feat(qt): DashPay contact payments, seed recovery and identity details

Send to username: the recipient field of the send dialog accepts a DPNS label (the Base58 entry validator would silently drop 0, I, O and l), resolves it through a proved read, and replaces it with the next unused DIP-15 payment address derived from the contact's stored xpub. A lookup discloses what was typed to an evonode, so while typing only a label that cannot be the start of a Dash address (one with a character outside Base58, or a hyphen) is looked up; a label that could still become an address is looked up once the entry is left. The status shown is the DPNS label the proof verified, as registered rather than in its homograph-safe normalized form, together with the derived address; a profile display name is never presented as the destination. The address is reserved when it resolves, labelled for transaction history, and its cursor advances only once the payment was committed; a commit the mempool refuses (TransactionCommitFailed) releases the reservation. Paying a contact starts on the Send tab: the send entry's @ button opens a contact picker (first contact selected, Enter pays), and the DashPay tab has no pay controls of its own; a connected contact's row and tooltip point there. Leaving the recipient field looks a username up through a FocusOut event filter as well as editingFinished, which a field losing focus with an intermediate text does not report. While network activity is off the @ button is disabled and a lookup says DashPay is paused rather than that Platform can't be reached.

Seed-only recovery rebuilds the local Platform state of a wallet restored from its recovery phrase: it probes identity indexes by MASTER key hash with a gap of five, where only a proven absence counts (a failed probe ends the session incomplete and the next start retries), restores index 0 as REGISTERED with the lexicographically first of its names or as an identity awaiting a username, and records the identity's signing, encryption and decryption key ids after checking each against the key the wallet derives there, so an identity registered by another wallet from the same seed with a different key layout still works and one whose keys this wallet does not hold is reported rather than restored as an identity that could never sign. Until the probe has concluded, and while a locked wallet keeps it from running, no new registration may start: it would burn an asset lock on an identity Platform refuses as a duplicate. Established contacts (a request proved in both directions) are restored by decrypting their requests, the friendship keychains are imported with birth times taken from our own on-chain requests (never the sender-authored document time), the outbound payment cursors are rebuilt from wallet history and a rescan starts. A contact skipped for a reason a later run can resolve (an unanswered page, a re-locked wallet) keeps the contact phase owed under a platform/recovery-pending record that the next start resumes. Every paged read is one request per step, continued from the cursor, under a flow-level cap.

The network-changed and record-version wipes end in recovery through this path.

Tests (test_dash-qt): recovery treats only proven absence as absence, never re-probes after a session ends and opens registration only then; an identity with foreign keys is refused and a locked wallet defers the probe to its unlock while blocking registration; an owed contact phase resumes on the next start without a second identity scan; the restored identity, name across two pages continued by cursor and key ids; mutual-only contacts with the birth time of our own request; the send entry looking up only what cannot be an address prefix while typing (and on leaving the entry otherwise), showing the DPNS label and derived address (never the profile name or the normalized label) with the cursor advancing exactly once on commit; and the recipient entry validator.

An Identity details dialog shows the username, the identity id in Base58 (hex in its tooltip and context menu), its state, when this wallet registered it (not shown for a restored identity, whose record was written when it was found), its balance on Dash Platform in the display unit, its profile, and behind Show keys its keys with the ones this wallet holds marked, in cards sharing one label column. It reads once when opened; a failed read leaves its values at a dash instead of Loading… and offers Try again, and while DashPay is paused it reads nothing and says it shows only what the wallet knows. Its Copy buttons are secondary so Close is its one filled button. Contact errors and the picker's empty state say to add contacts on the DashPay tab. A recovery check that gets no answer ends in a notice with Try again instead of checking forever, and a locked wallet is offered Unlock wallet…, which unlocks it for that scan only and locks it again when the scan ends or after two minutes (a monotonic timer), whichever comes first. The scan derives the MASTER key hashes it probes before its first request; a scan whose unlock ran out goes on with its reads, and an identity it finds is not concluded on (its keys cannot be compared) until the next unlock, while a contact it cannot decrypt stays owed. The Send tab shows a username's lookup state on a line under the recipient; the @ button's glyph is sized through GUIUtil::setFont, and its Alt+C shortcut belongs to the entry being edited, so a second recipient does not make it ambiguous. The DashPay page gives its primary action the initial focus (the state card's action, else the empty state's Add contact…, else the contacts table), and Identity details… sits next to Edit profile… on the right of the header. A contact row whose reply Platform is confirming cannot be accepted again meanwhile. The contact picker hides its Profile name column when nobody has a profile and shares the text colour and selection of the contacts and search tables in both themes. Tests: the identity details after failed reads with no Network, Funding, Revision, Refresh or Copy all details and the keys behind Show keys (identityDetailsAfterFailedReads), Created only for an identity this wallet registered (identityDetailsCreatedOnlyWhenRegisteredHere), no reads while paused (identityDetailsPausedShowsLocalOnly), a connected contact's row pointing to Send with no action of its own (answeredRequestEstablishesContact) and the recovery unlock lasting only for the scan, with an identity found after it ran out left for the next unlock (recoveryUnlockLastsForTheScan).

