feat: add trezor receive

[ben-kaufman]

Summary

• open the existing Receive sheet on a Trezor tab from the paired hardware-wallet screen
• render the watcher-provided next-unused address immediately, with an account-scan fallback
• support safe amount/message editing on the hardware address and exact on-device verification
• match the receive design with a white selected underline, blue hardware QR/action accents, and verification inside Show Details

Stack

• Based on Send PR feat: add trezor send #688
• Uses Bitkit Core v0.5.10 from bitkit-core #147

Linked Issues/Tasks

Fixes #707

Validation

• iPhone 16 simulator build passes against Core 0.5.10
• focused watcher receive-address test passes
• SwiftFormat passes

[greptile-apps]

Greptile Summary

Adds Trezor receiving to the existing receive sheet, using watcher-provided addresses with an account-scan fallback and optional on-device verification.

• Opens receive directly on the Trezor tab from a hardware-wallet screen.
• Supports amount and message parameters for hardware-wallet BIP21 requests.
• Adds reconnect, pairing-code, and passphrase handling for device verification.
• Updates Bitkit Core to 0.5.10 and extends watcher-event handling for next-unused addresses.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The receive flow preserves explicit hardware-wallet identity from its primary entry point, obtains a next-unused address through watcher or account-scan state, and rejects device verification unless the returned address exactly matches the displayed destination.

Important Files Changed

Filename	Overview
Bitkit/Managers/HwWalletManager.swift	Stores watcher-provided next-unused addresses, adds account-scan fallback, and verifies the displayed derivation directly on the Trezor.
Bitkit/Views/Wallets/Receive/ReceiveQr.swift	Adds the Trezor receive tab, hardware BIP21 rendering, address loading, and reconnect/passphrase-aware verification.
Bitkit/Views/Wallets/Receive/ReceiveEdit.swift	Adds an on-chain-only editing mode that preserves amount and message state without invoking Lightning or Paykit flows.
Bitkit/Views/Wallets/Receive/ReceiveSheet.swift	Carries hardware-wallet identity through receive navigation and presents pairing requests during reconnect.
Bitkit/Components/TabBar/TabBar.swift	Opens the receive sheet on the Trezor tab when invoked from a hardware-wallet route.
Bitkit.xcodeproj/project.xcodeproj	Updates Bitkit Core to the version providing the watcher receive-address payload.

Sequence Diagram

sequenceDiagram
    participant User
    participant Receive as Receive Sheet
    participant Manager as Hardware Wallet Manager
    participant Watcher as Watch-only Watcher
    participant Electrum
    participant Trezor
    User->>Receive: Open Trezor receive tab
    Receive->>Manager: Request receive address
    Manager->>Watcher: Read cached next-unused address
    alt Watcher address available
        Watcher-->>Manager: Address and derivation path
    else Watcher address unavailable
        Manager->>Electrum: Scan account addresses
        Electrum-->>Manager: First unused external address
    end
    Manager-->>Receive: Address and derivation path
    Receive-->>User: Display QR and details
    opt Verify on device
        User->>Receive: Verify address
        Receive->>Manager: Verify displayed address
        Manager->>Trezor: Derive and display exact path
        Trezor-->>Manager: Device-derived address
        Manager-->>Receive: Accept only exact match
    end

Loading

_{Reviews (1): Last reviewed commit: "feat: add trezor receive" | Re-trigger Greptile}

[ovitrif]

Receive still uses getReceiveAddress when the watcher has not reported an address, but no test calls that method. testWatcherEventProvidesReceiveAddress only asserts cached watcher state, so a broken unused.first selection or a dropped empty-unused error would stay green.

[piotr-iohk]

Tested on simulator and device (iPhone 13 + Trezor Safe 7).

Generally all good. Able to present the receive address, verify the address on the device, etc.

One observation (looks intentional in code, but may be misleading to the user): with 2+ paired hardware wallets (e.g. standard + passphrase), Home → Receive does not show the Trezor tab, so there is no hardware receive address from that entry point. Fine to defer to a follow-up PR — if that's the case, let's create a ticket for this.

Steps to reproduce

1. Pair a Trezor (standard wallet). Home should show one hardware wallet tile.
2. Add a passphrase wallet on the same device (Paired → Passphrase → enter passphrase). Home should now show two hardware wallet tiles.
3. From the main/home screen, tap Receive.
4. Only Savings / Spending tabs are shown. No Trezor tab, so you cannot get a hardware receive address.

Expected (or less misleading)

Home → Receive either shows a Trezor tab (or a wallet picker) when more than one hardware wallet is paired, or makes it clear that hardware receive is only available from the specific wallet screen.

Workaround

Open the specific hardware wallet screen first, then Receive. That path still shows the address.

Recording

ScreenRecording_09-01-2026.10-03-56_1.MP4

[piotr-iohk]

Approve. Single-wallet receive looks good on simulator and device. See the QA comment for the multi-wallet Home Receive note (fine to defer).

The base branch was changed.

[ben-kaufman]

The single-wallet hardware Receive flow remains green and its review threads are resolved. I filed #709 for the requested Home Receive wallet picker when multiple hardware wallets are paired. @piotr-iohk please re-review the current signed head because the earlier approval was dismissed after the branch update.