(fsync-parent-dir-tolerant): a failed parent-dir fsync
+        // warns and counts instead of failing the write. Accepted risk: the
+        // vault's own fsync+rename already put the data on disk, so only the
+        // directory entry's durability across power loss is unconfirmed —
+        // surfaced to callers via `durability_uncertain_count()`.
         let signal_unconfirmed = |e: &std::io::Error| {
             tracing::warn!(
                 error = %e,
diff --git a/packages/rs-platform-wallet-storage/src/secrets/store.rs b/packages/rs-platform-wallet-storage/src/secrets/store.rs
index 1c11ef09532..a1b481d7174 100644
--- a/packages/rs-platform-wallet-storage/src/secrets/store.rs
+++ b/packages/rs-platform-wallet-storage/src/secrets/store.rs
@@ -328,6 +328,13 @@ impl SecretStore {
                 })
             }
             Self::Os(_) => {
+                // INTENTIONAL(keyring-reprotect-non-atomic): the OS keyring
+                // exposes no compare-and-swap, so this get-then-set is not
+                // atomic. Accepted residual: a crash between the two leaves
+                // the entry under the OLD passphrase (the set never landed),
+                // and a concurrent writer's value can be overwritten. The
+                // File arm gets atomicity from its own rename; there is no
+                // equivalent primitive to borrow here.
                 let Some(secret) = self.get_secret(service, label, current)? else {
                     return Err(SecretStoreError::NoEntry);
                 };
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/backup.rs b/packages/rs-platform-wallet-storage/src/sqlite/backup.rs
index 397cfdfd574..0139d510bec 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/backup.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/backup.rs
@@ -426,6 +426,12 @@ pub fn restore_from(dest_db_path: &Path, src_backup: &Path) -> Result<(), Wallet
     //    use `OsString::push` so non-UTF-8 bytes round-trip; `NotFound` is a
     //    silent no-op. The lock conn was dropped in step 7 for cross-platform
     //    unlink semantics.
+    //    INTENTIONAL(wal-shm-cleanup-race): this unlink shares the
+    //    lock-release-before-rename trade-off documented on this function. A
+    //    peer that opened the old database still holds its own descriptors,
+    //    so under POSIX these unlinks just detach the names — the peer reads
+    //    its already-open inode and nothing escalates. Accepted risk: that
+    //    peer keeps serving pre-restore state until it reopens.
     if let Some(file_name) = dest_db_path.file_name() {
         for ext in ["-wal", "-shm"] {
             let mut sibling_name = file_name.to_os_string();
@@ -488,7 +494,18 @@ where
         return Err(on_failure(String::new()));
     }
     if rows.len() == 1 && rows[0] == "ok" && trailing_err.is_none() {
-        Ok(())
+        // `integrity_check` validates page/index structure and says nothing
+        // about referential integrity, so a file can be structurally perfect
+        // while an identity's keys point at a wallet that no longer exists.
+        // SQLite also skips FK enforcement entirely for any child key with a
+        // NULL column (MATCH SIMPLE), so violations can accumulate on the
+        // nullable-scope tables without any write ever failing.
+        let violations = foreign_key_violations(conn)?;
+        if violations.is_empty() {
+            Ok(())
+        } else {
+            Err(on_failure(violations.join("\n")))
+        }
     } else {
         let mut report = rows.join("\n");
         if let Some(e) = trailing_err {
@@ -500,6 +517,34 @@ where
     }
 }
 
+/// One diagnostic line per `PRAGMA foreign_key_check` row, empty when the
+/// database is referentially clean.
+///
+/// Each row is `(child table, child rowid, parent table, fk index)`; the
+/// rowid is NULL for a WITHOUT ROWID child, so it renders as `-`.
+fn foreign_key_violations(conn: &Connection) -> Result<Vec<String>, WalletStorageError> {
+    let mut stmt = conn
+        .prepare("PRAGMA foreign_key_check")
+        .map_err(|source| WalletStorageError::IntegrityCheckRunFailed { source })?;
+    let rows = stmt
+        .query_map([], |row| {
+            let table: String = row.get(0)?;
+            let rowid: Option<i64> = row.get(1)?;
+            let parent: String = row.get(2)?;
+            let fkid: i64 = row.get(3)?;
+            Ok(format!(
+                "foreign_key_check: {table} row {} violates FK #{fkid} into {parent}",
+                rowid.map_or_else(|| "-".to_string(), |id| id.to_string())
+            ))
+        })
+        .map_err(|source| WalletStorageError::IntegrityCheckRunFailed { source })?;
+    let mut out = Vec::new();
+    for item in rows {
+        out.push(item.map_err(|source| WalletStorageError::IntegrityCheckRunFailed { source })?);
+    }
+    Ok(out)
+}
+
 /// Apply retention to a directory. Files that match the recognised
 /// backup-name prefixes are eligible; others are ignored.
 ///
@@ -622,6 +667,57 @@ fn utc_timestamp() -> String {
 mod tests {
     use super::*;
 
+    /// A structurally sound file can still be referentially broken:
+    /// `integrity_check` alone reports "ok" while a child row points at a
+    /// parent that does not exist. The verification path must catch that.
+    #[test]
+    fn integrity_check_reports_foreign_key_violations() {
+        let mut conn = rusqlite::Connection::open_in_memory().unwrap();
+        crate::sqlite::migrations::run(&mut conn).unwrap();
+        // Plant an orphan with enforcement off, the way a file written by an
+        // older build (or with the pragma disabled) can arrive on disk.
+        conn.execute_batch("PRAGMA foreign_keys = OFF;").unwrap();
+        conn.execute(
+            "INSERT INTO identities \
+             (identity_id, wallet_id, identity_index, entry_blob) \
+             VALUES (?1, ?2, NULL, ?3)",
+            rusqlite::params![&[0x1Au8; 32][..], &[0x2Bu8; 32][..], vec![0u8; 4]],
+        )
+        .unwrap();
+        conn.execute_batch("PRAGMA foreign_keys = ON;").unwrap();
+
+        // `integrity_check` on its own is satisfied by this file.
+        let structural: String = conn
+            .query_row("PRAGMA integrity_check", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(structural, "ok", "the file is structurally sound");
+
+        let err = run_integrity_check(&conn, |report| WalletStorageError::IntegrityCheckFailed {
+            report,
+        })
+        .expect_err("a dangling foreign key must fail verification");
+        match err {
+            WalletStorageError::IntegrityCheckFailed { report } => {
+                assert!(
+                    report.contains("foreign_key_check") && report.contains("identities"),
+                    "report must name the check and the offending table, got: {report}"
+                );
+            }
+            other => panic!("expected IntegrityCheckFailed, got {other:?}"),
+        }
+    }
+
+    /// A clean migrated database passes both halves of the check.
+    #[test]
+    fn integrity_check_passes_a_clean_database() {
+        let mut conn = rusqlite::Connection::open_in_memory().unwrap();
+        crate::sqlite::migrations::run(&mut conn).unwrap();
+        run_integrity_check(&conn, |report| WalletStorageError::IntegrityCheckFailed {
+            report,
+        })
+        .expect("a freshly migrated database is both sound and consistent");
+    }
+
     #[test]
     fn manual_backup_filename_matches_regex() {
         let n = manual_backup_filename();
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/error.rs b/packages/rs-platform-wallet-storage/src/sqlite/error.rs
index 0721478d40a..0b1edcae949 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/error.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/error.rs
@@ -271,12 +271,13 @@ pub enum WalletStorageError {
     },
 
     /// A rehydration merge (`load_prekeyed`) found an `identity_keys` /
-    /// `contacts` entry whose owner identity is neither loaded nor
-    /// tombstoned for this wallet — an orphaned row a logical delete does
-    /// not explain. Hard-error rather than silently drop live key / contact
-    /// state; only a known-tombstoned owner's orphaned rows are safe to skip.
+    /// `contacts` entry whose owner identity is not loaded for this wallet.
+    /// Removing an identity sweeps its rows, so an absent owner is
+    /// corruption: hard-error rather than silently drop live key / contact
+    /// state. [`LoadPolicy::Recovery`](crate::LoadPolicy) downgrades it to a
+    /// counted skip.
     #[error(
-        "rehydration merge found an orphaned entry: owner {} is neither loaded nor tombstoned",
+        "rehydration merge found an orphaned entry: owner {} is not loaded",
         hex::encode(owner)
     )]
     OrphanedIdentityEntry { owner: [u8; 32] },
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/load_ctx.rs b/packages/rs-platform-wallet-storage/src/sqlite/load_ctx.rs
index 8a4b5fc9640..6c85b63e89d 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/load_ctx.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/load_ctx.rs
@@ -37,12 +37,16 @@ pub enum LoadSite {
     UnresolvedUtxoAddress,
     /// One used address resolves to two different owning accounts.
     UsedAddressOwnerConflict,
-    /// An `identity_keys` / `contacts` row's owner identity is tombstoned.
-    /// Counted per row, though `route_by_owner` decides once per collection
-    /// after its walk, so one log line can carry many counts.
-    TombstonedIdentityOrphan,
+    /// An `identity_keys` / `contacts` row names an identity that is not
+    /// there. Counted per row, though `route_by_owner` decides once per
+    /// collection after its walk, so one log line can carry many counts.
+    MissingIdentityOwner,
     /// An identity owned by no wallet carries a registration index.
     UnownedIdentityHasRegistrationIndex,
+    /// Two live `identities` rows of one wallet claim the same
+    /// `identity_index`. Only one can occupy the derivation slot, so the
+    /// loser is dropped from the wallet's identity map.
+    IdentityIndexCollision,
 }
 
 impl LoadSite {
@@ -57,8 +61,9 @@ impl LoadSite {
             Self::OrphanedUtxoOwner => "orphaned_utxo_owner",
             Self::UnresolvedUtxoAddress => "unresolved_utxo_address",
             Self::UsedAddressOwnerConflict => "used_address_owner_conflict",
-            Self::TombstonedIdentityOrphan => "tombstoned_identity_orphan",
+            Self::MissingIdentityOwner => "missing_identity_owner",
             Self::UnownedIdentityHasRegistrationIndex => "unowned_identity_has_registration_index",
+            Self::IdentityIndexCollision => "identity_index_collision",
         }
     }
 }
@@ -290,7 +295,7 @@ mod tests {
     fn tolerate_many_counts_every_occurrence_from_one_record() {
         let ctx = LoadCtx::recovery();
         ctx.tolerate_many(
-            LoadSite::TombstonedIdentityOrphan,
+            LoadSite::MissingIdentityOwner,
             5,
             WalletStorageError::blob_decode("five leftover rows"),
         )
@@ -298,7 +303,7 @@ mod tests {
         let snapshot = ctx.degradation();
         assert_eq!(snapshot.total, 5);
         assert_eq!(
-            snapshot.by_site.get(&LoadSite::TombstonedIdentityOrphan),
+            snapshot.by_site.get(&LoadSite::MissingIdentityOwner),
             Some(&5)
         );
     }
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/persister.rs b/packages/rs-platform-wallet-storage/src/sqlite/persister.rs
index 8b3962e8ad3..8909e05fc3c 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/persister.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/persister.rs
@@ -574,7 +574,7 @@ impl SqlitePersister {
     ///
     /// Keys are folded in exactly as `load()` does for wallet-owned
     /// identities, so a returned `ManagedIdentity` is usable without a
-    /// second call. Tombstoned identities are omitted.
+    /// second call.
     ///
     /// # Errors
     ///
@@ -716,7 +716,7 @@ impl SqlitePersister {
             // must precede the cascade's `BEGIN EXCLUSIVE` because
             // `Backup::new` deadlocks if the source holds an active write tx.
             // Applying a changeset outside `store()` is safe here because
-            // `identities::apply` re-runs the slot check inside this very tx.
+            // `identities::apply_upserts` re-runs the slot check in this very tx.
             if let Some(cs) = drained_slot.take() {
                 #[cfg(any(test, feature = "__test-helpers"))]
                 if let Some(primed) = primed_pre_flush_error {
@@ -1549,6 +1549,12 @@ impl PlatformWalletPersistence for SqlitePersister {
                     ))
                 })?
             };
+            // TODO(insert-wallet-id-recompute): confirm whether key_wallet's
+            // insert_wallet recomputes wallet_id — see PR's existing Deferred
+            // #3992 note. Both construction paths above hand it the persisted
+            // id; if the manager derives its own instead, a rehydrated wallet
+            // could be filed under an id that no longer matches its rows.
+            // Answering it needs the key-wallet crate, not this repo.
             let mut wallet_info =
                 key_wallet::wallet::managed_wallet_info::ManagedWalletInfo::from_wallet(
                     &wallet,
@@ -1841,7 +1847,7 @@ fn apply_changeset_to_tx(
         schema::shielded_viewing_keys::apply(tx, wallet_id, shielded)?;
     }
     if let Some(identities) = cs.identities.as_ref() {
-        schema::identities::apply(tx, wallet_id, identities)?;
+        schema::identities::apply_upserts(tx, wallet_id, identities)?;
     }
     if let Some(keys) = cs.identity_keys.as_ref() {
         schema::identity_keys::apply(tx, wallet_id, keys)?;
@@ -1872,6 +1878,13 @@ fn apply_changeset_to_tx(
             cs.dashpay_payments_overlay.as_ref(),
         )?;
     }
+    // Identity removals land LAST: the delete cascades every identity-scoped
+    // child row, so running it before the writers above would instead pull
+    // the FK parent out from under their inserts and fail the whole flush.
+    // See `schema::identities::apply_removals`.
+    if let Some(identities) = cs.identities.as_ref() {
+        schema::identities::apply_removals(tx, wallet_id, identities)?;
+    }
     // Bump each touched domain's version inside this same tx so a domain's
     // cache-invalidation marker commits atomically with its data.
     schema::versions::bump_touched_domains(tx, wallet_id, cs)?;
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/schema/core_state.rs b/packages/rs-platform-wallet-storage/src/sqlite/schema/core_state.rs
index 367b4dd5b25..1c8adc01e15 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/schema/core_state.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/schema/core_state.rs
@@ -575,7 +575,16 @@ pub fn get_tx_record(
     drop(rows);
     drop(stmt);
     if let Err(mismatch) = ensure_transaction_record_matches_columns(txid, height, &record) {
+        // Captured before `mismatch` moves: only a txid disagreement means
+        // the row is a different transaction from the one asked for.
+        let names_another_transaction = record.txid != *txid;
         ctx.tolerate(LoadSite::CoreTransactionColumnDrift, mismatch)?;
+        // Recovery tolerated the drift, which licenses continuing the load —
+        // not answering a point read with someone else's transaction. Height
+        // drift keeps the blob authoritative and still serves the record.
+        if names_another_transaction {
+            return Ok(None);
+        }
     }
     Ok(Some(record))
 }
@@ -1278,8 +1287,12 @@ mod tests {
         );
     }
 
+    /// A txid-drifted row names a DIFFERENT transaction than the one asked
+    /// for, so recovery mode must decline to answer rather than hand back
+    /// the wrong record. Contrast the height-drift sibling below, where the
+    /// blob stays authoritative and the record is still served.
     #[test]
-    fn get_tx_record_tolerates_blob_txid_drift_in_recovery_without_repairing() {
+    fn get_tx_record_declines_a_txid_drifted_row_in_recovery_without_repairing() {
         let mut conn = rusqlite::Connection::open_in_memory().unwrap();
         crate::sqlite::migrations::run(&mut conn).unwrap();
         let wallet_id = [0x4Bu8; 32];
@@ -1308,10 +1321,13 @@ mod tests {
         )
         .unwrap();
 
-        let record = get_tx_record(&conn, &wallet_id, &typed_txid, &LoadCtx::recovery())
-            .expect("recovery mode must still serve the point read")
-            .expect("blob-bearing row must return its record");
-        assert_eq!(record.txid, blob_txid);
+        assert!(
+            get_tx_record(&conn, &wallet_id, &typed_txid, &LoadCtx::recovery())
+                .expect("recovery mode tolerates the drift instead of erroring")
+                .is_none(),
+            "the row's blob names a different transaction than the one asked \
+             for; recovery must decline rather than serve the wrong record"
+        );
         // The row was NOT repaired, so the blob txid still matches no row.
         assert!(
             get_tx_record(&conn, &wallet_id, &blob_txid, &LoadCtx::recovery())
@@ -1319,6 +1335,16 @@ mod tests {
                 .is_none(),
             "a read must never rewrite the row it read"
         );
+        // Declining is not deleting: the drifted row is still on disk under
+        // its typed txid, for an operator or a later repair pass to find.
+        let still_present: i64 = conn
+            .query_row(
+                "SELECT COUNT(*) FROM core_transactions WHERE wallet_id = ?1 AND txid = ?2",
+                params![wallet_id.as_slice(), AsRef::<[u8]>::as_ref(&typed_txid)],
+                |row| row.get(0),
+            )
+            .unwrap();
+        assert_eq!(still_present, 1, "a read must never delete the row it read");
     }
 
     #[test]
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/schema/identities.rs b/packages/rs-platform-wallet-storage/src/sqlite/schema/identities.rs
index fa10ddd4999..396473baeec 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/schema/identities.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/schema/identities.rs
@@ -1,6 +1,6 @@
 //! `identities` table writer.
 
-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap};
 
 use dpp::identity::accessors::IdentityGettersV0;
 use dpp::prelude::Identifier;
@@ -22,7 +22,12 @@ use crate::sqlite::schema::blob::impl_persistable_blob;
 // PUBLIC material only: identity snapshot reaching the `entry_blob` column.
 impl_persistable_blob!(IdentityEntry);
 
-pub fn apply(
+/// Write the changeset's inserted / updated identities.
+///
+/// The insert half of a two-part apply: [`apply_removals`] must run for
+/// the same changeset, AFTER every identity-scoped child writer in the
+/// same transaction. See that function for why the order is load-bearing.
+pub fn apply_upserts(
     tx: &Transaction<'_>,
     wallet_id: &WalletId,
     cs: &IdentityChangeSet,
@@ -41,16 +46,15 @@ pub fn apply(
         // A's row: it fires only when the on-disk row is unowned (orphan →
         // parented promotion) or already owned by the incoming scope. A
         // cross-wallet write becomes a no-op (SQLite skips a false-WHERE
-        // upsert without erroring), preserving the resident blob, index, and
-        // tombstone. `IS` is the NULL-safe match for the nullable column.
+        // upsert without erroring), preserving the resident blob and index.
+        // `IS` is the NULL-safe match for the nullable column.
         let mut stmt = tx.prepare_cached(
-            "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-             VALUES (?1, ?2, ?3, ?4, 0) \
+            "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+             VALUES (?1, ?2, ?3, ?4) \
              ON CONFLICT(identity_id) DO UPDATE SET \
                 wallet_id = COALESCE(identities.wallet_id, excluded.wallet_id), \
                 identity_index = excluded.identity_index, \
-                entry_blob = excluded.entry_blob, \
-                tombstoned = 0 \
+                entry_blob = excluded.entry_blob \
              WHERE identities.wallet_id IS NULL OR identities.wallet_id IS excluded.wallet_id",
         )?;
         let wallet_id_param = wallet_id_to_param(wallet_id);
@@ -85,22 +89,69 @@ pub fn apply(
                 payload,
             ])?;
         }
-    }
-    if !cs.removed.is_empty() {
-        // Scope the tombstone to the flush wallet (NULL-safe `IS`) so wallet
-        // A's `removed` set can't tombstone wallet B's identity; the sentinel
-        // scope maps to NULL and tombstones only orphan rows.
-        let wallet_id_param = wallet_id_to_param(wallet_id);
-        let mut stmt = tx.prepare_cached(
-            "UPDATE identities SET tombstoned = 1 WHERE identity_id = ?1 AND wallet_id IS ?2",
-        )?;
-        for id in &cs.removed {
-            stmt.execute(params![id.as_slice(), wallet_id_param])?;
+        // Carry the promoted identities' NULL-scoped keys into the same
+        // scope, inside the promotion's own transaction. A key left
+        // NULL-scoped under a now-owned identity is the state the
+        // `identity_keys_null_scope_*` triggers forbid, and it drops out of
+        // the owner's scoped read. The `EXISTS` clause is what makes this
+        // safe to run for every flushed id: it fires only where the identity
+        // row really is owned by this scope, so a cross-wallet upsert that
+        // the `DO UPDATE WHERE` turned into a no-op moves no keys either.
+        if !scope_is_sentinel {
+            let mut rescope = tx.prepare_cached(
+                "UPDATE identity_keys SET wallet_id = ?1 \
+                 WHERE identity_id = ?2 AND wallet_id IS NULL \
+                   AND EXISTS (SELECT 1 FROM identities i \
+                               WHERE i.identity_id = ?2 AND i.wallet_id IS ?1)",
+            )?;
+            for id in cs.identities.keys() {
+                rescope.execute(params![wallet_id_param, id.as_slice()])?;
+            }
         }
     }
     Ok(())
 }
 
+/// Delete the changeset's removed identities, and with them every row
+/// they own.
+///
+/// # Ordering
+///
+/// Must run AFTER every identity-scoped child writer in the same
+/// transaction (`identity_keys`, `contacts`, `token_balances`,
+/// `dashpay`). A merged buffer can carry `removed` for an identity
+/// alongside upserts for that same identity — sync writes its keys, the
+/// host then removes it, both land in one flush. Deleting first pulls
+/// the foreign-key parent out from under those inserts and fails the
+/// whole flush; deleting last lets them land and then sweeps them, which
+/// is the same end state and the documented "removal wins" rule.
+///
+/// Dependents go through three paths: the native `ON DELETE CASCADE` on
+/// `identity_id`, V001's `cascade_meta_on_identity_delete`, and V015's
+/// `cascade_children_on_identity_delete` for the rows no live foreign
+/// key reaches (an out-of-wallet identity's `identity_keys`, whose
+/// compound FK is dormant under MATCH SIMPLE, plus `contacts` and
+/// `ignored_senders`, which have no FK to `identities` at all).
+pub fn apply_removals(
+    tx: &Transaction<'_>,
+    wallet_id: &WalletId,
+    cs: &IdentityChangeSet,
+) -> Result<(), WalletStorageError> {
+    if cs.removed.is_empty() {
+        return Ok(());
+    }
+    // Scope the delete to the flush wallet (NULL-safe `IS`) so wallet A's
+    // `removed` set can't delete wallet B's identity; the sentinel scope
+    // maps to NULL and reaches only orphan rows.
+    let wallet_id_param = wallet_id_to_param(wallet_id);
+    let mut stmt =
+        tx.prepare_cached("DELETE FROM identities WHERE identity_id = ?1 AND wallet_id IS ?2")?;
+    for id in &cs.removed {
+        stmt.execute(params![id.as_slice(), wallet_id_param])?;
+    }
+    Ok(())
+}
+
 /// Refuse a changeset that would put two identities in one wallet's
 /// derivation slot, or hand a wallet-less identity a slot at all.
 ///
@@ -112,25 +163,25 @@ pub fn apply(
 /// attributed to the caller that made it.
 ///
 /// Occupancy is keyed on the FLUSH SCOPE, not on the incoming row's
-/// stored `wallet_id`: [`apply`]'s upsert promotes a NULL `wallet_id`
+/// stored `wallet_id`: [`apply_upserts`] promotes a NULL `wallet_id`
 /// into the flush scope, so the scope is the slot the write actually
-/// lands in. Ids in `cs.removed` hold no slot — [`apply`] inserts before
-/// it tombstones, so "tombstone A@N + insert B@N" in one changeset has a
-/// legal final state. Tombstoned rows are likewise transparent: the
-/// tombstone `UPDATE` leaves `identity_index` populated, and counting
-/// those would refuse legitimate slot reuse.
+/// lands in. Ids in `cs.removed` hold no slot — [`apply_removals`]
+/// deletes them later in the same transaction, so "remove A@N + insert
+/// B@N" in one changeset has a legal final state.
 ///
 /// The judgement is on the state the changeset ENDS in, never the one it
 /// starts from: an on-disk occupant that `cs` itself rewrites to another
 /// index — or to none at all — has vacated the slot as surely as a
-/// tombstoned one, so "A moves to 2, B takes 1" and a two-way swap are
+/// removed one, so "A moves to 2, B takes 1" and a two-way swap are
 /// both legal. `identities` carries no `(wallet_id, identity_index)`
-/// UNIQUE index, so [`apply`]'s row-at-a-time upserts pass straight
-/// through the transient double-claim a swap goes through.
+/// UNIQUE index, so the row-at-a-time upserts pass straight through the
+/// transient double-claim a swap goes through.
 ///
 /// A pre-existing on-disk duplicate (written before this check existed)
-/// makes both of its slot-mates unwritable here. That wallet already
-/// fails to load; refusing to extend the contradiction is the point.
+/// makes both of its slot-mates unwritable here. Refusing to extend the
+/// contradiction is the point: a strict load rejects that wallet outright
+/// and a `Recovery` load counts the collision and drops one identity from
+/// the slot, so the duplicate costs the user an identity either way.
 ///
 /// Scope-keying also covers the promotion case (an existing NULL-parented
 /// row being pulled into a wallet that already fills the slot) at no
@@ -156,12 +207,11 @@ pub(crate) fn check_index_conflicts(
     let wallet_id_param = wallet_id_to_param(wallet_id);
     let mut stmt = conn.prepare_cached(
         "SELECT identity_id FROM identities \
-         WHERE wallet_id IS ?1 AND identity_index = ?2 AND tombstoned = 0 \
-           AND identity_id != ?3",
+         WHERE wallet_id IS ?1 AND identity_index = ?2 AND identity_id != ?3",
     )?;
     let mut claimed: BTreeMap<u32, Identifier> = BTreeMap::new();
     for (id, entry) in &cs.identities {
-        // A removed id is tombstoned by the end of the same `apply`, so
+        // A removed id is deleted by the end of the same transaction, so
         // whatever it claims here it does not keep.
         if cs.removed.contains(id) {
             continue;
@@ -218,23 +268,18 @@ pub(crate) fn check_index_conflicts(
     Ok(())
 }
 
-/// Decode a single `identities` row into `(entry, tombstoned)`.
-///
-/// Returns `Ok(None)` if no row matches. The `tombstoned` flag is
-/// returned alongside the entry so the caller can decide whether to skip
-/// a logically deleted identity rather than having to consult
-/// [`load_state`] separately.
+/// Decode a single `identities` row, or `Ok(None)` if no row matches.
 #[cfg(any(test, feature = "__test-helpers"))]
 pub fn fetch(
     conn: &Connection,
     wallet_id: &WalletId,
     identity_id: &[u8; 32],
-) -> Result<Option<(IdentityEntry, bool)>, WalletStorageError> {
+) -> Result<Option<IdentityEntry>, WalletStorageError> {
     // Scope to the caller's wallet (NULL-safe `IS`) so a peer wallet sharing
     // the identity-id row can't leak through; sentinel matches orphan rows.
     let wallet_id_param = wallet_id_to_param(wallet_id);
     let mut stmt = conn.prepare(
-        "SELECT length(entry_blob), entry_blob, tombstoned FROM identities \
+        "SELECT length(entry_blob), entry_blob FROM identities \
          WHERE identity_id = ?1 AND wallet_id IS ?2",
     )?;
     let mut rows = stmt.query(params![&identity_id[..], wallet_id_param])?;
@@ -243,20 +288,43 @@ pub fn fetch(
         Some(row) => {
             blob::check_size(row.get::<_, i64>(0)?)?;
             let payload: Vec<u8> = row.get(1)?;
-            let tombstoned: i64 = row.get(2)?;
-            Ok(Some((blob::decode(&payload)?, tombstoned != 0)))
+            Ok(Some(blob::decode(&payload)?))
         }
     }
 }
 
 /// Build an [`IdentityManagerStartState`](platform_wallet::changeset::IdentityManagerStartState)
-/// for one wallet. Tombstoned rows are skipped; a row that fails to decode is
-/// a hard error (corruption is never silently dropped). Rows with
+/// for one wallet. A row that fails to decode is a hard error (corruption is
+/// never silently dropped). Rows with
 /// `identity_index = Some(_)` bucket into `wallet_identities`, `None` into
 /// `out_of_wallet_identities`.
+/// Strict-policy [`load_state_with_ctx`], for the tests that read identity
+/// state directly rather than through `load_prekeyed`.
+#[cfg(any(test, feature = "__test-helpers"))]
 pub fn load_state(
     conn: &Connection,
     wallet_id: &WalletId,
+) -> Result<platform_wallet::changeset::IdentityManagerStartState, WalletStorageError> {
+    // `LoadCtx::strict()` is cfg-gated to test/helper builds; the policy
+    // constructor is not, so the plain library build keeps compiling.
+    load_state_with_ctx(
+        conn,
+        wallet_id,
+        &LoadCtx::new(crate::sqlite::config::LoadPolicy::Strict),
+    )
+}
+
+/// [`load_state`] under an explicit load policy.
+///
+/// Only the duplicate-slot case consults `ctx`: a second live row claiming
+/// an `identity_index` this wallet has already filled is fatal under
+/// `Strict` and a counted, logged drop under `Recovery`. The typed-column
+/// cross-checks stay unconditional — a row whose columns contradict its own
+/// blob is corruption, not a recoverable projection.
+pub fn load_state_with_ctx(
+    conn: &Connection,
+    wallet_id: &WalletId,
+    ctx: &LoadCtx,
 ) -> Result<platform_wallet::changeset::IdentityManagerStartState, WalletStorageError> {
     use platform_wallet::changeset::IdentityManagerStartState;
 
@@ -266,7 +334,7 @@ pub fn load_state(
     // unowned bucket. A plain `=` could not express the second case at all.
     let wallet_id_param = wallet_id_to_param(wallet_id);
     let mut stmt = conn.prepare(
-        "SELECT identity_id, length(entry_blob), entry_blob, tombstoned \
+        "SELECT identity_id, length(entry_blob), entry_blob, identity_index \
          FROM identities WHERE wallet_id IS ?1",
     )?;
     // The ignored-senders TABLE is the authoritative ignore record (every
@@ -280,10 +348,7 @@ pub fn load_state(
         let identity_id_bytes: Vec<u8> = row.get(0)?;
         blob::check_size(row.get::<_, i64>(1)?)?;
         let payload: Vec<u8> = row.get(2)?;
-        let tombstoned: i64 = row.get(3)?;
-        if tombstoned != 0 {
-            continue;
-        }
+        let typed_identity_index: Option<i64> = row.get(3)?;
         let entry: IdentityEntry = blob::decode(&payload)?;
         // Cross-check the decoded blob against the typed columns it was
         // selected by (mirrors the accounts / identity_keys readers): the
@@ -301,15 +366,42 @@ pub fn load_state(
                 });
             }
         }
+        // The blob's index is what the wallet runs on; the column is what
+        // the write-path slot guard (`check_index_conflicts`) reasons about.
+        // Divergence means the guard has been policing a value the runtime
+        // never sees, so the two must be proven equal on the way in.
+        let typed_identity_index = typed_identity_index
+            .map(|raw| crate::sqlite::util::safe_cast::i64_to_u32("identities.identity_index", raw))
+            .transpose()?;
+        if entry.identity_index != typed_identity_index {
+            return Err(WalletStorageError::IdentityEntryIdMismatch);
+        }
         let ignored = ignored_by_owner.remove(&entry.id).unwrap_or_default();
         let managed = managed_identity_from_entry(&entry, wallet_id, ignored);
         match entry.identity_index {
             Some(idx) => {
-                state
+                let entry_id = entry.id;
+                if let Some(displaced) = state
                     .wallet_identities
                     .entry(*wallet_id)
                     .or_default()
-                    .insert(idx, managed);
+                    .insert(idx, managed)
+                {
+                    // `identities` carries no `(wallet_id, identity_index)`
+                    // UNIQUE index, so a pre-guard duplicate can still be on
+                    // disk. Left unreported the map keyed by `idx` just drops
+                    // whichever row SQLite happened to yield first — an
+                    // identity silently missing from the wallet.
+                    ctx.tolerate(
+                        LoadSite::IdentityIndexCollision,
+                        WalletStorageError::IdentityIndexConflict {
+                            wallet_id: *wallet_id,
+                            identity_index: idx,
+                            existing: displaced.identity.id().to_buffer(),
+                            incoming: entry_id.to_buffer(),
+                        },
+                    )?;
+                }
             }
             None => {
                 state.out_of_wallet_identities.insert(entry.id, managed);
@@ -326,15 +418,14 @@ pub fn load_state(
 /// its own `public_keys` and contact maps at load time — no separate
 /// changeset layered on afterwards. Fail-hard on a corrupt row (inherited
 /// from the three underlying readers) and on any merged key / contact entry
-/// whose owner is absent for a reason other than a known tombstone; a
-/// tombstoned owner's orphaned rows are skipped with a summary log (see
-/// [`merge_contacts_and_keys`]).
+/// whose owner is absent, which [`LoadPolicy::Recovery`](crate::LoadPolicy)
+/// downgrades to a counted skip (see [`merge_contacts_and_keys`]).
 pub fn load_prekeyed(
     conn: &Connection,
     wallet_id: &WalletId,
     ctx: &LoadCtx,
 ) -> Result<platform_wallet::changeset::IdentityManagerStartState, WalletStorageError> {
-    let mut state = load_state(conn, wallet_id)?;
+    let mut state = load_state_with_ctx(conn, wallet_id, ctx)?;
     let identity_keys = crate::sqlite::schema::identity_keys::load_state(conn, wallet_id)?;
     let records = crate::sqlite::schema::contacts::load_state(conn, wallet_id)?;
     // Ignored senders restore in `load_state` from the authoritative
@@ -346,35 +437,10 @@ pub fn load_prekeyed(
         established: records.established,
         ..Default::default()
     };
-    let tombstoned = load_tombstoned_ids(conn, wallet_id)?;
-    merge_contacts_and_keys(&mut state, contacts, identity_keys, &tombstoned, ctx)?;
+    merge_contacts_and_keys(&mut state, contacts, identity_keys, ctx)?;
     Ok(state)
 }
 
-/// The set of identity ids tombstoned (logically deleted) for this wallet.
-/// A rehydration-merge entry whose owner is in this set is an expected
-/// logical-delete orphan — safe to skip; an owner absent for any other
-/// reason is a hard error.
-fn load_tombstoned_ids(
-    conn: &Connection,
-    wallet_id: &WalletId,
-) -> Result<HashSet<Identifier>, WalletStorageError> {
-    // NULL-safe `IS`, matching `load_state`: a tombstoned UNOWNED identity
-    // must be recognised as tombstoned too, else its leftover key rows are
-    // treated as inexplicable orphans and hard-error the read.
-    let wallet_id_param = wallet_id_to_param(wallet_id);
-    let mut stmt = conn
-        .prepare("SELECT identity_id FROM identities WHERE wallet_id IS ?1 AND tombstoned = 1")?;
-    let mut rows = stmt.query(params![wallet_id_param])?;
-    let mut out = HashSet::new();
-    while let Some(row) = rows.next()? {
-        let id_bytes: Vec<u8> = row.get(0)?;
-        let id32 = super::id32("identities.identity_id", &id_bytes)?;
-        out.insert(Identifier::from(id32));
-    }
-    Ok(out)
-}
-
 /// Reconstruct a [`ManagedIdentity`] from a persisted [`IdentityEntry`]
 /// using a freshly minted V0 [`Identity`] for `(id, balance, revision)`.
 /// Live runtime fields (contacts maps, public-key derivations) are
@@ -470,9 +536,8 @@ pub fn ensure_exists(
     let payload = blob::encode(&stub)?;
     let wallet_id_param = wallet_id_to_param(wallet_id);
     conn.execute(
-        "INSERT OR IGNORE INTO identities \
-            (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-         VALUES (?1, ?2, NULL, ?3, 0)",
+        "INSERT OR IGNORE INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+         VALUES (?1, ?2, NULL, ?3)",
         params![&identity_id[..], wallet_id_param, payload],
     )?;
     Ok(())
@@ -492,16 +557,20 @@ pub fn ensure_exists(
 /// # Errors
 ///
 /// [`WalletStorageError::OrphanedIdentityEntry`] when an entry's owner is
-/// absent from the loaded set. A known-tombstoned owner is the one case
-/// [`LoadPolicy::Recovery`](crate::LoadPolicy) forgives: its rows are
-/// logical-delete leftovers, skipped and summarised once per collection.
-/// Under `Strict` even those abort, because "the owner is gone" is exactly
-/// the state that silently drops live key / contact material.
+/// absent from the loaded set. Removing an identity sweeps its rows, so an
+/// absent owner is corruption rather than routine bookkeeping. A `contacts`
+/// or `ignored_senders` row is the reachable shape: both key on `owner_id`
+/// with no foreign key to `identities`, so nothing rejects one naming an
+/// identity that is not there. `identity_keys` cannot reach this state —
+/// its wallet-scoped FK is live, and V014's trigger pair covers the
+/// NULL-scoped case the compound FK leaves dormant.
+/// [`LoadPolicy::Recovery`](crate::LoadPolicy) skips and counts those;
+/// `Strict` aborts, because "the owner is gone" is exactly the state that
+/// silently drops live key / contact material.
 pub fn merge_contacts_and_keys(
     state: &mut IdentityManagerStartState,
     contacts: ContactChangeSet,
     identity_keys: IdentityKeysChangeSet,
-    tombstoned: &HashSet<Identifier>,
     ctx: &LoadCtx,
 ) -> Result<(), WalletStorageError> {
     // One transient id → &mut ManagedIdentity view over both buckets so
@@ -523,7 +592,6 @@ pub fn merge_contacts_and_keys(
             .into_values()
             .map(|entry| (entry.identity_id, entry.public_key)),
         &mut by_id,
-        tombstoned,
         ctx,
         "identity_keys",
         |managed, key| managed.identity.add_public_key(key),
@@ -534,7 +602,6 @@ pub fn merge_contacts_and_keys(
             .into_iter()
             .map(|(key, entry)| (key.owner_id, entry.request)),
         &mut by_id,
-        tombstoned,
         ctx,
         "sent_contact_requests",
         |managed, request| managed.apply_sent_contact_request(request),
@@ -545,7 +612,6 @@ pub fn merge_contacts_and_keys(
             .into_iter()
             .map(|(key, entry)| (key.owner_id, entry.request)),
         &mut by_id,
-        tombstoned,
         ctx,
         "incoming_contact_requests",
         |managed, request| managed.apply_incoming_contact_request(request),
@@ -556,7 +622,6 @@ pub fn merge_contacts_and_keys(
             .into_iter()
             .map(|(key, established)| (key.owner_id, established)),
         &mut by_id,
-        tombstoned,
         ctx,
         "established_contacts",
         |managed, established| managed.apply_established_contact(established),
@@ -568,15 +633,13 @@ pub fn merge_contacts_and_keys(
 /// Apply one collection's entries to their owning identity.
 ///
 /// An entry whose owner is loaded is applied. An entry whose owner is
-/// tombstoned is counted and, if the policy allows it, skipped — decided
-/// once after the walk rather than per entry, so a wallet with thousands of
-/// leftovers produces one log line, not thousands, while the per-site tally
-/// still counts every skipped row. Any other missing owner is fatal in both
-/// policies.
+/// missing is counted and, under [`LoadPolicy::Recovery`](crate::LoadPolicy),
+/// skipped — decided once after the walk rather than per entry, so a wallet
+/// with thousands of orphans produces one log line, not thousands, while the
+/// per-site tally still counts every skipped row.
 fn route_by_owner<T>(
     entries: impl IntoIterator<Item = (Identifier, T)>,
     by_id: &mut HashMap<Identifier, &mut ManagedIdentity>,
-    tombstoned: &HashSet<Identifier>,
     ctx: &LoadCtx,
     collection: &'static str,
     apply: impl Fn(&mut ManagedIdentity, T),
@@ -586,15 +649,10 @@ fn route_by_owner<T>(
     for (owner, payload) in entries {
         match by_id.get_mut(&owner) {
             Some(managed) => apply(managed, payload),
-            None if tombstoned.contains(&owner) => {
+            None => {
                 skipped += 1;
                 first_skipped_owner.get_or_insert(owner);
             }
-            None => {
-                return Err(WalletStorageError::OrphanedIdentityEntry {
-                    owner: owner.to_buffer(),
-                })
-            }
         }
     }
     if let Some(owner) = first_skipped_owner {
@@ -602,17 +660,17 @@ fn route_by_owner<T>(
         // only describing.
         let skipped = u32::try_from(skipped).unwrap_or(u32::MAX);
         ctx.tolerate_many(
-            LoadSite::TombstonedIdentityOrphan,
+            LoadSite::MissingIdentityOwner,
             skipped,
             WalletStorageError::OrphanedIdentityEntry {
                 owner: owner.to_buffer(),
             },
         )?;
         tracing::warn!(
-            site = LoadSite::TombstonedIdentityOrphan.as_str(),
+            site = LoadSite::MissingIdentityOwner.as_str(),
             collection,
             count = skipped,
-            "skipped rehydration entries whose owning identity is tombstoned"
+            "skipped rehydration entries whose owning identity is absent"
         );
     }
     Ok(())
@@ -663,16 +721,18 @@ mod tests {
         }
     }
 
+    /// Both halves of the writer in one transaction, in the order
+    /// `apply_changeset_to_tx` runs them.
     fn apply_in_tx(conn: &mut Connection, scope: &[u8; 32], cs: &IdentityChangeSet) {
         let tx = conn.transaction().unwrap();
-        apply(&tx, scope, cs).unwrap();
+        apply_upserts(&tx, scope, cs).unwrap();
+        apply_removals(&tx, scope, cs).unwrap();
         tx.commit().unwrap();
     }
 
     /// A wallet-B flush naming an identity already owned by wallet A must NOT
-    /// overwrite A's blob / index or clear A's tombstone — the DO UPDATE WHERE
-    /// scopes the overwrite to the owning wallet, so the cross-wallet write is
-    /// a no-op.
+    /// overwrite A's blob or index — the DO UPDATE WHERE scopes the overwrite
+    /// to the owning wallet, so the cross-wallet write is a no-op.
     #[test]
     fn cross_wallet_upsert_does_not_overwrite_resident_row() {
         let mut conn = migrated_conn();
@@ -682,14 +742,11 @@ mod tests {
         insert_wallet(&conn, &a);
         insert_wallet(&conn, &b);
 
-        // A registers X (balance 1000, index 5), then tombstones it.
+        // A registers X (balance 1000, index 5).
         let mut cs_a = IdentityChangeSet::default();
         cs_a.identities
             .insert(Identifier::from(x), entry(x, Some(a), 1000, Some(5)));
         apply_in_tx(&mut conn, &a, &cs_a);
-        let mut cs_a_remove = IdentityChangeSet::default();
-        cs_a_remove.removed.insert(Identifier::from(x));
-        apply_in_tx(&mut conn, &a, &cs_a_remove);
 
         // B flushes X (balance 2000, index 9, unowned blob). Must be a no-op.
         let mut cs_b = IdentityChangeSet::default();
@@ -697,16 +754,42 @@ mod tests {
             .insert(Identifier::from(x), entry(x, None, 2000, Some(9)));
         apply_in_tx(&mut conn, &b, &cs_b);
 
-        let (resident, tombstoned) = fetch(&conn, &a, &x).unwrap().expect("A still owns the row");
+        let resident = fetch(&conn, &a, &x).unwrap().expect("A still owns the row");
         assert_eq!(resident.balance, 1000, "A's blob must survive B's write");
         assert_eq!(resident.identity_index, Some(5), "A's index must survive");
-        assert!(tombstoned, "A's tombstone must not be reset by B");
         assert!(
             fetch(&conn, &b, &x).unwrap().is_none(),
             "B must not have taken ownership"
         );
     }
 
+    /// A cross-wallet `removed` set is a no-op for the same reason the
+    /// cross-wallet upsert is: the DELETE carries the flush scope, so
+    /// wallet B cannot delete wallet A's identity out from under it.
+    #[test]
+    fn cross_wallet_removal_leaves_the_resident_row() {
+        let mut conn = migrated_conn();
+        let a = [0xA1u8; 32];
+        let b = [0xB2u8; 32];
+        let x = [0x01u8; 32];
+        insert_wallet(&conn, &a);
+        insert_wallet(&conn, &b);
+
+        let mut cs_a = IdentityChangeSet::default();
+        cs_a.identities
+            .insert(Identifier::from(x), entry(x, Some(a), 1000, Some(5)));
+        apply_in_tx(&mut conn, &a, &cs_a);
+
+        let mut cs_b_remove = IdentityChangeSet::default();
+        cs_b_remove.removed.insert(Identifier::from(x));
+        apply_in_tx(&mut conn, &b, &cs_b_remove);
+
+        assert!(
+            fetch(&conn, &a, &x).unwrap().is_some(),
+            "B's removed set must not reach A's identity"
+        );
+    }
+
     /// The WHERE still permits the orphan → parented promotion path: an
     /// unowned (NULL wallet_id) row is claimed by the first wallet to flush it.
     #[test]
@@ -733,7 +816,7 @@ mod tests {
             .insert(Identifier::from(y), entry(y, Some(a), 500, Some(3)));
         apply_in_tx(&mut conn, &a, &cs_a);
 
-        let (claimed, _) = fetch(&conn, &a, &y).unwrap().expect("A claimed Y");
+        let claimed = fetch(&conn, &a, &y).unwrap().expect("A claimed Y");
         assert_eq!(claimed.balance, 500, "promotion applies the new blob");
         assert_eq!(claimed.identity_index, Some(3));
     }
@@ -788,7 +871,7 @@ mod tests {
             .insert((out_of_wallet, 0), key(out_of_wallet, 0xB2));
 
         let tx = conn.transaction().unwrap();
-        apply(&tx, &w, &ids).unwrap();
+        apply_upserts(&tx, &w, &ids).unwrap();
         crate::sqlite::schema::identity_keys::apply(&tx, &w, &keys).unwrap();
         tx.commit().unwrap();
 
