feat(ffi): upload progress on wallet path + distinct timeout/disk-space errors

[Nic-dorman]

FFI-only mobile error-handling + progress improvements for the next AntFfi 0.0.8 release. No ant-core bump — still ant-core 0.3.1 (ant-cli-v0.2.11), so nothing on the payment/security surface moves.

Changes

Ticket	Change
V2-597	Add fileUploadPublicWithProgress / fileUploadPrivateWithProgress — the wallet-backed (built-in payment) counterparts of fileUploadPublic/Private. They bridge ant-core's file_upload_with_progress UploadEvents to the existing ProgressListener (encrypting/quoting/storing phases). The external-signer path already had progress via prepare/finalize_*_with_progress; this closes the gap on the wallet path.
V2-599	fileDownloadPublic no longer flattens every ant-core error into NetworkError. It now propagates through the From<ant_core::data::Error> mapping, so a timeout / out-of-disk failure surfaces as its own variant instead of a misleading "network error".
V2-600	Map ant-core Error::InsufficientDiskSpace → new ClientError::InsufficientDiskSpace (previously swallowed by the catch-all InternalError).
V2-601 (timeout half)	Error::Timeout now maps to a dedicated ClientError::Timeout variant instead of being folded into NetworkError with a "timeout:" prefix.

Out of scope (need upstream ant-client work)

• V2-601 insufficient-funds half — ant-core wraps low balance in a generic Payment(String) with no distinct variant. Needs a core InsufficientFunds variant; V2-601 stays open for it.
• V2-598 cancellation — no CancellationToken on core's data upload/download path (only implicit receiver-drop). Rescoped to a download-only investigation.

Verification

• cargo fmt --all + cargo clippy --all-targets --all-features -D warnings clean
• cargo test --all — 8 passed
• Regenerated Swift + Kotlin bindings and confirmed both expose fileUploadPublicWithProgress/fileUploadPrivateWithProgress and the Timeout / InsufficientDiskSpace error variants.

Additive uniffi enum change (new variants), so bindings and Rust stay in lockstep per-release; consumers pick it up on the 0.0.8 rebuild.

🤖 Generated with Claude Code

[Nic-dorman]

Both in-scope misses from the release review addressed in 64469ed (branch also rebased onto current main):

• wait_for_receipt timeout now returns ClientError::Timeout instead of NetworkError — the most user-visible timeout in the WalletConnect external-signer flow now carries the variant this PR introduced.
• Download ENOSPC: core Io(StorageFull) from download file writes now maps to ClientError::InsufficientDiskSpace instead of InternalError (guard arm on the From impl; other Io kinds still fall through).
• Corrected the missing-record mapping note (missing records surface as core InvalidData → FFI InvalidInput at the 0.3.1 pin, not Network; the NotFound arm arrives with the 0.4.x pin bump now that fix(core): type absent records as Error::NotFound (was InvalidData) ant-client#153 is merged).
• Added From-mapping unit tests (StorageFull → InsufficientDiskSpace, other Io → InternalError, Timeout → Timeout).

Gates on 64469ed: fmt + clippy -D warnings clean, 11/11 tests. No interface change (no new variants), so no binding regeneration needed.

Holding merge pending Nic's go-ahead.

[dirvine]

Panel review — ant-sdk#214

Verdict: approve. Severe blockers: none.

What it does (verified against PR head 64469ed)

• file_upload_public_with_progress / file_upload_private_with_progress (client.rs:624, client.rs:692) — wallet-backed progress methods bridging ant_core::UploadEvent through the existing upload_progress_bridge (client.rs:90) → map_upload_event (client.rs:28) → ProgressListener. Progress is awaited before data_map_store, matching the non-progress versions exactly.
• Error::Timeout → ClientError::Timeout and Error::InsufficientDiskSpace → ClientError::InsufficientDiskSpace added as first-class variants in the From<ant_core::data::Error> impl (lib.rs:296–297). Error::Io(StorageFull) also maps to InsufficientDiskSpace (lib.rs:302) — covers the download-ENOSPC case the non-progress file_download_public hits on the file write path.
• file_download_public no longer flattens every ant-core error into NetworkError — the explicit map_err was deleted in favour of the ? / From impl (client.rs:798).
• wait_for_receipt in payments.rs:194 now returns ClientError::Timeout (was NetworkError) — addresses the WalletConnect external-signer timeout that was the most user-visible miss in the release review.
• Progress doc updated (lib.rs:233) to describe the three upload phases and which methods emit each, replacing the stale "storing only" doc.

Caveats (non-blocking under severe-only threshold)

• New ClientError::Timeout and InsufficientDiskSpace variants are additive uniffi enum changes — Swift + Kotlin bindings must be regenerated on the 0.0.8 release. fffi-ci.yml generates them in CI for the new methods, so export-surface regressions are caught at PR time. PR body confirms they were regenerated and the new methods + variants are exposed.
• V2-601 insufficient-funds half stays open: ant-core wraps low balance in a generic Payment(String). The NotFound arm and the InsufficientFunds arm will land with the 0.4.x pin bump (V2-650 / V2-686 / V2-601 follow-up). Documented as out-of-scope, not silently missed.
• ant-core pin: confirmed at 0.3.1 (ant-cli-v0.2.11 tag, commit e1b5eac6). No protocol/payment surface moves — purely FFI ergonomics + better error taxonomy.
• 51-commit branch is stale-branch pile-up — main..HEAD includes merges of work already on main (e.g. chore(antd): release v0.11.1 #218 antd-0.11.1). Not introduced by this PR. Recommend a fast-forward / rebase before merge, cosmetic only.

Verified locally (against PR head 64469ed, detached worktree)

• cargo fmt --all -- --check — clean
• cargo clippy --all-targets --all-features -- -D warnings — clean
• cargo test --lib --no-fail-fast — 11/11 pass, including the 3 new From-mapping tests (core_io_storage_full_maps_to_insufficient_disk_space, core_io_other_kinds_stay_internal, core_timeout_maps_to_timeout_variant) which exercise the new arms against the real ant-core 0.3.1 types
• CI: Check (ant-ffi) ✅ pass, Security audit ✅ pass

Recommendation

Approve. The PR is focused, additive, gated by tests, and the two post-review fixes (commit 64469ed) addressed exactly the misses Nic flagged in the release review (wait_for_receipt timeout variant + download ENOSPC mapping). No protocol/security/payment surface change.

---

Panel review (Hermes). Holding formal sign-off with Nic per the PR's "Holding merge pending Nic's go-ahead" note.

[Nic-dorman]

Thanks for the review. Two notes on the caveats:

• Branch state: the PR is 2 commits on top of current main (7f3918f + 64469ed, rebased onto d1f3cb0/chore(antd): release v0.11.1 #218 yesterday) — GitHub's commit list and git rev-list origin/main..HEAD both show 2. The 51-commit main..HEAD delta looks like a comparison against a stale local main; no rebase needed.
• Bindings regeneration: agreed — the Swift/Kotlin bindings regenerate as part of the 0.0.8 release cut per RELEASING.md (same lockstep step as every release), tracked on the release ticket (V2-686).

Merge remains held for Nic's go-ahead.