Recovery restores each contact from its newest incoming request (the one DashPay acts on, ContactFlow::NewestPerSender) and remembers every request this identity sent, answered or not, under contact/out/ with the time of the first one: that is the keychain's birth time and what tells Add contact a request was already sent. Past payments the rebuilt cursor finds in wallet history to a restored contact's payment addresses are labelled as payments to them, as a send from here labels them; only scripts the wallet holds a transaction for are labelled, and a label the user gave the address stays. The Identity details dialog no longer shows the normalized Stored as form of the username. Tests: recoveryRestoresIdentityAndPagesContacts also covers an unanswered request we sent being remembered (and one never sent not being), and a past payment to a restored contact labelled with the cursor continuing after it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: PastaPastaPasta

src/Makefile.qt.include

@@ -125,13 +125,16 @@ QT_MOC_CPP = \
 if ENABLE_PLATFORM_GUI
 QT_MOC_CPP += \
   qt/platform/moc_contactflow.cpp \
+  qt/platform/moc_contactpickerdialog.cpp \
   qt/platform/moc_contactsmodel.cpp \
   qt/platform/moc_contactspage.cpp \
   qt/platform/moc_createusernamewizard.cpp \
   qt/platform/moc_dashpayoptionswidget.cpp \
+  qt/platform/moc_identitydetailsdialog.cpp \
   qt/platform/moc_identityflow.cpp \
   qt/platform/moc_platformoptindialog.cpp \
   qt/platform/moc_platformpage.cpp \
+  qt/platform/moc_platformrecovery.cpp \
   qt/platform/moc_platformservice.cpp \
   qt/platform/moc_platformui.cpp \
   qt/platform/moc_profiledialog.cpp \
@@ -243,13 +246,16 @@ BITCOIN_QT_H = \
 if ENABLE_PLATFORM_GUI
 BITCOIN_QT_H += \
   qt/platform/contactflow.h \
+  qt/platform/contactpickerdialog.h \
   qt/platform/contactsmodel.h \
   qt/platform/contactspage.h \
   qt/platform/createusernamewizard.h \
   qt/platform/dashpayoptionswidget.h \
+  qt/platform/identitydetailsdialog.h \
   qt/platform/identityflow.h \
   qt/platform/platformoptindialog.h \
   qt/platform/platformpage.h \
+  qt/platform/platformrecovery.h \
   qt/platform/platformservice.h \
   qt/platform/platformui.h \
   qt/platform/profiledialog.h \
@@ -391,13 +397,16 @@ BITCOIN_QT_WALLET_CPP = \
 
 BITCOIN_QT_PLATFORM_CPP = \
   qt/platform/contactflow.cpp \
+  qt/platform/contactpickerdialog.cpp \
   qt/platform/contactsmodel.cpp \
   qt/platform/contactspage.cpp \
   qt/platform/createusernamewizard.cpp \
   qt/platform/dashpayoptionswidget.cpp \
+  qt/platform/identitydetailsdialog.cpp \
   qt/platform/identityflow.cpp \
   qt/platform/platformoptindialog.cpp \
   qt/platform/platformpage.cpp \
+  qt/platform/platformrecovery.cpp \
   qt/platform/platformservice.cpp \
   qt/platform/platformui.cpp \
   qt/platform/profiledialog.cpp \

src/qt/bitcoinaddressvalidator.cpp

@@ -22,6 +22,31 @@ BitcoinAddressEntryValidator::BitcoinAddressEntryValidator(QObject *parent, bool
 {
 }
 
