fix(lite): per-address spendable honours the backend spendable flag; flag imported view-only addresses

Lite-parity audit: per-address spendableBalance was set equal to the gross balance, ignoring the backend's
per-note 'spendable' flag (spending key present AND note at/below the anchor height), and has_spending_key
was effectively always true (mapAddress never set spendabilityKnown). So the Send auto-picker could select
an address that can't fund the send, and an imported view-only (zxviews) address looked spendable.

- Parser: carry the backend per-note 'spendable' flag when present (Sapling notes; transparent utxos keep
  the confirmed/unspent rule). It can only narrow spendability, never widen it.
- Mapper: derive per-address spending-key evidence from positive signals only — a spendable note proves a
  key (spendable), a confirmed long-mature (>=100 blocks) still-non-spendable note proves view-only
  (!spendable); fresh/immature/no notes stay unknown so nothing is mislabelled.
- Controller: info.balance stays the gross sum; info.spendableBalance now counts only backend-spendable
  outputs; a tolerated partial refresh keeps the last-known spendable balance and view-only verdict.

Display/selection only — gating can only get stricter for view-only/unanchored funds; no send/sweep/encrypt
call changes. Test: testLitePerAddressSpendableAndViewOnly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/wallet/lite_result_parsers.cpp

@@ -285,6 +285,14 @@ bool parseSpendableOutput(const json& value,
     if (!readOptionalBoolField(value, "spent", output.spent, result)) return false;
     if (!readOptionalBoolField(value, "unconfirmed_spent", output.unconfirmedSpent, result)) return false;
     output.spendable = !output.pending && !output.spent && !output.unconfirmedSpent;
+    // The backend's per-note 'spendable' (we hold the spending key AND the note is at/below the anchor
+    // height) is authoritative when present (Sapling notes only; transparent utxos carry no such field,
+    // so they keep the confirmed/unspent rule above). It can only narrow, never widen, spendability.
+    bool backendSpendable = true;
+    if (!readOptionalBoolField(value, "spendable", backendSpendable, result)) return false;
+    if (value.contains("spendable") && value.at("spendable").is_boolean()) {
+        output.spendable = output.spendable && backendSpendable;
+    }
     return true;
 }
 

src/wallet/lite_wallet_controller.cpp

@@ -376,10 +376,12 @@ void applyLiteRefreshModelToWalletState(const LiteWalletAppRefreshModel& model,
         // unconfirmed-spent, or still pending (notes/utxos from an unconfirmed received tx) so
         // the per-address figures match the confirmed balance the wallet treats as available.
         std::unordered_map<std::string, std::uint64_t> perAddressZatoshis;
+        std::unordered_map<std::string, std::uint64_t> perAddressSpendableZatoshis;  // backend 'spendable' only
         if (model.hasSpendableOutputs) {
             for (const auto& output : model.spendableOutputs) {
                 if (output.spent || output.unconfirmedSpent || output.pending) continue;
                 perAddressZatoshis[output.address] += output.valueZatoshis;
+                if (output.spendable) perAddressSpendableZatoshis[output.address] += output.valueZatoshis;
             }
         }
 
@@ -388,8 +390,14 @@ void applyLiteRefreshModelToWalletState(const LiteWalletAppRefreshModel& model,
         // of zeroing every address — a zeroed breakdown next to a correct nonzero total looks
         // like fund loss and breaks "send from this address".
         std::unordered_map<std::string, double> priorBalances;
+        std::unordered_map<std::string, double> priorSpendable;
+        std::unordered_map<std::string, bool> priorHasKey;
         if (!model.hasSpendableOutputs) {
-            for (const auto& a : state.addresses) priorBalances[a.address] = a.balance;
+            for (const auto& a : state.addresses) {
+                priorBalances[a.address] = a.balance;
+                priorSpendable[a.address] = a.spendableBalance;
+                priorHasKey[a.address] = a.has_spending_key;
+            }
         }
 
         state.addresses.clear();
@@ -407,9 +415,22 @@ void applyLiteRefreshModelToWalletState(const LiteWalletAppRefreshModel& model,
             } else {
                 info.balance = 0.0;  // notes succeeded and address has no spendable outputs
             }
-            info.spendableBalance = info.balance;  // lite per-address balance is already confirmed/spendable
+            // balance stays the gross confirmed-unspent sum; spendableBalance counts only outputs the backend
+            // marks spendable (spending key + anchor depth). Notes failed this cycle -> keep last-known.
+            if (model.hasSpendableOutputs) {
+                const auto sit = perAddressSpendableZatoshis.find(addr.address);
+                info.spendableBalance = sit != perAddressSpendableZatoshis.end()
+                    ? static_cast<double>(sit->second) / kZatoshisPerCoin : 0.0;
+            } else {
+                const auto psit = priorSpendable.find(addr.address);
+                info.spendableBalance = psit != priorSpendable.end() ? psit->second : 0.0;
+            }
             info.type = (addr.kind == LiteWalletAppAddressKind::Shielded) ? "shielded" : "transparent";
             info.has_spending_key = addr.spendabilityKnown ? addr.spendable : true;
+            if (!addr.spendabilityKnown && !model.hasSpendableOutputs) {
+                const auto pkit = priorHasKey.find(addr.address);  // keep last-known view-only verdict
+                if (pkit != priorHasKey.end()) info.has_spending_key = pkit->second;
+            }
             if (addr.kind == LiteWalletAppAddressKind::Shielded) {
                 state.z_addresses.push_back(info);
             } else {

src/wallet/lite_wallet_state_mapper.cpp

@@ -190,6 +190,32 @@ LiteWalletStateMapResult mapLiteWalletRefreshBundle(const LiteWalletRefreshBundl
         result.model.sync.complete = bundle.syncStatus.complete;
     }
 
+    // Per-address spending-key evidence from the backend's per-note 'spendable' flag. Only POSITIVE evidence
+    // sets spendabilityKnown: a spendable note proves a key; a confirmed, long-mature (well past any anchor
+    // offset) unspent note that is still not spendable can only mean a view-only address. Fresh/immature
+    // notes, no notes, or no chain height stay unknown (the controller then keeps its spendable default).
+    if (result.model.hasAddresses && result.model.hasSpendableOutputs) {
+        constexpr std::int64_t kMatureDepth = 100;
+        const std::int64_t tip = result.model.hasSyncStatus
+            ? static_cast<std::int64_t>(result.model.sync.chainHeight) : 0;
+        for (auto& addr : result.model.addresses) {
+            if (addr.kind != LiteWalletAppAddressKind::Shielded) continue;
+            bool anySpendable = false;
+            bool matureNonSpendable = false;
+            for (const auto& out : result.model.spendableOutputs) {
+                if (out.address != addr.address || out.kind != LiteSpendableOutputKind::UnspentNote) continue;
+                if (out.spent || out.unconfirmedSpent || out.pending) continue;
+                if (out.spendable) { anySpendable = true; break; }
+                if (tip > 0 && out.createdInBlock && *out.createdInBlock > 0 &&
+                    tip - *out.createdInBlock >= kMatureDepth) {
+                    matureNonSpendable = true;
+                }
+            }
+            if (anySpendable) { addr.spendabilityKnown = true; addr.spendable = true; }
+            else if (matureNonSpendable) { addr.spendabilityKnown = true; addr.spendable = false; }
+        }
+    }
+
     if (!modelHasAnyMappedField(result.model)) {
         addIssue(result, LiteWalletStateMapIssue::EmptyBundle, "lite refresh bundle has no mappable fields");
         result.error = result.issues.back().message;