perf(net): one balance scan per poll, filtered opstatus, a guarded merge scope

The Core poll ran z_gettotalbalance twice (minconf 0 and 1), each a whole-
wallet scan under dragonxd's cs_main. The spendable (minconf=1) call now
runs only after the display call succeeded, and only when something is
unconfirmed or pending or the exact total moved: about 95% of polls make
one scan instead of two. A forced post-send balance can no longer be lost
to a refused enqueue, and pending-send debits aren't re-applied each tick.

z_getoperationstatus is filtered to our opids with its real argument form
([[id,...]]; the old ["id"] was rejected), falling back to the unfiltered
call if a daemon refuses the filter. The Shield/Merge dialog's own polls
are filtered and session-guarded too, and finally reach Done; the dead
RPCClient wrappers are deleted.

The Merge/Consolidate scope scan becomes a tested state machine: one scan
at a time, failures latch behind a Retry button, only "node not ready"
retries by itself (10/30/60 s, at most 3), Lite never scans. Its 120 s
calls are maintenance calls: every main-thread disconnect aborts one in
flight first, so a lifecycle action no longer freezes the UI behind it.
An aborted merge that was already sent says it may still go through.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app.cpp

@@ -325,6 +325,7 @@ public:
 
     void beginBackgroundStop(const char* reason) override
     {
+        app_.abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
         if (app_.rpc_ && app_.rpc_->isConnected()) app_.rpc_->disconnect();
         app_.onDisconnected(reason ? reason : "Daemon lifecycle");
         App& app = app_;
@@ -1289,13 +1290,28 @@ void App::update()
             if (!rpc) return [this](){ opid_poll_in_progress_ = false; };
             json result;
             services::NetworkRefreshService::OperationStatusPollResult parsed;
+            const auto filter = services::NetworkRefreshService::buildOperationFilterParams(opids);
+            if (!filter) return [this](){ opid_poll_in_progress_ = false; };
             try {
                 rpc::RPCClient::TraceScope trace("Send tab / Operation status");
-                // No per-opid filter: this daemon rejects z_getoperationstatus(["opid"]) with
-                // "JSON value is not an array as expected", which left completed sends stuck on
-                // "Waiting for operation". The no-arg form returns ALL operations;
-                // parseOperationStatusPoll() filters down to the opids we're tracking.
-                result = rpc->call("z_getoperationstatus", json::array());
+                // Filtered to our opids: the call takes cs_main + cs_wallet and builds a status object for
+                // every op it reports, and the daemon retains finished ops, so the unfiltered form grew
+                // with every send, shield and chat message. Its one argument is an ARRAY of ids,
+                // [[id, ...]]; the old ["opid"] attempt failed with "JSON value is not an array as
+                // expected" because params[0] was a string. If a daemon still answers the filter with an
+                // error, fall back to the unfiltered form for this connection rather than wedge sends on
+                // "Waiting for operation"; parseOperationStatusPoll() ignores ops we don't track.
+                if (!opid_filter_unsupported_.load(std::memory_order_relaxed)) {
+                    try {
+                        result = rpc->call("z_getoperationstatus", *filter);
+                    } catch (const rpc::RpcError& e) {
+                        if (e.kind() == rpc::RpcFailureKind::Warmup) throw;
+                        result = rpc->call("z_getoperationstatus", json::array());
+                        opid_filter_unsupported_.store(true, std::memory_order_relaxed);
+                    }
+                } else {
+                    result = rpc->call("z_getoperationstatus", json::array());
+                }
                 // Parse INSIDE the guard: a malformed/type-anomalous element must never abort the
                 // poll and leave opid_poll_in_progress_ stuck true for the whole connected session.
                 parsed = services::NetworkRefreshService::parseOperationStatusPoll(result, opids);
@@ -7496,6 +7512,7 @@ void App::restartDaemon()
 
     // Disconnect RPC so the loading overlay appears
     if (decision.disconnectRpc && rpc_ && rpc_->isConnected()) {
+        abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
         rpc_->disconnect();
     }
     onDisconnected("Daemon restart");

src/app.h

@@ -15,6 +15,8 @@
 #include <unordered_set>
 #include <deque>
 #include <condition_variable>
+#include <cstdint>
+#include <optional>
 #include <nlohmann/json_fwd.hpp>
 #include "data/transaction_history_cache.h"
 #include "data/address_book.h"
@@ -432,6 +434,42 @@ public:
     // richer pending-send path internally; this is for operations with no optimistic
     // transaction row of their own.
     void trackOperation(const std::string& opid);
+    // The connected daemon rejected the opid-filtered z_getoperationstatus, so polls use the unfiltered
+    // form (every retained op) for the rest of this connection.
+    bool opidFilterUnsupported() const { return opid_filter_unsupported_.load(std::memory_order_relaxed); }
+
+    // RAII around one long ("maintenance") rpc_ call made on a worker thread with a timeout above the
+    // default 30 s, e.g. a merge or a whole-wallet scan given 120 s. rpc_ holds its curl lock for the
+    // whole transfer and disconnect() takes the same lock, so these are counted for
+    // abortMaintenanceCalls().
+    class MaintenanceCallScope {
+    public:
+        explicit MaintenanceCallScope(App& app) : app_(app)
+        {
+            // Count first, then read the flag; abortMaintenanceCalls() sets the flag, then reads the count.
+            // Either this sees the abort and never sends, or the abort sees this call and cuts it off. (A
+            // call queued behind the one disconnect() waits on could otherwise take the curl lock next
+            // and hold disconnect() for its full 120 s.)
+            app_.maint_calls_.fetch_add(1);
+            if (app_.maint_abort_.load()) {
+                app_.maint_calls_.fetch_sub(1);
+                throw rpc::RpcTransportError(rpc::RpcFailureKind::Aborted, "RPC aborted: disconnecting");
+            }
+        }
+        ~MaintenanceCallScope() { app_.maint_calls_.fetch_sub(1); }
+        MaintenanceCallScope(const MaintenanceCallScope&) = delete;
+        MaintenanceCallScope& operator=(const MaintenanceCallScope&) = delete;
+    private:
+        App& app_;
+    };
+    // Main thread, right before rpc_->disconnect(): abort rpc_'s in-flight call if it is a maintenance
+    // call, so the disconnect doesn't freeze the UI for up to its 120 s, and refuse maintenance calls that
+    // start before the next connect (onConnected() lifts that). Ordinary calls are left to finish (at most
+    // 30 s, as before), so a user's own send is never cut off mid-call.
+    void abortMaintenanceCalls();
+    // Whether a whole-wallet scan the user didn't ask for may be sent now: a connected, unlocked, synced
+    // full node that is past warmup, not rescanning and not busy.
+    bool walletScanReady() const;
 
     // Force refresh
     void refreshNow();
@@ -738,14 +776,18 @@ private:
     // t_addresses for `fromAddress` and clamp its balance at >=0. A positive `signedAmount`
     // restores a debit; a negative one applies it. When `includeAggregates` is set, adjust the
     // private/transparent bucket (chosen by the address's leading 'z') and totalBalance with the
-    // same clamp. Shared by the three pending-send delta sites so they can't drift.
+    // same clamp. Shared by the three pending-send delta sites so they can't drift. `includeAddress`
+    // off leaves the per-address balances alone (the Core poll refreshes only the aggregates).
     void applyPendingSendDelta(const std::string& fromAddress, double signedAmount,
-                               bool includeAggregates);
+                               bool includeAggregates, bool includeAddress = true);
     // Deliver a deferred z_sendmany result to its waiting UI callback once the opid
     // reaches a terminal status. Returns true if a callback was registered (and fired).
     bool invokeSendResultCallback(const std::string& opid, bool ok,
                                   const std::string& result);
-    void applyPendingSendBalanceDeltas(bool includeAggregateBalances);
+    // Re-apply every pending send's debit on top of freshly fetched balances: the aggregates after a
+    // Core poll that carried a balance, the per-address balances after an address scan. Only onto
+    // fresh values, or a debit applied again on every tick would drain them.
+    void applyPendingSendBalanceDeltas(bool includeAggregateBalances, bool includeAddressBalances = true);
     std::string transactionHistoryCacheWalletIdentity() const;
     bool ensureTransactionHistoryCacheUnlockedFor(const std::string& walletIdentity);
     // Record the active wallet's cached metadata (balance, address count, identity, size) into the
@@ -1302,6 +1344,16 @@ private:
     std::time_t sync_settle_until_ = 0;    // hold the sync-throttle until this wall-clock time (0 = not settling)
     double last_balance_scan_ms_ = 0.0;    // measured cost of the last z_gettotalbalance scan
     bool force_balance_refresh_ = false;   // a wallet mutation forces the next balance poll through the throttle
+    // Bumped with each forced-refresh request, so the poll that carried the forced balance clears the
+    // flag only if no newer request came in meanwhile (see requestForcedBalanceRefresh()).
+    std::uint32_t force_balance_seq_ = 0;
+    // The exact minconf=0 total of the last balance poll: the minconf=1 call is skipped while it holds
+    // still and nothing is pending (NetworkRefreshService::CoreRefreshPlan).
+    std::optional<std::int64_t> last_total_balance_zat_;
+    // Force the next balance poll through the throttle (the user's own send). Cleared by the Core poll
+    // that actually sent the forced balance call, not at dispatch, so a dispatch the job queue refuses
+    // (a Core job already in flight) or one that skips the balance (node behind or busy) keeps it.
+    void requestForcedBalanceRefresh() { force_balance_refresh_ = true; ++force_balance_seq_; }
     // Same adaptive back-off applied to the other two O(mapWallet) scans that hold the daemon's cs_main:
     // the address scan (z_listunspent) and the history scan (z_listreceivedbyaddress). Without this, a
     // large shielded wallet re-scans them every tab cadence (~seconds each), saturating cs_main and
@@ -1490,6 +1542,9 @@ private:
     std::unordered_set<std::string> witness_seen_txids_;
     int witness_total_txs_ = 0;
     bool opid_poll_in_progress_ = false;
+    std::atomic<bool> opid_filter_unsupported_{false};   // see opidFilterUnsupported(); set on the worker
+    std::atomic<int> maint_calls_{0};                    // maintenance calls in flight (MaintenanceCallScope)
+    std::atomic<bool> maint_abort_{false};               // set by abortMaintenanceCalls(), cleared on connect
     // Consecutive Core-refresh cycles where BOTH core RPCs failed → likely a dead
     // connection. After kCoreFailuresBeforeDisconnect, tear down and reconnect.
     int consecutive_core_failures_ = 0;

