fix: prevent false on-chain send success

Bitkit.xcodeproj/project.pbxproj

@@ -1202,7 +1202,7 @@
 			repositoryURL = "https://github.com/synonymdev/ldk-node";
 			requirement = {
 				kind = exactVersion;
-				version = "0.7.0-rc.66";
+				version = "0.7.0-rc.71";
 			};
 		};
 		96DEA0382DE8BBA1009932BF /* XCRemoteSwiftPackageReference "bitkit-core" */ = {

Bitkit/AppScene.swift

@@ -1357,7 +1357,19 @@ struct AppScene: View {
     }
 
     private func associateResolvedPaykitOnchainPayment(_ resolution: PaykitOnchainPaymentResolution) async {
-        if let identity = pubkyProfile.publicKey,
+        await Self.associateResolvedPaykitOnchainPayment(resolution, activeIdentity: pubkyProfile.publicKey, activity: activity)
+        await PaykitPaymentProofService.shared.consumeOnchainPaymentResolution(resolution, activeIdentity: pubkyProfile.publicKey)
+    }
+
+    static func associateResolvedPaykitOnchainPayment(
+        _ resolution: PaykitOnchainPaymentResolution,
+        activeIdentity: String?,
+        activity: ActivityListViewModel
+    ) async {
+        // Hardware proof reconciliation already saved contact/tags in the original wallet before publishing.
+        // Replaying the default-wallet association would overwrite unrelated Savings rows and later edits.
+        guard resolution.walletId == WalletScope.default else { return }
+        if let identity = activeIdentity,
            PubkyPublicKeyFormat.matches(resolution.identity, identity)
         {
             do {
@@ -1384,7 +1396,6 @@ struct AppScene: View {
                 )
             }
         }
-        await PaykitPaymentProofService.shared.consumeOnchainPaymentResolution(resolution)
     }
 
     private func pollIncomingPaykitPaymentRequests() async {
@@ -1460,14 +1471,19 @@ struct AppScene: View {
                 } else {
                     preparation = IncomingPaykitPaymentRequestPreparation(request: request, session: pubkyProfile.currentSession)
                     incomingPaymentRequestPreparation = preparation
-                    sheets.showSheet(.send, data: SendConfig(view: .confirm, preparation: preparation, onDismiss: {
-                        if preparation.resolvedRoute == nil, scenePhase == .active,
-                           preparation.matchesSession(pubkyProfile.currentSession), let request = preparation.request
-                        {
-                            paykitPaymentRequestManager.dismissPreparingRequest(request)
+                    sheets.showSheet(.send, data: SendConfig(
+                        view: .confirm,
+                        hardwareWalletId: paykitPaymentRequestManager.retainedHardwareRetries[request.id]?.onchainWalletId,
+                        preparation: preparation,
+                        onDismiss: {
+                            if preparation.resolvedRoute == nil, scenePhase == .active,
+                               preparation.matchesSession(pubkyProfile.currentSession), let request = preparation.request
+                            {
+                                paykitPaymentRequestManager.dismissPreparingRequest(request)
+                            }
+                            preparation.clear()
                         }
-                        preparation.clear()
-                    }))
+                    ))
                 }
                 defer {
                     if preparation.resolvedRoute == nil {
@@ -1518,11 +1534,15 @@ struct AppScene: View {
 
                     do {
                         try await preparation.whilePreparing {
-                            try await app.handleScannedData(
-                                paymentTarget,
-                                claimedContactPaymentContext: contactPaymentContext,
-                                alternativeOnchainBalanceSats: hwWalletManager.maximumFundingBalanceSats
-                            )
+                            if let proof = paykitPaymentRequestManager.retainedHardwareRetries[request.id] {
+                                try app.handleRetainedHardwarePayment(proof, context: contactPaymentContext)
+                            } else {
+                                try await app.handleScannedData(
+                                    paymentTarget,
+                                    claimedContactPaymentContext: contactPaymentContext,
+                                    alternativeOnchainBalanceSats: hwWalletManager.maximumFundingBalanceSats
+                                )
+                            }
                         }
                         guard isCurrentIncomingPaymentRequestPreparation(preparation),
                               app.ownsContactPaymentContext(contactPaymentContext)

