fix(platform-wallet-ffi)!: move ErrorShieldedInviteAlreadyClaimed 32 -> 37 and mirror it (#4204)

32 is allocated to `ErrorTransactionBuild` (#4247, also
carried by #4256) in ERROR_CODE_REGISTRY.md (#4261). This variant took 32
without a registry row, so the two collide as a hard `E0081: discriminant
value 32 assigned more than once` the moment both land — reproduced on a
real integration merge, not hypothetical. 27-36 are all claimed (27
ErrorShutdownIncomplete via the merged #4268; 29 #4184; 31 #4183; 32/33
#4247/#4256; 34-36 the #4185 trio) and 28/30 are vacated-but-RESERVED, so
37 is the allocation frontier.

The code was also unmirrored on BOTH hosts, which is the more dangerous
half: Swift is exhaustive, so it surfaced as .errorUnknown and lost its
identity; Kotlin fell through to Generic(32), and in any tree carrying
#4185's ErrorReservationWalletMismatch = 32 it actively MISCLASSIFIED
"shielded invite already claimed" as "reservation wallet mismatch". That
matters on the claim-recovery path specifically — the error is raised from
four sites in shielded/operations.rs, three inside the recovery function.

Adds the typed Kotlin PlatformWallet.ShieldedInviteAlreadyClaimed (terminal,
inherited isRetryable = false), the Swift enum case + init(ffi:) arm, a
DashSdkErrorTest assertion pinning 37, and refreshes the stale Swift
reservation comment the registry asked the next toucher to drop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bfoss765

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/errors/DashSdkError.kt

@@ -239,6 +239,25 @@ sealed class DashSdkError(
         class NotFound(message: String, cause: Throwable? = null) :
             PlatformWallet(message, cause)
 
+        /**
+         * `ErrorShieldedInviteAlreadyClaimed` (native code 37). A one-time-key
+         * (shielded invitation) claim found the invitation note's nullifier
+         * already spent on chain, and could NOT produce positive evidence that
+         * this claim's Type-20 transition created an identity — the spend was
+         * finalized to the creation-failure address, or another holder of the
+         * same bearer one-time key won the race, or the id is not re-derivable.
+         *
+         * TERMINAL and NOT retryable (the inherited [isRetryable] `false`):
+         * the note is consumed, so no retry can spend it again. Distinct from
+         * [ShieldedCreateUnconfirmed], which means "executed, not yet
+         * resolvable, hold the slot". No identity id is produced — this wallet
+         * has no identity to hold a slot for, and claiming one would be the
+         * false-ownership assertion this code exists to prevent. Hosts should
+         * surface the invitation as spent rather than registering an identity.
+         */
+        class ShieldedInviteAlreadyClaimed(message: String, cause: Throwable? = null) :
+            PlatformWallet(message, cause)
+
         /**
          * Any other `PlatformWalletFFIResultCode` without a dedicated type.
          * Carries the platform-wallet [nativeCode] (already de-offset) and
@@ -351,6 +370,10 @@ sealed class DashSdkError(
             // sniffing involved. (Codes 26-30 are reserved by sibling PRs
             // #4185 / #4184 — see PlatformWalletFFIResultCode.)
             31 -> PlatformWallet.SigningKeyUnavailable(message, cause)
+            // ErrorShieldedInviteAlreadyClaimed. Allocated 37 (not 32, which
+            // belongs to ErrorTransactionBuild — dashpay/platform#4247/#4256);
+            // see packages/rs-platform-wallet-ffi/ERROR_CODE_REGISTRY.md.
+            37 -> PlatformWallet.ShieldedInviteAlreadyClaimed(message, cause)
             else ->
                 // @Deprecated fallback — see the code-6 arm; code 31 is the
                 // real discriminator.

packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/errors/DashSdkErrorTest.kt

@@ -90,6 +90,19 @@ class DashSdkErrorTest {
         // The message must warn against retrying, like the broadcast sibling.
         assertTrue(spendUnconfirmed.message!!.contains("do NOT retry"))
 
