feat: add private payment requests

[ben-kaufman]

This PR adds private Paykit Payment Requests to Bitkit.

Description

1. Automatically opens incoming requests in the existing Send confirmation flow with the requesting contact, exact amount, and a Payment Request title.
2. Keeps dismissed requests actionable through a bell, preview sheet, and full request history, with manual reopen and explicit rejection.
3. Adds outgoing request creation from Receive for linked, saved contacts, including amount, note, expiry, queued delivery state, and sent history.
4. Drops expired or remotely unavailable requests, keeps presentation state scoped to the active Pubky identity, and protects account changes, sheet transitions, and overlapping actions.
5. Requires strict private resolution for requests: a consumed Private Payment List is never reused, another endpoint from that list is not attempted, and public details are never used as fallback while waiting for a newer list.
6. Updates Paykit to 0.1.0-rc44 and adds local E2E homeserver configuration plus safe cold-start restoration for externally managed Pubky sessions.

The request payload itself remains SDK-backed and durable; Bitkit persists only encrypted, identity-scoped presentation suppression, not a duplicate request queue. Payment proofs and receipts remain out of scope.

Dependencies:

• Paykit 0.1.0-rc44
• Local Locks interoperability was verified with paykit-server#2 at 41cda2567226a690a012770017d5e7c1d49e2a2b.
• Companion iOS PR: synonymdev/bitkit-ios#676

Preview

N/A — proof recordings were completed locally and are intentionally not attached to the PR.

QA Notes

Manual Tests

• 1. Clean wallet → create Pubky profile → enable Paykit and Contact Payments → add the peer as a contact: private-capable request action appears once the Noise link is established.
• 2. Peer creates a private request → Home: Payment Request opens automatically with the correct contact and amount.
• 3. Payment Request → dismiss without rejecting → bell → request preview → Pay: the request remains queued, reopens, and pays successfully.
• 4. Peer creates a second request after payment → Pay: a newer Private Payment List is used; the consumed list is not reused and no public fallback occurs.
• 5. Receive → Send Payment Request → enter amount, note, and expiry → select linked contact → Send: request is queued once and appears in sent history.
• 6. Incoming request → Reject: only that request becomes terminal and the private payment list is not consumed.
• 7. Incoming request → dismiss → relaunch: request remains discoverable without automatically reopening again; expired requests disappear live.
• 8. Cross-platform E2E: iOS creates two requests that Android receives and pays, and Android creates two requests that iOS receives and pays, on clean regtest state.

Automated Checks

• PaykitPaymentRequestRepoTest.kt: covers mapping, eligibility, proposal delivery, rejection, expiry, identity-scoped presentation state, and action serialization.
• PaykitSdkServiceTest.kt: covers exact identity enforcement and safe deferred session restoration.
• AppViewModelSendFlowTest.kt: covers automatic/manual presentation, sheet transitions, identity changes, newer-list retry, strict private resolution, and payment lifecycle races.
• PaymentRequestExpirationTest.kt: covers expiry selection and retained draft state.
• SheetHostTest.kt: covers locked sheet dismissal and scrim input isolation during durable proposal creation.
• Local verification passed: app compile, Android-test compile, complete dev unit suite, detekt, and git diff --check.
• Both final cross-platform proof videos decoded end to end without errors.

[piotr-iohk]

Flagging while QA’ing with the staging public-pay pubkys — not a prod issue (Paykit UI is still hidden).

Enabling payments with contacts fail-closes with Unknown error if a saved contact’s receiver marker doesn’t parse (here: missing noise_public_key). I hit it on:

• pubky1jy146y751hkgqk9p69ds5cqf461aj5x7c8ptbca5rw6m9asotso
• pubkynekaxdyt5ktoqyufd7cgug6qppa7999hm46wfqdzm6jqnr8tj16o

In principle the same thing could happen with any broken / outdated profile marker, not only these fixtures. Recording attached. Same surface on iOS after #676 (toast there is Private Paykit is not available).

Steps:

1. Enable Paykit UI. Create a profile. Leave payments with contacts off.
2. Add either (or both) staging pubkys above as contacts. They do not need to be live.
3. Enable payments with contacts.
4. Toast is Unknown error and the toggle stays off.

Screen.Recording.2026-08-26.at.10.12.34.mov

logs.zip

[piotr-iohk]

Flagging from QA: paying a payment request that’s larger than the wallet balance.

Same setup, two directions, both recordings attached:

• iOS → Android (this PR): incoming sheet, Pay → toast Insufficient Spending Balance (e.g. ₿ 78,244 more needed to pay this Lightning invoice) and a red-bordered card. Dismiss then fails with Payment request operation is already in progress. Toast / error repeats; request stays on the sheet and is hard to dismiss.