Bitkit/Extensions/BroadcastError+Connectivity.swift

@@ -52,6 +52,53 @@ extension Error {
         return false
     }
 
+    func isHardwareBroadcastRefusal() -> Bool {
+        if isDefiniteHardwarePreBroadcastFailure() {
+            return true
+        }
+        if let error = self as? BroadcastError, case let .ElectrumError(details) = error {
+            let prefix = "broadcast failed: "
+            let details = details.lowercased()
+            guard details.hasPrefix(prefix) else { return false }
+            var reason = String(details.dropFirst(prefix.count))
+            for envelope in ["electrum server error: ", "sendrawtransaction rpc error: "] where reason.hasPrefix(envelope) {
+                guard let data = String(reason.dropFirst(envelope.count)).data(using: .utf8),
+                      let response = try? JSONSerialization.jsonObject(with: data, options: .fragmentsAllowed)
+                else { return false }
+                if let message = response as? String {
+                    reason = message
+                } else if let response = response as? [String: Any], let message = response["message"] as? String {
+                    reason = message
+                } else {
+                    return false
+                }
+            }
+            for prefix in ["sendrawtransaction rpc error -25: ", "sendrawtransaction rpc error -26: "] where reason.hasPrefix(prefix) {
+                reason = String(reason.dropFirst(prefix.count))
+            }
+            // This exact Bitcoin Core replacement refusal only releases navigation, never the receipt.
+            let replacementRefusal = "\\Ainsufficient fee, rejecting replacement [0-9a-f]{64}; new feerate [0-9]+\\.[0-9]{8} btc/kvb <= old feerate [0-9]+\\.[0-9]{8} btc/kvb\\z"
+            if reason.range(of: replacementRefusal, options: .regularExpression) != nil {
+                return true
+            }
+            let rejectionPrefix = "the transaction was rejected by network rules.\n\n"
+            if reason.hasPrefix(rejectionPrefix) {
+                reason = String(reason.dropFirst(rejectionPrefix.count).split(separator: "\n", maxSplits: 1).first ?? "")
+            }
+            return [
+                "min relay fee not met",
+                "mempool min fee not met",
+                "bad-txns-inputs-missingorspent",
+                "txn-mempool-conflict",
+                "non-final",
+            ].contains { reason == $0 || reason.hasPrefix($0 + ", ") }
+        }
+        if let error = self as? AppError, let underlyingError = error.underlyingError {
+            return underlyingError.isHardwareBroadcastRefusal()
+        }
+        return false
+    }
+
     func isBroadcastConnectivityFailure() -> Bool {
         if let broadcastError = self as? BroadcastError {
             return broadcastError.isConnectivityFailure

Bitkit/Managers/HwWalletManager.swift

@@ -1235,6 +1235,14 @@ final class HwWalletManager {
         )
     }
 
+    nonisolated static func persistedFundingAccount(walletId: String) throws -> HwFundingAccount {
+        let entries = HwKnownDeviceStorage.loadAll(walletId: walletId)
+        guard let xpub = entries.compactMap({ $0.xpubs[hwFundingDefaultAddressType.stringValue] }).first else {
+            throw PaykitPaymentRequestError.requestUnavailable
+        }
+        return HwFundingAccount(xpub: xpub, addressType: hwFundingDefaultAddressType, balanceSats: 0)
+    }
+
     func watcherReceiveAddress(
         walletId: String,
         addressType: AddressScriptType = hwFundingDefaultAddressType
@@ -1541,11 +1549,16 @@ final class HwWalletManager {
     }
 
