Track remaining devnet audit server fixes for v5.1 (PV15) #5410

The remaining server-side consensus remedies from the Platform v5 Sakura audit are scheduled for v5.1 / PV15, following Ivan’s decision on 2026-10-13. They are deferred work, not fixed findings.

Source assessment baseline: 5cbe01e8689d76dbaf6aae7a1cb706644800c0fe. Paths were rechecked; original runtime reproductions were not all rerun. Revalidate each finding on the implementation baseline before fixing it.

Deferred server work

• F-1: sponsored MAX action fee reaches internal balance overflow before sponsor-budget refusal; define and implement the correct consensus refusal/fee behavior.
• B1: align the nonce-window boundary exactly 24 behind between DPP validation and Drive application.
• ID-3: IdentityUpdate key validation, including uniqueness across unique and non-unique key tables and correct failure handling.
• L22 / ID-5: enforce the intended MASTER-key rotation rule on add-only IdentityUpdate calls.
• ID-4: settle and implement missing-recipient credit-transfer admission, fee and nonce handling; reuse existing IdentityCreditTransfer to a non-existent recipientId passes check_tx and stays in the mempool, blocking the sender's nonce slot #4624 rather than duplicate it.
• R1: repair the mismatch between Permanent reference guarantees and keyword-target removal; distinguish query recovery from consensus prevention and existing-state handling.
• R2: preserve intended reference-kind semantics across keep-history deletion repair; account for existing declarations.
• MO-U3: settle no-op replace / same-price update behavior and its effect on updatedAt and deleteWithin.
• A3: revalidate remaining ordinary aggregate overflow and undeletable-document cases, then implement the agreed remedy. Current residual reproduction and automatic-maintenance reachability are not certified.
• ID-1: DPNS owner binding, tracked by the PV15 redesign in feat(platform)!: dpns contract v3 checks name registration with schema keywords (PV15) #5337.
• A2: remaining unsigned index ordering and migration coverage, tracked by Fix unsigned index key order for high values #5338 (partial fix fix(platform)!: key unsigned integer index values in value order #5350 is already merged).
• Sponsor-owned storage/refunds: fix(platform)!: refund sponsor-paid document storage to the gas sponsor #5238.
• Declarative DashPay contact-request checks: feat(platform)!: dashpay contact requests declare their checks #4933.

Protocol boundary and delivery

• Target the v5.1 line and select consensus changes through PV15; preserve stable and testnet/mainnet-activated versions.
• A milestone change alone does not version an implementation. In the inspected heads, fix(platform)!: refund sponsor-paid document storage to the gas sponsor #5238 and feat(platform)!: dashpay contact requests declare their checks #4933 still changed generations selected by PV14; reconcile their bases and adapt dispatch/schema/migration selection before delivery. Do not merge those inspected implementations into v5.0 on the strength of this scheduling decision.
• Each item still needs a current-code reproducer, reviewed scope, failing-then-passing regression, and code review. Scheduling does not approve an unresolved domain choice or close a finding.
• Current cap-one-preserving nullifier protection and SDK/query-only work continue separately; this issue does not defer them.

Separate activation checks

Deferring these fixes is not an activation-safety certificate. Keep A3 liveness investigation and the chosen v5.0 candidate’s migration/mandatory epoch-processing verification separate. Escalate any demonstrated chain-halt path before activation rather than silently accepting it through this milestone. The previously identified TTL/contest overflow prevention (#5316) and missing-proposer-identity payout fix (#5399) are already merged; they are not deferred by this issue.