From 27d1a22d20d8ba55a151b0c8a48d90dff73b8db8 Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Mon, 1 Jun 2026 18:49:25 +0700
Subject: [PATCH 1/7] chore: bump grovedb to 67acdbcb (dashpay/grovedb#752
 merged with develop)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Picks up the post-merge tip of dashpay/grovedb#752 (snapshot bootstrap API).

The grovedb branch was force-rebased onto develop after PR #751
('perf(commitment-tree): batched append_many_raw — replace _without_frontier
API') was squash-merged, leaving the snapshot branch as just the bootstrap
surface:

* GroveDb::raw_storage()                          — escape hatch
* RocksDbStorage::ingest_subtree_sst()            — bulk-load SST
* GroveDb::replace_commitment_tree_subtree_root() — patch parent Merk leaf

Used by drive-abci's shielded_snapshot module to dump/apply a precomputed
shielded-pool subtree at devnet genesis (without paying the per-write WAL +
fsync cost of the runtime seeder path). Roundtrip verified via the
previously-ignored test:

  snapshot_dump_apply_preserves_anchor  ← now passes
    30k notes → 8.6 MB SST → reapplied yields byte-equivalent anchor

The standalone seed tests (seeded_pool_count_matches_total_notes etc.)
remain green on the new grovedb rev.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Cargo.lock                              | 64 ++++++++++++-------------
 packages/rs-dpp/Cargo.toml              |  2 +-
 packages/rs-drive-abci/Cargo.toml       |  8 ++--
 packages/rs-drive/Cargo.toml            | 12 ++---
 packages/rs-platform-version/Cargo.toml |  2 +-
 packages/rs-platform-wallet/Cargo.toml  |  2 +-
 packages/rs-sdk/Cargo.toml              |  2 +-
 7 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f0089412bd5..2c6a3e1b227 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -513,7 +513,7 @@ dependencies = [
  "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "regex",
@@ -1132,7 +1132,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2264,7 +2264,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2689,7 +2689,7 @@ dependencies = [
 [[package]]
 name = "grovedb"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "axum 0.8.9",
  "bincode",
@@ -2727,7 +2727,7 @@ dependencies = [
 [[package]]
 name = "grovedb-bulk-append-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "blake3",
@@ -2743,7 +2743,7 @@ dependencies = [
 [[package]]
 name = "grovedb-commitment-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -2759,7 +2759,7 @@ dependencies = [
 [[package]]
 name = "grovedb-costs"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "integer-encoding",
  "intmap",
@@ -2769,7 +2769,7 @@ dependencies = [
 [[package]]
 name = "grovedb-dense-fixed-sized-merkle-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "blake3",
@@ -2782,7 +2782,7 @@ dependencies = [
 [[package]]
 name = "grovedb-element"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2797,7 +2797,7 @@ dependencies = [
 [[package]]
 name = "grovedb-epoch-based-storage-flags"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "grovedb-costs",
  "hex",
@@ -2809,7 +2809,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merk"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2835,7 +2835,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merkle-mountain-range"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "blake3",
@@ -2846,7 +2846,7 @@ dependencies = [
 [[package]]
 name = "grovedb-path"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "hex",
 ]
@@ -2854,7 +2854,7 @@ dependencies = [
 [[package]]
 name = "grovedb-query"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "bincode",
  "byteorder",
@@ -2870,7 +2870,7 @@ dependencies = [
 [[package]]
 name = "grovedb-storage"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "blake3",
  "grovedb-costs",
@@ -2889,7 +2889,7 @@ dependencies = [
 [[package]]
 name = "grovedb-version"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "thiserror 2.0.18",
  "versioned-feature-core 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -2898,7 +2898,7 @@ dependencies = [
 [[package]]
 name = "grovedb-visualize"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "hex",
  "itertools 0.14.0",
@@ -2907,7 +2907,7 @@ dependencies = [
 [[package]]
 name = "grovedbg-types"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
 dependencies = [
  "serde",
  "serde_with 3.20.0",
@@ -3301,7 +3301,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3552,7 +3552,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4304,7 +4304,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5112,7 +5112,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
  "heck 0.4.1",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "petgraph",
@@ -5133,7 +5133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5146,7 +5146,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5276,7 +5276,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5314,9 +5314,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6042,7 +6042,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6055,7 +6055,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6114,7 +6114,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6954,7 +6954,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -8356,7 +8356,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/packages/rs-dpp/Cargo.toml b/packages/rs-dpp/Cargo.toml
index 8bcc4360d75..a86c58ad3c2 100644
--- a/packages/rs-dpp/Cargo.toml
+++ b/packages/rs-dpp/Cargo.toml
@@ -71,7 +71,7 @@ strum = { version = "0.26", features = ["derive"] }
 json-schema-compatibility-validator = { path = '../rs-json-schema-compatibility-validator', optional = true }
 once_cell = "1.19.0"
 tracing = { version = "0.1.41" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.40", features = ["full"] }
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 633d3d2db7e..8d99fb6a2b5 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -82,7 +82,7 @@ derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
 # bindings, and blake3 for the snapshot-file checksum.
@@ -107,7 +107,7 @@ dpp = { path = "../rs-dpp", default-features = false, features = [
 drive = { path = "../rs-drive", features = ["fixtures-and-mocks"] }
 drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", features = ["client"] }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", features = ["client"] }
 assert_matches = "1.5.0"
 drive-abci = { path = ".", features = ["testing-config", "mocks"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
@@ -121,8 +121,8 @@ integer-encoding = { version = "4.0.0" }
 
 # For dump_only_default_and_aux_cfs_under_shielded_subtree_prefix — same
 # subtree-prefix algorithm grovedb uses internally.
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
 
 [features]
 default = ["bls-signatures"]
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index c893ae54b9a..f94f3092dd6 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -52,12 +52,12 @@ enum-map = { version = "2.0.3", optional = true }
 intmap = { version = "3.0.1", features = ["serde"], optional = true }
 chrono = { version = "0.4.35", optional = true }
 itertools = { version = "0.13", optional = true }
-grovedb = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true, default-features = false }
-grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true, default-features = false }
+grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
 
 [dev-dependencies]
 criterion = "0.5"
diff --git a/packages/rs-platform-version/Cargo.toml b/packages/rs-platform-version/Cargo.toml
index 125441aaaa8..8a4003ac9d7 100644
--- a/packages/rs-platform-version/Cargo.toml
+++ b/packages/rs-platform-version/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 thiserror = { version = "2.0.12" }
 bincode = { version = "=2.0.1" }
 versioned-feature-core = { git = "https://github.com/dashpay/versioned-feature-core", version = "1.0.0" }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
 
 [features]
 mock-versions = []
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index b92f03cfa14..2852791974f 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -49,7 +49,7 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 zeroize = "1"
 
 # Shielded pool (optional, behind `shielded` feature)
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
 # Direct `rusqlite` access so `FileBackedShieldedStore::open_path` can set
 # WAL + synchronous=NORMAL pragmas before handing the connection to
 # `ClientPersistentCommitmentTree`. Version locked to match the rev grovedb
diff --git a/packages/rs-sdk/Cargo.toml b/packages/rs-sdk/Cargo.toml
index d918fee30ef..709a9f91e83 100644
--- a/packages/rs-sdk/Cargo.toml
+++ b/packages/rs-sdk/Cargo.toml
@@ -18,7 +18,7 @@ drive = { path = "../rs-drive", default-features = false, features = [
 ] }
 
 drive-proof-verifier = { path = "../rs-drive-proof-verifier", default-features = false }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", features = [
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", features = [
   "client",
   "sqlite",
 ], optional = true }

From 52acd3f90c4470c73d96b39029f035176913ff36 Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Mon, 1 Jun 2026 18:49:54 +0700
Subject: [PATCH 2/7] test(drive-abci): un-ignore
 snapshot_dump_apply_preserves_anchor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The grovedb snapshot bootstrap API (dashpay/grovedb#752 — `ingest_subtree_sst`,
`replace_commitment_tree_subtree_root`, `raw_storage`) is now wired in via
the rev bump in the previous commit, so the roundtrip test is no longer
gated behind a pre-merge marker.

Verified locally: 30k notes → 8.6 MB SST → re-applied to a fresh platform
yields a byte-equivalent Sinsemilla anchor (df37726e…4c2300).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../initialization/create_genesis_state/test/shielded.rs         | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
index 8f2949e4f8d..68fa57ba738 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
@@ -1038,7 +1038,6 @@ mod platform_tests {
     /// `commit_mmr` to the end) is what makes multi-batch work; this test
     /// pins that contract.
     #[test]
-    #[ignore = "snapshot dump+apply roundtrip; needs the new grovedb branch"]
     fn snapshot_dump_apply_preserves_anchor() {
         let platform_version = PlatformVersion::latest();
 

From bf2efc5e3028444c05d8092e9e93d09bf49bb8a4 Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Mon, 1 Jun 2026 20:52:47 +0700
Subject: [PATCH 3/7] feat(drive-abci): split shielded-pool seeding behind its
 own cfg gate

Adds a second build-time gate `create_shielded_test_data` nested inside
`create_sdk_test_data`, so SDK_TEST_DATA-only devnets (the pre-#3732
shape) skip the 1M-note shielded-pool seeding and the snapshot bake/apply
machinery.

