fix(wallets): use selector ceiling for asset-lock Max

CHANGELOG.md

@@ -63,6 +63,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
+- **"Max" now matches what your Core wallet can actually send**: pressing
+  "Max" when shielding DASH, funding a Platform address, sending directly to
+  an identity, or funding an identity (creating or topping up, from your
+  wallet balance or a received deposit) could suggest an amount larger than
+  the wallet could actually send, so the transaction was rejected no matter
+  how you adjusted it. Max and the amount check now ask the wallet directly
+  what it can send instead of estimating from an on-screen balance, so the
+  two stay in agreement, and both reserve room for the fee. Funding from a
+  received deposit is also now capped by what actually arrived at that
+  deposit address, never by unrelated funds elsewhere in the wallet. While
+  the check is running, the amount field shows "Checking the available
+  amount…"; if it fails, "The available amount could not be checked."
+  appears with a "Retry available amount check" button, and you can still
+  switch to a different funding method at any point. For a very large
+  wallet, this check is capped at a few seconds; if it can't finish in
+  time, the amount field explains that and suggests sending a smaller
+  amount or trying again shortly.
+
 - **Wallet rename consistency**: renaming a wallet no longer overwrites other
   saved wallet details when metadata cannot be read. Overlapping renames and
   wallet removals also keep displayed aliases and deleted-wallet metadata

docs/user-stories.md

@@ -457,6 +457,15 @@ As a developer, I want to transfer credits privately from my shielded pool to an
 - Spending is paused until the shielded balance is verified, and the button is disabled with a clear reason while verification is in progress.
 - Available only on Platform protocol v12 or later when Expert view or Developer view is selected.
 
+### SND-017: "Max" is verified against what the wallet can actually build [Implemented]
+**Persona:** Alex, Priya, Jordan
+
+As a user, I want "Max" (and the amount check behind it) to reflect what my Core wallet can genuinely send when shielding DASH, funding a Platform address, sending directly to an identity, or funding an identity from my wallet balance, so that the amount I'm offered — or type in myself — never gets rejected for exceeding what the wallet can build.
+
+- "Max" and amount validation both ask the wallet directly for its actual sendable ceiling, reserving the relevant operation's fee, instead of estimating from the on-screen balance — the two always agree, including for an amount typed in by hand rather than produced by the Max button.
+- While the check is running, the amount field shows "Checking the available amount…"; if it fails, "The available amount could not be checked." appears with a "Retry available amount check" button.
+- Funding from a received deposit is capped by what actually arrived at that specific deposit address, never by unrelated funds elsewhere in the wallet — see SND-014 (Core-to-Core Max), which uses a separate, simpler network-fee-only calculation not covered by this story.
+
 ---
 
 ## Asset Locks (ALK)

src/backend_task/error.rs

@@ -4,6 +4,7 @@
 //! `Debug` → variant name + fields (logged and shown in collapsible details).
 
 use crate::model::fee_estimation::format_credits_as_dash;
+use crate::model::wallet::WalletSeedHash;
 use dash_sdk::Error as SdkError;
 use dash_sdk::dapi_client::DapiClientError;
 use dash_sdk::dapi_client::transport::TransportError;
@@ -234,6 +235,23 @@ pub enum TaskError {
         >,
     },
 
+    /// The non-broadcasting asset-lock builder probe exceeded its bounded wait.
+    #[error(
+        "We couldn't work out the maximum amount you can send from this wallet in time. Try sending a smaller amount, or wait a few minutes and try again."
+    )]
+    AssetLockMaxAmountTimedOut { seed_hash: WalletSeedHash },
+
+    /// The non-broadcasting asset-lock builder probe could not determine a safe Max.
+    #[error(
+        "The wallet's available amount could not be checked. Wait a moment and try again."
+    )]
+    AssetLockBalanceQueryFailed {
+        #[source]
+        source: Box<
+            dash_sdk::dpp::key_wallet::wallet::managed_wallet_info::transaction_builder::BuilderError,
+        >,
+    },
+
     /// The payment would need more individual unspent outputs than fit in a
     /// single standard transaction.
     #[error(

src/backend_task/mod.rs

@@ -331,6 +331,11 @@ pub enum BackendTaskContext {
     ScheduledVoteSweep { network: Network },
     /// Receive-address derivation for one wallet's deposit flow.
     GenerateReceiveAddress { seed_hash: WalletSeedHash },
+    /// Live asset-lock builder ceiling query for one wallet.
+    AssetLockMaxAmount {
+        seed_hash: WalletSeedHash,
+        snapshot_generation: u64,
+    },
     /// One HD-wallet or imported-key alias update.
     WalletRename(WalletTask),
     /// A known backend task that needs no finer UI correlation.
@@ -387,6 +392,16 @@ impl BackendTaskContext {
         }
     }
 