     /// Broadcast a signed funding transaction and return its txid. Does not require a connected device.
-    func broadcastFunding(serializedTx: String, paymentDeadline: PaykitPreciseInstant? = nil) async throws -> String {
+    func broadcastFunding(
+        serializedTx: String,
+        paymentDeadline: PaykitPreciseInstant? = nil,
+        beforeDispatch: @escaping @MainActor @Sendable () async throws -> Void = {}
+    ) async throws -> String {
         try await OnChainHwService.shared.broadcastRawTx(
             serializedTx: serializedTx,
             electrumUrl: electrumUrlProvider(),
-            paymentDeadline: paymentDeadline
+            paymentDeadline: paymentDeadline,
+            beforeDispatch: beforeDispatch
         )
     }
 

Bitkit/Models/HwFunding.swift

@@ -1,4 +1,6 @@
 import BitkitCore
+import CryptoKit
+import Foundation
 import LDKNode
 
 /// The default address type funds are sourced from when transferring from a hardware wallet to
@@ -47,3 +49,76 @@ struct HwFundingBroadcastResult: Equatable {
     let feeRate: UInt64
     let totalSpent: UInt64
 }
+
+/// Matches Android's txid calculation: hash consensus bytes without marker, flag or witness.
+/// This identifies a signed candidate; it does not establish backend acceptance.
+enum SignedTransactionId {
+    static func fromHex(_ hex: String) throws -> String {
+        func invalid() -> PaykitPaymentRequestError {
+            .requestUnavailable
+        }
+        guard (20 ... 2_000_000).contains(hex.count), hex.count.isMultiple(of: 2) else { throw invalid() }
+        let chars = Array(hex.utf8)
+        var bytes = [UInt8]()
+        for index in stride(from: 0, to: chars.count, by: 2) {
+            guard let byte = UInt8(String(decoding: chars[index ... index + 1], as: UTF8.self), radix: 16) else { throw invalid() }
+            bytes.append(byte)
+        }
+        var offset = 4
+        func skip(_ length: Int) throws {
+            guard length >= 0, length <= bytes.count - offset else { throw invalid() }
+            offset += length
+        }
+        func compactSize() throws -> Int {
+            guard offset < bytes.count else { throw invalid() }
+            let prefix = bytes[offset]
+            offset += 1
+            if prefix < 253 {
+                return Int(prefix)
+            }
+            let length = prefix == 253 ? 2 : prefix == 254 ? 4 : 8
+            guard length <= bytes.count - offset else { throw invalid() }
+            var value: UInt64 = 0
+            for index in 0 ..< length {
+                value |= UInt64(bytes[offset]) << (8 * index)
+                offset += 1
+            }
+            guard value <= UInt64(Int.max) else { throw invalid() }
+            return Int(value)
+        }
+        let hasWitness = bytes[offset] == 0
+        if hasWitness {
+            guard bytes[offset + 1] == 1 else { throw invalid() }
+            try skip(2)
+        }
+        let baseStart = offset
+        let inputCount = try compactSize()
+        guard inputCount > 0, inputCount <= bytes.count / 41 else { throw invalid() }
+        for _ in 0 ..< inputCount {
+            try skip(36)
+            try skip(compactSize())
+            try skip(4)
+        }
+        let outputCount = try compactSize()
+        guard outputCount > 0, outputCount <= bytes.count / 9 else { throw invalid() }
+        for _ in 0 ..< outputCount {
+            try skip(8)
+            try skip(compactSize())
+        }
+        let baseEnd = offset
+        if hasWitness {
+            for _ in 0 ..< inputCount {
+                let count = try compactSize()
+                guard count <= bytes.count - offset else { throw invalid() }
+                for _ in 0 ..< count {
+                    try skip(compactSize())
+                }
+            }
+        }
+        let lockTimeStart = offset
+        try skip(4)
+        guard offset == bytes.count else { throw invalid() }
+        let canonical = Data(bytes[0 ..< 4] + bytes[baseStart ..< baseEnd] + bytes[lockTimeStart ..< offset])
+        return SHA256.hash(data: Data(SHA256.hash(data: canonical))).reversed().map { String(format: "%02x", $0) }.joined()
+    }
+}