* `#[cfg(create_shielded_test_data)]` now gates:
  - the `create_data_for_shielded_pool` call inside `create_sdk_test_data`
  - the `mod shielded` declaration (in create_genesis_state/test/mod.rs)
  - the `shielded_snapshot` lib module (bake/apply public API)
  - the `snapshot-bake` CLI subcommand + everything supporting it
* `mod snapshot_bake_main` in main.rs consolidates what used to be three
  separately-gated items (NoopCoreRPC, its impl block, and the
  `snapshot_bake` fn) under a single `#[cfg(create_shielded_test_data)]`
  on the module declaration.
* New `.cargo/config-shielded-test-data.toml` profile sets BOTH cfgs
  (`create_sdk_test_data` + `create_shielded_test_data`); the existing
  `config-test-sdk-data.toml` continues to set only the outer cfg.
* Dockerfile gains a `SHIELDED_TEST_DATA` build arg (forwarded by
  dashmate, parallel to `SDK_TEST_DATA`). Setting it to `true` selects
  the dual-cfg cargo profile AND drives the bake stage to produce a
  `shielded-pool.snap`. SDK-only builds skip the bake (the binary doesn't
  even contain the `snapshot-bake` subcommand).
* `check-cfg` allowlist in `packages/rs-drive-abci/Cargo.toml` updated
  to recognise the new cfg.

Verified locally with `cargo check -p drive-abci` in all three modes:
  - default (no cfgs)              -> 15m 15s, clean
  - only `create_sdk_test_data`    ->  6m 16s, clean
  - both cfgs                      -> 18m 41s, clean

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .cargo/config-shielded-test-data.toml         |  38 ++++
 Dockerfile                                    |  61 ++++--
 packages/rs-drive-abci/Cargo.toml             |   1 +
 .../create_genesis_state/test/mod.rs          |  11 +
 packages/rs-drive-abci/src/lib.rs             |   6 +-
 packages/rs-drive-abci/src/main.rs            | 207 +++++++++---------
 6 files changed, 198 insertions(+), 126 deletions(-)
 create mode 100644 .cargo/config-shielded-test-data.toml

diff --git a/.cargo/config-shielded-test-data.toml b/.cargo/config-shielded-test-data.toml
new file mode 100644
index 00000000000..9c43b49da3a
--- /dev/null
+++ b/.cargo/config-shielded-test-data.toml
@@ -0,0 +1,38 @@
+[target.aarch64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static"]
+
+[target.x86_64-unknown-linux-musl]
+rustflags = [
+    "-C",
+    "target-feature=-crt-static",
+    "-C",
+    "target-cpu=x86-64",
+]
+
+[target.x86_64-unknown-linux-gnu]
+rustflags = [
+    "-C",
+    "target-feature=-crt-static",
+    "-C",
+    "target-cpu=x86-64",
+]
+
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+
+[target.wasm32-unknown-unknown]
+rustflags = ['--cfg', 'getrandom_backend="wasm_js"']
+
+# Activates BOTH the base SDK test-data gate and the shielded-pool seeding /
+# snapshot-bake gate. Selected in the Dockerfile when `SHIELDED_TEST_DATA=true`
+# (which implies SDK_TEST_DATA, since shielded fixtures are seeded inside
+# `create_sdk_test_data`).
+[target.'cfg(all())']
+rustflags = [
+    "--cfg",
+    "tokio_unstable",
+    '--cfg',
+    'create_sdk_test_data',
+    '--cfg',
+    'create_shielded_test_data',
+]
diff --git a/Dockerfile b/Dockerfile
index ff14ceaf1d3..940f9393a6f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,12 +18,18 @@
 # - ALPINE_VERSION - use different version of Alpine base image; requires also rust:apline...
 #   image to be available
 # - USERNAME, USER_UID, USER_GID - specification of user used to run the binary
-# - SDK_TEST_DATA - set to `true` to create SDK test data on chain genesis.
+# - SDK_TEST_DATA - set to `true` to create SDK test data on chain genesis
+#   (base fixtures: addresses, group token queries, token direct prices).
 #   For local devnet workflows use `yarn dashmate config set
 #   platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA true` (the
 #   `yarn setup` script does this automatically for the `local` config) —
 #   do NOT pass it as a shell env. The value flows through dashmate ->
 #   docker-compose `build.args:` -> this ARG.
+# - SHIELDED_TEST_DATA - set to `true` to ALSO seed the shielded pool at
+#   genesis and bake a snapshot file into the runtime image (the
+#   1M-note stress-test path). Implies SDK_TEST_DATA. Off by default —
+#   most devnet setups only need the base SDK fixtures, not the shielded
+#   pool, and seeding shielded notes is expensive at image-build time.
 #
 # # sccache cache backends
 #
@@ -426,12 +432,19 @@ RUN --mount=type=secret,id=AWS \
 # This will prebuild majority of dependencies
 FROM deps AS build-drive-abci
 
-# SDK_TEST_DATA is forwarded by dashmate from each `local_N` config's
-# `platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA` field (set by
-# `scripts/setup_local_network.sh` after `dashmate setup local`, as part of
-# `yarn setup`). Do NOT set this via shell env — single source of truth is the
-# dashmate config.
+# SDK_TEST_DATA / SHIELDED_TEST_DATA are forwarded by dashmate from each
+# `local_N` config's `platform.drive.abci.docker.build.buildArgs.*` fields
+# (set by `scripts/setup_local_network.sh` after `dashmate setup local`, as
+# part of `yarn setup`). Do NOT set them via shell env — single source of
+# truth is the dashmate config.
+#
+# SHIELDED_TEST_DATA=true ⇒ implies SDK_TEST_DATA=true (the shielded seeder
+# runs inside `create_sdk_test_data`); selects the dual-cfg cargo profile
+# that activates both `create_sdk_test_data` and `create_shielded_test_data`.
+# The bake stage further down only produces a shielded-pool snapshot when
+# this flag is on.
 ARG SDK_TEST_DATA
+ARG SHIELDED_TEST_DATA
 ARG ADDITIONAL_FEATURES=""
 
 SHELL ["/bin/bash", "-o", "pipefail","-e", "-x", "-c"]
@@ -459,7 +472,9 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
     export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
+    elif [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
     cargo chef cook \
@@ -544,7 +559,9 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
     export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
+    elif [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
     # Workaround: as we cache dapi-grpc, its build.rs is not rerun, so we need to touch it
@@ -568,12 +585,16 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
 # image COPYs that file in and sets `DRIVE_SHIELDED_SNAPSHOT` so the
 # InitChain hook applies it instead of running the runtime seeder.
 #
-# Skipped (file replaced with a sentinel) when SDK_TEST_DATA != "true", so
-# production / non-SDK builds don't carry test data.
+# Skipped (file replaced with a sentinel) when SHIELDED_TEST_DATA != "true",
+# so SDK-only builds (and production) don't carry the shielded fixture.
+# The drive-abci binary itself only contains the `snapshot-bake` subcommand
+# when built with `--cfg create_shielded_test_data` (selected by the
+# SHIELDED_TEST_DATA build arg in the build stage), so invoking it on an
+# SDK-only binary would fail with "unknown subcommand" anyway.
 #
 FROM build-drive-abci AS bake-shielded-snapshot
 
-ARG SDK_TEST_DATA
+ARG SHIELDED_TEST_DATA
 
 # libgcc + libstdc++ for the dynamically-linked drive-abci binary (build
 # stage's alpine image normally has them; explicit `apk add` is a no-op if
@@ -582,11 +603,11 @@ RUN apk add --no-cache libgcc libstdc++
 
 RUN set -ex; \
     mkdir -p /artifacts; \
-    if [ "${SDK_TEST_DATA}" = "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" = "true" ]; then \
         /artifacts/drive-abci snapshot-bake --out /artifacts/shielded-pool.snap ; \
         ls -la /artifacts/shielded-pool.snap ; \
     else \
-        echo "SDK_TEST_DATA != true; skipping shielded-pool snapshot bake" ; \
+        echo "SHIELDED_TEST_DATA != true; skipping shielded-pool snapshot bake" ; \
         : > /artifacts/.no-shielded-snapshot ; \
     fi
 
@@ -708,13 +729,13 @@ COPY --from=bake-shielded-snapshot /artifacts/ /opt/dashmate/snapshots/
 COPY packages/rs-drive-abci/.env.mainnet /var/lib/dash/rs-drive-abci/.env
 