+DashPayRecipientEntryValidator::DashPayRecipientEntryValidator(QObject* parent, bool allow_uri) :
+    QValidator(parent),
+    m_address_validator(nullptr, allow_uri)
+{
+}
+
+QValidator::State DashPayRecipientEntryValidator::validate(QString& input, int& pos) const
+{
+    const State address_state = m_address_validator.validate(input, pos);
+    if (address_state != Invalid) return address_state;
+
+    // DPNS labels accept ASCII letters, digits, and interior hyphens. Keep
+    // incomplete labels editable, but reject impossible candidates early.
+    if (input.size() > 63 || input.startsWith('-')) return Invalid;
+    for (const QChar ch : input) {
+        const ushort c = ch.unicode();
+        if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '-')) {
+            return Invalid;
+        }
+    }
+
+    if (input.size() < 3 || input.endsWith('-')) return Intermediate;
+    return Acceptable;
+}
+
 QValidator::State BitcoinAddressEntryValidator::validate(QString &input, int &pos) const
 {
     Q_UNUSED(pos);

src/qt/bitcoinaddressvalidator.h

@@ -23,6 +23,26 @@ class BitcoinAddressEntryValidator : public QValidator
     bool fAllowURI;
 };
 
+/** Recipient entry validator that also permits DashPay username candidates.
+ *
+ * This only controls which characters may be entered. A username is not a
+ * payment destination until it has been proof-resolved and replaced with a
+ * Dash address; BitcoinAddressCheckValidator remains responsible for that
+ * final check.
+ */
+class DashPayRecipientEntryValidator : public QValidator
+{
+    Q_OBJECT
+
+public:
+    explicit DashPayRecipientEntryValidator(QObject* parent, bool allow_uri = false);
+
+    State validate(QString& input, int& pos) const override;
+
+private:
+    BitcoinAddressEntryValidator m_address_validator;
+};
+
 /** Bitcoin address widget validator, checks for a valid bitcoin address.
  */
 class BitcoinAddressCheckValidator : public QValidator

src/qt/forms/sendcoinsentry.ui

@@ -54,6 +54,25 @@
       </property>
       </widget>
     </item>
+    <item>
+      <widget class="QToolButton" name="contactsButton">
+      <property name="visible">
+        <bool>false</bool>
+      </property>
+      <property name="toolTip">
+        <string>Choose a DashPay contact to pay (Alt+C)</string>
+      </property>
+      <property name="text">
+        <string/>
+      </property>
+      <property name="iconSize">
+        <size>
+        <width>22</width>
+        <height>22</height>
+        </size>
+      </property>
+      </widget>
+    </item>
     <item>
       <widget class="QToolButton" name="addressBookButton">
       <property name="toolTip">
@@ -110,7 +129,20 @@
     </item>
     </layout>
   </item>
-  <item row="1" column="0">
+  <item row="1" column="1">
+    <widget class="QLabel" name="payToStatus">
+    <property name="visible">
+      <bool>false</bool>
+    </property>
+    <property name="textFormat">
+      <enum>Qt::PlainText</enum>
+    </property>
+    <property name="wordWrap">
+      <bool>true</bool>
+    </property>
+    </widget>
+  </item>
+  <item row="2" column="0">
     <widget class="QLabel" name="labellLabel">
     <property name="text">
       <string>&amp;Label:</string>
@@ -123,7 +155,7 @@
     </property>
     </widget>
   </item>
-  <item row="1" column="1">
+  <item row="2" column="1">
     <widget class="QLineEdit" name="addAsLabel">
     <property name="toolTip">
       <string>Enter a label for this address to add it to the list of used addresses</string>
@@ -133,7 +165,7 @@
     </property>
     </widget>
   </item>
-  <item row="2" column="0">
+  <item row="3" column="0">
     <widget class="QLabel" name="amountLabel">
     <property name="text">
       <string>A&amp;mount:</string>
@@ -146,7 +178,7 @@
     </property>
     </widget>
   </item>
-  <item row="2" column="1">
+  <item row="3" column="1">
     <layout class="QHBoxLayout" name="horizontalLayoutAmount" stretch="0,1,0">
     <item>
       <widget class="BitcoinAmountField" name="payAmount" native="true">
@@ -174,7 +206,7 @@
     </item>
     </layout>
   </item>
-  <item row="3" column="0">
+  <item row="4" column="0">
     <widget class="QLabel" name="messageLabel">
     <property name="text">
       <string>Message:</string>
@@ -184,7 +216,7 @@
     </property>
     </widget>
   </item>
-  <item row="3" column="1">
+  <item row="4" column="1">
     <widget class="QLabel" name="messageTextLabel">
     <property name="toolTip">
       <string>A message that was attached to the dash: URI which will be stored with the transaction for your reference. Note: This message will not be sent over the Dash network.</string>
@@ -194,7 +226,7 @@
     </property>
     </widget>
   </item>
-  <item row="4" column="0" colspan="2">
+  <item row="5" column="0" colspan="2">
     <widget class="Line" name="line">
     <property name="orientation">
       <enum>Qt::Horizontal</enum>

