fix(sdk): run blocking Swift SDK Platform queries off the caller's actor

packages/rs-sdk-ffi/src/data_contract/put.rs

@@ -29,7 +29,7 @@ pub unsafe extern "C" fn dash_sdk_data_contract_put_to_platform(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let data_contract = &*(data_contract_handle as *const DataContract);
     let identity_public_key = &*(identity_public_key_handle as *const IdentityPublicKey);
     let signer = &*(signer_handle as *const VTableSigner);
@@ -86,7 +86,7 @@ pub unsafe extern "C" fn dash_sdk_data_contract_put_to_platform_and_wait(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let data_contract = &*(data_contract_handle as *const DataContract);
     let identity_public_key = &*(identity_public_key_handle as *const IdentityPublicKey);
     let signer = &*(signer_handle as *const VTableSigner);

packages/rs-sdk-ffi/src/document/create.rs

@@ -88,7 +88,7 @@ pub unsafe extern "C" fn dash_sdk_document_create(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     let contract_id_str = match CStr::from_ptr(params.data_contract_id).to_str() {
         Ok(s) => s,

packages/rs-sdk-ffi/src/document/delete.rs

@@ -57,7 +57,7 @@ pub unsafe extern "C" fn dash_sdk_document_delete(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     // Parse document ID
     let document_id_str = match CStr::from_ptr(document_id).to_str() {
@@ -218,7 +218,7 @@ pub unsafe extern "C" fn dash_sdk_document_delete_and_wait(
 
     info!("[DOCUMENT DELETE] starting document delete operation");
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
     // Parse document ID

packages/rs-sdk-ffi/src/document/price.rs

@@ -55,7 +55,7 @@ pub unsafe extern "C" fn dash_sdk_document_update_price_of_document(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -195,7 +195,7 @@ pub unsafe extern "C" fn dash_sdk_document_update_price_of_document_and_wait(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 

packages/rs-sdk-ffi/src/document/purchase.rs

@@ -56,7 +56,7 @@ pub unsafe extern "C" fn dash_sdk_document_purchase(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -226,7 +226,7 @@ pub unsafe extern "C" fn dash_sdk_document_purchase_and_wait(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 

packages/rs-sdk-ffi/src/document/put.rs

@@ -58,7 +58,7 @@ pub unsafe extern "C" fn dash_sdk_document_put_to_platform(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let identity_public_key = &*(identity_public_key_handle as *const IdentityPublicKey);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
@@ -228,7 +228,7 @@ pub unsafe extern "C" fn dash_sdk_document_put_to_platform_and_wait(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let identity_public_key = &*(identity_public_key_handle as *const IdentityPublicKey);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);

packages/rs-sdk-ffi/src/document/queries/fetch.rs

@@ -31,7 +31,7 @@ pub unsafe extern "C" fn dash_sdk_document_fetch_by_contract_id(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     let contract_id_str = match CStr::from_ptr(contract_id).to_str() {
         Ok(s) => s,

packages/rs-sdk-ffi/src/document/replace.rs

@@ -55,7 +55,7 @@ pub unsafe extern "C" fn dash_sdk_document_replace_on_platform(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -206,7 +206,7 @@ pub unsafe extern "C" fn dash_sdk_document_replace_on_platform_and_wait(
 
     info!("[DOCUMENT REPLACE] starting document replace operation");
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 

packages/rs-sdk-ffi/src/document/transfer.rs

@@ -68,7 +68,7 @@ pub unsafe extern "C" fn dash_sdk_document_transfer_to_identity(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     // Parse data contract ID
     let contract_id_str = match CStr::from_ptr(data_contract_id).to_str() {
@@ -237,7 +237,7 @@ pub unsafe extern "C" fn dash_sdk_document_transfer_to_identity_and_wait(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let document = &*(document_handle as *const Document);
     // Parse data contract ID
     let contract_id_str = match CStr::from_ptr(data_contract_id).to_str() {

packages/rs-sdk-ffi/src/identity/create.rs

@@ -22,7 +22,7 @@ pub unsafe extern "C" fn dash_sdk_identity_create(sdk_handle: *mut SDKHandle) ->
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     let result: Result<Identity, FFIError> = wrapper.runtime.block_on(async {
         // For now, create a random identity

packages/rs-sdk-ffi/src/identity/put.rs

@@ -52,7 +52,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_instant_lock(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let identity = &*(identity_handle as *const Identity);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -140,7 +140,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_instant_lock_and
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let identity = &*(identity_handle as *const Identity);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -225,7 +225,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_chain_lock(
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let identity = &*(identity_handle as *const Identity);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 
@@ -302,7 +302,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_chain_lock_and_w
         ));
     }
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
     let identity = &*(identity_handle as *const Identity);
     let signer = &*(signer_handle as *const crate::signer::VTableSigner);
 

packages/rs-sdk-ffi/src/identity/transfer.rs

@@ -93,7 +93,7 @@ pub unsafe extern "C" fn dash_sdk_identity_transfer_credits(
         signer_handle
     );
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     // SAFETY: Null check was performed above. Caller must guarantee the pointer is valid
     // and points to a live Identity. We cannot detect dangling pointers without a handle

packages/rs-sdk-ffi/src/identity/withdraw.rs

@@ -83,7 +83,7 @@ pub unsafe extern "C" fn dash_sdk_identity_withdraw(
         core_fee_per_byte, public_key_id, "dash_sdk_identity_withdraw: parameters"
     );
 