 # Only point InitChain's apply-side at the snapshot when the bake stage
-# actually produced one (SDK_TEST_DATA=true). On the SDK_TEST_DATA=false
-# branch the bake stage leaves only a `.no-shielded-snapshot` sentinel, so
-# exporting DRIVE_SHIELDED_SNAPSHOT unconditionally would make
-# create_data_for_shielded_pool try to apply a missing file and fail
-# instead of falling back to the runtime seeder. We gate on the real file's
-# existence (writing the var into the binary's .env, which is loaded via
-# dotenvy and left unset otherwise so the seeder fallback runs).
+# actually produced one (SHIELDED_TEST_DATA=true). Otherwise the bake stage
+# leaves only a `.no-shielded-snapshot` sentinel, so exporting
+# DRIVE_SHIELDED_SNAPSHOT unconditionally would make
+# create_data_for_shielded_pool try to apply a missing file and fail instead
+# of falling back to the runtime seeder. We gate on the real file's existence
+# (writing the var into the binary's .env, which is loaded via dotenvy and
+# left unset otherwise so the seeder fallback runs).
 RUN if [ -f /opt/dashmate/snapshots/shielded-pool.snap ]; then \
         echo "DRIVE_SHIELDED_SNAPSHOT=/opt/dashmate/snapshots/shielded-pool.snap" \
             >> /var/lib/dash/rs-drive-abci/.env ; \
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 8d99fb6a2b5..2c0cd721c9c 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -142,5 +142,6 @@ path = "src/main.rs"
 unexpected_cfgs = { level = "warn", check-cfg = [
   'cfg(tokio_unstable)',
   'cfg(create_sdk_test_data)',
+  'cfg(create_shielded_test_data)',
   'cfg(feature, values("__shielded_strategy_tests"))',
 ] }
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
index 8fd3d5bc133..70c575c40e7 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
@@ -7,6 +7,10 @@ use dpp::version::PlatformVersion;
 use drive::grovedb::TransactionArg;
 
 mod addresses;
+// Shielded-pool seeding (incl. snapshot bake/apply tests) is gated separately
+// from the base SDK fixtures — see the comment in `create_sdk_test_data` and
+// `.cargo/config-shielded-test-data.toml`.
+#[cfg(any(create_shielded_test_data, test))]
 mod shielded;
 mod tokens;
 
@@ -39,6 +43,13 @@ impl<C> Platform<C> {
         self.create_data_for_group_token_queries(block_info, transaction, platform_version)?;
         self.create_data_for_token_direct_prices(block_info, transaction, platform_version)?;
         self.create_data_for_addresses(block_info, transaction, platform_version)?;
+        // Shielded-pool seeding is gated separately so SDK_TEST_DATA-only
+        // builds get the base fixtures (addresses, tokens) without paying the
+        // shielded-seed setup cost or shipping the bake/apply code path. Enable
+        // by building with `--cfg create_shielded_test_data` (the
+        // `.cargo/config-shielded-test-data.toml` profile, selected in the
+        // Dockerfile via the `SHIELDED_TEST_DATA=true` build arg).
+        #[cfg(create_shielded_test_data)]
         self.create_data_for_shielded_pool(block_info, transaction, platform_version)?;
 
         Ok(())
diff --git a/packages/rs-drive-abci/src/lib.rs b/packages/rs-drive-abci/src/lib.rs
index 756e0176bf5..9c997c9ad62 100644
--- a/packages/rs-drive-abci/src/lib.rs
+++ b/packages/rs-drive-abci/src/lib.rs
@@ -91,11 +91,11 @@ pub mod server;
 /// Shielded-pool genesis snapshot — bake/apply.
 ///
 /// Test-data tooling only: the bake reads a pool seeded by
-/// `create_sdk_test_data` and the apply runs from that same seeder's
+/// `create_data_for_shielded_pool` and the apply runs from that same seeder's
 /// fast-path, so the module has no purpose in a production build. Gated on
-/// `create_sdk_test_data` (its only callers) plus `test` (the genesis
+/// `create_shielded_test_data` (its only callers) plus `test` (the genesis
 /// seeder's test module exercises it under `cargo test`).
-#[cfg(any(create_sdk_test_data, test))]
+#[cfg(any(create_shielded_test_data, test))]
 pub mod shielded_snapshot;
 /// Verification helpers
 pub mod verify;
diff --git a/packages/rs-drive-abci/src/main.rs b/packages/rs-drive-abci/src/main.rs
index fb84eeefd36..bb6d7779f12 100644
--- a/packages/rs-drive-abci/src/main.rs
+++ b/packages/rs-drive-abci/src/main.rs
@@ -78,9 +78,9 @@ enum Commands {
     /// Intended for the Dockerfile bake stage, where the snapshot file is
     /// embedded into the runtime image and consumed at boot via
     /// `DRIVE_SHIELDED_SNAPSHOT=<path>`. Requires the binary to be built
-    /// with `--cfg create_sdk_test_data` so that `create_genesis_state`
+    /// with `--cfg create_shielded_test_data` so that `create_genesis_state`
     /// invokes the seeder — the command is compiled out otherwise.
-    #[cfg(create_sdk_test_data)]
+    #[cfg(create_shielded_test_data)]
     #[command()]
     SnapshotBake {
         /// Where to write the snapshot file. Parent directory must exist.
@@ -185,8 +185,8 @@ impl Cli {
             Commands::Config => dump_config(&config)?,
             Commands::Status => runtime.block_on(check_status(&config))?,
             Commands::Verify => drive_abci::verify::run(&config, true)?,
-            #[cfg(create_sdk_test_data)]
-            Commands::SnapshotBake { out } => snapshot_bake(&config, &out)?,
+            #[cfg(create_shielded_test_data)]
+            Commands::SnapshotBake { out } => snapshot_bake_main::run(&config, &out)?,
             Commands::Version => print_version(),
             #[cfg(feature = "replay")]
             Commands::Replay(args) => {
@@ -205,14 +205,14 @@ fn main() -> Result<(), ExitCode> {
     // skip `load_config` (which would panic on missing GRPC_BIND_ADDRESS etc.)
     // and use a sensible default. Other subcommands (Start / Status / etc.)
     // still need the full config. The command only exists under
-    // `create_sdk_test_data`, so the branch is compiled out otherwise.
-    #[cfg(create_sdk_test_data)]
+    // `create_shielded_test_data`, so the branch is compiled out otherwise.
+    #[cfg(create_shielded_test_data)]
     let config = if matches!(cli.command, Commands::SnapshotBake { .. }) {
         drive_abci::config::PlatformConfig::default_local()
     } else {
         load_config(&cli.config)
     };
-    #[cfg(not(create_sdk_test_data))]
+    #[cfg(not(create_shielded_test_data))]
     let config = load_config(&cli.config);
 
     // Start tokio runtime and thread listening for signals.
@@ -346,20 +346,12 @@ fn dump_config(config: &PlatformConfig) -> Result<(), String> {
     Ok(())
 }
 
-/// Stub CoreRPCLike used during `snapshot-bake` — Platform::open_with_client
-/// requires a CoreRPCLike, but create_genesis_state never actually calls any
-/// of its methods (no chain locks, transactions, or quorum lookups happen
-/// during genesis). Every method is `unreachable!()` so a bake that
-/// accidentally tries to talk to Core surfaces as a loud panic.
-///
-/// Only the `snapshot-bake` command uses it, so it is compiled out unless
-/// `create_sdk_test_data` is set (the cfg that command lives behind).
-#[cfg(create_sdk_test_data)]
-struct NoopCoreRPC;
-
-#[cfg(create_sdk_test_data)]
-mod noop_core_rpc_impl {
-    use super::NoopCoreRPC;
+/// Everything that exists only to support the `snapshot-bake` subcommand
+/// (used by the Dockerfile bake stage to pre-build a shielded-pool snapshot
+/// for the runtime image to apply at InitChain). Gated as a whole on
+/// `create_shielded_test_data` so production builds carry none of it.
+#[cfg(create_shielded_test_data)]
+mod snapshot_bake_main {
     use dpp::dashcore::ephemerealdata::chain_lock::ChainLock;
     use dpp::dashcore::{Block, BlockHash, Header, InstantLock, QuorumHash, Transaction, Txid};
     use dpp::dashcore_rpc::dashcore_rpc_json::{
@@ -369,9 +361,19 @@ mod noop_core_rpc_impl {
     use dpp::dashcore_rpc::json::GetRawTransactionResult;
     use dpp::dashcore_rpc::Error;
     use dpp::prelude::TimestampMillis;
+    use dpp::version::PlatformVersion;
+    use drive_abci::config::PlatformConfig;
+    use drive_abci::platform_types::platform::Platform;
     use drive_abci::rpc::core::CoreRPCLike;
     use serde_json::Value;
 
+    /// Stub CoreRPCLike — Platform::open_with_client requires a CoreRPCLike,
+    /// but create_genesis_state never actually touches Core (no chain locks,
+    /// transactions, or quorum lookups happen during genesis). Every method
+    /// is `unreachable!()` so a bake that accidentally tries to talk to Core
+    /// surfaces as a loud panic.
+    pub(super) struct NoopCoreRPC;
+
     impl CoreRPCLike for NoopCoreRPC {
         fn get_block_hash(&self, _: u32) -> Result<BlockHash, Error> {
             unreachable!()
@@ -450,93 +452,92 @@ mod noop_core_rpc_impl {
             unreachable!()
         }
     }
-}
 