@@ -807,6 +890,167 @@ mod tests {
         );
     }
 
+    /// Promoting an orphan identity into a wallet must carry its
+    /// NULL-scoped `identity_keys` rows across in the same transaction.
+    /// Left behind, those keys stay NULL-scoped while their identity is
+    /// wallet-owned — a state the `identity_keys_null_scope_*` triggers
+    /// exist to forbid, and one that hides the keys from the promoted
+    /// identity's own scoped read.
+    #[test]
+    fn orphan_promotion_rescopes_the_identitys_null_scoped_keys() {
+        use platform_wallet::changeset::IdentityKeysChangeSet;
+
+        let mut conn = migrated_conn();
+        let a = [0xA1u8; 32];
+        let y = [0x02u8; 32];
+        insert_wallet(&conn, &a);
+
+        // Orphan Y under the sentinel scope, then give it a NULL-scoped key.
+        let mut cs_orphan = IdentityChangeSet::default();
+        cs_orphan
+            .identities
+            .insert(Identifier::from(y), entry(y, None, 10, None));
+        apply_in_tx(&mut conn, &[0u8; 32], &cs_orphan);
+
+        let mut keys = IdentityKeysChangeSet::default();
+        keys.upserts.insert(
+            (Identifier::from(y), 0),
+            sample_key_entry(Identifier::from(y), 0x09),
+        );
+        let tx = conn.transaction().unwrap();
+        crate::sqlite::schema::identity_keys::apply(&tx, &[0u8; 32], &keys).unwrap();
+        tx.commit().unwrap();
+
+        // A claims Y.
+        let mut cs_a = IdentityChangeSet::default();
+        cs_a.identities
+            .insert(Identifier::from(y), entry(y, Some(a), 500, Some(3)));
+        apply_in_tx(&mut conn, &a, &cs_a);
+
+        let orphaned: i64 = conn
+            .query_row(
+                "SELECT COUNT(*) FROM identity_keys \
+                 WHERE identity_id = ?1 AND wallet_id IS NULL",
+                params![&y[..]],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(
+            orphaned, 0,
+            "the promoted identity's keys must not stay NULL-scoped"
+        );
+
+        let rescoped: i64 = conn
+            .query_row(
+                "SELECT COUNT(*) FROM identity_keys \
+                 WHERE identity_id = ?1 AND wallet_id IS ?2",
+                params![&y[..], &a[..]],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(rescoped, 1, "the key must move to the promoting wallet");
+    }
+
+    /// A NULL-scoped key must name an identity that actually exists. V001's
+    /// guard only rejected keys whose identity was wallet-OWNED, so one
+    /// naming no identity at all slipped through — MATCH SIMPLE leaves both
+    /// foreign keys dormant on a NULL-scoped row, making the trigger the
+    /// only guard there is. Closed by V014.
+    #[test]
+    fn null_scoped_key_is_rejected_for_a_missing_identity() {
+        use platform_wallet::changeset::IdentityKeysChangeSet;
+
+        let mut conn = migrated_conn();
+        let ghost = Identifier::from([0x5Eu8; 32]); // never written to `identities`
+
+        let mut keys = IdentityKeysChangeSet::default();
+        keys.upserts
+            .insert((ghost, 0), sample_key_entry(ghost, 0x5E));
+
+        let tx = conn.transaction().unwrap();
+        let err = crate::sqlite::schema::identity_keys::apply(&tx, &[0u8; 32], &keys)
+            .expect_err("a NULL-scoped key naming no identity must be rejected");
+        assert!(
+            matches!(err, WalletStorageError::IdentityKeyWalletMismatch { .. }),
+            "expected IdentityKeyWalletMismatch from the NULL-scope trigger, got {err:?}"
+        );
+    }
+
+    /// Two live rows of one wallet claiming the same `identity_index` must
+    /// not resolve by silently dropping whichever the scan reached first.
+    /// `identities` has no `(wallet_id, identity_index)` UNIQUE index, so a
+    /// duplicate written before the write-path slot guard existed is still
+    /// reachable on disk.
+    #[test]
+    fn load_state_reports_a_duplicate_identity_index_instead_of_dropping_one() {
+        let conn = migrated_conn();
+        let wallet = [7u8; 32];
+        insert_wallet(&conn, &wallet);
+        for id_byte in [0xAAu8, 0xBBu8] {
+            let e = entry([id_byte; 32], Some(wallet), 100, Some(1));
+            let payload = blob::encode(&e).unwrap();
+            conn.execute(
+                "INSERT INTO identities \
+                 (identity_id, wallet_id, identity_index, entry_blob) \
+                 VALUES (?1, ?2, 1, ?3)",
+                params![&[id_byte; 32][..], &wallet[..], payload],
+            )
+            .unwrap();
+        }
+
+        // Strict: the contradiction is fatal rather than silently resolved.
+        let err = load_state_with_ctx(&conn, &wallet, &LoadCtx::strict())
+            .expect_err("a duplicated derivation slot must fail a strict load");
+        assert!(
+            matches!(err, WalletStorageError::IdentityIndexConflict { .. }),
+            "expected IdentityIndexConflict, got {err:?}"
+        );
+
+        // Recovery: still degraded, but counted and logged rather than silent.
+        let ctx = LoadCtx::recovery();
+        let state = load_state_with_ctx(&conn, &wallet, &ctx)
+            .expect("recovery tolerates the duplicate to get the wallet open");
+        assert_eq!(
+            state.wallet_identities.get(&wallet).map(|m| m.len()),
+            Some(1),
+            "one identity still loses the slot — the point is that it is reported"
+        );
+        let degradation = ctx.degradation();
+        assert!(degradation.degraded);
+        assert_eq!(
+            degradation.by_site.get(&LoadSite::IdentityIndexCollision),
+            Some(&1),
+            "the collision must be counted against its own site"
+        );
+    }
+
+    /// The `identity_index` COLUMN and the index inside `entry_blob` are two
+    /// copies of one fact. The write-path slot guard polices the column while
+    /// the wallet runs on the blob, so a load must refuse a row where they
+    /// disagree rather than let the guard protect a value nothing reads.
+    #[test]
+    fn load_state_rejects_identity_index_column_drift() {
+        let conn = migrated_conn();
+        let wallet = [8u8; 32];
+        insert_wallet(&conn, &wallet);
+        let e = entry([0xC1u8; 32], Some(wallet), 100, Some(2));
+        let payload = blob::encode(&e).unwrap();
+        conn.execute(
+            "INSERT INTO identities \
+             (identity_id, wallet_id, identity_index, entry_blob) \
+             VALUES (?1, ?2, 9, ?3)",
+            params![&[0xC1u8; 32][..], &wallet[..], payload],
+        )
+        .unwrap();
+
+        let err =
+            load_state(&conn, &wallet).expect_err("column/blob index drift must fail the load");
+        assert!(
+            matches!(err, WalletStorageError::IdentityEntryIdMismatch),
+            "expected IdentityEntryIdMismatch, got {err:?}"
+        );
+    }
+
     fn sample_key_entry(id: Identifier, byte: u8) -> platform_wallet::changeset::IdentityKeyEntry {
         use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
         use dpp::identity::{IdentityPublicKey, KeyType, Purpose, SecurityLevel};
@@ -904,7 +1148,7 @@ mod tests {
             .insert((identity, 0), sample_key_entry(identity, 0x11));
         {
             let tx = conn.transaction().unwrap();
-            apply(&tx, &owner, &ids).unwrap();
+            apply_upserts(&tx, &owner, &ids).unwrap();
             crate::sqlite::schema::identity_keys::apply(&tx, &owner, &owner_keys).unwrap();
             tx.commit().unwrap();
         }
@@ -967,7 +1211,7 @@ mod tests {
         owner_keys.upserts.insert((x, 0), sample_key_entry(x, 0x11));
         {
             let tx = conn.transaction().unwrap();
-            apply(&tx, &owner, &ids).unwrap();
+            apply_upserts(&tx, &owner, &ids).unwrap();
             crate::sqlite::schema::identity_keys::apply(&tx, &owner, &owner_keys).unwrap();
             tx.commit().unwrap();
         }
@@ -1028,7 +1272,7 @@ mod tests {
         keys.upserts.insert((z, 0), sample_key_entry(z, 0x5B));
         {
             let tx = conn.transaction().unwrap();
-            apply(&tx, &unowned, &ids).unwrap();
+            apply_upserts(&tx, &unowned, &ids).unwrap();
             crate::sqlite::schema::identity_keys::apply(&tx, &unowned, &keys)
                 .expect("an unowned key on an unowned identity is legitimate");
             tx.commit().unwrap();
@@ -1174,7 +1418,7 @@ mod tests {
         keys.upserts.insert((z, 0), sample_key_entry(z, 0x6B));
         {
             let tx = conn.transaction().unwrap();
-            apply(&tx, &unowned, &ids).unwrap();
+            apply_upserts(&tx, &unowned, &ids).unwrap();
             crate::sqlite::schema::identity_keys::apply(&tx, &unowned, &keys).unwrap();
             tx.commit().unwrap();
         }
@@ -1197,108 +1441,6 @@ mod tests {
         assert_eq!(remaining, 0, "the unowned key must actually be deleted");
     }
 
-    /// `load_prekeyed` skips — never hard-errors on — an `identity_keys`
-    /// entry whose owner is a known-tombstoned identity: those orphaned rows
-    /// are the expected, self-explained fallout of a logical delete.
-    #[test]
-    fn load_prekeyed_skips_orphaned_keys_of_tombstoned_owner_in_recovery() {
-        use platform_wallet::changeset::IdentityKeysChangeSet;
-
-        let mut conn = migrated_conn();
-        let a = [0xA7u8; 32];
-        insert_wallet(&conn, &a);
-        let y = Identifier::from([0x44u8; 32]);
-
-        let mut ids = IdentityChangeSet::default();
-        ids.identities
-            .insert(y, entry([0x44; 32], Some(a), 50, Some(0)));
-        let mut keys = IdentityKeysChangeSet::default();
-        keys.upserts.insert((y, 0), sample_key_entry(y, 0xD4));
-        {
-            let tx = conn.transaction().unwrap();
-            apply(&tx, &a, &ids).unwrap();
-            crate::sqlite::schema::identity_keys::apply(&tx, &a, &keys).unwrap();
-            tx.commit().unwrap();
-        }
-        // Tombstone Y; its key row survives as a logical-delete orphan.
-        let mut removed = IdentityChangeSet::default();
-        removed.removed.insert(y);
-        apply_in_tx(&mut conn, &a, &removed);
-
-        let strict = load_prekeyed(&conn, &a, &LoadCtx::strict())
-            .expect_err("a tombstoned owner's leftover key must abort a strict load");
-        assert!(
-            matches!(strict, WalletStorageError::OrphanedIdentityEntry { .. }),
-            "expected OrphanedIdentityEntry, got {strict:?}"
-        );
-
-        let state = load_prekeyed(&conn, &a, &LoadCtx::recovery())
-            .expect("tombstoned-owner orphan must be skipped in recovery, not fatal");
-        assert!(
-            state
-                .wallet_identities
-                .get(&a)
-                .map(|m| m.is_empty())
-                .unwrap_or(true),
-            "tombstoned identity must not surface in the loaded state"
-        );
-    }
-
-    /// The same logical-delete skip, for a tombstoned UNOWNED identity.
-    ///
-    /// Not a duplicate of the wallet-owned case above: the skip depends on
-    /// `load_tombstoned_ids` recognising the owner as tombstoned, and that
-    /// query is scoped by `wallet_id`. Scoped with `=` it cannot match a
-    /// NULL, so an unowned tombstone is invisible, its surviving key rows
-    /// look like owners that vanished for no reason, and the read fails
-    /// with `OrphanedIdentityEntry` — the exact brick this whole line of
-    /// work exists to prevent, re-entering through the unowned door. The
-    /// NULL-safe `IS` is what closes it, and this test is what holds it
-    /// closed: revert that predicate to `= ?1` and this fails.
-    #[test]
-    fn load_prekeyed_skips_orphaned_keys_of_tombstoned_unowned_owner_in_recovery() {
-        use platform_wallet::changeset::IdentityKeysChangeSet;
-
-        let mut conn = migrated_conn();
-        let unowned = [0u8; 32];
-        let z = Identifier::from([0x9Cu8; 32]);
-
-        let mut ids = IdentityChangeSet::default();
-        ids.identities.insert(z, entry([0x9C; 32], None, 30, None));
-        let mut keys = IdentityKeysChangeSet::default();
-        keys.upserts.insert((z, 0), sample_key_entry(z, 0x9D));
-        {
-            let tx = conn.transaction().unwrap();
-            apply(&tx, &unowned, &ids).unwrap();
-            crate::sqlite::schema::identity_keys::apply(&tx, &unowned, &keys).unwrap();
-            tx.commit().unwrap();
-        }
-
-        // Tombstone Z. Its key row survives — a logical delete tombstones
-        // the identity, it does not reap the children.
-        let mut removed = IdentityChangeSet::default();
-        removed.removed.insert(z);
-        apply_in_tx(&mut conn, &unowned, &removed);
-        let surviving_keys: i64 = conn
-            .query_row(
-                "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
-                params![&z.to_buffer()[..]],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert_eq!(
-            surviving_keys, 1,
-            "the orphaned key row must actually exist, or this test proves nothing"
-        );
-
-        let state = load_prekeyed(&conn, &unowned, &LoadCtx::recovery())
-            .expect("a tombstoned UNOWNED owner's orphan key must be skipped in recovery");
-        assert!(
-            state.out_of_wallet_identities.is_empty(),
-            "the tombstoned identity must not surface in the loaded state"
-        );
-    }
-
     /// The delete's scope guard, which nothing else holds in place.
     ///
     /// `(identity_id, key_id)` is the primary key, so `wallet_id` in the
@@ -1325,7 +1467,7 @@ mod tests {
         keys.upserts.insert((x, 0), sample_key_entry(x, 0xC4));
         {
             let tx = conn.transaction().unwrap();
-            apply(&tx, &owner, &ids).unwrap();
+            apply_upserts(&tx, &owner, &ids).unwrap();
             crate::sqlite::schema::identity_keys::apply(&tx, &owner, &keys).unwrap();
             tx.commit().unwrap();
         }
@@ -1433,8 +1575,8 @@ mod tests {
         let blob_id = [0x02u8; 32]; // disagreeing blob
         let payload = blob::encode(&entry(blob_id, Some(a), 100, Some(1))).unwrap();
         conn.execute(
-            "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-             VALUES (?1, ?2, 1, ?3, 0)",
+            "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+             VALUES (?1, ?2, 1, ?3)",
             params![&typed_id[..], &a[..], payload],
         )
         .unwrap();
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/schema/identity_keys.rs b/packages/rs-platform-wallet-storage/src/sqlite/schema/identity_keys.rs
index 8c129ffdaeb..3a60345a078 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/schema/identity_keys.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/schema/identity_keys.rs
@@ -241,7 +241,8 @@ pub fn load_state(
     // those keys are unreachable — `wallet_id = NULL` is never true.
     let wallet_id_param = super::wallet_id_to_param(wallet_id);
     let mut stmt = conn.prepare(
-        "SELECT identity_id, key_id, length(public_key_blob), public_key_blob \
+        "SELECT identity_id, key_id, length(public_key_blob), public_key_blob, \
+                public_key_hash \
          FROM identity_keys WHERE wallet_id IS ?1",
     )?;
     let mut rows = stmt.query(params![wallet_id_param])?;
@@ -250,6 +251,7 @@ pub fn load_state(
         let key_id: i64 = row.get(1)?;
         blob::check_size(row.get::<_, i64>(2)?)?;
         let payload: Vec<u8> = row.get(3)?;
+        let typed_public_key_hash: Vec<u8> = row.get(4)?;
         let id32 = super::id32("identity_keys.identity_id", &identity_id_bytes)?;
         let identity_id = Identifier::from(id32);
         let key_id: KeyID =
@@ -262,9 +264,13 @@ pub fn load_state(
         // `public_key.id()` is verified too — it becomes the DPP
         // signing-selection map key via `add_public_key`, so a mismatch would
         // file the key under a wrong KeyID rather than being caught here.
+        // `public_key_hash` is the indexed lookup column while the blob is
+        // what callers receive, so a divergence makes a key findable under a
+        // hash it does not carry.
         if entry.identity_id != identity_id
             || entry.key_id != key_id
             || entry.public_key.id() != key_id
+            || entry.public_key_hash[..] != typed_public_key_hash[..]
         {
             return Err(WalletStorageError::IdentityKeyEntryMismatch);
         }
@@ -465,6 +471,35 @@ mod tests {
         );
     }
 
+    /// `load_state` rejects a row whose typed `public_key_hash` column
+    /// disagrees with the hash inside the decoded blob. The column is the
+    /// indexed lookup key while the blob is what callers receive, so a
+    /// divergence means a key is findable under a hash it does not carry.
+    #[test]
+    fn load_state_rejects_public_key_hash_column_mismatch() {
+        let conn = migrated_conn();
+        let wallet = [0x44u8; 32];
+        let typed_identity = [0xEEu8; 32];
+        let wire = IdentityKeyWire {
+            identity_id: Identifier::from(typed_identity),
+            key_id: 0,
+            public_key_bincode: bincode::encode_to_vec(sample_public_key(), blob::bounded_config())
+                .unwrap(),
+            // `insert_key_row` writes an all-zero hash column, so a non-zero
+            // blob hash is the drift under test.
+            public_key_hash: [0x77u8; 20],
+            wallet_id: None,
+            derivation_indices: None,
+        };
+        insert_key_row(&conn, &wallet, &typed_identity, &wire);
+
+        let err = load_state(&conn, &wallet).expect_err("public_key_hash mismatch must fail");
+        assert!(
+            matches!(err, WalletStorageError::IdentityKeyEntryMismatch),
+            "expected IdentityKeyEntryMismatch, got {err:?}"
+        );
+    }
+
     /// `load_state` rejects a row whose inner `IdentityPublicKey.id()`
     /// disagrees with the typed `key_id` column. That inner id becomes the
     /// DPP signing-selection map key via `add_public_key`, so a mismatch
diff --git a/packages/rs-platform-wallet-storage/src/sqlite/util/wallet.rs b/packages/rs-platform-wallet-storage/src/sqlite/util/wallet.rs
index 16291fbf20d..ca14c7ed8f2 100644
--- a/packages/rs-platform-wallet-storage/src/sqlite/util/wallet.rs
+++ b/packages/rs-platform-wallet-storage/src/sqlite/util/wallet.rs
@@ -387,6 +387,12 @@ fn route_to_funds_account(
     owner: Option<&OwningAccount>,
     orphaned_owners: &mut Vec<String>,
 ) -> usize {
+    // INTENTIONAL(funds-account-fallback): an unattributable owner routes to
+    // account 0 rather than failing. Accepted risk: until the next sync warms
+    // the per-account view, such a UTXO or used address is attributed to the
+    // first funds account instead of its own. Failing closed here would brick
+    // wallets whose owners legitimately have no funds account (provider
+    // accounts sit on a non-secp256k1 curve), which is the worse outcome.
     match owner {
         None => 0,
         Some(owner) => account_keys
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_compile_time.rs b/packages/rs-platform-wallet-storage/tests/sqlite_compile_time.rs
index fb25a7af8c5..16d225c1813 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_compile_time.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_compile_time.rs
@@ -110,12 +110,7 @@ const READ_ONLY_PREPARE_ALLOWED: &[(&str, &str)] = &[
     // `load_state` (`SELECT identity_id, length(entry_blob)…`).
     (
         "identities.rs",
-        "length(entry_blob), entry_blob, tombstoned",
-    ),
-    // load_tombstoned_ids supplies the merge's positive tombstone signal.
-    (
-        "identities.rs",
-        "SELECT identity_id FROM identities WHERE",
+        "length(entry_blob), entry_blob",
     ),
     ("contacts.rs", "SELECT owner_id, contact_id, state"),
     (
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_contacts_keys_rehydration.rs b/packages/rs-platform-wallet-storage/tests/sqlite_contacts_keys_rehydration.rs
index 8f77f85050b..efdda52c256 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_contacts_keys_rehydration.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_contacts_keys_rehydration.rs
@@ -475,37 +475,37 @@ fn tc8_out_of_wallet_identity_loads_empty() {
     assert!(managed.dashpay().incoming_contact_requests().is_empty());
 }
 
-/// TC-9 — a tombstoned identity's orphaned key/contact rows are the one
-/// orphan class recovery mode forgives. Strict refuses them: "the owner is
-/// gone" is exactly the state that silently discards live key material, so
-/// only an operator who asked for a best-effort load gets the old skip.
+/// TC-9 — a `contacts` row whose owner identity is not loaded is the
+/// orphan class recovery mode forgives. Strict refuses it: "the owner is
+/// gone" is exactly the state that silently discards live contact
+/// material, so only an operator who asked for a best-effort load gets
+/// the skip.
+///
+/// `contacts` is keyed by `owner_id` with no foreign key to `identities`
+/// (only to `wallets`), which is what makes this row writable at all — a
+/// removal sweeps such rows via the delete trigger, so one surviving here
+/// means genuine corruption rather than routine bookkeeping.
 #[test]
-fn tc9_tombstoned_identity_orphan_rows_load_only_in_recovery() {
+fn tc9_orphaned_contact_row_loads_only_in_recovery() {
     let (persister, _tmp, path) = fresh_persister();
     let w = wid(0xC9);
     ensure_wallet_meta(&persister, &w);
-    let id = Identifier::from([0x99; 32]);
+    let resident = Identifier::from([0x98; 32]);
+    let ghost = Identifier::from([0x99; 32]);
     let contact = Identifier::from([0xAB; 32]);
     let mut established_map = BTreeMap::new();
     established_map.insert(
         SentContactRequestKey {
-            owner_id: id,
+            owner_id: ghost,
             recipient_id: contact,
         },
-        established(id, contact),
+        established(ghost, contact),
     );
-    // Store identity + key + contact.
     persister
         .store(
             w,
             PlatformWalletChangeSet {
-                identities: Some(id_changeset([wallet_identity_entry(id, w, 0)])),
-                identity_keys: Some(keys_changeset([key_entry(
-                    id,
-                    0,
-                    0x99,
-                    SecurityLevel::HIGH,
-                )])),
+                identities: Some(id_changeset([wallet_identity_entry(resident, w, 0)])),
                 contacts: Some(ContactChangeSet {
                     established: established_map,
                     ..Default::default()
@@ -514,23 +514,11 @@ fn tc9_tombstoned_identity_orphan_rows_load_only_in_recovery() {
             },
         )
         .unwrap();
-    // Tombstone the identity only; its key/contact rows are left behind.
-    let mut removed = IdentityChangeSet::default();
-    removed.removed.insert(id);
-    persister
-        .store(
-            w,
-            PlatformWalletChangeSet {
-                identities: Some(removed),
-                ..Default::default()
-            },
-        )
-        .unwrap();
     drop(persister);
 
     let strict = reopen(&path)
         .load()
-        .expect_err("orphan rows of a tombstoned owner must abort a strict load");
+        .expect_err("an orphaned contact row must abort a strict load");
     let PersistenceError::Backend { source, .. } = strict else {
         panic!("expected a typed backend error, got {strict:?}");
     };
@@ -554,57 +542,55 @@ fn tc9_tombstoned_identity_orphan_rows_load_only_in_recovery() {
         recovery
             .last_load_degradation()
             .by_site
-            .get(&platform_wallet_storage::LoadSite::TombstonedIdentityOrphan)
+            .get(&platform_wallet_storage::LoadSite::MissingIdentityOwner)
             .copied(),
-        // One per leftover row: the key row and the established-contact row.
-        Some(2),
-        "both leftover collections must be counted"
+        Some(1),
+        "the skipped row must be counted, never silently dropped"
     );
     let im = &state.wallets[&w].identity_manager;
     let present = im
         .wallet_identities
         .values()
         .flat_map(|m| m.values())
-        .any(|m| m.identity.id() == id)
-        || im.out_of_wallet_identities.contains_key(&id);
+        .any(|m| m.identity.id() == ghost)
+        || im.out_of_wallet_identities.contains_key(&ghost);
     assert!(
         !present,
-        "tombstoned identity must be absent from both buckets"
+        "the ghost owner must not be conjured into a bucket"
     );
 }
 
-/// Several leftover rows of one tombstoned owner in one collection must
+/// Several orphaned rows of one missing owner in one collection must
 /// count several times: every other `LoadSite` counts occurrences, so a
 /// rescue operator reading `by_site` would otherwise be unable to tell
-/// three lost keys from three lost collections.
+/// three lost contacts from three lost collections.
 #[test]
-fn tombstoned_identity_orphan_rows_are_counted_per_row() {
+fn orphaned_rows_of_one_owner_are_counted_per_row() {
     let (persister, _tmp, path) = fresh_persister();
     let w = wid(0xCA);
     ensure_wallet_meta(&persister, &w);
-    let id = Identifier::from([0x9A; 32]);
-    persister
-        .store(
-            w,
-            PlatformWalletChangeSet {
-                identities: Some(id_changeset([wallet_identity_entry(id, w, 0)])),
-                identity_keys: Some(keys_changeset([
-                    key_entry(id, 0, 0x91, SecurityLevel::HIGH),
-                    key_entry(id, 1, 0x92, SecurityLevel::HIGH),
-                    key_entry(id, 2, 0x93, SecurityLevel::HIGH),
-                ])),
-                ..Default::default()
+    let resident = Identifier::from([0x99; 32]);
+    let ghost = Identifier::from([0x9A; 32]);
+    let mut established_map = BTreeMap::new();
+    for contact in [0xC1u8, 0xC2, 0xC3] {
+        let contact = Identifier::from([contact; 32]);
+        established_map.insert(
+            SentContactRequestKey {
+                owner_id: ghost,
+                recipient_id: contact,
             },
-        )
-        .unwrap();
-    // Tombstone the owner; its three key rows are left behind.
-    let mut removed = IdentityChangeSet::default();
-    removed.removed.insert(id);
+            established(ghost, contact),
+        );
+    }
     persister
         .store(
             w,
             PlatformWalletChangeSet {
-                identities: Some(removed),
+                identities: Some(id_changeset([wallet_identity_entry(resident, w, 0)])),
+                contacts: Some(ContactChangeSet {
+                    established: established_map,
+                    ..Default::default()
+                }),
                 ..Default::default()
             },
         )
@@ -623,10 +609,10 @@ fn tombstoned_identity_orphan_rows_are_counted_per_row() {
         recovery
             .last_load_degradation()
             .by_site
-            .get(&platform_wallet_storage::LoadSite::TombstonedIdentityOrphan)
+            .get(&platform_wallet_storage::LoadSite::MissingIdentityOwner)
             .copied(),
         Some(3),
-        "each leftover key row must be counted"
+        "each orphaned contact row must be counted"
     );
 }
 
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_identity_hard_delete.rs b/packages/rs-platform-wallet-storage/tests/sqlite_identity_hard_delete.rs
new file mode 100644
index 00000000000..27fffbeb45a
--- /dev/null
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_identity_hard_delete.rs
@@ -0,0 +1,762 @@
+#![allow(clippy::field_reassign_with_default)]
+
+//! `IdentityChangeSet.removed` is a physical `DELETE FROM identities`.
+//!
+//! Every dependent row goes with it — through the native FK cascade
+//! where one is live, and through `cascade_children_on_identity_delete`
+//! where none is. Three shapes need the trigger rather than the FKs:
+//! an out-of-wallet identity's `identity_keys` (the compound FK is
+//! dormant once `wallet_id` is NULL), and `contacts` / `ignored_senders`
+//! (keyed by `owner_id` with no FK to `identities` at all).
+
+mod common;
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use common::{ensure_wallet_meta, fresh_persister, wid};
+use dpp::identity::accessors::IdentityGettersV0;
+use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
+use dpp::identity::{IdentityPublicKey, KeyType, Purpose, SecurityLevel};
+use dpp::platform_value::BinaryData;
+use dpp::prelude::Identifier;
+use platform_wallet::changeset::{
+    ContactChangeSet, IdentityChangeSet, IdentityEntry, IdentityKeyEntry, IdentityKeysChangeSet,
+    PersistenceError, PersistenceErrorKind, PlatformWalletChangeSet, PlatformWalletPersistence,
+    SentContactRequestKey, TokenBalanceChangeSet,
+};
+use platform_wallet::wallet::identity::{ContactRequest, EstablishedContact, IdentityStatus};
+use platform_wallet::wallet::platform_wallet::WalletId;
+use platform_wallet_storage::sqlite::migrations as mig;
+use rusqlite::{params, Connection};
+
+/// The all-zero scope every reader and writer maps to a NULL `wallet_id`.
+const UNOWNED: WalletId = [0u8; 32];
+
+fn reopen(path: &std::path::Path) -> platform_wallet_storage::SqlitePersister {
+    platform_wallet_storage::SqlitePersister::open(
+        platform_wallet_storage::SqlitePersisterConfig::new(path),
+    )
+    .expect("reopen persister")
+}
+
+fn iid(byte: u8) -> Identifier {
+    Identifier::from([byte; 32])
+}
+
+fn entry(id: Identifier, wallet_id: Option<WalletId>, index: Option<u32>) -> IdentityEntry {
+    IdentityEntry {
+        id,
+        balance: 1_000,
+        revision: 1,
+        identity_index: index,
+        last_updated_balance_block_time: None,
+        last_synced_keys_block_time: None,
+        dpns_names: Vec::new(),
+        contested_dpns_names: Vec::new(),
+        status: IdentityStatus::Active,
+        wallet_id,
+        dashpay_profile: None,
+        dashpay_payments: Default::default(),
+        contact_profiles: Default::default(),
+        ignored_senders: Default::default(),
+    }
+}
+
+fn key_entry(id: Identifier, key_id: u32, byte: u8) -> IdentityKeyEntry {
+    IdentityKeyEntry {
+        identity_id: id,
+        key_id,
+        public_key: IdentityPublicKey::V0(IdentityPublicKeyV0 {
+            id: key_id,
+            purpose: Purpose::AUTHENTICATION,
+            security_level: SecurityLevel::HIGH,
+            contract_bounds: None,
+            key_type: KeyType::ECDSA_SECP256K1,
+            read_only: false,
+            data: BinaryData::new(vec![byte; 33]),
+            disabled_at: None,
+        }),
+        public_key_hash: [byte; 20],
+        wallet_id: None,
+        derivation_indices: None,
+    }
+}
+
+fn keys_of(id: Identifier, key_id: u32, byte: u8) -> IdentityKeysChangeSet {
+    let mut cs = IdentityKeysChangeSet::default();
+    cs.upserts.insert((id, key_id), key_entry(id, key_id, byte));
+    cs
+}
+
+fn contact_request(sender: Identifier, recipient: Identifier) -> ContactRequest {
+    ContactRequest {
+        sender_id: sender,
+        recipient_id: recipient,
+        sender_key_index: 1,
+        recipient_key_index: 2,
+        account_reference: 3,
+        encrypted_account_label: None,
+        encrypted_public_key: vec![9, 9, 9],
+        auto_accept_proof: None,
+        core_height_created_at: 42,
+        created_at: 7,
+    }
+}
+
+/// An established pair plus an ignored sender, both owned by `owner` —
+/// the two `owner_id`-keyed tables that carry no FK to `identities`.
+fn contacts_of(owner: Identifier, contact: Identifier) -> ContactChangeSet {
+    let mut established = BTreeMap::new();
+    established.insert(
+        SentContactRequestKey {
+            owner_id: owner,
+            recipient_id: contact,
+        },
+        EstablishedContact {
+            contact_identity_id: contact,
+            outgoing_request: contact_request(owner, contact),
+            incoming_request: contact_request(contact, owner),
+            alias: Some("friend".into()),
+            note: None,
+            is_hidden: false,
+            accepted_accounts: vec![0],
+            payment_channel_broken: false,
+            contact_account_label: None,
+            external_account_reference: None,
+        },
+    );
+    ContactChangeSet {
+        established,
+        ignored: BTreeSet::from([(owner, contact)]),
+        ..Default::default()
+    }
+}
+
+fn balances_of(owner: Identifier, token: Identifier) -> TokenBalanceChangeSet {
+    let mut cs = TokenBalanceChangeSet::default();
+    cs.balances.insert((owner, token), 77);
+    cs
+}
+
+fn removal_of(id: Identifier) -> IdentityChangeSet {
+    let mut cs = IdentityChangeSet::default();
+    cs.removed.insert(id);
+    cs
+}
+
+fn upsert_of(e: IdentityEntry) -> IdentityChangeSet {
+    let mut cs = IdentityChangeSet::default();
+    cs.identities.insert(e.id, e);
+    cs
+}
+
+/// `SELECT COUNT(*)` with one 32-byte-identifier parameter.
+fn count_by_id(conn: &Connection, sql: &str, id: Identifier) -> i64 {
+    conn.query_row(sql, params![id.as_slice()], |r| r.get(0))
+        .expect("count query")
+}
+
+/// Every row a removed identity owns, counted in one pass.
+fn dependents_of(conn: &Connection, id: Identifier) -> Vec<(&'static str, i64)> {
+    [
+        (
+            "identities",
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+        ),
+        (
+            "identity_keys",
+            "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
+        ),
+        (
+            "contacts",
+            "SELECT COUNT(*) FROM contacts WHERE owner_id = ?1",
+        ),
+        (
+            "ignored_senders",
+            "SELECT COUNT(*) FROM ignored_senders WHERE owner_id = ?1",
+        ),
+        (
+            "token_balances",
+            "SELECT COUNT(*) FROM token_balances WHERE identity_id = ?1",
+        ),
+        (
+            "meta_identity",
+            "SELECT COUNT(*) FROM meta_identity WHERE identity_id = ?1",
+        ),
+        (
+            "meta_token",
+            "SELECT COUNT(*) FROM meta_token WHERE identity_id = ?1",
+        ),
+    ]
+    .into_iter()
+    .map(|(table, sql)| (table, count_by_id(conn, sql, id)))
+    .collect()
+}
+
+/// The base case: `removed` deletes the row rather than flagging it, and
+/// leaves its wallet-mate alone.
+#[test]
+fn removed_identity_row_is_physically_deleted() {
+    let (persister, _tmp, path) = fresh_persister();
+    let w = wid(0xD0);
+    ensure_wallet_meta(&persister, &w);
+    let keep = iid(0x01);
+    let drop_me = iid(0x02);
+
+    let mut both = IdentityChangeSet::default();
+    both.identities.insert(keep, entry(keep, Some(w), Some(1)));
+    both.identities
+        .insert(drop_me, entry(drop_me, Some(w), Some(2)));
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(both),
+                ..Default::default()
+            },
+        )
+        .expect("seed both identities");
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(drop_me)),
+                ..Default::default()
+            },
+        )
+        .expect("remove one");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let conn = p2.lock_conn_for_test();
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+            drop_me
+        ),
+        0,
+        "a removed identity leaves no row behind"
+    );
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+            keep
+        ),
+        1,
+        "the wallet-mate must survive its sibling's removal"
+    );
+}
+
+/// A wallet-owned identity's whole dependent set goes with it: keys and
+/// balances via live FKs, `contacts` / `ignored_senders` / `meta_*` via
+/// the delete triggers.
+#[test]
+fn removing_a_wallet_identity_sweeps_every_dependent() {
+    let (persister, _tmp, path) = fresh_persister();
+    let w = wid(0xD1);
+    ensure_wallet_meta(&persister, &w);
+    let owner = iid(0x11);
+    let contact = iid(0x12);
+    let token = iid(0x13);
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(owner, Some(w), Some(1)))),
+                identity_keys: Some(keys_of(owner, 0, 0xAA)),
+                contacts: Some(contacts_of(owner, contact)),
+                token_balances: Some(balances_of(owner, token)),
+                ..Default::default()
+            },
+        )
+        .expect("seed identity and dependents");
+
+    // Metadata carries no FK at all, so seed it directly — the AFTER
+    // DELETE brooms are its only cleanup path.
+    {
+        let conn = persister.lock_conn_for_test();
+        conn.execute(
+            "INSERT INTO meta_identity (identity_id, key, value) VALUES (?1, 'alias', X'00')",
+            params![owner.as_slice()],
+        )
+        .expect("seed meta_identity");
+        conn.execute(
+            "INSERT INTO meta_token (identity_id, token_id, key, value) \
+             VALUES (?1, ?2, 'note', X'00')",
+            params![owner.as_slice(), token.as_slice()],
+        )
+        .expect("seed meta_token");
+    }
+
+    {
+        let conn = persister.lock_conn_for_test();
+        for (table, rows) in dependents_of(&conn, owner) {
+            assert_eq!(rows, 1, "`{table}` must be seeded before the removal");
+        }
+    }
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(owner)),
+                ..Default::default()
+            },
+        )
+        .expect("remove the identity");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let conn = p2.lock_conn_for_test();
+    for (table, rows) in dependents_of(&conn, owner) {
+        assert_eq!(rows, 0, "`{table}` must be swept by the identity removal");
+    }
+}
+
+/// The dormant-FK case. `identity_keys`' FK to `identities` is compound
+/// (`wallet_id, identity_id`), and SQLite's MATCH SIMPLE skips
+/// enforcement entirely once a child key column is NULL — so an
+/// out-of-wallet identity's keys are reachable ONLY through the trigger.
+#[test]
+fn removing_an_out_of_wallet_identity_deletes_its_keys() {
+    let (persister, _tmp, path) = fresh_persister();
+    let id = iid(0x7A);
+
+    persister
+        .store(
+            UNOWNED,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(id, None, None))),
+                identity_keys: Some(keys_of(id, 0, 0xAB)),
+                ..Default::default()
+            },
+        )
+        .expect("seed unowned identity with a key");
+
+    {
+        let conn = persister.lock_conn_for_test();
+        let null_scoped: i64 = conn
+            .query_row(
+                "SELECT COUNT(*) FROM identity_keys \
+                 WHERE identity_id = ?1 AND wallet_id IS NULL",
+                params![id.as_slice()],
+                |r| r.get(0),
+            )
+            .expect("count null-scoped keys");
+        assert_eq!(
+            null_scoped, 1,
+            "the key must be NULL-scoped, else this test is not exercising \
+             the dormant FK at all"
+        );
+    }
+
+    persister
+        .store(
+            UNOWNED,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(id)),
+                ..Default::default()
+            },
+        )
+        .expect("remove the unowned identity");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let conn = p2.lock_conn_for_test();
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+            id
+        ),
+        0,
+        "the unowned identity row must be gone"
+    );
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
+            id
+        ),
+        0,
+        "the dormant compound FK cannot cascade a NULL-scoped key; the \
+         AFTER DELETE trigger must"
+    );
+}
+
+/// A merged buffer can carry `removed` for an identity alongside key /
+/// contact / balance upserts for that same identity — sync writes its
+/// keys, the host then removes it, both land in one flush. The removal
+/// must run AFTER every identity-scoped child writer: doing it first
+/// pulls the FK parent out from under those inserts and fails the whole
+/// flush.
+#[test]
+fn removal_wins_over_child_writes_in_one_changeset() {
+    let (persister, _tmp, path) = fresh_persister();
+    let w = wid(0xD2);
+    ensure_wallet_meta(&persister, &w);
+    let owner = iid(0x21);
+    let contact = iid(0x22);
+    let token = iid(0x23);
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(owner, Some(w), Some(1)))),
+                ..Default::default()
+            },
+        )
+        .expect("seed the identity");
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(owner)),
+                identity_keys: Some(keys_of(owner, 0, 0xCC)),
+                contacts: Some(contacts_of(owner, contact)),
+                token_balances: Some(balances_of(owner, token)),
+                ..Default::default()
+            },
+        )
+        .expect("a removal alongside child writes must commit, not FK-fail");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let conn = p2.lock_conn_for_test();
+    for (table, rows) in dependents_of(&conn, owner) {
+        assert_eq!(
+            rows, 0,
+            "`{table}`: the removal must win over same-changeset child writes"
+        );
+    }
+}
+
+/// Removal is terminal, not reversible: re-adding the same identity id
+/// gets a blank identity, never its old keys / contacts / balances back.
+/// This is what the in-memory `IdentityManager` already does — it drops
+/// the whole `ManagedIdentity` — so storage and memory agree.
+#[test]
+fn re_added_identity_starts_from_zero() {
+    let (persister, _tmp, path) = fresh_persister();
+    let w = wid(0xD3);
+    ensure_wallet_meta(&persister, &w);
+    let owner = iid(0x31);
+    let contact = iid(0x32);
+    let token = iid(0x33);
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(owner, Some(w), Some(1)))),
+                identity_keys: Some(keys_of(owner, 0, 0xAA)),
+                contacts: Some(contacts_of(owner, contact)),
+                token_balances: Some(balances_of(owner, token)),
+                ..Default::default()
+            },
+        )
+        .expect("seed identity and dependents");
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(owner)),
+                ..Default::default()
+            },
+        )
+        .expect("remove");
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(owner, Some(w), Some(1)))),
+                ..Default::default()
+            },
+        )
+        .expect("re-add the same identity id");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let state = p2.load().expect("load after re-add");
+    let managed = &state.wallets[&w].identity_manager.wallet_identities[&w][&1];
+    assert_eq!(managed.identity.id(), owner, "the identity is back");
+    assert!(
+        managed.identity.public_keys().is_empty(),
+        "a re-added identity must not inherit the removed one's keys"
+    );
+    assert!(
+        managed.dashpay().established_contacts().is_empty(),
+        "a re-added identity must not inherit the removed one's contacts"
+    );
+
+    let conn = p2.lock_conn_for_test();
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM token_balances WHERE identity_id = ?1",
+            owner
+        ),
+        0,
+        "a re-added identity must not inherit the removed one's balances"
+    );
+}
+
+/// The wallet stays loadable under the STRICT policy after a removal.
+/// Leftover `identity_keys` / `contacts` rows would surface as
+/// `OrphanedIdentityEntry` and take the whole wallet's load down with
+/// them, turning an ordinary `remove_identity` into a bricked wallet.
+#[test]
+fn strict_load_survives_a_removed_identity() {
+    let (persister, _tmp, path) = fresh_persister();
+    let w = wid(0xD4);
+    ensure_wallet_meta(&persister, &w);
+    let removed = iid(0x41);
+    let contact = iid(0x42);
+    let survivor = iid(0x43);
+
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(removed, Some(w), Some(1)))),
+                identity_keys: Some(keys_of(removed, 0, 0x99)),
+                contacts: Some(contacts_of(removed, contact)),
+                ..Default::default()
+            },
+        )
+        .expect("seed the identity that will be removed");
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(survivor, Some(w), Some(2)))),
+                ..Default::default()
+            },
+        )
+        .expect("seed the survivor");
+    persister
+        .store(
+            w,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(removed)),
+                ..Default::default()
+            },
+        )
+        .expect("remove");
+    drop(persister);
+
+    let p2 = reopen(&path);
+    let state = p2.load().expect("a strict load must survive a removal");
+    assert!(
+        !p2.last_load_degradation().degraded,
+        "an ordinary removal is not a degraded load"
+    );
+    let bucket = &state.wallets[&w].identity_manager.wallet_identities[&w];
+    assert_eq!(bucket.len(), 1, "only the survivor remains");
+    assert_eq!(bucket[&2].identity.id(), survivor);
+}
+
+/// The seam between V014 and V015: an `identity_keys` orphan can be
+/// neither written nor left behind.
+///
+/// V014's NULL-scope trigger refuses a key naming an identity that is not
+/// there, closing the only door MATCH SIMPLE's dormant compound FK left
+/// open on the write side. V015's delete broom closes the read side, by
+/// sweeping such keys when their identity goes. Either migration alone
+/// leaves `identity_keys` able to orphan; this pins that together they
+/// do not, so `MissingIdentityOwner` is reachable only through the
+/// FK-less `contacts` / `ignored_senders` tables (covered by
+/// `sqlite_contacts_keys_rehydration`).
+#[test]
+fn null_scoped_key_can_neither_name_a_missing_identity_nor_outlive_one() {
+    let (persister, _tmp, _path) = fresh_persister();
+    let ghost = iid(0x6B);
+
+    // Write side (V014): the key is refused, and nothing lands.
+    let err = persister
+        .store(
+            UNOWNED,
+            PlatformWalletChangeSet {
+                identity_keys: Some(keys_of(ghost, 0, 0x6C)),
+                ..Default::default()
+            },
+        )
+        .expect_err("a NULL-scoped key naming no identity must be refused");
+    let PersistenceError::Backend { kind, .. } = &err else {
+        panic!("expected a typed backend error, got {err:?}");
+    };
+    assert_eq!(
+        *kind,
+        PersistenceErrorKind::Constraint,
+        "a guard trigger firing is an integrity violation, not an engine fault"
+    );
+    {
+        let conn = persister.lock_conn_for_test();
+        assert_eq!(
+            count_by_id(
+                &conn,
+                "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
+                ghost
+            ),
+            0,
+            "the refused key must not have reached disk"
+        );
+    }
+
+    // Read side (V015): the same row, written legitimately under a live
+    // identity, does not survive that identity's removal.
+    persister
+        .store(
+            UNOWNED,
+            PlatformWalletChangeSet {
+                identities: Some(upsert_of(entry(ghost, None, None))),
+                identity_keys: Some(keys_of(ghost, 0, 0x6C)),
+                ..Default::default()
+            },
+        )
+        .expect("the same key is legal once its identity exists");
+    persister
+        .store(
+            UNOWNED,
+            PlatformWalletChangeSet {
+                identities: Some(removal_of(ghost)),
+                ..Default::default()
+            },
+        )
+        .expect("remove the unowned identity");
+
+    let conn = persister.lock_conn_for_test();
+    assert_eq!(
+        count_by_id(
+            &conn,
+            "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
+            ghost
+        ),
+        0,
+        "the removal must sweep the key the dormant FK cannot cascade"
+    );
+}
+
+/// V015 retires the `tombstoned` column, and purges the rows and
+/// dependents a pre-V015 database had already logically deleted.
+#[test]
+fn v015_purges_tombstoned_rows_and_retires_the_column() {
+    let mut conn = Connection::open_in_memory().expect("open in-memory db");
+    conn.pragma_update(None, "foreign_keys", true)
+        .expect("enable foreign keys");
+
+    // Stand the database up at every migration BEFORE this one, so the
+    // fixture is written against the schema V015 has to upgrade.
+    mig::runner()
+        .set_target(refinery::Target::Version(14))
+        .run(&mut conn)
+        .expect("migrate to the last pre-V015 schema");
+
+    let w = [0x5Au8; 32];
+    let tombstoned = [0x51u8; 32];
+    let live = [0x52u8; 32];
+    let contact = [0x53u8; 32];
+    let token = [0x54u8; 32];
+    conn.execute(
+        "INSERT INTO wallets (wallet_id, network, birth_height) VALUES (?1, 'testnet', 0)",
+        params![w.as_slice()],
+    )
+    .expect("insert wallet");
+    for (id, flag) in [(tombstoned, 1), (live, 0)] {
+        conn.execute(
+            "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
+             VALUES (?1, ?2, NULL, X'00', ?3)",
+            params![id.as_slice(), w.as_slice(), flag],
+        )
+        .expect("insert identity");
+        conn.execute(
+            "INSERT INTO identity_keys \
+                (wallet_id, identity_id, key_id, public_key_blob, public_key_hash) \
+             VALUES (?1, ?2, 0, X'00', X'00')",
+            params![w.as_slice(), id.as_slice()],
+        )
+        .expect("insert key");
+        conn.execute(
+            "INSERT INTO contacts (wallet_id, owner_id, contact_id, state) \
+             VALUES (?1, ?2, ?3, 'established')",
+            params![w.as_slice(), id.as_slice(), contact.as_slice()],
+        )
+        .expect("insert contact");
+        conn.execute(
+            "INSERT INTO ignored_senders (wallet_id, owner_id, sender_id) VALUES (?1, ?2, ?3)",
+            params![w.as_slice(), id.as_slice(), contact.as_slice()],
+        )
+        .expect("insert ignored sender");
+        conn.execute(
+            "INSERT INTO token_balances (identity_id, token_id, balance, updated_at) \
+             VALUES (?1, ?2, 1, 0)",
+            params![id.as_slice(), token.as_slice()],
+        )
+        .expect("insert balance");
+        conn.execute(
+            "INSERT INTO meta_identity (identity_id, key, value) VALUES (?1, 'alias', X'00')",
+            params![id.as_slice()],
+        )
+        .expect("insert meta_identity");
+    }
+
+    mig::run(&mut conn).expect("migrate to the newest version");
+
+    let columns: Vec<String> = {
+        let mut stmt = conn
+            .prepare("PRAGMA table_info(identities)")
+            .expect("prepare table_info");
+        let rows = stmt
+            .query_map([], |r| r.get::<_, String>(1))
+            .expect("query table_info");
+        rows.map(|r| r.expect("column name")).collect()
+    };
+    assert!(
+        !columns.contains(&"tombstoned".to_string()),
+        "V015 must drop the tombstoned column, got {columns:?}"
+    );
+
+    for (table, sql) in [
+        (
+            "identities",
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+        ),
+        (
+            "identity_keys",
+            "SELECT COUNT(*) FROM identity_keys WHERE identity_id = ?1",
+        ),
+        (
+            "contacts",
+            "SELECT COUNT(*) FROM contacts WHERE owner_id = ?1",
+        ),
+        (
+            "ignored_senders",
+            "SELECT COUNT(*) FROM ignored_senders WHERE owner_id = ?1",
+        ),
+        (
+            "token_balances",
+            "SELECT COUNT(*) FROM token_balances WHERE identity_id = ?1",
+        ),
+        (
+            "meta_identity",
+            "SELECT COUNT(*) FROM meta_identity WHERE identity_id = ?1",
+        ),
+    ] {
+        let purged: i64 = conn
+            .query_row(sql, params![tombstoned.as_slice()], |r| r.get(0))
+            .expect("count purged");
+        assert_eq!(
+            purged, 0,
+            "`{table}` must be purged for a tombstoned identity"
+        );
+        let kept: i64 = conn
+            .query_row(sql, params![live.as_slice()], |r| r.get(0))
+            .expect("count kept");
+        assert_eq!(kept, 1, "`{table}` must be untouched for a live identity");
+    }
+}
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_concurrency.rs b/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_concurrency.rs
index ecf3b29fa85..18f125498bd 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_concurrency.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_concurrency.rs
@@ -93,7 +93,7 @@ fn live_occupant(p: &SqlitePersister, wallet_id: &WalletId, index: u32) -> Optio
     let conn = p.lock_conn_for_test();
     conn.query_row(
         "SELECT identity_id FROM identities \
-         WHERE wallet_id IS ?1 AND identity_index = ?2 AND tombstoned = 0",
+         WHERE wallet_id IS ?1 AND identity_index = ?2",
         params![wallet_id.as_slice(), i64::from(index)],
         |row| row.get::<_, Vec<u8>>(0),
     )
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_uniqueness.rs b/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_uniqueness.rs
index 8b113b45475..15ebc2fd157 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_uniqueness.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_identity_index_uniqueness.rs
@@ -85,7 +85,7 @@ fn backend_kind(err: &PersistenceError) -> PersistenceErrorKind {
     }
 }
 
