perf(net): one balance scan per poll, filtered opstatus, a guarded merge scope

The Core poll ran z_gettotalbalance twice (minconf 0 and 1), each a whole-
wallet scan under dragonxd's cs_main. The spendable (minconf=1) call now
runs only after the display call succeeded, and only when something is
unconfirmed or pending or the exact total moved: about 95% of polls make
one scan instead of two. A forced post-send balance can no longer be lost
to a refused enqueue, and pending-send debits aren't re-applied each tick.

z_getoperationstatus is filtered to our opids with its real argument form
([[id,...]]; the old ["id"] was rejected), falling back to the unfiltered
call if a daemon refuses the filter. The Shield/Merge dialog's own polls
are filtered and session-guarded too, and finally reach Done; the dead
RPCClient wrappers are deleted.

The Merge/Consolidate scope scan becomes a tested state machine: one scan
at a time, failures latch behind a Retry button, only "node not ready"
retries by itself (10/30/60 s, at most 3), Lite never scans. Its 120 s
calls are maintenance calls: every main-thread disconnect aborts one in
flight first, so a lifecycle action no longer freezes the UI behind it.
An aborted merge that was already sent says it may still go through.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/services/network_refresh_service.h

@@ -120,6 +120,20 @@ public:
         // node (ReplyTimeout / QueueFull) from a gone one (NotListening) without reading what().
         rpc::RpcFailureKind blockchainErrKind = rpc::RpcFailureKind::None;
         rpc::RpcFailureKind balanceErrKind = rpc::RpcFailureKind::None;
+        // The minconf=0 call reached the daemon (it may still have failed). False when the balance was
+        // skipped (behind, busy chain read) or held back by the busy gate (Deferred) before it was sent.
+        bool balanceAttempted = false;
+        bool spendableQueried = false;                 // the minconf=1 call was made
+        std::optional<std::int64_t> totalBalanceZat;   // the minconf=0 "total" in zatoshis, exact
+    };
+
+    // What one Core refresh fetches. The minconf=1 (spendable) z_gettotalbalance is a second whole-wallet
+    // scan under cs_main; it only tells something the minconf=0 call doesn't while funds are unconfirmed
+    // or pending, so it runs only when needSpendable or the exact total moved since prevTotalZat.
+    struct CoreRefreshPlan {
+        bool includeBalance = true;
+        bool needSpendable = true;
+        std::optional<std::int64_t> prevTotalZat;
     };
 
     struct MiningRefreshResult {
@@ -271,7 +285,24 @@ public:
     // includeBalance=false skips z_gettotalbalance (which takes the wallet lock + cs_main) and only
     // fetches getblockchaininfo — used while syncing, where the balance is incomplete anyway and the
     // wallet should minimise lock contention with block connection.
-    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, bool includeBalance = true);
+    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, const CoreRefreshPlan& plan);
+    static CoreRefreshResult collectCoreRefreshResult(RefreshRpcGateway& rpc, bool includeBalance = true)
+    {
+        CoreRefreshPlan plan;
+        plan.includeBalance = includeBalance;
+        return collectCoreRefreshResult(rpc, plan);
+    }
+    // An amount as the daemon formats it ("[-]digits[.up to 8 digits]") in zatoshis; nullopt for anything
+    // else or anything that would overflow. Exact, so "did the total move" never trips on rounding.
+    static std::optional<std::int64_t> parseMoneyZat(const std::string& text);
+    // Whether the next balance poll needs the minconf=1 (spendable) call whatever the total does: never
+    // fetched, unconfirmed or pending funds, or a forced refresh after the user's own send.
+    static bool spendableBalanceNeeded(const WalletState& state, bool pendingSendWork, bool forced);
+    // The total the next poll compares against (CoreRefreshPlan::prevTotalZat). None after a poll whose
+    // minconf=1 call was made but brought back no total (timeout, held back, error): that left spendable
+    // degraded to display, so the next poll must count the total as moved and measure it again.
+    static std::optional<std::int64_t> nextTotalBaseline(const CoreRefreshResult& result,
+                                                         std::optional<std::int64_t> previous);
     static MiningRefreshResult parseMiningRefreshResult(const nlohmann::json& miningInfo,
                                                         bool miningOk,
                                                         const nlohmann::json& localHashrate,
@@ -340,6 +371,11 @@ public:
         int pageSize = 100);
     static OperationStatusPollResult parseOperationStatusPoll(const nlohmann::json& result,
                                                               const std::vector<std::string>& requestedOpids);
+    // Params for z_getoperationstatus/result filtered to these opids: ONE argument, an array of ids, so
+    // [[id, ...]]. nullopt when no non-empty id remains: an empty filter means every op the node has
+    // retained. Built explicitly, because a one-element braced list of a json ({ids}) collapses to the
+    // inner array, which the daemon rejects ("JSON value is not an array as expected").
+    static std::optional<nlohmann::json> buildOperationFilterParams(const std::vector<std::string>& opids);
 
     struct DaemonRescanScan {
         bool  foundRescan = false;