Screen.Recording.2026-08-26.at.14.06.24.mov

• Android → iOS (ldk-node Error #676, already merged): Pay → Please try again. Coin selection failed. Dismiss is fine; the copy is just the wrong error.

Screen.Recording.2026-08-26.at.14.18.16.mov

Steps:

1. Two live wallets with payments-with-contacts on. Put ~88k on the payer (split savings + spending is fine).
2. Other wallet requests more than that total (100k Android-as-payer, 90k iOS-as-payer).
3. On the incoming request, tap Pay, then try Dismiss.

Expected: don’t enter confirm if the amount is above spendable. On Android, Dismiss should still work after a failed Pay (no already in progress loop).

[ben-kaufman]

Addressed both QA findings in signed commit 5d39cd96a:

• A malformed remote receiver marker is still rejected and cannot be used, but its per-contact inspection error no longer aborts global private endpoint publication for valid contacts. The regression test now covers the immediate-publication path used when enabling Contact Payments.
• An unaffordable request now releases its manual presentation state after showing the existing insufficient-balance message. It remains pending and dismissible, is not accepted or rejected, and does not consume a Private Payment List. The regression test verifies Dismiss remains actionable and no retry starts from the old context.

The matching iOS fixes are isolated in synonymdev/bitkit-ios#684: malformed remote markers no longer block other contacts, and incoming request amounts are used during initial LN/on-chain balance validation so the standard insufficient Spending/Savings error appears before coin selection.

Local verification: 193 focused Android tests passed; detekt completed successfully with only unrelated pre-existing findings.

[piotr-iohk]

Retested after 5d39cd9.

Enable — still fails. ❌

Toggle Enable payments with contacts → Unknown error, toggle does not stay on. Same staging contact as before (pubky1jy146y751hkgqk9p69ds5cqf461aj5x7c8ptbca5rw6m9asotso). Recording + logs attached.

This is not the noise_public_key inspect-fail anymore. Logs are PrivateUnavailable. In this run I turned the toggle off first; disable cleanup already failed with that error, then re-enable with cleanup still pending fail-closes again. Settings still maps it to Unknown error.

Same user-facing miss on iOS #684 (toast there is Private Paykit is not available).

Steps:

1. Paykit UI on. Profile exists. Staging pubky above saved as a contact (need not be live).
2. Payments with contacts off (or turn it off first).
3. Enable payments with contacts.
4. Toast is Unknown error; toggle stays off.

Screen.Recording.2026-08-27.at.10.24.05.-.android.mov

logs-android.zip

Over-balance — looks good on Android. ✅

Incoming request larger than the wallet: one Insufficient Savings / Spending toast, request stays pending and dismissible. No already in progress loop.

iOS #684 still repeats that toast (see that PR).

[jvsena42]

Code review

Reviewed git diff master...HEAD at 56ce990 (merge-base 6ae3cb7) — 34 files, ~3.8k added lines. 10 findings inline, roughly in severity order: the ReceiveSheet start-destination change and the dropped firstError in PrivatePaykitRepo look like the two most likely to bite in practice.

Checked and looked correct: the generation/identity guards in PaykitPaymentRequestRepo (activate/refresh/synchronizeLocked/isCurrentState), creationMutex.tryLock with finally unlock in propose, expiration rescheduling, the hideSheet re-entrancy guard, SheetHost's confirmValueChange + rememberUpdatedState pairing, the scrim's pointer-consuming modifier, the stopped/recursion loop in presentNextIncomingPaykitPaymentRequest, and the sats/BTC BigDecimal conversions.

One judgement call I did not flag as a defect: the string-literal match in canDeferStaleSession is brittle against SDK message changes.

[jvsena42]

Back stack loses ReceiveRoute.QR when the sheet opens at a non-QR route.

Replacing LaunchedEffect(startRoute) { navController.navigateTo(startRoute) } with startDestination = startRoute means QR is no longer the root of the inner NavHost stack.

ContentView.kt:936 (FundingScreen -> "Fund") opens Sheet.Receive(route = ReceiveRoute.Amount). In that flow:

1. ReceiveAmountScreen's onBack = { navController.popBackStack() } now returns false — the back arrow is a dead control.
2. ReceiveRoute.Confirm's onContinue does navigateTo(QR) { popUpTo(QR) { inclusive = true } }. With QR absent, the popUpTo is a no-op and the stack becomes [Amount, Confirm, QR], so back from the QR screen lands on Confirm instead of closing the sheet.

[jvsena42]

Duplicate payment request via system back.

onSent navigates to PaymentRequestSent without popping PaymentRequestRecipient, and navigateTo only sets launchSingleTop. The Sent screen has no BackHandler or back arrow, so system back returns to the recipient picker with selectedTarget still set and isCreating == false — "Send Request" is enabled and proposes a second request for the same draft.