-/// Live (non-tombstoned) occupant of `(wallet_id, index)`, if any.
+/// Occupant of `(wallet_id, index)`, if any.
 fn live_occupant(p: &SqlitePersister, wallet_id: &WalletId, index: u32) -> Option<[u8; 32]> {
     let conn = p.lock_conn_for_test();
     let wid_param: Option<&[u8]> = if *wallet_id == SENTINEL {
@@ -95,7 +95,7 @@ fn live_occupant(p: &SqlitePersister, wallet_id: &WalletId, index: u32) -> Optio
     };
     conn.query_row(
         "SELECT identity_id FROM identities \
-         WHERE wallet_id IS ?1 AND identity_index = ?2 AND tombstoned = 0",
+         WHERE wallet_id IS ?1 AND identity_index = ?2",
         params![wid_param, i64::from(index)],
         |row| row.get::<_, Vec<u8>>(0),
     )
@@ -104,17 +104,18 @@ fn live_occupant(p: &SqlitePersister, wallet_id: &WalletId, index: u32) -> Optio
     .map(|raw| raw.try_into().expect("32-byte identity_id"))
 }
 
-/// `Some(tombstoned)` when the row exists at all.
-fn row_tombstoned(p: &SqlitePersister, id: &Identifier) -> Option<bool> {
+/// Whether the identity has a row on disk. A removal deletes it, so
+/// "removed" and "never written" are the same observable state.
+fn row_exists(p: &SqlitePersister, id: &Identifier) -> bool {
     let conn = p.lock_conn_for_test();
     conn.query_row(
-        "SELECT tombstoned FROM identities WHERE identity_id = ?1",
+        "SELECT 1 FROM identities WHERE identity_id = ?1",
         params![id.as_slice()],
-        |row| row.get::<_, i64>(0),
+        |_| Ok(()),
     )
     .optional()
     .expect("query identity row")
-    .map(|t| t != 0)
+    .is_some()
 }
 
 /// Claim a slot by writing an `identities` row straight to the DB —
@@ -126,8 +127,8 @@ fn row_tombstoned(p: &SqlitePersister, id: &Identifier) -> Option<bool> {
 fn peer_claims_slot(p: &SqlitePersister, wallet_id: &WalletId, id: &Identifier, index: u32) {
     let conn = p.lock_conn_for_test();
     conn.execute(
-        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-         VALUES (?1, ?2, ?3, X'00', 0)",
+        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+         VALUES (?1, ?2, ?3, X'00')",
         params![id.as_slice(), wallet_id.as_slice(), i64::from(index)],
     )
     .expect("peer claims slot");
@@ -171,9 +172,8 @@ fn duplicate_index_is_rejected_at_write_time() {
         Some([0x01; 32]),
         "the resident identity must keep its slot"
     );
-    assert_eq!(
-        row_tombstoned(&p, &iid(0x02)),
-        None,
+    assert!(
+        !row_exists(&p, &iid(0x02)),
         "the rejected identity must not reach disk at all"
     );
 }
@@ -238,7 +238,7 @@ fn rejected_duplicate_does_not_swallow_a_staged_changeset() {
         Some([0x03; 32]),
         "the staged write survived the rejection"
     );
-    assert_eq!(row_tombstoned(&p, &iid(0x02)), None);
+    assert!(!row_exists(&p, &iid(0x02)));
 }
 
 /// The probe keys on the FLUSH SCOPE, not on the incoming identity's own
@@ -263,10 +263,10 @@ fn probe_keys_on_the_flush_scope_not_the_stored_wallet_id() {
     assert_eq!(live_occupant(&p, &w, 1), Some([0x01; 32]));
 }
 
-/// A tombstoned row holds no slot: remove-then-re-register at the same
+/// A removed row holds no slot: remove-then-re-register at the same
 /// index is legitimate reuse, not a collision.
 #[test]
-fn tombstoned_row_frees_its_slot_for_reuse() {
+fn removed_row_frees_its_slot_for_reuse() {
     let (p, _tmp, _path) = fresh_persister();
     let w = wid(0xF1);
     ensure_wallet_meta(&p, &w);
@@ -278,15 +278,15 @@ fn tombstoned_row_frees_its_slot_for_reuse() {
     p.store(w, identity_cs([identity_entry(0x02, Some(1))], []))
         .expect("the freed slot must be reusable");
 
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), Some(true));
+    assert!(!row_exists(&p, &iid(0x01)));
     assert_eq!(live_occupant(&p, &w, 1), Some([0x02; 32]));
 }
 
 /// Removal and re-registration merged into ONE changeset has a legal
-/// final state (the tombstone lands in the same transaction), so the
-/// probe must treat a removed id as holding no slot.
+/// final state (the delete lands in the same transaction), so the probe
+/// must treat a removed id as holding no slot.
 #[test]
-fn tombstone_and_reinsert_in_one_changeset_is_accepted() {
+fn removal_and_reinsert_in_one_changeset_is_accepted() {
     let (p, _tmp, _path) = fresh_persister();
     let w = wid(0xF2);
     ensure_wallet_meta(&p, &w);
@@ -294,9 +294,9 @@ fn tombstone_and_reinsert_in_one_changeset_is_accepted() {
         .expect("first identity at index 1");
 
     p.store(w, identity_cs([identity_entry(0x02, Some(1))], [iid(0x01)]))
-        .expect("tombstone + reinsert at the same index is legal");
+        .expect("removal + reinsert at the same index is legal");
 
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), Some(true));
+    assert!(!row_exists(&p, &iid(0x01)));
     assert_eq!(live_occupant(&p, &w, 1), Some([0x02; 32]));
 }
 
@@ -319,8 +319,8 @@ fn colliding_entries_in_one_changeset_are_rejected_without_picking_a_winner() {
         .expect_err("two identities cannot share one slot");
 
     assert_index_conflict(&err);
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), None);
-    assert_eq!(row_tombstoned(&p, &iid(0x02)), None);
+    assert!(!row_exists(&p, &iid(0x01)));
+    assert!(!row_exists(&p, &iid(0x02)));
     assert_eq!(live_occupant(&p, &w, 1), None);
 }
 
@@ -364,7 +364,7 @@ fn reupserting_the_same_identity_at_its_own_index_is_accepted() {
 
 /// An occupant that the SAME changeset moves to another index has
 /// vacated its old slot by the time the changeset lands, exactly like
-/// one it tombstones. Judging the final state, not the starting one, is
+/// one it removes. Judging the final state, not the starting one, is
 /// what makes the guard a uniqueness rule rather than a freeze.
 #[test]
 fn an_occupant_reindexed_in_the_same_changeset_frees_its_old_slot() {
@@ -437,9 +437,8 @@ fn an_occupant_losing_its_index_in_the_same_changeset_frees_its_slot() {
     .expect("A gives up its index in the same changeset that B claims it");
 
     assert_eq!(live_occupant(&p, &w, 1), Some([0x02; 32]));
-    assert_eq!(
-        row_tombstoned(&p, &iid(0x01)),
-        Some(false),
+    assert!(
+        row_exists(&p, &iid(0x01)),
         "A is still a live row, just no longer in a wallet slot"
     );
 }
@@ -462,7 +461,7 @@ fn walletless_identity_carrying_an_index_is_rejected() {
     );
     assert!(!typed.is_transient());
     assert_eq!(typed.persistence_kind(), PersistenceErrorKind::Constraint);
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), None);
+    assert!(!row_exists(&p, &iid(0x01)));
 }
 
 /// The companion positive case: a wallet-less identity WITHOUT an index
@@ -474,7 +473,7 @@ fn walletless_identity_without_an_index_is_accepted() {
     p.store(SENTINEL, identity_cs([identity_entry(0x01, None)], []))
         .expect("wallet-less identities are first-class");
 
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), Some(false));
+    assert!(row_exists(&p, &iid(0x01)));
 }
 
 /// A store checks disk and buffer as they are at that instant. A
@@ -499,7 +498,7 @@ fn flush_rejects_a_duplicate_that_a_peer_created_under_the_buffer() {
         Some([0x01; 32]),
         "the whole transaction rolls back — the peer's row stands"
     );
-    assert_eq!(row_tombstoned(&p, &iid(0x02)), None);
+    assert!(!row_exists(&p, &iid(0x02)));
 
     // A fatal flush failure drops that wallet's buffer rather than
     // restoring an unflushable changeset, so the retry is a no-op
@@ -533,17 +532,16 @@ fn a_slot_held_by_a_buffered_write_refuses_a_second_claimant() {
         Some([0x01; 32]),
         "the first caller's write is untouched by the rejection"
     );
-    assert_eq!(
-        row_tombstoned(&p, &iid(0x02)),
-        None,
+    assert!(
+        !row_exists(&p, &iid(0x02)),
         "the rejected changeset never reached the buffer"
     );
 }
 
 /// A buffered removal frees the slot it names: the check reads the
-/// merged view exactly as the flush will apply it, and `apply` inserts
-/// before it tombstones. Reclaiming the slot in a later store is
-/// legitimate reuse, not a collision.
+/// merged view exactly as the flush will apply it, and the flush inserts
+/// before it deletes. Reclaiming the slot in a later store is legitimate
+/// reuse, not a collision.
 #[test]
 fn a_buffered_removal_frees_its_slot_for_a_later_store() {
     let (p, _tmp, _path) = fresh_persister_with_mode(FlushMode::Manual);
@@ -557,7 +555,7 @@ fn a_buffered_removal_frees_its_slot_for_a_later_store() {
 
     p.flush(w).expect("the merged changeset is consistent");
     assert_eq!(live_occupant(&p, &w, 1), Some([0x02; 32]));
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), Some(true));
+    assert!(!row_exists(&p, &iid(0x01)));
 }
 
 /// One wallet's rejected flush is one wallet's problem: `commit_writes`
@@ -612,10 +610,9 @@ fn delete_wallet_proceeds_despite_unpersistable_pending_writes() {
         .expect("an unflushable buffer must not block the delete");
 
     assert_eq!(report.wallet_id, w);
-    assert_eq!(row_tombstoned(&p, &iid(0x01)), None);
-    assert_eq!(
-        row_tombstoned(&p, &iid(0x02)),
-        None,
+    assert!(!row_exists(&p, &iid(0x01)));
+    assert!(
+        !row_exists(&p, &iid(0x02)),
         "the peer's row went with the wallet's cascade"
     );
     let conn = p.lock_conn_for_test();
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_migrations.rs b/packages/rs-platform-wallet-storage/tests/sqlite_migrations.rs
index ac25fafbb37..076edbfcea3 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_migrations.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_migrations.rs
@@ -73,8 +73,8 @@ fn tc027_smoke_insert_every_table() {
     .unwrap();
     let identity_id = [7u8; 32];
     conn.execute(
-        "INSERT INTO identities (wallet_id, identity_index, identity_id, entry_blob, tombstoned) \
-         VALUES (?1, NULL, ?2, X'01', 0)",
+        "INSERT INTO identities (wallet_id, identity_index, identity_id, entry_blob) \
+         VALUES (?1, NULL, ?2, X'01')",
         params![wallet_id.as_slice(), identity_id.as_slice()],
     )
     .unwrap();
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_object_metadata.rs b/packages/rs-platform-wallet-storage/tests/sqlite_object_metadata.rs
index 0d24aafe2b4..6cd617efe19 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_object_metadata.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_object_metadata.rs
@@ -613,8 +613,8 @@ fn meta_identity_cleanup_fires_on_wallet_cascade() {
     )
     .unwrap();
     conn.execute(
-        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-         VALUES (?1, ?2, NULL, X'00', 0)",
+        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+         VALUES (?1, ?2, NULL, X'00')",
         params![&idy[..], &w[..]],
     )
     .unwrap();
@@ -682,8 +682,8 @@ fn meta_token_cleanup_fires_on_wallet_cascade_two_hops() {
     )
     .unwrap();
     conn.execute(
-        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-         VALUES (?1, ?2, NULL, X'00', 0)",
+        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+         VALUES (?1, ?2, NULL, X'00')",
         params![&idy[..], &w[..]],
     )
     .unwrap();
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_tombstone.rs b/packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_removal.rs
similarity index 67%
rename from packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_tombstone.rs
rename to packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_removal.rs
index 98260e6e44a..4ac407883b2 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_tombstone.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_qa_identity_removal.rs
@@ -1,12 +1,12 @@
 #![allow(clippy::field_reassign_with_default)]
 
-//! Write-path coverage for the `IdentityChangeSet.removed` tombstone
-//! branch. The tombstone runs a wallet-scoped, NULL-safe
-//! `UPDATE identities SET tombstoned = 1 WHERE identity_id = ?1 AND
-//! wallet_id IS ?2`, mirroring the upsert's per-entry wallet cross-check.
-//! These tests pin that a tombstoned identity is excluded from the
-//! per-wallet `load_state` and that a foreign wallet's `removed` set
-//! cannot tombstone this wallet's identity.
+//! Write-path coverage for the `IdentityChangeSet.removed` branch. The
+//! removal runs a wallet-scoped, NULL-safe `DELETE FROM identities WHERE
+//! identity_id = ?1 AND wallet_id IS ?2`, mirroring the upsert's
+//! per-entry wallet cross-check. These tests pin that a removed identity
+//! leaves nothing behind for `load_state` to see, that re-adding its id
+//! starts from a blank identity, and that a foreign wallet's `removed`
+//! set cannot reach this wallet's identity.
 
 mod common;
 
@@ -53,11 +53,11 @@ fn entry_for(id: u8, wallet_id: [u8; 32]) -> IdentityEntry {
     }
 }
 
-/// An identity routed through `IdentityChangeSet.removed` is tombstoned
-/// and disappears from the per-wallet `load_state` while a sibling,
+/// An identity routed through `IdentityChangeSet.removed` is deleted and
+/// disappears from the per-wallet `load_state` while a sibling,
 /// non-removed identity survives.
 #[test]
-fn qa_tomb1_removed_identity_excluded_from_load() {
+fn qa_rm1_removed_identity_excluded_from_load() {
     let (persister, _tmp, path) = fresh_persister();
     let w = wid(0xD0);
     ensure_wallet_meta(&persister, &w);
@@ -82,7 +82,7 @@ fn qa_tomb1_removed_identity_excluded_from_load() {
         )
         .unwrap();
 
-    // Second flush: tombstone drop_me.
+    // Second flush: remove drop_me.
     let mut removed: BTreeSet<Identifier> = BTreeSet::new();
     removed.insert(drop_me.id);
     persister
@@ -102,7 +102,7 @@ fn qa_tomb1_removed_identity_excluded_from_load() {
     let p2 = reopen(&path);
     let conn = p2.lock_conn_for_test();
 
-    // The tombstoned row is still physically present (logical delete).
+    // The removed row is physically gone; only the survivor remains.
     let total: i64 = conn
         .query_row(
             "SELECT COUNT(*) FROM identities WHERE wallet_id = ?1",
@@ -110,25 +110,16 @@ fn qa_tomb1_removed_identity_excluded_from_load() {
             |r| r.get(0),
         )
         .unwrap();
-    assert_eq!(total, 2, "tombstone is a logical delete; row stays on disk");
+    assert_eq!(total, 1, "a removal deletes the row, it does not flag it");
 
-    let tombstoned: i64 = conn
-        .query_row(
-            "SELECT COUNT(*) FROM identities WHERE wallet_id = ?1 AND tombstoned = 1",
-            rusqlite::params![w.as_slice()],
-            |r| r.get(0),
-        )
-        .unwrap();
-    assert_eq!(tombstoned, 1, "exactly one identity tombstoned");
-
-    // load_state must skip the tombstoned identity and keep the other.
+    // load_state must surface only the survivor.
     let state = identities::load_state(&conn, &w).unwrap();
     drop(conn);
     let wallet_idents = state.wallet_identities.get(&w).expect("wallet bucket");
     assert_eq!(
         wallet_idents.len(),
         1,
-        "load_state must surface only the non-tombstoned identity"
+        "load_state must surface only the surviving identity"
     );
     let surviving_ids: Vec<Identifier> = wallet_idents.values().map(|m| m.identity.id()).collect();
     assert!(
@@ -137,14 +128,17 @@ fn qa_tomb1_removed_identity_excluded_from_load() {
     );
     assert!(
         !surviving_ids.contains(&drop_me.id),
-        "tombstoned identity must NOT appear in load"
+        "removed identity must NOT appear in load"
     );
 }
 
-/// Re-upserting a tombstoned identity clears the tombstone (the upsert
-/// sets `tombstoned = 0`) — the resurrection path the writer relies on.
+/// Re-adding a removed identity id is legal and idempotent — the upsert
+/// simply finds no conflicting row — but it starts from a blank
+/// identity, never the removed one's state. The in-memory
+/// `IdentityManager` drops the whole `ManagedIdentity` on removal, so
+/// this is what keeps storage and memory agreeing.
 #[test]
-fn qa_tomb2_reupsert_clears_tombstone() {
+fn qa_rm2_re_add_after_removal_is_a_fresh_row() {
     let (persister, _tmp, path) = fresh_persister();
     let w = wid(0xD1);
     ensure_wallet_meta(&persister, &w);
@@ -180,13 +174,34 @@ fn qa_tomb2_reupsert_clears_tombstone() {
         )
         .unwrap();
 
-    // Re-upsert resurrects.
+    // The removal is observable between the two writes: nothing is left
+    // for the re-add to inherit.
+    {
+        let conn = persister.lock_conn_for_test();
+        let rows: i64 = conn
+            .query_row(
+                "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
+                rusqlite::params![e.id.as_slice()],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(rows, 0, "the removal deleted the row");
+    }
+
+    // Re-add the same id with a different balance: a plain insert now,
+    // not an update of a surviving row.
+    let re_added = IdentityEntry {
+        balance: 9_999,
+        ..e.clone()
+    };
+    let mut re_add: BTreeMap<Identifier, IdentityEntry> = BTreeMap::new();
+    re_add.insert(re_added.id, re_added);
     persister
         .store(
             w,
             PlatformWalletChangeSet {
                 identities: Some(IdentityChangeSet {
-                    identities: idents,
+                    identities: re_add,
                     removed: Default::default(),
                 }),
                 ..Default::default()
@@ -197,34 +212,29 @@ fn qa_tomb2_reupsert_clears_tombstone() {
 
     let p2 = reopen(&path);
     let conn = p2.lock_conn_for_test();
-    let tombstoned: i64 = conn
-        .query_row(
-            "SELECT tombstoned FROM identities WHERE identity_id = ?1",
-            rusqlite::params![e.id.as_slice()],
-            |r| r.get(0),
-        )
-        .unwrap();
     let state = identities::load_state(&conn, &w).unwrap();
     drop(conn);
-    assert_eq!(tombstoned, 0, "re-upsert must clear the tombstone flag");
+    let bucket = state.wallet_identities.get(&w).expect("wallet bucket");
+    assert_eq!(bucket.len(), 1, "the re-added identity is loadable again");
     assert_eq!(
-        state
-            .wallet_identities
-            .get(&w)
-            .map(|m| m.len())
-            .unwrap_or(0),
-        1,
-        "resurrected identity must reappear in load"
+        bucket
+            .values()
+            .next()
+            .expect("one identity")
+            .identity
+            .balance(),
+        9_999,
+        "the re-added blob wins; no trace of the removed one survives"
     );
 }
 
-/// The tombstone UPDATE is scoped by `wallet_id`: a `removed` entry
-/// naming an identity parented to a different wallet is a no-op against
-/// that wallet's row (NULL-safe `wallet_id IS ?2` predicate). An
-/// identity_id is globally unique to one wallet, so this is
-/// defense-in-depth enforcing the isolation the data model assumes.
+/// The removal DELETE is scoped by `wallet_id`: a `removed` entry naming
+/// an identity parented to a different wallet is a no-op against that
+/// wallet's row (NULL-safe `wallet_id IS ?2` predicate). An identity_id
+/// is globally unique to one wallet, so this is defense-in-depth
+/// enforcing the isolation the data model assumes.
 #[test]
-fn qa_tomb3_tombstone_update_is_wallet_scoped() {
+fn qa_rm3_removal_is_wallet_scoped() {
     let (persister, _tmp, path) = fresh_persister();
     let wa = wid(0xE0);
     let wb = wid(0xE1);
@@ -267,9 +277,9 @@ fn qa_tomb3_tombstone_update_is_wallet_scoped() {
 
     let p2 = reopen(&path);
     let conn = p2.lock_conn_for_test();
-    let tombstoned: i64 = conn
+    let rows: i64 = conn
         .query_row(
-            "SELECT tombstoned FROM identities WHERE identity_id = ?1",
+            "SELECT COUNT(*) FROM identities WHERE identity_id = ?1",
             rusqlite::params![b_ident.id.as_slice()],
             |r| r.get(0),
         )
@@ -278,11 +288,11 @@ fn qa_tomb3_tombstone_update_is_wallet_scoped() {
     drop(conn);
 
     // Cross-wallet isolation: wallet A's `removed` set names wallet B's
-    // identity, but the wallet-scoped tombstone UPDATE leaves B's row
-    // untouched, so B's load still surfaces the identity.
+    // identity, but the wallet-scoped DELETE leaves B's row untouched,
+    // so B's load still surfaces the identity.
     assert_eq!(
-        tombstoned, 0,
-        "wallet-scoped tombstone: A's removed set must NOT affect B's identity"
+        rows, 1,
+        "wallet-scoped removal: A's removed set must NOT delete B's identity"
     );
     assert_eq!(
         b_state
@@ -291,6 +301,6 @@ fn qa_tomb3_tombstone_update_is_wallet_scoped() {
             .map(|m| m.len())
             .unwrap_or(0),
         1,
-        "B's identity must survive A's unrelated tombstone"
+        "B's identity must survive A's unrelated removal"
     );
 }
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_recovery_mode.rs b/packages/rs-platform-wallet-storage/tests/sqlite_recovery_mode.rs
index ad9c8e46dff..0801f297b18 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_recovery_mode.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_recovery_mode.rs
@@ -446,8 +446,8 @@ fn seed_self_contradictory_unowned_identity(persister: &SqlitePersister, identit
     let payload = blob::encode(&entry).expect("encode unowned identity entry");
     let conn = persister.lock_conn_for_test();
     conn.execute(
-        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob, tombstoned) \
-         VALUES (?1, NULL, 4, ?2, 0)",
+        "INSERT INTO identities (identity_id, wallet_id, identity_index, entry_blob) \
+         VALUES (?1, NULL, 4, ?2)",
         params![id.as_slice(), payload],
     )
     .expect("seed unowned identity carrying a registration index");
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_schema_pinning.rs b/packages/rs-platform-wallet-storage/tests/sqlite_schema_pinning.rs
index d2fa47cde79..bdd044c35e9 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_schema_pinning.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_schema_pinning.rs
@@ -15,13 +15,13 @@ use platform_wallet_storage::sqlite::migrations as mig;
 /// Golden `(version, name)` fingerprint of the frozen migration set. Bump
 /// deliberately only when adding/removing/renaming a migration file.
 const EXPECTED_ID_FINGERPRINT: &str =
-    "7b64cb59144e7243e4ef6b5978ca529db504c0b105084db189db04cb239b7b61";
+    "6855016a412a416c07ccfc439da303698887765d5b8e674b41c930a3f7957ae1";
 
 /// Golden content-level fingerprint over every migration's rendered SQL.
 /// Bump deliberately only when the DDL body itself changes; an accidental
 /// change (a silent table rename) must fail this test, not slip through.
 const EXPECTED_SQL_FINGERPRINT: &str =
-    "c35038cd41302c2678e0d20f0bc9cc02e2aea7e30d7b8e51de40bd852d485bb5";
+    "6beb4c682c5f42e7300bc316c99046ce25b9bc635081b8200569db11aa0a6fbb";
 
 /// Table names that lost the cross-branch reconciliation and must never
 /// resurface as SQL identifiers on this frozen (`wallets`) baseline.
diff --git a/packages/rs-platform-wallet-storage/tests/sqlite_structural_hardening.rs b/packages/rs-platform-wallet-storage/tests/sqlite_structural_hardening.rs
index a2ccc572042..fd6b4c287d9 100644
--- a/packages/rs-platform-wallet-storage/tests/sqlite_structural_hardening.rs
+++ b/packages/rs-platform-wallet-storage/tests/sqlite_structural_hardening.rs
@@ -27,8 +27,8 @@ fn native_fk_rejects_orphan_child() {
     let (persister, _tmp, _path) = fresh_persister();
     let conn = persister.lock_conn_for_test();
     let res = conn.execute(
-        "INSERT INTO identities (wallet_id, identity_index, identity_id, entry_blob, tombstoned) \
-         VALUES (?1, NULL, ?2, X'00', 0)",
+        "INSERT INTO identities (wallet_id, identity_index, identity_id, entry_blob) \
+         VALUES (?1, NULL, ?2, X'00')",
         params![[7u8; 32].as_slice(), [9u8; 32].as_slice()],
     );
     let err = res.unwrap_err().to_string();
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index 755f7bb110b..a46939a40ca 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -69,7 +69,7 @@ zeroize = "1"
 log = "0.4"
 
 # Shielded pool (optional, behind `shielded` feature)
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", optional = true }
 # Direct `rusqlite` access so `FileBackedShieldedStore::open_path` can set
 # WAL + synchronous=NORMAL pragmas before handing the connection to
 # `ClientPersistentCommitmentTree`. Version locked to match the rev grovedb
diff --git a/packages/rs-platform-wallet/src/changeset/core_bridge.rs b/packages/rs-platform-wallet/src/changeset/core_bridge.rs
index 8c749d926d4..d9372ece5e6 100644
--- a/packages/rs-platform-wallet/src/changeset/core_bridge.rs
+++ b/packages/rs-platform-wallet/src/changeset/core_bridge.rs
@@ -34,7 +34,7 @@
 
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
 use dashcore::blockdata::transaction::{txout::TxOut, OutPoint};
 use key_wallet::account::AccountType;
@@ -90,11 +90,17 @@ const ADAPTER_STORE_BATCH_LIMIT: usize = 512;
 /// Session fault state for the durable-watermark guard
 /// (dashpay/platform#4069).
 ///
-/// Now that the persistence channel is a lossless unbounded `mpsc`, the only
-/// remaining fault trigger is a **`store()` rejection**, which carries a
-/// `wallet_id`, so only THAT wallet's watermark freezes. A sibling wallet
-/// whose rows are still landing atomically keeps advancing — freezing it too
-/// would force a redundant rescan of a wallet that never lost a row.
+/// Now that the persistence channel is a lossless unbounded `mpsc`, two things
+/// fault a wallet, and both name the wallets they hit, so a sibling whose rows
+/// are still landing atomically keeps advancing — freezing it too would force a
+/// redundant rescan of a wallet that never lost a row.
+///
+/// - A **`store()` rejection**, which carries a `wallet_id`: that wallet's rows
+///   are known not to be on disk.
+/// - A **panic in the blocking commit thread**, which faults every wallet with
+///   something to persist that is absent from `settled` — the one that panicked
+///   plus every wallet the loop never reached. Their outcome is unknown rather
+///   than known-bad, and unknown must fail closed the same way.
 ///
 /// The old global (`broadcast::Lagged`) latch is gone: the unbounded channel
 /// can never `Lagged`, so there is no more "dropped events of unknown wallet"
@@ -102,7 +108,8 @@ const ADAPTER_STORE_BATCH_LIMIT: usize = 512;
 /// fail-closed backstop — in a healthy run it never fires.
 #[derive(Default)]
 struct AdapterFaultState {
-    /// Set by a `store()` rejection: freezes only the named wallet.
+    /// Set by a `store()` rejection, or by the panic-recovery branch for a
+    /// wallet whose commit outcome is unknown: freezes only the named wallets.
     per_wallet: HashMap<WalletId, bool>,
 }
 
@@ -112,8 +119,9 @@ impl AdapterFaultState {
         self.per_wallet.get(wallet_id).copied().unwrap_or(false)
     }
 
-    /// Fault a single wallet after its `store()` was rejected, and raise
-    /// the host-visible hard-fault signal.
+    /// Fault a single wallet — after its `store()` was rejected, or after a
+    /// commit panic left its outcome unknown — and raise the host-visible
+    /// hard-fault signal.
     fn fault_wallet(&mut self, wallet_id: WalletId, hard_signal: &AtomicBool) {
         self.per_wallet.insert(wallet_id, true);
         hard_signal.store(true, Ordering::Relaxed);
@@ -265,9 +273,11 @@ where
 ///
 /// # Durable-watermark guard (fail-closed backstop)
 ///
-/// One fault trigger remains: a rejected `store()` (the rows for that batch
-/// are not on disk). When a wallet faults this way, we never advance ITS
-/// persisted sync watermark again this session — [`freeze_synced_height_if_faulted`]
+/// Two things fault a wallet: a rejected `store()` (the rows for that batch
+/// are not on disk) and a panic in the blocking commit thread (the rows for
+/// every persistable wallet the commit did not settle have an unknown fate,
+/// which fails closed the same way). When a wallet faults either way, we never
+/// advance ITS persisted sync watermark again this session — [`freeze_synced_height_if_faulted`]
 /// strips `synced_height` from every subsequent changeset, holding the
 /// durable watermark at the last height whose rows were fully committed.
 /// Records/UTXO deltas in the same changeset still persist; only the height
@@ -275,8 +285,9 @@ where
 /// (lower) watermark and the persister's idempotent upserts re-apply the
 /// missing rows. This is a fail-closed safety property — the durable
 /// watermark never outruns the rows it implies — and in a healthy run it
-/// never fires, since the channel is lossless and a `store()` rejection means
-/// a genuine backend error, not overload.
+/// never fires, since the channel is lossless, and both triggers mean a
+/// genuine backend error rather than overload — a rejection is one the store
+/// reported, a panic one it could not.
 ///
 /// When a wallet faults, the task raises `sync_fault` (an `AtomicBool` the
 /// host polls via `PlatformWalletManager::sync_fault_detected`) and logs a
@@ -293,10 +304,16 @@ async fn run_wallet_event_adapter<P>(
     P: PlatformWalletPersistence + 'static,
 {
     tracing::debug!("wallet-event adapter task started");
-    let mut fault = AdapterFaultState::default();
+    // Both live behind handles rather than as locals because the commit runs
+    // on a blocking thread (see the `spawn_blocking` below) and has to be able
+    // to carry its state across drains. Moving them into the closure by value
+    // would lose a wallet's frozen watermark if that thread ever panicked —
+    // un-freezing a wallet that failed verification is the one outcome the
+    // fail-closed guard exists to prevent.
+    let fault = Arc::new(Mutex::new(AdapterFaultState::default()));
     // One-shot latch so the hard "watermark frozen" line hits logcat exactly
     // once per session rather than once per faulted batch.
-    let mut freeze_logged = false;
+    let freeze_logged = Arc::new(AtomicBool::new(false));
 
     loop {
         // Block for the first event of a batch. Everything already sitting in
@@ -356,17 +373,171 @@ async fn run_wallet_event_adapter<P>(
             }
         }
 
-        // Commit the folded batch. The channel is lossless, so the only way a
-        // watermark is held back is a rejected `store()` (the fail-closed
-        // backstop inside `commit_batch`).
-        let diag = commit_batch(
-            &*persister,
-            batch,
-            folded,
-            &mut fault,
-            &sync_fault,
-            &mut freeze_logged,
-        );
+        // Commit the folded batch. The channel is lossless, so a watermark is
+        // held back only by the fail-closed backstops around this call: a
+        // rejected `store()` inside `commit_batch`, or a panic in the commit
+        // thread, handled in the `Err` arm below.
+        // Commit on a blocking thread, never on the async worker.
+        //
+        // `store()` is synchronous and, for the SQLite backend, commits a real
+        // transaction per call — its own docs warn that a slow write blocks
+        // every other wallet accessor for its duration. Called inline here it
+        // blocked a tokio worker instead: a field restore showed one drain of
+        // 512 folded events park the runtime long enough for the metrics tick
+        // covering it to report a 1.4s mean poll, with the whole sync stalled
+        // for minutes at a time and the durable watermark left hundreds of
+        // thousands of blocks behind the chain tip.
+        //
+        // The handle is awaited rather than raced against `cancel`: a store
+        // that has started must be allowed to finish, and dropping the handle
+        // would not stop the thread anyway. Shutdown is observed at the next
+        // `recv` instead.
+        // Captured before the batch moves into the closure: if the commit
+        // thread panics, these are the wallets whose rows have an unknown fate
+        // and whose watermark must therefore be frozen.
+        //
+        // Only wallets `commit_batch` can actually call `store()` for. A wallet
+        // contributes to the batch whenever it produced an event, including
+        // events that project to nothing — a `TransactionInstantLocked` that is
+        // ignored because the transaction is already chain-locked, a
+        // `SyncHeightAdvanced` for an unknown wallet. Those hit the
+        // `is_empty_no_records()` skip and never reach a store, so a sibling's
+        // panic says nothing about them; freezing them would strip a healthy
+        // wallet's watermark for the rest of the session over someone else's
+        // bad batch.
+        //
+        // Deliberately conservative in one direction: `commit_batch` re-tests
+        // emptiness AFTER `freeze_synced_height_if_faulted` has stripped a
+        // faulted wallet's watermark, so a batch that looks non-empty here can
+        // still be skipped there. That wallet is already faulted, so freezing
+        // it again costs nothing — whereas the reverse error, omitting a wallet
+        // whose store did run, would leave a watermark free to advance past
+        // rows nobody can account for.
+        let batch_wallet_ids: Vec<WalletId> = batch
+            .iter()
+            .filter(|(_, wallet_batch)| {
+                !wallet_batch.core.is_empty_no_records()
+                    || !Merge::is_empty(&wallet_batch.asset_locks)
+            })
+            .map(|(wallet_id, _)| *wallet_id)
+            .collect();
+        // Filled by `commit_batch` as each wallet's `store()` returns. Lives
+        // out here so a panicking commit thread cannot take it down with it:
+        // what it holds is the difference between "this wallet's rows are
+        // accounted for" and "nobody knows".
+        let settled: Arc<Mutex<Vec<WalletId>>> = Arc::new(Mutex::new(Vec::new()));
+        let settled_for_commit = Arc::clone(&settled);
+        let persister_for_commit = Arc::clone(&persister);
+        let sync_fault_for_commit = Arc::clone(&sync_fault);
+        let fault_for_commit = Arc::clone(&fault);
+        let freeze_for_commit = Arc::clone(&freeze_logged);
+        let committed = tokio::task::spawn_blocking(move || {
+            // The lock is uncontended by construction — this task is the only
+            // writer, and one drain commits at a time — so it never blocks;
+            // it exists to carry the state, not to arbitrate.
+            let mut fault = fault_for_commit
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner());
+            let mut settled = settled_for_commit
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner());
+            // The flag itself, not a copy: a local `bool` written back after
+            // `commit_batch` returns is lost when a later store in the same
+            // batch panics, and the panic branch would then emit the one-shot
+            // marker a second time for a freeze already announced.
+            commit_batch(
+                &*persister_for_commit,
+                batch,
+                folded,
+                &mut fault,
+                &sync_fault_for_commit,
+                &freeze_for_commit,
+                &mut settled,
+            )
+        })
+        .await;
+
+        let diag = match committed {
+            Ok(diag) => diag,
+            // The commit thread panicked, so `commit_batch` never reached the
+            // `store()` rejection arm that would have frozen the affected
+            // wallets. Freeze them here instead.
+            //
+            // Before this call moved off the runtime a panic unwound the whole
+            // adapter task, which stopped every later watermark advance by
+            // killing the writer. `spawn_blocking` turns that into a recoverable
+            // `JoinError`, and simply continuing would let the NEXT batch
+            // persist a higher `synced_height` for a wallet whose rows from this
+            // batch may never have landed — the exact hole the fail-closed rule
+            // exists to prevent. Faulting per wallet rather than stopping the
+            // adapter keeps the existing design: a wallet whose commit is in
+            // doubt freezes, its siblings keep syncing.
+            Err(join_error) => {
+                // `commit_batch` walks the batch serially, so a panic partitions
+                // it: wallets whose `store()` already returned are settled — their
+                // rows were accepted or rejected, and a rejection already faulted
+                // them from inside. Freezing those too would strip a healthy
+                // wallet's watermark for the rest of the session over a sibling's
+                // bad batch.
+                //
+                // What is left — the wallet that panicked, plus every wallet the
+                // loop never reached — has no known outcome, and its events are
+                // gone from the lossless channel. Those must freeze, or a later
+                // batch advances their watermark past rows that may never have
+                // landed.
+                let settled_ids = settled
+                    .lock()
+                    .unwrap_or_else(|poisoned| poisoned.into_inner())
+                    .iter()
+                    .copied()
+                    .collect::<HashSet<_>>();
+                let unsettled: Vec<WalletId> = batch_wallet_ids
+                    .iter()
+                    .copied()
+                    .filter(|id| !settled_ids.contains(id))
+                    .collect();
+                {
+                    let mut fault = fault
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner());
+                    for wallet_id in &unsettled {
+                        fault.fault_wallet(*wallet_id, &sync_fault);
+                    }
+                }
+                // Same one-shot marker the rejection arm emits, and via the same
+                // `log` facade, because this freeze is indistinguishable from
+                // that one as far as the host is concerned: the latch is up and
+                // a rescan is pending. Leaving it to `tracing` alone would hide
+                // a panic-induced freeze from logcat entirely, and — worse —
+                // leave the flag clear, so a later rejected store would
+                // emit the supposedly one-shot line as though it were the first
+                // fault of the session.
+                //
+                // `swap` rather than load-then-store: a store panicking inside
+                // the same blocking task can race the flag the task wrote back
+                // on its way out, and emitting this line twice is a worse
+                // outcome than the branch reading its own write.
+                if !unsettled.is_empty() && !freeze_logged.swap(true, Ordering::Relaxed) {
+                    log::error!(
+                        "SYNC WATERMARK FROZEN: the wallet-event commit thread panicked ({}); \
+                         {} wallet(s) whose rows have an unknown outcome are now held so the \
+                         next scan re-persists them (dashpay/platform#4370). \
+                         syncFaultDetected() is latched.",
+                        join_error,
+                        unsettled.len()
+                    );
+                }
+                tracing::error!(
+                    error = %join_error,
+                    folded,
+                    settled = settled_ids.len(),
+                    frozen = unsettled.len(),
+                    "wallet-event commit thread failed; freezing the wallets whose \
+                     rows have an unknown outcome"
+                );
+                continue;
+            }
+        };
 
         // One structured line per drain via the `log` facade so a tester
         // logcat is unambiguous about whether the watermark is advancing.
@@ -409,7 +580,8 @@ fn commit_batch<P>(
     folded: usize,
     fault: &mut AdapterFaultState,
     sync_fault: &AtomicBool,
-    freeze_logged: &mut bool,
+    freeze_logged: &AtomicBool,
+    settled: &mut Vec<WalletId>,
 ) -> BatchDiagnostics
 where
     P: PlatformWalletPersistence + ?Sized,
@@ -458,7 +630,15 @@ where
             asset_locks: (!Merge::is_empty(&asset_locks)).then_some(asset_locks),
             ..PlatformWalletChangeSet::default()
         };
-        match persister.store(wallet_id, cs) {
+        let store_result = persister.store(wallet_id, cs);
+        // Recorded only once the store has RETURNED, and whether it accepted
+        // or rejected — both are answers. A wallet whose store panicked never
+        // reaches this line, and one the loop never got to is never pushed at
+        // all, so what is missing from `settled` is exactly the set whose
+        // outcome the caller cannot reason about. See the `JoinError` arm in
+        // `run_wallet_event_adapter`.
+        settled.push(wallet_id);
+        match store_result {
             Ok(()) => {
                 if let Some(h) = offered_height {
                     diag.record_persisted(h);
@@ -480,8 +660,7 @@ where
                 }
                 // One-shot, unambiguous logcat marker via the `log` facade
                 // (android_logger forwards `log` to logcat; `tracing` may not).
-                if !*freeze_logged {
-                    *freeze_logged = true;
+                if !freeze_logged.swap(true, Ordering::Relaxed) {
                     log::error!(
                         "SYNC WATERMARK FROZEN: persister rejected a changeset for wallet {} ({}); \
                          its durable sync height is now held so the next scan re-persists the \
@@ -503,10 +682,11 @@ where
 
 /// Durable-watermark guard for dashpay/platform#4069.
 ///
-/// When a wallet has faulted this session (a `store()` was rejected), its
-/// persisted `synced_height` watermark must not advance past the last height
-/// whose rows were fully committed — otherwise the wallet believes it is
-/// scanned and never re-matches the blocks whose rows were lost. This
+/// When a wallet has faulted this session — its `store()` was rejected, or a
+/// commit panic left the batch's outcome unknown — its persisted
+/// `synced_height` watermark must not advance past the last height whose rows
+/// were fully committed; otherwise the wallet believes it is scanned and never
+/// re-matches the blocks whose rows were lost. This
 /// strips ONLY `synced_height`; every other field (records, UTXO
 /// deltas, `last_processed_height`, chain-lock) is left intact so
 /// in-flight rows still persist. Factored out as a pure function so the
@@ -2041,6 +2221,17 @@ mod tests {
     struct ProbePersister {
         obs: UnboundedSender<StoreObserved>,
         fail_once: Mutex<HashSet<WalletId>>,
+        /// Wallets whose NEXT `store()` panics instead of returning. Models a
+        /// backend that dies mid-write — the case that used to unwind the whole
+        /// adapter task and now surfaces as a `JoinError`.
+        panic_once: Mutex<HashSet<WalletId>>,
+        /// Held closed to keep a `store()` call parked. The SQLite backend
+        /// commits a real transaction per call, so a slow disk parks the caller
+        /// for real; this makes that duration controllable.
+        block_until: Mutex<Option<std::sync::mpsc::Receiver<()>>>,
+        /// Raised as soon as a blocked `store()` is entered, so a test can wait
+        /// for the block to be in effect rather than sleeping and hoping.
+        blocked: Arc<AtomicBool>,
     }
 
     impl ProbePersister {
@@ -2048,11 +2239,24 @@ mod tests {
             Self {
                 obs,
                 fail_once: Mutex::new(HashSet::new()),
+                panic_once: Mutex::new(HashSet::new()),
+                block_until: Mutex::new(None),
+                blocked: Arc::new(AtomicBool::new(false)),
             }
         }
+        /// Park the next `store()` until the returned sender is dropped or
+        /// signalled. `blocked` reports when the park is actually in effect.
+        fn block_next(&self) -> (std::sync::mpsc::Sender<()>, Arc<AtomicBool>) {
+            let (tx, rx) = std::sync::mpsc::channel();
+            *self.block_until.lock().unwrap() = Some(rx);
+            (tx, Arc::clone(&self.blocked))
+        }
         fn fail_next(&self, wallet_id: WalletId) {
             self.fail_once.lock().unwrap().insert(wallet_id);
         }
+        fn panic_next(&self, wallet_id: WalletId) {
+            self.panic_once.lock().unwrap().insert(wallet_id);
+        }
     }
 
     impl PlatformWalletPersistence for ProbePersister {
@@ -2062,6 +2266,17 @@ mod tests {
             changeset: PlatformWalletChangeSet,
         ) -> Result<(), PersistenceError> {
             let core = changeset.core.as_ref();
+            if let Some(gate) = self.block_until.lock().unwrap().take() {
+                self.blocked.store(true, Ordering::Relaxed);
+                // Blocks the calling thread outright — the whole point is to
+                // model a synchronous backend, so an async wait would prove
+                // nothing.
+                let _ = gate.recv();
+                self.blocked.store(false, Ordering::Relaxed);
+            }
+            if self.panic_once.lock().unwrap().remove(&wallet_id) {
+                panic!("probe persister: store panicked for {wallet_id:?}");
+            }
             let rejected = self.fail_once.lock().unwrap().remove(&wallet_id);
             let _ = self.obs.send(StoreObserved {
                 wallet_id,
@@ -2414,6 +2629,274 @@ mod tests {
         );
     }
 