src/app_network.cpp

@@ -687,7 +687,9 @@ void App::tryConnect()
 
 void App::onConnected()
 {
+    maint_abort_.store(false);   // maintenance calls queued before this connect have already failed (FIFO)
     state_.connected = true;
+    ui::ShieldDialog::invalidateScope();   // inputs read before this connect may be another wallet's
     const bool completedSwitch = wallet_switch_pending_confirm_.exchange(false);  // this connect confirms a switch
     // A successful connect completes a switch — close/clear the progress modal (kept open through the
     // stop → start → reconnect sequence, or already hidden via "continue in background").
@@ -837,6 +839,9 @@ void App::onDisconnected(const std::string& reason)
     network_refresh_.resetJobs();
     rescan_status_poll_in_progress_ = false;
     opid_poll_in_progress_ = false;
+    opid_filter_unsupported_ = false;   // a reconnect may be to a different daemon
+    last_total_balance_zat_.reset();
+    ui::ShieldDialog::invalidateScope();
     address_validation_cache_dirty_ = true;
     resetTransactionHistoryCacheSession();
 
@@ -937,6 +942,7 @@ void App::handleLostConnection(const std::string& reason)
     DEBUG_LOGF("[Connection] %s — tearing down for reconnect\n", reason.c_str());
     // Flip the main client's connected_ flag so update()'s else-branch re-enters
     // tryConnect(). onDisconnected() alone only tears down the fast lane.
+    abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
     if (rpc_) rpc_->disconnect();
     onDisconnected(reason);
 }
@@ -989,6 +995,24 @@ bool App::effectivelySyncing() const
     return std::time(nullptr) < sync_settle_until_;
 }
 
+void App::abortMaintenanceCalls()
+{
+    // Both stick until the next connect, which is fine here: every caller disconnects next.
+    maint_abort_.store(true);   // refuses maintenance calls still queued on the worker
+    if (rpc_ && maint_calls_.load() > 0) rpc_->requestAbort();   // cuts off the one in flight
+}
+
+bool App::walletScanReady() const
+{
+    if (isLiteBuild() || capture_mode_ || shutting_down_.load()) return false;
+    // state_.warming_up, not rpc_->isWarmingUp(): the client's flag is set when a connect lands in warmup
+    // and stays set until the next reconnect, which kept this false for the whole session.
+    if (!rpc_ || !rpc_->isConnected()) return false;
+    if (!state_.connected || state_.warming_up || state_.isLocked()) return false;
+    if (state_.sync.rescanning || runtime_rescan_active_ || effectivelySyncing()) return false;
+    return !rpc_busy_gate_->busy();
+}
+
 // Adaptive throttle: the next balance poll must wait at least (lastScanCost / kBalanceDutyCycle) since
 // the last one, so balance scanning can never occupy more than ~kBalanceDutyCycle of wall-clock. A
 // cheap wallet (sub-cadence cost) is unaffected — the tab's Core timer stays the real cadence; a ~20s
@@ -1194,7 +1218,7 @@ void App::removePendingSendTransactions(const std::vector<std::string>& opids,
 }
 
 void App::applyPendingSendDelta(const std::string& fromAddress, double signedAmount,
-                                bool includeAggregates)
+                                bool includeAggregates, bool includeAddress)
 {
     // For a debit (signedAmount < 0) this clamps at >=0 exactly as the debit sites did. For a
     // restore (signedAmount > 0) the clamp is a no-op — max(0, bal+amt) == bal+amt when bal,amt>=0 —
@@ -1211,7 +1235,7 @@ void App::applyPendingSendDelta(const std::string& fromAddress, double signedAmo
         }
         return false;
     };
-    if (!applyToAddress(state_.z_addresses)) applyToAddress(state_.t_addresses);
+    if (includeAddress && !applyToAddress(state_.z_addresses)) applyToAddress(state_.t_addresses);
     if (includeAggregates) {
         if (!fromAddress.empty() && fromAddress[0] == 'z') {
             state_.spendablePrivateBalance = std::max(0.0, state_.spendablePrivateBalance + signedAmount);
@@ -1244,11 +1268,11 @@ bool App::invokeSendResultCallback(const std::string& opid, bool ok,
     return true;
 }
 
-void App::applyPendingSendBalanceDeltas(bool includeAggregateBalances)
+void App::applyPendingSendBalanceDeltas(bool includeAggregateBalances, bool includeAddressBalances)
 {
     for (const auto& [opid, pending] : pending_send_info_) {
         (void)opid;
-        applyPendingSendDelta(pending.from, -pending.amount, includeAggregateBalances);
+        applyPendingSendDelta(pending.from, -pending.amount, includeAggregateBalances, includeAddressBalances);
     }
 }
 
@@ -1458,6 +1482,7 @@ void App::switchToWallet(const std::string& walletFile, bool stopDaemonConfirmed
     // start, so the daemon comes up on -wallet=<name>. WalletState clears on disconnect and the
     // per-wallet caches re-key off the new identity (P1), so no previous-wallet data leaks through.
     daemon_restarting_ = true;
+    abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
     if (rpc_ && rpc_->isConnected()) rpc_->disconnect();
     onDisconnected("Switching wallet");
     // The loaded wallet is changing — drop the old wallet's chat identity + decrypted store so it
@@ -1885,15 +1910,31 @@ void App::refreshCoreData(bool allowBalance)
     // pending for after the unlock.
     const bool includeBalance = allowBalance && !effectivelySyncing() &&
                                 (force_balance_refresh_ || balanceRefreshDue());
-    if (includeBalance) force_balance_refresh_ = false;
+    // The forced request this poll carries. The result callback clears the flag only if the balance
+    // call was really sent and no newer request came in; clearing it here lost it whenever the enqueue
+    // was refused (a Core job already in flight) or the worker skipped the balance (behind, busy).
+    const std::uint32_t forcedSeq = (includeBalance && force_balance_refresh_) ? force_balance_seq_ : 0;
+    NetworkRefreshService::CoreRefreshPlan plan;
+    plan.includeBalance = includeBalance;
+    plan.needSpendable = NetworkRefreshService::spendableBalanceNeeded(
+        state_, !pending_send_info_.empty() || !pending_opids_.empty() || !send_txids_.empty(),
+        force_balance_refresh_);
+    plan.prevTotalZat = last_total_balance_zat_;
 
-    auto enqueued = network_refresh_.enqueue(services::NetworkRefreshService::Job::Core, *w, [this, rpc, tracePage, includeBalance]() -> rpc::RPCWorker::MainCb {
+    auto enqueued = network_refresh_.enqueue(services::NetworkRefreshService::Job::Core, *w, [this, rpc, tracePage, plan, forcedSeq]() -> rpc::RPCWorker::MainCb {
         AppRefreshRpcGateway refreshRpc(*rpc, traceSource(tracePage, "Core refresh"));
-        auto result = NetworkRefreshService::collectCoreRefreshResult(refreshRpc, includeBalance);
-        return [this, result]() {
+        auto result = NetworkRefreshService::collectCoreRefreshResult(refreshRpc, plan);
+        return [this, result, forcedSeq]() {
             try {
                 NetworkRefreshService::applyCoreRefreshResult(state_, result, std::time(nullptr));
-                applyPendingSendBalanceDeltas(true);
+                if (result.balanceOk) {
+                    // Fresh aggregates: re-apply the pending sends' debits to them. The per-address
+                    // balances are the address scan's to refresh and re-debit.
+                    applyPendingSendBalanceDeltas(true, false);
+                }
+                last_total_balance_zat_ = NetworkRefreshService::nextTotalBaseline(result, last_total_balance_zat_);
+                if (forcedSeq != 0 && result.balanceAttempted && forcedSeq == force_balance_seq_)
+                    force_balance_refresh_ = false;
 
