refactor(sdk): dedup shared wallet code + remove dead FFI/JNI chains

[shumkov]

Issue being fixed or feature implemented

Cleanup from the duplication/slop review of the Kotlin-SDK PR (#3999), stacked on feat/kotlin-sdk-and-example-app. Three kinds of change, all behavior-preserving. Net −651 lines.

What was done?

Dedup

Extracted the byte-identical candidate-address-SET union block (wallet-manager read lock → resolve payment account → union the derived pool with the hydrated address_balances map) from transfer.rs::auto_select_inputs and withdrawal.rs::plan_withdrawal into PlatformAddressWallet::candidate_address_set. Both are live spend paths and the block was copy-pasted (8bd3a858db retrofitted transfer onto withdrawal's shape) — a divergence risk. Behavior unchanged: each caller keeps its own empty-handling (transfer tolerates an empty set; withdrawal errors early), and balances are still read fresh from chain via AddressInfo::fetch_many at each site.

Dead-code removal

Bindings declared but never called — verified zero callers in-repo and org-wide (gh search code --owner dashpay); the Kotlin bindings are all internal (not public API). Each removes both the Kotlin external fun and its Java_... JNI trampoline.

• Handle-based identity-derive chain platform_wallet_derive_identity_private_key_at_slot (~465 LOC). It deadlocks in its only intended context — the identity-key persist callback fires while platform-wallet holds the wallet-manager write lock, and this export re-takes a read lock in its capability check — so every real flow uses the resolver-keyed sibling dash_sdk_derive_identity_key_at_slot_with_resolver (the same one iOS uses). Removed the Rust export + IdentityPrivateKeyFFI, its lib.rs module/re-export, the JNI trampoline + import (kept net_from_ord), and the Kotlin deriveIdentityPrivateKey binding.
• createCallbacks / destroyCallbacks — an alternate persistence-vtable entry point superseded by the live WalletManagerNative.nativeCreate → build_vtable path; the whole PersistenceNative object was dead, so the file is removed (kept build_vtable / KotlinPersistenceCtx, which the live path uses).
• managedIdentityDashPayProfile, resolverSupportsKeyType, walletGetId.

Also drops the now-unused guard / JClass / jlong imports and refreshes the persistence module docs (incl. a stale "wiring lands in a later milestone" note).

Minor cleanups

• Dropped two no-op #[allow(clippy::too_many_arguments)] on the top-up exports (6 args each, below clippy's threshold).
• Replaced a misleading Identifier::from_bytes(&[u8;32]).unwrap_or_default() with the infallible Identifier::from([u8;32]) — the input is a fixed 32-byte array, so the length check never fails and the zero-default was unreachable (it read as if a malformed id silently became all-zeros).
• Removed a stale ADDR-02 test-case reference from a transfer.rs comment.

How Has This Been Tested?

• cargo check -p platform-wallet -p platform-wallet-ffi -p rs-unified-sdk-jni — clean (warnings-as-errors).
• cargo fmt --check — clean.
• The candidate_address_set regression tests pass through the new helper: plan_withdrawal_sizes_inputs_from_chain_not_doubled_cache, plan_withdrawal_finds_candidates_from_balance_map_when_pool_empty.
• Every removed symbol was verified to have zero callers before deletion; the Kotlin edits are exercised by the Kotlin-SDK CI build.

Breaking Changes

None. All removed symbols were uncalled (internal bindings, no public API, no org-wide reference); the dedup is behavior-preserving.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests (existing regression tests cover the dedup; dead-code removal needs none)
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any (n/a — none)
• I have made corresponding changes to the documentation if needed

---

Deferred (from the same #3999 review, with reasons)

• B2 (register-contract-for-proof-verification dup) — cosmetic; deduping adds ~as much code as it removes in a core file.
• B3 (top-up account persistence round) — a forced abstraction across two load-bearing persistence paths; ~4 shared lines, not worth the risk.
• B4 / B5 (FFI capability-check ×6, build-preview-row ×5) — real duplication, but ~⅔ of the copies are in pre-existing files untouched by feat(sdk): add Kotlin SDK and KotlinExampleApp (Android port of SwiftExampleApp) #3999 → belongs in a standalone v4.1-dev hygiene PR, not stacked here.
• D4 (release_row / free_rows) — on inspection these are named, documented, unit-tested single-zeroization-site helpers, not vestigial; left as-is.
• Identity-top-up-from-asset-lock path convergence is tracked in Wire iOS managed identity top-up from asset lock + converge the 3 top-up paths (v4.1-dev) #4092.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 177e2735-894f-4d41-9cb7-baa0badf32c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/platform-wallet-dedup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 11 ahead in queue (commit 011c866)
Queue position: 12/12

[thepastaclaw]

Code Review

Verified this is a byte-for-byte behavior-preserving extraction: the shared candidate_address_set helper in wallet.rs is identical to the two previously duplicated inline blocks in transfer.rs and withdrawal.rs, including error variants, address union/conversion, and lock release timing before the network fetch. cargo check passes cleanly and no in-scope issues survive review.

Source: reviewers gpt-5.6-sol (Sol reviewer), claude-sonnet-5 (Sonnet reviewer), and claude-opus-4-8 (Opus reviewer), general lane; verifier claude-sonnet-5. Orchestrator openai/gpt-5.6-sol (orchestration-only).