-/// Produce a shielded-pool snapshot at `out_path` from a fresh temporary
-/// GroveDB. Runs the full `create_genesis_state` cycle (which, under
-/// `cfg(create_sdk_test_data)`, invokes the shielded-pool seeder), then
-/// dumps the resulting subtree. Self-contained — `config` is ignored
-/// (we use a tempdir + sensible defaults).
-///
-/// Intended for the Dockerfile bake stage: produce a snapshot once during
-/// image build, embed in the runtime image, load it at every InitChain via
-/// `DRIVE_SHIELDED_SNAPSHOT`.
-#[cfg(create_sdk_test_data)]
-fn snapshot_bake(_config: &PlatformConfig, out_path: &std::path::Path) -> Result<(), String> {
-    use dpp::version::PlatformVersion;
-    use drive_abci::config::PlatformConfig;
-    use drive_abci::platform_types::platform::Platform;
+    /// Produce a shielded-pool snapshot at `out_path` from a fresh temporary
+    /// GroveDB. Runs the full `create_genesis_state` cycle (which, under
+    /// `cfg(create_shielded_test_data)`, invokes the shielded-pool seeder),
+    /// then dumps the resulting subtree. Self-contained — `_config` is
+    /// ignored (we use a tempdir + sensible defaults).
+    ///
+    /// Intended for the Dockerfile bake stage: produce a snapshot once during
+    /// image build, embed in the runtime image, load it at every InitChain
+    /// via `DRIVE_SHIELDED_SNAPSHOT`.
+    pub(super) fn run(
+        _config: &PlatformConfig,
+        out_path: &std::path::Path,
+    ) -> Result<(), String> {
+        tracing::info!(
+            out = %out_path.display(),
+            "snapshot-bake: creating tempdir + bootstrapping fresh GroveDB",
+        );
 
-    tracing::info!(
-        out = %out_path.display(),
-        "snapshot-bake: creating tempdir + bootstrapping fresh GroveDB",
-    );
-
-    let tempdir = tempfile::tempdir().map_err(|e| format!("tempdir: {e}"))?;
-
-    // Use the local (regtest) config — same network the bake target image
-    // will run on. We use NoopCoreRPC so we don't try to connect to a
-    // non-existent Core node during the in-container bake.
-    let mut platform_config = PlatformConfig::default_local();
-    platform_config.db_path = tempdir.path().to_path_buf();
-
-    let platform = Platform::<NoopCoreRPC>::open_with_client(
-        tempdir.path(),
-        Some(platform_config),
-        NoopCoreRPC,
-        None,
-    )
-    .map_err(|e| format!("open platform: {e}"))?;
-
-    let platform_version = PlatformVersion::latest();
-    let tx = platform.drive.grove.start_transaction();
-
-    // Defensively unset DRIVE_SHIELDED_SNAPSHOT before seeding. The seeder
-    // (`create_data_for_shielded_pool`) checks this env var first and, if set,
-    // APPLIES the referenced snapshot instead of running the seeder. A developer
-    // (or the Dockerfile env) with it exported would make `snapshot-bake`
-    // recursively re-dump an inherited snapshot rather than seeding a fresh one.
-    std::env::remove_var("DRIVE_SHIELDED_SNAPSHOT");
-
-    tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under cfg(create_sdk_test_data))");
-    platform
-        .create_genesis_state(
-            1, // genesis_core_height (placeholder for bake)
-            0, // genesis_time (placeholder for bake)
-            Some(&tx),
+        let tempdir = tempfile::tempdir().map_err(|e| format!("tempdir: {e}"))?;
+
+        // Use the local (regtest) config — same network the bake target image
+        // will run on. We use NoopCoreRPC so we don't try to connect to a
+        // non-existent Core node during the in-container bake.
+        let mut platform_config = PlatformConfig::default_local();
+        platform_config.db_path = tempdir.path().to_path_buf();
+
+        let platform = Platform::<NoopCoreRPC>::open_with_client(
+            tempdir.path(),
+            Some(platform_config),
+            NoopCoreRPC,
+            None,
+        )
+        .map_err(|e| format!("open platform: {e}"))?;
+
+        let platform_version = PlatformVersion::latest();
+        let tx = platform.drive.grove.start_transaction();
+
+        // Defensively unset DRIVE_SHIELDED_SNAPSHOT before seeding. The seeder
+        // (`create_data_for_shielded_pool`) checks this env var first and, if
+        // set, APPLIES the referenced snapshot instead of running the seeder.
+        // A developer (or the Dockerfile env) with it exported would make
+        // `snapshot-bake` recursively re-dump an inherited snapshot rather
+        // than seeding a fresh one.
+        std::env::remove_var("DRIVE_SHIELDED_SNAPSHOT");
+
+        tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under cfg(create_shielded_test_data))");
+        platform
+            .create_genesis_state(
+                1, // genesis_core_height (placeholder for bake)
+                0, // genesis_time (placeholder for bake)
+                Some(&tx),
+                platform_version,
+            )
+            .map_err(|e| format!("create_genesis_state: {e}"))?;
+        tx.commit().map_err(|e| format!("commit: {e}"))?;
+
+        tracing::info!(
+            out = %out_path.display(),
+            "snapshot-bake: dumping shielded subtree to snapshot file",
+        );
+        let stats = drive_abci::shielded_snapshot::dump_shielded_subtree(
+            &platform.drive.grove,
+            None,
+            out_path,
             platform_version,
         )
-        .map_err(|e| format!("create_genesis_state: {e}"))?;
-    tx.commit().map_err(|e| format!("commit: {e}"))?;
-
-    tracing::info!(
-        out = %out_path.display(),
-        "snapshot-bake: dumping shielded subtree to snapshot file",
-    );
-    let stats = drive_abci::shielded_snapshot::dump_shielded_subtree(
-        &platform.drive.grove,
-        None,
-        out_path,
-        platform_version,
-    )
-    .map_err(|e| format!("snapshot dump failed: {e}"))?;
-
-    tracing::info!(
-        out = %out_path.display(),
-        total_count = stats.total_count,
-        key_count = stats.key_count,
-        sst_bytes = stats.sst_bytes,
-        "snapshot-bake: wrote shielded-pool snapshot",
-    );
-    println!(
-        "wrote {} bytes ({} keys, total_count={}) to {}",
-        stats.sst_bytes,
-        stats.key_count,
-        stats.total_count,
-        out_path.display(),
-    );
+        .map_err(|e| format!("snapshot dump failed: {e}"))?;
+
+        tracing::info!(
+            out = %out_path.display(),
+            total_count = stats.total_count,
+            key_count = stats.key_count,
+            sst_bytes = stats.sst_bytes,
+            "snapshot-bake: wrote shielded-pool snapshot",
+        );
+        println!(
+            "wrote {} bytes ({} keys, total_count={}) to {}",
+            stats.sst_bytes,
+            stats.key_count,
+            stats.total_count,
+            out_path.display(),
+        );
 
-    Ok(())
+        Ok(())
+    }
 }
 
 fn list_enabled_features() -> Vec<&'static str> {

From 614ae01ec43b06c4236825b2feef1b6027273358 Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Mon, 1 Jun 2026 23:14:15 +0700
Subject: [PATCH 4/7] feat(drive-abci): gate grovedb snapshot-bootstrap APIs
 behind `unsafe-dump-load`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Picks up the post-refactor tip of dashpay/grovedb#752 (`2e9dff50`), which:
  1. Renames `replace_commitment_tree_subtree_root` → `replace_subtree_root`
     and makes it generic over Element variant (caller builds whichever
     non-Merk tree element they're snapshot-restoring).
  2. Gates all three snapshot-bootstrap entry points
     (`raw_storage`, `ingest_subtree_sst`, `replace_subtree_root`) behind a
     new `unsafe-dump-load` Cargo feature, so production grovedb has no
     compiled access to them.

Platform changes:
  * `drive` exposes a pass-through `unsafe-dump-load` feature that forwards
    to `grovedb/unsafe-dump-load`.
  * `drive-abci` exposes a pass-through `unsafe-dump-load` feature that
    forwards to `drive/unsafe-dump-load`.
  * `drive-abci`'s `[dev-dependencies]` always enables the feature so
    `cargo test` can run the snapshot roundtrip test.
  * Dockerfile passes `--features=unsafe-dump-load` to both
    `cargo chef cook` and `cargo build` when `SHIELDED_TEST_DATA=true`
    (composes correctly with any user-supplied `ADDITIONAL_FEATURES`).
  * Callers in `shielded_snapshot` and the snapshot-bake path now construct
    `Element::new_commitment_tree(total_count, chunk_power, flags)` locally
    and pass it to `replace_subtree_root`.