-    let wrapper = &mut *(sdk_handle as *mut SDKWrapper);
+    let wrapper = &*(sdk_handle as *const SDKWrapper);
 
     // SAFETY: Null check was performed above. Caller must guarantee the pointer is valid
     // and points to a live Identity. We cannot detect dangling pointers without a handle

packages/rs-sdk-ffi/src/sdk.rs

@@ -40,6 +40,17 @@ fn apply_version(builder: SdkBuilder, platform_version: u32) -> Result<SdkBuilde
 }
 
 /// Internal SDK wrapper
+///
+/// A single `SDKHandle` is used from several threads at once (the Swift SDK
+/// runs Platform queries concurrently off the caller's actor), so every FFI
+/// entry point that is handed a live handle must borrow it shared:
+/// `&*(handle as *const SDKWrapper)`. Nothing here needs `&mut` once the
+/// wrapper is built: `Sdk` is `Send + Sync`, `runtime` is an `Arc`, and the
+/// trusted provider mutates only through its own interior locks. Taking
+/// `&mut SDKWrapper` from a handle another thread may be using would alias a
+/// live shared borrow, which is undefined behaviour even if nothing is
+/// written. The one exclusive operation is `dash_sdk_destroy`, whose contract
+/// is that the caller has already stopped every other use of the handle.
 pub(crate) struct SDKWrapper {
     pub sdk: Sdk,
     pub runtime: Arc<BigStackRuntime>,
@@ -514,6 +525,11 @@ pub unsafe extern "C" fn dash_sdk_create_trusted(config: *const DashSDKConfig) -
 /// # Safety
 /// - `handle` must be a valid pointer previously returned by this SDK and not yet destroyed.
 /// - It may be null (no-op). After this call the handle must not be used again.
+/// - This is the only entry point that takes the wrapper exclusively, so no
+///   other call on the same handle may be in flight or start concurrently.
+///   The Swift SDK calls it only from `SDK.deinit`, which cannot run while a
+///   query holds its `SDK` (`performBlockingQuery` retains `self` across the
+///   FFI call).
 #[no_mangle]
 pub unsafe extern "C" fn dash_sdk_destroy(handle: *mut SDKHandle) {
     if !handle.is_null() {

packages/rs-sdk-ffi/src/token/burn.rs

@@ -52,7 +52,7 @@ pub unsafe extern "C" fn dash_sdk_token_burn(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/claim.rs

@@ -51,7 +51,7 @@ pub unsafe extern "C" fn dash_sdk_token_claim(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/config_update.rs

@@ -53,7 +53,7 @@ pub unsafe extern "C" fn dash_sdk_token_update_contract_token_configuration(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
 
     // Convert transition_owner_id from bytes to Identifier (32 bytes)
     let transition_owner_id = {

packages/rs-sdk-ffi/src/token/destroy_frozen_funds.rs

@@ -51,7 +51,7 @@ pub unsafe extern "C" fn dash_sdk_token_destroy_frozen_funds(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/emergency_action.rs

@@ -67,7 +67,7 @@ pub unsafe extern "C" fn dash_sdk_token_emergency_action(
     // SAFETY: We've verified all pointers are non-null above
     // However, we cannot validate if they point to valid memory without dereferencing
     // For test safety, we should create proper mock handles instead of using arbitrary values
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/freeze.rs

@@ -51,7 +51,7 @@ pub unsafe extern "C" fn dash_sdk_token_freeze(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
 
     // Convert transition_owner_id from bytes to Identifier (32 bytes)
     let transition_owner_id = {

packages/rs-sdk-ffi/src/token/mint.rs

@@ -67,7 +67,7 @@ pub unsafe extern "C" fn dash_sdk_token_mint(
 
     eprintln!("🟦 FFI TOKEN MINT: Extracting pointers");
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/purchase.rs

@@ -51,7 +51,7 @@ pub unsafe extern "C" fn dash_sdk_token_purchase(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/set_price.rs

@@ -52,7 +52,7 @@ pub unsafe extern "C" fn dash_sdk_token_set_price(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
 
     // Convert transition_owner_id from bytes to Identifier (32 bytes)
     let transition_owner_id = {

packages/rs-sdk-ffi/src/token/transfer.rs

@@ -52,7 +52,7 @@ pub unsafe extern "C" fn dash_sdk_token_transfer(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
     let identity_public_key = unsafe { &*(identity_public_key_handle as *const IdentityPublicKey) };
     let signer = unsafe { &*(signer_handle as *const crate::signer::VTableSigner) };
     let params = unsafe { &*params };

packages/rs-sdk-ffi/src/token/unfreeze.rs

@@ -48,7 +48,7 @@ pub unsafe extern "C" fn dash_sdk_token_unfreeze(
     }
 
     // SAFETY: We've verified all pointers are non-null above
-    let wrapper = unsafe { &mut *(sdk_handle as *mut SDKWrapper) };
+    let wrapper = unsafe { &*(sdk_handle as *const SDKWrapper) };
 
     // Convert transition_owner_id from bytes to Identifier (32 bytes)
     let transition_owner_id = {