fix(receive): serve the receive address from the SDK engine, not the held dashj chain

common/src/main/java/org/dash/wallet/common/WalletDataProvider.kt

@@ -44,6 +44,22 @@ interface WalletDataProvider {
     fun freshReceiveAddressString(): String
     fun currentReceiveAddressString(): String
 
+    /**
+     * [freshReceiveAddressString] / [currentReceiveAddressString] answered by a
+     * LIVE read of whichever engine owns the key chain right now.
+     *
+     * Post-cutover the wallet module reads the Kotlin SDK engine's next UNUSED
+     * address over the FFI instead of the dashj key chain, which is HELD post-
+     * cutover and would serve an address the chain has already paid (SR-03 /
+     * D-003). Pre-cutover — and in these defaults — the dashj answers are
+     * unchanged.
+     *
+     * BLOCKING, like the plain accessors: use [freshReceiveAddressStringOffMain]
+     * / [currentReceiveAddressStringOffMain] from feature and integration code.
+     */
+    fun freshReceiveAddressStringLive(): String = freshReceiveAddressString()
+    fun currentReceiveAddressStringLive(): String = currentReceiveAddressString()
+
     /** Estimated wallet balance. */
     fun getWalletBalance(): Dash
 

common/src/main/java/org/dash/wallet/common/WalletDataProviderExt.kt

@@ -44,7 +44,19 @@ import org.dash.wallet.common.transactions.filters.LockedTransaction
  * `freshReceiveAddressString()` keep working unchanged.
  */
 suspend fun WalletDataProvider.freshReceiveAddressStringOffMain(): String =
-    withContext(Dispatchers.IO) { freshReceiveAddressString() }
+    withContext(Dispatchers.IO) { freshReceiveAddressStringLive() }
+
+/**
+ * The wallet's current receive address, read OFF the calling thread.
+ *
+ * Same seam and same reason as [freshReceiveAddressStringOffMain], for the
+ * callers that want the address the wallet is currently advertising rather than
+ * a newly issued one (Maya's refund/source address, the swap aggregator). The
+ * `Live` accessor underneath is what makes this the ENGINE's next unused address
+ * post-cutover instead of the held dashj chain's frozen pointer.
+ */
+suspend fun WalletDataProvider.currentReceiveAddressStringOffMain(): String =
+    withContext(Dispatchers.IO) { currentReceiveAddressStringLive() }
 
 /** [WalletDataProvider.observeTotalBalance] as neutral [Dash] amounts. */
 fun WalletDataProvider.observeTotalDashBalance(): Flow<Dash> = observeTotalBalance()

common/src/main/java/org/dash/wallet/common/data/BaseConfig.kt

@@ -123,6 +123,26 @@ abstract class BaseConfig(
         return data.map { preferences -> preferences[key] }
     }
 
+    /**
+     * [observe] WITHOUT [data]'s IOException rescue — an unreadable store is
+     * delivered as the THROW it was instead of arriving as an absent key.
+     *
+     * [data] catches IOException and emits [emptyPreferences], so a corrupt,
+     * truncated or unreadable preferences file reaches [observe] exactly as a
+     * key that was never written does: `null`. For a preference that is only a
+     * hint that is the right trade — the unset default is harmless. For one that
+     * AUTHORISES something it is the wrong one: the caller cannot tell "nobody
+     * ever set this" from "we could not find out", so it takes the unset default
+     * on a read that never succeeded.
+     *
+     * Callers that must keep those apart collect this instead. `null` still
+     * means ABSENT, exactly as in [observe]; a FAILED read arrives as the
+     * IOException, for the caller to fail closed on.
+     */
+    open fun <T> observePreservingErrors(key: Preferences.Key<T>): Flow<T?> {
+        return context.dataStore.data.map { preferences -> preferences[key] }
+    }
+
     open suspend fun <T> get(key: Preferences.Key<T>): T? {
         return data.map { preferences -> preferences[key] }.first()
     }

common/src/main/java/org/dash/wallet/common/services/ReceiveAddressUnavailableException.kt