                 // Feed the adaptive balance throttle + sync-settle hysteresis. Record the last scan's
                 // cost (0 when balance was skipped), and arm the settle window only on the
@@ -5182,6 +5223,7 @@ void App::beginAdoptSeedWallet()
     { std::lock_guard<std::mutex> lk(seed_migration_mutex_); seed_migration_adopt_done_ = false; }
     // Gate the main-loop reconnect so tryConnect can't start the daemon while we swap wallet.dat.
     daemon_restarting_ = true;
+    abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
     if (rpc_ && rpc_->isConnected()) rpc_->disconnect();
     onDisconnected("Adopting seed wallet");
     // Adopting swaps in a brand-new seed wallet — drop the legacy wallet's chat identity + store so
@@ -5302,6 +5344,7 @@ void App::restoreOriginalWallet()
     { std::lock_guard<std::mutex> lk(wallet_restore_mutex_); wallet_restore_done_ = false; }
     daemon_restarting_ = true;                 // gate the reconnect loop while we swap files
     connection_status_ = TR("sb_restarting_daemon");
+    abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
     if (rpc_ && rpc_->isConnected()) rpc_->disconnect();
     onDisconnected("Restoring original wallet");
     ui::Notifications::instance().info(TR("wallet_restore_started"), 12.0f);
@@ -5472,6 +5515,7 @@ void App::rebuildWalletDatabase()
     { std::lock_guard<std::mutex> lk(wallet_restore_mutex_); wallet_restore_done_ = false; }
     daemon_restarting_ = true;
     connection_status_ = TR("sb_restarting_daemon");
+    abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
     if (rpc_ && rpc_->isConnected()) rpc_->disconnect();
     onDisconnected("Rebuilding wallet database");
     ui::Notifications::instance().info(TR("wallet_rebuild_started"), 15.0f);
@@ -5813,7 +5857,7 @@ void App::submitZSendMany(const std::string& from, const std::string& to, double
                 // Force transaction list refresh so the sent tx appears immediately
                 transactions_dirty_ = true;
                 last_tx_block_height_ = -1;
-                force_balance_refresh_ = true;  // the user's own send must update the balance now, past the throttle
+                requestForcedBalanceRefresh();  // the user's own send must update the balance now, past the throttle
                 network_refresh_.markWalletMutationRefresh();
                 // z_sendmany only returned an opid: the transaction is built/signed/
                 // broadcast asynchronously by the daemon. Defer the user-facing

src/app_wizard.cpp

@@ -87,6 +87,7 @@ void App::restartWizard()
 
     // Disconnect RPC
     if (rpc_ && rpc_->isConnected()) {
+        abortMaintenanceCalls();   // a long call holds the curl lock disconnect() needs
         rpc_->disconnect();
     }
     onDisconnected("Wizard restart");

src/rpc/rpc_client.cpp

@@ -832,24 +832,6 @@ void RPCClient::z_mergeToAddress(const std::vector<std::string>& fromAddrs, cons
     doRPC("z_mergetoaddress", {addrs, toAddr, fee, 0, limit}, cb, err);
 }
 
-void RPCClient::z_getOperationStatus(const std::vector<std::string>& opids, Callback cb, ErrorCallback err)
-{
-    json ids = json::array();
-    for (const auto& id : opids) {
-        ids.push_back(id);
-    }
-    doRPC("z_getoperationstatus", {ids}, cb, err);
-}
-
-void RPCClient::z_getOperationResult(const std::vector<std::string>& opids, Callback cb, ErrorCallback err)
-{
-    json ids = json::array();
-    for (const auto& id : opids) {
-        ids.push_back(id);
-    }
-    doRPC("z_getoperationresult", {ids}, cb, err);
-}
-
 void RPCClient::z_listReceivedByAddress(const std::string& address, int minconf, Callback cb, ErrorCallback err)
 {
     doRPC("z_listreceivedbyaddress", {address, minconf}, cb, err);
@@ -902,16 +884,6 @@ void RPCClient::z_mergeToAddress(const std::vector<std::string>& fromAddrs, cons
     doRPC("z_mergetoaddress", {addrs, toAddr, fee, 0, limit}, handlers.first, handlers.second);
 }
 
-void RPCClient::z_getOperationStatus(const std::vector<std::string>& opids, UnifiedCallback cb)
-{
-    json ids = json::array();
-    for (const auto& id : opids) {
-        ids.push_back(id);
-    }
-    auto handlers = splitUnified(std::move(cb));
-    doRPC("z_getoperationstatus", {ids}, handlers.first, handlers.second);
-}
-
 void RPCClient::getBlock(int height, UnifiedCallback cb)
 {
     // First get block hash, then get block

src/rpc/rpc_client.h

@@ -257,10 +257,6 @@ public:
     void z_mergeToAddress(const std::vector<std::string>& fromAddrs, const std::string& toAddr,
                           double fee, int limit, Callback cb, ErrorCallback err = nullptr);
     
-    // Operation status monitoring
-    void z_getOperationStatus(const std::vector<std::string>& opids, Callback cb, ErrorCallback err = nullptr);
-    void z_getOperationResult(const std::vector<std::string>& opids, Callback cb, ErrorCallback err = nullptr);
-    
     // Received transactions
     void z_listReceivedByAddress(const std::string& address, int minconf, Callback cb, ErrorCallback err = nullptr);
 
@@ -272,7 +268,6 @@ public:
                           double fee, int limit, UnifiedCallback cb);
     void z_mergeToAddress(const std::vector<std::string>& fromAddrs, const std::string& toAddr,
                           double fee, int limit, UnifiedCallback cb);
-    void z_getOperationStatus(const std::vector<std::string>& opids, UnifiedCallback cb);
     void getBlock(int height, UnifiedCallback cb);
 
 private:

src/services/network_refresh_service.cpp

@@ -7,6 +7,7 @@
 #include <chrono>
 #include <cmath>
 #include <cstdlib>
+#include <limits>
 #include <map>
 #include <set>
 #include <unordered_map>
@@ -271,6 +272,9 @@ NetworkRefreshService::CoreRefreshResult NetworkRefreshService::parseCoreRefresh
         result.shieldedBalance = readBalanceString(totalBalance, "private");
         result.transparentBalance = readBalanceString(totalBalance, "transparent");
         result.totalBalance = readBalanceString(totalBalance, "total");
+        const auto total = totalBalance.find("total");
+        if (total != totalBalance.end() && total->is_string())
+            result.totalBalanceZat = parseMoneyZat(total->get<std::string>());
     }
     if (spendableBalance.is_object()) {   // confirmed totals (minconf=1); left unset on old daemons
         result.spendableShieldedBalance = readBalanceString(spendableBalance, "private");
@@ -290,7 +294,8 @@ NetworkRefreshService::CoreRefreshResult NetworkRefreshService::parseCoreRefresh
     return result;
 }
 
-NetworkRefreshService::CoreRefreshResult NetworkRefreshService::collectCoreRefreshResult(RefreshRpcGateway& rpc, bool includeBalance)
+NetworkRefreshService::CoreRefreshResult NetworkRefreshService::collectCoreRefreshResult(RefreshRpcGateway& rpc,
+                                                                                         const CoreRefreshPlan& plan)
 {
     json totalBalance;
     json spendableBalance;
@@ -328,7 +333,9 @@ NetworkRefreshService::CoreRefreshResult NetworkRefreshService::collectCoreRefre
 
     // Don't follow a chain-info call that found the node busy (a reply timeout or a full queue) with two
     // balance scans: they need the same cs_main, and each would only take another of its few RPC slots.
-    if (includeBalance && !behind && !rpc::rpcKindMeansBusy(blockErrKind)) {
+    bool balanceAttempted = false;
+    bool spendableQueried = false;
+    if (plan.includeBalance && !behind && !rpc::rpcKindMeansBusy(blockErrKind)) {
         // z_gettotalbalance is O(mapWallet) and holds the daemon's cs_main for its whole duration —
         // seconds on a large shielded wallet. Time it so the caller can throttle how often it polls
         // (balanceRefreshDue()), keeping balance scans from starving block connection.
@@ -340,9 +347,25 @@ NetworkRefreshService::CoreRefreshResult NetworkRefreshService::collectCoreRefre
             balanceErrKind = rpc::rpcFailureKindOf(e);
             DEBUG_LOGF("Balance error: %s\n", e.what());
         }
-        try {   // SPENDABLE total: minconf=1 (confirmed). If absent, spendable degrades to display in apply.
-            spendableBalance = rpc.call("z_gettotalbalance", json::array({1}));
-        } catch (...) {}
+        // A Deferred call was held back by the busy gate and never reached the daemon.
+        balanceAttempted = balanceErrKind != rpc::RpcFailureKind::Deferred;
+        // SPENDABLE total: minconf=1 (confirmed), a second whole-wallet scan. Only after the display call
+        // succeeded (its result is dropped otherwise), and only when it can differ from the display total:
+        // something is unconfirmed or pending (needSpendable), or the exact total moved since the last
+        // poll, which is how a new incoming 0-conf payment first shows. Skipped, spendable equals display
+        // in applyCoreRefreshResult and nothing reads as unconfirmed.
+        if (balanceOk) {
+            std::optional<std::int64_t> totalZat;
+            const auto total = totalBalance.is_object() ? totalBalance.find("total") : totalBalance.end();
+            if (total != totalBalance.end() && total->is_string()) totalZat = parseMoneyZat(total->get<std::string>());
+            const bool totalMoved = !totalZat || !plan.prevTotalZat || *totalZat != *plan.prevTotalZat;
+            if (plan.needSpendable || totalMoved) {
+                spendableQueried = true;
+                try {   // If it fails, spendable degrades to display in apply.
+                    spendableBalance = rpc.call("z_gettotalbalance", json::array({1}));
+                } catch (...) {}
+            }
+        }
         balanceScanMs = std::chrono::duration<double, std::milli>(
             std::chrono::steady_clock::now() - balanceStart).count();
     }
@@ -351,9 +374,65 @@ NetworkRefreshService::CoreRefreshResult NetworkRefreshService::collectCoreRefre
     result.balanceScanMs = balanceScanMs;
     result.blockchainErrKind = blockErrKind;
     result.balanceErrKind = balanceErrKind;
+    result.balanceAttempted = balanceAttempted;
+    result.spendableQueried = spendableQueried;
     return result;
 }
 
+std::optional<std::int64_t> NetworkRefreshService::parseMoneyZat(const std::string& text)
+{
+    constexpr std::int64_t kCoin = 100000000;
+    // Leaves room for up to 99999999 zatoshis of fraction on top of whole * 1e8.
+    constexpr std::int64_t kMaxWhole = std::numeric_limits<std::int64_t>::max() / kCoin - 1;
+    std::size_t i = 0;
+    const bool negative = !text.empty() && text[0] == '-';
+    if (negative) ++i;
+    std::int64_t whole = 0;
+    std::size_t wholeDigits = 0;
+    for (; i < text.size() && text[i] >= '0' && text[i] <= '9'; ++i, ++wholeDigits) {
+        const int digit = text[i] - '0';
+        if (whole > (kMaxWhole - digit) / 10) return std::nullopt;   // the amount would overflow
+        whole = whole * 10 + digit;
+    }
+    if (wholeDigits == 0) return std::nullopt;
+    std::int64_t fraction = 0;
+    if (i < text.size() && text[i] == '.') {
+        ++i;
+        std::size_t fractionDigits = 0;
+        for (; i < text.size() && text[i] >= '0' && text[i] <= '9'; ++i, ++fractionDigits) {
+            if (fractionDigits == 8) return std::nullopt;   // finer than a zatoshi: not a daemon amount
+            fraction = fraction * 10 + (text[i] - '0');
+        }
+        if (fractionDigits == 0) return std::nullopt;
+        for (; fractionDigits < 8; ++fractionDigits) fraction *= 10;
+    }
+    if (i != text.size()) return std::nullopt;
+    const std::int64_t zat = whole * kCoin + fraction;
+    return negative ? -zat : zat;
+}
+
+std::optional<std::int64_t> NetworkRefreshService::nextTotalBaseline(const CoreRefreshResult& result,
+                                                                    std::optional<std::int64_t> previous)
+{
+    if (!result.balanceOk) return previous;                                       // no fresh total
+    if (result.spendableQueried && !result.spendableTotalBalance) return std::nullopt;   // re-measure next poll
+    return result.totalBalanceZat;
+}
+
+bool NetworkRefreshService::spendableBalanceNeeded(const WalletState& state, bool pendingSendWork, bool forced)
+{
+    if (forced || pendingSendWork) return true;
+    if (state.last_balance_update == 0) return true;
+    if (state.unconfirmedBalance > 1e-9) return true;
+    // The address scan saw unconfirmed funds (z_listunspent/listunspent at minconf=0 with confirmations).
+    auto anyUnconfirmed = [](const std::vector<AddressInfo>& addresses) {
+        return std::any_of(addresses.begin(), addresses.end(), [](const AddressInfo& address) {
+            return address.balance - address.spendableBalance > 1e-9;
+        });
+    };
+    return anyUnconfirmed(state.z_addresses) || anyUnconfirmed(state.t_addresses);
+}
+
 NetworkRefreshService::MiningRefreshResult NetworkRefreshService::parseMiningRefreshResult(
     const json& miningInfo, bool miningOk, const json& localHashrate, bool hashrateOk, double daemonMemoryMb)
 {
@@ -1327,9 +1406,10 @@ NetworkRefreshService::OperationStatusPollResult NetworkRefreshService::parseOpe
     OperationStatusPollResult parsed;
     if (!result.is_array()) return parsed;
 
-    // We poll z_getoperationstatus with no filter (this daemon rejects the per-opid filtered form),
-    // so the result lists ALL operations. Only act on the ones we're tracking — otherwise an
-    // unrelated failed/old operation would fire a spurious error toast or pollute send state.
+    // The poll is filtered to our opids (buildOperationFilterParams), but falls back to the unfiltered
+    // form, which lists ALL operations, if a daemon rejects the filter. Only act on the ones we're
+    // tracking — otherwise an unrelated failed/old operation would fire a spurious error toast or
+    // pollute send state.
     const std::set<std::string> requested(requestedOpids.begin(), requestedOpids.end());
 
     std::set<std::string> reported;
@@ -1379,6 +1459,18 @@ NetworkRefreshService::OperationStatusPollResult NetworkRefreshService::parseOpe
     return parsed;
 }
 
+std::optional<json> NetworkRefreshService::buildOperationFilterParams(const std::vector<std::string>& opids)
+{
+    json ids = json::array();
+    for (const auto& opid : opids) {
+        if (!opid.empty()) ids.push_back(opid);
+    }
+    if (ids.empty()) return std::nullopt;
+    json params = json::array();
+    params.push_back(std::move(ids));
+    return params;
+}
+
 void NetworkRefreshService::applyConnectionInfoResult(WalletState& state, const ConnectionInfoResult& result)
 {
     if (!result.ok) return;

src/services/network_refresh_service.h

@@ -120,6 +120,20 @@ public:
         // node (ReplyTimeout / QueueFull) from a gone one (NotListening) without reading what().
         rpc::RpcFailureKind blockchainErrKind = rpc::RpcFailureKind::None;
         rpc::RpcFailureKind balanceErrKind = rpc::RpcFailureKind::None;
+        // The minconf=0 call reached the daemon (it may still have failed). False when the balance was
+        // skipped (behind, busy chain read) or held back by the busy gate (Deferred) before it was sent.
+        bool balanceAttempted = false;
+        bool spendableQueried = false;                 // the minconf=1 call was made
+        std::optional<std::int64_t> totalBalanceZat;   // the minconf=0 "total" in zatoshis, exact
+    };
+
+    // What one Core refresh fetches. The minconf=1 (spendable) z_gettotalbalance is a second whole-wallet
+    // scan under cs_main; it only tells something the minconf=0 call doesn't while funds are unconfirmed
+    // or pending, so it runs only when needSpendable or the exact total moved since prevTotalZat.
+    struct CoreRefreshPlan {
+        bool includeBalance = true;
+        bool needSpendable = true;
+        std::optional<std::int64_t> prevTotalZat;
     };
 
     struct MiningRefreshResult {
@@ -271,7 +285,24 @@ public:
     // includeBalance=false skips z_gettotalbalance (which takes the wallet lock + cs_main) and only
     // fetches getblockchaininfo — used while syncing, where the balance is incomplete anyway and the
     // wallet should minimise lock contention with block connection.
-    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, bool includeBalance = true);
+    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, const CoreRefreshPlan& plan);
+    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, bool includeBalance = true)
+    {
+        CoreRefreshPlan plan;
+        plan.includeBalance = includeBalance;
+        return collectCoreRefreshResult(rpc, plan);
+    }
+    // An amount as the daemon formats it ("[-]digits[.up to 8 digits]") in zatoshis; nullopt for anything
+    // else or anything that would overflow. Exact, so "did the total move" never trips on rounding.
+    static std::optional<std::int64_t> parseMoneyZat(const std::string& text);
+    // Whether the next balance poll needs the minconf=1 (spendable) call whatever the total does: never
+    // fetched, unconfirmed or pending funds, or a forced refresh after the user's own send.
+    static bool spendableBalanceNeeded(const WalletState& state, bool pendingSendWork, bool forced);
+    // The total the next poll compares against (CoreRefreshPlan::prevTotalZat). None after a poll whose
+    // minconf=1 call was made but brought back no total (timeout, held back, error): that left spendable
+    // degraded to display, so the next poll must count the total as moved and measure it again.
+    static std::optional<std::int64_t> nextTotalBaseline(const CoreRefreshResult& result,
+                                                         std::optional<std::int64_t> previous);
     static MiningRefreshResult parseMiningRefreshResult(const nlohmann::json& miningInfo,
                                                         bool miningOk,
                                                         const nlohmann::json& localHashrate,
@@ -340,6 +371,11 @@ public:
         int pageSize = 100);
     static OperationStatusPollResult parseOperationStatusPoll(const nlohmann::json& result,
                                                               const std::vector<std::string>& requestedOpids);
+    // Params for z_getoperationstatus/result filtered to these opids: ONE argument, an array of ids, so
+    // [[id, ...]]. nullopt when no non-empty id remains: an empty filter means every op the node has
+    // retained. Built explicitly, because a one-element braced list of a json ({ids}) collapses to the
+    // inner array, which the daemon rejects ("JSON value is not an array as expected").
+    static std::optional<nlohmann::json> buildOperationFilterParams(const std::vector<std::string>& opids);
 
     struct DaemonRescanScan {
         bool  foundRescan = false;

src/services/note_consolidation.cpp

@@ -5,6 +5,7 @@
 #include "note_consolidation.h"
 
 #include <algorithm>
+#include <cctype>
 #include <map>
 
 namespace dragonx {
@@ -20,6 +21,7 @@ std::vector<NoteGroup> groupSpendableNotes(const nlohmann::json& zListUnspent)
             if (address.empty()) continue;
             if (n.value("confirmations", 0) < 1) continue;   // z_mergetoaddress spends confirmed notes only
             if (!n.value("spendable", true)) continue;       // watch-only: no key to spend it
+            if (noteIsLocked(n)) continue;                   // held by an operation in flight
             NoteGroup& g = byAddress[address];
             g.address = address;
             ++g.notes;
@@ -36,6 +38,13 @@ std::vector<NoteGroup> groupSpendableNotes(const nlohmann::json& zListUnspent)
     return out;
 }
 
+bool noteIsLocked(const nlohmann::json& zListUnspentEntry)
+{
+    if (!zListUnspentEntry.is_object()) return false;
+    const auto it = zListUnspentEntry.find("locked");
+    return it != zListUnspentEntry.end() && it->is_boolean() && it->get<bool>();
+}
+
 bool worthConsolidating(const NoteGroup& group, double fee)
 {
     // The daemon rejects a merge whose fee is more than what it nets (merged value < 2 x fee).
@@ -67,5 +76,107 @@ AddressRun consolidateInPlace(const std::string& address, const MergeCall& call,
     return run;
 }
 