+    /// (h) SAFETY INVARIANT under a commit-thread PANIC: a wallet whose
+    /// `store()` panicked must be frozen just as if the store had been
+    /// rejected, because its rows have an unknown fate.
+    ///
+    /// This is a regression guard on the move to `spawn_blocking`. Before it,
+    /// a panic unwound the adapter task itself, which stopped every later
+    /// watermark advance by killing the writer outright. `spawn_blocking`
+    /// turns that into a recoverable `JoinError` — and merely logging it would
+    /// let the NEXT batch persist a higher `synced_height` for a wallet whose
+    /// earlier rows may never have landed, which is exactly the hole
+    /// dashpay/platform#4069 closed.
+    #[tokio::test]
+    async fn a_panicking_commit_freezes_the_batch_wallets() {
+        let wallet_id = [0xEEu8; 32];
+        let (tx, rx) = unbounded_channel::<WalletEvent>();
+
+        let (obs_tx, mut obs_rx) = unbounded_channel();
+        let persister = Arc::new(ProbePersister::new(obs_tx));
+        persister.panic_next(wallet_id);
+        let sync_fault = Arc::new(AtomicBool::new(false));
+        let cancel = CancellationToken::new();
+        let handle = tokio::spawn(run_wallet_event_adapter(
+            test_manager(),
+            Arc::clone(&persister),
+            rx,
+            Arc::clone(&sync_fault),
+            cancel.clone(),
+        ));
+
+        // The store for this batch panics: no observation is emitted, and the
+        // adapter must fault the wallet rather than carry on unaffected.
+        tx.send(block_processed_event(wallet_id, 10)).unwrap();
+        // Bounded, so a regression fails the test instead of hanging it: with
+        // the fault-on-panic path removed, `sync_fault` is simply never raised
+        // and an unbounded spin would wedge CI with no diagnosis.
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while !sync_fault.load(Ordering::Relaxed) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("a panicked commit must raise the hard-fault signal");
+
+        // The adapter must still be alive — the point of moving the commit off
+        // the runtime is that one bad batch does not take the writer with it.
+        assert!(
+            !handle.is_finished(),
+            "a panicked commit must not kill the adapter"
+        );
+
+        // A later watermark for the same wallet must not reach the store.
+        tx.send(block_processed_event(wallet_id, 60)).unwrap();
+        tx.send(sync_height_event(wallet_id, 900)).unwrap();
+
+        let post = tokio::time::timeout(std::time::Duration::from_secs(5), obs_rx.recv())
+            .await
+            .expect("a faulted wallet must still persist its rows")
+            .expect("the record-bearing event must still persist while faulted");
+        assert_eq!(post.wallet_id, wallet_id);
+        assert_eq!(
+            post.synced_height, None,
+            "a wallet whose commit panicked must not advance its durable watermark"
+        );
+
+        cancel.cancel();
+        drop(tx);
+        handle.await.unwrap();
+    }
+
+    /// (j) THE PRIMARY BEHAVIOUR OF THIS PR: a blocked `store()` must not park
+    /// the async runtime.
+    ///
+    /// `store()` is synchronous and, for the SQLite backend, commits a real
+    /// transaction per call. Called inline on a tokio worker it held that
+    /// worker for the duration — a field restore showed one drain park the
+    /// runtime long enough for the metrics tick covering it to report a 1.4s
+    /// mean poll, with the durable watermark left hundreds of thousands of
+    /// blocks behind the chain tip.
+    ///
+    /// Every other test in this module would still pass with `commit_batch`
+    /// moved back inline, because they only check persistence outcomes. This
+    /// one runs the adapter on a SINGLE worker, parks a `store()`, and requires
+    /// a spawned task to still get scheduled.
+    ///
+    /// Deliberately built out of `std` primitives — a `std::mpsc` handoff and
+    /// `std::thread::sleep` on the test thread — rather than `tokio::time`.
+    /// The regression parks the runtime's only worker, and a tokio timer needs
+    /// that runtime to fire: an async timeout here hangs instead of failing,
+    /// which is worse than the bug it is meant to catch.
+    #[test]
+    fn a_blocked_store_does_not_park_the_runtime() {
+        use std::sync::mpsc as std_mpsc;
+        use std::time::{Duration, Instant};
+
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(1)
+            .enable_all()
+            .build()
+            .unwrap();
+
+        let wallet_id = [0x33u8; 32];
+        let (tx, rx) = unbounded_channel::<WalletEvent>();
+        let (obs_tx, mut obs_rx) = unbounded_channel();
+        let persister = Arc::new(ProbePersister::new(obs_tx));
+        let (release, blocked) = persister.block_next();
+        let sync_fault = Arc::new(AtomicBool::new(false));
+        let cancel = CancellationToken::new();
+
+        let handle = runtime.spawn(run_wallet_event_adapter(
+            test_manager(),
+            Arc::clone(&persister),
+            rx,
+            Arc::clone(&sync_fault),
+            cancel.clone(),
+        ));
+
+        // Park the commit inside a synchronous `store()`.
+        tx.send(block_processed_event(wallet_id, 10)).unwrap();
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !blocked.load(Ordering::Relaxed) {
+            assert!(
+                Instant::now() < deadline,
+                "the store must actually park before the assertion below means anything"
+            );
+            std::thread::sleep(Duration::from_millis(10));
+        }
+
+        // The discriminator: a SPAWNED task has to be scheduled on the
+        // runtime's single worker. With the commit on `spawn_blocking` the
+        // worker is free and this arrives at once; with it inline the worker is
+        // sitting inside `store()` and this times out.
+        let (sentinel_tx, sentinel_rx) = std_mpsc::channel();
+        runtime.spawn(async move {
+            let _ = sentinel_tx.send(());
+        });
+        sentinel_rx
+            .recv_timeout(Duration::from_secs(5))
+            .expect("a blocked store must not hold the runtime's only worker");
+
+        // Release, then let the drain finish so the adapter shuts down cleanly.
+        drop(release);
+        runtime.block_on(async {
+            let observed = tokio::time::timeout(Duration::from_secs(5), obs_rx.recv())
+                .await
+                .expect("the released store must complete")
+                .expect("store observed");
+            assert_eq!(observed.wallet_id, wallet_id);
+
+            cancel.cancel();
+            drop(tx);
+            handle.await.unwrap();
+        });
+    }
+
+    /// (i) A commit panic must punish exactly the wallets whose outcome it
+    /// left unknown — no more, no less.
+    ///
+    /// `commit_batch` walks the batch serially (a `BTreeMap`, so in wallet-id
+    /// order), and a panic cuts it in two. A wallet whose `store()` already
+    /// returned is settled: its rows are on disk and its watermark is safe,
+    /// so freezing it would strip its `synced_height` for the rest of the
+    /// session over a sibling's bad batch. A wallet ordered AFTER the panic
+    /// is the opposite case — unwinding dropped its consumed changes before
+    /// `store()` was ever attempted, so nothing knows whether its rows
+    /// landed, and it must freeze or a later watermark advances past rows
+    /// that never existed.
+    ///
+    /// Both halves are checked here, because they are guarded by the same
+    /// `batch_wallet_ids - settled` expression and a regression that faults
+    /// only the wallet that actually panicked satisfies neither.
+    ///
+    /// Guards the fix for the first version of the panic handler, which
+    /// faulted every wallet in the drain.
+    #[tokio::test]
+    async fn a_panicking_commit_spares_the_wallets_it_already_stored() {
+        // `BTreeMap` order decides who is committed first, so the ids are
+        // chosen to put the healthy wallet ahead of the panicking one.
+        let healthy = [0x11u8; 32];
+        let doomed = [0x22u8; 32];
+        // Sorts after `doomed`, so the commit unwinds before it is reached.
+        let unreached = [0x33u8; 32];
+        let (tx, rx) = unbounded_channel::<WalletEvent>();
+
+        let (obs_tx, mut obs_rx) = unbounded_channel();
+        let persister = Arc::new(ProbePersister::new(obs_tx));
+        persister.panic_next(doomed);
+        let sync_fault = Arc::new(AtomicBool::new(false));
+        let cancel = CancellationToken::new();
+        let handle = tokio::spawn(run_wallet_event_adapter(
+            test_manager(),
+            Arc::clone(&persister),
+            rx,
+            Arc::clone(&sync_fault),
+            cancel.clone(),
+        ));
+
+        // All three in one drain: `healthy` stores, `doomed` panics, and
+        // `unreached` never gets its turn. Sent before any is observed so they
+        // fold into a single batch.
+        tx.send(block_processed_event(healthy, 10)).unwrap();
+        tx.send(block_processed_event(doomed, 10)).unwrap();
+        tx.send(block_processed_event(unreached, 10)).unwrap();
+
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while !sync_fault.load(Ordering::Relaxed) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("the panicked commit must raise the hard-fault signal");
+
+        // Drain what the panicking batch managed to observe.
+        while obs_rx.try_recv().is_ok() {}
+
+        // The healthy wallet's watermark must still advance: its store
+        // returned, so its rows are accounted for.
+        tx.send(sync_height_event(healthy, 900)).unwrap();
+        // Bounded: on a regression the healthy wallet is frozen, its
+        // watermark-only changeset collapses to nothing, and no store is
+        // observed at all — an unbounded `recv` would hang CI instead of
+        // reporting which invariant broke.
+        let after_healthy = tokio::time::timeout(std::time::Duration::from_secs(5), obs_rx.recv())
+            .await
+            .expect("a wallet whose store completed must still be storable")
+            .expect("healthy wallet still stores");
+        assert_eq!(after_healthy.wallet_id, healthy);
+        assert_eq!(
+            after_healthy.synced_height,
+            Some(900),
+            "a wallet whose store completed must not be frozen by a sibling's panic"
+        );
+
+        // The wallet whose store panicked must be frozen.
+        tx.send(block_processed_event(doomed, 60)).unwrap();
+        tx.send(sync_height_event(doomed, 900)).unwrap();
+        let after_doomed = tokio::time::timeout(std::time::Duration::from_secs(5), obs_rx.recv())
+            .await
+            .expect("a faulted wallet must still persist its rows")
+            .expect("doomed wallet still persists rows");
+        assert_eq!(after_doomed.wallet_id, doomed);
+        assert_eq!(
+            after_doomed.synced_height, None,
+            "the wallet whose commit panicked must not advance its watermark"
+        );
+
+        // The wallet the commit never reached must be frozen too: its changes
+        // went down with the unwind without a `store()` ever being attempted,
+        // so its rows are exactly as unaccounted-for as the panicking
+        // wallet's. A handler that faults only the direct casualty leaves this
+        // one free to advance past rows that never landed.
+        tx.send(block_processed_event(unreached, 60)).unwrap();
+        tx.send(sync_height_event(unreached, 900)).unwrap();
+        let after_unreached =
+            tokio::time::timeout(std::time::Duration::from_secs(5), obs_rx.recv())
+                .await
+                .expect("a faulted wallet must still persist its rows")
+                .expect("unreached wallet still persists rows");
+        assert_eq!(after_unreached.wallet_id, unreached);
+        assert_eq!(
+            after_unreached.synced_height, None,
+            "a wallet the panicking commit never reached must not advance its watermark"
+        );
+
+        cancel.cancel();
+        drop(tx);
+        handle.await.unwrap();
+    }
+
     /// (g) SAFETY INVARIANT under a fault: once the per-wallet fault latch is
     /// set (here by a rejected `store()`), no later changeset for that wallet
     /// may advance the durable `synced_height` — whether the watermark arrives
@@ -2429,8 +2912,9 @@ mod tests {
 
         let (obs_tx, mut obs_rx) = unbounded_channel();
         let persister = Arc::new(ProbePersister::new(obs_tx));
-        // Fault the wallet via a rejected store (the only remaining trigger
-        // now that the lossless channel can't lag).
+        // Fault the wallet via a rejected store — the trigger with a known
+        // outcome. The other one, a commit panic, is covered by
+        // `a_panicking_commit_freezes_the_batch_wallets`.
         persister.fail_next(wallet_id);
         let sync_fault = Arc::new(AtomicBool::new(false));
         let cancel = CancellationToken::new();
@@ -2815,7 +3299,7 @@ mod tests {
         let persister = ProbePersister::new(obs_tx);
         let sync_fault = AtomicBool::new(false);
         let mut fault = AdapterFaultState::default();
-        let mut freeze_logged = false;
+        let freeze_logged = AtomicBool::new(false);
 
         let mut batch = BTreeMap::new();
         batch.insert(
@@ -2831,7 +3315,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         let observed = obs_rx
@@ -2895,7 +3380,7 @@ mod tests {
         let persister = ProbePersister::new(obs_tx);
         let sync_fault = AtomicBool::new(false);
         let mut fault = AdapterFaultState::default();
-        let mut freeze_logged = false;
+        let freeze_logged = AtomicBool::new(false);
 
         let diag = commit_batch(
             &persister,
@@ -2903,7 +3388,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         assert_eq!(diag.persisted, Some(500));
@@ -2926,7 +3412,7 @@ mod tests {
         persister.fail_next(wallet_id);
         let sync_fault = AtomicBool::new(false);
         let mut fault = AdapterFaultState::default();
-        let mut freeze_logged = false;
+        let freeze_logged = AtomicBool::new(false);
 
         let diag = commit_batch(
             &persister,
@@ -2934,7 +3420,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         // The height was genuinely offered to the store...
@@ -2978,7 +3465,7 @@ mod tests {
         assert!(fault.is_faulted(&wallet_id));
         assert!(sync_fault.load(Ordering::Relaxed));
         assert!(
-            freeze_logged,
+            freeze_logged.load(Ordering::Relaxed),
             "the one-shot SYNC WATERMARK FROZEN marker must have been emitted"
         );
     }
@@ -2995,7 +3482,7 @@ mod tests {
         let mut fault = AdapterFaultState::default();
         // Pre-fault the wallet, as an earlier drain's rejection would have.
         fault.fault_wallet(wallet_id, &sync_fault);
-        let mut freeze_logged = true; // one-shot already spent
+        let freeze_logged = AtomicBool::new(true); // one-shot already spent
 
         let diag = commit_batch(
             &persister,
@@ -3003,7 +3490,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         assert_eq!(diag.persisted, None, "a frozen watermark is not persisted");
@@ -3038,7 +3526,7 @@ mod tests {
         let sync_fault = AtomicBool::new(false);
         let mut fault = AdapterFaultState::default();
         fault.fault_wallet(wallet_id, &sync_fault);
-        let mut freeze_logged = true;
+        let freeze_logged = AtomicBool::new(true);
 
         let core = CoreChangeSet {
             synced_height: Some(1234),
@@ -3050,7 +3538,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         assert_eq!(diag.frozen, Some(1234));
@@ -3074,7 +3563,7 @@ mod tests {
         persister.fail_next(rejecting);
         let sync_fault = AtomicBool::new(false);
         let mut fault = AdapterFaultState::default();
-        let mut freeze_logged = false;
+        let freeze_logged = AtomicBool::new(false);
 
         let mut batch = BTreeMap::new();
         batch.extend(one_wallet_batch(healthy, watermark_with_rows(10, 10)));
@@ -3086,7 +3575,8 @@ mod tests {
             2,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         assert_eq!(
@@ -3121,7 +3611,7 @@ mod tests {
         let mut fault = AdapterFaultState::default();
         // Pre-fault the wallet, as an earlier drain's rejection would have.
         fault.fault_wallet(wallet_id, &sync_fault);
-        let mut freeze_logged = true;
+        let freeze_logged = AtomicBool::new(true);
 
         let diag = commit_batch(
             &persister,
@@ -3129,7 +3619,8 @@ mod tests {
             1,
             &mut fault,
             &sync_fault,
-            &mut freeze_logged,
+            &freeze_logged,
+            &mut Vec::new(),
         );
 
         assert_eq!(diag.wallets, 1);
diff --git a/packages/rs-platform-wallet/src/error.rs b/packages/rs-platform-wallet/src/error.rs
index 3f25f778d58..434af477eb1 100644
--- a/packages/rs-platform-wallet/src/error.rs
+++ b/packages/rs-platform-wallet/src/error.rs
@@ -321,6 +321,49 @@ pub enum PlatformWalletError {
         actual_identity_index: u32,
     },
 
+    /// Asset-lock coin selection came up short, so a host (and ultimately the
+    /// wallet UI) can render a precise shortfall instead of a stringly-typed
+    /// "Insufficient funds" message (dashpay/platform#4073).
+    ///
+    /// What `available` covers depends on the build's funding form. An
+    /// exact-amount build funds from a POOLED source list — the default
+    /// [`ASSET_LOCK_FUNDING_SOURCES`](crate::ASSET_LOCK_FUNDING_SOURCES)
+    /// unions the BIP44 and BIP32 accounts with every DashPay
+    /// contact-receiving account — so its shortfall describes that whole
+    /// permitted union, not any single account (an explicit single-element
+    /// source list narrows it back to one account). Only a *drain* build
+    /// (whole-account funding) selects exactly one account, so only there
+    /// does the figure name a single account's shortfall. CoinJoin funds
+    /// exclusively through the drain form — it is never pooled (spending
+    /// mixed outputs alongside transparent ones would link them), so the
+    /// CoinJoin → shielded migration's shortfall is always the mixed
+    /// account's own.
+    ///
+    /// Distinct from [`CoreInsufficientFunds`] / [`CorePooledInsufficientFunds`],
+    /// which belong to the atomic Core-send selector rather than the asset-lock
+    /// builder, and which carry `Option` amounts because a pooled send may not
+    /// know them. The asset-lock builder always has concrete figures: the
+    /// key-wallet shortfall errors carry their own, and the empty-candidate-set
+    /// case is reported as `available: 0` against the requested target.
+    ///
+    /// On a *drain* build (whole-account funding, e.g. the CoinJoin → shielded
+    /// migration) the requested target is the zero credit-output placeholder
+    /// that key-wallet rewrites to `Σ inputs − fee`, so `required` reports the
+    /// caller's drain floor instead: an empty account surfaces as
+    /// `available: 0, required: <minimum_lock_duffs>` (the shielded flow
+    /// installs the positive Type 18 pool-fee floor before building), and only
+    /// a floor-less drain reports `required: 0`. The floor is additionally
+    /// enforced downstream against the built payload once the lock value is
+    /// known.
+    ///
+    /// [`CoreInsufficientFunds`]: Self::CoreInsufficientFunds
+    /// [`CorePooledInsufficientFunds`]: Self::CorePooledInsufficientFunds
+    #[error(
+        "asset lock coin selection is short: available {available} duffs, \
+         required {required} duffs"
+    )]
+    AssetLockInsufficientFunds { available: u64, required: u64 },
+
     #[error("SDK error: {0}")]
     Sdk(#[from] dash_sdk::Error),
 
diff --git a/packages/rs-platform-wallet/src/manager/mod.rs b/packages/rs-platform-wallet/src/manager/mod.rs
index 7808df22b50..46e1ef2511d 100644
--- a/packages/rs-platform-wallet/src/manager/mod.rs
+++ b/packages/rs-platform-wallet/src/manager/mod.rs
@@ -392,11 +392,12 @@ pub struct PlatformWalletManager<P: PlatformWalletPersistence + 'static> {
     pub(super) event_manager: Arc<PlatformEventManager>,
     pub(super) persister: Arc<P>,
     /// Tracked (wallet-independent) masternodes for this manager's
-    /// network, keyed by wire proTxHash. Hydrated from the persister at
+    /// network, keyed by wire proTxHash, plus the per-node gates that
+    /// serialize their refreshes. Hydrated from the persister at
     /// `load_from_persistor`; every mutation writes the whole set back
     /// (see `masternode::tracked`).
     pub(crate) tracked_masternodes:
-        std::sync::Arc<std::sync::RwLock<crate::masternode::tracked::TrackedMasternodeMap>>,
+        std::sync::Arc<crate::masternode::tracked::TrackedMasternodeRegistry>,
     /// Cancellation token + join handle for the wallet-event adapter
     /// task. Held so [`shutdown`] can stop it cleanly when the manager
     /// is torn down.
@@ -544,7 +545,7 @@ impl<P: PlatformWalletPersistence + 'static> PlatformWalletManager<P> {
             #[cfg(feature = "shielded")]
             event_manager,
             persister,
-            tracked_masternodes: std::sync::Arc::new(std::sync::RwLock::new(Default::default())),
+            tracked_masternodes: std::sync::Arc::new(Default::default()),
             event_adapter_cancel,
             event_adapter_join: tokio::sync::Mutex::new(Some(event_adapter_join)),
             registry,
diff --git a/packages/rs-platform-wallet/src/masternode/tracked.rs b/packages/rs-platform-wallet/src/masternode/tracked.rs
index 475f9cfd44d..5c0933aa8f5 100644
--- a/packages/rs-platform-wallet/src/masternode/tracked.rs
+++ b/packages/rs-platform-wallet/src/masternode/tracked.rs
@@ -443,6 +443,37 @@ fn number_records(records: &mut [MasternodeRecord]) {
     }
 }
 
+/// The manager's tracked-masternode registry: the rows plus the per-node
+/// refresh gates. Both live behind one `Arc`, so every
+/// [`TrackedMasternodes`] handle a manager hands out shares the rows AND
+/// the gates that order the refreshes writing to them.
+#[derive(Default)]
+pub(crate) struct TrackedMasternodeRegistry {
+    rows: std::sync::RwLock<TrackedMasternodeMap>,
+    /// One gate per node, created on demand and dropped once no pass holds
+    /// it. Held for a whole refresh pass — see [`refresh_row_and_persist`].
+    gates: std::sync::Mutex<BTreeMap<[u8; 32], std::sync::Arc<tokio::sync::Mutex<()>>>>,
+}
+
+impl TrackedMasternodeRegistry {
+    /// Take `pro_tx_hash`'s refresh gate. The `std` lock over the gate map
+    /// is released before the `await`, so waiting for a gate never blocks
+    /// the runtime thread.
+    async fn refresh_gate(&self, pro_tx_hash: &[u8; 32]) -> tokio::sync::OwnedMutexGuard<()> {
+        let gate = {
+            let mut gates = self
+                .gates
+                .lock()
+                .expect("tracked masternode gate map lock poisoned");
+            // Every pass keeps its own clone alive for its whole duration,
+            // so a gate the map alone references has no pass on it.
+            gates.retain(|_, gate| std::sync::Arc::strong_count(gate) > 1);
+            std::sync::Arc::clone(gates.entry(*pro_tx_hash).or_default())
+        };
+        gate.lock_owned().await
+    }
+}
+
 /// Shared handle to the tracked-masternode registry and everything its
 /// operations need (SPV for the list, the SDK for Platform / DAPI, the
 /// persister for durability). Cloneable and `Send + Sync`, so hosts can run
@@ -452,13 +483,104 @@ fn number_records(records: &mut [MasternodeRecord]) {
 /// shares one registry.
 #[derive(Clone)]
 pub struct TrackedMasternodes {
-    registry: std::sync::Arc<std::sync::RwLock<TrackedMasternodeMap>>,
+    registry: std::sync::Arc<TrackedMasternodeRegistry>,
     spv: std::sync::Arc<crate::spv::SpvRuntime>,
     sdk: std::sync::Arc<dash_sdk::Sdk>,
     persister: std::sync::Arc<dyn PlatformWalletPersistence>,
     network: Network,
 }
 
+/// Apply one registry mutation and durably replace the persisted set as one
+/// linearizable operation.
+fn mutate_registry_and_persist<T>(
+    registry: &TrackedMasternodeRegistry,
+    persister: &dyn PlatformWalletPersistence,
+    network: Network,
+    mutation: impl FnOnce(&mut TrackedMasternodeMap) -> Result<T, PlatformWalletError>,
+) -> Result<T, PlatformWalletError> {
+    let mut guard = registry
+        .rows
+        .write()
+        .expect("tracked masternode registry lock poisoned");
+    let before = guard.clone();
+    let result = match mutation(&mut guard) {
+        Ok(result) => result,
+        Err(error) => {
+            *guard = before;
+            return Err(error);
+        }
+    };
+    let records: Vec<TrackedMasternode> = guard.values().cloned().collect();
+    if let Err(e) = persister.persist_tracked_masternodes(network, &records) {
+        *guard = before;
+        return Err(PlatformWalletError::WalletCreation(format!(
+            "failed to persist tracked masternodes: {e}"
+        )));
+    }
+    Ok(result)
+}
+
+/// What a refresh pass's network half learned besides the snapshot: the
+/// masternode list it read (the returned record renders the node's LIVE
+/// status from it) and the first error it hit, if any.
+#[derive(Default)]
+struct RefreshOutcome {
+    list_now: Option<Vec<MasternodeListSummary>>,
+    first_error: Option<PlatformWalletError>,
+}
+
+/// One refresh pass over `pro_tx_hash`: take the node's refresh gate, read
+/// the row under it, hand its snapshot to `learn`, then write the learned
+/// snapshot back and durably replace the persisted set.
+///
+/// The gate spans the read AND the write, so two passes over one node never
+/// both start from the same snapshot: `learn` always sees everything
+/// earlier passes learned, and keeps a field by simply not overwriting it —
+/// otherwise the pass that finished last would put its own pre-read clone
+/// back over the other's findings and persist the loss. Serializing also
+/// spares the second pass the network work the first one already did.
+///
+/// Only the snapshot is written: a relabel that raced the pass keeps its
+/// label, and an untrack that raced it wins — the row is gone, so the pass
+/// errors instead of resurrecting it.
+async fn refresh_row_and_persist<F, Fut>(
+    registry: &TrackedMasternodeRegistry,
+    persister: &dyn PlatformWalletPersistence,
+    network: Network,
+    pro_tx_hash: &[u8; 32],
+    learn: F,
+) -> Result<(TrackedMasternode, RefreshOutcome), PlatformWalletError>
+where
+    F: FnOnce(TrackedMasternodeSnapshot) -> Fut,
+    Fut: std::future::Future<Output = (TrackedMasternodeSnapshot, RefreshOutcome)>,
+{
+    let _gate = registry.refresh_gate(pro_tx_hash).await;
+
+    let mut tracked = registry
+        .rows
+        .read()
+        .expect("tracked masternode registry lock poisoned")
+        .get(pro_tx_hash)
+        .cloned()
+        .ok_or_else(|| not_tracked(pro_tx_hash))?;
+
+    let (snapshot, outcome) = learn(tracked.snapshot).await;
+    tracked.snapshot = snapshot;
+
+    let label = mutate_registry_and_persist(registry, persister, network, |guard| {
+        match guard.get_mut(pro_tx_hash) {
+            Some(live) => {
+                live.snapshot = tracked.snapshot.clone();
+                Ok(live.label.clone())
+            }
+            None => Err(not_tracked(pro_tx_hash)),
+        }
+    })?;
+    tracked.label = label;
+
+    Ok((tracked, outcome))
+}
+
 impl std::fmt::Debug for TrackedMasternodes {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("TrackedMasternodes")
@@ -477,23 +599,25 @@ impl TrackedMasternodes {
             .contains(PersistenceCapabilities::TRACKED_MASTERNODES)
     }
 
-    /// Write the whole registry through the persister (whole-set replace
-    /// for this network — the set is small and user-curated).
-    fn persist(&self) -> Result<(), PlatformWalletError> {
-        let records: Vec<TrackedMasternode> = {
-            let guard = self
-                .registry
-                .read()
-                .expect("tracked masternode registry lock poisoned");
-            guard.values().cloned().collect()
-        };
-        self.persister
-            .persist_tracked_masternodes(self.network, &records)
-            .map_err(|e| {
-                PlatformWalletError::WalletCreation(format!(
-                    "failed to persist tracked masternodes: {e}"
-                ))
-            })
+    /// Apply one registry mutation and durably replace the persisted set as
+    /// one linearizable operation. The write guard deliberately spans the
+    /// persistence call: every backend is bound by the trait's non-reentrant
+    /// callback contract, and releasing it earlier would let an older
+    /// snapshot overwrite a newer concurrent mutation.
+    ///
+    /// The registry is user-curated and small, so retaining a complete
+    /// before-image is cheap and lets a rejected write restore exactly the
+    /// in-memory state the caller observed before the operation.
+    fn mutate_and_persist<T>(
+        &self,
+        mutation: impl FnOnce(&mut TrackedMasternodeMap) -> Result<T, PlatformWalletError>,
+    ) -> Result<T, PlatformWalletError> {
+        mutate_registry_and_persist(
+            self.registry.as_ref(),
+            self.persister.as_ref(),
+            self.network,
+            mutation,
+        )
     }
 
     /// Hydrate the registry from the persister. A load failure logs and
@@ -503,6 +627,7 @@ impl TrackedMasternodes {
             Ok(rows) => {
                 let mut guard = self
                     .registry
+                    .rows
                     .write()
                     .expect("tracked masternode registry lock poisoned");
                 for row in rows {
@@ -519,6 +644,7 @@ impl TrackedMasternodes {
     /// `already_tracked` mark).
     pub fn hashes(&self) -> std::collections::BTreeSet<[u8; 32]> {
         self.registry
+            .rows
             .read()
             .expect("tracked masternode registry lock poisoned")
             .keys()
@@ -529,6 +655,7 @@ impl TrackedMasternodes {
     /// The tracked row itself (snapshot included), when present.
     pub fn get(&self, pro_tx_hash: &[u8; 32]) -> Option<TrackedMasternode> {
         self.registry
+            .rows
             .read()
             .expect("tracked masternode registry lock poisoned")
             .get(pro_tx_hash)
@@ -549,11 +676,7 @@ impl TrackedMasternodes {
             .as_ref()
             .map(|summaries| summaries.iter().find(|s| s.pro_tx_hash == pro_tx_hash));
 
-        let tracked = {
-            let mut guard = self
-                .registry
-                .write()
-                .expect("tracked masternode registry lock poisoned");
+        let tracked = self.mutate_and_persist(|guard| {
             if guard.contains_key(&pro_tx_hash) {
                 return Err(PlatformWalletError::InvalidParameter(
                     "this masternode is already tracked".to_string(),
@@ -571,10 +694,9 @@ impl TrackedMasternodes {
                 },
             };
             guard.insert(pro_tx_hash, tracked.clone());
-            tracked
-        };
+            Ok(tracked)
+        })?;
 
-        self.persist()?;
         Ok(tracked.record(entry))
     }
 
@@ -582,19 +704,7 @@ impl TrackedMasternodes {
     /// host owns any attached keys (secure storage) and deletes them
     /// itself. Blocking.
     pub fn untrack_blocking(&self, pro_tx_hash: &[u8; 32]) -> Result<bool, PlatformWalletError> {
-        let removed = {
-            let mut guard = self
-                .registry
-                .write()
-                .expect("tracked masternode registry lock poisoned");
-            guard.remove(pro_tx_hash).is_some()
-        };
-        // Persist unconditionally: an earlier call may have removed the row
-        // from memory and then failed the write, so a retry arrives with
-        // `removed == false` while the stale row still sits on disk — a
-        // skipped persist would resurrect the node on the next start.
-        self.persist()?;
-        Ok(removed)
+        self.mutate_and_persist(|guard| Ok(guard.remove(pro_tx_hash).is_some()))
     }
 
     /// Rename a tracked masternode (`None` / blank clears the label).
@@ -604,17 +714,13 @@ impl TrackedMasternodes {
         pro_tx_hash: &[u8; 32],
         label: Option<String>,
     ) -> Result<(), PlatformWalletError> {
-        {
-            let mut guard = self
-                .registry
-                .write()
-                .expect("tracked masternode registry lock poisoned");
+        self.mutate_and_persist(|guard| {
             let tracked = guard
                 .get_mut(pro_tx_hash)
                 .ok_or_else(|| not_tracked(pro_tx_hash))?;
             tracked.label = label.filter(|l| !l.trim().is_empty());
-        }
-        self.persist()
+            Ok(())
+        })
     }
 
     /// Every tracked masternode as a display record, with the CURRENT list
@@ -630,6 +736,7 @@ impl TrackedMasternodes {
         let mut rows: Vec<TrackedMasternode> = {
             let guard = self
                 .registry
+                .rows
                 .read()
                 .expect("tracked masternode registry lock poisoned");
             guard.values().cloned().collect()
@@ -656,22 +763,52 @@ impl TrackedMasternodes {
     /// error is returned, so a flaky step never discards what an earlier
     /// step learned; `refreshed_at` advances only on a fully successful
     /// pass.
+    ///
+    /// Serialized per masternode: a second refresh of the same node waits
+    /// for the one in flight instead of racing it — two passes that both
+    /// started from the same snapshot would end with the one finishing last
+    /// putting its own pre-read clone back over the other's findings.
     pub async fn refresh(
         &self,
         pro_tx_hash: &[u8; 32],
     ) -> Result<MasternodeRecord, PlatformWalletError> {
-        let mut tracked = self
-            .get(pro_tx_hash)
-            .ok_or_else(|| not_tracked(pro_tx_hash))?;
+        let (tracked, outcome) = refresh_row_and_persist(
+            self.registry.as_ref(),
+            self.persister.as_ref(),
+            self.network,
+            pro_tx_hash,
+            |snapshot| self.learn(pro_tx_hash, snapshot),
+        )
+        .await?;
 
+        let entry = outcome
+            .list_now
+            .as_ref()
+            .map(|s| s.iter().find(|e| e.pro_tx_hash == *pro_tx_hash));
+        match outcome.first_error {
+            Some(e) => Err(e),
+            None => Ok(tracked.record(entry)),
+        }
+    }
+
+    /// The network half of a [`Self::refresh`] pass: everything the wallet
+    /// layer can learn about `pro_tx_hash`, merged into `snapshot`. Runs
+    /// under the node's refresh gate, so `snapshot` already carries what
+    /// earlier passes learned and a step that comes back empty leaves its
+    /// field alone rather than clearing it.
+    async fn learn(
+        &self,
+        pro_tx_hash: &[u8; 32],
+        mut snapshot: TrackedMasternodeSnapshot,
+    ) -> (TrackedMasternodeSnapshot, RefreshOutcome) {
         // 1. Current list entry (local).
         let list_now = self.spv.masternode_list_summaries().await;
-        let entry = list_now
+        if let Some(Some(entry)) = list_now
             .as_ref()
-            .map(|s| s.iter().find(|e| e.pro_tx_hash == *pro_tx_hash));
-        if let Some(Some(entry)) = &entry {
-            tracked.snapshot.list = Some((*entry).clone());
-            tracked.snapshot.ever_listed = true;
+            .map(|s| s.iter().find(|e| e.pro_tx_hash == *pro_tx_hash))
+        {
+            snapshot.list = Some(entry.clone());
+            snapshot.ever_listed = true;
         }
 
         let mut display = *pro_tx_hash;
@@ -682,7 +819,7 @@ impl TrackedMasternodes {
         // balance.
         match Identity::fetch(self.sdk.as_ref(), Identifier::from(display)).await {
             Ok(Some(identity)) => {
-                let mut platform = tracked.snapshot.platform.clone().unwrap_or_default();
+                let mut platform = snapshot.platform.clone().unwrap_or_default();
                 for key in identity.public_keys().values() {
                     let data: Option<[u8; 20]> = key.data().as_slice().try_into().ok();
                     match key.purpose() {
@@ -696,7 +833,7 @@ impl TrackedMasternodes {
                     }
                 }
                 platform.owner_identity_balance = Some(identity.balance());
-                tracked.snapshot.platform = Some(platform);
+                snapshot.platform = Some(platform);
             }
             Ok(None) => {
                 // No owner identity (node registered before Platform, or a
@@ -711,13 +848,11 @@ impl TrackedMasternodes {
 
         // 3. Operator identity (needs the operator key — list, else
         // registration).
-        let operator_key = tracked
-            .snapshot
+        let operator_key = snapshot
             .list
             .as_ref()
             .map(|l| l.operator_public_key)
-            .or(tracked
-                .snapshot
+            .or(snapshot
                 .registration
                 .as_ref()
                 .map(|r| r.operator_public_key));
@@ -725,14 +860,14 @@ impl TrackedMasternodes {
             let operator_id = Identifier::create_operator_identifier(&display, &operator_key);
             match Identity::fetch(self.sdk.as_ref(), operator_id).await {
                 Ok(Some(identity)) => {
-                    let mut platform = tracked.snapshot.platform.clone().unwrap_or_default();
+                    let mut platform = snapshot.platform.clone().unwrap_or_default();
                     platform.operator_payout_key_hash = identity
                         .public_keys()
                         .values()
                         .find(|k| k.purpose() == Purpose::TRANSFER)
                         .and_then(|k| k.data().as_slice().try_into().ok())
                         .or(platform.operator_payout_key_hash);
-                    tracked.snapshot.platform = Some(platform);
+                    snapshot.platform = Some(platform);
                 }
                 Ok(None) => {}
                 Err(e) => {
@@ -745,13 +880,13 @@ impl TrackedMasternodes {
 
         // 4. ProRegTx (once): registration height, collateral, original
         // keys / payout script.
-        if tracked.snapshot.registration.is_none() {
+        if snapshot.registration.is_none() {
             match self.sdk.get_transaction(&hex::encode(display)).await {
                 Ok(Some(fetched)) => {
                     if let Some(details) =
                         registration_from_transaction(&fetched.transaction, fetched.height)
                     {
-                        tracked.snapshot.registration = Some(details);
+                        snapshot.registration = Some(details);
                     }
                 }
                 Ok(None) => {}
@@ -764,36 +899,16 @@ impl TrackedMasternodes {
         }
 
         if first_error.is_none() {
-            tracked.snapshot.refreshed_at = Some(now_unix());
-        }
-
-        // Keep + persist whatever was learned, even on a partial failure —
-        // but only while the node is STILL tracked: an untrack that raced
-        // the network calls must win (no resurrection), and a concurrent
-        // relabel keeps its label (only the snapshot is refreshed here).
-        let still_tracked = {
-            let mut guard = self
-                .registry
-                .write()
-                .expect("tracked masternode registry lock poisoned");
-            match guard.get_mut(pro_tx_hash) {
-                Some(live) => {
-                    live.snapshot = tracked.snapshot.clone();
-                    tracked.label = live.label.clone();
-                    true
-                }
-                None => false,
-            }
-        };
-        if !still_tracked {
-            return Err(not_tracked(pro_tx_hash));
+            snapshot.refreshed_at = Some(now_unix());
         }
-        self.persist()?;
 
-        match first_error {
-            Some(e) => Err(e),
-            None => Ok(tracked.record(entry)),
-        }
+        (
+            snapshot,
+            RefreshOutcome {
+                list_now,
+                first_error,
+            },
+        )
     }
 
     /// Withdraw from a TRACKED masternode's owner identity with a
@@ -871,7 +986,7 @@ impl TrackedMasternodes {
             _ => {
                 return Err(PlatformWalletError::InvalidParameter(
                     "a withdrawal signs with the owner key or the payout-address key".to_string(),
-                ))
+                ));
             }
         };
 
@@ -985,6 +1100,10 @@ pub(crate) type TrackedMasternodeMap = BTreeMap<[u8; 32], TrackedMasternode>;
 mod tests {
     use super::super::list::test_support::{evonode, masternode};
     use super::*;
+    use crate::changeset::{ClientStartState, PersistenceError, PlatformWalletChangeSet};
+    use crate::wallet::platform_wallet::WalletId;
+    use std::sync::atomic::{AtomicBool, Ordering};
+    use std::sync::{Arc, Mutex, RwLock};
 
     fn snapshot_full() -> TrackedMasternodeSnapshot {
         TrackedMasternodeSnapshot {
@@ -1049,6 +1168,207 @@ mod tests {
         }
     }
 
+    struct RegistryPersister {
+        registry: Arc<TrackedMasternodeRegistry>,
+        reject: AtomicBool,
+        saw_exclusive_registry_lock: AtomicBool,
+        writes: Mutex<Vec<Vec<TrackedMasternode>>>,
+    }
+
+    impl PlatformWalletPersistence for RegistryPersister {
+        fn store(
+            &self,
+            _wallet_id: WalletId,
+            _changeset: PlatformWalletChangeSet,
+        ) -> Result<(), PersistenceError> {
+            Ok(())
+        }
+
+        fn flush(&self, _wallet_id: WalletId) -> Result<(), PersistenceError> {
+            Ok(())
+        }
+
+        fn persist_tracked_masternodes(
+            &self,
+            _network: Network,
+            records: &[TrackedMasternode],
+        ) -> Result<(), PersistenceError> {
+            self.saw_exclusive_registry_lock
+                .store(self.registry.rows.try_read().is_err(), Ordering::SeqCst);
+            if self.reject.load(Ordering::SeqCst) {
+                return Err(PersistenceError::backend("tracked write rejected"));
+            }
+            self.writes.lock().unwrap().push(records.to_vec());
+            Ok(())
+        }
+
+        fn load(&self) -> Result<ClientStartState, PersistenceError> {
+            Ok(ClientStartState::default())
+        }
+    }
+
+    fn registry_persister(
+        initial: TrackedMasternodeMap,
+    ) -> (Arc<TrackedMasternodeRegistry>, Arc<RegistryPersister>) {
+        let registry = Arc::new(TrackedMasternodeRegistry {
+            rows: RwLock::new(initial),
+            gates: Default::default(),
+        });
+        let persister = Arc::new(RegistryPersister {
+            registry: Arc::clone(&registry),
+            reject: AtomicBool::new(false),
+            saw_exclusive_registry_lock: AtomicBool::new(false),
+            writes: Mutex::new(Vec::new()),
+        });
+        (registry, persister)
+    }
+
+    #[test]
+    fn registry_mutation_remains_exclusive_until_whole_set_is_persisted() {
+        let (registry, persister) = registry_persister(TrackedMasternodeMap::new());
+        let row = tracked();
+
+        mutate_registry_and_persist(
+            registry.as_ref(),
+            persister.as_ref(),
+            Network::Testnet,
+            |rows| {
+                rows.insert(row.pro_tx_hash, row.clone());
+                Ok(())
+            },
+        )
+        .unwrap();
+
+        assert!(persister.saw_exclusive_registry_lock.load(Ordering::SeqCst));
+        assert_eq!(persister.writes.lock().unwrap().as_slice(), &[vec![row]]);
+    }
+
+    #[test]
+    fn rejected_whole_set_write_restores_the_complete_registry() {
+        let original = tracked();
+        let mut initial = TrackedMasternodeMap::new();
+        initial.insert(original.pro_tx_hash, original.clone());
+        let (registry, persister) = registry_persister(initial.clone());
+        persister.reject.store(true, Ordering::SeqCst);
+
+        let error = mutate_registry_and_persist(
+            registry.as_ref(),
+            persister.as_ref(),
+            Network::Testnet,
+            |rows| {
+                rows.get_mut(&original.pro_tx_hash).unwrap().label = Some("changed".to_string());
+                rows.insert(
+                    [8; 32],
+                    TrackedMasternode {
+                        pro_tx_hash: [8; 32],
+                        label: None,
+                        added_at: 2,
+                        snapshot: TrackedMasternodeSnapshot::default(),
+                    },
+                );
+                Ok(())
+            },
+        )
+        .unwrap_err();
+
+        assert!(error
+            .to_string()
+            .contains("failed to persist tracked masternodes"));
+        assert_eq!(*registry.rows.read().unwrap(), initial);
+    }
+
+    /// Two refresh passes over one node, interleaved so the pass that
+    /// learns nothing writes last. Its snapshot must not be the pre-read
+    /// clone that predates what the other pass learned — in memory or in
+    /// the persisted set.
+    #[tokio::test]
+    async fn interleaved_refresh_passes_keep_what_the_other_learned() {
+        let hash = [7u8; 32];
+        let mut initial = TrackedMasternodeMap::new();
+        initial.insert(
+            hash,
+            TrackedMasternode {
+                pro_tx_hash: hash,
+                label: Some("my node".to_string()),
+                added_at: 1,
+                snapshot: TrackedMasternodeSnapshot::default(),
+            },
+        );
+        let (registry, persister) = registry_persister(initial);
+
+        let (learning_tx, learning_rx) = tokio::sync::oneshot::channel();
+        let (release_learner_tx, release_learner_rx) = tokio::sync::oneshot::channel();
+        let (release_blind_tx, release_blind_rx) = tokio::sync::oneshot::channel();
+
+        // The pass that learns the registration, held mid-pass so the other
+        // one can start while it is still in its network half.
+        let learner = {
+            let (registry, persister) = (Arc::clone(&registry), Arc::clone(&persister));
+            tokio::spawn(async move {
+                refresh_row_and_persist(
+                    registry.as_ref(),
+                    persister.as_ref(),
+                    Network::Testnet,
+                    &hash,
+                    move |mut snapshot| async move {
+                        learning_tx.send(()).expect("the test awaits this");
+                        release_learner_rx.await.expect("the test releases this");
+                        snapshot.registration = snapshot_full().registration;
+                        (snapshot, RefreshOutcome::default())
+                    },
+                )
+                .await
+            })
+        };
+        learning_rx
+            .await
+            .expect("the learner starts its network half");
+
+        // The pass whose network half comes back empty: it keeps a field by
+        // not overwriting it, so it may only write a snapshot it read AFTER
+        // the learner's.
+        let blind = {
+            let (registry, persister) = (Arc::clone(&registry), Arc::clone(&persister));
+            tokio::spawn(async move {
+                refresh_row_and_persist(
+                    registry.as_ref(),
+                    persister.as_ref(),
+                    Network::Testnet,
+                    &hash,
+                    move |snapshot| async move {
+                        release_blind_rx.await.expect("the test releases this");
+                        (snapshot, RefreshOutcome::default())
+                    },
+                )
+                .await
+            })
+        };
+        // Let it get as far as it can while the learner still holds the row.
+        tokio::task::yield_now().await;
+
+        release_learner_tx.send(()).expect("the learner waits");
+        learner.await.expect("learner task").expect("learner pass");
+        release_blind_tx.send(()).expect("the blind pass waits");
+        blind.await.expect("blind task").expect("blind pass");
+
+        let live = registry
+            .rows
+            .read()
+            .unwrap()
+            .get(&hash)
+            .expect("still tracked")
+            .clone();
+        assert_eq!(live.snapshot.registration, snapshot_full().registration);
+        let persisted = persister
+            .writes
+            .lock()
+            .unwrap()
+            .last()
+            .cloned()
+            .expect("both passes persisted the set");
+        assert_eq!(persisted, vec![live]);
+    }
+
     #[test]
     fn record_prefers_live_list_then_snapshot_then_registration() {
         let t = tracked();
diff --git a/packages/rs-platform-wallet/src/wallet/apply.rs b/packages/rs-platform-wallet/src/wallet/apply.rs
index 2917591c977..48c41310ac1 100644
--- a/packages/rs-platform-wallet/src/wallet/apply.rs
+++ b/packages/rs-platform-wallet/src/wallet/apply.rs
@@ -152,7 +152,7 @@ impl PlatformWalletInfo {
             for (_id, entry) in identities {
                 self.identity_manager.apply_identity_entry(entry);
             }
-            // Best-effort tombstones across both buckets. Routed
+            // Best-effort removals across both buckets. Routed
             // through `remove_for_apply` so the manager's side-index
             // stays in lockstep with the buckets without us having to
             // reach in and touch the index from out here.
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
index ca1b8feb712..a8084c1fa21 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
@@ -13,9 +13,11 @@ use key_wallet::bip32::DerivationPath;
 use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
 use key_wallet::signer::ExtendedPubKeySigner;
 use key_wallet::wallet::managed_wallet_info::asset_lock_builder::{
-    AssetLockFundingAccount, AssetLockFundingType, CreditOutputFunding,
+    AssetLockError, AssetLockFundingAccount, AssetLockFundingType, CreditOutputFunding,
 };
+use key_wallet::wallet::managed_wallet_info::coin_selection::SelectionError;
 use key_wallet::wallet::managed_wallet_info::managed_account_operations::ManagedAccountOperations;
+use key_wallet::wallet::managed_wallet_info::transaction_builder::BuilderError;
 use key_wallet::wallet::managed_wallet_info::transaction_building::AccountTypePreference;
 use key_wallet::wallet::managed_wallet_info::ManagedWalletInfo;
 use key_wallet::wallet::Wallet;
@@ -215,10 +217,19 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
             )
             .await
             .map_err(|e| {
-                PlatformWalletError::AssetLockTransaction(format!(
-                    "Asset lock builder failed: {}",
-                    e
-                ))
+                // A drain's credit-output value is a zero placeholder, so it
+                // must not be advertised as the `required` amount of a typed
+                // shortfall (an empty CoinJoin account would report
+                // `available: 0, required: 0`). The shielded flow already
+                // computed the positive floor and threads it through
+                // `DrainAll`; use it so the pair describes the real gap.
+                let required = match amount {
+                    AssetLockBuildAmount::Exact(value) => value,
+                    AssetLockBuildAmount::DrainAll { minimum_lock_duffs } => {
+                        minimum_lock_duffs.unwrap_or(0)
+                    }
+                };
+                map_builder_error(e, required)
             })?;
 
         // 4. Pull the (pubkey, path) for our single credit output.
@@ -1024,6 +1035,61 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     }
 }
 
+/// Map a key-wallet [`AssetLockError`] to a [`PlatformWalletError`], promoting
+/// every coin-selection shortfall shape to the typed
+/// [`PlatformWalletError::AssetLockInsufficientFunds`] so callers get one
+/// structured shortfall contract (dashpay/platform#4073) instead of a string
+/// they must pattern-match:
+///
+///   - `BuilderError::InsufficientFunds` / `SelectionError::InsufficientFunds`
+///     carry their own exact `available`/`required` duff amounts — preserved
+///     verbatim.
+///   - `SelectionError::NoUtxosAvailable` — the zero-spendable-candidate case,
+///     the MOST extreme shortfall — carries no amounts, so it would otherwise
+///     fall through to the generic string form while *partial* shortfalls
+///     stayed typed. It maps to `available: 0` against the caller's
+///     `requested` target, keeping the empty candidate set on the same
+///     structured path.
+///
+/// `requested` is the caller's target in duffs. On a drain build the target is
+/// the zero credit-output placeholder (key-wallet rewrites the value to
+/// `Σ inputs − fee`), so the mapper substitutes the drain floor —
+/// `minimum_lock_duffs.unwrap_or(0)` — as `required`: an empty account reports
+/// `available: 0` against the configured floor (positive for the shielded
+/// flow, which installs the Type 18 pool-fee floor before building), and 0
+/// only when no floor was supplied. The floor is additionally enforced
+/// downstream by `broadcast_funded_asset_lock_with_funding` against the built
+/// payload.
+///
+/// Every other builder error keeps the pre-existing generic
+/// `AssetLockTransaction` string form.
+fn map_builder_error(e: AssetLockError, requested: u64) -> PlatformWalletError {
+    match e {
+        AssetLockError::Builder(
+            BuilderError::InsufficientFunds {
+                available,
+                required,
+            }
+            | BuilderError::CoinSelection(SelectionError::InsufficientFunds {
+                available,
+                required,
+            }),
+        ) => PlatformWalletError::AssetLockInsufficientFunds {
+            available,
+            required,
+        },
+        AssetLockError::Builder(BuilderError::CoinSelection(SelectionError::NoUtxosAvailable)) => {
+            PlatformWalletError::AssetLockInsufficientFunds {
+                available: 0,
+                required: requested,
+            }
+        }
+        other => {
+            PlatformWalletError::AssetLockTransaction(format!("Asset lock builder failed: {other}"))
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::{Arc, Mutex};
@@ -1054,6 +1120,68 @@ mod tests {
     use crate::wallet::platform_wallet::WalletId;
     use crate::{AssetLockFundingType, PlatformWalletError};
 
+    /// The zero-spendable-candidate selection error must surface the SAME
+    /// typed shortfall as a partial shortfall (not the generic string form),
+    /// so hosts stay on one structured path; and a partial shortfall must
+    /// still carry its own exact amounts (dashpay/platform#4073).
+    #[test]
+    fn coin_selection_shortfalls_map_to_typed_insufficient_funds() {
+        use super::{map_builder_error, AssetLockError, BuilderError, SelectionError};
+
+        // Zero spendable candidates -> typed, available: 0, required = requested.
+        match map_builder_error(
+            AssetLockError::Builder(BuilderError::CoinSelection(
+                SelectionError::NoUtxosAvailable,
+            )),
+            12_345,
+        ) {
+            PlatformWalletError::AssetLockInsufficientFunds {
+                available,
+                required,
+            } => {
+                assert_eq!(available, 0, "empty candidate set means nothing available");
+                assert_eq!(
+                    required, 12_345,
+                    "requested target threaded through as required"
+                );
+            }
+            other => panic!("expected typed AssetLockInsufficientFunds, got {other:?}"),
+        }
+
+        // A partial shortfall keeps its own exact amounts; the requested arg is
+        // NOT substituted for the builder's carried values.
+        match map_builder_error(
+            AssetLockError::Builder(BuilderError::CoinSelection(
+                SelectionError::InsufficientFunds {
+                    available: 100,
+                    required: 500,
+                },
+            )),
+            999,
+        ) {
+            PlatformWalletError::AssetLockInsufficientFunds {
+                available,
+                required,
+            } => {
+                assert_eq!(available, 100);
+                assert_eq!(required, 500, "carried amounts win over the requested arg");
+            }
+            other => panic!("expected typed AssetLockInsufficientFunds, got {other:?}"),
+        }
+
+        // A non-shortfall builder error keeps the pre-existing generic string
+        // form — the typed promotion must not swallow unrelated failures.
+        match map_builder_error(AssetLockError::WatchOnlyWallet, 42) {
+            PlatformWalletError::AssetLockTransaction(msg) => {
+                assert!(
+                    msg.starts_with("Asset lock builder failed: "),
+                    "generic form preserved, got {msg}"
+                );
+            }
+            other => panic!("expected generic AssetLockTransaction, got {other:?}"),
+        }
+    }
+
     /// Persistence stub that records every stored changeset so tests can
     /// assert what the asset-lock flow queued. `fail_flush` simulates a
     /// backend whose durability boundary fails; `flushes` counts `flush`
@@ -1231,6 +1359,85 @@ mod tests {
         );
     }
 