Verified locally:
  * Default build (no SDK_TEST_DATA, no SHIELDED_TEST_DATA): compiles, no
    snapshot-bootstrap APIs in the binary.
  * `SDK_TEST_DATA=true` only: compiles, no shielded code or APIs.
  * `SHIELDED_TEST_DATA=true`: compiles with feature on.
  * `snapshot_dump_apply_preserves_anchor` test (with feature on) passes —
    30k notes dumped + reapplied yields byte-equivalent anchor.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Cargo.lock                                    | 60 +++++++++----------
 Dockerfile                                    | 14 ++++-
 packages/rs-dpp/Cargo.toml                    |  2 +-
 packages/rs-drive-abci/Cargo.toml             | 16 +++--
 .../create_genesis_state/test/shielded.rs     | 16 ++---
 .../src/shielded_snapshot/mod.rs              | 15 ++---
 packages/rs-drive/Cargo.toml                  | 17 ++++--
 packages/rs-platform-version/Cargo.toml       |  2 +-
 packages/rs-platform-wallet/Cargo.toml        |  2 +-
 packages/rs-sdk/Cargo.toml                    |  2 +-
 10 files changed, 83 insertions(+), 63 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2c6a3e1b227..7af683a8c73 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -513,7 +513,7 @@ dependencies = [
  "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "regex",
@@ -1132,7 +1132,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2264,7 +2264,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2689,7 +2689,7 @@ dependencies = [
 [[package]]
 name = "grovedb"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "axum 0.8.9",
  "bincode",
@@ -2727,7 +2727,7 @@ dependencies = [
 [[package]]
 name = "grovedb-bulk-append-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "blake3",
@@ -2743,7 +2743,7 @@ dependencies = [
 [[package]]
 name = "grovedb-commitment-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -2759,7 +2759,7 @@ dependencies = [
 [[package]]
 name = "grovedb-costs"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "integer-encoding",
  "intmap",
@@ -2769,7 +2769,7 @@ dependencies = [
 [[package]]
 name = "grovedb-dense-fixed-sized-merkle-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "blake3",
@@ -2782,7 +2782,7 @@ dependencies = [
 [[package]]
 name = "grovedb-element"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2797,7 +2797,7 @@ dependencies = [
 [[package]]
 name = "grovedb-epoch-based-storage-flags"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "grovedb-costs",
  "hex",
@@ -2809,7 +2809,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merk"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2835,7 +2835,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merkle-mountain-range"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "blake3",
@@ -2846,7 +2846,7 @@ dependencies = [
 [[package]]
 name = "grovedb-path"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "hex",
 ]
@@ -2854,7 +2854,7 @@ dependencies = [
 [[package]]
 name = "grovedb-query"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "bincode",
  "byteorder",
@@ -2870,7 +2870,7 @@ dependencies = [
 [[package]]
 name = "grovedb-storage"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "blake3",
  "grovedb-costs",
@@ -2889,7 +2889,7 @@ dependencies = [
 [[package]]
 name = "grovedb-version"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "thiserror 2.0.18",
  "versioned-feature-core 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -2898,7 +2898,7 @@ dependencies = [
 [[package]]
 name = "grovedb-visualize"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "hex",
  "itertools 0.14.0",
@@ -2907,7 +2907,7 @@ dependencies = [
 [[package]]
 name = "grovedbg-types"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=67acdbcb610d8ff34c8ebeffd8262fa2475e9b32#67acdbcb610d8ff34c8ebeffd8262fa2475e9b32"
+source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
 dependencies = [
  "serde",
  "serde_with 3.20.0",
@@ -3301,7 +3301,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3552,7 +3552,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4304,7 +4304,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5112,7 +5112,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
  "heck 0.4.1",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "log",
  "multimap",
  "petgraph",
@@ -5133,7 +5133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5146,7 +5146,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5276,7 +5276,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5314,7 +5314,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "tracing",
  "windows-sys 0.59.0",
 ]
@@ -6055,7 +6055,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6114,7 +6114,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6954,7 +6954,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8356,7 +8356,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Dockerfile b/Dockerfile
index 940f9393a6f..e70599eb24e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -469,14 +469,19 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if  [[ "${CARGO_BUILD_PROFILE}" == "release" ]] ; then \
     mv .cargo/config-release.toml .cargo/config.toml; \
     fi && \
+    FEATURES_LIST=""; \
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
-    export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
+    FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
     if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}unsafe-dump-load"; \
     elif [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [[ -n "${FEATURES_LIST}" ]]; then \
+    export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
+    fi && \
     cargo chef cook \
     --recipe-path recipe.json \
     --profile "$CARGO_BUILD_PROFILE" \
@@ -556,14 +561,19 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     else \
     export OUT_DIRECTORY=debug; \
     fi && \
+    FEATURES_LIST=""; \
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
-    export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
+    FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
     if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}unsafe-dump-load"; \
     elif [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [[ -n "${FEATURES_LIST}" ]]; then \
+    export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
+    fi && \
     # Workaround: as we cache dapi-grpc, its build.rs is not rerun, so we need to touch it
     echo "// $(date) " >> /platform/packages/dapi-grpc/build.rs && \
     cargo build \
diff --git a/packages/rs-dpp/Cargo.toml b/packages/rs-dpp/Cargo.toml
index a86c58ad3c2..8ed4036eafc 100644
--- a/packages/rs-dpp/Cargo.toml
+++ b/packages/rs-dpp/Cargo.toml
@@ -71,7 +71,7 @@ strum = { version = "0.26", features = ["derive"] }
 json-schema-compatibility-validator = { path = '../rs-json-schema-compatibility-validator', optional = true }
 once_cell = "1.19.0"
 tracing = { version = "0.1.41" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.40", features = ["full"] }
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 2c0cd721c9c..56737e68e72 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -82,7 +82,7 @@ derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
 # bindings, and blake3 for the snapshot-file checksum.
@@ -107,9 +107,9 @@ dpp = { path = "../rs-dpp", default-features = false, features = [
 drive = { path = "../rs-drive", features = ["fixtures-and-mocks"] }
 drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", features = ["client"] }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", features = ["client"] }
 assert_matches = "1.5.0"
-drive-abci = { path = ".", features = ["testing-config", "mocks"] }
+drive-abci = { path = ".", features = ["testing-config", "mocks", "unsafe-dump-load"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
 mockall = { version = "0.13" }
 dash-platform-macros = { path = "../rs-dash-platform-macros" }
@@ -121,14 +121,20 @@ integer-encoding = { version = "4.0.0" }
 
 # For dump_only_default_and_aux_cfs_under_shielded_subtree_prefix — same
 # subtree-prefix algorithm grovedb uses internally.
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
 
 [features]
 default = ["bls-signatures"]
 mocks = ["mockall", "drive/fixtures-and-mocks", "bls-signatures"]
 console = ["console-subscriber", "tokio/tracing"]
 testing-config = []
+# Forwards `drive/unsafe-dump-load` (and through it `grovedb/unsafe-dump-load`).
+# Enable in builds that need the shielded-pool snapshot bake/apply path —
+# Dockerfile turns this on when `SHIELDED_TEST_DATA=true`. The snapshot-test
+# in this crate's own `#[cfg(test)]` module also requires it (dev-dependency
+# below enables it for `cargo test`).
+unsafe-dump-load = ["drive/unsafe-dump-load"]
 grovedbg = ["drive/grovedbg"]
 # `abci-server replay` command
 replay = ["dep:time", "tenderdash-abci/serde"]
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
index 68fa57ba738..bbf9ba84772 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
@@ -437,8 +437,7 @@ impl<C> Platform<C> {
 
             // Commit the subtree's data_batch through the transaction —
             // makes all the BulkAppendTree / frontier writes visible to
-            // subsequent reads (including replace_commitment_tree_subtree_root's
-            // own batch).
+            // subsequent reads (including replace_subtree_root's own batch).
             self.drive
                 .grove
                 .raw_storage()
@@ -451,14 +450,17 @@ impl<C> Platform<C> {
                 })?;
 
             // --- Update parent Merk leaf with the new state ---
+            let new_element = drive::grovedb::Element::new_commitment_tree(
+                u64::from(cfg.total_notes),
+                chunk_power,
+                flags,
+            );
             self.drive
                 .grove
-                .replace_commitment_tree_subtree_root(
+                .replace_subtree_root(
                     parent_path,
                     leaf_key,
-                    u64::from(cfg.total_notes),
-                    chunk_power,
-                    flags,
+                    new_element,
                     combined_root,
                     Some(tx),
                     &platform_version.drive.grove_version,
@@ -466,7 +468,7 @@ impl<C> Platform<C> {
                 .value
                 .map_err(|e| {
                     Error::Execution(ExecutionError::CorruptedCodeExecution(Box::leak(
-                        format!("seed: replace_commitment_tree_subtree_root: {e}").into_boxed_str(),
+                        format!("seed: replace_subtree_root: {e}").into_boxed_str(),
                     )))
                 })?;
 
diff --git a/packages/rs-drive-abci/src/shielded_snapshot/mod.rs b/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
index 82fbf1c339a..342b7748283 100644
--- a/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
+++ b/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
@@ -14,7 +14,7 @@
 //!   the underlying RocksDB, cross-validates the reconstructed state against
 //!   the header's `combined_root`, then writes the parent-Merk
 //!   `Element::CommitmentTree` leaf via the new
-//!   `GroveDb::replace_commitment_tree_subtree_root` public API.
+//!   `GroveDb::replace_subtree_root` public API.
 //!
 //! Built on three new public methods we added to grovedb on the
 //! `feat/snapshot-apply-public-api` branch:
@@ -22,7 +22,7 @@
 //! 1. `GroveDb::raw_storage()` — escape hatch to the underlying
 //!    `RocksDbStorage` so we can open a `StorageContext` for raw iteration.
 //! 2. `GroveDb::ingest_subtree_sst(cf, sst_path)` — bulk-ingest an SST file.
-//! 3. `GroveDb::replace_commitment_tree_subtree_root(...)` — patch the
+//! 3. `GroveDb::replace_subtree_root(...)` — patch the
 //!    parent-Merk `Element::CommitmentTree` leaf with a caller-provided
 //!    `combined_root`.
 //!
@@ -559,21 +559,18 @@ pub fn apply_shielded_snapshot(
     let leaf_key = &[SHIELDED_NOTES_KEY];
     let flags = header.flags.map(|b| vec![b]);
 
