ReceiveCheckpointStore

Idempotency cursor for inbound-receipt notifications (#284): the highest receipt transaction id already announced per (network, address). Two paths can see the same receipt — the live in-app observer (WalletForegroundService) and the background poll (ReceivePollWorker) — and both run across process deaths; this persisted id makes a receipt announce at most once. Whichever path announces first records the id; the other then sees it as already handled.

Provenance (is this a genuine receipt, and how much?) is decided upstream in the indexer's SubscriptionManager by diffing the transaction's UTXO set — so a user's own change is never a receipt and never reaches here. This store is therefore a pure dedup cursor; it no longer reasons about balances. (That balance high-water was what the old delta detector used, and what occasionally announced a spend's change as a "receipt".)

Plain prefs: a transaction id is public chain metadata, not a secret. A dedicated prefs file (PREFS) — the old balance-watermark store wrote String values under a different file, so there's no type collision on upgrade.