Never present a post-broadcast error as a failed send

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

Description

Technical design doc

GUI half of Edge bug "Send - multiple transactions after network error": one intended Bitcoin send became five real payments. Every broadcast succeeded; the engine's saveTx then threw, and the send scene treated that throw as a failed send: error card blaming the network plus a re-armed slider. Each retry re-quoted on the remaining UTXOs (saveTx marks inputs spent before it throws), so each slide was a fresh real payment. Three distinct payments happened inside 44 seconds in the incident log.

Asana: https://app.asana.com/1/9976422036640/project/1213843652804305/task/1217135300337949

The submit flow in SendScene2.handleSliderComplete is now split at the broadcast boundary:

• broadcastedTx is hoisted above the try block; once it is set, the funds have moved.
• A post-broadcast throw is logged (logActivity), surfaced as a warning that the transaction WAS sent ("sent, but some final bookkeeping did not complete"), and navigates forward exactly like a success (onDone / transaction details).
• The finally block only re-arms the slider when nothing was broadcast. A genuinely failed broadcast (throw before broadcastTx returns) keeps the existing error card and retry behavior.
• handleSliderComplete returns the broadcast transaction so the FIO no-bundled retry (which recursively awaits it) propagates a nested broadcast to the outer invocation; without that, the outer finally could re-arm the slider after the nested attempt broadcast (caught by Bugbot in review).

Verified on the iOS sim against Bitcoin testnet with a real broadcast and an injected post-broadcast throw, before and after the fix (screenshots below). The engine half (saveTx tolerating a disconnected engine, broadcast-ambiguity resolution) is EdgeApp/edge-currency-plugins#455.

---

Note

High Risk
Changes core send confirmation behavior and could misclassify edge cases, but directly prevents duplicate real payments after successful broadcasts.

Overview
SendScene2 now treats a successful broadcastTx as the point of no return: if anything throws after that, the user sees a warning that the transaction was sent (new transaction_success_bookkeeping_error_message), navigation follows the success path via navigateForwardAsSent, and the confirm slider is not re-armed. Pre-broadcast failures still show the error card and allow retry.

handleSliderComplete returns the broadcasted transaction and propagates it through the FIO no-bundled retry so nested sends cannot leave the outer flow thinking nothing broadcast. The slider uses a handleSlideConfirm wrapper for the void callback contract.

CHANGELOG entry and src/docs/send-post-broadcast-failure.md document the incident (duplicate payments after engine bookkeeping threw) and the GUI half of the fix; engine changes are in a separate repo PR.

^{Reviewed by Cursor Bugbot for commit cfb630e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[j0ntz]

📸🪓 Test evidence (iOS sim, Bitcoin testnet, real broadcasts)

🪓 Hack-forced evidence: Uncommitted throw injected in SendScene2 right after coreWallet.broadcastTx returns (broadcast itself ran for real on testnet); frames 03/04 additionally swapped SendScene2 to develop's version for the before-fix comparison; both edits reverted, clean tree. Temporary uncommitted edit, reverted before commit; the marked frames prove the rendering, not the trigger.

🪓 HACK-FORCED: after fix warning

🪓 HACK-FORCED: after fix forward nav

🪓 HACK-FORCED: before fix error card

🪓 HACK-FORCED: before fix slider rearmed

Captured by the agent's in-app test run (build-and-test).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ab91beb. Configure here.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}