+    pub(crate) fn asset_lock_max_amount_request(&self) -> Option<(WalletSeedHash, u64)> {
+        match self.operation() {
+            Self::AssetLockMaxAmount {
+                seed_hash,
+                snapshot_generation,
+            } => Some((*seed_hash, *snapshot_generation)),
+            _ => None,
+        }
+    }
+
     pub(crate) fn wallet_rename_task(&self) -> Option<&WalletTask> {
         match self.operation() {
             Self::WalletRename(task) => Some(task),
@@ -434,6 +449,13 @@ impl From<&BackendTask> for BackendTaskContext {
                     seed_hash: *seed_hash,
                 }
             }
+            BackendTask::WalletTask(WalletTask::GetAssetLockMaxAmount {
+                seed_hash,
+                snapshot_generation,
+            }) => Self::AssetLockMaxAmount {
+                seed_hash: *seed_hash,
+                snapshot_generation: *snapshot_generation,
+            },
             BackendTask::WalletTask(
                 task @ (WalletTask::RenameHdWallet { .. }
                 | WalletTask::RenameSingleKeyWallet { .. }),
@@ -601,6 +623,12 @@ pub enum BackendTaskSuccessResult {
         seed_hash: WalletSeedHash,
         locks: Vec<platform_wallet::wallet::asset_lock::tracked::TrackedAssetLock>,
     },
+    /// Largest asset-lock credit output the live upstream builder accepts.
+    AssetLockMaxAmount {
+        seed_hash: WalletSeedHash,
+        snapshot_generation: u64,
+        amount_duffs: u64,
+    },
     /// Platform address balances fetched from Platform
     PlatformAddressBalances {
         seed_hash: WalletSeedHash,
@@ -1243,6 +1271,19 @@ impl AppContext {
                 .list_tracked_asset_locks(&seed_hash)
                 .await
                 .map(|locks| BackendTaskSuccessResult::TrackedAssetLocks { seed_hash, locks }),
+            WalletTask::GetAssetLockMaxAmount {
+                seed_hash,
+                snapshot_generation,
+            } => backend
+                .asset_lock_max_amount(&seed_hash)
+                .await
+                .map(
+                    |amount_duffs| BackendTaskSuccessResult::AssetLockMaxAmount {
+                        seed_hash,
+                        snapshot_generation,
+                        amount_duffs,
+                    },
+                ),
             WalletTask::FetchPlatformAddressBalances { seed_hash } => {
                 self.fetch_platform_address_balances(seed_hash).await
             }

src/backend_task/wallet/mod.rs

@@ -224,6 +224,12 @@ pub enum WalletTask {
     ListTrackedAssetLocks {
         seed_hash: WalletSeedHash,
     },
+    /// Dry-run the live upstream asset-lock builder to obtain the largest
+    /// credit output its current UTXO set can fund.
+    GetAssetLockMaxAmount {
+        seed_hash: WalletSeedHash,
+        snapshot_generation: u64,
+    },
     /// Fund Platform addresses from a tracked asset lock identified by its
     /// credit-output outpoint. The proof and credit-output key are recovered
     /// from the upstream `AssetLockManager` and the wallet's funding

src/context/mod.rs

@@ -1461,6 +1461,20 @@ impl AppContext {
             .unwrap_or_default()
     }
 
+    /// Monotonic generation of the event-pushed snapshot for one wallet.
+    pub fn snapshot_generation(&self, seed_hash: &WalletSeedHash) -> u64 {
+        self.wallet_backend()
+            .map(|wb| wb.wallet_snapshot_generation(seed_hash))
+            .unwrap_or_default()
+    }
+
+    /// Snapshot generation and final-funds asset-lock signal from one read.
+    pub fn asset_lock_probe_snapshot(&self, seed_hash: &WalletSeedHash) -> (u64, u64) {
+        self.wallet_backend()
+            .map(|wallet_backend| wallet_backend.asset_lock_probe_snapshot(seed_hash))
+            .unwrap_or_default()
+    }
+
     /// Number of UTXOs in the wallet's display snapshot. Used to estimate the
     /// Core (L1) transaction fee for a "Max" send, which spends every UTXO.
     ///

src/context/test_support.rs

@@ -16,20 +16,34 @@ use crate::wallet_backend::DetKv;
 /// to exercise the settings read-modify-write and feature-gate paths.
 pub(crate) fn test_app_context(dir: &Path) -> Arc<AppContext> {
     let app_kv = AppContext::open_app_kv(dir).expect("open app k/v");
-    test_app_context_with_kv(dir, app_kv)
+    test_app_context_with_kv_and_network(dir, app_kv, Network::Testnet)
+}
+
+/// Build a throwaway [`AppContext`] for a specific network.
+pub(crate) fn test_app_context_for_network(dir: &Path, network: Network) -> Arc<AppContext> {
+    let app_kv = AppContext::open_app_kv(dir).expect("open app k/v");
+    test_app_context_with_kv_and_network(dir, app_kv, network)
 }
 
 /// [`test_app_context`] with a caller-supplied app k/v store, so a test can
 /// inject a fault-injecting backing store (see `kv_test_support::FailingKv`).
 pub(crate) fn test_app_context_with_kv(dir: &Path, app_kv: Arc<DetKv>) -> Arc<AppContext> {
+    test_app_context_with_kv_and_network(dir, app_kv, Network::Testnet)
+}
+
+fn test_app_context_with_kv_and_network(
+    dir: &Path,
+    app_kv: Arc<DetKv>,
+    network: Network,
+) -> Arc<AppContext> {
     crate::app_dir::ensure_env_file(dir);
     let db = Arc::new(crate::database::Database::new(dir.join("data.db")).expect("db"));
     db.create_tables(true).expect("create tables");
     db.set_default_version().expect("set version");
     let secret_store = AppContext::open_secret_store(dir).expect("open secret store");
     AppContext::new(
         dir.to_path_buf(),
-        Network::Testnet,
+        network,
         db,
         Default::default(),
         Default::default(),

src/model/asset_lock.rs

@@ -0,0 +1,51 @@
+//! Stateless asset-lock amount calculations shared by UI flows.
+
+/// Why an asset-lock amount is outside the builder-derived ceiling.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AssetLockAmountError {
+    /// Adding the operation-specific reserve exceeded the amount range.
+    Overflow,
+    /// The requested amount plus its reserve exceeds the builder ceiling.
+    ExceedsMaximum { maximum_amount_duffs: u64 },
+}
+
+/// Largest user-entered amount after reserving operation-specific fees.
+///
+/// Both arguments must use the same unit (duffs or Platform credits).
+pub fn asset_lock_user_max_amount(builder_max: u64, reserve: u64) -> u64 {
+    builder_max.saturating_sub(reserve)
+}
+
+/// Validate a user-entered amount against the live builder-derived ceiling.
+pub fn validate_asset_lock_amount(
+    amount_duffs: u64,
+    reserve_duffs: u64,
+    builder_max_duffs: u64,
+) -> Result<(), AssetLockAmountError> {
+    let required_duffs = amount_duffs
+        .checked_add(reserve_duffs)
+        .ok_or(AssetLockAmountError::Overflow)?;
+    if required_duffs > builder_max_duffs {
+        return Err(AssetLockAmountError::ExceedsMaximum {
+            maximum_amount_duffs: asset_lock_user_max_amount(builder_max_duffs, reserve_duffs),
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{AssetLockAmountError, asset_lock_user_max_amount, validate_asset_lock_amount};
+
+    #[test]
+    fn builder_ceiling_validation_reserves_operation_fee() {
+        assert_eq!(asset_lock_user_max_amount(10_000, 1_000), 9_000);
+        assert_eq!(validate_asset_lock_amount(9_000, 1_000, 10_000), Ok(()));
+        assert_eq!(
+            validate_asset_lock_amount(9_001, 1_000, 10_000),
+            Err(AssetLockAmountError::ExceedsMaximum {
+                maximum_amount_duffs: 9_000,
+            })
+        );
+    }
+}

