fix(drive): bind and bound proof decoding

.github/workflows/kotlin-sdk-build.yml

@@ -170,13 +170,10 @@ jobs:
 
             # Unlock the keyguard. With the screen kept on above, the device now
             # stays unlocked for the whole run instead of re-locking.
-            adb shell input keyevent KEYCODE_WAKEUP
-            adb shell wm dismiss-keyguard
-            sleep 5
-
-            # Fail loudly if the device is still locked, so a spurious
-            # InvalidKeyException can't masquerade as a real test failure.
-            adb shell dumpsys trust | grep -q 'deviceLocked=0' || { echo "::error::Emulator is still locked (deviceLocked=1); Keystore-backed tests would fail spuriously."; adb shell dumpsys trust; exit 1; }
+            # Credential acceptance and keyguard dismissal can race during a
+            # cold emulator boot. Retry the complete sequence atomically, then
+            # fail loudly before tests if the device never reaches unlocked.
+            for attempt in 1 2 3; do adb shell input keyevent KEYCODE_WAKEUP; adb shell wm dismiss-keyguard; adb shell input text 1234; adb shell input keyevent KEYCODE_ENTER; sleep 2; adb shell wm dismiss-keyguard; sleep 1; adb shell dumpsys trust | grep -q 'deviceLocked=0' && exit 0; done; echo "::error::Emulator is still locked (deviceLocked=1); Keystore-backed tests would fail spuriously."; adb shell dumpsys trust; exit 1
 
             ./gradlew :sdk:connectedDebugAndroidTest --stacktrace
 

.github/workflows/tests-rs-workspace.yml

@@ -14,7 +14,7 @@ jobs:
       github.event_name != 'pull_request'
       || github.event.pull_request.head.repo.full_name == github.repository
       || github.event.pull_request.head.repo.owner.login == 'thepastaclaw'
-    timeout-minutes: 30
+    timeout-minutes: 90
     steps:
       - name: Check out repo
         uses: actions/checkout@v4
@@ -238,7 +238,16 @@ jobs:
         run: |
           if [ -d target/llvm-cov-target ]; then
             du -sh target/llvm-cov-target || true
-            rm -rf target/llvm-cov-target
+            for attempt in 1 2 3; do
+              if rm -rf target/llvm-cov-target; then
+                break
+              fi
+              echo "::warning::Coverage cleanup attempt ${attempt} failed; retrying"
+              sleep 2
+            done
+            if [ -d target/llvm-cov-target ]; then
+              echo "::warning::Coverage artifacts could not be fully removed"
+            fi
           fi
           du -sh target 2>/dev/null || true
 

packages/rs-drive/src/drive/saved_block_transactions/fetch_compacted_address_balances/v0/mod.rs

@@ -8,6 +8,8 @@ use grovedb::{Element, PathQuery, Query, SizedQuery, TransactionArg};
 use platform_version::version::PlatformVersion;
 use std::collections::BTreeMap;
 
+use crate::verify::address_funds::verify_compacted_address_balance_changes::CompactedAddressBalanceProof;
+
 /// Result type for fetched compacted address balance changes
 /// Each entry is (start_block, end_block, address_balance_map)
 pub type CompactedAddressBalanceChanges = Vec<(
@@ -189,9 +191,11 @@ impl Drive {
 
     /// Version 0 implementation for proving compacted address balance changes.
     ///
-    /// Uses a two-step approach:
-    /// 1. First query (non-proving): descending to find any range containing start_block_height
-    /// 2. Second query (proving): ascending from the found start_block or start_block_height
+    /// Uses two independently verifiable proofs:
+    /// 1. A descending predecessor proof authenticates which range, if any,
+    ///    contains `start_block_height`.
+    /// 2. A forward proof starts at that authenticated range (or at the
+    ///    request-derived fallback key when no range contains the height).
     ///
     /// This ensures the proof covers all relevant ranges efficiently.
     pub(super) fn prove_compacted_address_balance_changes_v0(
@@ -203,7 +207,7 @@ impl Drive {
     ) -> Result<Vec<u8>, Error> {
         let path = Self::saved_compacted_block_transactions_address_balances_path_vec();
 
-        // Step 1: Non-proving descending query to find any range containing start_block_height
+        // Step 1: Authenticate the predecessor used to select the forward query.
         let mut desc_end_key = Vec::with_capacity(16);
         desc_end_key.extend_from_slice(&start_block_height.to_be_bytes());
         desc_end_key.extend_from_slice(&u64::MAX.to_be_bytes());
@@ -222,6 +226,13 @@ impl Drive {
             &platform_version.drive,
         )?;
 
+        let predecessor_proof = self.grove_get_proved_path_query(
+            &desc_path_query,
+            transaction,
+            &mut vec![],
+            &platform_version.drive,
+        )?;
+
         // Determine the actual start key for the proved query
         // If we found a containing range, use its exact key
         // Otherwise use (start_block_height, start_block_height) since end_block >= start_block always
@@ -258,12 +269,27 @@ impl Drive {
 
         let path_query = PathQuery::new(path, SizedQuery::new(query, limit, None));
 
-        self.grove_get_proved_path_query(
+        let forward_proof = self.grove_get_proved_path_query(
             &path_query,
             transaction,
             &mut vec![],
             &platform_version.drive,
+        )?;
+
+        bincode::encode_to_vec(
+            CompactedAddressBalanceProof {
+                predecessor_proof,
+                forward_proof,
+            },
+            bincode::config::standard()
+                .with_big_endian()
+                .with_no_limit(),
         )
+        .map_err(|e| {
+            Error::Protocol(Box::new(ProtocolError::CorruptedSerialization(format!(
+                "cannot encode compacted address balance proof: {e}"
+            ))))
+        })
     }
 }
 

packages/rs-drive/src/verify/address_funds/verify_compacted_address_balance_changes/mod.rs

@@ -17,6 +17,17 @@ pub type VerifiedCompactedAddressBalanceChanges = Vec<(
     BTreeMap<PlatformAddress, BlockAwareCreditOperation>,
 )>;
 
+/// Proof envelope for compacted address balance changes.
+///
+/// The predecessor proof independently authenticates which range, if any,
+/// contains the requested height. The forward proof can then be verified
+/// against a query derived only from that authenticated result.
+#[derive(Debug, bincode::Encode, bincode::Decode)]
+pub(crate) struct CompactedAddressBalanceProof {
+    pub(crate) predecessor_proof: Vec<u8>,
+    pub(crate) forward_proof: Vec<u8>,
+}
+
 impl Drive {
     /// Verifies the proof of compacted address balance changes starting from a given block height.
     ///