mainnet-v1.82.3

## Protocol
#### Sui Protocol Version in this release: `139`

https://github.com/MystenLabs/sui/pull/27989: Adds protocol version 139 with the `enable_forwarding_addresses` flag (devnet only). When enabled, the forwarding address registry is sequenced as an implicitly read system object and may be passed as a shared input.

https://github.com/MystenLabs/sui/pull/28223: Protocol version 139 reduces the non-refundable storage fee from 1% to 0.01% of the storage rebate.

https://github.com/MystenLabs/sui/pull/27328: Under protocol version 131, random-beacon DKG that misses its timeout round now keeps running and can re-enable randomness mid-epoch if it completes, instead of disabling randomness for the whole epoch.

https://github.com/MystenLabs/sui/pull/28233: On mainnet, protocol version 138 reduces the non-refundable storage fee from 1% to 0.01%.

https://github.com/MystenLabs/sui/pull/28224: Protocol version 139 charges non-system package inputs 1% of the per-byte object read cost.

## Nodes (Validators and Full nodes)

https://github.com/MystenLabs/sui/pull/28182: Full nodes that do not enable object or checkpoint pruning now drop `executed_transaction_digests` entries older than the previous epoch, bounding that table's disk and (on tidehunter) memory footprint. No action required.

https://github.com/MystenLabs/sui/pull/27909: Consensus consumers can opt into full-epoch replay with application acknowledgements and progress notifications. Opt-in consumers must drain commits during startup and acknowledge them after application. Existing Sui consumers require no migration.

## gRPC

https://github.com/MystenLabs/sui/pull/27981: kv-rpc accepts an optional `x-sui-consistent-read-checkpoint` request header. When set, the server waits until it can serve data up to that checkpoint before answering, and returns `Unavailable` if it cannot within its timeout. Requests without the header are unaffected.

https://github.com/MystenLabs/sui/pull/28157: When `enable-simulate-allowed-proposers` is on, `SimulateTransaction` only restricts the returned transaction to allowed proposers for clients that send an `x-sui-client-protocol-version` header of 136 or higher.

https://github.com/MystenLabs/sui/pull/28257: Adds `SignatureScheme::MLDSA65 = 7`. ML-DSA-65 signatures and multisig members can be submitted through `ExecuteTransaction` and are verified by `VerifySignature`.

https://github.com/MystenLabs/sui/pull/28348: `SubscribeTransactions` and `SubscribeCheckpoints` now fill `effects` object types, clever errors and event `json` when the read mask requests them, matching `GetTransaction`. `ListTransactions` and `ListEvents` requests below the node's retention now return `OUT_OF_RANGE` instead of `INTERNAL`.

## JSON-RPC

https://github.com/MystenLabs/sui/pull/27907: JSONRPC service is removed from the Fullnode and on startup the old DB will be removed to free up disk space.

## GraphQL

https://github.com/MystenLabs/sui/pull/28162: Resuming a subscription with `after`/`afterCheckpoint` no longer replays checkpoints at or below the resume point when the serving replica's streamed tip lags that point.

https://github.com/MystenLabs/sui/pull/28158: Forwards the caller's `x-sui-client-protocol-version` header to fullnode gRPC requests, allowing simulation responses to respect the caller's supported protocol version.

https://github.com/MystenLabs/sui/pull/28176: New `[limits] ledger-grpc-num-connections` config (default 4) sets how many connections GraphQL opens to the ledger service.

https://github.com/MystenLabs/sui/pull/28257: Adds `MlDsa65Signature` and `MlDsa65PublicKey` (additive).

## CLI

https://github.com/MystenLabs/sui/pull/28096: In `sui move test`, the test-only `allowance::new_withdrawal_for_testing` and `allowance::new_sponsor_withdrawal_for_testing` now take the inner `Withdrawal<T>` instead of a funder and amount; build it with `test_scenario::withdraw_balance_from_address(funder, amount)` after sending the funder a balance. `test_scenario` now aborts with `EUnbackedWithdrawal` when a transaction withdraws more from an owner than it holds, instead of clamping the balance to zero.

https://github.com/MystenLabs/sui/pull/28213: `sui client faucet` now supports Testnet as well as Devnet, using the faucets' proof-of-work API. The CLI solves a challenge before the faucet pays out, so requests take longer than before, and funds go to the recipient's address balance. With `--url`, pass a proof-of-work faucet's base URL, or a full `/gas` or `/v2/gas` URL for a faucet that doesn't use proof of work, such as the local one.

## Rust SDK

https://github.com/MystenLabs/sui/pull/28257: Bumps to the sui-rust-sdk revision with ML-DSA-65 support.

---
#### Full Log: https://github.com/MystenLabs/sui/commits/mainnet-v1.82.3