+    /// A whole-account drain that finds nothing selectable must report the
+    /// `DrainAll` minimum-lock floor as the shortfall's `required`, judged at
+    /// BUILD level rather than by calling `map_builder_error` directly.
+    ///
+    /// This is the branch guard for the `AssetLockBuildAmount::DrainAll`
+    /// arm of that `required` computation. A drain's credit output carries a
+    /// ZERO placeholder value (the key-wallet builder rewrites it to
+    /// `Σ inputs − fee`), so reverting the arm to the built `amount_duffs`
+    /// would advertise the meaningless pair `available: 0, required: 0` — and
+    /// the direct-call unit test above, which passes its own `requested`
+    /// argument in, would stay green through that revert. This one would not.
+    ///
+    /// The zero-spendable-candidate state is reached by holding the first
+    /// build's reservation token for the whole test, which keeps the fixture's
+    /// single CoinJoin UTXO reserved and leaves the account fully committed.
+    #[tokio::test]
+    async fn drain_shortfall_reports_the_minimum_lock_floor_as_required() {
+        let broadcaster = Arc::new(CountingOkBroadcaster::default());
+        let (manager, signer, _persistence) =
+            coinjoin_funded_asset_lock_manager(Arc::clone(&broadcaster)).await;
+
+        // Reserve the account's only UTXO. `_token` is a live binding, so the
+        // reservation cannot be released before the second build runs; `None`
+        // skips the floor check, which a build never applies anyway (it is
+        // judged downstream against the BUILT payload).
+        let (_tx, _path, _token, _accounts) = manager
+            .build_asset_lock_transaction_with_funding(
+                super::AssetLockBuildAmount::DrainAll {
+                    minimum_lock_duffs: None,
+                },
+                &[AccountTypePreference::CoinJoin],
+                0,
+                AssetLockFundingType::AssetLockShieldedAddressTopUp,
+                0,
+                &signer,
+            )
+            .await
+            .expect("first drain builds over the funded CoinJoin account");
+
+        // Second drain: zero spendable candidates over a CoinJoin account,
+        // which is exactly the whole-account form the shielded flow uses.
+        let shortfall = manager
+            .build_asset_lock_transaction_with_funding(
+                super::AssetLockBuildAmount::DrainAll {
+                    minimum_lock_duffs: Some(12_345),
+                },
+                &[AccountTypePreference::CoinJoin],
+                0,
+                AssetLockFundingType::AssetLockShieldedAddressTopUp,
+                0,
+                &signer,
+            )
+            .await;
+
+        match shortfall {
+            Err(PlatformWalletError::AssetLockInsufficientFunds {
+                available,
+                required,
+            }) => {
+                assert_eq!(
+                    available, 0,
+                    "the fully-reserved CoinJoin account has nothing selectable"
+                );
+                assert_eq!(
+                    required, 12_345,
+                    "a drain must report the floor threaded through DrainAll, \
+                     not the zero credit-output placeholder"
+                );
+            }
+            other => panic!("expected typed AssetLockInsufficientFunds, got {other:?}"),
+        }
+
+        assert_eq!(
+            broadcaster.calls(),
+            0,
+            "a build-level shortfall must never reach the broadcaster"
+        );
+    }
+
     /// Builds an `AssetLockManager` over the shared BIP44-funded fixture.
     async fn funded_asset_lock_manager<B: TransactionBroadcaster>(
         broadcaster: Arc<B>,
@@ -1429,8 +1636,14 @@ mod tests {
                 &signer,
             )
             .await;
+        // The reserved UTXO leaves zero spendable candidates, so this is the
+        // typed selection shortfall — a stronger assertion than the old generic
+        // build-error match, which any unrelated failure would also satisfy.
         assert!(
-            matches!(rebuild, Err(PlatformWalletError::AssetLockTransaction(_))),
+            matches!(
+                rebuild,
+                Err(PlatformWalletError::AssetLockInsufficientFunds { available: 0, .. })
+            ),
             "rebuild must fail at input selection while the reservation is \
              kept, got {rebuild:?}"
         );
@@ -1535,8 +1748,12 @@ mod tests {
                 &signer,
             )
             .await;
+        // As above: zero spendable candidates is the typed selection shortfall.
         assert!(
-            matches!(rebuild, Err(PlatformWalletError::AssetLockTransaction(_))),
+            matches!(
+                rebuild,
+                Err(PlatformWalletError::AssetLockInsufficientFunds { available: 0, .. })
+            ),
             "rebuild must fail at input selection while the reservation is \
              kept for the advanced row, got {rebuild:?}"
         );
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/contact_info.rs b/packages/rs-platform-wallet/src/wallet/identity/network/contact_info.rs
index 36e34dd3556..126a0803f3e 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/contact_info.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/contact_info.rs
@@ -114,6 +114,7 @@ impl<B: TransactionBroadcaster + ?Sized> DashPayView<'_, B> {
                     operator: WhereOperator::Equal,
                     value: platform_value!(identity_id),
                 }],
+                time_range_clauses: vec![],
                 group_by: vec![],
                 having: vec![],
                 // Load-bearing, not cosmetic: drive answers a bare
@@ -726,6 +727,7 @@ impl<B: TransactionBroadcaster + ?Sized> DashPayView<'_, B> {
         properties.insert("privateData".to_string(), Value::Bytes(private_data));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: doc_id.unwrap_or_else(|| Identifier::from([0u8; 32])),
             owner_id: *identity_id,
             properties,
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/contact_requests.rs b/packages/rs-platform-wallet/src/wallet/identity/network/contact_requests.rs
index 3dc33ea3206..bf5cb86542a 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/contact_requests.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/contact_requests.rs
@@ -4284,6 +4284,7 @@ mod sweep_tests {
         );
 
         let doc = Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([9u8; 32]),
             owner_id: sender,
             properties,
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/dpns_marketplace.rs b/packages/rs-platform-wallet/src/wallet/identity/network/dpns_marketplace.rs
index 309a30f8800..11df0c62951 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/dpns_marketplace.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/dpns_marketplace.rs
@@ -520,6 +520,7 @@ fn domain_by_normalized_label_query(
                 value: Value::Text(normalized_label),
             },
         ],
+        time_range_clauses: vec![],
         group_by: vec![],
         having: vec![],
         order_by_clauses: vec![],
@@ -561,6 +562,7 @@ fn history_by_source_document_query(
                 value: Value::Identifier(source_document_id.to_buffer()),
             },
         ],
+        time_range_clauses: vec![],
         group_by: vec![],
         having: vec![],
         order_by_clauses: vec![OrderClause {
@@ -662,6 +664,7 @@ impl IdentityWallet {
             data_contract: contract,
             document_type_name: DPNS_DOCUMENT_TYPE.to_string(),
             where_clauses,
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![OrderClause {
@@ -766,6 +769,7 @@ impl IdentityWallet {
                 operator: WhereOperator::Equal,
                 value: Value::Identifier(identity_id.to_buffer()),
             }],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![],
@@ -3699,6 +3703,7 @@ mod tests {
                 operator: WhereOperator::Equal,
                 value: Value::Identifier(identity_id.to_buffer()),
             }],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![],
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/profile.rs b/packages/rs-platform-wallet/src/wallet/identity/network/profile.rs
index b5582883845..e4c041d2724 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/profile.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/profile.rs
@@ -197,6 +197,7 @@ impl<B: TransactionBroadcaster + ?Sized> DashPayView<'_, B> {
         };
 
         let stub_document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: Identifier::from([0u8; 32]),
             owner_id: *identity_id,
             properties,
@@ -358,6 +359,7 @@ impl<B: TransactionBroadcaster + ?Sized> DashPayView<'_, B> {
         };
 
         let updated_document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: existing_doc_id,
             owner_id: *identity_id,
             properties,
@@ -744,6 +746,7 @@ fn single_profile_query(
             operator: WhereOperator::Equal,
             value: platform_value!(identity_id),
         }],
+        time_range_clauses: vec![],
         group_by: vec![],
         having: vec![],
         order_by_clauses: vec![],
@@ -777,6 +780,7 @@ fn contact_profiles_chunk_query(
             operator: WhereOperator::In,
             value: in_values,
         }],
+        time_range_clauses: vec![],
         group_by: vec![],
         having: vec![],
         order_by_clauses: vec![OrderClause {
diff --git a/packages/rs-platform-wallet/src/wallet/identity/state/manager/lifecycle.rs b/packages/rs-platform-wallet/src/wallet/identity/state/manager/lifecycle.rs
index 33bbe80e4b8..731b29e082e 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/state/manager/lifecycle.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/state/manager/lifecycle.rs
@@ -151,8 +151,12 @@ impl IdentityManager {
 
     /// Remove an identity from whichever bucket holds it.
     ///
-    /// Persists the tombstone changeset via `persister` and returns the
-    /// removed [`Identity`]. O(log n) via the side-index.
+    /// Persists the removal via `persister` and returns the removed
+    /// [`Identity`]. O(log n) via the side-index.
+    ///
+    /// Removal is terminal in storage as well as in memory: the persister
+    /// deletes the identity and every row it owns, so re-adding the same
+    /// id later starts from a blank identity.
     pub fn remove_identity(
         &mut self,
         identity_id: &Identifier,
diff --git a/packages/rs-sdk-ffi/src/document/create.rs b/packages/rs-sdk-ffi/src/document/create.rs
index 1412ea0d46e..6aa744398d6 100644
--- a/packages/rs-sdk-ffi/src/document/create.rs
+++ b/packages/rs-sdk-ffi/src/document/create.rs
@@ -341,6 +341,7 @@ pub unsafe extern "C" fn dash_sdk_document_make_handle(
 
     // Create the document
     let document = Document::V0(DocumentV0 {
+        contract_version: None,
         id: document_id,
         owner_id,
         properties,
diff --git a/packages/rs-sdk-ffi/src/document/delete.rs b/packages/rs-sdk-ffi/src/document/delete.rs
index b1dbb23d439..864bc8019bb 100644
--- a/packages/rs-sdk-ffi/src/document/delete.rs
+++ b/packages/rs-sdk-ffi/src/document/delete.rs
@@ -400,6 +400,7 @@ mod tests {
         properties.insert("name".to_string(), Value::Text("Test Document".to_string()));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/document/price.rs b/packages/rs-sdk-ffi/src/document/price.rs
index 18aea1485c7..10197aa6a2b 100644
--- a/packages/rs-sdk-ffi/src/document/price.rs
+++ b/packages/rs-sdk-ffi/src/document/price.rs
@@ -336,6 +336,7 @@ mod tests {
         properties.insert("price".to_string(), Value::U64(1000));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/document/purchase.rs b/packages/rs-sdk-ffi/src/document/purchase.rs
index bf55bb6fc11..8d45477eb1f 100644
--- a/packages/rs-sdk-ffi/src/document/purchase.rs
+++ b/packages/rs-sdk-ffi/src/document/purchase.rs
@@ -382,6 +382,7 @@ mod tests {
         properties.insert("price".to_string(), Value::U64(1000));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/document/put.rs b/packages/rs-sdk-ffi/src/document/put.rs
index fb2539df325..d492b6bb065 100644
--- a/packages/rs-sdk-ffi/src/document/put.rs
+++ b/packages/rs-sdk-ffi/src/document/put.rs
@@ -400,6 +400,7 @@ mod tests {
         properties.insert("name".to_string(), Value::Text("Test Document".to_string()));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/document/replace.rs b/packages/rs-sdk-ffi/src/document/replace.rs
index c552bd291b2..6be96648c02 100644
--- a/packages/rs-sdk-ffi/src/document/replace.rs
+++ b/packages/rs-sdk-ffi/src/document/replace.rs
@@ -413,6 +413,7 @@ mod tests {
         properties.insert("age".to_string(), Value::U64(25));
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/document/transfer.rs b/packages/rs-sdk-ffi/src/document/transfer.rs
index 9dfeeaab883..00523d400a1 100644
--- a/packages/rs-sdk-ffi/src/document/transfer.rs
+++ b/packages/rs-sdk-ffi/src/document/transfer.rs
@@ -391,6 +391,7 @@ mod tests {
         );
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id,
             owner_id,
             properties,
diff --git a/packages/rs-sdk-ffi/src/dpns/queries/contested.rs b/packages/rs-sdk-ffi/src/dpns/queries/contested.rs
index 443d3c65198..128167943d7 100644
--- a/packages/rs-sdk-ffi/src/dpns/queries/contested.rs
+++ b/packages/rs-sdk-ffi/src/dpns/queries/contested.rs
@@ -5,6 +5,7 @@ use dash_sdk::dpp::document::DocumentV0Getters;
 use dash_sdk::dpp::system_data_contracts::{load_system_data_contract, SystemDataContract};
 use std::ffi::{CStr, CString};
 use std::os::raw::c_char;
+use std::time::Duration;
 
 use crate::sdk::SDKWrapper;
 use crate::types::{
@@ -16,6 +17,10 @@ use dash_sdk::dpp::identifier::Identifier;
 use dash_sdk::dpp::platform_value::string_encoding::Encoding;
 use serde_json::json; // Still used by other functions
 
+/// A list query fans out to the vote state of every current contest. Keep one
+/// slow or unreachable DAPI node from pinning an FFI caller indefinitely.
+const DPNS_ACTIVE_CONTESTS_TIMEOUT: Duration = Duration::from_secs(30);
+
 /// Get all contested DPNS usernames where an identity is a contender
 ///
 /// # Safety
@@ -637,9 +642,19 @@ pub unsafe extern "C" fn dash_sdk_dpns_get_contested_non_resolved_usernames(
 
     let limit_opt = if limit > 0 { Some(limit) } else { None };
 
-    let result = sdk_wrapper
-        .runtime
-        .block_on(async { sdk.get_contested_non_resolved_usernames(limit_opt).await });
+    let result = sdk_wrapper.runtime.block_on(async {
+        tokio::time::timeout(
+            DPNS_ACTIVE_CONTESTS_TIMEOUT,
+            sdk.get_contested_non_resolved_usernames(limit_opt),
+        )
+        .await
+        .map_err(|_| {
+            dash_sdk::Error::TimeoutReached(
+                DPNS_ACTIVE_CONTESTS_TIMEOUT,
+                "fetching active DPNS contests".to_string(),
+            )
+        })?
+    });
 
     match result {
         Ok(names_with_contest_info) => {
diff --git a/packages/rs-sdk/Cargo.toml b/packages/rs-sdk/Cargo.toml
index ee1bfca14ae..95a53f942cf 100644
--- a/packages/rs-sdk/Cargo.toml
+++ b/packages/rs-sdk/Cargo.toml
@@ -18,7 +18,7 @@ drive = { path = "../rs-drive", default-features = false, features = [
 ] }
 
 drive-proof-verifier = { path = "../rs-drive-proof-verifier", default-features = false }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "753a11f14c9a4bc72bf2d5302751dd43d174621e", features = [
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "6c882c3ee7d2c331f1feda2eb4223add9a6f0e45", features = [
   "client",
   "sqlite",
 ], optional = true }
diff --git a/packages/rs-sdk/src/mock/requests.rs b/packages/rs-sdk/src/mock/requests.rs
index 9015c19a583..8cd7c1c445d 100644
--- a/packages/rs-sdk/src/mock/requests.rs
+++ b/packages/rs-sdk/src/mock/requests.rs
@@ -732,7 +732,9 @@ impl MockResponse for drive_proof_verifier::DocumentSplitAverages {
 /// is already an `i128`. One numeric column keeps the tuple flat while
 /// the tag preserves which axis produced it, so a mock expectation
 /// can't quietly turn a count into a sum.
-type DocumentRankedPage = (u64, Vec<(Vec<u8>, u8, i128)>);
+/// One mock-serialized ranked entry: `(key, axis tag, value, in_key)`.
+type MockRankedEntry = (Vec<u8>, u8, i128, Option<Vec<u8>>);
+type DocumentRankedPage = (u64, Vec<MockRankedEntry>);
 
 const RANKED_TAG_COUNT: u8 = 0;
 const RANKED_TAG_SUM: u8 = 1;
@@ -741,18 +743,21 @@ const RANKED_TAG_AVG: u8 = 2;
 impl MockResponse for drive_proof_verifier::DocumentRankedEntries {
     fn mock_serialize(&self, _sdk: &MockDashPlatformSdk) -> Vec<u8> {
         let bincode_config = standard();
-        let triples: Vec<(Vec<u8>, u8, i128)> = self
+        let triples: Vec<MockRankedEntry> = self
             .entries
             .iter()
             .map(|e| match e.value {
-                drive_proof_verifier::RankedEntryValue::Count(count) => {
-                    (e.key.clone(), RANKED_TAG_COUNT, count as i128)
-                }
+                drive_proof_verifier::RankedEntryValue::Count(count) => (
+                    e.key.clone(),
+                    RANKED_TAG_COUNT,
+                    count as i128,
+                    e.in_key.clone(),
+                ),
                 drive_proof_verifier::RankedEntryValue::Sum(sum) => {
-                    (e.key.clone(), RANKED_TAG_SUM, sum as i128)
+                    (e.key.clone(), RANKED_TAG_SUM, sum as i128, e.in_key.clone())
                 }
                 drive_proof_verifier::RankedEntryValue::AvgFixedPoint(avg) => {
-                    (e.key.clone(), RANKED_TAG_AVG, avg)
+                    (e.key.clone(), RANKED_TAG_AVG, avg, e.in_key.clone())
                 }
             })
             .collect();
@@ -769,7 +774,7 @@ impl MockResponse for drive_proof_verifier::DocumentRankedEntries {
             bincode::decode_from_slice(buf, bincode_config).expect("decode DocumentRankedEntries");
         let entries: Vec<drive_proof_verifier::RankedEntry> = triples
             .into_iter()
-            .map(|(key, tag, value)| {
+            .map(|(key, tag, value, in_key)| {
                 let value = match tag {
                     RANKED_TAG_COUNT => drive_proof_verifier::RankedEntryValue::Count(
                         u64::try_from(value).expect("a Count entry round-trips through i128"),
@@ -780,7 +785,7 @@ impl MockResponse for drive_proof_verifier::DocumentRankedEntries {
                     RANKED_TAG_AVG => drive_proof_verifier::RankedEntryValue::AvgFixedPoint(value),
                     other => panic!("unknown ranked axis tag {other} in mock expectation"),
                 };
-                drive_proof_verifier::RankedEntry { key, value }
+                drive_proof_verifier::RankedEntry { in_key, key, value }
             })
             .collect();
         drive_proof_verifier::DocumentRankedEntries {
diff --git a/packages/rs-sdk/src/platform/dashpay/contact_request.rs b/packages/rs-sdk/src/platform/dashpay/contact_request.rs
index d595faaaed7..adf48b41150 100644
--- a/packages/rs-sdk/src/platform/dashpay/contact_request.rs
+++ b/packages/rs-sdk/src/platform/dashpay/contact_request.rs
@@ -524,6 +524,7 @@ impl Sdk {
 
         // Create the document from the result
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: result.id,
             owner_id: result.owner_id,
             properties: result.properties,
diff --git a/packages/rs-sdk/src/platform/dashpay/contact_request_queries.rs b/packages/rs-sdk/src/platform/dashpay/contact_request_queries.rs
index 5e4d20947ad..841e66676e3 100644
--- a/packages/rs-sdk/src/platform/dashpay/contact_request_queries.rs
+++ b/packages/rs-sdk/src/platform/dashpay/contact_request_queries.rs
@@ -105,6 +105,7 @@ impl Sdk {
                 data_contract: dashpay_contract.clone(),
                 document_type_name: "contactRequest".to_string(),
                 where_clauses: where_clauses.clone(),
+                time_range_clauses: vec![],
                 group_by: vec![],
                 having: vec![],
                 // Load-bearing: a bare secondary-index equality with no
diff --git a/packages/rs-sdk/src/platform/documents/transitions/delete.rs b/packages/rs-sdk/src/platform/documents/transitions/delete.rs
index 2d44ec735a5..da43978f5bd 100644
--- a/packages/rs-sdk/src/platform/documents/transitions/delete.rs
+++ b/packages/rs-sdk/src/platform/documents/transitions/delete.rs
@@ -179,6 +179,7 @@ impl DocumentDeleteTransitionBuilder {
 
         // Create a minimal document for deletion
         let document = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: self.document_id,
             owner_id: self.owner_id,
             properties: Default::default(),
diff --git a/packages/rs-sdk/src/platform/documents/transitions/purchase.rs b/packages/rs-sdk/src/platform/documents/transitions/purchase.rs
index fa6be76a464..d9b245139e0 100644
--- a/packages/rs-sdk/src/platform/documents/transitions/purchase.rs
+++ b/packages/rs-sdk/src/platform/documents/transitions/purchase.rs
@@ -90,6 +90,7 @@ impl DocumentPurchaseTransitionBuilder {
         // Create a minimal document with just the required fields
         // The actual document will be fetched during the transition
         let document = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id: current_owner_id,
             properties: Default::default(),
diff --git a/packages/rs-sdk/src/platform/documents/transitions/set_price.rs b/packages/rs-sdk/src/platform/documents/transitions/set_price.rs
index 6750a6700cc..75f289c2fce 100644
--- a/packages/rs-sdk/src/platform/documents/transitions/set_price.rs
+++ b/packages/rs-sdk/src/platform/documents/transitions/set_price.rs
@@ -84,6 +84,7 @@ impl DocumentSetPriceTransitionBuilder {
         // Create a minimal document with just the required fields
         // The actual document will be fetched during the transition
         let document = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties: Default::default(),
diff --git a/packages/rs-sdk/src/platform/documents/transitions/transfer.rs b/packages/rs-sdk/src/platform/documents/transitions/transfer.rs
index 490380cc3fa..8bd5d515921 100644
--- a/packages/rs-sdk/src/platform/documents/transitions/transfer.rs
+++ b/packages/rs-sdk/src/platform/documents/transitions/transfer.rs
@@ -83,6 +83,7 @@ impl DocumentTransferTransitionBuilder {
         // Create a minimal document with just the required fields
         // The actual document will be fetched during the transition
         let document = Document::V0(dpp::document::DocumentV0 {
+            contract_version: None,
             id: document_id,
             owner_id,
             properties: Default::default(),
diff --git a/packages/rs-sdk/src/platform/dpns_usernames/contested_queries.rs b/packages/rs-sdk/src/platform/dpns_usernames/contested_queries.rs
index 0d87beb3b2d..2980294e6b1 100644
--- a/packages/rs-sdk/src/platform/dpns_usernames/contested_queries.rs
+++ b/packages/rs-sdk/src/platform/dpns_usernames/contested_queries.rs
@@ -18,10 +18,14 @@ use drive::query::vote_poll_vote_state_query::{
 use drive::query::vote_polls_by_document_type_query::VotePollsByDocumentTypeQuery;
 use drive::query::VotePollsByEndDateDriveQuery;
 use drive_proof_verifier::types::{Contenders, ContestedResource, VotePollsGroupedByTimestamp};
+use futures::{stream, StreamExt};
 use std::collections::BTreeMap;
 
 // DPNS parent domain constant
 const DPNS_PARENT_DOMAIN: &str = "dash";
+/// Keep the fan-out small enough not to overwhelm one DAPI node while avoiding
+/// the previous one-network-round-trip-per-contest serial load.
+const DPNS_VOTE_STATE_QUERY_CONCURRENCY: usize = 8;
 
 /// Represents contest information including contenders and end time
 #[derive(Debug, Clone)]
@@ -327,12 +331,20 @@ impl Sdk {
             .get_current_dpns_contests(None, None, Some(100))
             .await?;
 
-        // Check each name to see if it's resolved and collect contenders with end times
+        // Check each name to see if it's resolved and collect contenders with
+        // end times. `buffered` runs a bounded number of requests concurrently
+        // while yielding them in the BTreeMap's deterministic name order. That
+        // preserves the old limit semantics (the first N unresolved names) and
+        // avoids an unbounded burst against DAPI.
         let mut non_resolved_names: BTreeMap<String, ContestInfo> = BTreeMap::new();
+        let vote_states = stream::iter(current_contests).map(|(name, end_time)| async move {
+            let state = self.get_contested_dpns_vote_state(&name, None).await;
+            (name, end_time, state)
+        });
+        let mut vote_states = vote_states.buffered(DPNS_VOTE_STATE_QUERY_CONCURRENCY);
 
-        for (name, end_time) in current_contests {
-            // Get the vote state for this name
-            match self.get_contested_dpns_vote_state(&name, None).await {
+        while let Some((name, end_time, state)) = vote_states.next().await {
+            match state {
                 Ok(contenders) => {
                     // Check if there's a winner - if not, it's unresolved
                     if contenders.winner.is_none() {
diff --git a/packages/rs-sdk/src/platform/dpns_usernames/mod.rs b/packages/rs-sdk/src/platform/dpns_usernames/mod.rs
index 6de3e2950d1..0955ea24454 100644
--- a/packages/rs-sdk/src/platform/dpns_usernames/mod.rs
+++ b/packages/rs-sdk/src/platform/dpns_usernames/mod.rs
@@ -188,6 +188,7 @@ impl Sdk {
 
         // Create preorder document
         let preorder_document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: preorder_id,
             owner_id: identity_id,
             properties: BTreeMap::from([(
@@ -209,6 +210,7 @@ impl Sdk {
 
         // Create domain document
         let domain_document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: domain_id,
             owner_id: identity_id,
             properties: BTreeMap::from([
@@ -339,6 +341,7 @@ impl Sdk {
                     value: Value::Text(normalized_label),
                 },
             ],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![],
@@ -398,6 +401,7 @@ impl Sdk {
                     value: Value::Text(normalized_label),
                 },
             ],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![],
diff --git a/packages/rs-sdk/src/platform/dpns_usernames/queries.rs b/packages/rs-sdk/src/platform/dpns_usernames/queries.rs
index 499091c505a..87f36b6ad03 100644
--- a/packages/rs-sdk/src/platform/dpns_usernames/queries.rs
+++ b/packages/rs-sdk/src/platform/dpns_usernames/queries.rs
@@ -55,6 +55,7 @@ impl Sdk {
                 operator: WhereOperator::Equal,
                 value: Value::Identifier(identity_id.to_buffer()),
             }],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![], // Remove ordering by $createdAt as it might not be indexed
@@ -142,6 +143,7 @@ impl Sdk {
                     value: Value::Text(normalized_prefix),
                 },
             ],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![OrderClause {
diff --git a/packages/rs-sdk/src/platform/query.rs b/packages/rs-sdk/src/platform/query.rs
index 52d7119cf54..a9acc2639ed 100644
--- a/packages/rs-sdk/src/platform/query.rs
+++ b/packages/rs-sdk/src/platform/query.rs
@@ -492,7 +492,12 @@ impl Query<DocumentQuery> for DriveDocumentQuery<'_> {
                     .to_string(),
             ));
         }
-        let q: DocumentQuery = self.into();
+        // Fallible: a drive query carrying time-range resolution provenance
+        // has no faithful `DocumentQuery` form (the resolved bucket equality
+        // would demote to a raw-timestamp predicate) and is refused — build
+        // a `DocumentQuery` with `with_time_range` / `with_time_range_grid`
+        // for time-range selections instead.
+        let q: DocumentQuery = self.try_into()?;
         Ok(q)
     }
 }
diff --git a/packages/rs-sdk/tests/fetch/document.rs b/packages/rs-sdk/tests/fetch/document.rs
index 3edb4501325..fdfe8ee8417 100644
--- a/packages/rs-sdk/tests/fetch/document.rs
+++ b/packages/rs-sdk/tests/fetch/document.rs
@@ -132,6 +132,7 @@ async fn document_list_drive_query() {
         start_at: None,
         start_at_included: true,
         block_time_ms: None,
+        resolved_time_ranges: vec![],
     };
 
     let docs = Document::fetch_many(&sdk, query)
diff --git a/packages/rs-unified-sdk-jni/src/funding.rs b/packages/rs-unified-sdk-jni/src/funding.rs
index f53384c8277..1a53abf9652 100644
--- a/packages/rs-unified-sdk-jni/src/funding.rs
+++ b/packages/rs-unified-sdk-jni/src/funding.rs
@@ -378,6 +378,66 @@ pub extern "system" fn Java_org_dashfoundation_dashsdk_ffi_FundingNative_shielde
     })
 }
 
+/// Fund the shielded pool by DRAINING the wallet's CoinJoin account
+/// (`m/9'/coinType'/4'/accountIndex'`) into a single asset lock — bridges
+/// `platform_wallet_manager_shielded_fund_from_asset_lock_coinjoin_drain`.
+///
+/// Mirrors Swift's `PlatformWalletManager.shieldedFundFromCoinJoinDrain`.
+/// Sibling of [`Java_..._shieldedFundFromAssetLock`] with drain funding, so
+/// it differs in exactly two ways:
+///
+/// 1. **No amount** — every final mixed-coin UTXO is consumed and the lock
+///    value is `Σ inputs − L1 fee`, computed Rust-side. The mixed coins never
+///    hop through a transparent BIP44 address, which is what makes this the
+///    CoinJoin → Shielded migration path rather than a normal shield.
+/// 2. **No surplus output** — the single-recipient remainder flow pins the
+///    consensus surplus to zero, so the parameter is omitted rather than
+///    plumbed as null.
+///
+/// `coinJoinAccountIndex` selects the CoinJoin account to drain (0 for every
+/// current wallet); `recipientRaw43` is the 43-byte raw Orchard address;
+/// `coreSignerHandle` is the manager's `MnemonicResolverHandle`. The Rust
+/// preflight rejects a drain whose balance could not clear the Type 18 pool
+/// fee, so an unrecoverable dust lock is never broadcast, and a stuck lock
+/// resumes through the same `shieldedResumeFundFromAssetLock` entry point as a
+/// BIP44-funded one. The ~30s Halo 2 proof runs inside the call; nothing is
+/// returned on success.
+#[no_mangle]
+pub extern "system" fn Java_org_dashfoundation_dashsdk_ffi_FundingNative_shieldedFundFromCoinJoinDrain(
+    mut env: JNIEnv,
+    _class: JClass,
+    manager_handle: jlong,
+    wallet_id: JByteArray,
+    coin_join_account_index: jint,
+    recipient_raw43: JByteArray,
+    core_signer_handle: jlong,
+) {
+    guard(&mut env, (), |env| {
+        // Reject a negative index at the boundary — it would otherwise
+        // bit-cast to a huge u32 on the FFI call.
+        if coin_join_account_index < 0 {
+            throw_sdk_exception(env, 1, "coinJoinAccountIndex must be non-negative");
+            return;
+        }
+        let Some(wid) = read_id32(env, &wallet_id, "walletId") else {
+            return;
+        };
+        let Some(recipient) = read_recipient43(env, &recipient_raw43) else {
+            return;
+        };
+        let result = unsafe {
+            platform_wallet_ffi::platform_wallet_manager_shielded_fund_from_asset_lock_coinjoin_drain(
+                manager_handle as Handle,
+                wid.as_ptr(),
+                coin_join_account_index as u32,
+                recipient.as_ptr(),
+                core_signer_handle as *mut MnemonicResolverHandle,
+            )
+        };
+        let _ = take_pwffi_error(env, result);
+    })
+}
+
 /// Resume a shielded fund-from-asset-lock from an already-tracked lock by
 /// outpoint — bridges
 /// `platform_wallet_manager_shielded_resume_fund_from_asset_lock`. Sibling
diff --git a/packages/simple-signer/Cargo.toml b/packages/simple-signer/Cargo.toml
index 4bb9d4aa765..b95f827d797 100644
--- a/packages/simple-signer/Cargo.toml
+++ b/packages/simple-signer/Cargo.toml
@@ -24,6 +24,7 @@ bincode = { version = "=2.0.1", features = ["serde"] }
 base64 = { version = "0.22.1" }
 hex = { version = "0.4.3" }
 tracing = "0.1.41"
+zeroize = "1"
 
 [package.metadata.cargo-machete]
 ignored = ["bincode"]
diff --git a/packages/simple-signer/src/single_key_signer.rs b/packages/simple-signer/src/single_key_signer.rs
index c42a431f4e5..ad76b20af51 100644
--- a/packages/simple-signer/src/single_key_signer.rs
+++ b/packages/simple-signer/src/single_key_signer.rs
@@ -10,6 +10,7 @@ use dpp::identity::{IdentityPublicKey, KeyType};
 use dpp::platform_value::BinaryData;
 use dpp::ProtocolError;
 use tracing::{debug, warn};
+use zeroize::Zeroizing;
 
 /// A simple signer that uses a single private key
 /// This is designed for WASM and other single-key use cases
@@ -34,7 +35,7 @@ impl SingleKeySigner {
         if private_key_data.len() != 32 {
             return Err("Private key must be 32 bytes".to_string());
         }
-        let mut arr = [0u8; 32];
+        let mut arr = Zeroizing::new([0u8; 32]);
         arr.copy_from_slice(private_key_data);
         let private_key = PrivateKey::from_byte_array(&arr, network)
             .map_err(|e| format!("Invalid private key: {}", e))?;
@@ -83,6 +84,24 @@ impl SingleKeySigner {
     }
 }
 
+impl Drop for SingleKeySigner {
+    /// `secp256k1::SecretKey` is `Copy` and does not erase itself, and this
+    /// signer is built per FFI call for keys that are deliberately never
+    /// persisted, so the scalar is cleared when the handle is destroyed.
+    ///
+    /// This covers the copies this type owns. It does not reach the one the
+    /// pinned `dashcore` makes internally: `signer::sign` parses its own
+    /// `SecretKey` from the bytes handed to it and does not erase it before
+    /// returning. Closing that gap needs erasing storage inside
+    /// `rust-dashcore` itself.
+    ///
+    /// TODO(dashconnect-key-hygiene): upstream zeroizing parse/sign storage to
+    /// `rust-dashcore`, then bump the pinned revision here.
+    fn drop(&mut self) {
+        self.private_key.inner.non_secure_erase();
+    }
+}
+
 #[async_trait]
 impl Signer<IdentityPublicKey> for SingleKeySigner {
     async fn sign(
@@ -95,7 +114,8 @@ impl Signer<IdentityPublicKey> for SingleKeySigner {
             KeyType::ECDSA_SECP256K1 | KeyType::ECDSA_HASH160 => {
                 // Do not log private key material. Log data fingerprint only.
                 debug!(data_hex = %hex::encode(data), "SingleKeySigner: signing data");
-                let signature = signer::sign(data, &self.private_key.inner.secret_bytes())?;
+                let secret_bytes = Zeroizing::new(self.private_key.inner.secret_bytes());
+                let signature = signer::sign(data, &secret_bytes[..])?;
                 Ok(signature.to_vec().into())
             }
             _ => {
@@ -137,14 +157,8 @@ impl Signer<IdentityPublicKey> for SingleKeySigner {
             KeyType::ECDSA_SECP256K1 => {
                 // Compare full public key
                 let secp = dashcore::secp256k1::Secp256k1::new();
-                let secret_key = match dashcore::secp256k1::SecretKey::from_byte_array(
-                    &self.private_key.inner.secret_bytes(),
-                ) {
-                    Ok(sk) => sk,
-                    Err(_) => return false,
-                };
                 let public_key =
-                    dashcore::secp256k1::PublicKey::from_secret_key(&secp, &secret_key);
+                    dashcore::secp256k1::PublicKey::from_secret_key(&secp, &self.private_key.inner);
                 let public_key_bytes = public_key.serialize();
 
                 identity_public_key.data().as_slice() == public_key_bytes
@@ -154,14 +168,8 @@ impl Signer<IdentityPublicKey> for SingleKeySigner {
                 use dpp::dashcore::hashes::{hash160, Hash};
 
                 let secp = dashcore::secp256k1::Secp256k1::new();
-                let secret_key = match dashcore::secp256k1::SecretKey::from_byte_array(
-                    &self.private_key.inner.secret_bytes(),
-                ) {
-                    Ok(sk) => sk,
-                    Err(_) => return false,
-                };
                 let public_key =
-                    dashcore::secp256k1::PublicKey::from_secret_key(&secp, &secret_key);
+                    dashcore::secp256k1::PublicKey::from_secret_key(&secp, &self.private_key.inner);
                 let public_key_bytes = public_key.serialize();
                 let public_key_hash160 = hash160::Hash::hash(&public_key_bytes)
                     .to_byte_array()
@@ -178,6 +186,22 @@ impl Signer<IdentityPublicKey> for SingleKeySigner {
 mod tests {
     use super::*;
     use dashcore::Network;
+    use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
+    use dpp::identity::{Purpose, SecurityLevel};
+    use dpp::platform_value::BinaryData;
+
+    fn identity_key(key_type: KeyType, data: Vec<u8>) -> IdentityPublicKey {
+        IdentityPublicKey::V0(IdentityPublicKeyV0 {
+            id: 0,
+            purpose: Purpose::AUTHENTICATION,
+            security_level: SecurityLevel::HIGH,
+            contract_bounds: None,
+            key_type,
+            read_only: false,
+            data: BinaryData::new(data),
+            disabled_at: None,
+        })
+    }
 
     #[test]
     fn test_single_key_signer_from_wif() -> Result<(), String> {
@@ -221,6 +245,30 @@ mod tests {
         assert!(SingleKeySigner::new_from_slice(&bytes, Network::Testnet).is_err());
     }
 
+    #[test]
+    fn test_can_sign_with_ecdsa_key_types() -> Result<(), String> {
+        use dpp::dashcore::hashes::{hash160, Hash};
+
+        let signer = SingleKeySigner::new_from_slice(&[0x03; 32], Network::Testnet)?;
+        let secp = dashcore::secp256k1::Secp256k1::new();
+        let public_key =
+            dashcore::secp256k1::PublicKey::from_secret_key(&secp, &signer.private_key.inner)
+                .serialize();
+
+        let full_key = identity_key(KeyType::ECDSA_SECP256K1, public_key.to_vec());
+        assert!(signer.can_sign_with(&full_key));
+        let wrong_full_key = identity_key(KeyType::ECDSA_SECP256K1, vec![0; public_key.len()]);
+        assert!(!signer.can_sign_with(&wrong_full_key));
+
+        let public_key_hash = hash160::Hash::hash(&public_key).to_byte_array();
+        let hash_key = identity_key(KeyType::ECDSA_HASH160, public_key_hash.to_vec());
+        assert!(signer.can_sign_with(&hash_key));
+        let wrong_hash_key = identity_key(KeyType::ECDSA_HASH160, vec![0; public_key_hash.len()]);
+        assert!(!signer.can_sign_with(&wrong_hash_key));
+
+        Ok(())
+    }
+
     #[test]
     fn test_single_key_signer_auto_detect() -> Result<(), String> {
         // Test hex detection
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/FFI/KeychainSigner.swift b/packages/swift-sdk/Sources/SwiftDashSDK/FFI/KeychainSigner.swift
index b5eac3f6e45..d41605004fd 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/FFI/KeychainSigner.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/FFI/KeychainSigner.swift
@@ -84,6 +84,54 @@ import SwiftData
 /// current `passUnretained` shape removes the leak at the cost
 /// of the explicit keepalive contract above.
 public final class KeychainSigner: Signer, @unchecked Sendable {
+    final class AdditionalSigningKeyEntry: @unchecked Sendable {
+        let publicKey: Data
+        private var privateKeyBytes: [UInt8]
+
+        init(publicKey: Data, privateKey: Data) {
+            self.publicKey = publicKey
+            self.privateKeyBytes = Array(privateKey)
+        }
+
+        deinit {
+            zeroPrivateKey()
+        }
+
+        func sign(data: Data, network: Network) -> Result<Data, KeychainSigner.Error> {
+            do {
+                return .success(
+                    try privateKeyBytes.withUnsafeBufferPointer { buffer in
+                        try RawKeySigner.sign(
+                            data: data,
+                            privateKeyBuffer: buffer,
+                            network: network
+                        )
+                    }
+                )
+            } catch KeyManagerError.signerCreationFailed(let message) {
+                return .failure(.ffiSignerCreationFailed(message: message))
+            } catch KeyManagerError.invalidKeyFormat(let message) {
+                return .failure(.ffiSignerCreationFailed(message: "invalid key format: \(message)"))
+            } catch KeyManagerError.signingFailed(let message) {
+                return .failure(.ffiSignFailed(message: message))
+            } catch {
+                return .failure(.ffiSignFailed(message: String(describing: error)))
+            }
+        }
+
+        func zeroPrivateKey() {
+            privateKeyBytes.withUnsafeMutableBufferPointer { ptr in
+                if let base = ptr.baseAddress {
+                    memset_s(UnsafeMutableRawPointer(base), ptr.count, 0, ptr.count)
+                }
+            }
+        }
+
+        var isZeroedForTesting: Bool {
+            privateKeyBytes.allSatisfy { $0 == 0 }
+        }
+    }
+
     // MARK: Public surface
 
     /// FFI signer handle. Pass to any `*_with_signer` entry point;
@@ -190,6 +238,7 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
     /// Raw pointer to the FFI signer handle. Boxed by Rust and freed
     /// in `deinit`.
     private var handlePtr: OpaquePointer!
+    private var additionalSigningKeys: [Data: [AdditionalSigningKeyEntry]] = [:]
 
     // MARK: Init
 
@@ -245,6 +294,7 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
     }
 
     deinit {
+        clearAdditionalSigningKeys()
         // `dash_sdk_signer_destroy` drops the Rust handle box +
         // vtable allocation. The destroy trampoline is a no-op
         // (init used `passUnretained`, so there's nothing to
@@ -256,8 +306,112 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
         }
     }
 
+    /// `isolation` keeps `body` running in the caller's actor context, so a
+    /// caller isolated to an actor (e.g. `@MainActor`) does not have to send a
+    /// non-`Sendable` closure across an isolation boundary to use the scope.
+    /// `T` is `Sendable` because the result still leaves `body`'s context: the
+    /// SwiftExampleApp target compiles these sources without region-based
+    /// isolation, where returning a non-`Sendable` value is rejected outright.
+    public func withAdditionalSigningKeys<T: Sendable>(
+        _ keys: [(publicKey: Data, privateKey: Data)],
+        isolation: isolated (any Actor)? = #isolation,
+        perform body: () async throws -> T
+    ) async rethrows -> T {
+        try await withAdditionalSigningKeys(
+            makeAdditionalSigningKeyEntries(keys),
+            isolation: isolation,
+            perform: body
+        )
+    }
+
+    func withAdditionalSigningKeys<T: Sendable>(
+        _ entries: [AdditionalSigningKeyEntry],
+        isolation: isolated (any Actor)? = #isolation,
+        perform body: () async throws -> T
+    ) async rethrows -> T {
+        pushAdditionalSigningKeys(entries)
+        defer { popAdditionalSigningKeys(entries) }
+        return try await body()
+    }
+
     // MARK: Trampoline-callable internals
 
+    func makeAdditionalSigningKeyEntries(
+        _ keys: [(publicKey: Data, privateKey: Data)]
+    ) -> [AdditionalSigningKeyEntry] {
+        keys.map { AdditionalSigningKeyEntry(publicKey: $0.publicKey, privateKey: $0.privateKey) }
+    }
+
+    func pushAdditionalSigningKeys(_ entries: [AdditionalSigningKeyEntry]) {
+        queue.sync {
+            for entry in entries {
+                additionalSigningKeys[entry.publicKey, default: []].append(entry)
+            }
+        }
+    }
+
+    func popAdditionalSigningKeys(_ entries: [AdditionalSigningKeyEntry]) {
+        queue.sync {
+            for entry in entries.reversed() {
+                guard var stack = additionalSigningKeys[entry.publicKey] else {
+                    entry.zeroPrivateKey()
+                    continue
+                }
+
+                if let last = stack.last, last === entry {
+                    stack.removeLast()
+                } else {
+                    stack.removeAll { $0 === entry }
+                }
+
+                if stack.isEmpty {
+                    additionalSigningKeys.removeValue(forKey: entry.publicKey)
+                } else {
+                    additionalSigningKeys[entry.publicKey] = stack
+                }
+
+                entry.zeroPrivateKey()
+            }
+        }
+    }
+
+    func clearAdditionalSigningKeys() {
+        queue.sync {
+            for entries in additionalSigningKeys.values {
+                for entry in entries {
+                    entry.zeroPrivateKey()
+                }
+            }
+            additionalSigningKeys.removeAll()
+        }
+    }
+
+    func additionalSigningKey(publicKey: Data) -> AdditionalSigningKeyEntry? {
+        var entry: AdditionalSigningKeyEntry?
+        queue.sync {
+            // HASH160 identity keys can be requested by their 20-byte hash160
+            // rather than the 33-byte compressed secp256k1 public key. The
+            // registry is therefore keyed by the exact bytes the FFI asks for.
+            entry = additionalSigningKeys[publicKey]?.last
+        }
+        return entry
+    }
+
+    /// Looks the scoped key up and signs with it inside one critical section.
+    /// `popAdditionalSigningKeys` / `clearAdditionalSigningKeys` zero an
+    /// entry's bytes while holding `queue`, so releasing the lock between the
+    /// lookup and the signature would let a scope ending on another thread
+    /// zero the key mid-read and yield a garbage signature instead of a clean
+    /// failure. Returns `nil` when no scoped key matches.
+    func signWithScopedKey(publicKey: Data, data: Data) -> Result<Data, Error>? {
+        queue.sync {
+            guard let entry = additionalSigningKeys[publicKey]?.last else {
+                return nil
+            }
+            return entry.sign(data: data, network: network)
+        }
+    }
+
     // MARK: key_type dispatch
     //
     // The Rust signer FFI sends one of two payload shapes through the
@@ -312,7 +466,8 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
     /// private keys are NEVER persisted; they're derived per call
     /// from `(mnemonic, path)` inside Rust.
     fileprivate func lookupIdentityPrivateKey(
-        publicKey: Data
+        publicKey: Data,
+        keyType: UInt8
     ) -> Result<Data, Error> {
         var captured: Result<Data, Error> = .failure(.publicKeyNotFound)
         queue.sync {
@@ -340,6 +495,9 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
                 return
             }
 
+            print(
+                "⚠️ KEYCHAIN_SIGNER_PUBLIC_KEY_MISS keyType=\(keyType) requestedBytes=\(pubkeyHex)"
+            )
             captured = .failure(.publicKeyNotFound)
         }
         return captured
@@ -373,6 +531,10 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
     /// derive-and-sign FFI requires. We do NOT actually derive a key
     /// here; the check is purely "are the prerequisites in place".
     func canSign(publicKey: Data, keyType: UInt8) -> Bool {
+        if additionalSigningKey(publicKey: publicKey) != nil {
+            return true
+        }
+
         if keyType == Self.platformAddressHashKeyType {
             // Resolve the address row first (synchronous lookup);
             // mnemonic check is gated on having the wallet id.
@@ -436,6 +598,53 @@ public final class KeychainSigner: Signer, @unchecked Sendable {
         return found
     }
 
+    /// Shared by the sign trampoline and tests: consult any scoped
+    /// in-memory registry first, then the existing platform-address /
+    /// breadcrumb / persisted-key paths.
+    func signOnDemand(
+        publicKey: Data,
+        keyType: UInt8,
+        data: Data
+    ) -> Result<Data, Error> {
+        if let result = signWithScopedKey(publicKey: publicKey, data: data) {
+            return result
+        }
+
+        if keyType == Self.platformAddressHashKeyType {
+            return signPlatformAddressOnDemand(
+                addressHash: publicKey,
+                keyType: keyType,
+                data: data
+            )
+        }
+
+        switch signIdentityKeyOnDemand(
+            publicKey: publicKey,
+            keyType: keyType,
+            data: data
+        ) {
+        case .success(let sig)?:
+            return .success(sig)
+        case .failure(.signWithMnemonicFailed(let tag))?
+        where tag == SignWithMnemonicResolverError.unsupportedKeyType.rawValue:
+            break
+        case .failure(let err)?:
+            print("⚠️ IDENTITY_SIGN_FALLBACK resolver-failed: \(err.localizedDescription)")
+        case nil:
+            print("⚠️ IDENTITY_SIGN_FALLBACK no-breadcrumb")
+        }
+
+        let privateKey: Data
+        switch lookupIdentityPrivateKey(publicKey: publicKey, keyType: keyType) {
+        case .failure(let err):
+            return .failure(err)
+        case .success(let priv):
+            privateKey = priv
+        }
+
+        return ffiSign(privateKey: privateKey, data: data)
+    }
+
     /// Resolved context for a platform-address signing request:
     /// the matching `PersistentPlatformAddress`'s wallet id +
     /// derivation path. `nil` when no row matches the supplied
@@ -803,77 +1012,22 @@ private func keychainSignerSignAsyncTrampoline(
         }
     }
 