+    let new_element = Element::new_commitment_tree(header.total_count, header.chunk_power, flags);
     grove
-        .replace_commitment_tree_subtree_root(
+        .replace_subtree_root(
             parent_path,
             leaf_key,
-            header.total_count,
-            header.chunk_power,
-            flags,
+            new_element,
             header.combined_root,
             transaction,
             &platform_version.drive.grove_version,
         )
         .value
-        .map_err(|e| {
-            ShieldedSnapshotError::GroveDb(format!("replace_commitment_tree_subtree_root: {e}"))
-        })?;
+        .map_err(|e| ShieldedSnapshotError::GroveDb(format!("replace_subtree_root: {e}")))?;
 
     Ok(ApplyStats {
         total_count: header.total_count,
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index f94f3092dd6..3db12617a3a 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -52,12 +52,12 @@ enum-map = { version = "2.0.3", optional = true }
 intmap = { version = "3.0.1", features = ["serde"], optional = true }
 chrono = { version = "0.4.35", optional = true }
 itertools = { version = "0.13", optional = true }
-grovedb = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true, default-features = false }
-grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
-grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true, default-features = false }
+grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
 
 [dev-dependencies]
 criterion = "0.5"
@@ -130,6 +130,11 @@ server = [
 full = ["server", "ciborium", "serde", "bs58", "tempfile", "base64", "chrono"]
 cbor_query = ["ciborium", "dpp/platform-value-cbor", "dpp/cbor"]
 grovedb_operations_logging = []
+# Forwards grovedb's `unsafe-dump-load` feature — gates the snapshot-bootstrap
+# escape hatches (`raw_storage`, `ingest_subtree_sst`, `replace_subtree_root`).
+# Off by default; enable in callers that need to dump/restore a subtree
+# out-of-band (e.g. devnet shielded-pool genesis snapshot).
+unsafe-dump-load = ["grovedb/unsafe-dump-load"]
 verify = [
   "grovedb/verify",
   "grovedb-costs",
diff --git a/packages/rs-platform-version/Cargo.toml b/packages/rs-platform-version/Cargo.toml
index 8a4003ac9d7..8675be63b37 100644
--- a/packages/rs-platform-version/Cargo.toml
+++ b/packages/rs-platform-version/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 thiserror = { version = "2.0.12" }
 bincode = { version = "=2.0.1" }
 versioned-feature-core = { git = "https://github.com/dashpay/versioned-feature-core", version = "1.0.0" }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32" }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
 
 [features]
 mock-versions = []
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index 2852791974f..5bab7c3a6e2 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -49,7 +49,7 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 zeroize = "1"
 
 # Shielded pool (optional, behind `shielded` feature)
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
 # Direct `rusqlite` access so `FileBackedShieldedStore::open_path` can set
 # WAL + synchronous=NORMAL pragmas before handing the connection to
 # `ClientPersistentCommitmentTree`. Version locked to match the rev grovedb
diff --git a/packages/rs-sdk/Cargo.toml b/packages/rs-sdk/Cargo.toml
index 709a9f91e83..2f7c8e08e2e 100644
--- a/packages/rs-sdk/Cargo.toml
+++ b/packages/rs-sdk/Cargo.toml
@@ -18,7 +18,7 @@ drive = { path = "../rs-drive", default-features = false, features = [
 ] }
 
 drive-proof-verifier = { path = "../rs-drive-proof-verifier", default-features = false }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "67acdbcb610d8ff34c8ebeffd8262fa2475e9b32", features = [
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", features = [
   "client",
   "sqlite",
 ], optional = true }

From e8f3099e10f18c4ab5d722487060ac74d1e8165b Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Tue, 2 Jun 2026 12:36:10 +0700
Subject: [PATCH 5/7] style: cargo fmt (collapse snapshot_bake_main::run
 signature)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 packages/rs-drive-abci/src/main.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/packages/rs-drive-abci/src/main.rs b/packages/rs-drive-abci/src/main.rs
index bb6d7779f12..1dc1e46d57b 100644
--- a/packages/rs-drive-abci/src/main.rs
+++ b/packages/rs-drive-abci/src/main.rs
@@ -462,10 +462,7 @@ mod snapshot_bake_main {
     /// Intended for the Dockerfile bake stage: produce a snapshot once during
     /// image build, embed in the runtime image, load it at every InitChain
     /// via `DRIVE_SHIELDED_SNAPSHOT`.
-    pub(super) fn run(
-        _config: &PlatformConfig,
-        out_path: &std::path::Path,
-    ) -> Result<(), String> {
+    pub(super) fn run(_config: &PlatformConfig, out_path: &std::path::Path) -> Result<(), String> {
         tracing::info!(
             out = %out_path.display(),
             "snapshot-bake: creating tempdir + bootstrapping fresh GroveDB",

From e230766f0471c7c00d13eec2e8828254117f7075 Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Tue, 2 Jun 2026 16:08:11 +0700
Subject: [PATCH 6/7] chore: bump grovedb to a18f7929 (dashpay/grovedb#752
 merged into develop)

Repoints the pin from the pre-merge feat branch tip
(`2e9dff50455083dc9fbf15b954cea602431acf9d`) to the squash-merge commit on
grovedb develop (`a18f7929460ef9c5d814f61ff84d8805b2a1761b`). Same content,
canonical address.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Cargo.lock                              | 44 ++++++++++++-------------
 packages/rs-dpp/Cargo.toml              |  2 +-
 packages/rs-drive-abci/Cargo.toml       |  8 ++---
 packages/rs-drive/Cargo.toml            | 12 +++----
 packages/rs-platform-version/Cargo.toml |  2 +-
 packages/rs-platform-wallet/Cargo.toml  |  2 +-
 packages/rs-sdk/Cargo.toml              |  2 +-
 7 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7af683a8c73..24b474d0108 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -513,7 +513,7 @@ dependencies = [
  "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "regex",
@@ -2689,7 +2689,7 @@ dependencies = [
 [[package]]
 name = "grovedb"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "axum 0.8.9",
  "bincode",
@@ -2727,7 +2727,7 @@ dependencies = [
 [[package]]
 name = "grovedb-bulk-append-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2743,7 +2743,7 @@ dependencies = [
 [[package]]
 name = "grovedb-commitment-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -2759,7 +2759,7 @@ dependencies = [
 [[package]]
 name = "grovedb-costs"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "integer-encoding",
  "intmap",
@@ -2769,7 +2769,7 @@ dependencies = [
 [[package]]
 name = "grovedb-dense-fixed-sized-merkle-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2782,7 +2782,7 @@ dependencies = [
 [[package]]
 name = "grovedb-element"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2797,7 +2797,7 @@ dependencies = [
 [[package]]
 name = "grovedb-epoch-based-storage-flags"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "grovedb-costs",
  "hex",
@@ -2809,7 +2809,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merk"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2835,7 +2835,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merkle-mountain-range"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2846,7 +2846,7 @@ dependencies = [
 [[package]]
 name = "grovedb-path"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "hex",
 ]
@@ -2854,7 +2854,7 @@ dependencies = [
 [[package]]
 name = "grovedb-query"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "byteorder",
@@ -2870,7 +2870,7 @@ dependencies = [
 [[package]]
 name = "grovedb-storage"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "blake3",
  "grovedb-costs",
@@ -2889,7 +2889,7 @@ dependencies = [
 [[package]]
 name = "grovedb-version"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "thiserror 2.0.18",
  "versioned-feature-core 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -2898,7 +2898,7 @@ dependencies = [
 [[package]]
 name = "grovedb-visualize"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "hex",
  "itertools 0.14.0",
@@ -2907,7 +2907,7 @@ dependencies = [
 [[package]]
 name = "grovedbg-types"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=2e9dff50455083dc9fbf15b954cea602431acf9d#2e9dff50455083dc9fbf15b954cea602431acf9d"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "serde",
  "serde_with 3.20.0",
@@ -3301,7 +3301,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -5112,7 +5112,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
  "heck 0.4.1",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "petgraph",
@@ -5133,7 +5133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5146,7 +5146,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5276,7 +5276,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5314,7 +5314,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
  "windows-sys 0.59.0",
 ]
diff --git a/packages/rs-dpp/Cargo.toml b/packages/rs-dpp/Cargo.toml
index 8ed4036eafc..6bfb4536a9e 100644
--- a/packages/rs-dpp/Cargo.toml
+++ b/packages/rs-dpp/Cargo.toml
@@ -71,7 +71,7 @@ strum = { version = "0.26", features = ["derive"] }
 json-schema-compatibility-validator = { path = '../rs-json-schema-compatibility-validator', optional = true }
 once_cell = "1.19.0"
 tracing = { version = "0.1.41" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.40", features = ["full"] }
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 56737e68e72..4df18cc1895 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -82,7 +82,7 @@ derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
 # bindings, and blake3 for the snapshot-file checksum.
@@ -107,7 +107,7 @@ dpp = { path = "../rs-dpp", default-features = false, features = [
 drive = { path = "../rs-drive", features = ["fixtures-and-mocks"] }
 drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", features = ["client"] }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", features = ["client"] }
 assert_matches = "1.5.0"
 drive-abci = { path = ".", features = ["testing-config", "mocks", "unsafe-dump-load"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
@@ -121,8 +121,8 @@ integer-encoding = { version = "4.0.0" }
 
