feat(fullnode): add "Repair Wallet" (-zapwallettxes=2) to Settings

When a note's stored record is corrupt or its tx isn't in the canonical chain,
z_sendmany fails to build a valid sapling spend proof even after a full -rescan,
because a plain rescan replays witnesses but keeps the existing tx/note records.
The zcashd repair for this is -zapwallettxes=2, which deletes all wallet tx/note
records and rebuilds them from the chain (keys/addresses preserved).

Adds a RepairWallet lifecycle operation that mirrors the existing -rescan plumbing
(one-shot zapOnNextStart flag on the embedded daemon; -zapwallettxes=2 implies and
supersedes -rescan), an App::repairWallet() that reuses the rescan status UI (so the
status bar + warmup-end completion detection apply), and a confirmed "Repair Wallet"
button + dialog in Settings → node maintenance (embedded daemon only).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/daemon/daemon_controller.cpp

@@ -96,12 +96,23 @@ bool DaemonController::rescanOnNextStart() const
     return daemon_->rescanOnNextStart();
 }
 
+void DaemonController::setZapOnNextStart(bool enabled)
+{
+    daemon_->setZapOnNextStart(enabled);
+}
+
+bool DaemonController::zapOnNextStart() const
+{
+    return daemon_->zapOnNextStart();
+}
+
 void DaemonController::prepareLifecycleOperation(const LifecycleDecision& decision,
                                                  const config::Settings* settings)
 {
     if (settings) syncSettings(settings);
     if (decision.resetCrashCount) resetCrashCount();
     if (decision.setRescanOnNextStart) setRescanOnNextStart(true);
+    if (decision.setZapOnNextStart) setZapOnNextStart(true);
 }
 
 DaemonController::ShutdownDecision DaemonController::shutdownDecision(

src/daemon/daemon_controller.h

@@ -31,6 +31,7 @@ public:
     enum class LifecycleOperation {
         ManualRestart,
         Rescan,
+        RepairWallet,        // restart with -zapwallettxes=2 (wipe & rebuild wallet tx records)
         DeleteBlockchainData,
         BootstrapStop
     };
@@ -46,6 +47,7 @@ public:
         bool setRescanOnNextStart = false;
         bool disconnectRpc = false;
         int restartDelayMs = 0;
+        bool setZapOnNextStart = false;
     };
 
     class LifecycleTaskContext {
@@ -102,6 +104,8 @@ public:
     void resetCrashCount();
     void setRescanOnNextStart(bool enabled);
     bool rescanOnNextStart() const;
+    void setZapOnNextStart(bool enabled);
+    bool zapOnNextStart() const;
 
     static ShutdownDecision evaluateShutdownPolicy(bool hasDaemon,
                                                    bool externalDaemonDetected,
@@ -141,6 +145,13 @@ public:
                 }
                 return {operation, true, daemonRunning, "rescan-blockchain", "Starting rescan...", "",
                         false, true, false, 3000};
+            case LifecycleOperation::RepairWallet:
+                if (!usingEmbeddedDaemon || !hasDaemon) {
+                    return {operation, false, daemonRunning, "", "",
+                            "Wallet repair requires embedded daemon. Restart your daemon with -zapwallettxes=2 manually."};
+                }
+                return {operation, true, daemonRunning, "repair-wallet", "Repairing wallet...", "",
+                        false, false, false, 3000, true};
             case LifecycleOperation::DeleteBlockchainData:
                 if (!usingEmbeddedDaemon || !hasDaemon) {
                     return {operation, false, daemonRunning, "", "",
@@ -190,6 +201,7 @@ public:
                 }
                 break;
             case LifecycleOperation::Rescan:
+            case LifecycleOperation::RepairWallet:
             case LifecycleOperation::DeleteBlockchainData:
                 runtime.stopDaemonWithPolicy();
                 result.stopped = true;
@@ -206,6 +218,7 @@ public:
         }
 
         if (decision.operation == LifecycleOperation::Rescan ||
+            decision.operation == LifecycleOperation::RepairWallet ||
             decision.operation == LifecycleOperation::DeleteBlockchainData) {
             runtime.resetOutputOffset();
         }

src/daemon/embedded_daemon.cpp

@@ -482,8 +482,14 @@ bool EmbeddedDaemon::start(const std::string& binary_path)
         args.push_back("-maxconnections=" + std::to_string(max_connections_));
     }
 
-    // Add -rescan flag if requested (one-shot)
-    if (rescan_on_next_start_.exchange(false)) {
+    // Add wallet-repair flag if requested (one-shot). -zapwallettxes=2 wipes all wallet tx/note
+    // records and rebuilds them from the chain; it implies -rescan, so don't also pass -rescan.
+    if (zap_on_next_start_.exchange(false)) {
+        DEBUG_LOGF("[INFO] Adding -zapwallettxes=2 flag for wallet repair (zap & rebuild)\n");
+        args.push_back("-zapwallettxes=2");
+        rescan_on_next_start_.store(false);  // implied by zap; avoid redundant -rescan
+    } else if (rescan_on_next_start_.exchange(false)) {
+        // Add -rescan flag if requested (one-shot)
         DEBUG_LOGF("[INFO] Adding -rescan flag for blockchain rescan\n");
         args.push_back("-rescan");
     }

src/daemon/embedded_daemon.h

@@ -183,6 +183,14 @@ public:
     void setRescanOnNextStart(bool v) { rescan_on_next_start_ = v; }
     bool rescanOnNextStart() const { return rescan_on_next_start_.load(); }
 
+    /**
+     * @brief Request a wallet repair (-zapwallettxes=2) on the next daemon start. This deletes all
+     *        wallet transaction/note records and rebuilds them from the chain (keys are kept); the
+     *        daemon implicitly rescans afterwards. One-shot, like the rescan flag.
+     */
+    void setZapOnNextStart(bool v) { zap_on_next_start_ = v; }
+    bool zapOnNextStart() const { return zap_on_next_start_.load(); }
+
     /** Get number of consecutive daemon crashes (resets on successful start or manual reset) */
     int getCrashCount() const { return crash_count_.load(); }
     /** Reset crash counter (call on successful connection or manual restart) */
@@ -222,6 +230,7 @@ private:
     int max_connections_ = 0;  // 0 = daemon default
     std::atomic<int> crash_count_{0};  // consecutive crash counter
     std::atomic<bool> rescan_on_next_start_{false};  // -rescan flag for next start
+    std::atomic<bool> zap_on_next_start_{false};     // -zapwallettxes=2 flag for next start
 };
 
 } // namespace daemon