-    // Dispatch on key_type. Platform-address signing (`0xFF`) is a
-    // single-call derive-and-sign path — no separate key lookup,
-    // because the derived bytes never come back to Swift. Identity
-    // signing (`< 5`) prefers the same derive-sign-destroy path (from
-    // the key's stored breadcrumb) and falls back to the stored scalar
-    // when a key has no breadcrumb yet.
-    if keyType == KeychainSigner.platformAddressHashKeyType {
-        switch signer.signPlatformAddressOnDemand(
-            addressHash: pubkeyData,
-            keyType: keyType,
-            data: dataToSign
-        ) {
-        case .failure(let err):
-            reportError(err.localizedDescription)
-        case .success(let sig):
-            reportSuccess(sig)
-        }
-        return
-    }
-
-    // Identity signing (`keyType < 5`): derive-sign-destroy via the resolver
-    // when the key carries a derivation breadcrumb; otherwise fall back to the
-    // stored scalar. The fallback keeps already-materialized keys — and any not
-    // yet backfilled — signable, so the cutover is non-lockout by construction.
-    // Every fallback is logged so the zero-fallback acceptance gate can catch
-    // un-migrated rows or resolver failures before the stored scalar is removed.
-    //
-    // Rust owns the supported-key-type decision: we attempt the resolver for
-    // any identity key and treat its `UNSUPPORTED_KEY_TYPE` tag as the routing
-    // signal (fall through to the stored scalar silently, no fallback log —
-    // the resolver simply doesn't handle this type). This avoids mirroring the
-    // Rust ECDSA-only set in Swift, so a future Rust-derivable key type is
-    // automatically routed through the resolver without a matching Swift edit.
-    switch signer.signIdentityKeyOnDemand(
+    switch signer.signOnDemand(
         publicKey: pubkeyData,
         keyType: keyType,
         data: dataToSign
     ) {
-    case .success(let sig)?:
-        reportSuccess(sig)
-        return
-    case .failure(.signWithMnemonicFailed(let tag))?
-    where tag == SignWithMnemonicResolverError.unsupportedKeyType.rawValue:
-        // Rust does not derive-sign this key type — route to the stored
-        // scalar with no spurious fallback log.
-        break
-    case .failure(let err)?:
-        print("⚠️ IDENTITY_SIGN_FALLBACK resolver-failed: \(err.localizedDescription)")
-    case nil:
-        print("⚠️ IDENTITY_SIGN_FALLBACK no-breadcrumb")
-    }
-
-    let privateKey: Data
-    switch signer.lookupIdentityPrivateKey(publicKey: pubkeyData) {
     case .failure(let err):
         // "No stored key" outcomes carry the structured
         // SigningKeyUnavailable code so hosts get the typed
         // PlatformWalletError.signingKeyUnavailable without message
-        // sniffing (dashpay/platform#4060 finding 7).
+        // sniffing (dashpay/platform#4060 finding 7). The lookup that
+        // raises it now lives inside `signOnDemand`, so the mapping is
+        // applied here rather than at each call site.
         reportError(
             err.localizedDescription,
             code: keychainSignerCompletionErrorCode(for: err)
         )
-        return
-    case .success(let priv):
-        privateKey = priv
-    }
-
-    switch signer.ffiSign(privateKey: privateKey, data: dataToSign) {
-    case .failure(let err):
-        reportError(err.localizedDescription)
     case .success(let sig):
         reportSuccess(sig)
     }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/KeyWallet/KeyManager.swift b/packages/swift-sdk/Sources/SwiftDashSDK/KeyWallet/KeyManager.swift
index 28a1a098370..e4baac4e1d2 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/KeyWallet/KeyManager.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/KeyWallet/KeyManager.swift
@@ -53,18 +53,23 @@ public enum RawKeySigner {
   /// - Parameters:
   ///   - data: Raw bytes to sign. Hashed (SHA256d) inside the FFI —
   ///     pass the full message, never a pre-computed digest.
-  ///   - privateKey: 32-byte ECDSA scalar. A local copy is zeroed
-  ///     before returning.
+  ///   - privateKeyBuffer: 32-byte ECDSA scalar borrowed from the
+  ///     caller. A local copy is still zeroed before returning so the
+  ///     FFI signer never reads directly from caller-owned storage.
   ///   - network: Affects WIF/address metadata inside the signer only,
   ///     not the signature bytes.
-  public static func sign(data: Data, privateKey: Data, network: Network) throws -> Data {
-    guard privateKey.count == 32 else {
+  public static func sign(
+    data: Data,
+    privateKeyBuffer: UnsafeBufferPointer<UInt8>,
+    network: Network
+  ) throws -> Data {
+    guard privateKeyBuffer.count == 32 else {
       throw KeyManagerError.invalidKeyFormat(
-        "Private key must be 32 bytes, got \(privateKey.count)")
+        "Private key must be 32 bytes, got \(privateKeyBuffer.count)")
     }
 
     // Defensive copy into a mutable buffer we can zero on exit.
-    var keyCopy = [UInt8](privateKey)
+    var keyCopy = Array(privateKeyBuffer)
     defer {
       keyCopy.withUnsafeMutableBufferPointer { buf in
         if let base = buf.baseAddress {
@@ -117,6 +122,24 @@ public enum RawKeySigner {
     }
     return Data(bytes: bytes, count: Int(sigStruct.pointee.signature_len))
   }
+
+  /// - Parameters:
+  ///   - data: Raw bytes to sign. Hashed (SHA256d) inside the FFI —
+  ///     pass the full message, never a pre-computed digest.
+  ///   - privateKey: 32-byte ECDSA scalar. A local copy is zeroed
+  ///     before returning.
+  ///   - network: Affects WIF/address metadata inside the signer only,
+  ///     not the signature bytes.
+  public static func sign(data: Data, privateKey: Data, network: Network) throws -> Data {
+    try privateKey.withUnsafeBytes { rawBuffer in
+      let keyBytes = rawBuffer.bindMemory(to: UInt8.self)
+      return try sign(
+        data: data,
+        privateKeyBuffer: UnsafeBufferPointer(start: keyBytes.baseAddress, count: keyBytes.count),
+        network: network
+      )
+    }
+  }
 }
 
 // MARK: - Key Manager
@@ -471,4 +494,3 @@ public final class KeyManager: Sendable {
     return privateKeyData.count == 32
   }
 }
-
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
index 6d17cd115e1..f111121f922 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
@@ -3,8 +3,9 @@ import SwiftData
 
 /// Factory for creating SwiftData model containers for Dash Platform persistence
 public enum DashModelContainer {
-    /// All persistent model types for the Dash SDK
-    public static var modelTypes: [any PersistentModel.Type] {
+    /// The exact model set shipped as schema V1. Keep frozen: staged
+    /// migration identifies an existing store by this schema checksum.
+    fileprivate static var v1ModelTypes: [any PersistentModel.Type] {
         [
             PersistentIdentity.self,
             PersistentDPNSName.self,
@@ -39,14 +40,18 @@ public enum DashModelContainer {
             PersistentShieldedViewingKey.self,
             PersistentAssetLock.self,
             PersistentInvitation.self,
-            PersistentMasternode.self,
-            PersistentTrackedMasternode.self
+            PersistentMasternode.self
         ]
     }
 
+    /// All persistent model types in the current Dash SDK schema.
+    public static var modelTypes: [any PersistentModel.Type] {
+        v1ModelTypes + [PersistentTrackedMasternode.self]
+    }
+
     /// Create the schema for all Dash Platform models
     public static var schema: Schema {
-        Schema(modelTypes)
+        Schema(versionedSchema: DashSchemaV2.self)
     }
 
     /// Create a persistent model container for storing data
@@ -66,10 +71,8 @@ public enum DashModelContainer {
             cloudKitDatabase: cloudKit ? .automatic : .none
         )
 
-        // Wire the migration plan even though V1 is the only shipped
-        // schema — future schema bumps just have to add a stage to
-        // `DashMigrationPlan.stages` without also having to remember
-        // to thread the plan into the container construction call.
+        // Always wire the migration plan so stores created by an older SDK
+        // advance through the registered versioned schemas.
         return try ModelContainer(
             for: schema,
             migrationPlan: DashMigrationPlan.self,
@@ -96,11 +99,13 @@ public enum DashModelContainer {
 /// SwiftData migration plan for Dash Platform model updates
 public enum DashMigrationPlan: SchemaMigrationPlan {
     public static var schemas: [any VersionedSchema.Type] {
-        [DashSchemaV1.self]
+        [DashSchemaV1.self, DashSchemaV2.self]
     }
 
     public static var stages: [MigrationStage] {
-        []
+        [
+            .lightweight(fromVersion: DashSchemaV1.self, toVersion: DashSchemaV2.self)
+        ]
     }
 }
 
@@ -231,6 +236,19 @@ public enum DashSchemaV1: VersionedSchema {
         Schema.Version(1, 0, 0)
     }
 
+    public static var models: [any PersistentModel.Type] {
+        DashModelContainer.v1ModelTypes
+    }
+}
+
+/// Version 2 adds wallet-independent tracked masternodes. The new model has
+/// no relationship or required-data dependency on V1 rows, so a lightweight
+/// migration preserves every existing row and creates its table.
+public enum DashSchemaV2: VersionedSchema {
+    public static var versionIdentifier: Schema.Version {
+        Schema.Version(2, 0, 0)
+    }
+
     public static var models: [any PersistentModel.Type] {
         DashModelContainer.modelTypes
     }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
index 5ff4f28e682..bf4aca366ea 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
@@ -173,11 +173,11 @@ public final class ManagedPlatformWallet: @unchecked Sendable {
         /// secp256k1; 48 for BLS; etc.).
         public let pubkeyBytes: Data
         public let readOnly: Bool
-        /// Optional contract-bounds restriction. Required for
-        /// Encryption / Decryption keys (Drive scopes those keys
-        /// to a specific contract / document type so a key issued
-        /// for App A cannot decrypt App B's payloads). `nil` for
-        /// every other purpose.
+        /// Optional contract-bounds restriction. Bounds are valid
+        /// for any purpose only when present and only if consensus
+        /// allows that purpose / contract / document-type shape.
+        /// `nil` is valid for every purpose, including Encryption /
+        /// Decryption keys.
         public let contractBounds: ContractBounds?
 
         public init(
@@ -212,6 +212,25 @@ public final class ManagedPlatformWallet: @unchecked Sendable {
         case singleContractDocumentType(id: Data, documentTypeName: String)
     }
 
+    /// Inspectable fields of a parsed raw `IdentityUpdateTransition`.
+    /// The keys intentionally reuse `IdentityPubkey` so callers can
+    /// validate and hand them back to `updateIdentity(...)` unchanged.
+    public struct ParsedIdentityUpdateTransition: Sendable {
+        public let identityId: Identifier
+        public let addPublicKeys: [IdentityPubkey]
+        public let disablePublicKeyIds: [UInt32]
+
+        public init(
+            identityId: Identifier,
+            addPublicKeys: [IdentityPubkey],
+            disablePublicKeyIds: [UInt32]
+        ) {
+            self.identityId = identityId
+            self.addPublicKeys = addPublicKeys
+            self.disablePublicKeyIds = disablePublicKeyIds
+        }
+    }
+
     /// Result of a successful identity registration.
     public struct CreatedIdentity: Sendable {
         /// 32-byte identity id.
@@ -3192,6 +3211,139 @@ extension ManagedPlatformWallet {
         }.value
     }
 
+    /// Parse a raw `IdentityUpdateTransition` from DPP bytes without
+    /// signing or broadcasting it. Accepts both standard tagged bytes
+    /// and Yappr's tagless `dash-st:` framing.
+    public func parseIdentityUpdateTransition(_ bytes: Data) throws -> ParsedIdentityUpdateTransition {
+        guard !bytes.isEmpty else {
+            throw PlatformWalletError.deserialization(
+                "IdentityUpdateTransition bytes are empty"
+            )
+        }
+
+        var out = ParsedIdentityUpdateFFI(
+            identity_id: (
+                0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0
+            ),
+            add_public_keys: nil,
+            add_public_keys_count: 0,
+            disable_public_key_ids: nil,
+            disable_public_key_ids_count: 0
+        )
+
+        let result = bytes.withUnsafeBytes { rawBuffer -> PlatformWalletFFIResult in
+            let byteBuffer = rawBuffer.bindMemory(to: UInt8.self)
+            return platform_wallet_parse_identity_update_transition(
+                byteBuffer.baseAddress,
+                UInt(byteBuffer.count),
+                &out
+            )
+        }
+        try result.check()
+        defer { platform_wallet_parse_identity_update_transition_free(&out) }
+
+        var identityTuple = out.identity_id
+        let identityId = Swift.withUnsafeBytes(of: &identityTuple) { Data($0) }
+
+        let addPublicKeys: [IdentityPubkey]
+        if let pointer = out.add_public_keys, out.add_public_keys_count > 0 {
+            let buffer = UnsafeBufferPointer(start: pointer, count: Int(out.add_public_keys_count))
+            addPublicKeys = try buffer.enumerated().map { index, entry in
+                try Self.makeParsedIdentityPubkey(from: entry, index: index)
+            }
+        } else {
+            addPublicKeys = []
+        }
+
+        let disablePublicKeyIds: [UInt32]
+        if let pointer = out.disable_public_key_ids, out.disable_public_key_ids_count > 0 {
+            disablePublicKeyIds = Array(
+                UnsafeBufferPointer(
+                    start: pointer,
+                    count: Int(out.disable_public_key_ids_count)
+                )
+            )
+        } else {
+            disablePublicKeyIds = []
+        }
+
+        return ParsedIdentityUpdateTransition(
+            identityId: identityId,
+            addPublicKeys: addPublicKeys,
+            disablePublicKeyIds: disablePublicKeyIds
+        )
+    }
+
+    private static func makeParsedIdentityPubkey(
+        from entry: ParsedIdentityUpdatePublicKeyFFI,
+        index: Int
+    ) throws -> IdentityPubkey {
+        guard let keyType = KeyType(rawValue: entry.key_type),
+              let purpose = KeyPurpose(rawValue: entry.purpose),
+              let securityLevel = SecurityLevel(rawValue: entry.security_level) else {
+            throw PlatformWalletError.deserialization(
+                "Unknown IdentityUpdateTransition public-key enum discriminant at index \(index)"
+            )
+        }
+
+        let pubkeyBytes: Data
+        if let dataPtr = entry.data_ptr {
+            pubkeyBytes = Data(bytes: dataPtr, count: Int(entry.data_len))
+        } else if entry.data_len == 0 {
+            pubkeyBytes = Data()
+        } else {
+            throw PlatformWalletError.deserialization(
+                "IdentityUpdateTransition public key \(index) had a null data pointer for \(entry.data_len) bytes"
+            )
+        }
+
+        let contractBounds = try parsedContractBounds(from: entry, index: index)
+
+        return IdentityPubkey(
+            keyId: entry.key_id,
+            keyType: keyType,
+            purpose: purpose,
+            securityLevel: securityLevel,
+            pubkeyBytes: pubkeyBytes,
+            readOnly: entry.read_only,
+            contractBounds: contractBounds
+        )
+    }
+
+    private static func parsedContractBounds(
+        from entry: ParsedIdentityUpdatePublicKeyFFI,
+        index: Int
+    ) throws -> ContractBounds? {
+        switch entry.contract_bounds_kind {
+        case 0:
+            return nil
+        case 1:
+            var idTuple = entry.contract_bounds_id
+            return .singleContract(
+                id: Swift.withUnsafeBytes(of: &idTuple) { Data($0) }
+            )
+        case 2:
+            guard let documentTypePtr = entry.contract_bounds_document_type,
+                  let documentTypeName = String(validatingCString: documentTypePtr) else {
+                throw PlatformWalletError.deserialization(
+                    "IdentityUpdateTransition contract bounds at key \(index) are missing a valid UTF-8 document type"
+                )
+            }
+            var idTuple = entry.contract_bounds_id
+            return .singleContractDocumentType(
+                id: Swift.withUnsafeBytes(of: &idTuple) { Data($0) },
+                documentTypeName: documentTypeName
+            )
+        default:
+            throw PlatformWalletError.deserialization(
+                "Unknown IdentityUpdateTransition contract-bounds kind \(entry.contract_bounds_kind) at key \(index)"
+            )
+        }
+    }
+
     /// Create + broadcast a new data contract owned by
     /// `ownerIdentityId`. Returns the 32-byte contract id once
     /// Platform confirms the transition.
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
index 0f662065388..98cb682977f 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
@@ -149,6 +149,105 @@ struct PlatformWalletNativeTeardownCalls: @unchecked Sendable {
     )
 }
 
+/// Arguments of one native create-wallet call, captured on the main actor
+/// before hopping to the destroy queue. Every field is a plain value type.
+struct PlatformWalletCreateParams: Sendable {
+    let mnemonic: String
+    let network: Network
+    let accountOptions: UInt32
+    let birthHeight: UInt32?
+}
+
+/// Native entry point used by the off-main create orchestration in
+/// [`PlatformWalletManager.performCreateWallet`]. Same design as
+/// [`PlatformWalletNativeTeardownCalls`]: injecting the function (rather
+/// than the outcome) keeps the production timing, result mapping, and
+/// logging under test without calling Rust. The unchecked conformance is
+/// intentional: the closure is an immutable C-entry wrapper, and the whole
+/// value is copied onto the dedicated queue.
+///
+/// Tests with a fake manager handle must inject this table: handles come from
+/// a process-global registry, so an arbitrary non-zero test value is not
+/// guaranteed to miss a live Rust entry owned by another test.
+struct PlatformWalletNativeCreateCalls: @unchecked Sendable {
+    /// Mirrors `platform_wallet_manager_create_wallet_from_mnemonic_with_birth_height`,
+    /// folding the two out-params into the return value (the 32-byte wallet
+    /// id already copied into a `Data`).
+    typealias Call = @Sendable (Handle, PlatformWalletCreateParams)
+        -> (result: PlatformWalletFFIResult, walletHandle: Handle, walletId: Data)
+
+    let createFromMnemonic: Call
+
+    static let live = PlatformWalletNativeCreateCalls(
+        createFromMnemonic: { managerHandle, params in
+            var walletHandle: Handle = NULL_HANDLE
+            var walletId: FFIByteTuple32 =
+                (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+            let result = params.mnemonic.withCString { mnemonicPtr in
+                platform_wallet_manager_create_wallet_from_mnemonic_with_birth_height(
+                    managerHandle,
+                    mnemonicPtr,
+                    params.network.ffiValue,
+                    params.accountOptions,
+                    params.birthHeight != nil,
+                    params.birthHeight ?? 0,
+                    &walletHandle,
+                    &walletId
+                )
+            }
+            let idData = withUnsafeBytes(of: &walletId) { Data($0) }
+            return (result, walletHandle, idData)
+        }
+    )
+}
+
+/// Test seam for the native calls of the async `loadFromPersistor()`
+/// overload; same contract as [`PlatformWalletNativeCreateCalls`].
+struct PlatformWalletNativeLoadCalls: @unchecked Sendable {
+    /// Mirrors `platform_wallet_manager_load_from_persistor`.
+    typealias BulkLoad = @Sendable (Handle) -> PlatformWalletFFIResult
+    /// The SwiftData id fetch between the bulk load and the per-wallet
+    /// lookups. Part of the seam (not pure FFI) so unit tests can drive
+    /// the lookup loop without constructing a ModelContainer.
+    typealias ListRestorableIds = @Sendable (PlatformWalletPersistenceHandler?) -> [Data]
+    /// Mirrors `platform_wallet_manager_get_wallet` for one 32-byte id,
+    /// folding the out-param into the return value.
+    typealias GetWallet = @Sendable (Handle, Data)
+        -> (result: PlatformWalletFFIResult, walletHandle: Handle)
+
+    let loadFromPersistor: BulkLoad
+    let restorableWalletIds: ListRestorableIds
+    let getWallet: GetWallet
+
+    static let live = PlatformWalletNativeLoadCalls(
+        loadFromPersistor: { managerHandle in
+            platform_wallet_manager_load_from_persistor(managerHandle)
+        },
+        restorableWalletIds: { handler in
+            handler?.restorableWalletIds() ?? []
+        },
+        getWallet: { managerHandle, walletId in
+            var walletHandle: Handle = NULL_HANDLE
+            let result: PlatformWalletFFIResult = walletId.withUnsafeBytes { idPtr in
+                // C signature is `const uint8_t (*wallet_id)[32]`, imported
+                // as `UnsafePointer<FFIByteTuple32>?` — rebind the raw
+                // 32-byte buffer to that tuple shape (same dance as the
+                // sync overload).
+                guard let base = idPtr.baseAddress?.assumingMemoryBound(to: FFIByteTuple32.self) else {
+                    return PlatformWalletFFIResult(
+                        code: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_NULL_POINTER,
+                        message: nil)
+                }
+                return platform_wallet_manager_get_wallet(
+                    managerHandle,
+                    base,
+                    &walletHandle)
+            }
+            return (result, walletHandle)
+        }
+    )
+}
+
 /// The one thing SwiftUI needs for all wallet operations.
 ///
 /// Owns the Rust-side `PlatformWalletManager` handle which drives:
@@ -351,17 +450,79 @@ public class PlatformWalletManager: ObservableObject {
     /// an uncached no-op because the manager can still be configured later.
     private var shutdownTask: Task<PlatformWalletShutdownMetrics, Never>?
 
+    /// Set the moment [`shutdown()`] decides to proceed, BEFORE it drains
+    /// in-flight native ops: closes admission for EVERY native entrypoint —
+    /// the async ones (`createWallet`, `loadFromPersistor`) and their
+    /// synchronous overloads — so the drain below can terminate without a
+    /// synchronous op entering while the MainActor is reentrant at an
+    /// `await`.
+    private var shutdownRequested = false
+
+    /// Async native entrypoints (`createWallet`, `loadFromPersistor`)
+    /// between admission and the end of their MainActor epilogue.
+    /// [`shutdown()`] waits for this to reach zero before taking the
+    /// handle: an admitted op must complete its FULL transaction (FFI +
+    /// publish) or fail on its own terms — never be failed retroactively
+    /// by a concurrent teardown after the native side already persisted
+    /// data (for create, the caller would roll back its mnemonic and
+    /// orphan the persisted rows).
+    private var activeNativeOpCount = 0
+    private var nativeOpDrainContinuations: [CheckedContinuation<Void, Never>] = []
+
+    /// Admission + bookkeeping shared by the async native entrypoints:
+    /// rejects while a shutdown drain runs, otherwise counts the op in.
+    /// MainActor-atomic (no suspension between check and increment), so the
+    /// drain can never miss an admitted op. Balance with
+    /// [`finishNativeOp()`] on every exit path.
+    private func admitNativeOp(_ name: String) throws {
+        guard !shutdownRequested else {
+            throw PlatformWalletError.invalidHandle(
+                "manager shutdown is in progress; \(name) rejected")
+        }
+        activeNativeOpCount += 1
+    }
+
+    private func finishNativeOp() {
+        activeNativeOpCount -= 1
+        if activeNativeOpCount == 0, !nativeOpDrainContinuations.isEmpty {
+            let waiters = nativeOpDrainContinuations
+            nativeOpDrainContinuations.removeAll()
+            waiters.forEach { $0.resume() }
+        }
+    }
+
     /// Test seam for the individual native calls. Production keeps `.live`;
     /// tests replace the function table while still running the production
     /// teardown orchestration end-to-end.
     internal var nativeTeardownCalls = PlatformWalletNativeTeardownCalls.live
 
-    /// Dedicated serial queue for the blocking native teardown. The Rust
-    /// `destroy` runs `block_on(shutdown())` on the calling thread and can
-    /// legitimately take tens of seconds when an in-flight sync pass ignores
-    /// cancellation, so it must park a plain GCD thread — never the main
-    /// thread, and never a Swift Concurrency cooperative-pool thread (which
-    /// is why this is a DispatchQueue and not `Task.detached`).
+    /// Test seam for the native create call used by the async
+    /// `createWallet(mnemonic:)` overload; same contract as
+    /// [`nativeTeardownCalls`].
+    internal var nativeCreateCalls = PlatformWalletNativeCreateCalls.live
+
+    /// Test seam for the native calls of the async `loadFromPersistor()`
+    /// overload; same contract as [`nativeTeardownCalls`].
+    internal var nativeLoadCalls = PlatformWalletNativeLoadCalls.live
+
+    /// Dedicated serial queue for the blocking native teardown AND the
+    /// blocking native create (async `createWallet(mnemonic:)` overload).
+    /// Both park the calling thread — the Rust `destroy` runs
+    /// `block_on(shutdown())` and can legitimately take tens of seconds when
+    /// an in-flight sync pass ignores cancellation; create derives hundreds
+    /// of keys and flushes persistence synchronously — so they must park a
+    /// plain GCD thread: never the main thread, and never a Swift
+    /// Concurrency cooperative-pool thread (which is why this is a
+    /// DispatchQueue and not `Task.detached`).
+    ///
+    /// Sharing ONE queue is deliberate: memory safety already comes from the
+    /// Rust-side registry (the create call holds a read guard for its whole
+    /// duration; destroy's map removal takes the write lock), so the queue's
+    /// job is deterministic FIFO — a teardown enqueued after an admitted
+    /// create runs after it, never concurrently with it. Accepted trade-off:
+    /// the queue is process-wide, so a create on one manager can queue
+    /// behind another manager's slow destroy (rare — hosts await `shutdown()`
+    /// between lifecycle operations).
     nonisolated static let destroyQueue = DispatchQueue(
         label: "org.dash.platform-wallet.destroy",
         qos: .userInitiated
@@ -437,17 +598,33 @@ public class PlatformWalletManager: ObservableObject {
     /// for the host to log.
     @discardableResult
     public func shutdown() async -> PlatformWalletShutdownMetrics {
-        if let task = shutdownTask {
-            return await task.value
-        }
-        guard handle != NULL_HANDLE else {
-            // Never configured (or a test double without a handle): nothing
-            // to tear down. Do not cache this no-op: a manager may still be
-            // configured later, and that live handle must then be torn down.
-            return PlatformWalletShutdownMetrics(
-                steps: [],
-                totalMilliseconds: 0,
-                ranOffMainThread: false)
+        // Drain loop: close admission for new async creates, then wait for
+        // every already-admitted create to finish its FULL transaction
+        // (native create + MainActor epilogue). Draining before take-once
+        // means a create whose FFI already persisted wallet data can never
+        // be failed retroactively by this teardown — the caller would roll
+        // back its mnemonic and orphan the persisted rows. Each await can
+        // interleave with other MainActor work, so every idempotency /
+        // no-op condition is re-checked after resuming.
+        while true {
+            if let task = shutdownTask {
+                return await task.value
+            }
+            guard handle != NULL_HANDLE else {
+                // Never configured (or a test double without a handle):
+                // nothing to tear down. Do not cache this no-op: a manager
+                // may still be configured later, and that live handle must
+                // then be torn down.
+                return PlatformWalletShutdownMetrics(
+                    steps: [],
+                    totalMilliseconds: 0,
+                    ranOffMainThread: false)
+            }
+            shutdownRequested = true
+            if activeNativeOpCount == 0 { break }
+            await withCheckedContinuation { continuation in
+                nativeOpDrainContinuations.append(continuation)
+            }
         }
 
         // Take-once: from this point every FFI entry gated on
@@ -703,6 +880,36 @@ public class PlatformWalletManager: ObservableObject {
 
     // MARK: - Wallet creation
 
+    /// Admission gate for the SYNCHRONOUS native entrypoints (`createWallet`,
+    /// `createWalletFromSeed`, `loadFromPersistor`, `deleteWallet`). Rejects:
+    ///
+    /// - once shutdown has closed admission — including the drain window,
+    ///   where the manager's handle is intentionally still live for an
+    ///   already-admitted async op while the MainActor is reentrant at the
+    ///   drain's `await`;
+    /// - while an async native op is in flight: the synchronous overloads
+    ///   run their FFI on the calling thread, so admitting one would run a
+    ///   second native op CONCURRENTLY with the admitted op on the destroy
+    ///   queue. For load that is a real race — Rust's loader inserts into
+    ///   `wallet_manager` and `self.wallets` in two steps, and a parallel
+    ///   loader that sees the first insert skips the wallet before the
+    ///   second lands (load.rs treats "already present" as "fully
+    ///   hydrated", which only holds for sequential loaders).
+    ///
+    /// Async entrypoints use [`admitNativeOp`] instead (they serialize on
+    /// the destroy queue, so async-with-async is safe).
+    private func ensureSyncNativeOpAllowed(_ name: String) throws {
+        try ensureConfigured()
+        guard !shutdownRequested else {
+            throw PlatformWalletError.invalidHandle(
+                "manager shutdown is in progress; \(name) rejected")
+        }
+        guard activeNativeOpCount == 0 else {
+            throw PlatformWalletError.invalidHandle(
+                "an async native operation is in flight; synchronous \(name) rejected")
+        }
+    }
+
     /// Create a wallet from a BIP39 mnemonic phrase (English).
     ///
     /// Stores the returned wallet as the active [`wallet`] published
@@ -725,7 +932,7 @@ public class PlatformWalletManager: ObservableObject {
         createDefaultAccounts: Bool = true,
         birthHeight: UInt32? = nil
     ) throws -> ManagedPlatformWallet {
-        try ensureConfigured()
+        try ensureSyncNativeOpAllowed("createWallet")
         var walletHandle: Handle = NULL_HANDLE
         var walletId: FFIByteTuple32 =
             (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
@@ -754,6 +961,107 @@ public class PlatformWalletManager: ObservableObject {
         return w
     }
 
+    /// Off-main variant of [`createWallet(mnemonic:...)`]: identical
+    /// semantics (same FFI call, `birthHeight` contract, name persistence,
+    /// and published-state update), but the blocking native create — key
+    /// derivation for every account plus a synchronous persistence flush,
+    /// seconds of work — runs on [`destroyQueue`] instead of the main
+    /// thread. In an `async` context overload resolution prefers this
+    /// variant; sync contexts keep the sync one.
+    ///
+    /// Throws `PlatformWalletError.invalidHandle` when the manager is shut
+    /// down or a shutdown is already in progress — always BEFORE any native
+    /// work: an admitted create is guaranteed to run its full transaction
+    /// (native create + publish); [`shutdown()`] drains admitted creates
+    /// before taking the handle, so a create whose FFI persisted wallet
+    /// data can never be failed retroactively by a concurrent teardown.
+    @discardableResult
+    public func createWallet(
+        mnemonic: String,
+        network: Network,
+        name: String? = nil,
+        createDefaultAccounts: Bool = true,
+        birthHeight: UInt32? = nil
+    ) async throws -> ManagedPlatformWallet {
+        // Admission is checked on the MainActor with no suspension before
+        // the count increment, so `shutdown()`'s drain can never miss an
+        // admitted create.
+        try ensureConfigured()
+        try admitNativeOp("createWallet")
+        defer { finishNativeOp() }
+
+        let h = handle
+        let params = PlatformWalletCreateParams(
+            mnemonic: mnemonic,
+            network: network,
+            accountOptions: createDefaultAccounts ? 1 : 0,
+            birthHeight: birthHeight)
+        let calls = nativeCreateCalls
+
+        // Deliberately a direct continuation, NOT the `Task {}` wrapper
+        // `shutdown()` uses (that wrapper exists only to share
+        // `shutdownTask`): the dispatch below happens synchronously at this
+        // suspension point, so an admitted create is enqueued on the shared
+        // FIFO queue before any later `shutdown()`'s teardown block —
+        // teardown can never overtake an already-admitted create. A
+        // `shutdown()` that completed BEFORE this point already failed the
+        // `ensureConfigured()` above, so nothing was enqueued.
+        let created: Result<ManagedPlatformWallet, PlatformWalletError> =
+            await withCheckedContinuation { continuation in
+                Self.destroyQueue.async {
+                    continuation.resume(
+                        returning: Self.performCreateWallet(h, params: params, calls: calls))
+                }
+            }
+        let w = try created.get()
+
+        // Defense in depth only: `shutdown()` drains admitted creates
+        // before taking the handle, so this cannot fire from the production
+        // shutdown path. It guards the invariant that the manager never
+        // publishes a wallet after its handle was torn down (dropping `w`
+        // lets its deinit release the wrapper handle — a registry no-op
+        // after manager teardown).
+        guard handle != NULL_HANDLE else {
+            assertionFailure("shutdown took the handle under an admitted create despite the drain")
+            throw PlatformWalletError.invalidHandle(
+                "manager was shut down while createWallet ran off-main")
+        }
+        if let name, !name.isEmpty {
+            persistenceHandler?.setWalletName(walletId: w.walletId, name: name)
+        }
+        self.wallets[w.walletId] = w
+        return w
+    }
+
+    /// The blocking native create body of the async
+    /// [`createWallet(mnemonic:...)`] overload: runs the injected create
+    /// call, maps the FFI result to Swift types on the queue (the raw
+    /// result's Rust-owned message string never crosses the continuation),
+    /// and logs duration + which thread it ran on — the whole point is
+    /// `offMain=true`.
+    nonisolated static func performCreateWallet(
+        _ handle: Handle,
+        params: PlatformWalletCreateParams,
+        calls: PlatformWalletNativeCreateCalls = .live
+    ) -> Result<ManagedPlatformWallet, PlatformWalletError> {
+        let offMain = !Thread.isMainThread
+        let start = CFAbsoluteTimeGetCurrent()
+        let outcome = calls.createFromMnemonic(handle, params)
+        let result = PlatformWalletResult(outcome.result)
+        let ms = Int((CFAbsoluteTimeGetCurrent() - start) * 1000)
+        guard result.isSuccess else {
+            Self.log.error(
+                "native create failed in \(ms, privacy: .public)ms offMain=\(offMain, privacy: .public) network=\(params.network.rawValue, privacy: .public): \(String(describing: result.code), privacy: .public): \(result.message ?? "<no detail from Rust>", privacy: .public)"
+            )
+            return .failure(PlatformWalletError(code: result.code, message: result.message))
+        }
+        Self.log.info(
+            "native create finished in \(ms, privacy: .public)ms offMain=\(offMain, privacy: .public) network=\(params.network.rawValue, privacy: .public)"
+        )
+        return .success(
+            ManagedPlatformWallet(handle: outcome.walletHandle, walletId: outcome.walletId))
+    }
+
     /// Create a wallet from raw 64-byte seed bytes.
     ///
     /// See `createWallet(mnemonic:...)` for the `birthHeight` semantics: `nil`
@@ -767,7 +1075,7 @@ public class PlatformWalletManager: ObservableObject {
         createDefaultAccounts: Bool = true,
         birthHeight: UInt32? = nil
     ) throws -> ManagedPlatformWallet {
-        try ensureConfigured()
+        try ensureSyncNativeOpAllowed("createWalletFromSeed")
         guard seed.count == 64 else {
             throw PlatformWalletError.invalidParameter(
                 "seed must be 64 bytes, got \(seed.count)"
@@ -829,7 +1137,11 @@ public class PlatformWalletManager: ObservableObject {
     /// `createWallet` flow.
     @discardableResult
     public func loadFromPersistor() throws -> [ManagedPlatformWallet] {
-        try ensureConfigured()
+        // Same synchronous-admission gate as the sync creates: rejected
+        // during the shutdown drain AND while an async native op is in
+        // flight — a second Rust loader running concurrently with the one
+        // on the destroy queue races load.rs's two-step hydration.
+        try ensureSyncNativeOpAllowed("loadFromPersistor")
 
         try platform_wallet_manager_load_from_persistor(handle).check()
 
@@ -872,46 +1184,9 @@ public class PlatformWalletManager: ObservableObject {
                 self.wallets[walletId] = managedWallet
 
                 // Seedless unlock of the just-restored external-signable
-                // (watch-only) wallet: verify the Keychain-resolved seed binds
-                // to this wallet and drain any deferred contact-crypto.
-                // Best-effort, per wallet: a wallet with no stored mnemonic
-                // (genuine watch-only) stays watch-only, and any unlock error
-                // (e.g. a mis-mapped Keychain slot) is logged-and-continued so
-                // one wallet can't fail the whole restore.
-                do {
-                    let unlocked = try unlockWalletFromKeychain(managedWallet)
-                    // NSLog (not print) so the unlock outcome is observable
-                    // off-Xcode — it pairs with the resolver audit line in
-                    // MnemonicResolver.resolve for "what touched the seed".
-                    NSLog(
-                        "🔓 wallet unlock %@: %@",
-                        String(walletId.toHexString().prefix(8)),
-                        unlocked ? "seed verified" : "no mnemonic — stays watch-only"
-                    )
-                } catch let error as PlatformWalletError {
-                    // Distinguish a wrong-seed binding (Rust `SeedMismatch` →
-                    // `ErrorInvalidParameter` → `.invalidParameter`) from a
-                    // transient failure. The verify FFI is the only `.check()` on
-                    // this path and `walletId` is already 32 bytes here, so
-                    // `.invalidParameter` ≡ the seed-binding rejection — a
-                    // security-relevant Keychain slot mis-mapping, not a hiccup.
-                    // Either way the wallet stays external-signable (cannot sign),
-                    // so no wrong-seed signing can occur.
-                    if case .invalidParameter = error {
-                        print(
-                            "🚫 wallet unlock REJECTED \(walletId.toHexString().prefix(8)): "
-                                + "seed does not bind (mis-mapped Keychain slot?) — stays watch-only"
-                        )
-                    } else {
-                        // Transient (resolver/Keychain unavailable, …) — not
-                        // retried this pass; a later signer-present action re-tries.
-                        print("⚠️ wallet unlock failed \(walletId.toHexString().prefix(8)) (transient): \(error)")
-                    }
-                    self.lastError = error
-                } catch {
-                    print("❌ wallet unlock failed \(walletId.toHexString().prefix(8)): \(error)")
-                    self.lastError = error
-                }
+                // (watch-only) wallet — shared with the async overload's
+                // epilogue; see `unlockRestoredWalletLoggingOutcome`.
+                unlockRestoredWalletLoggingOutcome(managedWallet)
             } catch {
                 // Log and skip — one wallet failing doesn't fail the
                 // whole restore. Usually means wallet_id / xpub
@@ -936,6 +1211,219 @@ public class PlatformWalletManager: ObservableObject {
         return restored
     }
 
+    /// What the off-main half of the async [`loadFromPersistor()`] hands
+    /// back to the MainActor epilogue: one entry per restorable wallet id,
+    /// in the persistence handler's id order — either the raw wallet handle
+    /// (the owning `ManagedPlatformWallet` wrapper is built on the
+    /// MainActor) or the copied lookup error. Keeping the ORDERED sequence
+    /// lets the epilogue replay publication, unlock and `lastError`
+    /// assignment in exactly the sync overload's per-wallet interleaving.
+    private struct OffMainLoadOutcome: @unchecked Sendable {
+        enum Lookup {
+            case restored(walletId: Data, walletHandle: Handle)
+            case skipped(PlatformWalletError)
+        }
+
+        let bulkResult: Result<Void, PlatformWalletError>
+        let lookups: [Lookup]
+    }
+
+    /// The blocking body of the async [`loadFromPersistor()`] overload:
+    /// bulk restore FFI (fires the persistence callbacks synchronously on
+    /// this queue — the handler is thread-safe by design, the same
+    /// callbacks fire from Rust sync threads in steady state), the
+    /// SwiftData id fetch (the handler serializes on its own queue and
+    /// background context), and the per-wallet handle lookups. Maps FFI
+    /// results on the queue so no Rust-owned message string crosses the
+    /// continuation. Mirrors `performCreateWallet`'s timing log.
+    private nonisolated static func performLoadFromPersistor(
+        _ handle: Handle,
+        handler: PlatformWalletPersistenceHandler?,
+        calls: PlatformWalletNativeLoadCalls
+    ) -> OffMainLoadOutcome {
+        let started = CFAbsoluteTimeGetCurrent()
+        let offMain = !Thread.isMainThread
+
+        let bulk = PlatformWalletResult(calls.loadFromPersistor(handle))
+        guard bulk.isSuccess else {
+            let ms = Int((CFAbsoluteTimeGetCurrent() - started) * 1000)
+            Self.log.error(
+                "native load failed in \(ms, privacy: .public)ms offMain=\(offMain, privacy: .public): \(String(describing: bulk.code), privacy: .public): \(bulk.message ?? "<no detail from Rust>", privacy: .public)"
+            )
+            return OffMainLoadOutcome(
+                bulkResult: .failure(PlatformWalletError(code: bulk.code, message: bulk.message)),
+                lookups: [])
+        }
+
+        var lookups: [OffMainLoadOutcome.Lookup] = []
+        let walletIds = calls.restorableWalletIds(handler)
+        lookups.reserveCapacity(walletIds.count)
+        for walletId in walletIds where walletId.count == 32 {
+            let lookup = calls.getWallet(handle, walletId)
+            let lookupResult = PlatformWalletResult(lookup.result)
+            guard lookupResult.isSuccess else {
+                // Log-and-skip parity with the sync overload: one wallet
+                // failing (usually SwiftData drift vs. Rust recompute)
+                // doesn't fail the whole restore. Recorded IN SEQUENCE so
+                // the epilogue's `lastError` replay matches the sync
+                // overload's per-wallet ordering.
+                lookups.append(.skipped(PlatformWalletError(
+                    code: lookupResult.code,
+                    message: lookupResult.message)))
+                continue
+            }
+            lookups.append(.restored(walletId: walletId, walletHandle: lookup.walletHandle))
+        }
+
+        let restoredCount = lookups.reduce(into: 0) { count, entry in
+            if case .restored = entry { count += 1 }
+        }
+        let ms = Int((CFAbsoluteTimeGetCurrent() - started) * 1000)
+        Self.log.info(
+            "native load finished in \(ms, privacy: .public)ms offMain=\(offMain, privacy: .public) wallets=\(restoredCount, privacy: .public)"
+        )
+        return OffMainLoadOutcome(bulkResult: .success(()), lookups: lookups)
+    }
+
+    /// Off-main variant of [`loadFromPersistor()`]: identical semantics
+    /// (bulk restore, per-wallet handle lookup, publish, best-effort
+    /// keychain unlock, asset-lock catch-up), but the blocking native work
+    /// — the bulk restore's persister reads and Rust wallet
+    /// reconstruction plus the per-wallet lookups, measured at roughly
+    /// 400ms per persisted wallet — runs on [`destroyQueue`] instead of
+    /// the main thread. In an `async` context overload resolution prefers
+    /// this variant; sync contexts keep the sync one.
+    ///
+    /// The per-wallet keychain unlock stays in the MainActor epilogue
+    /// (it is actor-isolated and marker-cached) and is timed separately —
+    /// its measured share decides whether it ever moves too.
+    ///
+    /// Participates in [`shutdown()`]'s admission/drain exactly like the
+    /// async `createWallet`: rejected up front while a shutdown drains,
+    /// and once admitted the teardown waits for the full transaction.
+    @discardableResult
+    public func loadFromPersistor() async throws -> [ManagedPlatformWallet] {
+        try ensureConfigured()
+        try admitNativeOp("loadFromPersistor")
+        defer { finishNativeOp() }
+
+        let h = handle
+        let handler = persistenceHandler
+        let calls = nativeLoadCalls
+
+        // Direct continuation for the same FIFO reason as the async
+        // create: an admitted load is enqueued on the shared queue before
+        // any later shutdown's teardown block.
+        let outcome: OffMainLoadOutcome = await withCheckedContinuation { continuation in
+            Self.destroyQueue.async {
+                continuation.resume(
+                    returning: Self.performLoadFromPersistor(h, handler: handler, calls: calls))
+            }
+        }
+        try outcome.bulkResult.get()
+
+        // Own every returned wallet handle IMMEDIATELY, before anything can
+        // throw: if the defensive guard below fires, dropping the wrappers
+        // releases the Rust-side aliases through their deinit instead of
+        // leaking raw handles in the global registry. Nothing is published
+        // until the guard has passed. The sequence order is preserved.
+        enum OwnedLookup {
+            case wallet(ManagedPlatformWallet)
+            case skipped(PlatformWalletError)
+        }
+        let owned: [OwnedLookup] = outcome.lookups.map { entry in
+            switch entry {
+            case .restored(let walletId, let walletHandle):
+                return .wallet(ManagedPlatformWallet(handle: walletHandle, walletId: walletId))
+            case .skipped(let error):
+                return .skipped(error)
+            }
+        }
+
+        // Defense in depth only — the shutdown drain waits for this op, so
+        // the handle cannot have been torn down (see the async create's
+        // matching guard).
+        guard handle != NULL_HANDLE else {
+            assertionFailure("shutdown took the handle under an admitted load despite the drain")
+            throw PlatformWalletError.invalidHandle(
+                "manager was shut down while loadFromPersistor ran off-main")
+        }
+
+        // Replay in sequence, exactly like the sync overload's per-wallet
+        // loop: a skipped lookup assigns its error to `lastError` in place,
+        // a restored wallet is published and then unlocked before the next
+        // entry — so `lastError` ends up reflecting the SAME (latest-in-
+        // order) failure either overload would leave behind. The unlock
+        // share is accumulated separately: it is the remaining MainActor
+        // cost of the load and the data for deciding whether it ever moves
+        // off-main.
+        var restored: [ManagedPlatformWallet] = []
+        var unlockSeconds: TimeInterval = 0
+        for entry in owned {
+            switch entry {
+            case .skipped(let error):
+                self.lastError = error
+            case .wallet(let managedWallet):
+                restored.append(managedWallet)
+                self.wallets[managedWallet.walletId] = managedWallet
+                let unlockStarted = CFAbsoluteTimeGetCurrent()
+                unlockRestoredWalletLoggingOutcome(managedWallet)
+                unlockSeconds += CFAbsoluteTimeGetCurrent() - unlockStarted
+            }
+        }
+        let unlockMs = Int(unlockSeconds * 1000)
+        Self.log.info(
+            "load unlock loop finished in \(unlockMs, privacy: .public)ms wallets=\(restored.count, privacy: .public)"
+        )
+
+        catchUpStuckAssetLocks(wallets: restored)
+        return restored
+    }
+
+    /// The per-wallet unlock body shared by both `loadFromPersistor`
+    /// overloads: verify the Keychain-resolved seed binds to the restored
+    /// wallet and drain any deferred contact-crypto. Best-effort, per
+    /// wallet — a wallet with no stored mnemonic (genuine watch-only)
+    /// stays watch-only, and any unlock error is logged-and-continued
+    /// (feeding `lastError`) so one wallet can't fail the whole restore.
+    private func unlockRestoredWalletLoggingOutcome(_ managedWallet: ManagedPlatformWallet) {
+        let walletId = managedWallet.walletId
+        do {
+            let unlocked = try unlockWalletFromKeychain(managedWallet)
+            // NSLog (not print) so the unlock outcome is observable
+            // off-Xcode — it pairs with the resolver audit line in
+            // MnemonicResolver.resolve for "what touched the seed".
+            NSLog(
+                "🔓 wallet unlock %@: %@",
+                String(walletId.toHexString().prefix(8)),
+                unlocked ? "seed verified" : "no mnemonic — stays watch-only"
+            )
+        } catch let error as PlatformWalletError {
+            // Distinguish a wrong-seed binding (Rust `SeedMismatch` →
+            // `ErrorInvalidParameter` → `.invalidParameter`) from a
+            // transient failure. The verify FFI is the only `.check()` on
+            // this path and `walletId` is already 32 bytes here, so
+            // `.invalidParameter` ≡ the seed-binding rejection — a
+            // security-relevant Keychain slot mis-mapping, not a hiccup.
+            // Either way the wallet stays external-signable (cannot sign),
+            // so no wrong-seed signing can occur.
+            if case .invalidParameter = error {
+                print(
+                    "🚫 wallet unlock REJECTED \(walletId.toHexString().prefix(8)): "
+                        + "seed does not bind (mis-mapped Keychain slot?) — stays watch-only"
+                )
+            } else {
+                // Transient (resolver/Keychain unavailable, …) — not
+                // retried this pass; a later signer-present action re-tries.
+                print("⚠️ wallet unlock failed \(walletId.toHexString().prefix(8)) (transient): \(error)")
+            }
+            self.lastError = error
+        } catch {
+            print("❌ wallet unlock failed \(walletId.toHexString().prefix(8)): \(error)")
+            self.lastError = error
+        }
+    }
+
     // MARK: - Keychain seed unlock
 