src/qt/platform/contactpickerdialog.cpp

@@ -0,0 +1,123 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <qt/platform/contactpickerdialog.h>
+
+#include <qt/guiutil.h>
+#include <qt/platform/contactsmodel.h>
+#include <qt/platform/platformservice.h>
+#include <qt/platform/platformui.h>
+
+#include <QDialogButtonBox>
+#include <QHeaderView>
+#include <QLabel>
+#include <QPushButton>
+#include <QSortFilterProxyModel>
+#include <QTableView>
+#include <QVBoxLayout>
+
+ContactPickerDialog::ContactPickerDialog(PlatformService& service, QWidget* parent) :
+    QDialog(parent, GUIUtil::dialog_flags),
+    m_service(service)
+{
+    setWindowTitle(tr("Pay a DashPay contact"));
+    resize(440, 360);
+
+    auto* layout = new QVBoxLayout(this);
+    layout->addWidget(PlatformUi::makeHint(tr("Choose who to pay. The payment goes to a fresh address that only you "
+                                              "and this contact can link."),
+                                           this));
+
+    m_model = new ContactsModel(m_service, this);
+    m_proxy = new QSortFilterProxyModel(this);
+    m_proxy->setSourceModel(m_model);
+    m_proxy->setFilterRole(ContactsModel::KindRole);
+    m_proxy->setFilterFixedString(QString::number(static_cast<int>(ContactsModel::Kind::Established)));
+    m_proxy->setFilterKeyColumn(0);
+
+    m_view = new QTableView(this);
+    m_view->setModel(m_proxy);
+    m_view->setSelectionBehavior(QAbstractItemView::SelectRows);
+    m_view->setSelectionMode(QAbstractItemView::SingleSelection);
+    m_view->setEditTriggers(QAbstractItemView::NoEditTriggers);
+    m_view->horizontalHeader()->setStretchLastSection(true);
+    m_view->verticalHeader()->hide();
+    m_view->hideColumn(ContactsModel::Direction);
+    layout->addWidget(m_view);
+
+    m_empty = new QWidget(this);
+    auto* empty_layout = new QVBoxLayout(m_empty);
+    auto* empty_title = new QLabel(tr("No contacts to pay yet."), m_empty);
+    empty_title->setAlignment(Qt::AlignCenter);
+    auto* empty_hint = PlatformUi::makeHint(tr("Add contacts on the DashPay tab. Once they accept, you can pay them "
+                                               "here by username."),
+                                            m_empty);
+    empty_hint->setAlignment(Qt::AlignCenter);
+    empty_layout->addStretch();
+    empty_layout->addWidget(empty_title);
+    empty_layout->addWidget(empty_hint);
+    empty_layout->addStretch();
+    layout->addWidget(m_empty);
+    m_loading = new QWidget(this);
+    auto* loading_layout = new QVBoxLayout(m_loading);
+    auto* loading_bar = PlatformUi::makeBusyBar(m_loading);
+    loading_bar->show();
+    auto* loading_text = PlatformUi::makeHint(tr("Loading contacts…"), m_loading);
+    loading_text->setAlignment(Qt::AlignCenter);
+    loading_layout->addStretch();
+    loading_layout->addWidget(loading_bar);
+    loading_layout->addWidget(loading_text);
+    loading_layout->addStretch();
+    layout->addWidget(m_loading);
+
+    auto* buttons = new QDialogButtonBox(this);
+    auto* cancel = buttons->addButton(QDialogButtonBox::Cancel);
+    PlatformUi::makeSecondary(cancel);
+    m_choose_button = buttons->addButton(tr("Pay"), QDialogButtonBox::AcceptRole);
+    m_choose_button->setDefault(true);
+    layout->addWidget(buttons);
+    setTabOrder(m_view, m_choose_button);
+    setTabOrder(m_choose_button, cancel);
+
+    connect(buttons, &QDialogButtonBox::accepted, this, &ContactPickerDialog::chooseCurrent);
+    connect(buttons, &QDialogButtonBox::rejected, this, &QDialog::reject);
+    connect(m_view, &QTableView::activated, this, &ContactPickerDialog::chooseCurrent);
+    connect(m_view->selectionModel(), &QItemSelectionModel::currentChanged, this, &ContactPickerDialog::updateState);
+    connect(m_proxy, &QAbstractItemModel::modelReset, this, &ContactPickerDialog::updateState);
+    connect(m_proxy, &QAbstractItemModel::rowsInserted, this, &ContactPickerDialog::updateState);
+    connect(m_proxy, &QAbstractItemModel::rowsRemoved, this, &ContactPickerDialog::updateState);
+
+    GUIUtil::updateFonts();
+    GUIUtil::disableMacFocusRect(this);
+    updateState();
+    m_model->refresh();
+}
+
+void ContactPickerDialog::updateState()
+{
+    const bool have_contacts{m_proxy->rowCount() > 0};
+    // No column of blanks when nobody has a profile.
+    m_view->setColumnHidden(ContactsModel::DisplayName, !m_model->hasDisplayNames());
+    m_view->setVisible(have_contacts);
+    m_empty->setVisible(!have_contacts && m_model->loaded());
+    m_loading->setVisible(!have_contacts && !m_model->loaded());
+    // The first contact is ready to pay: Enter pays it.
+    if (have_contacts && !m_view->currentIndex().isValid()) {
+        m_view->setCurrentIndex(m_proxy->index(0, 0));
+        m_view->setFocus();
+    }
+    const QModelIndex current{m_view->currentIndex()};
+    m_choose_button->setEnabled(current.isValid() &&
+                                !m_proxy->data(current, ContactsModel::UsernameRole).toString().isEmpty());
+}
+
+void ContactPickerDialog::chooseCurrent()
+{
+    const QModelIndex current{m_view->currentIndex()};
+    if (!current.isValid()) return;
+    const QString username{m_proxy->data(current, ContactsModel::UsernameRole).toString()};
+    if (username.isEmpty()) return;
+    m_selected_username = username;
+    accept();
+}