 # For dump_only_default_and_aux_cfs_under_shielded_subtree_prefix — same
 # subtree-prefix algorithm grovedb uses internally.
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [features]
 default = ["bls-signatures"]
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index 3db12617a3a..f2f40292254 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -52,12 +52,12 @@ enum-map = { version = "2.0.3", optional = true }
 intmap = { version = "3.0.1", features = ["serde"], optional = true }
 chrono = { version = "0.4.35", optional = true }
 itertools = { version = "0.13", optional = true }
-grovedb = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true, default-features = false }
-grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
-grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true, default-features = false }
+grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [dev-dependencies]
 criterion = "0.5"
diff --git a/packages/rs-platform-version/Cargo.toml b/packages/rs-platform-version/Cargo.toml
index 8675be63b37..cbcd9702ad8 100644
--- a/packages/rs-platform-version/Cargo.toml
+++ b/packages/rs-platform-version/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 thiserror = { version = "2.0.12" }
 bincode = { version = "=2.0.1" }
 versioned-feature-core = { git = "https://github.com/dashpay/versioned-feature-core", version = "1.0.0" }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d" }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [features]
 mock-versions = []
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index 5bab7c3a6e2..e9ea678eb55 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -49,7 +49,7 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 zeroize = "1"
 
 # Shielded pool (optional, behind `shielded` feature)
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
 # Direct `rusqlite` access so `FileBackedShieldedStore::open_path` can set
 # WAL + synchronous=NORMAL pragmas before handing the connection to
 # `ClientPersistentCommitmentTree`. Version locked to match the rev grovedb
diff --git a/packages/rs-sdk/Cargo.toml b/packages/rs-sdk/Cargo.toml
index 2f7c8e08e2e..97bdbcb1300 100644
--- a/packages/rs-sdk/Cargo.toml
+++ b/packages/rs-sdk/Cargo.toml
@@ -18,7 +18,7 @@ drive = { path = "../rs-drive", default-features = false, features = [
 ] }
 
 drive-proof-verifier = { path = "../rs-drive-proof-verifier", default-features = false }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "2e9dff50455083dc9fbf15b954cea602431acf9d", features = [
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", features = [
   "client",
   "sqlite",
 ], optional = true }

From e4b1008ceeb7f55a354dbf1790ad8b0b07c9ed6d Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Tue, 2 Jun 2026 17:59:18 +0700
Subject: [PATCH 7/7] refactor(drive-abci): replace
 cfg(create_shielded_test_data) with shielded_test_data Cargo feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Codex reviewer flagged that the previous design split shielded-pool gating
across two mechanisms (a cfg flag from `.cargo/config-shielded-test-data.toml`
plus a `unsafe-dump-load` Cargo feature for the underlying grovedb APIs),
which made it possible to have the cfg set without the feature — surfacing
as cryptic method-missing compile errors instead of a clear feature-not-enabled
message.

Collapses the two mechanisms into a single Cargo feature chain:

  drive-abci/shielded_test_data
   └── drive/shielded_test_data
       └── grovedb/unsafe-dump-load

The grovedb-side feature keeps its `unsafe-dump-load` name since it
describes the primitive there; in this tree the only use case for those
primitives is shielded-pool test seeding, hence the renamed handle.

All `#[cfg(create_shielded_test_data)]` attributes in drive-abci become
`#[cfg(feature = "shielded_test_data")]`. Production builds carry neither
the seeder nor the bake/apply code paths; `SHIELDED_TEST_DATA=true` in
the Dockerfile adds `--features=shielded_test_data` to the cargo
invocation.

Drops:
  * `.cargo/config-shielded-test-data.toml` (no longer needed — the outer
    `create_sdk_test_data` cfg keeps its own `config-test-sdk-data.toml`,
    matching the pre-PR pattern).
  * `create_shielded_test_data` from drive-abci's check-cfg allowlist.

The outer `create_sdk_test_data` gate stays a rustc cfg (unchanged); the
project's existing rationale applies to the SDK-fixture machinery as
before, but doesn't apply to the narrower shielded path add-on.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .cargo/config-shielded-test-data.toml         | 38 -------------------
 Dockerfile                                    | 26 +++++++------
 packages/rs-drive-abci/Cargo.toml             | 17 +++++----
 .../create_genesis_state/test/mod.rs          | 12 +++---
 packages/rs-drive-abci/src/lib.rs             |  7 ++--
 packages/rs-drive-abci/src/main.rs            | 24 ++++++------
 packages/rs-drive/Cargo.toml                  | 11 +++---
 7 files changed, 50 insertions(+), 85 deletions(-)
 delete mode 100644 .cargo/config-shielded-test-data.toml

diff --git a/.cargo/config-shielded-test-data.toml b/.cargo/config-shielded-test-data.toml
deleted file mode 100644
index 9c43b49da3a..00000000000
--- a/.cargo/config-shielded-test-data.toml
+++ /dev/null
@@ -1,38 +0,0 @@
-[target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "target-feature=-crt-static"]
-
-[target.x86_64-unknown-linux-musl]
-rustflags = [
-    "-C",
-    "target-feature=-crt-static",
-    "-C",
-    "target-cpu=x86-64",
-]
-
-[target.x86_64-unknown-linux-gnu]
-rustflags = [
-    "-C",
-    "target-feature=-crt-static",
-    "-C",
-    "target-cpu=x86-64",
-]
-
-[target.aarch64-unknown-linux-gnu]
-linker = "aarch64-linux-gnu-gcc"
-
-[target.wasm32-unknown-unknown]
-rustflags = ['--cfg', 'getrandom_backend="wasm_js"']
-
-# Activates BOTH the base SDK test-data gate and the shielded-pool seeding /
-# snapshot-bake gate. Selected in the Dockerfile when `SHIELDED_TEST_DATA=true`
-# (which implies SDK_TEST_DATA, since shielded fixtures are seeded inside
-# `create_sdk_test_data`).
-[target.'cfg(all())']
-rustflags = [
-    "--cfg",
-    "tokio_unstable",
-    '--cfg',
-    'create_sdk_test_data',
-    '--cfg',
-    'create_shielded_test_data',
-]
diff --git a/Dockerfile b/Dockerfile
index e70599eb24e..b31776de9c8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -439,10 +439,12 @@ FROM deps AS build-drive-abci
 # truth is the dashmate config.
 #
 # SHIELDED_TEST_DATA=true ⇒ implies SDK_TEST_DATA=true (the shielded seeder
-# runs inside `create_sdk_test_data`); selects the dual-cfg cargo profile
-# that activates both `create_sdk_test_data` and `create_shielded_test_data`.
-# The bake stage further down only produces a shielded-pool snapshot when
-# this flag is on.
+# runs inside `create_sdk_test_data`); installs the SDK-test-data cargo
+# profile (sets `--cfg create_sdk_test_data` for the outer SDK-fixture gate)
+# AND passes `--features=shielded_test_data` to cargo. The drive-abci
+# `shielded_test_data` feature compiles in the shielded seeder + bake/apply
+# code and forwards through `drive/shielded_test_data` →
+# `grovedb/unsafe-dump-load` to unlock the underlying grovedb primitives.
 ARG SDK_TEST_DATA
 ARG SHIELDED_TEST_DATA
 ARG ADDITIONAL_FEATURES=""
@@ -473,12 +475,12 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
     FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
-    mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
-    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}unsafe-dump-load"; \
-    elif [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ] || [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}shielded_test_data"; \
+    fi && \
     if [[ -n "${FEATURES_LIST}" ]]; then \
     export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
     fi && \
@@ -565,12 +567,12 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
     FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
-    mv .cargo/config-shielded-test-data.toml .cargo/config.toml; \
-    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}unsafe-dump-load"; \
-    elif [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ] || [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}shielded_test_data"; \
+    fi && \
     if [[ -n "${FEATURES_LIST}" ]]; then \
     export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
     fi && \
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 4df18cc1895..7059bba18e0 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -109,7 +109,7 @@ drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
 grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", features = ["client"] }
 assert_matches = "1.5.0"
-drive-abci = { path = ".", features = ["testing-config", "mocks", "unsafe-dump-load"] }
+drive-abci = { path = ".", features = ["testing-config", "mocks", "shielded_test_data"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
 mockall = { version = "0.13" }
 dash-platform-macros = { path = "../rs-dash-platform-macros" }
@@ -129,12 +129,14 @@ default = ["bls-signatures"]
 mocks = ["mockall", "drive/fixtures-and-mocks", "bls-signatures"]
 console = ["console-subscriber", "tokio/tracing"]
 testing-config = []
-# Forwards `drive/unsafe-dump-load` (and through it `grovedb/unsafe-dump-load`).
-# Enable in builds that need the shielded-pool snapshot bake/apply path —
-# Dockerfile turns this on when `SHIELDED_TEST_DATA=true`. The snapshot-test
-# in this crate's own `#[cfg(test)]` module also requires it (dev-dependency
-# below enables it for `cargo test`).
-unsafe-dump-load = ["drive/unsafe-dump-load"]
+# Compiles in the shielded-pool seeder, the `snapshot-bake` subcommand, and
+# the bake/apply API used at devnet InitChain. Pulls `drive/shielded_test_data`
+# (which forwards to `grovedb/unsafe-dump-load`) so the underlying snapshot
+# primitives become available. Dockerfile turns this on when
+# `SHIELDED_TEST_DATA=true`. The snapshot roundtrip test in this crate's own
+# `#[cfg(test)]` module also requires it — the dev-dependency below enables
+# it for `cargo test`.
+shielded_test_data = ["drive/shielded_test_data"]
 grovedbg = ["drive/grovedbg"]
 # `abci-server replay` command
 replay = ["dep:time", "tenderdash-abci/serde"]
@@ -148,6 +150,5 @@ path = "src/main.rs"
 unexpected_cfgs = { level = "warn", check-cfg = [
   'cfg(tokio_unstable)',
   'cfg(create_sdk_test_data)',
-  'cfg(create_shielded_test_data)',
   'cfg(feature, values("__shielded_strategy_tests"))',
 ] }
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
index 70c575c40e7..f6315d2225f 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
@@ -8,9 +8,8 @@ use drive::grovedb::TransactionArg;
 