+        // Code 37, NOT 32: 32 is ErrorTransactionBuild (dashpay/platform#4247,
+        // #4256). This assertion is the mirror's guard against the collision —
+        // if the Rust discriminant is ever moved back onto a claimed number,
+        // the host silently reclassifies an already-claimed invite as some
+        // other branch's error. See ERROR_CODE_REGISTRY.md (#4261).
+        val inviteClaimed =
+            DashSdkError.fromNative(DashSDKException(offset + 37, "nullifier already spent"))
+        assertTrue(inviteClaimed is DashSdkError.PlatformWallet.ShieldedInviteAlreadyClaimed)
+        assertFalse(
+            "ShieldedInviteAlreadyClaimed is TERMINAL — the note is consumed",
+            inviteClaimed.isRetryable,
+        )
+
         val broadcastUnconfirmed =
             DashSdkError.fromNative(DashSDKException(offset + 20, "ambiguous broadcast"))
         assertTrue(

packages/rs-platform-wallet-ffi/src/error.rs

@@ -214,8 +214,15 @@ pub enum PlatformWalletFFIResultCode {
     /// this code exists to prevent. Hosts should surface the invitation as spent
     /// rather than registering any identity.
     ///
-    /// Code 32: 27-30 stay reserved for the in-flight branches noted above.
-    ErrorShieldedInviteAlreadyClaimed = 32,
+    /// Code 37 — the next free integer per the allocation frontier in
+    /// `ERROR_CODE_REGISTRY.md` (dashpay/platform#4261). This variant briefly
+    /// held 32, which is allocated to `ErrorTransactionBuild`
+    /// (dashpay/platform#4247, also carried by #4256); the two collided as an
+    /// `E0081` the moment both were merged. 27-36 are all claimed (27
+    /// `ErrorShutdownIncomplete`, merged via #4268; 29 #4184; 31 #4183; 32/33
+    /// #4247/#4256; 34-36 the #4185 deferred-token trio), and 28/30 are vacated
+    /// but RESERVED, so 37 is the only correct allocation.
+    ErrorShieldedInviteAlreadyClaimed = 37,
 
     NotFound = 98, // Used exclusively for all the Option that are retuned as errors
     ErrorUnknown = 99,

packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletResult.swift

@@ -70,15 +70,30 @@ public enum PlatformWalletResultCode: Int32, Sendable {
     /// released and a corrected transaction may be submitted again.
     case errorTransactionBroadcastRejected = 26
     // Raw value 26 above (errorTransactionBroadcastRejected) landed on
-    // v4.1-dev. Raw values 27-28 remain reserved for the deferred-payment
-    // reservation-token errors (dashpay/platform#4185, which must renumber off
-    // 26) and 29/30 for the asset-lock funding errors
-    // (dashpay/platform#4184) on sibling branches.
+    // v4.1-dev. 27-36 are claimed by sibling branches and MUST NOT be reused
+    // here: 27 errorShutdownIncomplete (dashpay/platform#4268, merged), 29 the
+    // asset-lock funding shortfall (#4184), 31 below (#4183), 32/33
+    // errorTransactionBuild / errorTransactionSigning (#4247/#4256), 34-36 the
+    // deferred-payment reservation-token trio (#4185). 28 and 30 are vacated
+    // but RESERVED. These raw values MUST match `PlatformWalletFFIResultCode`
+    // in packages/rs-platform-wallet-ffi/src/error.rs — there is no
+    // compile-time check across the ABI. See ERROR_CODE_REGISTRY.md (#4261).
     /// A state transition could not be signed because the signer has no
     /// usable private key for the requested public key — restored from the
     /// structured signer completion code (dashpay/platform#4060 finding 7).
     /// Route to key repair; not retryable as-is.
     case errorSigningKeyUnavailable = 31
+    /// A one-time-key (shielded invitation) claim found the invitation note's
+    /// nullifier already spent on chain, with no positive evidence that this
+    /// claim created an identity. TERMINAL and NOT retryable — the note is
+    /// consumed, so no retry can spend it again, and no identity id is
+    /// produced. Surface the invitation as spent.
+    ///
+    /// Raw value 37 is the allocation frontier from ERROR_CODE_REGISTRY.md
+    /// (dashpay/platform#4261): 32 belongs to `errorTransactionBuild`
+    /// (#4247/#4256), 34-36 to the #4185 deferred-token trio, and 28/30 are
+    /// vacated-but-reserved.
+    case errorShieldedInviteAlreadyClaimed = 37
     case notFound = 98
     case errorUnknown = 99
 
@@ -140,6 +155,8 @@ public enum PlatformWalletResultCode: Int32, Sendable {
             self = .errorTransactionBroadcastRejected
         case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_SIGNING_KEY_UNAVAILABLE:
             self = .errorSigningKeyUnavailable
+        case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_SHIELDED_INVITE_ALREADY_CLAIMED:
+            self = .errorShieldedInviteAlreadyClaimed
         case PLATFORM_WALLET_FFI_RESULT_CODE_NOT_FOUND:
             self = .notFound
         case PLATFORM_WALLET_FFI_RESULT_CODE_ERROR_UNKNOWN: