feat: add trezor receive

[ben-kaufman]

Summary

• add a Trezor tab to the Receive flow with the current next-unused watcher address
• fall back to the existing account scan when watcher state is unavailable
• support on-chain-only amount and note editing without starting Lightning receive work
• verify the displayed address on the connected Trezor from the Details view
• match the hardware receive treatment with a white selected-tab underline, blue Bitcoin mark, and blue action icons

Stack

• Base: feat: add trezor send #1187
• Requires bitkit-core #147 / v0.5.10

Validation

• GitHub CI build and full unit-test suite pass
• just lint
• git diff --check
• repository, receive view-model, invoice utility, and watcher event tests added

[greptile-apps]

Greptile Summary

Adds hardware-wallet receiving to the existing receive sheet, including watcher-backed address resolution, BIP21 editing, and on-device Trezor verification.

• Adds a Trezor receive tab with QR, copy, share, details, and device-verification actions.
• Resolves the next unused watcher address with an account-scan fallback.
• Adds passphrase-aware verification state and watcher event coverage.
• Updates bitkit-core and adds repository, view-model, invoice utility, and journey tests.

Confidence Score: 4/5

The PR should not merge until receive amount and note state is scoped so Savings edits cannot silently alter the Trezor payment request.

The Trezor QR directly consumes the same BIP21 metadata updated by Savings editing, causing a request for one account to be displayed for another account with unintended payment details.

Files Needing Attention: app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveQrScreen.kt, app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveSheet.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Adds watcher-backed receive-address lookup, account-scan fallback, typed watcher address data, and identity-aware Trezor address verification.
app/src/main/java/to/bitkit/ui/screens/wallets/receive/HwReceiveViewModel.kt	Coordinates address loading, watcher updates, verification retries, passphrase prompts, cancellation, and user-facing errors.
app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveQrScreen.kt	Adds the Trezor tab and its actions, but incorrectly sources its amount and note from primary-wallet BIP21 metadata.
app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveSheet.kt	Wires hardware receive navigation and editing into the shared receive sheet, including the shared metadata path implicated in the finding.
app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveInvoiceUtils.kt	Builds hardware-wallet BIP21 requests and selects the blue Bitcoin QR logo.
app/src/main/java/to/bitkit/ui/screens/wallets/receive/EditInvoiceScreen.kt	Adds an on-chain-only editing path that avoids Lightning receive work and hides tags.

Sequence Diagram

sequenceDiagram
  participant U as User
  participant UI as Receive Sheet
  participant VM as Hardware Receive VM
  participant HW as Hardware Wallet Repo
  participant W as Watcher
  participant T as Trezor

  U->>UI: Open hardware-wallet receive
  UI->>VM: loadAddress(walletId)
  VM->>HW: getReceiveAddress(walletId)
  HW->>W: Read next unused address
  alt Watcher address available
    W-->>HW: Address and derivation path
  else Watcher state unavailable
    HW->>T: Scan public account
    T-->>HW: First unused address
  end
  HW-->>VM: Hardware receive address
  VM-->>UI: Display QR and details
  U->>UI: Verify on device
  UI->>VM: verifyAddress()
  VM->>HW: verifyReceiveAddress()
  HW->>T: Display address at derivation path
  T-->>HW: Derived address
  HW-->>VM: Match or mismatch

Loading

_{Reviews (1): Last reviewed commit: "feat: add trezor receive" | Re-trigger Greptile}

[ovitrif]

The receive flow can complete verification for an address that is no longer displayed. I also found two smaller gaps in the Details actions and editor coverage.