     /// Seedless unlock of a restored external-signable wallet.
@@ -1440,7 +1928,12 @@ public class PlatformWalletManager: ObservableObject {
     /// Deleting an already-removed wallet succeeds unless an
     /// operation fails.
     public func deleteWallet(walletId: Data) throws {
-        try ensureConfigured()
+        // Same synchronous-admission gate as the sync creates and load: a
+        // deletion interleaved with an in-flight async restore could remove
+        // the native registration between the restore's snapshot read and
+        // its publication (or wipe SwiftData/Keychain that the loader then
+        // re-inserts), violating this method's full-wipe semantics.
+        try ensureSyncNativeOpAllowed("deleteWallet")
         guard walletId.count == 32 else {
             throw PlatformWalletError.invalidParameter(
                 "walletId must be 32 bytes, got \(walletId.count)"
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerMasternodes.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerMasternodes.swift
index 1902c28b56f..0a8c08f4a15 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerMasternodes.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerMasternodes.swift
@@ -123,12 +123,12 @@ extension PlatformWalletManager {
             return []
         }
 
-        var outEntries: UnsafePointer<MasternodeEntryFFI>?
+        var outEntries: UnsafePointer<MasternodeEntryV2FFI>?
         var outCount: UInt = 0
 
         let ffiResult = walletId.withUnsafeBytes { (raw: UnsafeRawBufferPointer) -> PlatformWalletFFIResult in
             let base = raw.baseAddress?.assumingMemoryBound(to: UInt8.self)
-            return platform_wallet_manager_list_masternodes(
+            return platform_wallet_manager_list_masternodes_v2(
                 handle,
                 base,
                 &outEntries,
@@ -147,7 +147,7 @@ extension PlatformWalletManager {
         }
 
         defer {
-            platform_wallet_manager_free_masternodes(
+            platform_wallet_manager_free_masternodes_v2(
                 UnsafeMutablePointer(mutating: entries),
                 outCount
             )
@@ -156,16 +156,17 @@ extension PlatformWalletManager {
         return Self.masternodeModels(from: entries, count: Int(outCount))
     }
 
-    /// Decode a Rust-owned `MasternodeEntryFFI` array into value models —
+    /// Decode a Rust-owned `MasternodeEntryV2FFI` array into value models —
     /// shared by the wallet list, the tracked list, and the tracked
     /// track/refresh calls. `nonisolated` so detached marshalling tasks can
     /// run it off the main actor.
     nonisolated static func masternodeModels(
-        from entries: UnsafePointer<MasternodeEntryFFI>,
+        from entries: UnsafePointer<MasternodeEntryV2FFI>,
         count: Int
     ) -> [PlatformMasternode] {
         (0..<count).map { i in
-            var entry = entries[i]
+            let entryV2 = entries[i]
+            var entry = entryV2.v1
             let proTx = withUnsafeBytes(of: &entry.pro_tx_hash) { Data($0) }
             let collateralTxid = entry.has_collateral
                 ? withUnsafeBytes(of: &entry.collateral_txid) { Data($0) }
@@ -211,8 +212,8 @@ extension PlatformWalletManager {
                 platformAccountType: entry.platform_account_type,
                 platformKeyIndex: entry.platform_key_index,
                 platformOwnershipChecked: entry.platform_ownership_checked,
-                source: MasternodeSource(rawValue: entry.source) ?? .wallet,
-                label: entry.label.map { String(cString: $0) }
+                source: MasternodeSource(rawValue: entryV2.source) ?? .wallet,
+                label: entryV2.label.map { String(cString: $0) }
             )
         }
     }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerTrackedMasternodes.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerTrackedMasternodes.swift
index d17d8c460b0..4f6795d5f55 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerTrackedMasternodes.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerTrackedMasternodes.swift
@@ -109,7 +109,7 @@ extension PlatformWalletManager {
     /// render both with one code path.
     public func trackedMasternodes() -> [PlatformMasternode] {
         guard isConfigured, handle != NULL_HANDLE else { return [] }
-        var outEntries: UnsafePointer<MasternodeEntryFFI>?
+        var outEntries: UnsafePointer<MasternodeEntryV2FFI>?
         var outCount: UInt = 0
         let ffiResult = platform_wallet_manager_list_tracked_masternodes(
             handle, &outEntries, &outCount)
@@ -120,7 +120,7 @@ extension PlatformWalletManager {
         }
         guard let entries = outEntries, outCount > 0 else { return [] }
         defer {
-            platform_wallet_manager_free_masternodes(
+            platform_wallet_manager_free_masternodes_v2(
                 UnsafeMutablePointer(mutating: entries), outCount)
         }
         return Self.masternodeModels(from: entries, count: Int(outCount))
@@ -140,7 +140,7 @@ extension PlatformWalletManager {
         }
         let handle = self.handle
         return try await Task.detached(priority: .userInitiated) { () -> PlatformMasternode in
-            var outEntries: UnsafePointer<MasternodeEntryFFI>?
+            var outEntries: UnsafePointer<MasternodeEntryV2FFI>?
             var outCount: UInt = 0
             let ffiResult = proTxHash.withUnsafeBytes { (raw: UnsafeRawBufferPointer) -> PlatformWalletFFIResult in
                 platform_wallet_manager_refresh_tracked_masternode(
@@ -157,7 +157,7 @@ extension PlatformWalletManager {
                 throw PlatformWalletError.notFound("refresh returned no record")
             }
             defer {
-                platform_wallet_manager_free_masternodes(
+                platform_wallet_manager_free_masternodes_v2(
                     UnsafeMutablePointer(mutating: entries), outCount)
             }
             guard let record = Self.masternodeModels(from: entries, count: Int(outCount)).first
@@ -224,7 +224,7 @@ extension PlatformWalletManager {
         _ call: (
             Handle,
             UnsafePointer<UInt8>?,
-            UnsafeMutablePointer<UnsafePointer<MasternodeEntryFFI>?>,
+            UnsafeMutablePointer<UnsafePointer<MasternodeEntryV2FFI>?>,
             UnsafeMutablePointer<UInt>
         ) -> PlatformWalletFFIResult
     ) throws -> PlatformMasternode {
@@ -232,7 +232,7 @@ extension PlatformWalletManager {
             throw PlatformWalletError.invalidParameter(
                 "Manager not configured, or proTxHash not 32 bytes")
         }
-        var outEntries: UnsafePointer<MasternodeEntryFFI>?
+        var outEntries: UnsafePointer<MasternodeEntryV2FFI>?
         var outCount: UInt = 0
         let ffiResult = proTxHash.withUnsafeBytes { (raw: UnsafeRawBufferPointer) -> PlatformWalletFFIResult in
             call(
@@ -249,7 +249,7 @@ extension PlatformWalletManager {
             throw PlatformWalletError.notFound("no record returned")
         }
         defer {
-            platform_wallet_manager_free_masternodes(
+            platform_wallet_manager_free_masternodes_v2(
                 UnsafeMutablePointer(mutating: entries), outCount)
         }
         guard let record = Self.masternodeModels(from: entries, count: Int(outCount)).first else {
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
index 2ea1c8520ad..cadffca051e 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
@@ -94,6 +94,13 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
     /// `markUtxoSpent`, …) assume they are already on the queue.
     private let backgroundContext: ModelContext
 
+    /// Context dedicated to tracked-masternode whole-set writes. Those writes
+    /// are not part of a wallet changeset and must become durable before their
+    /// synchronous FFI callback reports success. Keeping them off
+    /// `backgroundContext` prevents an unrelated changeset rollback from
+    /// discarding a successful track/untrack/rename operation.
+    private let trackedMasternodeContext: ModelContext
+
     /// Serial queue that owns `backgroundContext` and any other
     /// non-Sendable handler state (`loadAllocations`). All public
     /// entry points — both the FFI callback shims and the
@@ -144,6 +151,8 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
         self.network = network
         self.backgroundContext = ModelContext(modelContainer)
         self.backgroundContext.autosaveEnabled = true
+        self.trackedMasternodeContext = ModelContext(modelContainer)
+        self.trackedMasternodeContext.autosaveEnabled = false
     }
 
     /// Synchronously run `body` on `serialQueue`.
@@ -6111,16 +6120,14 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
     /// Replace the stored tracked-masternode set for `networkRaw` with
     /// `rows` (whole-set semantics, mirroring the Rust trait contract).
     ///
-    /// Registry writes arrive OUTSIDE Rust `store()` rounds, so this
-    /// method saves immediately — unless a changeset round is open on the
-    /// shared context, in which case the round's `endChangeset` commits
-    /// (or rolls back) these rows together with the round. A rolled-back
-    /// registry write is re-issued by the next registry mutation (the
-    /// Rust side always writes the whole set).
+    /// Registry writes arrive OUTSIDE Rust `store()` rounds and use their own
+    /// context, so this method always saves before returning success. An
+    /// unrelated wallet changeset can therefore neither absorb nor roll back
+    /// a tracked-node mutation.
     func persistTrackedMasternodes(networkRaw: UInt32, rows: [TrackedMasternodeRow]) -> Bool {
         onQueue {
             do {
-                let existing = try backgroundContext.fetch(
+                let existing = try trackedMasternodeContext.fetch(
                     FetchDescriptor<PersistentTrackedMasternode>(
                         predicate: #Predicate { $0.networkRaw == networkRaw }
                     )
@@ -6135,7 +6142,7 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
                         found.addedAt = row.addedAt
                         found.snapshotJSON = row.snapshotJSON
                     } else {
-                        backgroundContext.insert(PersistentTrackedMasternode(
+                        trackedMasternodeContext.insert(PersistentTrackedMasternode(
                             networkRaw: networkRaw,
                             proTxHash: row.proTxHash,
                             label: row.label,
@@ -6145,14 +6152,17 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
                     }
                 }
                 for removed in stale.values {
-                    backgroundContext.delete(removed)
-                }
-                if !inChangeset {
-                    try backgroundContext.save()
+                    trackedMasternodeContext.delete(removed)
                 }
+                try trackedMasternodeContext.save()
                 return true
             } catch {
                 print("⚠️ persistTrackedMasternodes: \(error)")
+                // A failed save leaves pending inserts/deletes registered on
+                // the context. Discard them before returning failure so a
+                // later load or successful mutation cannot expose/commit a
+                // registry state Rust has already rolled back.
+                trackedMasternodeContext.rollback()
                 return false
             }
         }
@@ -6173,7 +6183,7 @@ public final class PlatformWalletPersistenceHandler: @unchecked Sendable {
                 descriptor.sortBy = [
                     SortDescriptor(\.addedAt, order: .forward)
                 ]
-                rows = try backgroundContext.fetch(descriptor)
+                rows = try trackedMasternodeContext.fetch(descriptor)
             } catch {
                 print("⚠️ loadTrackedMasternodes: \(error)")
                 return (nil, 0, true)
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift
index fb99dd35728..688eb1519e1 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift
@@ -89,6 +89,34 @@ public enum PlatformWalletResultCode: Int32, Sendable {
     /// (Not returned by `destroy`: Rust owns the callback contexts, so a
     /// straggling worker is memory-safe and merely logged there.)
     case errorShutdownIncomplete = 27
+    /// Asset-lock coin selection came up short over the *permitted* funding
+    /// set (dashpay/platform#4073). Nothing was built or broadcast and no
+    /// funding output was consumed, so the caller may refresh its preflight
+    /// and retry.
+    ///
+    /// **Recovery depends on the funding form** — both reach this one code,
+    /// and only one of them can be retried at a smaller amount:
+    /// - *exact-amount* funding carries a caller-chosen amount, so the fix is
+    ///   to re-run preflight and confirm a smaller one;
+    /// - a whole-account *drain* accepts no amount argument at all, so there
+    ///   is nothing to lower. Its shortfall means the account's drainable
+    ///   balance is under the required minimum lock floor: add funds to that
+    ///   account, or lower the floor.
+    ///
+    /// Do not present "try a smaller amount" to the user on the drain path.
+    ///
+    /// The structured `available` / `required` duff amounts travel in the
+    /// message string — `PlatformWalletFFIResult` is ABI-frozen at code +
+    /// message, so there are no out-params for them.
+    ///
+    /// Distinct from `errorCoreInsufficientFunds` (22), which is the atomic
+    /// Core-send selector rather than the asset-lock builder. What the figures
+    /// cover depends on the funding form: an exact-amount build pools the
+    /// default source list (BIP44 + BIP32 + every DashPay contact-receiving
+    /// account) and its shortfall describes that whole permitted union, while
+    /// a whole-account *drain* build names exactly one account. CoinJoin funds
+    /// only through the drain form.
+    case errorAssetLockInsufficientFunds = 29
     /// A state transition could not be signed because the signer has no
     /// usable private key for the requested public key — restored from the
     /// structured signer completion code (dashpay/platform#4060 finding 7).
@@ -99,13 +127,16 @@ public enum PlatformWalletResultCode: Int32, Sendable {
     /// wallet does not own — or owns only watch-only, a DashPay *external*
     /// account holding a contact's addresses.
     case errorSigningKeyUnavailable = 31
-    // Codes 27-33 are claimed outside this PR and must not be reused here:
-    // 27 errorShutdownIncomplete (dashpay/platform#4268, merged), 29
-    // errorAssetLockInsufficientFunds (#4184), 31 errorSigningKeyUnavailable
-    // (#4183/#4259), 32 errorTransactionBuild (#4247/#4256), 33
-    // errorTransactionSigning (#4256); 28 and 30 are free. The deferred-token
-    // trio therefore occupies the contiguous block 34-36. These raw values
-    // MUST match `PlatformWalletFFIResultCode` in
+    // Codes 27-33 are claimed outside this PR — except 29, mirrored above —
+    // and must not be reused here: 27 errorShutdownIncomplete
+    // (dashpay/platform#4268, merged), 29 errorAssetLockInsufficientFunds
+    // (claimed by #4184, which was closed unmerged along with its successor
+    // #4316; this PR salvages the code at its reserved number, so the mirror
+    // above matches the Rust discriminant rather than trailing it), 31
+    // errorSigningKeyUnavailable (#4183/#4259), 32 errorTransactionBuild
+    // (#4247/#4256), 33 errorTransactionSigning (#4256); 28 and 30 are free.
+    // The deferred-token trio therefore occupies the contiguous block 34-36.
+    // These raw values MUST match `PlatformWalletFFIResultCode` in
     // packages/rs-platform-wallet-ffi/src/error.rs — there is no compile-time
     // check across the ABI. See ERROR_CODE_REGISTRY.md (#4261).
     /// A deferred (BIP70/BIP270) reservation token has outlived its funding
@@ -154,12 +185,12 @@ public enum PlatformWalletResultCode: Int32, Sendable {
     /// amount plus input 0's retained fee reserve. Refresh the shield
     /// preflight and ask the user to confirm the new capacity.
     case errorShieldedInsufficientBalance = 41
-    // Persister failure classes (42-43) — a fresh contiguous block above
-    // every prior claim, for the same reason the 34-36 trio moved there.
+    // Persister failure classes (48-49) — claimed from the error-code
+    // registry's allocation frontier; these raw values are hand-mirrored ABI.
     /// A persister operation failed transiently; callers may retry.
-    case errorPersisterTransient = 42
+    case errorPersisterTransient = 48
     /// A persister operation failed permanently; callers must not retry.
-    case errorPersisterFatal = 43
+    case errorPersisterFatal = 49
     /// The named thing does not exist. Besides the handle/lookup failures this
     /// has always covered, BOTH deferred-send paths report the
     /// wallet-was-REMOVED case here.
@@ -239,6 +270,8 @@ public enum PlatformWalletResultCode: Int32, Sendable {
             self = .errorAssetLockAlreadyConsumed
         case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_ASSET_LOCK_FUNDING_MISMATCH:
             self = .errorAssetLockFundingMismatch
+        case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_ASSET_LOCK_INSUFFICIENT_FUNDS:
+            self = .errorAssetLockInsufficientFunds
         case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_PERSISTER_TRANSIENT:
             self = .errorPersisterTransient
         case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_PERSISTER_FATAL:
@@ -349,6 +382,15 @@ public enum PlatformWalletError: LocalizedError {
     /// prove that the requested operation completed.
     case assetLockAlreadyConsumed(String)
     case assetLockFundingMismatch(String)
+    /// Asset-lock coin selection could not cover the requested funding over
+    /// the permitted source set. Nothing was built or broadcast and no
+    /// funding output was consumed — refresh the preflight, then recover by
+    /// the funding form: an exact-amount build can confirm a smaller amount,
+    /// while a whole-account drain takes no amount to lower and instead needs
+    /// funds added to the drained account (or a lower minimum lock floor).
+    /// The `available` / `required` duff figures are in the message. Kotlin
+    /// parity: `DashSdkError.PlatformWallet.AssetLockInsufficientFunds`.
+    case assetLockInsufficientFunds(String)
     /// A persister operation failed transiently; callers may retry.
     case persisterTransient(String)
     /// A persister operation failed permanently; callers must not retry.
@@ -480,7 +522,7 @@ public enum PlatformWalletError: LocalizedError {
              .arithmeticOverflow(let m), .noSelectableInputs(let m),
              .coreInsufficientFunds(let m),
              .assetLockNotTracked(let m), .assetLockAlreadyConsumed(let m),
-             .assetLockFundingMismatch(let m),
+             .assetLockFundingMismatch(let m), .assetLockInsufficientFunds(let m),
              .persisterTransient(let m), .persisterFatal(let m),
              .walletAlreadyExists(let m), .shieldedBroadcastFailed(let m),
              .shieldedBroadcastUnconfirmed(let m), .shieldedSpendUnconfirmed(let m),
@@ -548,6 +590,7 @@ public enum PlatformWalletError: LocalizedError {
         case .errorAssetLockNotTracked: self = .assetLockNotTracked(detail)
         case .errorAssetLockAlreadyConsumed: self = .assetLockAlreadyConsumed(detail)
         case .errorAssetLockFundingMismatch: self = .assetLockFundingMismatch(detail)
+        case .errorAssetLockInsufficientFunds: self = .assetLockInsufficientFunds(detail)
         case .errorPersisterTransient: self = .persisterTransient(detail)
         case .errorPersisterFatal: self = .persisterFatal(detail)
         case .errorWalletAlreadyExists: self = .walletAlreadyExists(detail)
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/SDK.swift b/packages/swift-sdk/Sources/SwiftDashSDK/SDK.swift
index c38f13fab0e..f36c00f06d8 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/SDK.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/SDK.swift
@@ -1,5 +1,6 @@
 import Foundation
 import DashSDKFFI
+import os.log
 
 // MARK: - Data Extensions
 extension Data {
@@ -449,7 +450,16 @@ public final class SDK: @unchecked Sendable {
 
   deinit {
     if let handle = handle {
+      // Timed + thread-stamped: `dash_sdk_destroy` tears down the tokio
+      // runtime synchronously, and the last reference is often released on
+      // the MainActor (host stop / error unwind). This line is the data for
+      // deciding whether destruction ever needs an explicit off-main hop.
+      let started = CFAbsoluteTimeGetCurrent()
+      let offMain = !Thread.isMainThread
       dash_sdk_destroy(handle)
+      let ms = Int((CFAbsoluteTimeGetCurrent() - started) * 1000)
+      Logger(subsystem: "dashpay.SwiftDashSDK", category: "SDKLifecycle")
+        .info("dash_sdk_destroy finished in \(ms, privacy: .public)ms offMain=\(offMain, privacy: .public)")
     }
   }
 
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Security/Secp256k1Primitives.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Security/Secp256k1Primitives.swift
new file mode 100644
index 00000000000..f4463d70edc
--- /dev/null
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Security/Secp256k1Primitives.swift
@@ -0,0 +1,69 @@
+import Foundation
+import DashSDKFFI
+
+/// Standalone secp256k1 primitives exposed by the Platform FFI.
+///
+/// These are handle-free on purpose: DashConnect validates scanned QR payloads
+/// before a wallet is resolved, so the URI path cannot depend on any wallet instance.
+public enum Secp256k1Primitives {
+    /// True when `pubKey` is a well-formed 33-byte compressed secp256k1 point.
+    public static func isValidCompressedPoint(_ pubKey: Data) -> Bool {
+        guard pubKey.count == 33 else {
+            return false
+        }
+
+        return pubKey.withUnsafeBytes { rawBuffer in
+            let bytes = rawBuffer.bindMemory(to: UInt8.self)
+            return platform_wallet_secp256k1_verify_compressed_point(
+                bytes.baseAddress,
+                UInt(bytes.count)
+            ) == 1
+        }
+    }
+
+    /// The 33-byte compressed public key for a 32-byte secp256k1 private key.
+    public static func compressedPublicKey(privateKey: Data) throws -> Data {
+        var output = [UInt8](repeating: 0, count: 33)
+
+        let result = privateKey.withUnsafeBytes { rawBuffer -> PlatformWalletFFIResult in
+            let bytes = rawBuffer.bindMemory(to: UInt8.self)
+            return output.withUnsafeMutableBufferPointer { outputBuffer in
+                platform_wallet_secp256k1_compressed_public_key(
+                    bytes.baseAddress,
+                    UInt(bytes.count),
+                    outputBuffer.baseAddress
+                )
+            }
+        }
+
+        try result.check()
+        return Data(output)
+    }
+
+    /// The 32-byte raw affine X coordinate of `privateKey * publicKey`.
+    public static func ecdhSharedX(privateKey: Data, publicKey: Data) throws -> Data {
+        // The FFI writes the shared secret directly into the returned buffer:
+        // a separate scratch array would leave a second, unscrubbed copy of
+        // the session secret in allocator memory once it was copied into `Data`.
+        var output = Data(count: 32)
+
+        let result = output.withUnsafeMutableBytes { outputBuffer -> PlatformWalletFFIResult in
+            privateKey.withUnsafeBytes { privateBuffer in
+                publicKey.withUnsafeBytes { publicBuffer in
+                    let privateBytes = privateBuffer.bindMemory(to: UInt8.self)
+                    let publicBytes = publicBuffer.bindMemory(to: UInt8.self)
+                    return platform_wallet_secp256k1_ecdh_shared_x(
+                        privateBytes.baseAddress,
+                        UInt(privateBytes.count),
+                        publicBytes.baseAddress,
+                        UInt(publicBytes.count),
+                        outputBuffer.bindMemory(to: UInt8.self).baseAddress
+                    )
+                }
+            }
+        }
+
+        try result.check()
+        return output
+    }
+}
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Voting/SDK+DPNSContests.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Voting/SDK+DPNSContests.swift
index 050356919a5..393c6142708 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Voting/SDK+DPNSContests.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Voting/SDK+DPNSContests.swift
@@ -1,6 +1,44 @@
 import Foundation
 import DashSDKFFI
 
+private final class DPNSActiveContestsRequest: @unchecked Sendable {
+  private enum Phase {
+    case queued
+    case running
+    case cancelled
+  }
+
+  let sdk: SDK
+  let sdkHandle: OpaquePointer
+
+  private let lock = NSLock()
+  private var phase = Phase.queued
+
+  init(sdk: SDK, sdkHandle: OpaquePointer) {
+    self.sdk = sdk
+    self.sdkHandle = sdkHandle
+  }
+
+  func begin() -> Bool {
+    lock.withLock {
+      guard case .queued = phase else { return false }
+      phase = .running
+      return true
+    }
+  }
+
+  func cancel() {
+    lock.withLock { phase = .cancelled }
+  }
+
+  var isCancelled: Bool {
+    lock.withLock {
+      if case .cancelled = phase { return true }
+      return false
+    }
+  }
+}
+
 // MARK: - DPNS contested-username browsing
 //
 // Typed reads for the *voter's* view of DPNS username contests: every open
@@ -22,6 +60,14 @@ import DashSDKFFI
 @MainActor
 extension SDK {
 
+  /// Serializes the blocking active-contest FFI call on a GCD worker rather
+  /// than occupying Swift's cooperative executor. Serial execution also lets
+  /// canceled refreshes waiting behind an in-flight query skip entering Rust.
+  nonisolated private static let activeContestsQueue = DispatchQueue(
+    label: "org.dash.swiftdashsdk.dpns-active-contests",
+    qos: .userInitiated
+  )
+
   // MARK: - Label normalization
 
   /// Homograph-normalize a DPNS label the way Platform does before indexing
@@ -58,22 +104,64 @@ extension SDK {
   /// Every DPNS username contest that is still open, with its contenders,
   /// tallies and end time.
   ///
-  /// One round trip. Reads the FFI's `DashSDKContestedNamesList` structure
-  /// directly, so contender tallies arrive as integers.
+  /// The Rust bridge lists current contests, then loads their vote states with
+  /// bounded concurrency and an overall timeout. This async wrapper keeps that
+  /// blocking FFI operation off the caller's actor. Cancellation is cooperative
+  /// at the FFI boundary: it prevents work that has not entered Rust, but once
+  /// the synchronous call starts this method waits for it to return (bounded by
+  /// the Rust timeout), frees any result, then throws `CancellationError`.
   ///
   /// - Parameter limit: Maximum contests to return. The FFI has no
   ///   start-after cursor on this query, so this is a hard ceiling, not a
   ///   page size — raise it rather than trying to page.
   /// - Returns: Contests sorted by normalized label. Empty when nothing is
   ///   contested.
-  public func dpnsActiveContests(limit: UInt32 = 200) throws -> [DPNSContest] {
-    guard let handle = handle else {
+  public func dpnsActiveContests(limit: UInt32 = 200) async throws -> [DPNSContest] {
+    guard let sdkHandle = handle else {
       throw SDKError.invalidState("SDK not initialized")
     }
-    guard let listPtr = dash_sdk_dpns_get_contested_non_resolved_usernames(handle, limit) else {
-      throw SDKError.internalError("Failed to fetch contested DPNS usernames")
+
+    let request = DPNSActiveContestsRequest(sdk: self, sdkHandle: sdkHandle)
+
+    return try await withTaskCancellationHandler {
+      try Task.checkCancellation()
+
+      let contests = try await withCheckedThrowingContinuation {
+        (continuation: CheckedContinuation<[DPNSContest], Error>) in
+        Self.activeContestsQueue.async {
+          guard request.begin() else {
+            continuation.resume(throwing: CancellationError())
+            return
+          }
+
+          // `SDK` owns its handle; pin it until the synchronous FFI call has
+          // returned and any owned result has been copied and freed.
+          let contests: [DPNSContest]? = withExtendedLifetime(request.sdk) {
+            guard let listPtr = dash_sdk_dpns_get_contested_non_resolved_usernames(
+              request.sdkHandle, limit
+            ) else { return nil }
+            return Self.consumeContestedNamesList(listPtr)
+          }
+
+          // The FFI call cannot be interrupted. Check only after consuming the
+          // result so cancellation cannot leak an allocated list.
+          if request.isCancelled {
+            continuation.resume(throwing: CancellationError())
+          } else if let contests {
+            continuation.resume(returning: contests)
+          } else {
+            continuation.resume(
+              throwing: SDKError.internalError("Failed to fetch contested DPNS usernames")
+            )
+          }
+        }
+      }
+      // Cover cancellation after the worker's check but before this task resumes.
+      try Task.checkCancellation()
+      return contests
+    } onCancel: {
+      request.cancel()
     }
-    return Self.consumeContestedNamesList(listPtr)
   }
 
   /// The open contests **this identity is contending in** — the "how are my
@@ -105,7 +193,7 @@ extension SDK {
   /// the null-label handling to drift.
   ///
   /// Takes ownership: the list is freed before returning, on every path.
-  private static func consumeContestedNamesList(
+  nonisolated private static func consumeContestedNamesList(
     _ listPtr: UnsafeMutablePointer<DashSDKContestedNamesList>
   ) -> [DPNSContest] {
     defer { dash_sdk_contested_names_list_free(listPtr) }
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/ContentView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/ContentView.swift
index 7febdf052ed..994f45f7671 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/ContentView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/ContentView.swift
@@ -510,7 +510,7 @@ struct ContentView: View {
             // history), falling back to genesis only for wallets that predate
             // that metadata — never the current tip, which would skip the
             // history recovery exists to recover.
-            let managed = try recoveryManager.createWallet(
+            let managed = try await recoveryManager.createWallet(
                 mnemonic: mnemonic,
                 network: restoredNetwork,
                 name: restoredName,
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CreateWalletView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CreateWalletView.swift
index 8c19ad13e58..3af077393ad 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CreateWalletView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CreateWalletView.swift
@@ -351,7 +351,12 @@ struct CreateWalletView: View {
                 // metadata must be written under EACH freshly-created
                 // network's id, and `isImported` stamped on each id's
                 // row.
-                try await MainActor.run {
+                // An async MainActor closure (not `MainActor.run`, whose
+                // closure is synchronous): the loop below awaits the
+                // async `createWallet` overload, so each network's
+                // blocking native create runs on the SDK's dedicated
+                // queue instead of freezing the main thread.
+                let createOnMain: @MainActor () async throws -> Void = {
                     // Per-network results for networks the wallet was
                     // FRESHLY created on this pass — each carries the
                     // scoped `walletId` Rust returned, which is the
@@ -384,7 +389,7 @@ struct CreateWalletView: View {
                     for net in selectedNetworks {
                         do {
                             let mgr = try walletManagerStore.backgroundManager(for: net)
-                            let managed = try mgr.createWallet(
+                            let managed = try await mgr.createWallet(
                                 mnemonic: mnemonicPhrase,
                                 network: net,
                                 name: walletLabel,
@@ -519,6 +524,7 @@ struct CreateWalletView: View {
 
                     dismiss()
                 }
+                try await createOnMain()
 
                 print("=== WALLET CREATION SUCCESS - networks: \(selectedNetworks.map { $0.displayName }) ===")
             } catch {
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/WalletDetailView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/WalletDetailView.swift
index cd9affaee51..71d82056c99 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/WalletDetailView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/WalletDetailView.swift
@@ -834,11 +834,6 @@ struct WalletInfoView: View {
         isUpdatingNetworks = true
         defer { isUpdatingNetworks = false }
 
-        // `createWallet` below is a synchronous @MainActor FFI call that
-        // blocks the main thread, so without yielding first SwiftUI never
-        // paints the overlay. Let it render one frame before we block.
-        try? await Task.sleep(nanoseconds: 50_000_000) // ~50ms, one frame
-
         // Add the existing wallet to another network by re-creating it
         // from the stored mnemonic in that network's manager. The
         // `walletId` is now network-scoped — the same mnemonic produces
@@ -864,7 +859,7 @@ struct WalletInfoView: View {
             // Enabling an existing wallet on another network: the mnemonic is
             // pre-existing and may already have on-chain history there — scan
             // from genesis (birthHeight 0) so prior funds/payments are seen.
-            let created = try mgr.createWallet(
+            let created = try await mgr.createWallet(
                 mnemonic: mnemonic,
                 network: network,
                 name: wallet.name ?? wallet.label,
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/DashModelMigrationTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/DashModelMigrationTests.swift
new file mode 100644
index 00000000000..efa5d73c80e
--- /dev/null
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/DashModelMigrationTests.swift
@@ -0,0 +1,60 @@
+import Foundation
+import SwiftData
+import XCTest
+
+@testable import SwiftDashSDK
+
+final class DashModelMigrationTests: XCTestCase {
+    @MainActor
+    func testV1StoreMigratesToV2AndAcceptsTrackedMasternodes() throws {
+        let directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString, isDirectory: true)
+        try FileManager.default.createDirectory(
+            at: directory, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: directory) }
+        let storeURL = directory.appendingPathComponent("dash.store")
+
+        let v1Schema = Schema(versionedSchema: DashSchemaV1.self)
+        let v1Configuration = ModelConfiguration(
+            "DashMigrationTest",
+            schema: v1Schema,
+            url: storeURL,
+            allowsSave: true,
+            cloudKitDatabase: .none)
+        var v1Container: ModelContainer? = try ModelContainer(
+            for: v1Schema,
+            configurations: [v1Configuration])
+        v1Container?.mainContext.insert(PersistentKeyword(
+            keyword: "preserved",
+            contractId: "contract"))
+        try v1Container?.mainContext.save()
+        v1Container = nil
+
+        let v2Schema = Schema(versionedSchema: DashSchemaV2.self)
+        let v2Configuration = ModelConfiguration(
+            "DashMigrationTest",
+            schema: v2Schema,
+            url: storeURL,
+            allowsSave: true,
+            cloudKitDatabase: .none)
+        let migrated = try ModelContainer(
+            for: v2Schema,
+            migrationPlan: DashMigrationPlan.self,
+            configurations: [v2Configuration])
+
+        let keywords = try migrated.mainContext.fetch(FetchDescriptor<PersistentKeyword>())
+        XCTAssertEqual(keywords.map(\.keyword), ["preserved"])
+
+        migrated.mainContext.insert(PersistentTrackedMasternode(
+            networkRaw: Network.testnet.rawValue,
+            proTxHash: Data(repeating: 7, count: 32),
+            label: "new in V2",
+            addedAt: 1,
+            snapshotJSON: "{}"))
+        try migrated.mainContext.save()
+        XCTAssertEqual(
+            try migrated.mainContext.fetchCount(
+                FetchDescriptor<PersistentTrackedMasternode>()),
+            1)
+    }
+}
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/ErrorHandlingTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/ErrorHandlingTests.swift
index f696761a42d..264fcd8d0a3 100644
--- a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/ErrorHandlingTests.swift
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/ErrorHandlingTests.swift
@@ -34,8 +34,8 @@ final class ErrorHandlingTests: XCTestCase {
     }
 
     func testPersisterFFIResultMappingsRemainDistinguishable() {
-        XCTAssertEqual(PlatformWalletResultCode.errorPersisterTransient.rawValue, 42)
-        XCTAssertEqual(PlatformWalletResultCode.errorPersisterFatal.rawValue, 43)
+        XCTAssertEqual(PlatformWalletResultCode.errorPersisterTransient.rawValue, 48)
+        XCTAssertEqual(PlatformWalletResultCode.errorPersisterFatal.rawValue, 49)
         XCTAssertEqual(
             PlatformWalletResultCode(
                 ffi: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_PERSISTER_TRANSIENT
@@ -70,6 +70,46 @@ final class ErrorHandlingTests: XCTestCase {
         }
     }
 
