feat(platform-wallet): let a Core build fund from only the inputs it was given

[romchornyi]

Issue being fixed or feature implemented

The wallet-aware finalizers add every unreserved UTXO of the funding account to the candidate pool, so
seeding a subset through core_wallet_tx_builder_add_inputs_from_outpoints does not restrict what gets
selected. A caller that drains an account in batches each staying under the standard-transaction input
limit therefore achieves nothing — every batch still sees the whole account and fails with a
too-many-inputs error, and an account above the cap cannot be drained at all, however it is chunked.

This is live. The iOS CoinJoin sweep chunks exactly this way; a user with 589 mixed UTXOs gets
Too many inputs for a standard transaction: 589 (max 500) on every attempt and every retry, and their
~101 DASH cannot be moved by any route the app offers. The failure is at build time, so nothing is
broadcast and nothing changes between attempts.

What was done?

• core_wallet_tx_builder_use_only_added_inputs in rs-platform-wallet-ffi, and
  CoreTransactionBuilder.useOnlyAddedInputs() in the Swift SDK, exposing key-wallet's opt-in.
• Moves the rust-dashcore pin onto a branch that carries it.

Opt-in throughout: no existing caller changes behaviour.

About the pin

It continues the existing cherry-pick lineage rather than following dev.
chore/sync-fixes-filter-rescans-and-added-inputs is the current pin (4db5c367) plus:

dash-spv #866	rescan committed filter ranges for newly derived scripts
dash-spv #974	coalesce committed-range filter rescans across batch commits
key-wallet ×4	the use_only_added_inputs work (dashpay/rust-dashcore#994)

#866/#974 are included because they bear on the same reports: a heavily mixed wallet recognises a
different transaction set on each launch, so its balance moves without a spend. Both touch only
dash-spv/src/sync/filters/, so they carry nothing else with them.

Pinning dev instead was tried first and does not build: it drags in the sweep-event chain, and this
workspace does not handle WalletEvent::TransactionsSwept — six non-exhaustive matches plus a changed
Mnemonic::from_phrase signature, seven errors. Handling that event is #4406's subject, and #4406 is
open and conflicting. The same wall #4459 documented; the same answer it used.

How Has This Been Tested?

• cargo check -p platform-wallet -p platform-wallet-ffi against the pinned revision — clean.
• key-wallet on the pinned branch: cargo test -p key-wallet --lib — 666 passed, 0 failed.
• The key-wallet change carries four tests of its own, including a 589-UTXO account that fails with
  TooManyInputs unbounded and builds its 500-input chunk with the opt-in (feat(key-wallet): let a build fund from only the inputs it was given rust-dashcore#994).

Not yet exercised end-to-end on device: that needs the iOS side, which is a one-line follow-up in
sweepCoinJoin, and a rebuilt DashSDKFFI.xcframework.

Breaking Changes

None. New FFI entry point and a dependency revision; existing callers are unaffected.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}