+ScopeWant scopeScanWant(const ScopeScan& scan, const ScopeInputs& in)
+{
+    if (!in.mergeMode || scan.phase == ScopePhase::Loaded) return ScopeWant::Nothing;
+    if (scan.inFlight || in.busyWithOp) return ScopeWant::Nothing;
+    if (scan.phase == ScopePhase::Failed && !scan.autoRetry) return ScopeWant::Nothing;   // waits for Retry
+    if (in.now < scan.retryAt) return ScopeWant::WaitBackoff;
+    if (!in.nodeReady) return ScopeWant::WaitNode;
+    return ScopeWant::Post;
+}
+
+std::uint32_t scopeScanBegin(ScopeScan& scan, double now)
+{
+    scan.phase = ScopePhase::Loading;
+    scan.inFlight = true;
+    scan.inFlightGen = scan.gen;
+    scan.startedAt = now;
+    return scan.gen;
+}
+
+bool scopeScanFinish(ScopeScan& scan, std::uint32_t gen, const std::string& error, rpc::RpcFailureKind kind,
+                     double now)
+{
+    if (scan.inFlight && gen == scan.inFlightGen) scan.inFlight = false;
+    if (gen != scan.gen) return false;   // a scan from an earlier session: its data is not this one's
+    if (error.empty()) {
+        scan.phase = ScopePhase::Loaded;
+        scan.failures = 0;
+        scan.autoRetry = false;
+        scan.retryAt = 0.0;
+        scan.error.clear();
+        return true;
+    }
+    scan.phase = ScopePhase::Failed;
+    ++scan.failures;
+    scan.error = error;
+    scan.autoRetry = scopeFailureRetries(kind, error) && scan.failures <= kScopeMaxAutoRetries;
+    scan.retryAt = scan.autoRetry ? now + scopeRetryDelaySec(scan.failures) : 0.0;
+    return false;
+}
+
+void scopeScanOpen(ScopeScan& scan, double now)
+{
+    if (scan.inFlight && now - scan.startedAt > kScopeInFlightMaxSec) scan.inFlight = false;   // lost
+    if (scan.inFlight && scan.phase == ScopePhase::Loading) return;   // still loading for the last session
+    ++scan.gen;
+    scan.phase = ScopePhase::Idle;
+    scan.failures = 0;
+    scan.autoRetry = false;
+    scan.retryAt = 0.0;
+    scan.error.clear();
+}
+
+void scopeScanInvalidate(ScopeScan& scan)
+{
+    ++scan.gen;
+    scan.phase = ScopePhase::Idle;
+    scan.failures = 0;
+    scan.autoRetry = false;
+    scan.retryAt = 0.0;
+    scan.error.clear();
+}
+
+void scopeScanRetry(ScopeScan& scan)
+{
+    if (scan.phase != ScopePhase::Failed) return;
+    scan.phase = ScopePhase::Idle;
+    scan.failures = 0;
+    scan.autoRetry = false;
+    scan.retryAt = 0.0;
+    scan.error.clear();
+}
+
+double scopeRetryDelaySec(int failures)
+{
+    if (failures <= 1) return 10.0;
+    if (failures == 2) return 30.0;
+    return 60.0;
+}
+
+bool scopeFailureRetries(rpc::RpcFailureKind kind, const std::string& message)
+{
+    using K = rpc::RpcFailureKind;
+    switch (kind) {
+    case K::NotListening:
+    case K::ConnectTimeout:
+    case K::Warmup:
+    case K::Deferred:
+    case K::ShuttingDown:
+    case K::Unhandled:
+    case K::Aborted:
+        return true;
+    case K::Other: {
+        std::string lower = message;
+        std::transform(lower.begin(), lower.end(), lower.begin(),
+                       [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+        return lower.find("not connected") != std::string::npos;
+    }
+    default:
+        return false;   // ReplyTimeout, QueueFull, AppError, Auth, parse/type errors
+    }
+}
+
 }  // namespace services
 }  // namespace dragonx

src/services/note_consolidation.h

@@ -10,8 +10,12 @@
 // Shielded only: a transparent address can't receive a non-coinbase output on DragonX (private chain).
 // Pure apart from the merge call it is handed, so the test target can drive it.
 
+#include "rpc/rpc_failure.h"
+
 #include <nlohmann/json.hpp>
 
+#include <chrono>
+#include <cstdint>
 #include <functional>
 #include <string>
 #include <vector>
@@ -26,10 +30,14 @@ struct NoteGroup {
     double amount = 0.0;
 };
 
-// Spendable shielded notes grouped by address, most notes first. Transparent UTXOs and unconfirmed or
-// watch-only notes are left out (z_mergetoaddress only spends confirmed notes it has keys for).
+// Spendable shielded notes grouped by address, most notes first. Transparent UTXOs and unconfirmed,
+// watch-only or locked notes are left out (z_mergetoaddress only spends confirmed, unlocked notes it has
+// keys for).
 std::vector<NoteGroup> groupSpendableNotes(const nlohmann::json& zListUnspent);
 
+// A z_listunspent entry the wallet has locked, e.g. for an operation in flight ("locked": true).
+bool noteIsLocked(const nlohmann::json& zListUnspentEntry);
+
 // Worth consolidating in place: at least two notes, and more than one batch's fee to work with.
 bool worthConsolidating(const NoteGroup& group, double fee);
 
@@ -59,5 +67,59 @@ struct AddressRun {
 // locks a batch's notes before the call returns, so each call takes the next batch. At most maxBatches.
 AddressRun consolidateInPlace(const std::string& address, const MergeCall& call, int maxBatches = 20);
 
+// ── Scope scan (the Merge/Consolidate dialog's listunspent + z_listunspent) ─────────────────────────
+// Both calls are whole-wallet scans under the daemon's cs_main. The dialog used to post the pair again on
+// the frame after any failure, every frame for as long as it stayed open (and forever on Lite, which has
+// no node). This decides when a scan may be posted; the dialog owns one ScopeScan.
+
+inline double steadySeconds()   // ImGui::GetTime() stands still while the window is minimized
+{
+    return std::chrono::duration<double>(std::chrono::steady_clock::now().time_since_epoch()).count();
+}
+
+inline constexpr long   kScopeCallTimeoutSec = 120;   // each call; a large wallet can take minutes
+inline constexpr double kScopeInFlightMaxSec = 1800;  // a scan outstanding this long is presumed lost
+inline constexpr int    kScopeMaxAutoRetries = 3;
+
+enum class ScopePhase { Idle, Loading, Loaded, Failed };
+
+struct ScopeScan {
+    ScopePhase phase = ScopePhase::Idle;
+    std::uint32_t gen = 0;          // bumped per dialog session; a result from another session is dropped
+    bool inFlight = false;          // a scan is posted and its result not yet in (survives close/reopen)
+    std::uint32_t inFlightGen = 0;  // the session that posted it: only its result clears inFlight
+    double startedAt = 0.0;
+    int failures = 0;
+    bool autoRetry = false;         // the last failure was "node not ready yet": retry by itself
+    double retryAt = 0.0;
+    std::string error;
+};
+
+struct ScopeInputs {
+    bool mergeMode = false;
+    bool busyWithOp = false;   // a merge was submitted or is in flight
+    bool nodeReady = false;    // App::walletScanReady()
+    double now = 0.0;
+};
+
+enum class ScopeWant { Nothing, Post, WaitNode, WaitBackoff };
+
+ScopeWant scopeScanWant(const ScopeScan& scan, const ScopeInputs& in);
+// Mark a scan posted: Loading, in flight for this session. Returns the generation to finish it with.
+std::uint32_t scopeScanBegin(ScopeScan& scan, double now);
+// Record a scan's result. True when it belongs to the current session and succeeded: apply its data.
+bool scopeScanFinish(ScopeScan& scan, std::uint32_t gen, const std::string& error, rpc::RpcFailureKind kind,
+                     double now);
+// The dialog opened: start a new session, unless a scan of the last one is still loading (adopt it).
+void scopeScanOpen(ScopeScan& scan, double now);
+// The data went stale (reconnect): the next want is a fresh scan. An in-flight scan stays guarded.
+void scopeScanInvalidate(ScopeScan& scan);
+// The user pressed Retry after a failure.
+void scopeScanRetry(ScopeScan& scan);
+double scopeRetryDelaySec(int failures);   // 10, 30, then 60 s
+// Retry by itself only when the node wasn't ready (refused, warming up, held back as busy, aborted):
+// not after a reply timeout or a real error, each of which would cost another pair of full scans.
+bool scopeFailureRetries(rpc::RpcFailureKind kind, const std::string& message);
+
 }  // namespace services
 }  // namespace dragonx

src/ui/pages/settings_page.cpp

@@ -1293,12 +1293,15 @@ void RenderSettingsPage(App* app) {
             if (BTN("##wreq", TR("settings_request_payment"), ICON_MD_QR_CODE))
                 RequestPaymentDialog::show();
             if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_request_payment"));
-            if (BTN("##wshield", TR("settings_shield_mining"), ICON_MD_SHIELD))
-                ShieldDialog::show(ShieldDialog::Mode::ShieldCoinbase);
-            if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_shield_mining"));
-            if (BTN("##wmerge", TR("settings_merge_to_address"), ICON_MD_CALL_MERGE))
-                ShieldDialog::showMerge();
-            if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_merge"));
+            // z_shieldcoinbase / z_mergetoaddress are full-node RPCs: Lite has no node to send them to.
+            if (app->supportsFullNodeLifecycleActions()) {
+                if (BTN("##wshield", TR("settings_shield_mining"), ICON_MD_SHIELD))
+                    ShieldDialog::show(ShieldDialog::Mode::ShieldCoinbase);
+                if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_shield_mining"));
+                if (BTN("##wmerge", TR("settings_merge_to_address"), ICON_MD_CALL_MERGE))
+                    ShieldDialog::showMerge();
+                if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_merge"));
+            }
             if (BTN("##wclear", TR("settings_clear_ztx"), ICON_MD_DELETE_SWEEP))
                 s_settingsState.confirm_clear_ztx = true;
             if (ImGui::IsItemHovered()) material::Tooltip("%s", TR("tt_clear_ztx"));

src/ui/windows/shield_dialog.cpp

@@ -16,7 +16,9 @@
 #include "imgui.h"
 