Suggest popUpTo(ReceiveRoute.PaymentRequestRecipient) { inclusive = true }.

[jvsena42]

Dropping firstError = firstError ?: it silently swallows total publication failure.

This hunk removes the firstError assignment, so a receiverPathSelection.error is now only logged, never propagated.

If selection fails for every contact, publicationReceiverPaths is empty, so preparation.updates.isEmpty() and the if (requireImmediatePublication) preparation.firstError?.let { throw it } guard sees null and returns success. The requireImmediatePublication = true callers — ContactPaymentSettingsRepo.kt:49, :79, :148, the "share private payment details" toggles — then report success to the user while nothing was published.

[jvsena42]

eligibleTargets now issues remote lookups on every refresh().

It runs from synchronizeLocked, and per saved contact does paykitReceiverPaths(publicKey) plus a paykitReceiverMarker(publicKey, path) remote read. refresh() is driven by startInitialPaykitPaymentRequestPolling (15 runs at 2s intervals, re-armed on every initial link burst) and then by the 30/60/120s poll loop.

With N contacts that is roughly 15 x N x 2 remote reads inside 30s, on a path that previously only listed local records. Worth caching per identity/generation or computing it off the refresh path.

[jvsena42]

Automatic presentations now retry forever.

The give-up branch above only applies when requestedPaymentRequestId == request.id. For a non-requested (automatic) presentation, once PAYKIT_PAYMENT_REQUEST_PRESENTATION_RETRY_DELAYS (now List(14) { 2.seconds }) is exhausted, attempt saturates at 14 via coerceAtMost and retryDelay falls back to PAYKIT_PAYMENT_REQUEST_REFRESH_INTERVALS.last() (120s) indefinitely.

An incoming request whose private payment details never resolve calls beginPaymentRequest every 2s for ~28s, then every 2 minutes for the request's whole lifetime (up to 30 days). The previous code stopped after 4 attempts.

Related: the requested-branch return at line 869 leaves paymentRequestPresentationRetryAttempts[request.id] at its saturated value. A later "Pay" tap on the same request therefore gives up on its first failure — no retry window, no "waiting for details" toast, and the log misreports the attempt count.

[jvsena42]

Store can never repair a corrupt entry.

Both load (line 28) and save (line 35) call Json.decodeFromString<State>(...) on the raw keychain value with no fallback. If that entry is ever corrupt, or written by a future/older schema, load throws (callers swallow it and see an empty set) and every subsequent save throws too — so the bad value is never overwritten.

Effect: presented-request ids stop persisting permanently, and already-surfaced payment requests are auto-presented again on every app start. save should treat a parse failure as State() and overwrite.

[jvsena42]

Reject runs in the card's rememberCoroutineScope().

scope is rememberCoroutineScope() from PaymentRequestCard (line 456), so it is tied to the card's composition. onReject is a suspend () -> Result<Unit>; closing the sheet mid-flight cancels it, which can leave the request rejected in the SDK but still shown as pending (and the outbound message unflushed) until the next refresh.

createPaymentRequest already runs this kind of work in viewModelScope; same is warranted here.

[jvsena42]

Pasting an unknown pubky gives a blank screen with no explanation.

The field is labelled "RECIPIENT" with placeholder "Enter pubky" and a Paste button, but query only filters targets, which are derived from saved, linked contacts. Pasting a valid pubky that is not already a saved and linked contact yields an empty recipients list with no message, so the user cannot tell why the recipient is unusable.

Worth an empty-state explaining that the recipient must be a saved contact with private payment details linked.

[jvsena42]

Dead parameter, and it is not part of the remember key.

showSymbol has no callers — both existing call sites omit it.

If it is kept, line 34 is a problem: if (showSymbol == null) rememberMoneyText(sats) else rememberMoneyText(sats, showSymbol = showSymbol) creates two distinct composable call sites, so toggling it at runtime discards remembered state. More importantly rememberMoneyText keys on remember(currencies, sats, unit) — showSymbol is not a key, so a future caller that flips it for the same sats/unit gets the stale string.

Either drop the parameter or add showSymbol to the remember key.

[jvsena42]

Three new entries are out of alphabetical order (CLAUDE.md: "ALWAYS add new localizable string resources in alphabetical order in strings.xml"):

• wallet__payment_request_sending (this line) sorts before wallet__payment_request_sent_*, not after
• wallet__payment_request_waiting_for_details (line 1209) sorts before wallet__payment_request_waiting_for_recipient
• wallet__payment_requests_earlier (line 1213) sorts before wallet__payment_requests_empty_*