fix: snapshot CoinJoin collaterals before random fee charging

[PastaPastaPasta]

Issue being fixed or feature implemented

ChargeRandomFees() iterates the live CoinJoin session collateral vector without holding the session lock. A concurrent session reset can clear that vector while it is being traversed, invalidating the iterator and transaction reference.

What was done?

• Copy the shared collateral references while holding cs_coinjoin.
• Release the lock before random selection and collateral submission.
• Add a lock annotation and assertion documenting the call contract.

The copied CTransactionRef values keep each collateral alive, and the existing fee-selection behavior is unchanged.

How Has This Been Tested?

• Built test/test_dash with depends on macOS arm64 using --enable-debug --enable-werror.
• Ran coinjoin_inouts_tests (8 cases).
• Ran coinjoin_tests (12 cases).
• Ran the whitespace and logging linters.

Breaking Changes

None.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone

This pull request was created by Codex.

[coderabbitai]

Warning

Review limit reached

@PastaPastaPasta, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 082078b9-dd70-4084-82c6-c96e65921a11

📥 Commits

Reviewing files that changed from the base of the PR and between 981a25d and ea1deec.

📒 Files selected for processing (2)

• src/coinjoin/server.cpp
• src/coinjoin/server.h

---

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Review complete (commit ea1deec)
Last checked: 2026-08-13 06:00 UTC

[thepastaclaw]

Final validation — Codex/Sol only (Phase 2 disabled)

The exact-head diff safely copies the CoinJoin session collateral references while holding cs_coinjoin, then releases the lock before collateral submission, preserving object lifetime, lock ordering, and fee-selection behavior. No in-scope defects or actionable review findings were identified.
Source: reviewer backend model gpt-5.6-sol; final verifier backend model gpt-5.6-sol. Orchestration-only: openclaw-agent/cliproxy/gpt-5.6-sol (not reviewer evidence).

Validated zero-blocker Codex/Sol precheck evidence was promoted to final because Phase 2 (Sonnet/Opus) is temporarily disabled. This is Codex/Sol-only final validation, not Codex + Sonnet/Opus coverage.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet/Opus: not run (Phase 2 disabled — temporary Codex/Sol-only final)
• Secondary pass: disabled (temporary_phase2_sonnet_disable)