feat(coinjoin): offer BIP44 or Shielded destination in post-sync move-funds prompt

[QuantumExplorer]

What

The first-sync "Move your mixed coins" popup previously always swept the leftover CoinJoin balance into the BIP44 spendable balance. This PR gives users a choice of destination when there is enough balance to make shielding worthwhile.

• Small balances — unchanged: the existing BIP44-only dialog.
• Balances ≥ 2× the fee overhead (Type 18 pool fee + an L1-fee allowance for a many-input drain), with the shielded sub-wallet bound — a destination-choice sheet (CoinJoinMoveFundsSheet) offers:
  • Dash Wallet balance — the existing sweep (WalletSendService.sweepCoinJoin).
  • Shielded balance — a single CoinJoin-drain asset lock: every mixed-coin UTXO funds the Type 18 lock directly (lock value = Σ inputs − L1 fee, computed SDK-side) and the shielded pool receives lock_value − pool_fee. No transparent intermediate hop, one transaction, one PIN prompt.

The availability check fails closed (BIP44-only dialog) when the fee estimate or shielded binding is unavailable.

How

• ShieldedTransferCoordinator.performAssetLock gains an AssetLockFundingSource (.bip44(amountDuffs:) | .coinJoinDrain) routed to the new SDK wrapper shieldedFundFromCoinJoinDrain; the historical amountDuffs entry point delegates unchanged, so the internal transfer and Send are untouched.
• The sheet's shielded path is one coordinator run with the same step checklist as the internal transfer (Authorizing → Locking funds → Generating proof → Broadcasting). Auth-cancel returns to the destination choice. The CoinJoin balance is re-tallied on completion so the popup/Settings surfaces self-clear.
• ShieldedTransferStepList gains a positional (labels/currentIndex) init for the wallet leg's progress row.

Failure posture

Every failure mode leaves the funds recoverable:

• A pre-broadcast failure (incl. auth cancel) moves nothing — the coins stay in the CoinJoin account and the popup/Settings surfaces keep offering the move. The SDK preflight refuses a drain whose balance could not clear the pool fee, so an unrecoverable dust lock is never broadcast.
• A committed-but-stuck asset lock resumes on its exact outpoint (mirrors InternalTransferConfirmSheet.tryAgain); across relaunches the home tx list's ShieldedRecoverySheet picks it up — identical to a BIP44-funded shielded transfer.
• shieldedSpendUnconfirmed surfaces the shared non-retryable "submitted, awaiting sync" state.

Cross-repo dependencies

Both upstream layers are merged — no pins or integration branches needed:

1. feat(key-wallet): CoinJoin funding account + drain mode for asset-lock builds rust-dashcore#915 — key-wallet AssetLockFundingAccount + drain mode (merged; in platform's rev pin).
2. feat(platform-wallet): CoinJoin-drain asset-lock funding for the shielded pool platform#4327 — AssetLockFunding drain variant with the post-build lock-value floor, family-aware proof/recovery lookups, owner-guarded reservation release, platform_wallet_manager_shielded_fund_from_asset_lock_coinjoin_drain FFI + shieldedFundFromCoinJoinDrain Swift wrapper (merged to v4.2-dev).

To build this PR: ../platform on v4.2-dev (≥ 963f0d26fc), then cd ../platform/packages/swift-sdk && ./build_ios.sh --target ios --target sim. Verified: the dashpay scheme builds green against upstream v4.2-dev HEAD with that xcframework.

Heads-up: swift-sdk-integration HEAD itself does not compile (the maya-swift-sdk merge #916 landed after the finalizeAtomic refactor #920 without rebasing). This branch carries the four-file fix as its own commit (fix(build): repair swift-sdk-integration compile breaks…) — cherry-pick it to the base branch independently if desired.

Notes

• Settings/Tools "Move CoinJoin Funds" rows are unchanged (BIP44 sweep).
• On-chain co-spend linkage of the mixed UTXOs is inherent to any consolidating move (the sweep has it too); what this flow eliminates is the extra transparent-address hop.

Verification

• Clean dashpay scheme build (arm64 simulator) against the rebuilt xcframework; key-wallet unit suites green (551 + 48, incl. 3 new drain/CoinJoin tests).
• Unit-test target is pre-existing broken (per CLAUDE.md); testnet smoke of the popup needs a wallet with leftover CoinJoin funds mid-recovery — flow to exercise: first sync completes → sheet appears → "Shielded balance".

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b140f6a5-52f8-4f6b-9797-6ece183b5e9c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/coinjoin-balance-destination-e26edf

---

_{Comment @coderabbitai help to get the list of available commands.}