src/qt/platform/contactpickerdialog.h

@@ -0,0 +1,46 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_QT_PLATFORM_CONTACTPICKERDIALOG_H
+#define BITCOIN_QT_PLATFORM_CONTACTPICKERDIALOG_H
+
+#include <QDialog>
+#include <QString>
+
+class ContactsModel;
+class PlatformService;
+
+QT_BEGIN_NAMESPACE
+class QPushButton;
+class QSortFilterProxyModel;
+class QTableView;
+QT_END_NAMESPACE
+
+/** Modal picker over the established (payable) contacts. On accept,
+ *  selectedUsername() holds the chosen contact's DashPay username. */
+class ContactPickerDialog : public QDialog
+{
+    Q_OBJECT
+
+public:
+    explicit ContactPickerDialog(PlatformService& service, QWidget* parent = nullptr);
+
+    QString selectedUsername() const { return m_selected_username; }
+
+private Q_SLOTS:
+    void updateState();
+    void chooseCurrent();
+
+private:
+    PlatformService& m_service;
+    ContactsModel* m_model{nullptr};
+    QSortFilterProxyModel* m_proxy{nullptr};
+    QTableView* m_view{nullptr};
+    QWidget* m_empty{nullptr};
+    QWidget* m_loading{nullptr};
+    QPushButton* m_choose_button{nullptr};
+    QString m_selected_username;
+};
+
+#endif // BITCOIN_QT_PLATFORM_CONTACTPICKERDIALOG_H