+    func testAssetLockInsufficientFundsFFIResultMapping() {
+        // The asset-lock coin-selection shortfall (dashpay/platform#4073).
+        // Swift could not decode code 29 at all before this mirror existed —
+        // no raw-value case and no C-enum arm meant it fell through to
+        // .errorUnknown, so the Rust-side typed code died at the Swift
+        // boundary while Kotlin already branched on it.
+        XCTAssertEqual(
+            PlatformWalletResultCode(
+                ffi: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_ASSET_LOCK_INSUFFICIENT_FUNDS
+            ),
+            .errorAssetLockInsufficientFunds
+        )
+        XCTAssertNotEqual(
+            PlatformWalletResultCode(
+                ffi: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_ASSET_LOCK_INSUFFICIENT_FUNDS
+            ),
+            .errorUnknown
+        )
+        // The raw value is hand-mirrored ABI, not a derived ordinal.
+        XCTAssertEqual(
+            PlatformWalletResultCode.errorAssetLockInsufficientFunds.rawValue,
+            29
+        )
+
+        // The structured available/required duffs ride the message string —
+        // PlatformWalletFFIResult is ABI-frozen at code + message — so the
+        // typed error must carry them through unaltered.
+        let rendered = "asset lock coin selection is short: available 18000000 duffs, "
+            + "required 100000000 duffs"
+        let error = PlatformWalletError(
+            code: .errorAssetLockInsufficientFunds,
+            message: rendered
+        )
+        guard case .assetLockInsufficientFunds(let message) = error else {
+            return XCTFail("expected typed assetLockInsufficientFunds error")
+        }
+        XCTAssertEqual(message, rendered)
+        XCTAssertEqual(error.errorDescription, rendered)
+    }
+
     func testPlatformWalletNotFoundFFIResultMapping() {
         // Code 98 (the blanket Option→result miss) stays typed inside the
         // wallet-error family — the mapping Kotlin now converges on
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/KeychainSignerAdditionalSigningKeysTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/KeychainSignerAdditionalSigningKeysTests.swift
new file mode 100644
index 00000000000..286f16a91ed
--- /dev/null
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/KeychainSignerAdditionalSigningKeysTests.swift
@@ -0,0 +1,192 @@
+import SwiftData
+import XCTest
+
+@testable import SwiftDashSDK
+
+@MainActor
+final class KeychainSignerAdditionalSigningKeysTests: XCTestCase {
+    private enum ScopeError: Swift.Error {
+        case expected
+    }
+
+    func testAdditionalHash160KeyIsSignableWithinScopeAndUnavailableAfterwards() async throws {
+        let container = try DashModelContainer.createInMemory()
+        let keychain = KeychainManager(serviceName: "org.dashfoundation.tests.\(UUID().uuidString)")
+        let signer = KeychainSigner(modelContainer: container, network: .testnet, keychain: keychain)
+
+        let privateKey = Data(repeating: 0x11, count: 32)
+        let publicKey = try Secp256k1Primitives.compressedPublicKey(privateKey: privateKey)
+        let publicKeyHash = try XCTUnwrap(
+            Data(hexString: KeychainManager.computePublicKeyHashHex(publicKey))
+        )
+
+        await signer.withAdditionalSigningKeys([
+            (publicKey: publicKeyHash, privateKey: privateKey),
+        ]) {
+            XCTAssertTrue(
+                signer.canSign(publicKey: publicKeyHash, keyType: KeyType.ecdsaHash160.rawValue)
+            )
+
+            let result = signer.signOnDemand(
+                publicKey: publicKeyHash,
+                keyType: KeyType.ecdsaHash160.rawValue,
+                data: Data("proof-of-possession".utf8)
+            )
+
+            guard case .success(let signature) = result else {
+                return XCTFail("expected signature, got \(result)")
+            }
+            XCTAssertEqual(signature.count, 65)
+        }
+
+        XCTAssertFalse(
+            signer.canSign(publicKey: publicKeyHash, keyType: KeyType.ecdsaHash160.rawValue)
+        )
+    }
+
+    func testAdditionalSigningKeysAreZeroedAfterThrowingScope() async throws {
+        let container = try DashModelContainer.createInMemory()
+        let keychain = KeychainManager(serviceName: "org.dashfoundation.tests.\(UUID().uuidString)")
+        let signer = KeychainSigner(modelContainer: container, network: .testnet, keychain: keychain)
+
+        let privateKey = Data(repeating: 0x12, count: 32)
+        let publicKey = try Secp256k1Primitives.compressedPublicKey(privateKey: privateKey)
+        let entries = signer.makeAdditionalSigningKeyEntries([(publicKey: publicKey, privateKey: privateKey)])
+
+        XCTAssertFalse(entries[0].isZeroedForTesting)
+
+        do {
+            _ = try await signer.withAdditionalSigningKeys(entries) {
+                throw ScopeError.expected
+            }
+            XCTFail("expected throwing scope")
+        } catch ScopeError.expected {
+            XCTAssertTrue(entries[0].isZeroedForTesting)
+            XCTAssertFalse(
+                signer.canSign(publicKey: publicKey, keyType: KeyType.ecdsaSecp256k1.rawValue)
+            )
+        }
+    }
+
+    func testWalletOwnedKeyStillSignsThroughPersistence() throws {
+        let container = try DashModelContainer.createInMemory()
+        let keychain = KeychainManager(serviceName: "org.dashfoundation.tests.\(UUID().uuidString)")
+        let signer = KeychainSigner(modelContainer: container, network: .testnet, keychain: keychain)
+
+        let persisted = try seedPersistedIdentityKey(
+            container: container,
+            keychain: keychain,
+            privateKey: Data(repeating: 0x13, count: 32)
+        )
+        defer {
+            _ = keychain.deleteIdentityPrivateKey(
+                walletId: persisted.walletId,
+                derivationPath: persisted.derivationPath
+            )
+        }
+
+        XCTAssertTrue(
+            signer.canSign(publicKey: persisted.publicKey, keyType: KeyType.ecdsaSecp256k1.rawValue)
+        )
+
+        let result = signer.signOnDemand(
+            publicKey: persisted.publicKey,
+            keyType: KeyType.ecdsaSecp256k1.rawValue,
+            data: Data("wallet-owned".utf8)
+        )
+
+        guard case .success(let signature) = result else {
+            return XCTFail("expected persisted key signature, got \(result)")
+        }
+        XCTAssertEqual(signature.count, 65)
+    }
+
+    func testAdditionalRegistryDoesNotChangeWalletOwnedBehaviorWhenBytesMatch() async throws {
+        let container = try DashModelContainer.createInMemory()
+        let keychain = KeychainManager(serviceName: "org.dashfoundation.tests.\(UUID().uuidString)")
+        let signer = KeychainSigner(modelContainer: container, network: .testnet, keychain: keychain)
+
+        let persisted = try seedPersistedIdentityKey(
+            container: container,
+            keychain: keychain,
+            privateKey: Data(repeating: 0x14, count: 32)
+        )
+        defer {
+            _ = keychain.deleteIdentityPrivateKey(
+                walletId: persisted.walletId,
+                derivationPath: persisted.derivationPath
+            )
+        }
+
+        let message = Data("same-bytes".utf8)
+        let baseline = signer.signOnDemand(
+            publicKey: persisted.publicKey,
+            keyType: KeyType.ecdsaSecp256k1.rawValue,
+            data: message
+        )
+
+        guard case .success(let baselineSignature) = baseline else {
+            return XCTFail("expected baseline signature, got \(baseline)")
+        }
+
+        await signer.withAdditionalSigningKeys([
+            (publicKey: persisted.publicKey, privateKey: persisted.privateKey),
+        ]) {
+            let scoped = signer.signOnDemand(
+                publicKey: persisted.publicKey,
+                keyType: KeyType.ecdsaSecp256k1.rawValue,
+                data: message
+            )
+
+            guard case .success(let scopedSignature) = scoped else {
+                return XCTFail("expected scoped signature, got \(scoped)")
+            }
+            XCTAssertEqual(scopedSignature, baselineSignature)
+        }
+    }
+
+    private func seedPersistedIdentityKey(
+        container: ModelContainer,
+        keychain: KeychainManager,
+        privateKey: Data
+    ) throws -> (publicKey: Data, privateKey: Data, walletId: Data, derivationPath: String) {
+        let publicKey = try Secp256k1Primitives.compressedPublicKey(privateKey: privateKey)
+        let walletId = Data(repeating: 0xAB, count: 32)
+        let derivationPath = "m/9'/1'/5'/0'/0'/0'/0'"
+        let metadata = IdentityPrivateKeyMetadata(
+            identityId: "id1",
+            keyId: 0,
+            walletId: walletId.toHexString(),
+            identityIndex: 0,
+            keyIndex: 0,
+            derivationPath: derivationPath,
+            publicKey: publicKey.toHexString(),
+            publicKeyHash: KeychainManager.computePublicKeyHashHex(publicKey),
+            keyType: KeyType.ecdsaSecp256k1.rawValue,
+            purpose: KeyPurpose.authentication.rawValue,
+            securityLevel: SecurityLevel.high.rawValue
+        )
+        let identifier = try XCTUnwrap(
+            keychain.storeIdentityPrivateKey(
+                privateKey,
+                derivationPath: derivationPath,
+                metadata: metadata
+            )
+        )
+
+        let context = ModelContext(container)
+        let row = PersistentPublicKey(
+            keyId: 0,
+            purpose: .authentication,
+            securityLevel: .high,
+            keyType: .ecdsaSecp256k1,
+            publicKeyData: publicKey,
+            identityId: "id1"
+        )
+        row.privateKeyKeychainIdentifier = identifier
+        context.insert(row)
+        try context.save()
+
+        return (publicKey, privateKey, walletId, derivationPath)
+    }
+}
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletCreateWalletTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletCreateWalletTests.swift
new file mode 100644
index 00000000000..dceccf470aa
--- /dev/null
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletCreateWalletTests.swift
@@ -0,0 +1,372 @@
+import XCTest
+import DashSDKFFI
+@testable import SwiftDashSDK
+
+/// Coverage for the async off-main `createWallet(mnemonic:)` overload.
+///
+/// Tests inject the native create call (and the teardown table, for the
+/// shutdown-interplay cases), so the production `performCreateWallet`
+/// orchestration stays under test: off-main execution, result mapping,
+/// the shutdown drain (an admitted create completes before teardown takes
+/// the handle; new creates are rejected while the drain runs), and the
+/// FIFO ordering with teardown on the shared destroy queue — all without
+/// invoking a production create or teardown call.
+@MainActor
+final class PlatformWalletCreateWalletTests: XCTestCase {
+
+    /// Records create invocations and (optionally) blocks inside the native
+    /// call, so a test can interleave a `shutdown()` with an in-flight
+    /// off-main create.
+    private final class CreateRecorder: @unchecked Sendable {
+        private let lock = NSLock()
+        private let gate: DispatchSemaphore?
+        private let failingCode: PlatformWalletFFIResultCode?
+        private let eventLog: EventLog?
+        private var invocations: [(handle: Handle, mnemonic: String, ranOnMainThread: Bool)] = []
+        private var inFlight = 0
+        private var maxInFlightSeen = 0
+
+        init(
+            gate: DispatchSemaphore? = nil,
+            failingCode: PlatformWalletFFIResultCode? = nil,
+            eventLog: EventLog? = nil
+        ) {
+            self.gate = gate
+            self.failingCode = failingCode
+            self.eventLog = eventLog
+        }
+
+        func record(
+            handle: Handle,
+            params: PlatformWalletCreateParams
+        ) -> (result: PlatformWalletFFIResult, walletHandle: Handle, walletId: Data) {
+            lock.withLock {
+                invocations.append((handle, params.mnemonic, Thread.isMainThread))
+                inFlight += 1
+                maxInFlightSeen = max(maxInFlightSeen, inFlight)
+            }
+            eventLog?.append("create:begin")
+            gate?.wait()
+            let index = lock.withLock { invocations.count }
+            defer {
+                eventLog?.append("create:end")
+                lock.withLock { inFlight -= 1 }
+            }
+            if let failingCode {
+                return (
+                    PlatformWalletFFIResult(code: failingCode, message: nil),
+                    NULL_HANDLE,
+                    Data()
+                )
+            }
+            // `ManagedPlatformWallet.deinit` destroys its handle through the
+            // live FFI. Keep the fake handle at zero so it can never collide
+            // with a real process-global Rust registry entry; the distinct
+            // wallet ids are sufficient for the concurrency assertions.
+            return (
+                PlatformWalletFFIResult(code: PLATFORM_WALLET_FFI_RESULT_CODE_SUCCESS, message: nil),
+                NULL_HANDLE,
+                Data(repeating: UInt8(index), count: 32)
+            )
+        }
+
+        var count: Int { lock.withLock { invocations.count } }
+        var handles: [Handle] { lock.withLock { invocations.map(\.handle) } }
+        var mainThreadFlags: [Bool] { lock.withLock { invocations.map(\.ranOnMainThread) } }
+        /// Peak number of native creates running at once — 1 proves the
+        /// shared queue actually serialized concurrent callers.
+        var maxInFlight: Int { lock.withLock { maxInFlightSeen } }
+    }
+
+    private nonisolated static func makeCreateCalls(
+        recorder: CreateRecorder
+    ) -> PlatformWalletNativeCreateCalls {
+        PlatformWalletNativeCreateCalls(
+            createFromMnemonic: { handle, params in
+                recorder.record(handle: handle, params: params)
+            }
+        )
+    }
+
+    /// Teardown table whose steps append to a shared event log, so the
+    /// FIFO ordering of create vs teardown on the shared queue is provable.
+    private final class EventLog: @unchecked Sendable {
+        private let lock = NSLock()
+        private var entries: [String] = []
+        func append(_ event: String) { lock.withLock { entries.append(event) } }
+        var events: [String] { lock.withLock { entries } }
+    }
+
+    private nonisolated static func makeTeardownCalls(log: EventLog) -> PlatformWalletNativeTeardownCalls {
+        func step(_ name: String) -> PlatformWalletNativeTeardownCalls.Call {
+            { _ in
+                log.append("teardown:\(name)")
+                return PlatformWalletFFIResult(code: PLATFORM_WALLET_FFI_RESULT_CODE_SUCCESS, message: nil)
+            }
+        }
+        return PlatformWalletNativeTeardownCalls(
+            spvStop: step("spv_stop"),
+            platformAddressSyncStop: step("platform_address_sync_stop"),
+            shieldedSyncStop: step("shielded_sync_stop"),
+            dashPaySyncStop: step("dashpay_sync_stop"),
+            dpnsSyncStop: step("dpns_sync_stop"),
+            destroy: step("destroy")
+        )
+    }
+
+    private func makeManager(
+        handle: Handle,
+        createRecorder: CreateRecorder,
+        teardownLog: EventLog = EventLog()
+    ) -> PlatformWalletManager {
+        let manager = PlatformWalletManager.makeForTesting(
+            handle: handle,
+            calls: Self.makeTeardownCalls(log: teardownLog)
+        )
+        manager.nativeCreateCalls = Self.makeCreateCalls(recorder: createRecorder)
+        return manager
+    }
+
+    // MARK: - Off-main execution + success path
+
+    func testCreateRunsOffMainAndPublishesWallet() async throws {
+        let recorder = CreateRecorder()
+        let manager = makeManager(handle: 42, createRecorder: recorder)
+
+        let wallet = try await manager.createWallet(mnemonic: "m", network: .testnet)
+
+        XCTAssertEqual(recorder.count, 1)
+        XCTAssertEqual(recorder.handles, [42])
+        XCTAssertEqual(recorder.mainThreadFlags, [false], "the native create must run off the main thread")
+        XCTAssertEqual(wallet.walletId, Data(repeating: 1, count: 32))
+        XCTAssertTrue(manager.wallets[wallet.walletId] === wallet)
+        await manager.shutdown()
+    }
+
+    // MARK: - Error mapping
+
+    func testCreateErrorCodeMapsToTypedError() async {
+        let recorder = CreateRecorder(
+            failingCode: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_WALLET_ALREADY_EXISTS)
+        let manager = makeManager(handle: 7, createRecorder: recorder)
+
+        do {
+            _ = try await manager.createWallet(mnemonic: "m", network: .testnet)
+            XCTFail("expected walletAlreadyExists")
+        } catch let error as PlatformWalletError {
+            guard case .walletAlreadyExists = error else {
+                return XCTFail("expected walletAlreadyExists, got \(error)")
+            }
+        } catch {
+            XCTFail("unexpected error: \(error)")
+        }
+        XCTAssertTrue(manager.wallets.isEmpty)
+        await manager.shutdown()
+    }
+
+    // MARK: - Shutdown interplay
+
+    func testCreateAfterShutdownThrowsWithoutInvokingNativeCall() async {
+        let recorder = CreateRecorder()
+        let manager = makeManager(handle: 9, createRecorder: recorder)
+
+        await manager.shutdown()
+
+        do {
+            _ = try await manager.createWallet(mnemonic: "m", network: .testnet)
+            XCTFail("expected a throw after shutdown")
+        } catch is PlatformWalletError {
+            // expected: ensureConfigured rejects the torn-down manager
+        } catch {
+            XCTFail("unexpected error: \(error)")
+        }
+        XCTAssertEqual(recorder.count, 0, "the native create must never be reached after shutdown")
+    }
+
+    /// A shutdown DURING the off-main create window must WAIT: the admitted
+    /// create completes its full transaction (native create + publish) and
+    /// only then does the teardown take the handle and run — an admitted
+    /// create is never failed retroactively after its FFI persisted wallet
+    /// data (the caller would roll back its mnemonic and orphan the rows).
+    func testShutdownDuringCreateWindowWaitsForCreateThenTearsDown() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let log = EventLog()
+        let recorder = CreateRecorder(gate: gate, eventLog: log)
+        let manager = makeManager(handle: 11, createRecorder: recorder, teardownLog: log)
+
+        let createTask = Task { try await manager.createWallet(mnemonic: "m", network: .testnet) }
+
+        // Wait until the create was admitted and is blocked inside the
+        // native call on the destroy queue.
+        while recorder.count == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+
+        // Start the shutdown; it must drain the in-flight create BEFORE
+        // taking the handle — so the handle stays live while the gate holds.
+        let shutdownTask = Task { await manager.shutdown() }
+        try await Task.sleep(for: .milliseconds(30))
+        XCTAssertEqual(
+            manager.handle, 11,
+            "shutdown must not take the handle while an admitted create is in flight")
+
+        gate.signal()
+        let wallet = try await createTask.value
+        let metrics = await shutdownTask.value
+
+        XCTAssertTrue(
+            manager.wallets[wallet.walletId] === wallet,
+            "the drained create must have completed its publish")
+        XCTAssertEqual(manager.handle, NULL_HANDLE)
+        XCTAssertEqual(metrics.steps.count, 6)
+        // The full ordering is in the shared event log: the create ended
+        // before the first teardown step began.
+        XCTAssertEqual(
+            log.events.prefix(2), ["create:begin", "create:end"],
+            "unexpected event order: \(log.events)")
+        XCTAssertEqual(log.events.count, 8)
+        XCTAssertEqual(log.events[2], "teardown:spv_stop")
+    }
+
+    /// New async and synchronous creates arriving while a shutdown is draining
+    /// are rejected up front — before any native work.
+    func testAllCreateOverloadsDuringShutdownDrainAreRejectedBeforeNativeWork() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = CreateRecorder(gate: gate)
+        // Use a value outside any realistic monotonic registry range so even a
+        // regression that reaches the live FFI can only produce a safe miss.
+        let manager = makeManager(handle: Handle.max, createRecorder: recorder)
+
+        let firstCreate = Task { try await manager.createWallet(mnemonic: "a", network: .testnet) }
+        while recorder.count == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+        let shutdownTask = Task { await manager.shutdown() }
+
+        // Poll through the seed overload with deliberately invalid input. It
+        // can never enter FFI: while the gated async create is in flight the
+        // unified synchronous-admission gate rejects it (in-flight branch),
+        // and once shutdown closes admission the shutdown branch takes over.
+        // Both take precedence over seed validation, so `invalidParameter`
+        // must never surface here.
+        while true {
+            do {
+                _ = try manager.createWallet(seed: Data(), network: .testnet)
+                XCTFail("an empty seed must never create a wallet")
+                break
+            } catch PlatformWalletError.invalidHandle(let message) {
+                if message == "manager shutdown is in progress; createWalletFromSeed rejected" {
+                    break
+                }
+                XCTAssertEqual(
+                    message,
+                    "an async native operation is in flight; synchronous createWalletFromSeed rejected")
+                await Task.yield()
+            } catch {
+                XCTFail("unexpected error while waiting for shutdown admission to close: \(error)")
+                break
+            }
+        }
+
+        func assertSynchronousShutdownRejection(
+            _ operation: () throws -> ManagedPlatformWallet,
+            file: StaticString = #filePath,
+            line: UInt = #line
+        ) {
+            do {
+                _ = try operation()
+                XCTFail("expected rejection during the shutdown drain", file: file, line: line)
+            } catch PlatformWalletError.invalidHandle(let message) {
+                XCTAssertEqual(
+                    message,
+                    "manager shutdown is in progress; createWallet rejected",
+                    file: file,
+                    line: line)
+            } catch {
+                XCTFail("unexpected error: \(error)", file: file, line: line)
+            }
+        }
+
+        // The explicit synchronous function type prevents async-overload
+        // selection in this async test context.
+        let createFromMnemonicSynchronously: () throws -> ManagedPlatformWallet = {
+            try manager.createWallet(mnemonic: "sync", network: .testnet)
+        }
+        assertSynchronousShutdownRejection(createFromMnemonicSynchronously)
+
+        do {
+            _ = try await manager.createWallet(mnemonic: "b", network: .testnet)
+            XCTFail("expected rejection during the shutdown drain")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle(let message) = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+            XCTAssertEqual(
+                message,
+                "manager shutdown is in progress; createWallet rejected")
+        }
+
+        gate.signal()
+        _ = try await firstCreate.value
+        _ = await shutdownTask.value
+        XCTAssertEqual(recorder.count, 1, "rejected creates must never reach native work")
+    }
+
+    // MARK: - Concurrent creates
+
+    func testConcurrentCreatesBothSerializeAndPublish() async throws {
+        let recorder = CreateRecorder()
+        let manager = makeManager(handle: 21, createRecorder: recorder)
+
+        async let first = manager.createWallet(mnemonic: "a", network: .testnet)
+        async let second = manager.createWallet(mnemonic: "b", network: .testnet)
+        let (w1, w2) = try await (first, second)
+
+        XCTAssertEqual(recorder.count, 2)
+        XCTAssertEqual(
+            recorder.maxInFlight, 1,
+            "the shared serial queue must never run two native creates at once")
+        XCTAssertNotEqual(w1.walletId, w2.walletId)
+        XCTAssertEqual(manager.wallets.count, 2)
+        XCTAssertTrue(manager.wallets[w1.walletId] === w1)
+        XCTAssertTrue(manager.wallets[w2.walletId] === w2)
+        await manager.shutdown()
+    }
+
+    /// A SYNCHRONOUS create arriving while an async native op is in flight
+    /// (no shutdown involved) is rejected up front: it would run its FFI on
+    /// the MainActor concurrently with the admitted op on the destroy queue.
+    func testSyncCreateIsRejectedWhileAsyncCreateIsInFlight() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = CreateRecorder(gate: gate)
+        // Outside any realistic monotonic registry range so even a
+        // regression that reaches the live FFI can only produce a safe miss.
+        let manager = makeManager(handle: Handle.max - 1, createRecorder: recorder)
+
+        let asyncCreate = Task { try await manager.createWallet(mnemonic: "a", network: .testnet) }
+        while recorder.count == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+
+        // Explicitly non-async closure type forces the SYNC overload
+        // (SE-0296 would otherwise pick the async one in this test body).
+        let syncCreate: () throws -> ManagedPlatformWallet = {
+            try manager.createWallet(mnemonic: "b", network: .testnet)
+        }
+        do {
+            _ = try syncCreate()
+            XCTFail("expected the sync overload to be rejected during an async create")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+        }
+
+        gate.signal()
+        _ = try await asyncCreate.value
+        XCTAssertEqual(
+            recorder.count, 1,
+            "only the admitted async create may reach the native call")
+        await manager.shutdown()
+    }
+}
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletLoadFromPersistorTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletLoadFromPersistorTests.swift
new file mode 100644
index 00000000000..8cd76a5de1d
--- /dev/null
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletLoadFromPersistorTests.swift
@@ -0,0 +1,357 @@
+import XCTest
+@testable import SwiftDashSDK
+
+/// Unit coverage for the async `loadFromPersistor()` overload.
+///
+/// Tests inject the native-load call table (bulk restore, id list, and
+/// per-wallet lookup) plus the teardown table for the shutdown-interplay
+/// cases, so the production `performLoadFromPersistor` orchestration stays
+/// under test: off-main execution, bulk error mapping, per-wallet
+/// skip-and-continue parity with the sync overload, and participation in
+/// the shutdown drain (an admitted load completes before teardown takes
+/// the handle; new loads are rejected while the drain runs), and the
+/// synchronous-overload admission gate — all without invoking a production
+/// load or teardown call. The keychain unlock epilogue is exercised only
+/// as far as its watch-only fast path (test wallets have no stored
+/// mnemonic, so the verify FFI is never reached).
+@MainActor
+final class PlatformWalletLoadFromPersistorTests: XCTestCase {
+    /// Thread-recording, optionally gated native-load table.
+    private final class LoadRecorder: @unchecked Sendable {
+        private let lock = NSLock()
+        private let gate: DispatchSemaphore?
+        private let bulkFailingCode: PlatformWalletFFIResultCode?
+        private let walletIds: [Data]
+        private let failingLookups: [Data: PlatformWalletFFIResultCode]
+        private var bulkInvocations: [(handle: Handle, ranOnMainThread: Bool)] = []
+        private var lookupIds: [Data] = []
+
+        init(
+            walletIds: [Data] = [],
+            gate: DispatchSemaphore? = nil,
+            bulkFailingCode: PlatformWalletFFIResultCode? = nil,
+            failingLookups: [Data: PlatformWalletFFIResultCode] = [:]
+        ) {
+            self.walletIds = walletIds
+            self.gate = gate
+            self.bulkFailingCode = bulkFailingCode
+            self.failingLookups = failingLookups
+        }
+
+        func makeCalls() -> PlatformWalletNativeLoadCalls {
+            PlatformWalletNativeLoadCalls(
+                loadFromPersistor: { [self] handle in
+                    lock.withLock {
+                        bulkInvocations.append((handle, Thread.isMainThread))
+                    }
+                    gate?.wait()
+                    if let bulkFailingCode {
+                        return PlatformWalletFFIResult(code: bulkFailingCode, message: nil)
+                    }
+                    return PlatformWalletFFIResult(
+                        code: PLATFORM_WALLET_FFI_RESULT_CODE_SUCCESS, message: nil)
+                },
+                restorableWalletIds: { [self] _ in walletIds },
+                getWallet: { [self] _, walletId in
+                    lock.withLock { lookupIds.append(walletId) }
+                    if let failingCode = failingLookups[walletId] {
+                        return (
+                            PlatformWalletFFIResult(code: failingCode, message: nil),
+                            NULL_HANDLE
+                        )
+                    }
+                    // `ManagedPlatformWallet.deinit` destroys its handle
+                    // through the live FFI. Keep the fake handle at zero so
+                    // it can never collide with a real process-global Rust
+                    // registry entry; the distinct wallet ids are sufficient
+                    // to tell results apart.
+                    return (
+                        PlatformWalletFFIResult(
+                            code: PLATFORM_WALLET_FFI_RESULT_CODE_SUCCESS, message: nil),
+                        NULL_HANDLE
+                    )
+                }
+            )
+        }
+
+        var bulkCount: Int { lock.withLock { bulkInvocations.count } }
+        var bulkMainThreadFlags: [Bool] { lock.withLock { bulkInvocations.map(\.ranOnMainThread) } }
+        var requestedLookupIds: [Data] { lock.withLock { lookupIds } }
+    }
+
+    private final class EventLog: @unchecked Sendable {
+        private let lock = NSLock()
+        private var entries: [String] = []
+        func append(_ event: String) { lock.withLock { entries.append(event) } }
+        var events: [String] { lock.withLock { entries } }
+    }
+
+    private nonisolated static func makeTeardownCalls(log: EventLog) -> PlatformWalletNativeTeardownCalls {
+        func step(_ name: String) -> PlatformWalletNativeTeardownCalls.Call {
+            { _ in
+                log.append("teardown:\(name)")
+                return PlatformWalletFFIResult(code: PLATFORM_WALLET_FFI_RESULT_CODE_SUCCESS, message: nil)
+            }
+        }
+        return PlatformWalletNativeTeardownCalls(
+            spvStop: step("spv_stop"),
+            platformAddressSyncStop: step("platform_address_sync_stop"),
+            shieldedSyncStop: step("shielded_sync_stop"),
+            dashPaySyncStop: step("dashpay_sync_stop"),
+            dpnsSyncStop: step("dpns_sync_stop"),
+            destroy: step("destroy")
+        )
+    }
+
+    private func makeManager(
+        handle: Handle,
+        recorder: LoadRecorder,
+        teardownLog: EventLog = EventLog()
+    ) -> PlatformWalletManager {
+        let manager = PlatformWalletManager.makeForTesting(
+            handle: handle,
+            calls: Self.makeTeardownCalls(log: teardownLog)
+        )
+        manager.nativeLoadCalls = recorder.makeCalls()
+        return manager
+    }
+
+    private func id(_ byte: UInt8) -> Data { Data(repeating: byte, count: 32) }
+
+    func testLoadRunsOffMainPublishesWalletsAndSkipsFailedLookups() async throws {
+        let good = id(1)
+        let bad = id(2)
+        let recorder = LoadRecorder(
+            walletIds: [good, bad],
+            failingLookups: [bad: PLATFORM_WALLET_FFI_RESULT_CODE_NOT_FOUND])
+        let manager = makeManager(handle: 42, recorder: recorder)
+
+        let restored = try await manager.loadFromPersistor()
+
+        XCTAssertEqual(recorder.bulkCount, 1)
+        XCTAssertEqual(
+            recorder.bulkMainThreadFlags, [false],
+            "the native load must run off the main thread")
+        XCTAssertEqual(recorder.requestedLookupIds, [good, bad])
+        XCTAssertEqual(restored.map(\.walletId), [good])
+        XCTAssertTrue(manager.wallets[good] === restored.first)
+        XCTAssertNil(manager.wallets[bad], "a failed lookup must be skipped, not published")
+        XCTAssertNotNil(manager.lastError, "the skip must surface through lastError (sync parity)")
+    }
+
+    /// `lastError` parity with the sync overload: failures are replayed in
+    /// wallet-id order, so the LATEST failure in sequence wins — not
+    /// whichever phase (lookup vs unlock) happened to run last.
+    func testLastErrorReflectsTheLatestFailureInSequenceOrder() async throws {
+        let earlyBad = id(1)
+        let good = id(2)
+        let lateBad = id(3)
+        let recorder = LoadRecorder(
+            walletIds: [earlyBad, good, lateBad],
+            failingLookups: [
+                earlyBad: PLATFORM_WALLET_FFI_RESULT_CODE_NOT_FOUND,
+                lateBad: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_WALLET_OPERATION,
+            ])
+        let manager = makeManager(handle: 42, recorder: recorder)
+
+        let restored = try await manager.loadFromPersistor()
+
+        XCTAssertEqual(restored.map(\.walletId), [good])
+        guard case .some(.walletOperation) = manager.lastError as? PlatformWalletError else {
+            return XCTFail(
+                "lastError must hold the LATER failure in id order, got \(String(describing: manager.lastError))")
+        }
+    }
+
+    func testShortWalletIdsNeverReachTheLookup() async throws {
+        let recorder = LoadRecorder(walletIds: [Data([0x01, 0x02])])
+        let manager = makeManager(handle: 42, recorder: recorder)
+
+        let restored = try await manager.loadFromPersistor()
+
+        XCTAssertTrue(restored.isEmpty)
+        XCTAssertEqual(recorder.requestedLookupIds, [])
+    }
+
+    func testBulkErrorMapsToTypedErrorAndPublishesNothing() async {
+        let recorder = LoadRecorder(
+            walletIds: [id(1)],
+            bulkFailingCode: PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_WALLET_OPERATION)
+        let manager = makeManager(handle: 7, recorder: recorder)
+
+        do {
+            _ = try await manager.loadFromPersistor()
+            XCTFail("expected the bulk failure to throw")
+        } catch let error as PlatformWalletError {
+            guard case .walletOperation = error else {
+                return XCTFail("expected walletOperation, got \(error)")
+            }
+        } catch {
+            XCTFail("unexpected error: \(error)")
+        }
+        XCTAssertTrue(manager.wallets.isEmpty)
+        XCTAssertEqual(
+            recorder.requestedLookupIds, [],
+            "a failed bulk load must not attempt per-wallet lookups")
+    }
+
+    /// A shutdown during the off-main load window must wait for the load's
+    /// full transaction, exactly like the async create.
+    func testShutdownDuringLoadWaitsForLoadThenTearsDown() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = LoadRecorder(walletIds: [id(3)], gate: gate)
+        let log = EventLog()
+        let manager = makeManager(handle: 11, recorder: recorder, teardownLog: log)
+
+        let loadTask = Task { try await manager.loadFromPersistor() }
+        while recorder.bulkCount == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+
+        let shutdownTask = Task { await manager.shutdown() }
+        try await Task.sleep(for: .milliseconds(30))
+        XCTAssertEqual(
+            manager.handle, 11,
+            "shutdown must not take the handle while an admitted load is in flight")
+
+        gate.signal()
+        let restored = try await loadTask.value
+        let metrics = await shutdownTask.value
+
+        XCTAssertEqual(restored.map(\.walletId), [id(3)])
+        XCTAssertTrue(manager.wallets[id(3)] === restored.first)
+        XCTAssertEqual(manager.handle, NULL_HANDLE)
+        XCTAssertEqual(metrics.steps.count, 6)
+        XCTAssertEqual(log.events.first, "teardown:spv_stop")
+    }
+
+    func testLoadDuringShutdownDrainIsRejectedBeforeNativeCall() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = LoadRecorder(walletIds: [id(4)], gate: gate)
+        let manager = makeManager(handle: 13, recorder: recorder)
+
+        let firstLoad = Task { try await manager.loadFromPersistor() }
+        while recorder.bulkCount == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+        let shutdownTask = Task { await manager.shutdown() }
+        try await Task.sleep(for: .milliseconds(20))
+
+        do {
+            _ = try await manager.loadFromPersistor()
+            XCTFail("expected rejection during the shutdown drain")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+        }
+
+        gate.signal()
+        _ = try await firstLoad.value
+        _ = await shutdownTask.value
+        XCTAssertEqual(recorder.bulkCount, 1, "the rejected load must never reach the native call")
+    }
+
+    /// The SYNCHRONOUS overload must be rejected while an async load is in
+    /// flight: it would run a second Rust loader on the MainActor
+    /// concurrently with the admitted one on the destroy queue, racing
+    /// load.rs's two-step hydration. Rejected before any native work.
+    func testSyncLoadIsRejectedWhileAsyncLoadIsInFlight() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = LoadRecorder(walletIds: [id(5)], gate: gate)
+        // A deliberately high fake manager handle: if the admission gate
+        // ever regressed, the sync overload's LIVE bulk FFI would run
+        // against it — a value this large can never alias a real
+        // registry entry allocated during this test process.
+        let manager = makeManager(handle: 0x7FFF_FFF1, recorder: recorder)
+
+        let asyncLoad = Task { try await manager.loadFromPersistor() }
+        while recorder.bulkCount == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+
+        // Explicitly non-async closure type forces the SYNC overload —
+        // this async test body would otherwise resolve to the async one
+        // (SE-0296).
+        let syncLoad: () throws -> [ManagedPlatformWallet] = { try manager.loadFromPersistor() }
+        do {
+            _ = try syncLoad()
+            XCTFail("expected the sync overload to be rejected during an async load")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+        }
+
+        gate.signal()
+        _ = try await asyncLoad.value
+        XCTAssertEqual(
+            recorder.bulkCount, 1,
+            "only the admitted async load may reach the native call")
+    }
+
+    /// The SYNCHRONOUS overload must also be rejected during the shutdown
+    /// drain window, where the handle is intentionally still live for the
+    /// admitted async op while the MainActor is reentrant at the drain's
+    /// await.
+    func testSyncLoadIsRejectedDuringShutdownDrain() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = LoadRecorder(walletIds: [id(6)], gate: gate)
+        let manager = makeManager(handle: 0x7FFF_FFF2, recorder: recorder)
+
+        let asyncLoad = Task { try await manager.loadFromPersistor() }
+        while recorder.bulkCount == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+        let shutdownTask = Task { await manager.shutdown() }
+        try await Task.sleep(for: .milliseconds(20))
+        XCTAssertEqual(manager.handle, 0x7FFF_FFF2, "drain must hold the handle live")
+
+        let syncLoad: () throws -> [ManagedPlatformWallet] = { try manager.loadFromPersistor() }
+        do {
+            _ = try syncLoad()
+            XCTFail("expected the sync overload to be rejected during the drain")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+        }
+
+        gate.signal()
+        _ = try await asyncLoad.value
+        _ = await shutdownTask.value
+        XCTAssertEqual(recorder.bulkCount, 1)
+    }
+
+    /// `deleteWallet` is a synchronous native op too (native removal +
+    /// Keychain + SwiftData wipe): interleaved with an in-flight async
+    /// restore it could remove the native registration between the
+    /// restore's snapshot read and its publication, or wipe data the
+    /// loader then re-inserts. The shared admission gate rejects it before
+    /// ANY of its work runs.
+    func testDeleteWalletIsRejectedWhileAsyncLoadIsInFlight() async throws {
+        let gate = DispatchSemaphore(value: 0)
+        let recorder = LoadRecorder(walletIds: [id(7)], gate: gate)
+        let manager = makeManager(handle: 0x7FFF_FFF3, recorder: recorder)
+
+        let asyncLoad = Task { try await manager.loadFromPersistor() }
+        while recorder.bulkCount == 0 {
+            try await Task.sleep(for: .milliseconds(5))
+        }
+
+        do {
+            try manager.deleteWallet(walletId: id(7))
+            XCTFail("expected deleteWallet to be rejected during an async load")
+        } catch let error as PlatformWalletError {
+            guard case .invalidHandle = error else {
+                return XCTFail("expected invalidHandle, got \(error)")
+            }
+        }
+
+        gate.signal()
+        let restored = try await asyncLoad.value
+        XCTAssertEqual(
+            restored.map(\.walletId), [id(7)],
+            "the admitted restore must complete untouched by the rejected deletion")
+    }
+}
diff --git a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/TrackedMasternodeTests.swift b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/TrackedMasternodeTests.swift
index b9b93d6cbbe..531e1aebc27 100644
--- a/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/TrackedMasternodeTests.swift
+++ b/packages/swift-sdk/SwiftTests/SwiftDashSDKTests/TrackedMasternodeTests.swift
@@ -49,4 +49,46 @@ final class TrackedMasternodeTests: XCTestCase {
         XCTAssertEqual(rows.count, 2, "the same proTxHash may be tracked on both networks")
         XCTAssertEqual(Set(rows.compactMap(\.network)), [.mainnet, .testnet])
     }
+
+    @MainActor
+    func testTrackedWritesCommitOutsideAndSurviveChangesetRollback() throws {
+        let container = try ModelContainer(
+            for: PersistentTrackedMasternode.self,
+            configurations: ModelConfiguration(isStoredInMemoryOnly: true))
+        let handler = PlatformWalletPersistenceHandler(
+            modelContainer: container, network: .testnet)
+        let walletId = Data(repeating: 1, count: 32)
+        let hash = Data(repeating: 9, count: 32)
+        let row = PlatformWalletPersistenceHandler.TrackedMasternodeRow(
+            proTxHash: hash,
+            label: "survives",
+            addedAt: 42,
+            snapshotJSON: #"{"v":1}"#)
+
+        handler.beginChangeset(walletId: walletId)
+        XCTAssertTrue(handler.persistTrackedMasternodes(
+            networkRaw: Network.testnet.rawValue,
+            rows: [row]))
+        XCTAssertFalse(handler.endChangeset(walletId: walletId, success: false))
+
+        var verificationContext = ModelContext(container)
+        var persisted = try verificationContext.fetch(
+            FetchDescriptor<PersistentTrackedMasternode>())
+        XCTAssertEqual(persisted.count, 1)
+        XCTAssertEqual(persisted.first?.proTxHash, hash)
+        XCTAssertEqual(persisted.first?.label, "survives")
+
+        // Whole-set removal has the same independent durability guarantee.
+        handler.beginChangeset(walletId: walletId)
+        XCTAssertTrue(handler.persistTrackedMasternodes(
+            networkRaw: Network.testnet.rawValue,
+            rows: []))
+        XCTAssertFalse(handler.endChangeset(walletId: walletId, success: false))
+
+        verificationContext = ModelContext(container)
+        persisted = try verificationContext.fetch(
+            FetchDescriptor<PersistentTrackedMasternode>())
+        XCTAssertTrue(persisted.isEmpty)
+    }
+
 }
diff --git a/packages/token-history-contract/package.json b/packages/token-history-contract/package.json
index c68cb237dda..3bf842216a4 100644
--- a/packages/token-history-contract/package.json
+++ b/packages/token-history-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/token-history-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "The token history contract",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/wallet-lib/package.json b/packages/wallet-lib/package.json
index c241c4d1286..18762f485fa 100644
--- a/packages/wallet-lib/package.json
+++ b/packages/wallet-lib/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/wallet-lib",
-  "version": "11.2.0-dev.1",
+  "version": "11.2.0-dev.2",
   "description": "Light wallet library for Dash",
   "main": "src/index.js",
   "unpkg": "dist/wallet-lib.min.js",
diff --git a/packages/wallet-utils-contract/package.json b/packages/wallet-utils-contract/package.json
index 31fbd5f6fd3..8b29a24167f 100644
--- a/packages/wallet-utils-contract/package.json
+++ b/packages/wallet-utils-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/wallet-utils-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "A contract and helper scripts for Wallet DApp",
   "scripts": {
     "lint": "eslint .",
diff --git a/packages/wasm-dpp/package.json b/packages/wasm-dpp/package.json
index 57dc8406c81..d0dea1de3b1 100644
--- a/packages/wasm-dpp/package.json
+++ b/packages/wasm-dpp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/wasm-dpp",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "The JavaScript implementation of the Dash Platform Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/wasm-dpp/src/errors/consensus/consensus_error.rs b/packages/wasm-dpp/src/errors/consensus/consensus_error.rs
index 7a1b2245af5..33daad96a0e 100644
--- a/packages/wasm-dpp/src/errors/consensus/consensus_error.rs
+++ b/packages/wasm-dpp/src/errors/consensus/consensus_error.rs
@@ -62,7 +62,7 @@ use dpp::consensus::state::data_trigger::DataTriggerError::{
   DataTriggerConditionError, DataTriggerExecutionError, DataTriggerInvalidResultError,
 };
 use wasm_bindgen::{JsError, JsValue};
-use dpp::consensus::basic::data_contract::{ContestedUniqueIndexOnMutableDocumentTypeError, ContestedUniqueIndexWithUniqueIndexError, DataContractTokenConfigurationUpdateError, DecimalsOverLimitError, DuplicateKeywordsError, GroupExceedsMaxMembersError, GroupHasTooFewMembersError, GroupMemberHasPowerOfZeroError, GroupMemberHasPowerOverLimitError, GroupNonUnilateralMemberPowerHasLessThanRequiredPowerError, GroupPositionDoesNotExistError, GroupRequiredPowerIsInvalidError, GroupTotalPowerLessThanRequiredError, InvalidDescriptionLengthError, InvalidDocumentTypeRequiredSecurityLevelError, InvalidKeywordCharacterError, InvalidKeywordLengthError, InvalidTokenBaseSupplyError, InvalidTokenDistributionFunctionDivideByZeroError, InvalidTokenDistributionFunctionIncoherenceError, InvalidTokenDistributionFunctionInvalidParameterError, InvalidTokenDistributionFunctionInvalidParameterTupleError, InvalidTokenLanguageCodeError, InvalidTokenNameCharacterError, InvalidTokenNameLengthError, MainGroupIsNotDefinedError, NewTokensDestinationIdentityOptionRequiredError, NonContiguousContractGroupPositionsError, NonContiguousContractTokenPositionsError, RedundantDocumentPaidForByTokenWithContractId, TokenPaymentByBurningOnlyAllowedOnInternalTokenError, TooManyKeywordsError, UnknownDocumentActionTokenEffectError, UnknownDocumentCreationRestrictionModeError, UnknownGasFeesPaidByError, UnknownSecurityLevelError, UnknownStorageKeyRequirementsError, UnknownTradeModeError, UnknownTransferableTypeError};
+use dpp::consensus::basic::data_contract::{ContestedUniqueIndexOnMutableDocumentTypeError, DataContractInvalidRequiredFieldsUpdateError, ContestedUniqueIndexWithUniqueIndexError, DataContractTokenConfigurationUpdateError, DecimalsOverLimitError, DuplicateKeywordsError, GroupExceedsMaxMembersError, GroupHasTooFewMembersError, GroupMemberHasPowerOfZeroError, GroupMemberHasPowerOverLimitError, GroupNonUnilateralMemberPowerHasLessThanRequiredPowerError, GroupPositionDoesNotExistError, GroupRequiredPowerIsInvalidError, GroupTotalPowerLessThanRequiredError, InvalidDescriptionLengthError, InvalidDocumentTypeRequiredSecurityLevelError, InvalidKeywordCharacterError, InvalidKeywordLengthError, InvalidTokenBaseSupplyError, InvalidTokenDistributionFunctionDivideByZeroError, InvalidTokenDistributionFunctionIncoherenceError, InvalidTokenDistributionFunctionInvalidParameterError, InvalidTokenDistributionFunctionInvalidParameterTupleError, InvalidTokenLanguageCodeError, InvalidTokenNameCharacterError, InvalidTokenNameLengthError, MainGroupIsNotDefinedError, NewTokensDestinationIdentityOptionRequiredError, NonContiguousContractGroupPositionsError, NonContiguousContractTokenPositionsError, RedundantDocumentPaidForByTokenWithContractId, TokenPaymentByBurningOnlyAllowedOnInternalTokenError, TooManyKeywordsError, UnknownDocumentActionTokenEffectError, UnknownDocumentCreationRestrictionModeError, UnknownGasFeesPaidByError, UnknownSecurityLevelError, UnknownStorageKeyRequirementsError, UnknownTradeModeError, UnknownTransferableTypeError};
 use dpp::consensus::basic::document::{ContestedDocumentsTemporarilyNotAllowedError, DocumentCreationNotAllowedError, DocumentFieldMaxSizeExceededError, MaxDocumentsTransitionsExceededError, MissingPositionsInDocumentTypePropertiesError};
 use dpp::consensus::basic::group::GroupActionNotAllowedOnTransitionError;
 use dpp::consensus::basic::identity::{DataContractBoundsNotPresentError, DisablingKeyIdAlsoBeingAddedInSameTransitionError, InvalidIdentityCreditWithdrawalTransitionAmountError, InvalidIdentityUpdateTransitionDisableKeysError, InvalidIdentityUpdateTransitionEmptyError, InvalidKeyPurposeForContractBoundsError, TooManyMasterPublicKeyError, WithdrawalOutputScriptNotAllowedWhenSigningWithOwnerKeyError};
@@ -1005,6 +1005,9 @@ fn from_basic_error(basic_error: &BasicError) -> JsValue {
         BasicError::TokenPricingScheduleEmptyError(e) => {
             generic_consensus_error!(TokenPricingScheduleEmptyError, e).into()
         }
+        BasicError::DataContractInvalidRequiredFieldsUpdateError(e) => {
+            generic_consensus_error!(DataContractInvalidRequiredFieldsUpdateError, e).into()
+        }
     }
 }
 
diff --git a/packages/wasm-dpp2/package.json b/packages/wasm-dpp2/package.json
index a75c6ce343d..75846bb33d1 100644
--- a/packages/wasm-dpp2/package.json
+++ b/packages/wasm-dpp2/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/wasm-dpp2",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "type": "module",
   "main": "./dist/dpp.js",
   "types": "./dist/dpp.d.ts",
diff --git a/packages/wasm-dpp2/src/data_contract/document/model.rs b/packages/wasm-dpp2/src/data_contract/document/model.rs
index d447196c486..b49d54ff9a3 100644
--- a/packages/wasm-dpp2/src/data_contract/document/model.rs
+++ b/packages/wasm-dpp2/src/data_contract/document/model.rs
@@ -235,6 +235,7 @@ impl DocumentWasm {
         )?;
 
         let document = Document::V0(DocumentV0 {
+            contract_version: None,
             id: doc_id,
             owner_id,
             properties,
diff --git a/packages/wasm-drive-verify/package.json b/packages/wasm-drive-verify/package.json
index 13320e7d17d..5ce753bb1ea 100644
--- a/packages/wasm-drive-verify/package.json
+++ b/packages/wasm-drive-verify/package.json
@@ -3,7 +3,7 @@
   "collaborators": [
     "Dash Core Group <dev@dash.org>"
   ],
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "license": "MIT",
   "description": "WASM bindings for Drive verify functions",
   "repository": {
diff --git a/packages/wasm-drive-verify/src/document/verify_proof.rs b/packages/wasm-drive-verify/src/document/verify_proof.rs
index b3cbfbbf726..1cd189c9f3e 100644
--- a/packages/wasm-drive-verify/src/document/verify_proof.rs
+++ b/packages/wasm-drive-verify/src/document/verify_proof.rs
@@ -108,6 +108,13 @@ pub fn verify_document_proof(
         start_at: start_at_bytes,
         start_at_included,
         block_time_ms,
+        // KNOWN LIMITATION: this surface has no input for time-range
+        // (IN_TIME_RANGE) resolution provenance, so proofs the server
+        // produced for a time-range query cannot be verified here — with
+        // empty provenance every bucketed index is inadmissible and
+        // verification fails closed. Use the SDK's FromProof path (which
+        // resolves from the signed metadata time) for those proofs.
+        resolved_time_ranges: vec![],
     };
 
     let (root_hash, documents) = query
diff --git a/packages/wasm-drive-verify/src/document/verify_proof_keep_serialized.rs b/packages/wasm-drive-verify/src/document/verify_proof_keep_serialized.rs
index 5ff7f822cd0..53e73ac22ab 100644
--- a/packages/wasm-drive-verify/src/document/verify_proof_keep_serialized.rs
+++ b/packages/wasm-drive-verify/src/document/verify_proof_keep_serialized.rs
@@ -99,6 +99,13 @@ pub fn verify_document_proof_keep_serialized(
         start_at: start_at_bytes,
         start_at_included,
         block_time_ms,
+        // KNOWN LIMITATION: this surface has no input for time-range
+        // (IN_TIME_RANGE) resolution provenance, so proofs the server
+        // produced for a time-range query cannot be verified here — with
+        // empty provenance every bucketed index is inadmissible and
+        // verification fails closed. Use the SDK's FromProof path (which
+        // resolves from the signed metadata time) for those proofs.
+        resolved_time_ranges: vec![],
     };
 
     let (root_hash, serialized_docs) = query
diff --git a/packages/wasm-drive-verify/src/document/verify_start_at_document_in_proof.rs b/packages/wasm-drive-verify/src/document/verify_start_at_document_in_proof.rs
index 3141260706c..12559c18701 100644
--- a/packages/wasm-drive-verify/src/document/verify_start_at_document_in_proof.rs
+++ b/packages/wasm-drive-verify/src/document/verify_start_at_document_in_proof.rs
@@ -107,6 +107,13 @@ pub fn verify_start_at_document_in_proof(
         start_at: start_at_bytes,
         start_at_included,
         block_time_ms,
+        // KNOWN LIMITATION: this surface has no input for time-range
+        // (IN_TIME_RANGE) resolution provenance, so proofs the server
+        // produced for a time-range query cannot be verified here — with
+        // empty provenance every bucketed index is inadmissible and
+        // verification fails closed. Use the SDK's FromProof path (which
+        // resolves from the signed metadata time) for those proofs.
+        resolved_time_ranges: vec![],
     };
 
     let (root_hash, document_option) = query
diff --git a/packages/wasm-sdk/package.json b/packages/wasm-sdk/package.json
index 368411c5bd7..9a8535defce 100644
--- a/packages/wasm-sdk/package.json
+++ b/packages/wasm-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/wasm-sdk",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "type": "module",
   "main": "./dist/sdk.js",
   "types": "./dist/sdk.d.ts",
diff --git a/packages/wasm-sdk/src/dpns.rs b/packages/wasm-sdk/src/dpns.rs
index d1c7099b5b7..c2f0677b4f7 100644
--- a/packages/wasm-sdk/src/dpns.rs
+++ b/packages/wasm-sdk/src/dpns.rs
@@ -277,6 +277,7 @@ impl WasmSdk {
                 operator: WhereOperator::Equal,
                 value: Value::Identifier(identity_id.to_buffer()),
             }],
+            time_range_clauses: vec![],
             group_by: vec![],
             having: vec![],
             order_by_clauses: vec![],
diff --git a/packages/wasm-sdk/src/queries/document.rs b/packages/wasm-sdk/src/queries/document.rs
index 55f4c06f92e..abc3b36fe82 100644
--- a/packages/wasm-sdk/src/queries/document.rs
+++ b/packages/wasm-sdk/src/queries/document.rs
@@ -11,7 +11,7 @@ use dash_sdk::platform::documents::document_history_query::DocumentHistoryQuery;
 use dash_sdk::platform::documents::document_query::DocumentQuery;
 use dash_sdk::platform::Fetch;
 use dash_sdk::platform::FetchMany;
-use drive::query::{OrderClause, WhereClause, WhereOperator};
+use drive::query::{OrderClause, TimeRangeGridSpec, TimeRangeSelector, WhereClause, WhereOperator};
 use drive_proof_verifier::types::DocumentHistory;
 use drive_proof_verifier::{DocumentSplitAverages, DocumentSplitCounts, DocumentSplitSums};
 use js_sys::{BigInt, Map};
@@ -119,6 +119,30 @@ export interface DocumentsQuery {
    * @default []
    */
   groupBy?: string[];
+
+  /**
+   * Time-range bucket selections for "trending"-style queries. Each entry
+   * picks a single bucket of a timestamp field covered by a `timeRange`
+   * index. The server resolves the bucket from the current block time and
+   * the proof verifier re-derives it from the signed response metadata, so
+   * the result is provable. Requires protocol version 14+ (the first
+   * version whose contract grammar hosts `timeRange` indexes).
+   *
+   * - `selector: "oldest"` → the oldest still-active range (a near-full
+   *   trailing window of ~`range`; best for "trending over the last window").
+   * - `selector: "newest"` → the freshest started range (latest partial slice).
+   *
+   * `grid` names one of the field's grids in the contract's own declared
+   * seconds (`{ range, step, phase? }`) — required when the contract buckets
+   * the field with more than one `timeRange` grid, where the bare selector
+   * is ambiguous and rejected. A zero phase is spelled by omission.
+   * @default []
+   */
+  timeRange?: {
+    field: string;
+    selector: "newest" | "oldest";
+    grid?: { range: number; step: number; phase?: number };
+  }[];
 }
 
 /**
@@ -195,6 +219,10 @@ struct DocumentsQueryInput {
     // `orderBy` field — the first clause's direction controls
     // split-mode entry ordering and `(In + prove)` walk order. No
     // separate `orderByAscending` knob.
+    /// Time-range bucket selections (`IN_TIME_RANGE`), each `{ field,
+    /// selector }`. v1-only; resolved server-side from block time.
+    #[serde(rename = "timeRange", default)]
+    time_range: Option<Vec<JsonValue>>,
 }
 
 #[derive(Deserialize)]
@@ -243,6 +271,7 @@ async fn build_documents_query(
         start_after,
         start_at,
         group_by: _,
+        time_range,
     } = input;
 
     let contract_id: Identifier = data_contract_id.into();
@@ -277,6 +306,16 @@ async fn build_documents_query(
         }
     }
 
+    if let Some(time_range_values) = time_range {
+        for clause_json in time_range_values.iter() {
+            let (field, selector, grid) = parse_time_range_clause(clause_json)?;
+            query = match grid {
+                Some(grid) => query.with_time_range_grid(field, selector, grid),
+                None => query.with_time_range(field, selector),
+            };
+        }
+    }
+
     if let Some(order_values) = order_by {
         for clause_json in order_values.iter() {
             let order_clause = parse_order_clause(clause_json)?;
@@ -456,6 +495,75 @@ fn parse_where_clause(json_clause: &JsonValue) -> Result<WhereClause, WasmSdkErr
     })
 }
 
+/// Parse a JSON time-range clause `{ field, selector, grid? }` for
+/// [`DocumentQuery::with_time_range`] / `with_time_range_grid`.
+///
+/// `grid` is `{ range, step, phase? }` in the contract's own declared
+/// seconds, naming one of the field's grids — required when the contract
+/// buckets the field with more than one `timeRange` grid (the bare selector
+/// is ambiguous there and the server rejects it). Like the contract grammar
+/// and the wire, a zero phase is spelled by omission.
+fn parse_time_range_clause(
+    json_clause: &JsonValue,
+) -> Result<(String, TimeRangeSelector, Option<TimeRangeGridSpec>), WasmSdkError> {
+    let object = json_clause.as_object().ok_or_else(|| {
+        WasmSdkError::invalid_argument(
+            "timeRange clause must be an object { field, selector, grid? }",
+        )
+    })?;
+    let field = object
+        .get("field")
+        .and_then(JsonValue::as_str)
+        .ok_or_else(|| {
+            WasmSdkError::invalid_argument("timeRange clause requires a string `field`")
+        })?
+        .to_string();
+    let selector = object
+        .get("selector")
+        .and_then(JsonValue::as_str)
+        .and_then(TimeRangeSelector::from_string)
+        .ok_or_else(|| {
+            WasmSdkError::invalid_argument(
+                "timeRange clause `selector` must be \"newest\" or \"oldest\"",
+            )
+        })?;
+    let grid = match object.get("grid") {
+        None | Some(JsonValue::Null) => None,
+        Some(grid_json) => {
+            let grid_object = grid_json.as_object().ok_or_else(|| {
+                WasmSdkError::invalid_argument(
+                    "timeRange clause `grid` must be an object { range, step, phase? } in \
+                     the contract's declared seconds",
+                )
+            })?;
+            let grid_number = |key: &str| -> Result<u64, WasmSdkError> {
+                grid_object
+                    .get(key)
+                    .and_then(JsonValue::as_u64)
+                    .ok_or_else(|| {
+                        WasmSdkError::invalid_argument(format!(
+                            "timeRange clause `grid.{}` must be an unsigned integer of seconds, \
+                         exactly as the contract declares it",
+                            key
+                        ))
+                    })
+            };
+            let range_seconds = grid_number("range")?;
+            let step_seconds = grid_number("step")?;
+            let phase_seconds = match grid_object.get("phase") {
+                None | Some(JsonValue::Null) => 0,
+                Some(_) => grid_number("phase")?,
+            };
+            Some(TimeRangeGridSpec {
+                range_seconds,
+                step_seconds,
+                phase_seconds,
+            })
+        }
+    };
+    Ok((field, selector, grid))
+}
+
 /// Parse JSON order by clause into OrderClause
 fn parse_order_clause(json_clause: &JsonValue) -> Result<OrderClause, WasmSdkError> {
     let clause_array = json_clause
@@ -1037,3 +1145,117 @@ fn split_averages_to_js_map(splits: Option<DocumentSplitAverages>) -> Result<Map
     }
     Ok(map)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    /// This parser is the only boundary turning the public JavaScript
+    /// `{ field, selector, grid? }` shape into a typed time-range clause —
+    /// native and protobuf tests construct their queries after it, so a
+    /// parser that dropped the grid or mis-typed a member would not fail
+    /// them. Pin every branch here.
+    #[test]
+    fn parses_a_bare_selector_without_a_grid() {
+        let (field, selector, grid) =
+            parse_time_range_clause(&json!({ "field": "$createdAt", "selector": "newest" }))
+                .expect("the bare shape parses");
+        assert_eq!(field, "$createdAt");
+        assert_eq!(selector, TimeRangeSelector::Newest);
+        assert_eq!(grid, None, "no grid member means the field's sole grid");
+    }
+
+    #[test]
+    fn parses_a_grid_with_zero_phase_spelled_by_omission() {
+        let (_, selector, grid) = parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "oldest",
+            "grid": { "range": 21_600, "step": 7_200 },
+        }))
+        .expect("the grid shape parses");
+        assert_eq!(selector, TimeRangeSelector::Oldest);
+        assert_eq!(
+            grid,
+            Some(TimeRangeGridSpec {
+                range_seconds: 21_600,
+                step_seconds: 7_200,
+                phase_seconds: 0,
+            }),
+            "an omitted (or null) phase is the canonical zero"
+        );
+    }
+
+    #[test]
+    fn parses_a_grid_with_an_explicit_phase() {
+        let (_, _, grid) = parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": { "range": 86_400, "step": 86_400, "phase": 3_600 },
+        }))
+        .expect("the phased grid shape parses");
+        assert_eq!(
+            grid,
+            Some(TimeRangeGridSpec {
+                range_seconds: 86_400,
+                step_seconds: 86_400,
+                phase_seconds: 3_600,
+            })
+        );
+    }
+
+    #[test]
+    fn rejects_an_invalid_selector() {
+        parse_time_range_clause(&json!({ "field": "$createdAt", "selector": "latest" }))
+            .expect_err("only \"newest\" and \"oldest\" are selectors");
+    }
+
+    #[test]
+    fn rejects_a_missing_field() {
+        parse_time_range_clause(&json!({ "selector": "newest" }))
+            .expect_err("the field is required");
+    }
+
+    #[test]
+    fn rejects_a_malformed_grid() {
+        // not an object
+        parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": [21_600, 7_200],
+        }))
+        .expect_err("a grid must be an object");
+        // missing step
+        parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": { "range": 21_600 },
+        }))
+        .expect_err("range and step are both required");
+    }
+
+    #[test]
+    fn rejects_non_unsigned_grid_members() {
+        // negative — the contract's declared units are unsigned seconds
+        parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": { "range": -21_600, "step": 7_200 },
+        }))
+        .expect_err("a negative range is not a contract-declared value");
+        // fractional — sub-second grids don't exist in the grammar
+        parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": { "range": 21_600, "step": 7_200.5 },
+        }))
+        .expect_err("a fractional step is not a contract-declared value");
+        // fractional phase through the optional member
+        parse_time_range_clause(&json!({
+            "field": "$createdAt",
+            "selector": "newest",
+            "grid": { "range": 21_600, "step": 7_200, "phase": 0.5 },
+        }))
+        .expect_err("a fractional phase is not a contract-declared value");
+    }
+}
diff --git a/packages/withdrawals-contract/package.json b/packages/withdrawals-contract/package.json
index 25fe4d1e464..a2eabad8e34 100644
--- a/packages/withdrawals-contract/package.json
+++ b/packages/withdrawals-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dashevo/withdrawals-contract",
-  "version": "4.2.0-dev.1",
+  "version": "4.2.0-dev.2",
   "description": "Data Contract to manipulate and track withdrawals",
   "scripts": {
     "build": "",