fix(sell): close the post-broadcast double-payment window - #2535
Draft
BullishNode wants to merge 1 commit into
Draft
fix(sell): close the post-broadcast double-payment window#2535BullishNode wants to merge 1 commit into
BullishNode wants to merge 1 commit into
Conversation
After broadcasting, the confirm handler fetched the order; any failure
in that fetch re-enabled Confirm with the transaction already on the
wire, so a second tap re-ran prepare, sign and broadcast and could pay
the order twice. Concurrent handlers (fee recalculation, utxo load,
order poll, price-lock refresh) also emitted pre-await snapshots that
could silently revert in-flight state.
- Latch on broadcast: payinBroadcastTxid is emitted immediately after
the transaction is on the wire (bitcoin and liquid). A latched bloc
never re-enters the send path, never surfaces a retryable error, and
keeps Confirm disabled while the existing poll carries the order to
success.
- Merge concurrent emits into live state so the latch survives fee
recalculation, utxo loads and an order poll spanning the broadcast.
- Price-lock refresh no longer clears the in-flight flag; a failure
after the deadline re-arms the countdown so the price refreshes.
- Show an in-flight spinner and status next to Confirm; disable
Advanced settings during confirmation.
- Success state now carries the post-broadcast order instead of the
stale pre-broadcast snapshot.
- Sell success screen: adds 'You sold {amount} for {fiatAmount}', gates
the balance-credit message on balance payouts, and closes (button and
back gesture) to wallet home like buy, on a new shared success
scaffold widget.
- SINPE recipients: ownerName is optional, matching the server schema;
display falls back to label, then phone or IBAN. Recipients missing
the Ridivi-derived name are no longer dropped.
Closes #2522
Closes #2523
Closes #2529
Closes #2530
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problems
ownerNamewas absent — the server schema has it nullable by design (Ridivi lookup can fail) (SINPE Móvil recipients silently dropped when ownerName is absent #2529).Changes
payinBroadcastTxid) emitted immediately after broadcast on both bitcoin and liquid paths; a latched bloc never re-enters the send path, never surfaces a retryable error, keeps Confirm disabled, and lets the existing poll carry the order to successSuccessScreenScaffold(buy/pay can adopt later): "You sold {amount} for {fiatAmount}", credit message gated on balance payouts (Order.isBalancePayout), closes to wallet homeownerNameoptional with display fallback chainValidation
5 bloc regression tests (double-confirm, poll race, stale order, countdown race, deadline recovery) — each demonstrated failing without its fix; analyze clean; full suite green. Reviewed with a verification pass (1 blocker + 2 should-fixes applied).
Closes #2522
Closes #2523
Closes #2529
Closes #2530