Postpone the Zano refresh worker and drop the tx-wide payment id

[peachbits]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none — but EdgeApp/edge-currency-accountbased#1092 consumes this and should be
reviewed alongside it. That PR needs a release of this one before it can bump
its react-native-zano pin.

Description

Addresses the performance regression QA found after the HF6 merge, plus the
HF6 payment-id correctness gap.

Related: #17 — this branch carries forward the correct parts of that PR and
takes a different approach where that one was incorrect. Left open for now;
no action taken on it.

Postpone the refresh worker through startWallet and generateSeedPhrase

Opening a Zano wallet auto-starts the SDK refresh worker, and that worker holds
the per-wallet epee::locked_object recursive mutex for the entire first
catch-up scan — minutes for a wallet weeks behind. Because React Native runs
every TurboModule call on one shared dispatch queue, anything that then touches
the wallet blocks the whole app's native calls behind that scan.

This opens with postponed_run_wallet and starts the worker explicitly, once
the wallet being returned is the one that should sync. That gives callers a
window to do their setup — the file re-key in particular — before the scan owns
the lock, and gives the engine an actual stop path.

Remove the transfer payment-id option, never send the tx-wide id

Since HF6 the network rejects the transaction-wide payment id outright; ids
travel inside integrated addresses and the wallet attaches each destination's
embedded id natively. transfer now always sends payment_id: '' and the
per-destination loop is gone. TransferParams.paymentId is deleted rather than
deprecated, so callers get a compile error instead of a silently dropped id.

Also corrects AddressInfo to the real native shape — payment_id is a
presence boolean, not the id, and there is no is_integrated field.

Fail closed when the iOS wallet directory cannot be protected

prepareZanoDirectory now returns a status and constantsToExport withholds
documentDirectory when the wallets directory could not be prepared, rather
than handing out a path with no protection applied. The JS constructor throws on
a missing directory instead of writing wallets somewhere unintended.

Encode the derived file password with rfc4648

Cosmetic — uses the shared encoder rather than a bespoke one.

Testing

Unit tests cover the JS logic against a fake native module. Beyond that, this
was run on device in a three-stage ladder on an account with four mainnet Zano
wallets created April–May 2025, each carrying a ~760k-block catch-up window.
Each stage used the same wallet-file fixture; stages 2 and 3 are the same GUI
commit differing only in which packages are installed, so the comparison
isolates these changes.

Confirmed the mechanism on device — with the published packages, the refresh
worker sits in wallet2::refresh → pull_blocks for 2269 of 2269 thread
samples, and nothing is written to the wallet file across 8.5 minutes and
~72,000 blocks scanned.

With this branch (plus EdgeApp/edge-currency-accountbased#1092), all four
wallets persisted
partial progress and resumed forward across a hard kill instead of rescanning.
App responsiveness was unchanged — Zano-attributable mutex waits stayed at 0–1
frames per sample in both stages.

Not covered by that run: the startup freeze path, which needs an account whose
wallets are not already marked in securityCheckedWallets, and the
legacy→HF6 wallet-file migration, which needs a fixture holding real scan
history. Both are being followed up separately.

---

• To see the specific tasks where the Asana app for GitHub is being used, see below:
  • https://app.asana.com/0/0/1217806296191300

[j0ntz]

Reviewed alongside EdgeApp/edge-currency-accountbased#1092. Nothing I found blocks the merge; all three notes below are suggestions. I checked the rfc4648 swap against the old hand-rolled encoder specifically: base16.stringify uppercases and the .toLowerCase() restores the previous output, so existing wallet files still open.

Separately, all four commit subjects are over the 50-character Edge limit that Paul enforces in review (54 to 77 characters).

[j0ntz]

The design doc for this work is now in #19, rewritten to describe what ships here rather than the first round.

Section 8's phase 8 records where this pair diverges from #17 and #1090: the checkpoint replacing the synced-only store, the mempool sweep moving after the paging loop, the HF6 payment-id handling, and the AddressInfo correction. Sections 5, 6, 9 and 11 are updated to match the shipping code, and the open items from my review are written down there too rather than smoothed over.

It lived only on jon/ios-perf-zano-xmr until now, and that branch goes away with #17.

[peachbits]

All four subjects reworded to <=50 characters (39-45).

[j0ntz]

Pushed a979b0f here, the migration design doc. It only ever lived on the branch behind the now-closed #17, so it would have been lost with that branch; this repo is where the postponed-run work it describes lands.

It is current as of today rather than a copy: section 6 gained the block-height conversion from the confirmation-count fix (pushed to EdgeApp/edge-currency-accountbased#1092 as e64142b7), Testing gained the unit and in-app coverage for it, and the phase history gained that phase.

[j0ntz]

Retracting my previous comment and the commit it described. a979b0f is gone from this branch (force-pushed back to c9947d5, your head), and nothing of yours was touched.

The design doc already has its own PR, #19, carrying a newer revision than the copy I pushed here. My phase goes there instead.

[j0ntz]

Ensure fixups squash correctly, they're not fixup! tagged