feat(platform)!: destroy a frozen identity's escrowed listings with its funds (PV15)

CHANGELOG.md

@@ -104,6 +104,21 @@
   gains `DataContractCompiledMaxSizeExceededError` and `ProtocolValidationOperation`
   gains `ContractCompiledSizeValidation`, so struct literals and exhaustive matches
   need them. See [#5579](https://github.com/dashpay/platform/pull/5579).
+- **drive (Rust API migration):** destroying a frozen identity's funds also destroys
+  its escrowed token listings from protocol version 15.
+  `TokenTransitionAction::associated_token_event` takes `&PlatformVersion` and returns
+  `Result<TokenEvent, Error>`. `TokenDestroyFrozenFundsTransitionActionV0` gains
+  `escrowed_listings` and `token_market_contract`; struct literals set them to an empty
+  `Vec` and `None` before protocol version 15. `DocumentOperationType` gains
+  `DeleteDocuments` and `TokenOperationType` gains `TokenDestroyFrozenHolding`; neither
+  enum is `#[non_exhaustive]`, so exhaustive matches need new arms. See
+  [#5532](https://github.com/dashpay/platform/pull/5532).
+- **platform-version (Rust API migration):** `DriveTokenOrderEscrowMethodVersions` gains
+  `fetch_frozen_listings` (`None` before protocol version 15, `Some(0)` from 15) and
+  `SystemLimits` gains `max_frozen_listings_destroyed_per_transition` (16 in every table;
+  nothing before protocol version 15 reads it). Struct literals of either, such as a
+  custom or test `PlatformVersion`, need the new field. See
+  [#5532](https://github.com/dashpay/platform/pull/5532).
 
 ### [5.0.1](https://github.com/dashpay/platform/compare/v5.0.0...v5.0.1) (2026-10-27)
 

book/src/data-model/token-marketplace.md

@@ -232,6 +232,22 @@ that the escrow is what the offer holds after its sales (`TokenOrder::escrow_aft
 is worth at its decimals, rounded up, less what its sellers were paid). A `TokenFillBid` is proven
 by the seller's token balance.
 
+## Frozen accounts
+
+A frozen account's open listings cannot be filled, and the tokens they hold sit in escrow, out of
+the frozen balance. From protocol version 15 a `TokenDestroyFrozenFunds` destroys them with the
+balance: it reads the frozen identity's open listings of the token, oldest first, at most
+`max_frozen_listings_destroyed_per_transition` (16), destroys what they hold in escrow, deletes
+their `ask` documents and records the whole amount destroyed in its `destroyFrozenFunds` history
+document. A frozen identity with more listings needs one more destroy per 16. Its offers hold
+credits, which are not the token's to destroy, and stay; it can still withdraw them.
+
+```text
+Frozen identity: balance 5,000, listings of 3,000 and 2,000
+Before (protocol version 14 rules): the destroy burns 5,000; the 5,000 in escrow stays
+From protocol version 15:           the destroy burns all 10,000 and deletes both listings
+```
+
 ## History
 
 A token that keeps transfer history (`keepsHistory.keepsTransferHistory`, the default) also