fix(key-wallet): stop counting a contact's watch-only coins as the wallet's

[romchornyi]

Problem

ManagedAccountCollection::all_funding_accounts includes dashpay_external_accounts.

A DashPay external account is watch-only by construction — the crate's own doc comment on the variant says so (managed_account_type.rs: "DashPay external (watch-only) account"). Its addresses derive from a contact's xpub, so this wallet can observe those outputs but can never sign for them. They are the contact's coins; this wallet only ever pays into them.

Treating them as funding has two visible consequences.

The balance does not move after paying a contact. The amount leaves the standard account and reappears under the external one, because the payment output landed there. Observed on an iOS device after sending 0.01 DASH to a contact:

account_balances=[Standard{idx:0,BIP44}=>0.99587131 DASH, DashpayExternal{idx:0}=>0.01 DASH]

The external account climbs across successive payments (0.111 → 0.461 → 0.511 in one session). To a user this reads as "my balance is wrong", or worse, "the send did not happen".

Unspendable outputs reach coin selection. utxos() feeds get_spendable_utxos(), so selection can pick an output the wallet has no key for and fail at signing time with funds apparently available.

What changed

dashpay_external_accounts is dropped from all_funding_accounts and all_funding_accounts_mut. That covers every consumer at once — account_balances, balance/update_balance, utxos, get_spendable_utxos, immature_transactions, matured_coinbase_records.

dashpay_receival_accounts stays: those addresses derive from our xpub and a contact pays into them, so the funds are genuinely ours.

The doc comment now states the exclusion and the reason, so the line does not get "fixed" back.

What deliberately did not change

The wallet still sees these transactions.

• Detection runs through transaction_checking, whose AccountTypeToCheck list still includes DashpayExternalAccount (transaction_router/mod.rs, account_checker.rs), so a send to a contact is still routed and recorded.
• The monitored-address / compact-filter set is built from all_accounts, not all_funding_accounts, and still includes the external account.
• all_accounts / all_accounts_mut are untouched, so chain-lock promotion, transaction history and instant-lock marking keep working per-account.

Only balance and UTXO aggregation change.

Alternatives considered

• Filtering in update_balance / get_spendable_utxos only — strictly worse: account_balances() and raw utxos() would keep reporting the contact's coins as the wallet's, i.e. the same bug on a different surface.
• Adding a watch-only flag to the managed layer — unnecessary machinery. is_watch_only exists on the immutable Account but not on ManagedCoreFundsAccount; the fact is already encoded in the account type, which is what the aggregation matches on anyway.

Testing

cargo test -p key-wallet — 604 passed, 0 failed. No existing test encoded the old behaviour.

New regression test external_dashpay_accounts_are_not_funding_accounts builds a collection with a standard, a receival and an external account and asserts the external one is absent from the funding view while the receival one is present, that the mutable view visits the same set, and that the account itself still exists in the collection. Verified to fail without the fix ("the contact's watch-only account must not count as this wallet's funds").

cargo clippy -p key-wallet --all-features --all-targets -- -D warnings and cargo fmt --check are clean.

Summary by CodeRabbit

• Bug Fixes
  • Funding account views now exclude DashPay external accounts while continuing to include DashPay receival accounts.
  • DashPay external accounts remain securely stored and monitored, but no longer appear in funding account lists.
  • Improved consistency between read-only and editable funding account views.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: edf487d8-2ede-4567-969b-5f63d3817a1a

📥 Commits

Reviewing files that changed from the base of the PR and between 712bab1 and d521873.

📒 Files selected for processing (1)

• key-wallet/src/managed_account/managed_account_collection.rs

---

📝 Walkthrough

Walkthrough

The funding-account iterators now exclude DashPay external accounts. They continue to include standard and DashPay receival accounts. Tests verify both iterator variants and confirm that external accounts remain stored.

Changes

Funding account scope

Layer / File(s)	Summary
Funding iterators and coverage key-wallet/src/managed_account/managed_account_collection.rs	The immutable and mutable funding iterators exclude dashpay_external_accounts. Documentation identifies these accounts as watch-only. Tests verify included accounts, excluded accounts, and collection retention.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: xdustinface, zocolini

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: excluding contact-owned watch-only coins from wallet funding calculations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dashpay-external-not-funding

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.04%. Comparing base (712bab1) to head (d521873).

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #926      +/-   ##
==========================================
+ Coverage   74.95%   75.04%   +0.09%     
==========================================
  Files         328      328              
  Lines       76884    76933      +49     
==========================================
+ Hits        57626    57738     +112     
+ Misses      19258    19195      -63     

Flag	Coverage Δ
core	77.29% <ø> (ø)
ffi	50.13% <ø> (-0.01%)	⬇️
rpc	20.00% <ø> (ø)
spv	91.28% <ø> (+0.03%)	⬆️
wallet	76.07% <100.00%> (+0.32%)	⬆️

Files with missing lines	Coverage Δ
.../src/managed_account/managed_account_collection.rs	62.75% <100.00%> (+6.35%)	⬆️

... and 6 files with indirect coverage changes