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026 Dash Core Group.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.dash.wallet.common.services
+
+/**
+ * No receive address can be served right now.
+ *
+ * Raised only POST-CUTOVER, when the SDK engine cannot answer and the wallet
+ * therefore has no address it is safe to advertise. It exists because the
+ * obvious fallback is actively wrong: the dashj key chain is HELD after the
+ * cutover, so its "current" pointer is frozen wherever the restore left it —
+ * index 0 on a fresh restore, an address the chain has ALREADY been paid on.
+ * Serving that is the SR-03 defect.
+ *
+ * Callers must surface a retry rather than substitute an address. The condition
+ * is transient by nature: it covers the window before the engine binds, a failed
+ * engine read, and the instant after a wallet wipe revokes the binding.
+ */
+class ReceiveAddressUnavailableException(
+    message: String = "no receive address is available yet"
+) : IllegalStateException(message)

common/src/main/java/org/dash/wallet/common/ui/receive/ReceiveInfoView.kt

@@ -102,6 +102,20 @@ class ReceiveInfoView(context: Context, attrs: AttributeSet?) : ConstraintLayout
         }
     }
 
+    /**
+     * Stop advertising an address: the address line and the QR code are both
+     * emptied. Used when a receive address that was on screen can no longer be
+     * vouched for — a stale address is worse than none, because the wallet may
+     * already have been paid on it.
+     */
+    fun clearInfo() {
+        if (address != null || amount != null) {
+            address = null
+            amount = null
+            refresh()
+        }
+    }
+
     fun setProfile(username: String?, displayName: String?, avatar: String?, avatarHash: ByteArray?) {
         this.username = username
 

features/exploredash/src/main/java/org/dash/wallet/features/exploredash/ui/ExploreTestNetFragment.kt

@@ -24,13 +24,15 @@ import android.content.Intent
 import android.net.Uri
 import android.os.Bundle
 import android.view.View
+import android.widget.Toast
 import androidx.fragment.app.Fragment
 import androidx.lifecycle.lifecycleScope
 import androidx.navigation.fragment.findNavController
 import dagger.hilt.android.AndroidEntryPoint
 import kotlinx.coroutines.launch
 import org.dash.wallet.common.WalletDataProvider
 import org.dash.wallet.common.freshReceiveAddressStringOffMain
+import org.dash.wallet.common.services.ReceiveAddressUnavailableException
 import org.dash.wallet.common.ui.viewBinding
 import org.dash.wallet.common.util.Constants
 import org.dash.wallet.features.exploredash.R
@@ -55,7 +57,18 @@ class ExploreTestNetFragment : Fragment(R.layout.fragment_explore_testnet) {
             // Off-main: dashj's freshReceiveAddress() forces a synchronous
             // full-wallet save — never run it on a click listener's thread.
             viewLifecycleOwner.lifecycleScope.launch {
-                val receiveAddress = walletDataProvider.freshReceiveAddressStringOffMain()
+                val receiveAddress = try {
+                    walletDataProvider.freshReceiveAddressStringOffMain()
+                } catch (ex: ReceiveAddressUnavailableException) {
+                    // Copying the held dashj chain's frozen address would point
+                    // the faucet at an already-paid address (SR-03).
+                    Toast.makeText(
+                        requireContext(),
+                        org.dash.wallet.common.R.string.loading_error,
+                        Toast.LENGTH_LONG
+                    ).show()
+                    return@launch
+                }
                 val clipboardManager =
                     requireActivity().getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
 

integrations/coinbase/src/main/java/org/dash/wallet/integrations/coinbase/ui/CoinbaseOrderReviewFragment.kt

