fix(dashmate): re-sync stale 3.x Drive and rs-dapi images

packages/dashmate/configs/getConfigFileMigrationsFactory.js

@@ -1521,8 +1521,54 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
         return configFile;
       },
       '4.0.0-rc.3': (configFile) => {
+        // Re-sync Drive ABCI and rs-dapi docker images that dashmate
+        // 3.0.x → 4.0.0-rc.2 left at the protocol-11 default tag
+        // (`dashpay/drive:3`, `dashpay/rs-dapi:3`), causing nodes to
+        // crash-loop after protocol 12 activation (#3889).
+        //
+        // Pre-3.0.0 → 3.0.0 already re-synced these images, but nodes
+        // already on 3.0.x skipped the 3.0.0 step (semver.gt filter),
+        // and the 3.0.1 / 3.0.2 / 3.1.0 migrations only touched
+        // Core / Gateway / Tenderdash images.
+        //
+        // The original attempt (#3889) keyed this migration at the
+        // same version it shipped with (4.0.0-rc.2), so
+        // already-stamped 4.0.0-rc.2 configs short-circuit in
+        // migrateConfigFile (fromVersion === toVersion). Re-keying at
+        // the next release ensures the fix fires for both:
+        //   • 3.0.x → 4.0.0-rc.x upgrades (the loop runs every
+        //     migration with key > fromVersion, regardless of
+        //     toVersion), and
+        //   • 4.0.0-rc.2 → 4.0.0-rc.3 once a chore(release) bumps
+        //     packages/dashmate/package.json (the convention; cf.
+        //     #3794 + #3796 for the 3.0.2 Envoy CVE).
+        //
+        // Only rewrite the stale dashmate-shipped tags — same style
+        // as the 3.0.2 Envoy CVE migration. A custom / private /
+        // manually-corrected image (private fork, vendor-patched
+        // build, `:latest`, etc.) is left untouched.
+        // The 3.x line shipped four prerelease label series:
+        //   `3.0.0-dev.X` / `3.1.0-dev.X` → `:3-dev`
+        //   `3.0.0-rc.X`                  → `:3-rc`
+        //   `3.0.1-hotfix.{1..4}` /
+        //   `3.1.0-hotfix.1`              → `:3-hotfix`
+        //   stable 3.0.0 / 3.0.1 / 3.0.2 / 3.1.0 → `:3`
+        // All of them resolve to a protocol-11 image and crash-loop
+        // after protocol 12 activation. Keep the alternation tight so
+        // custom tags (`:3-mycorp`, `:3.0.0`, `:latest`, etc.) survive.
+        const isStaleDriveImage = (image) => (
+          typeof image === 'string'
+          && /^dashpay\/drive:3(?:-(?:dev|rc|hotfix))?$/.test(image)
+        );
+        const isStaleRsDapiImage = (image) => (
+          typeof image === 'string'
+          && /^dashpay\/rs-dapi:3(?:-(?:dev|rc|hotfix))?$/.test(image)
+        );
+
         Object.entries(configFile.configs)
-          .forEach(([, options]) => {
+          .forEach(([name, options]) => {
+            const defaultConfig = getDefaultConfigByNameOrGroup(name, options.group);
+
             // Add responseHeaders toggle to rate limiter (default true so existing
             // deployments keep emitting RateLimit-* headers; rs-dapi-client depends
             // on RateLimit-Reset to apply precise ban windows instead of the
@@ -1535,6 +1581,20 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
               && typeof options.platform.gateway.rateLimiter.responseHeaders === 'undefined') {
               options.platform.gateway.rateLimiter.responseHeaders = base.get('platform.gateway.rateLimiter.responseHeaders');
             }
+
+            const driveDocker = options.platform?.drive?.abci?.docker;
+            if (driveDocker
+              && isStaleDriveImage(driveDocker.image)
+              && defaultConfig.has('platform.drive.abci.docker.image')) {
+              driveDocker.image = defaultConfig.get('platform.drive.abci.docker.image');
+            }
+
+            const rsDapiDocker = options.platform?.dapi?.rsDapi?.docker;
+            if (rsDapiDocker
+              && isStaleRsDapiImage(rsDapiDocker.image)
+              && defaultConfig.has('platform.dapi.rsDapi.docker.image')) {
+              rsDapiDocker.image = defaultConfig.get('platform.dapi.rsDapi.docker.image');
+            }
           });
 
         return configFile;