fix(platform-wallet): rescan DashPay contact accounts from the contact request height

packages/rs-platform-encryption/src/account_reference.rs

@@ -1,5 +1,20 @@
 //! DIP-15 `accountReference` (masked account index).
 
+/// Bit position of the rotation `version` in a masked `accountReference`:
+/// the top 4 bits carry the version, the low 28 bits the masked account index.
+pub const ACCOUNT_REFERENCE_VERSION_SHIFT: u32 = 28;
+
+/// Mask selecting the low 28 bits (the masked account index) of an
+/// `accountReference`; the complement of the version bits.
+const ACCOUNT_INDEX_MASK: u32 = (1 << ACCOUNT_REFERENCE_VERSION_SHIFT) - 1;
+
+/// Rotation `version` of a masked `accountReference`. Unlike
+/// [`unmask_account_reference`] it needs no secret: the version bits are not
+/// masked, so any party can tell whether a request is a re-key (`version > 0`).
+pub const fn account_reference_version(account_reference: u32) -> u32 {
+    account_reference >> ACCOUNT_REFERENCE_VERSION_SHIFT
+}
+
 /// `ASK28 = (HMAC-SHA256(sender_secret_key, compact_xpub))[28..32] big-endian >> 4`.
 ///
 /// HMAC input is the 69-byte DIP-15 compact form (the `encryptedPublicKey`
@@ -45,8 +60,8 @@ pub fn calculate_account_reference(
     version: u32,
 ) -> u32 {
     let ask28 = account_secret_key_28(sender_secret_key, compact_xpub);
-    let shortened_account_bits = account_index & 0x0FFF_FFFF;
-    let version_bits = version << 28;
+    let shortened_account_bits = account_index & ACCOUNT_INDEX_MASK;
+    let version_bits = version << ACCOUNT_REFERENCE_VERSION_SHIFT;
     version_bits | (ask28 ^ shortened_account_bits)
 }
 
@@ -60,8 +75,8 @@ pub fn unmask_account_reference(
     compact_xpub: &[u8],
 ) -> (u32, u32) {
     let ask28 = account_secret_key_28(sender_secret_key, compact_xpub);
-    let version = account_reference >> 28;
-    let account_index = (account_reference & 0x0FFF_FFFF) ^ ask28;
+    let version = account_reference_version(account_reference);
+    let account_index = (account_reference & ACCOUNT_INDEX_MASK) ^ ask28;
     (version, account_index)
 }
 
@@ -81,15 +96,15 @@ mod tests {
         let secret_key = [1u8; 32];
         let compact = test_compact_xpub();
         assert_eq!(
-            calculate_account_reference(&secret_key, &compact, 0, 0) >> 28,
+            account_reference_version(calculate_account_reference(&secret_key, &compact, 0, 0)),
             0
         );
         assert_eq!(
-            calculate_account_reference(&secret_key, &compact, 0, 1) >> 28,
+            account_reference_version(calculate_account_reference(&secret_key, &compact, 0, 1)),
             1
         );
         assert_eq!(
-            calculate_account_reference(&secret_key, &compact, 0, 15) >> 28,
+            account_reference_version(calculate_account_reference(&secret_key, &compact, 0, 15)),
             15
         );
     }
@@ -123,13 +138,13 @@ mod tests {
 
         let reference = calculate_account_reference(&secret_key, &compact, 0, 0);
         assert_eq!(
-            reference & 0x0FFF_FFFF,
+            reference & ACCOUNT_INDEX_MASK,
             expected_ask28,
             "ASK28 must be digest bytes [28..32] big-endian >> 4 (iOS dash-shared-core)"
         );
         let old_ask28 = u32::from_be_bytes([digest[0], digest[1], digest[2], digest[3]]) >> 4;
         assert_ne!(
-            reference & 0x0FFF_FFFF,
+            reference & ACCOUNT_INDEX_MASK,
             old_ask28,
             "head-of-digest extraction is the old bug"
         );

packages/rs-platform-encryption/src/lib.rs

@@ -24,7 +24,10 @@ mod ecdh;
 mod error;
 
 pub use account_label::{decrypt_account_label, encrypt_account_label};
-pub use account_reference::{calculate_account_reference, unmask_account_reference};
+pub use account_reference::{
+    account_reference_version, calculate_account_reference, unmask_account_reference,
+    ACCOUNT_REFERENCE_VERSION_SHIFT,
+};
 pub use aes::{decrypt_aes_256_cbc, encrypt_aes_256_cbc};
 pub use compact_xpub::{
     compact_xpub_bytes, decrypt_extended_public_key, encrypt_extended_public_key,

packages/rs-platform-wallet/src/changeset/dashpay_backfill.rs

@@ -36,8 +36,8 @@ use super::{PersistenceCapabilities, PlatformWalletPersistence};
 /// was recorded — the earliest height whose block the scanner is guaranteed to
 /// test against this contact's addresses. It is stored per contact rather than
 /// as one wallet-wide floor because a contact's checkpoint can *drop* after it
-/// was covered (the reciprocal request turns out to be older than ours, or a
-/// rotation falls back to wallet birth): a wallet-wide floor would then read
+/// was covered (an older outgoing publication becomes known, or a rotation
+/// falls back to wallet birth): a wallet-wide floor would then read
 /// as "still covered" for blocks the scan never tested with that contact.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]

packages/rs-platform-wallet/src/manager/dashpay_sync.rs

@@ -485,9 +485,9 @@ impl DashPaySyncManager {
         // Local-only: DIP-15 §12.6 coreHeight backfill — lower SPV synced_height
         // to re-scan for incoming payments that landed on a contact's receival
         // address before it was watched (restore-from-seed / 2nd device /
-        // offline-accept→pay). After the reconcile above so newly established
-        // receival accounts are visible; a per-contact guard prevents
-        // re-triggering and thrashing the in-flight backfill.
+        // offline-accept→pay). After the reconcile above so newly registered
+        // receival accounts (sent or established) are visible; a per-contact
+        // guard prevents re-triggering and thrashing the in-flight backfill.
         if let Err(e) = identity.dashpay().reconcile_dashpay_rescan().await {
             tracing::warn!(
                 wallet_id = %hex::encode(wallet_id),