@@ -25,6 +25,7 @@ import androidx.fragment.app.Fragment
 import androidx.lifecycle.lifecycleScope
 import androidx.navigation.fragment.findNavController
 import dagger.hilt.android.AndroidEntryPoint
+import kotlinx.coroutines.Job
 import kotlinx.coroutines.launch
 import org.dash.wallet.common.money.MoneyFormat
 import org.dash.wallet.common.services.analytics.AnalyticsConstants
@@ -46,6 +47,8 @@ import org.dash.wallet.integrations.coinbase.viewmodels.CoinbaseBuyDashViewModel
 import org.dash.wallet.integrations.coinbase.viewmodels.CoinbaseBuyUIState
 import org.dash.wallet.integrations.coinbase.viewmodels.CoinbaseViewModel
 import org.dash.wallet.integrations.coinbase.viewmodels.coinbaseViewModels
+import org.dash.wallet.common.services.ReceiveAddressUnavailableException
+import android.widget.Toast
 
 @AndroidEntryPoint
 class CoinbaseOrderReviewFragment : Fragment(R.layout.fragment_coinbase_order_review) {
@@ -57,6 +60,19 @@ class CoinbaseOrderReviewFragment : Fragment(R.layout.fragment_coinbase_order_re
     ).noCode().minDecimals(6).optionalDecimals()
     private var onBackPressedCallback: OnBackPressedCallback? = null
 
+    /**
+     * The confirm coroutine, so [onResume] can tell "finished, the user came
+     * back from 2FA" from "still running".
+     */
+    private var confirmJob: Job? = null
+
+    /**
+     * The id of the confirm attempt THIS fragment instance started, so the attempt
+     * can be released by name. The single-flight itself lives in the retained view
+     * model, which outlives this instance.
+     */
+    private var confirmAttemptId: Long? = null
+
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
         super.onViewCreated(view, savedInstanceState)
 
@@ -83,11 +99,66 @@ class CoinbaseOrderReviewFragment : Fragment(R.layout.fragment_coinbase_order_re
         }
 
         binding.confirmBtnContainer.setOnClickListener {
-            lifecycleScope.launch {
-                if (tryBuyDash()) {
-                    val params = viewModel.getTransferDashParams()
-                    val twoFaParams = CoinbaseTransactionParams(params, TransactionType.BuyDash)
-                    safeNavigate(CoinbaseOrderReviewFragmentDirections.coinbaseBuyDashOrderReviewToTwoFaCode(twoFaParams))
+            // Taken SYNCHRONOUSLY, on the tap, BEFORE anything is launched. The
+            // destination read below blocks (post-cutover it waits for the SDK
+            // engine to bind, then takes the engine's wallet-manager lock) and
+            // nothing is on screen while it does, so a second tap used to start a
+            // second coroutine — and a second placeBuyOrder under its own
+            // idempotency UUID, which Coinbase bills as a second purchase.
+            // Launching first and disabling inside the coroutine would not help:
+            // the taps race in exactly the window before the first suspension.
+            val attemptId = viewModel.tryBeginConfirm() ?: return@setOnClickListener
+            confirmAttemptId = attemptId
+            binding.confirmBtnContainer.isEnabled = false
+            confirmJob = lifecycleScope.launch {
+                // The flight is owned by this attempt through address preparation,
+                // the purchase and the handoff to 2FA, and given back only where
+                // nothing was bought.
+                try {
+                    // Acquire the destination BEFORE the purchase. tryBuyDash()
+                    // submits placeBuyOrder() with a fresh UUID, so an address
+                    // failure after it would leave a SUCCEEDED purchase with no
+                    // transfer parameters and no submitted-order state — pressing
+                    // confirm again would place a second, different order. Checking
+                    // first means the only failure is a no-op.
+                    val params = try {
+                        viewModel.getTransferDashParams()
+                    } catch (ex: ReceiveAddressUnavailableException) {
+                        // Depositing to the held dashj chain's frozen address is the
+                        // SR-03 defect; nothing has been bought yet, so this is safe
+                        // to retry.
+                        Toast.makeText(
+                            requireContext(),
+                            org.dash.wallet.common.R.string.loading_error,
+                            Toast.LENGTH_LONG
+                        ).show()
+                        return@launch
+                    }
+                    if (tryBuyDash(attemptId)) {
+                        // Bought: the operation is over, so this attempt stops
+                        // owning the flight and the navigation latch takes over.
+                        // Deliberately not simply released: the navigation
+                        // transaction has not executed when this coroutine ends, so
+                        // this view is still attached and still clickable — a queued
+                        // tap would place the second order. [onResume] drops the
+                        // latch if the user comes back to this screen.
+                        viewModel.latchConfirmForNavigation(attemptId)
+                        val twoFaParams = CoinbaseTransactionParams(params, TransactionType.BuyDash)
+                        safeNavigate(
+                            CoinbaseOrderReviewFragmentDirections
+                                .coinbaseBuyDashOrderReviewToTwoFaCode(twoFaParams)
+                        )
+                    }
+                } finally {
+                    // Covers the early return, a declined purchase AND an
+                    // unexpected throw: ownership left behind by a failure path
+                    // would leave the button dead for the rest of the screen's
+                    // life. Names the attempt, so it is a no-op once the purchase
+                    // handed off to the latch above, and — the case cancellation
+                    // creates — once this attempt no longer owns the flight because
+                    // the fragment was recreated while it was still parked in the
+                    // destination read and a new attempt is now running.
+                    releaseConfirm(attemptId)
                 }
             }
         }
@@ -158,15 +229,46 @@ class CoinbaseOrderReviewFragment : Fragment(R.layout.fragment_coinbase_order_re
         transactionStateDialog.showNow(parentFragmentManager, "CoinBaseBuyDashDialog")
     }
 
