feat: add Paykit subscriptions

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK

[ben-kaufman]

Description

Adds the payer side of Paykit subscriptions, stacked on #1199, which is stacked on #1178.

• Receives private subscription proposals and lets the payer review and confirm them.
• Requires an immediately due first period to be paid before showing the subscribed success state; failed or uncertain payments remain due and can be retried.
• Turns each unpaid billing period into the existing incoming payment-request flow, including automatic presentation, the bell queue, and the Payments tab.
• Schedules local due-payment notifications and opens the corresponding request when the notification is selected.
• Adds the Figma-aligned Subscriptions and Payments tabs, subscription detail/status views, cancellation, empty states, and fixed/open-ended summaries.
• Associates payment proofs with their exact billing period so recurring periods remain independent while retaining private-only resolution and fresh Private Payment List requirements.
• Keeps subscribe-and-pay inside one continuously presented sheet, including initial-payment failure and retry, without the modal dismissal/reappearance gap.
• Retains the settled payment rail in completed request and subscription history so Lightning feedback is purple and on-chain feedback is orange, including success confetti.

This PR intentionally covers payer-side receipt only. Subscription creation, Discover, automatic payment without confirmation, and renewal are not included because they are outside this MVP or are not currently exposed by Paykit.

Dependencies:

• Paykit 0.1.0-rc46
• Hardware-wallet payment proofs #1199
• Payment proof delivery #1178
• iOS companion PR #685

Preview

Final Android and cross-platform proof recordings were completed locally; they are not attached to the PR.

QA Notes

Manual Tests

• Receive an immediate-start private subscription proposal and verify review → payment → success stays in one continuously presented sheet.
• Exercise initial-payment failure and retry and verify the Send sheet remains presented while the first period stays due.
• Verify Lightning and on-chain subscription success choose purple/orange confetti and matching completed-payment icons.
• Receive a future-start proposal, trigger its due notification, and open the exact billing-period payment.
• Dismiss and reopen a due request from the bell queue and Payments tab, then pay it with fresh private payment details.
• Review active, expired, fixed-term, and open-ended subscription details and cancel an active subscription.

Automated Checks

• Full testDevDebugUnitTest suite
• Focused PaykitPaymentRequestRepoTest, PaykitPaymentRequestRepoSubscriptionTest, SubscriptionsScreenTest, and AppViewModelSendFlowTest
• compileDevDebugKotlin
• compileDevDebugAndroidTestKotlin
• detekt --rerun-tasks
• arm64 assembleDevDebug, install, and cold launch on API 36 emulator CodexBullTlsUiApi36
• git diff --check

[jvsena42]

could test the PR stack feature for this case

[ben-kaufman]

Done: the PR now uses the stack directly. #1186 is based on the hardware-proof fix #1199, which is based on #1178, so each review contains only its own layer.

[ovitrif]

A few leftovers on this layer:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_contact_timestamp is unused after the payment-request subtitle rewrite.
• Local due-notification scheduling and beginPaymentRequestWaitingForUpdatedList have no tests that would fail if those paths broke.

[jvsena42]

Duplicated component

[ben-kaufman]

@jvsena42 Fixed in dd53772. The duplicated fiat value came from replacing the subscription review sheet while its content was still composed. The flow now reuses the existing dismiss-delay-present sheet transition and waits for that transition before validating the destination. The focused send-flow regression passes.

[ben-kaufman]

The duplicated subscription payment UI is fixed in signed commit dd53772. The review sheet now completes its normal dismiss transition before the Send sheet is presented, and the focused send-flow regression covers the sequence. @jvsena42 please re-review the updated head when E2E finishes.

[ovitrif]

prepareHardwareContactPayment marks the on-chain proof started before the hardware device signs, but onHardwareSignCancelled and send-sheet dismiss never call failOnchainPayment. The due request then stays in inFlightRequestIds and a later prepare() fails with OperationInProgress.

Also:

• Several new Kotlin sites still use inline fully-qualified names where an import would do.
• wallet__payment_request_timestamp is unused after paymentRequestDateTime was removed.

addressed

[ovitrif]

utACK

[ovitrif]

Onchain Paykit payment still fails closed after proof prepare fails: markOnchainPaymentStarted(...).getOrThrow() in beforeSendAttempt (and the hardware onFailure return) still requires the unstarted proof that prepare would have stored. The new tests stub that mark to succeed, so they would not catch this.

[ovitrif]

On-chain Paykit sends still fail closed when proof prepare fails. proceedWithPayment continues after getOrNull(), but beforeSendAttempt then calls markOnchainPaymentStarted(...).getOrThrow(), and hardware prepareHardwareContactPayment still returns false on that failure. The new tests stub the mark to succeed, so they do not catch this.

[ovitrif]

utACK