 mod addresses;
 // Shielded-pool seeding (incl. snapshot bake/apply tests) is gated separately
-// from the base SDK fixtures — see the comment in `create_sdk_test_data` and
-// `.cargo/config-shielded-test-data.toml`.
-#[cfg(any(create_shielded_test_data, test))]
+// from the base SDK fixtures — see the comment in `create_sdk_test_data`.
+#[cfg(any(feature = "shielded_test_data", test))]
 mod shielded;
 mod tokens;
 
@@ -46,10 +45,9 @@ impl<C> Platform<C> {
         // Shielded-pool seeding is gated separately so SDK_TEST_DATA-only
         // builds get the base fixtures (addresses, tokens) without paying the
         // shielded-seed setup cost or shipping the bake/apply code path. Enable
-        // by building with `--cfg create_shielded_test_data` (the
-        // `.cargo/config-shielded-test-data.toml` profile, selected in the
-        // Dockerfile via the `SHIELDED_TEST_DATA=true` build arg).
-        #[cfg(create_shielded_test_data)]
+        // by building with `--features=shielded_test_data` — the Dockerfile
+        // passes that flag when `SHIELDED_TEST_DATA=true`.
+        #[cfg(feature = "shielded_test_data")]
         self.create_data_for_shielded_pool(block_info, transaction, platform_version)?;
 
         Ok(())
diff --git a/packages/rs-drive-abci/src/lib.rs b/packages/rs-drive-abci/src/lib.rs
index 9c997c9ad62..ac1ac54661b 100644
--- a/packages/rs-drive-abci/src/lib.rs
+++ b/packages/rs-drive-abci/src/lib.rs
@@ -93,9 +93,10 @@ pub mod server;
 /// Test-data tooling only: the bake reads a pool seeded by
 /// `create_data_for_shielded_pool` and the apply runs from that same seeder's
 /// fast-path, so the module has no purpose in a production build. Gated on
-/// `create_shielded_test_data` (its only callers) plus `test` (the genesis
-/// seeder's test module exercises it under `cargo test`).
-#[cfg(any(create_shielded_test_data, test))]
+/// the `shielded_test_data` Cargo feature (which also enables the underlying
+/// grovedb APIs through the dep chain) plus `test`, so the snapshot
+/// roundtrip test exercises it under `cargo test`.
+#[cfg(any(feature = "shielded_test_data", test))]
 pub mod shielded_snapshot;
 /// Verification helpers
 pub mod verify;
diff --git a/packages/rs-drive-abci/src/main.rs b/packages/rs-drive-abci/src/main.rs
index 1dc1e46d57b..347a21aeca1 100644
--- a/packages/rs-drive-abci/src/main.rs
+++ b/packages/rs-drive-abci/src/main.rs
@@ -78,9 +78,9 @@ enum Commands {
     /// Intended for the Dockerfile bake stage, where the snapshot file is
     /// embedded into the runtime image and consumed at boot via
     /// `DRIVE_SHIELDED_SNAPSHOT=<path>`. Requires the binary to be built
-    /// with `--cfg create_shielded_test_data` so that `create_genesis_state`
-    /// invokes the seeder — the command is compiled out otherwise.
-    #[cfg(create_shielded_test_data)]
+    /// with `--features=shielded_test_data` — the command is compiled out
+    /// otherwise.
+    #[cfg(feature = "shielded_test_data")]
     #[command()]
     SnapshotBake {
         /// Where to write the snapshot file. Parent directory must exist.
@@ -185,7 +185,7 @@ impl Cli {
             Commands::Config => dump_config(&config)?,
             Commands::Status => runtime.block_on(check_status(&config))?,
             Commands::Verify => drive_abci::verify::run(&config, true)?,
-            #[cfg(create_shielded_test_data)]
+            #[cfg(feature = "shielded_test_data")]
             Commands::SnapshotBake { out } => snapshot_bake_main::run(&config, &out)?,
             Commands::Version => print_version(),
             #[cfg(feature = "replay")]
@@ -205,14 +205,14 @@ fn main() -> Result<(), ExitCode> {
     // skip `load_config` (which would panic on missing GRPC_BIND_ADDRESS etc.)
     // and use a sensible default. Other subcommands (Start / Status / etc.)
     // still need the full config. The command only exists under
-    // `create_shielded_test_data`, so the branch is compiled out otherwise.
-    #[cfg(create_shielded_test_data)]
+    // `feature = "shielded_test_data"`, so the branch is compiled out otherwise.
+    #[cfg(feature = "shielded_test_data")]
     let config = if matches!(cli.command, Commands::SnapshotBake { .. }) {
         drive_abci::config::PlatformConfig::default_local()
     } else {
         load_config(&cli.config)
     };
-    #[cfg(not(create_shielded_test_data))]
+    #[cfg(not(feature = "shielded_test_data"))]
     let config = load_config(&cli.config);
 
     // Start tokio runtime and thread listening for signals.
@@ -348,9 +348,9 @@ fn dump_config(config: &PlatformConfig) -> Result<(), String> {
 
 /// Everything that exists only to support the `snapshot-bake` subcommand
 /// (used by the Dockerfile bake stage to pre-build a shielded-pool snapshot
-/// for the runtime image to apply at InitChain). Gated as a whole on
-/// `create_shielded_test_data` so production builds carry none of it.
-#[cfg(create_shielded_test_data)]
+/// for the runtime image to apply at InitChain). Gated as a whole on the
+/// `shielded_test_data` Cargo feature so production builds carry none of it.
+#[cfg(feature = "shielded_test_data")]
 mod snapshot_bake_main {
     use dpp::dashcore::ephemerealdata::chain_lock::ChainLock;
     use dpp::dashcore::{Block, BlockHash, Header, InstantLock, QuorumHash, Transaction, Txid};
@@ -455,7 +455,7 @@ mod snapshot_bake_main {
 
     /// Produce a shielded-pool snapshot at `out_path` from a fresh temporary
     /// GroveDB. Runs the full `create_genesis_state` cycle (which, under
-    /// `cfg(create_shielded_test_data)`, invokes the shielded-pool seeder),
+    /// `feature = "shielded_test_data"`, invokes the shielded-pool seeder),
     /// then dumps the resulting subtree. Self-contained — `_config` is
     /// ignored (we use a tempdir + sensible defaults).
     ///
@@ -495,7 +495,7 @@ mod snapshot_bake_main {
         // than seeding a fresh one.
         std::env::remove_var("DRIVE_SHIELDED_SNAPSHOT");
 
-        tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under cfg(create_shielded_test_data))");
+        tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under feature = \"shielded_test_data\")");
         platform
             .create_genesis_state(
                 1, // genesis_core_height (placeholder for bake)
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index f2f40292254..48b3d8cfc75 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -130,11 +130,12 @@ server = [
 full = ["server", "ciborium", "serde", "bs58", "tempfile", "base64", "chrono"]
 cbor_query = ["ciborium", "dpp/platform-value-cbor", "dpp/cbor"]
 grovedb_operations_logging = []
-# Forwards grovedb's `unsafe-dump-load` feature — gates the snapshot-bootstrap
-# escape hatches (`raw_storage`, `ingest_subtree_sst`, `replace_subtree_root`).
-# Off by default; enable in callers that need to dump/restore a subtree
-# out-of-band (e.g. devnet shielded-pool genesis snapshot).
-unsafe-dump-load = ["grovedb/unsafe-dump-load"]
+# Pass-through to grovedb's `unsafe-dump-load` feature — unlocks the
+# snapshot-bootstrap escape hatches (`raw_storage`, `ingest_subtree_sst`,
+# `replace_subtree_root`). Named after the drive-abci consumer feature
+# (`shielded_test_data`) rather than the grovedb primitive because in this
+# tree the only use case for these APIs is shielded-pool test seeding.
+shielded_test_data = ["grovedb/unsafe-dump-load"]
 verify = [
   "grovedb/verify",
   "grovedb-costs",