+    override fun onResume() {
+        super.onResume()
+        // Back from the 2FA screen (cancelled, or back-pressed) with no confirm
+        // running: the next tap is a new intent, so the latch the navigation kept
+        // is dropped HERE rather than in the coroutine, which ends while this
+        // view is still on screen. ONLY the latch: an attempt that is still
+        // running — this instance's predecessor, unwinding the destination read it
+        // was cancelled in — owns its flight and gives it back itself.
+        if (confirmJob?.isActive != true) {
+            viewModel.releaseConfirmNavigationLatch()
+
+            if (!viewModel.isConfirmBusy()) {
+                binding.confirmBtnContainer.isEnabled = true
+            }
+        }
+    }
+
+    /**
+     * Give the confirm single-flight back for [attemptId] and re-enable the
+     * button. The view can already be gone — [lifecycleScope] outlives it — so the
+     * button half is conditional, and it is also skipped while anything else still
+     * holds the flight.
+     */
+    private fun releaseConfirm(attemptId: Long) {
+        viewModel.endConfirm(attemptId)
+
+        if (view != null && !viewModel.isConfirmBusy()) {
+            binding.confirmBtnContainer.isEnabled = true
+        }
+    }
+
     private fun setNetworkState(hasInternet: Boolean) {
         binding.networkStatusStub.isVisible = !hasInternet
         binding.previewOfflineGroup.isVisible = hasInternet
     }
 
-    private suspend fun tryBuyDash(): Boolean {
+    private suspend fun tryBuyDash(attemptId: Long): Boolean {
         try {
             AdaptiveDialog.withProgress(getString(R.string.loading), requireActivity()) {
-                viewModel.buyDash()
+                viewModel.buyDash(attemptId)
             }
         } catch (ex: Exception) {
             viewModel.logEvent(AnalyticsConstants.Coinbase.BUY_ERROR)
@@ -202,5 +304,13 @@ class CoinbaseOrderReviewFragment : Fragment(R.layout.fragment_coinbase_order_re
     override fun onDestroy() {
         super.onDestroy()
         onBackPressedCallback?.remove()
+        // Whatever this instance started is cancelled with its [lifecycleScope],
+        // but a cancelled attempt parked in the uncancellable destination read can
+        // take seconds to unwind. Give its ownership back now, so the recreated
+        // fragment can confirm straight away; the late `finally` then finds the
+        // attempt no longer owns the flight and leaves the new one alone. A no-op
+        // for an attempt that already bought — that one is held by the navigation
+        // latch, which only [onResume] drops.
+        confirmAttemptId?.let { viewModel.endConfirm(it) }
     }
 }