 #include <algorithm>
+#include <cstdint>
 #include <set>
+#include <stdexcept>
 #include <vector>
 #include <string>
 #include <cstdio>
@@ -41,9 +43,8 @@ static bool   s_op_terminal = false;              // async op reached success/fa
 static std::string s_operation_id;
 static std::string s_status_message;
 static double s_last_poll = 0.0;                  // live-progress self-poll timer (ImGui::GetTime seconds)
-// Scope of what can be consolidated (fetched once on open, merge mode only).
-static bool   s_scope_loading = false;
-static bool   s_scope_loaded = false;
+// Scope of what can be consolidated (merge mode only). services::ScopeScan decides when to scan.
+static services::ScopeScan s_scan;
 static int    s_t_count = 0, s_z_count = 0;
 static double s_t_amount = 0.0, s_z_amount = 0.0;
 static bool   s_creating_addr = false;            // z_getnewaddress in flight (empty state)
@@ -52,16 +53,22 @@ static bool   s_creating_addr = false;            // z_getnewaddress in flight (
 static bool   s_per_address = false;
 static std::vector<services::NoteGroup> s_groups;   // spendable shielded notes by address (scope load)
 static std::set<std::string> s_selected;            // addresses ticked for per-address consolidation
+static std::set<std::string> s_unticked;            // unticked by the user this opening: kept across a re-scan
 struct PerAddressRun {
     services::AddressRun run;
-    std::vector<int> state;     // per opid: 0 = running, 1 = done, 2 = failed
+    std::vector<int> state;     // per opid: 0 = running, 1 = done, 2 = failed, 3 = gone from the daemon (unknown)
     std::string failure;        // first failed op's message
 };
 static std::vector<PerAddressRun> s_runs;           // after submit
 static bool   s_runs_submitting = false;
+// The op-status polls: one in flight at a time, cleared only by its reply, even across a close and
+// reopen; a reply for an earlier opening (another session) changes nothing else.
+static bool     s_poll_in_flight = false;
+static unsigned s_poll_session = 0;
 
 static void resetTransient()
 {
+    ++s_poll_session;
     s_operation_pending = false;
     s_op_terminal = false;
     s_confirm = false;
@@ -73,33 +80,47 @@ static void resetTransient()
 }
 
 // Count + sum spendable transparent UTXOs and shielded notes so the user can see the scope of a
-// consolidation (and how many batches it may take). Read-only; runs off the UI thread.
+// consolidation (and how many batches it may take). Read-only; runs off the UI thread. Only when
+// services::scopeScanWant() says so: both calls are whole-wallet scans under the daemon's cs_main.
 static void loadScope(App* app)
 {
     if (!app || !app->worker()) return;
-    s_scope_loading = true; s_scope_loaded = false;
-    app->worker()->post([app, rpc = app->rpc()]() -> rpc::RPCWorker::MainCb {
+    const std::uint32_t gen = services::scopeScanBegin(s_scan, services::steadySeconds());
+    app->worker()->post([app, rpc = app->rpc(), gen]() -> rpc::RPCWorker::MainCb {
         int tC = 0, zC = 0; double tA = 0.0, zA = 0.0; std::string error;
+        rpc::RpcFailureKind kind = rpc::RpcFailureKind::None;
         std::vector<services::NoteGroup> groups;
         try {
+            if (!rpc) throw std::runtime_error("Not connected");
+            // On a large wallet each scan can outlast the default 30 s; give them 120 s, counted as
+            // maintenance calls so a disconnect aborts them rather than waiting.
+            App::MaintenanceCallScope maint(*app);
             rpc::RPCClient::TraceScope trace("Shield dialog / Scope count");
-            nlohmann::json us = rpc->call("listunspent", nlohmann::json::array({0}));
+            nlohmann::json us = rpc->call("listunspent", nlohmann::json::array({0}), services::kScopeCallTimeoutSec);
             if (us.is_array()) for (const auto& u : us) {
                 if (u.value("confirmations", 0) >= 1 && u.value("spendable", true)) { ++tC; tA += u.value("amount", 0.0); }
             }
-            nlohmann::json zs = rpc->call("z_listunspent", nlohmann::json::array({0}));
+            nlohmann::json zs = rpc->call("z_listunspent", nlohmann::json::array({0}), services::kScopeCallTimeoutSec);
             if (zs.is_array()) for (const auto& z : zs) {
-                if (z.value("confirmations", 0) >= 1) { ++zC; zA += z.value("amount", 0.0); }
+                if (z.value("confirmations", 0) >= 1 && !services::noteIsLocked(z)) { ++zC; zA += z.value("amount", 0.0); }
             }
             groups = services::groupSpendableNotes(zs);
-        } catch (const std::exception& e) { error = e.what(); }
-        return [tC, zC, tA, zA, error, groups]() {
-            s_scope_loading = false; s_scope_loaded = error.empty();
+        } catch (const std::exception& e) {
+            error = e.what();
+            kind = rpc::rpcFailureKindOf(e);
+            if (error.empty()) error = "error";
+        } catch (...) {
+            error = "unknown error";
+            kind = rpc::RpcFailureKind::Other;
+        }
+        return [tC, zC, tA, zA, error, kind, gen, groups]() {
+            if (!services::scopeScanFinish(s_scan, gen, error, kind, services::steadySeconds())) return;
             s_t_count = tC; s_z_count = zC; s_t_amount = tA; s_z_amount = zA;
             s_groups = groups;
-            s_selected.clear();   // every address worth it, ticked by default
+            s_selected.clear();   // every address worth it, ticked by default, except ones the user unticked
             for (const auto& g : s_groups)
-                if (services::worthConsolidating(g, s_fee)) s_selected.insert(g.address);
+                if (services::worthConsolidating(g, s_fee) && !s_unticked.count(g.address))
+                    s_selected.insert(g.address);
             // Clamp the source to what actually has inputs (unless the user is mid-op).
             const bool tOk = tC > 0, zOk = zC > 0;
             if (!s_operation_pending) {
@@ -128,12 +149,13 @@ void ShieldDialog::show(Mode mode)
     s_utxo_limit = (int)schema::UI().drawElement("business", "utxo-limit").size;
     if (s_utxo_limit < 1) s_utxo_limit = 50;
     s_advanced = false;
-    s_scope_loaded = false; s_scope_loading = false;
+    services::scopeScanOpen(s_scan, services::steadySeconds());
     s_t_count = s_z_count = 0; s_t_amount = s_z_amount = 0.0;
     s_last_poll = 0.0;
     s_per_address = false;
     s_groups.clear();
     s_selected.clear();
+    s_unticked.clear();
 }
 
 void ShieldDialog::showShieldCoinbase(const std::string& fromAddress)
@@ -163,6 +185,15 @@ void ShieldDialog::hide()
     resetTransient();
 }
 
+void ShieldDialog::invalidateScope()
+{
+    s_confirm = false;   // what the user was confirming was read on the old connection
+    services::scopeScanInvalidate(s_scan);
+    s_t_count = s_z_count = 0; s_t_amount = s_z_amount = 0.0;
+    s_groups.clear();
+    s_selected.clear();
+}
+
 // Relevant count/amount for the currently-selected merge source.
 static int    srcCount()  { return s_src == 0 ? s_t_count : s_src == 1 ? s_z_count : (s_t_count + s_z_count); }
 static double srcAmount() { return s_src == 0 ? s_t_amount : s_src == 1 ? s_z_amount : (s_t_amount + s_z_amount); }
@@ -241,17 +272,34 @@ static void submitOperation(App* app)
         nlohmann::json addrs = nlohmann::json::array();
         for (const auto& a : fromAddrs) addrs.push_back(a);
         nlohmann::json result; std::string error;
+        bool uncertain = false;
         try {
+            if (!rpc) throw std::runtime_error("Not connected");
+            // The daemon scans the whole wallet before it returns the opid; on a large wallet that can
+            // outlast 30 s, which reported a failure for a merge that had started. 120 s, as a maintenance
+            // call so a disconnect aborts it instead of waiting.
+            App::MaintenanceCallScope maint(*app);
             rpc::RPCClient::TraceScope trace("Shield dialog / Consolidate");
             // fromaddrs, toaddr, fee, transparent_limit, shielded_limit — cap both to the batch size.
-            result = rpc->call("z_mergetoaddress", {addrs, to, fee, limit, limit});
-        } catch (const std::exception& e) { error = e.what(); }
-        return [app, result, error]() {
+            result = rpc->call("z_mergetoaddress", {addrs, to, fee, limit, limit}, services::kScopeCallTimeoutSec);
+        } catch (const std::exception& e) {
+            error = e.what();
+            // Sent, then cut off with no reply: our own abort on a lifecycle disconnect, the reply timeout
+            // or a dropped connection. The daemon keeps running the handler and may still queue the merge.
+            if (const auto* t = dynamic_cast<const rpc::RpcTransportError*>(&e))
+                uncertain = t->requestSent && t->httpStatus == 0;
+        }
+        return [app, result, error, uncertain]() {
             if (error.empty()) {
                 s_operation_id = result.value("opid", "");
                 s_status_message = TR("merge_progress");
                 Notifications::instance().success(TR("merge_started"));
                 app->trackOperation(s_operation_id);
+            } else if (uncertain) {
+                s_operation_pending = false; s_op_terminal = true;
+                s_confirm = false;   // don't leave Confirm armed for a merge that may still be running
+                s_status_message = TR("merge_submit_uncertain");
+                Notifications::instance().warning(TR("merge_submit_uncertain"));
             } else {
                 s_operation_pending = false; s_op_terminal = true;
                 s_status_message = std::string(TR("shield_error_prefix")) + error;
@@ -325,86 +373,142 @@ static void submitPerAddress(App* app)
     });
 }
 