src/model/mod.rs

@@ -1,5 +1,6 @@
 pub mod address;
 pub mod amount;
+pub mod asset_lock;
 pub mod contested_name;
 pub mod dashpay;
 pub mod dashpay_derivation;

src/ui/identities/add_new_identity_screen/by_receive_deposit.rs

@@ -145,6 +145,10 @@ impl AddNewIdentityScreen {
         let mut action = AppAction::None;
         self.reconcile_funding_deposit();
         let step = *self.step.read_recover();
+        let seed_hash = self
+            .selected_wallet
+            .as_ref()
+            .and_then(|wallet| wallet.read().ok().map(|wallet| wallet.seed_hash()));
 
         if step == WalletFundedScreenStep::WaitingOnFunds {
             ui.heading(format!(
@@ -171,6 +175,29 @@ impl AddNewIdentityScreen {
         // committed to the pending transaction, so the input's max recomputes to
         // 0 and would show a stale "exceeds maximum" error over a succeeding op.
         if step == WalletFundedScreenStep::FundsReceived {
+            let Some(seed_hash) = seed_hash else {
+                if ui.button("Choose a different funding method").clicked() {
+                    self.reset_to_choose_funding();
+                }
+                return action;
+            };
+            if self.asset_lock_balance.is_failed(&seed_hash) {
+                ui.label("The available amount could not be checked.");
+                if ui.button("Retry available amount check").clicked() {
+                    self.asset_lock_balance.invalidate_one(&seed_hash);
+                }
+                if ui.button("Choose a different funding method").clicked() {
+                    self.reset_to_choose_funding();
+                }
+                return action;
+            }
+            if self.asset_lock_balance.get(&seed_hash).is_none() {
+                ui.label("Checking the available amount…");
+                if ui.button("Choose a different funding method").clicked() {
+                    self.reset_to_choose_funding();
+                }
+                return action;
+            }
             self.render_funding_amount_input(ui);
 
             let has_valid_amount = self

src/ui/identities/add_new_identity_screen/by_using_unused_balance.rs

@@ -19,10 +19,11 @@ impl AddNewIdentityScreen {
                 }
             };
 
-            let spendable_balance: u64 = self
-                .app_context
-                .snapshot_balance(&wallet.seed_hash())
-                .spendable();
+            let seed_hash = wallet.seed_hash();
+            let spendable_balance = self
+                .asset_lock_balance
+                .get(&seed_hash)
+                .unwrap_or_else(|| self.app_context.snapshot_balance(&seed_hash).spendable());
 
             let dash_balance = spendable_balance as f64 * 1e-8; // Convert to DASH units
 
@@ -45,10 +46,7 @@ impl AddNewIdentityScreen {
     fn render_insufficient_wallet_balance_banner(&self, ui: &mut egui::Ui) -> Option<AppAction> {
         let selected_wallet = self.selected_wallet.as_ref()?;
         let spendable_duffs = match selected_wallet.read() {
-            Ok(w) => self
-                .app_context
-                .snapshot_balance(&w.seed_hash())
-                .spendable(),
+            Ok(w) => self.asset_lock_balance.get(&w.seed_hash())?,
             Err(_) => {
                 ui.label("Wallet is busy. Try again in a moment.");
                 return Some(AppAction::None);
@@ -102,8 +100,28 @@ impl AddNewIdentityScreen {
         self.show_wallet_balance(ui);
         ui.add_space(5.0);
 
+        let seed_hash = self
+            .selected_wallet
+            .as_ref()
+            .and_then(|wallet| wallet.read().ok().map(|wallet| wallet.seed_hash()));
+        let Some(seed_hash) = seed_hash else {
+            return action;
+        };
+        if self.asset_lock_balance.is_failed(&seed_hash) {
+            ui.label("The available amount could not be checked.");
+            if ui.button("Retry available amount check").clicked() {
+                self.asset_lock_balance.invalidate_one(&seed_hash);
+            }
+            return action;
+        }
+        if self.asset_lock_balance.get(&seed_hash).is_none() {
+            ui.label("Checking the available amount…");
+            return action;
+        }
+
         if let Some(insufficient_action) = self.render_insufficient_wallet_balance_banner(ui) {
-            return insufficient_action;
+            action |= insufficient_action;
+            return action;
         }
 
         self.render_funding_amount_input(ui);