feat(platform-wallet): prepare a ProUpServTx without broadcasting it

[QuantumExplorer]

What

Lets a host show an unban transaction before it is sent. Follow-up to #4507, which built, signed and broadcast in a single call, leaving no way to obtain the transaction for review.

How

• prepare_masternode_update_service runs every preflight, the payload, the funding, the operator-BLS signature and the input signatures, and stops at a signed transaction whose inputs stay reserved. execute_masternode_update_service is now exactly that plus the broadcast — existing behavior and tests unchanged. A preview built from the result therefore cannot drift from what gets broadcast, because it is what gets broadcast.
• Two additive FFI entry points (..._masternode_prepare_update_service, ..._tracked_masternode_prepare_update_service) register the prepared transaction in the existing CORE_SIGNED_TRANSACTION_STORAGE, so the host reuses the already-shipped handle verbs rather than getting new ones: core_wallet_broadcast_signed_transaction, core_wallet_abandon_signed_transaction, core_wallet_signed_transaction_fee / _bytes. Freeing a handle abandons and releases the reservation, so a host that simply drops a preview cannot strand inputs.
• Swift returns the same FinalizedCoreTransaction ownership token the ordinary send path already uses, so broadcasting a reviewed transaction goes through the host's existing accepted/rejected/unknown classification. Only the raw handle crosses the task boundary; the owning token is constructed on the caller's side so a thrown error can't strand it.
• The tracked operator-key parsing is promoted to a shared helper rather than copied into the new extern, and the params marshalling is shared between the broadcast and prepare runners.

Tests / verification

• The orchestrator test now asserts the prepared transaction is not broadcast (recording broadcaster empty), then broadcasts it separately and re-checks the payload, the inputs_hash binding and the verified BLS signature.
• New FFI test: both prepare externs return ErrorInvalidHandle for an unknown manager and leave out_transaction_handle at the null handle, so a host can never broadcast a stale handle after a failure.
• cargo fmt, clippy -D warnings on both crates, platform-wallet-ffi 318 passed, platform-wallet 948 passed with the one pre-existing v4.2-dev failure (regression_reports_max_from_usable_suffix_not_total_account_balance, the feat(dpp)!: rebalance the shielded fee constants for protocol 14 #4467 fixture — unrelated and untouched here), and build_ios.sh --target sim succeeds end to end.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 156fee3c-5a3b-4543-b42a-e38b25fe7fbd

📥 Commits

Reviewing files that changed from the base of the PR and between 52e8d4e and 7573288.

📒 Files selected for processing (5)

• packages/rs-platform-wallet-ffi/src/masternode_update_service.rs
• packages/rs-platform-wallet/src/masternode/mod.rs
• packages/rs-platform-wallet/src/masternode/update_service.rs
• packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerMasternodes.swift
• packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerTrackedMasternodes.swift

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}