-// Progress of a per-address run: poll every ~2s until each batch's operation is done or failed. Unfiltered,
-// like the shared poller (some daemons reject the per-opid form); only our operations are read.
+// Progress of a per-address run: poll every ~2s until each batch's operation is done or failed. Filtered
+// to the batches still running, as the shared poller does (unfiltered if the daemon rejected the filter).
 static void pollPerAddress(App* app)
 {
-    if (s_runs.empty() || s_op_terminal || !app->worker()) return;
+    if (s_runs.empty() || s_op_terminal || s_poll_in_flight || !app->worker()) return;
     const double now = ImGui::GetTime();
     if (now - s_last_poll < 2.0) return;
+    std::vector<std::string> running;
+    for (const auto& r : s_runs)
+        for (size_t i = 0; i < r.run.opids.size(); ++i)
+            if (r.state[i] == 0) running.push_back(r.run.opids[i]);
+    const auto filter = services::NetworkRefreshService::buildOperationFilterParams(running);
+    if (!filter) return;
     s_last_poll = now;
-    app->worker()->post([rpc = app->rpc()]() -> rpc::RPCWorker::MainCb {
+    s_poll_in_flight = true;
+    const unsigned session = s_poll_session;
+    nlohmann::json params = app->opidFilterUnsupported() ? nlohmann::json::array() : *filter;
+    app->worker()->post([rpc = app->rpc(), params = std::move(params), session]() -> rpc::RPCWorker::MainCb {
         nlohmann::json result; std::string error;
         try {
+            if (!rpc) throw std::runtime_error("Not connected");
             rpc::RPCClient::TraceScope trace("Shield dialog / Consolidate in place status");
-            result = rpc->call("z_getoperationstatus", nlohmann::json::array());
+            result = rpc->call("z_getoperationstatus", params);
         } catch (const std::exception& e) { error = e.what(); }
-        return [result, error]() {
+        return [result, error, session]() {
+            s_poll_in_flight = false;
+            if (session != s_poll_session) return;               // a reply for an earlier opening
             if (!error.empty() || !result.is_array()) return;   // transient — retry next tick
+            std::set<std::string> reported;
             for (const auto& op : result) {
                 if (!op.is_object() || !op.contains("id") || !op["id"].is_string()) continue;
                 const std::string id = op["id"].get<std::string>();
+                reported.insert(id);
                 const std::string status = (op.contains("status") && op["status"].is_string())
                                                ? op["status"].get<std::string>() : std::string();
                 for (auto& r : s_runs) {
                     for (size_t i = 0; i < r.run.opids.size(); ++i) {
                         if (r.run.opids[i] != id || r.state[i] != 0) continue;
                         if (status == "success") r.state[i] = 1;
-                        else if (status == "failed" || status == "cancelled") {
+                        else if (status == "failed" || status == "cancelled" || status == "canceled") {
                             r.state[i] = 2;
-                            if (r.failure.empty() && op.contains("error") && op["error"].is_object())
-                                r.failure = op["error"].value("message", std::string());
+                            if (r.failure.empty() && op.contains("error") && op["error"].is_object() &&
+                                op["error"].contains("message") && op["error"]["message"].is_string())
+                                r.failure = op["error"]["message"].get<std::string>();
                         }
                     }
                 }
             }
+            // A valid reply without one of our running ops: the daemon no longer holds it (restart, or
+            // popped by z_getoperationresult); its outcome can't be confirmed. One poll at a time, and
+            // states change only here, so the running set now is the set that was asked for.
+            for (auto& r : s_runs)
+                for (size_t i = 0; i < r.run.opids.size(); ++i)
+                    if (r.state[i] == 0 && !reported.count(r.run.opids[i])) r.state[i] = 3;
             bool allDone = true;
-            int failed = 0;
+            int failed = 0, unknown = 0;
             for (const auto& r : s_runs)
-                for (int st : r.state) { if (st == 0) allDone = false; if (st == 2) ++failed; }
+                for (int st : r.state) { if (st == 0) allDone = false; if (st == 2) ++failed; if (st == 3) ++unknown; }
             if (!allDone) return;
             s_operation_pending = false;
             s_op_terminal = true;
-            if (failed == 0) {
-                s_status_message = TR("shield_completed");
-                Notifications::instance().success(TR("shield_merge_done"));
-            } else {
+            if (failed > 0) {
                 s_status_message = TR("merge_keep_each_some_failed");
                 Notifications::instance().error(TR("merge_keep_each_some_failed"));
+            } else if (unknown > 0) {
+                s_status_message = TR("send_status_unconfirmed");
+                Notifications::instance().warning(TR("send_status_unconfirmed"));
+            } else {
+                s_status_message = TR("shield_completed");
+                Notifications::instance().success(TR("shield_merge_done"));
             }
         };
     });
 }
 
 // Live-progress self-poll: while an op is in flight, poll z_getoperationstatus every ~2s so the modal
-// shows "Consolidating… → Done/Failed" without a manual button. (The shared poller also tracks it for
-// balance refresh; this drives only the inline display.)
+// shows "Consolidating… → Done/Failed" without a manual button. (The shared poller also tracks it: it
+// refreshes balances and raises the failure toast; this drives the inline display and the success toast.)
 static void pollOperation(App* app)
 {
-    if (s_operation_id.empty() || s_op_terminal || !app->worker()) return;
+    if (s_operation_id.empty() || s_op_terminal || s_poll_in_flight || !app->worker()) return;
     const double now = ImGui::GetTime();
     if (now - s_last_poll < 2.0) return;
+    const std::string opid = s_operation_id;
+    // [[opid]]: the argument is an ARRAY of ids. The old {json::array({opid})} collapsed to ["opid"]
+    // (C++17 brace init of a json from one json copies it), which the daemon rejects, so this poll failed
+    // every time and the dialog never saw its op finish.
+    const auto filter = services::NetworkRefreshService::buildOperationFilterParams({opid});
+    if (!filter) return;
     s_last_poll = now;
-    std::string opid = s_operation_id;
-    app->worker()->post([rpc = app->rpc(), opid]() -> rpc::RPCWorker::MainCb {
+    s_poll_in_flight = true;
+    const unsigned session = s_poll_session;
+    nlohmann::json params = app->opidFilterUnsupported() ? nlohmann::json::array() : *filter;
+    app->worker()->post([rpc = app->rpc(), params = std::move(params), opid, session]() -> rpc::RPCWorker::MainCb {
         nlohmann::json result; std::string error;
         try {
+            if (!rpc) throw std::runtime_error("Not connected");
             rpc::RPCClient::TraceScope trace("Shield dialog / Op status");
-            result = rpc->call("z_getoperationstatus", {nlohmann::json::array({opid})});
+            result = rpc->call("z_getoperationstatus", params);
         } catch (const std::exception& e) { error = e.what(); }
-        return [result, error]() {
-            if (!error.empty() || !result.is_array() || result.empty()) return;   // transient — retry next tick
-            const auto& op = result[0];
-            const std::string status = op.value("status", "");
+        return [result, error, opid, session]() {
+            s_poll_in_flight = false;
+            if (session != s_poll_session || opid != s_operation_id) return;   // the dialog moved on
+            if (!error.empty() || !result.is_array()) return;   // transient — retry next tick
+            const nlohmann::json* found = nullptr;
+            for (const auto& o : result) {
+                if (o.is_object() && o.contains("id") && o["id"].is_string() && o["id"].get<std::string>() == opid) {
+                    found = &o;
+                    break;
+                }
+            }
+            if (!found) {
+                // A valid reply without our op: the daemon no longer holds it (it restarted, or another
+                // client popped it with z_getoperationresult). It registers an op before returning its id,
+                // so this is no race. The outcome can't be confirmed; stop polling.
+                s_operation_pending = false; s_op_terminal = true;
+                s_status_message = TR("send_status_unconfirmed");
+                Notifications::instance().warning(TR("send_status_unconfirmed"));
+                return;
+            }
+            const nlohmann::json& op = *found;
+            const std::string status = (op.contains("status") && op["status"].is_string())
+                                           ? op["status"].get<std::string>() : std::string();
             if (status == "success") {
                 s_operation_pending = false; s_op_terminal = true;
                 s_status_message = TR("shield_completed");
                 Notifications::instance().success(TR("shield_merge_done"));
-            } else if (status == "failed") {
-                std::string msg = op.value("error", nlohmann::json{}).value("message", std::string(TR("shield_unknown_error")));
+            } else if (status == "failed" || status == "cancelled" || status == "canceled") {
+                std::string msg = TR("shield_unknown_error");
+                if (op.contains("error") && op["error"].is_object() && op["error"].contains("message") &&
+                    op["error"]["message"].is_string())
+                    msg = op["error"]["message"].get<std::string>();
                 s_operation_pending = false; s_op_terminal = true;
                 s_status_message = std::string(TR("shield_op_failed")) + msg;
-                Notifications::instance().error(std::string(TR("shield_op_failed")) + msg);
+                // No toast: the op is tracked (App::trackOperation) and the shared opid poller raises the
+                // one failure toast, whether this dialog is open or not.
             }
             // queued / executing → leave the "Consolidating…" message and keep polling.
         };
@@ -426,6 +530,9 @@ void ShieldDialog::render(App* app)
     auto cancelBtn  = S.button("dialogs.shield", "cancel-button");
     const float dp  = Layout::dpiScale();
     const bool  isMerge = (s_mode == Mode::MergeToAddress);
+    // Merging needs the full node's z_mergetoaddress. Lite has no node: its scope scan used to fail and be
+    // re-posted every frame for as long as the dialog stayed open. (Shield coinbase keeps its own gating.)
+    if (isMerge && !app->supportsFullNodeLifecycleActions()) { s_open = false; return; }
 
     const char* title = s_consolidate ? TR("consolidate_title")
                       : isMerge        ? TR("merge_title")
@@ -441,7 +548,14 @@ void ShieldDialog::render(App* app)
     autoSelectDestination(state);
     pollOperation(app);
     pollPerAddress(app);
-    if (isMerge && !s_scope_loaded && !s_scope_loading && s_operation_id.empty()) loadScope(app);
+    if (isMerge) {
+        services::ScopeInputs in;
+        in.mergeMode = true;
+        in.busyWithOp = !s_operation_id.empty() || s_operation_pending || !s_runs.empty();
+        in.nodeReady = app->walletScanReady();
+        in.now = services::steadySeconds();
+        if (services::scopeScanWant(s_scan, in) == services::ScopeWant::Post) loadScope(app);
+    }
 
