fix: keep transfer unit tests out of the app's UserDefaults

[jvsena42]

Stack — review in order; each targets the one before it.

1. fix: keep transfer unit tests out of the app's UserDefaults #756 — keep transfer unit tests out of the app's UserDefaults (fixes fix: hardware transfer unit tests write mock transfers into the app's UserDefaults #733)
2. fix: stop the test suite wiping the simulator's wallet #757 — stop the test suite wiping the simulator's wallet
3. test: isolate remaining suites from the app's state #758 — isolate remaining suites from the app's state

Fixes #733

This PR stops the hardware transfer unit tests writing mock transfer records into the app's own preferences, where they show up as a permanent "TRANSFER IN PROGRESS" banner and an inflated balance.

The tests build a real transfer service, so any test that drives a successful mock broadcast persists a transfer record built from the fixtures. Those records name an order that does not exist at Blocktank, so the channel id never resolves, the transfer never settles, and the banner never clears. The test bundle is hosted in the app, so the preferences it writes to are the app's own.

Most of the seam already existed. The transfer service takes a storage object, but the storage initialiser was private, so the shared instance was the only one that could ever exist and the parameter was unreachable. This replaces it with the injected-defaults initialiser used elsewhere in the app, and lets the view model's convenience initialisers pass one through. Both keep defaulting to the standard store, so nothing shipped changes behaviour.

It also adds a small set of shared helpers for keeping a suite off the app's state, since the repo already solves this three different ways across a dozen files: an isolated defaults suite, a snapshot-and-restore that handles the absent case, and a guard that fails a test which leaves a key changed. The three transfer suites adopt the isolated suite and the guard.

The guard matters more than it first looks. A suite that quietly writes to the app's preferences still passes; the only thing that catches it is diffing real state afterwards. The guard turns that into a red test.

This is the first of three PRs. The second stops the wider test suite destroying the wallet on the simulator, and the third isolates the remaining suites.

No changelog fragment: nothing shipped changes for a user. The shared storage still binds to the standard defaults and every production call site is untouched.

Linked Issues/Tasks

Fixes #733

Design

N/A — no UI changes.

QA Notes

Manual Tests

• 1. With a wallet on the simulator, note the balance and that no transfer banner shows → run the three transfer suites → launch the app: balance unchanged, still no banner.

Automated Checks

• Unit tests modified: BitkitTests/TransferViewModelHwTests.swift, BitkitTests/TransferViewModelTests.swift and BitkitTests/TransferServiceActivityTests.swift now take an isolated defaults suite and assert the transfers key is untouched.
• Test helpers added: BitkitTests/AppStateIsolation.swift collects the isolation patterns already used across the target.
• Verified locally on iPhone 17, on a simulator that was carrying two of the phantom records: 63 tests pass and the transfers key is byte-identical afterwards. Removing the forwarding again fails exactly the two tests that reach the funding path, which is the guard working.
• CI: standard build and test checks run by the PR bot.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the production storage path remains unchanged and the affected tests consistently isolate write-producing transfer flows.

Summary

This PR adds injectable transfer persistence and uses it to prevent hosted transfer tests from writing mock records into the app’s preferences.

• Replaces the private suite-name storage initializer with a defaults-injection seam while preserving .standard as the production default.
• Forwards isolated defaults through the transfer view model’s testing convenience initializers.
• Adds reusable defaults isolation, restoration, and mutation-detection test helpers.
• Migrates the three affected transfer suites to isolated storage and guards the app’s transfers key.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Test setup] --> B[Unique UserDefaults suite]
  B --> C[TransferStorage]
  C --> D[TransferService]
  D --> E[TransferViewModel]
  E --> F[Mock transfer record]
  F --> B
  G[UserDefaults.standard] --> H[Guard snapshots transfers key]
  H --> I{Changed after test?}
  I -->|No| J[Test passes]
  I -->|Yes| K[Test fails]

Loading

_{Reviews (1) · Last reviewed commit: "fix: keep transfer unit tests out of the..."}

[jvsena42]

No HIGH/MEDIUM. One LOW observation inline, single-pass (not independently verified).

Checked and clean:

• Production: TransferStorage keeps the transfers key, the JSON encoding and the .standard default. The old private init(suiteName:) was only ever reached via shared, so nothing moves on upgrade. Every production user still binds to .shared: AppScene's single TransferService, HwWalletManager, BackupService, MigrationsService and ChannelDetailsViewModel. The TransferViewModel convenience inits that now build TransferStorage(defaults:) are only reached from #Preview blocks and tests.
• TransferStorage has no in-memory cache (getAll() reads defaults every call), so a second instance could not hold a divergent view of pending transfers anyway.
• guardAppDefaults is not vacuous. It compares via isEqual across nil/value/other, is registered before the body, and runs before the isolated-suite removal (LIFO).
• The write path in the HW suite (hwSignTask → fundPaidOrder → createTransfer → storage.insert) finishes before the isSigning defer that the tests poll on.
• All TransferViewModelTests and TransferServiceActivityTests construction sites use the isolated suite.

[piotr-iohk]

QA reviewed on a721ea0.

Reviewed the TransferStorage UserDefaults seam, TransferViewModel convenience inits (nil → TransferStorage.shared), AppStateIsolation helpers, and the three transfer suites; no device run this round, test-only / no UI.

No findings.

Checked and clean

• AppScene still constructs TransferService / TransferViewModel on TransferStorage.shared.
• Convenience inits leave transferDefaults nil → .shared, so BackupService still listens to the shared publisher.
• TransferStorage still uses the transfers key and JSON encode/decode; shared still defaults to .standard.
• TransferViewModelHwTests, TransferViewModelTests, and TransferServiceActivityTests all inject makeIsolatedDefaults() and guardAppDefaults("transfers").
• SavingsSwapTests still uses the convenience init (now .shared); those tests set swap mode and do not hit fundPaidOrder. Remaining suite isolation is test: isolate remaining suites from the app's state #758.

QA LGTM

[piotr-iohk]

QA LGTM

[ovi-reviewer]

Verdict: ✅ Approve

---

Reaudit: diff 1 file.

Findings:
N/A

Audit:
Skipped - only storage touched (score 2, threshold 3).

QA: sim-1 iPhone 17 Pro simulator on iOS 26.5, Debug build

1. ✅ passed: 100 000 sats in Savings before and after the three transfer suites, no transfer banner across a 96 s poll, and the app's transfers key still absent.

   Test 1:
   With a wallet on the simulator, note the balance and that no transfer banner shows → run the three transfer…

   1.mp4

Tip

Test 1 worth a journey:

• Create a new wallet: accept the terms, skip the intro, tap New Wallet
• Tap Receive and copy the on-chain address
• Fund the address with 100 000 sats on regtest and mine 6 blocks
• Close the Receive sheet and note the home balance and that no transfer banner shows
• Read the app's transfers preference key and note it is absent
• Run only the three transfer test suites against the same simulator
• Terminate the app and launch it again
• Watch the home screen for at least 30 seconds: balance unchanged and no transfer banner
• Read the transfers preference key again and compare it with the before value

Coverage:
QA: 1 of 1 manual tests passed

---

Reviewed by claude-opus-5-xhigh via gh-pr-review-loop skill
Commands: @ovi-reviewer test · retest · audit (author or owner)