fix(wallet): defer UTXO removal until asset lock tx is fully built and signed

[Copilot]

Summary

take_unspent_utxos_for mutates Wallet.utxos by removing selected UTXOs before the fee is finalized. If the build fails after UTXO selection (e.g. due to fee shortfall, missing private key, or address derivation error), those UTXOs are permanently dropped with no recovery path — particularly dangerous in SPV mode where there's no Core RPC reload fallback.

Changes

Core: Deferred UTXO removal (src/model/wallet/)

• utxos.rs — Added select_unspent_utxos_for (&self, non-mutating) for read-only UTXO selection. Added remove_selected_utxos (&mut self) for explicit post-success removal with DB persistence and balance recalculation. Refactored take_unspent_utxos_for to delegate to both — no behavior change for existing callers. Consolidated reload_utxos into a single method with mode-aware behavior (RPC: fetches from Core; SPV: no-op).
• asset_lock_transaction.rs — asset_lock_transaction_from_private_key now uses select_unspent_utxos_for (non-mutating) for initial selection. remove_selected_utxos is called only after the transaction is fully built and signed. Any early-exit error leaves UTXOs intact.

Callers: Removed duplicated UTXO cleanup

• create_asset_lock.rs — Removed post-broadcast UTXO removal block (now handled inside asset_lock_transaction_from_private_key).
• register_identity.rs — Removed UTXO removal block and simplified error recovery (unified reload_utxos replaces mode-specific branching).
• top_up_identity.rs — Same simplification as register_identity.
• fund_platform_address_from_wallet_utxos.rs — Removed UTXO removal block. Added store-before-broadcast pattern to prevent race with fast InstantSend. Added broadcast failure cleanup. Replaced custom proof-wait loop with shared wait_for_asset_lock_proof helper.

Other changes (backported from parent PRs)

• Connection status tri-state (connection_status.rs, top_panel.rs) — bool → OverallConnectionState enum (Disconnected/Syncing/Synced) with red/orange/green indicator.
• SPV stale balance fix (wallet_lifecycle.rs) — Zero out balances for addresses that no longer have UTXOs during SPV reconciliation.
• Database Arc<Mutex> (database/mod.rs) — Wrap connection in Arc<Mutex<Connection>> with shared_connection() for commitment tree sharing.
• Auto Update button (network_chooser_screen.rs) — Read RPC password from ~/.dashmate/config.json for local network config.
• configure-local.sh — Shell script to configure .env from dashmate for local network setup.
• Flatpak only-arches — Replace sed-based architecture patching with native only-arches directive.

Test plan

• Unit tests — 9 tests covering fee calculation edge cases (single input minimum, scaling with inputs, exact no-change, take-from-amount, insufficient funds, dust absorption, change elimination)
• Manual test scenarios — 10 scenarios + 3 edge cases for dynamic fee calculation
• Manual test scenarios — 8 scenarios + 5 edge cases for Auto Update button

🤖 Generated with Claude Code

[lklimek]

@copilot fix the issue in this PR. Rename PR accordingly

[Copilot]

@copilot fix the issue in this PR. Rename PR accordingly

Fixed in commit 2740af1.

The fix separates UTXO selection from UTXO removal:

• Added select_unspent_utxos_for (&self, non-mutating) — selects UTXOs without touching the wallet state
• Added remove_selected_utxos (&mut self) — explicit removal step
• Refactored take_unspent_utxos_for to delegate to these (no behavior change for callers in mod.rs)
• asset_lock_transaction_from_private_key now uses select_unspent_utxos_for and only calls remove_selected_utxos after the transaction is fully built and signed

Any early return (fee shortfall, missing private key, change address error) now leaves UTXOs intact in the wallet.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.github.com
  • Triggering command: /home/REDACTED/.rustup/toolchains/1.92-x86_64-REDACTED-linux-gnu/bin/cargo /home/REDACTED/.rustup/toolchains/1.92-x86_64-REDACTED-linux-gnu/bin/cargo check --all-features (dns block)
  • Triggering command: /home/REDACTED/.rustup/toolchains/1.92-x86_64-REDACTED-linux-gnu/bin/cargo /home/REDACTED/.rustup/toolchains/1.92-x86_64-REDACTED-linux-gnu/bin/cargo metadata --format-version 1 --all-features --manifest-path /home/REDACTED/work/dash-evo-tool/dash-evo-tool/Cargo.toml --filter-platform x86_64-REDACTED-linux-gnu --lockfile-path /tmp/rust-analyzer10c4-0/Cargo.lock -Zunstable-options (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This pull request fixes a critical UTXO management bug where UTXOs were being removed from the wallet before transaction building was complete, leading to permanent UTXO loss if the transaction creation failed after UTXO selection. The fix defers UTXO removal until after the transaction is fully built and signed.

Changes:

• Split UTXO management into separate select and remove operations to prevent premature UTXO loss
• Removed redundant UTXO cleanup code from transaction broadcast callers
• Added parameter ordering convention to CLAUDE.md for AppContext placement

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/model/wallet/utxos.rs	Added select_unspent_utxos_for (non-mutating) and remove_selected_utxos (explicit removal with DB persistence); refactored take_unspent_utxos_for to delegate to both
src/model/wallet/asset_lock_transaction.rs	Deferred UTXO removal to after transaction is fully built and signed; removed rollback logic (no longer needed)
src/model/wallet/mod.rs	Updated payment transaction methods to use deferred UTXO removal pattern
src/backend_task/wallet/fund_platform_address_from_wallet_utxos.rs	Removed redundant UTXO cleanup (now handled in transaction creation)
src/backend_task/identity/top_up_identity.rs	Removed redundant UTXO cleanup and simplified error recovery
src/backend_task/identity/register_identity.rs	Removed redundant UTXO cleanup and TODO comment about timing issue (now fixed)
src/backend_task/core/create_asset_lock.rs	Removed redundant UTXO cleanup from both asset lock creation methods
CLAUDE.md	Added parameter ordering convention for AppContext placement

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new parameter ordering convention documented here conflicts with the existing codebase convention. Throughout the codebase, Option<&AppContext> (named as register_addresses or register) is consistently placed as the last parameter after self, not the first.

Examples from existing code:

• change_address(&mut self, network: Network, register: Option<&AppContext>)
• registration_asset_lock_transaction(&mut self, network: Network, amount: u64, allow_take_fee_from_amount: bool, identity_index: u32, register_addresses: Option<&AppContext>)

The new remove_selected_utxos method follows the documented convention here by placing context first, but this creates inconsistency with the rest of the codebase. Consider either:

1. Updating this convention to match the existing pattern (context/register parameter last), or
2. Refactoring existing methods to follow the new convention (a larger change outside the scope of this PR)

For now, the convention documentation should reflect the actual predominant pattern in the codebase.

Suggested change

	When a method takes `&AppContext` (or `Option<&AppContext>`), place it as the first parameter after `self`. Example:
	```rust
	fn remove_selected_utxos(&mut self, context: Option<&AppContext>, selected: &BTreeMap<...>) -> Result<(), String>
	When a method takes `&AppContext` (or `Option<&AppContext>`), place it as the last parameter after `self`. Example:
	```rust
	fn remove_selected_utxos(&mut self, selected: &BTreeMap<...>, context: Option<&AppContext>) -> Result<(), String>