     // ── Description ──────────────────────────────────────────────────────────────────────────────
     ImGui::TextWrapped("%s", s_consolidate ? TR("consolidate_desc")
@@ -455,14 +569,24 @@ void ShieldDialog::render(App* app)
 
     // ── Merge: scope + source selector ──────────────────────────────────────────────────────────
     if (isMerge && !opInFlight) {
-        if (s_scope_loading) {
+        if (s_scan.phase == services::ScopePhase::Loading) {
             material::Type().textColored(material::TypeStyle::Caption, material::OnSurfaceMedium(),
                                          TR("merge_scope_loading"));
-        } else if (s_scope_loaded) {
+        } else if (s_scan.phase == services::ScopePhase::Loaded) {
             char buf[160];
             std::snprintf(buf, sizeof(buf), TR("merge_scope_fmt"),
                           s_t_count, s_z_count, fmtAmt(s_t_amount + s_z_amount).c_str());
             material::Type().textColored(material::TypeStyle::Caption, material::OnSurfaceMedium(), buf);
+        } else if (s_scan.phase == services::ScopePhase::Failed) {
+            const std::string reason = s_scan.error.size() > 160 ? s_scan.error.substr(0, 160) + "..." : s_scan.error;
+            char buf[320];
+            std::snprintf(buf, sizeof(buf), TR("merge_scope_failed_fmt"), reason.c_str());
+            wrappedCaption(material::Warning(), buf);
+            if (material::TactileButton(TR("retry"), ImVec2(0, 0), S.resolveFont(cancelBtn.font)))
+                services::scopeScanRetry(s_scan);
+        } else {
+            material::Type().textColored(material::TypeStyle::Caption, material::OnSurfaceMedium(),
+                                         state.isLocked() ? TR("merge_wait_locked") : TR("merge_waiting_node"));
         }
         ImGui::Spacing();
 
@@ -493,7 +617,7 @@ void ShieldDialog::render(App* app)
             ImGui::Spacing();
             int listed = 0;
             for (const auto& g : s_groups) if (g.notes >= 2) ++listed;
-            if (s_scope_loaded && listed == 0) {
+            if (s_scan.phase == services::ScopePhase::Loaded && listed == 0) {
                 wrappedCaption(material::Warning(), TR("merge_keep_each_none"));
             } else if (listed > 0) {
                 const float rowH = ImGui::GetFrameHeightWithSpacing();
@@ -511,8 +635,8 @@ void ShieldDialog::render(App* app)
                         ImGui::PushID(g.address.c_str());
                         ImGui::BeginDisabled(!worth);
                         if (ImGui::Checkbox(row, &ticked)) {
-                            if (ticked) s_selected.insert(g.address);
-                            else s_selected.erase(g.address);
+                            if (ticked) { s_selected.insert(g.address); s_unticked.erase(g.address); }
+                            else        { s_selected.erase(g.address);  s_unticked.insert(g.address); }
                         }
                         ImGui::EndDisabled();
                         if (ImGui::IsItemHovered(ImGuiHoveredFlags_AllowWhenDisabled))
@@ -618,7 +742,7 @@ void ShieldDialog::render(App* app)
                 ImGui::Spacing();
                 wrappedCaption(material::Warning(), hb);
             }
-        } else if (isMerge && s_scope_loaded && srcCount() > s_utxo_limit) {
+        } else if (isMerge && s_scan.phase == services::ScopePhase::Loaded && srcCount() > s_utxo_limit) {
             char hb[160];
             std::snprintf(hb, sizeof(hb), TR("merge_batch_fmt"), s_utxo_limit);
             ImGui::Spacing();
@@ -634,8 +758,8 @@ void ShieldDialog::render(App* app)
             const std::string label = app->getAddressLabel(r.run.address);
             const char* name = label.empty() ? nullptr : label.c_str();
             const std::string shortA = shortAddr(r.run.address);
-            int done = 0, failed = 0;
-            for (int st : r.state) { if (st == 1) ++done; if (st == 2) ++failed; }
+            int done = 0, failed = 0, unknown = 0;
+            for (int st : r.state) { if (st == 1) ++done; if (st == 2) ++failed; if (st == 3) ++unknown; }
             const int batches = static_cast<int>(r.run.opids.size());
             char line[320];
             ImU32 col = material::OnSurfaceMedium();
@@ -647,6 +771,9 @@ void ShieldDialog::render(App* app)
                 std::snprintf(line, sizeof(line), TR("merge_keep_each_status_failed"), name ? name : shortA.c_str(),
                               r.failure.c_str());
                 col = material::Error();
+            } else if (unknown > 0 && done + unknown == batches) {
+                std::snprintf(line, sizeof(line), TR("merge_keep_each_status_unconfirmed"), name ? name : shortA.c_str());
+                col = material::Warning();
             } else if (done == batches) {
                 std::snprintf(line, sizeof(line), TR("merge_keep_each_status_done"), name ? name : shortA.c_str(),
                               r.run.notesMerged, batches);
@@ -717,8 +844,9 @@ void ShieldDialog::render(App* app)
     }
 
     bool can_submit = haveDest && connected && !syncing;
-    if (isMerge && s_scope_loaded && srcCount() == 0) can_submit = false;
-    if (perAddress) can_submit = connected && !syncing && s_scope_loaded && !selectedGroups().empty();
+    const bool scopeLoaded = s_scan.phase == services::ScopePhase::Loaded;
+    if (isMerge && scopeLoaded && srcCount() == 0) can_submit = false;
+    if (perAddress) can_submit = connected && !syncing && scopeLoaded && !selectedGroups().empty();
 
     float footerBtnW = shieldBtn.width + cancelBtn.width + ImGui::GetStyle().ItemSpacing.x;
     material::BeginOverlayDialogFooter(footerBtnW, /*drawSeparator=*/false);

src/ui/windows/shield_dialog.h

@@ -52,6 +52,12 @@ public:
      * @brief Close the dialog (used by the UI sweep teardown)
      */
     static void hide();
+
+    /**
+     * @brief Forget the scope (inputs) read for the Merge/Consolidate view: the node connection changed,
+     * so it may be a different wallet. The next render reads it again once the node is ready.
+     */
+    static void invalidateScope();
 };
 
 } // namespace ui

src/util/i18n.cpp

@@ -2493,6 +2493,7 @@ void I18n::loadBuiltinEnglish()
         strings_["shield_unknown_error"] = "Unknown error";
         strings_["shield_send_failed"] = "Shield failed: ";
         strings_["merge_send_failed"] = "Merge failed: ";
+        strings_["merge_submit_uncertain"] = "The node didn't confirm the merge before the connection was interrupted. It may still go through \xE2\x80\x94 check History after reconnecting before merging again.";
         strings_["merge_description"] = "Merge multiple UTXOs into a single shielded address. This can help reduce wallet size and improve privacy.";
         strings_["merge_funds"] = "Merge Funds";
         strings_["merge_started"] = "Merge operation started";
@@ -2503,6 +2504,9 @@ void I18n::loadBuiltinEnglish()
         strings_["consolidate_funds_btn"] = "Consolidate";
         strings_["merge_scope_loading"] = "Checking your inputs\xE2\x80\xA6";
         strings_["merge_scope_fmt"] = "%d transparent + %d shielded inputs  \xC2\xB7  ~%s DRGX spendable";
+        strings_["merge_waiting_node"] = "Waiting for the node\xE2\x80\xA6";
+        strings_["merge_wait_locked"] = "The wallet is locked. Unlock it to continue.";
+        strings_["merge_scope_failed_fmt"] = "Couldn't read your inputs: %s";
         strings_["merge_source"] = "Consolidate";
         strings_["merge_src_transparent"] = "Transparent";
         strings_["merge_src_shielded"] = "Shielded";
@@ -2535,6 +2539,7 @@ void I18n::loadBuiltinEnglish()
         strings_["merge_keep_each_status_failed"] = "%s — failed: %s";
         strings_["merge_keep_each_status_done"] = "%s — done: %d notes merged in %d batch(es)";
         strings_["merge_keep_each_status_running"] = "%s — merging %d notes (%d of %d batches done)…";
+        strings_["merge_keep_each_status_unconfirmed"] = "%s \xE2\x80\x94 status could not be confirmed";
         strings_["merge_keep_each_run_again"] = "Addresses merged in several batches now hold one note per batch. Run this again after those confirm to merge them into one.";
         strings_["done"] = "Done";