feat(ui): redesign wallet screen information architecture

docs/user-stories.md

@@ -186,6 +186,43 @@ As a user, I want to withdraw credits from a Platform address back to a Core add
 - Destination Core address input.
 - Fee strategy configuration.
 
+### WAL-021: Navigate wallet accounts via tabs [Implemented]
+**Persona:** Alex, Priya
+
+As a user, I want to see clear tabs for Dash Core, Platform, and Shielded so that I can switch between account views without searching through a dropdown.
+
+- Tab bar replaces account category dropdown.
+- Each tab shows its balance in the label.
+- Empty accounts display "(empty)" indicator.
+- Switching tabs is instant with no data reload.
+
+### WAL-022: View system accounts in developer mode [Implemented]
+**Persona:** Jordan
+
+As a developer, I want a System tab that reveals all internal account categories (Identity Registration, CoinJoin, Provider keys, etc.) so that I can inspect low-level wallet structure without cluttering the default view.
+
+- System tab appears only when developer mode is enabled.
+- Each system account category is shown as a collapsible section.
+- Section headers display address count and balance.
+
+### WAL-023: Collapsible transaction history [Implemented]
+**Persona:** Alex, Priya
+
+As a user, I want the transaction history to be collapsible so that I can focus on addresses or balances without scrolling past a long list of transactions.
+
+- Transaction history section has a collapsible header.
+- Collapsed by default to reduce visual clutter.
+- Expand/collapse state persists within the session.
+
+### WAL-024: Collapsible balance breakdown [Implemented]
+**Persona:** Priya
+
+As a power user, I want the balance breakdown and address table to be collapsible so that I can focus on the information I need at the moment.
+
+- Address table section has a collapsible header.
+- Asset locks section has a collapsible header.
+- Sections are expanded by default for quick access.
+
 ---
 
 ## Send and Receive (SND)

src/backend_task/core/mod.rs

@@ -197,11 +197,14 @@ impl AppContext {
                     if let Some(task_err) = Self::chain_lock_rpc_error(active_config, e) {
                         return Err(task_err);
                     }
-                    // Non-auth, non-connection error — log the raw error but show
-                    // a sanitized message in the UI status display.
+                    // Non-auth, non-connection error — show the actual error
+                    // in the Networks page status display for debugging.
                     tracing::warn!(network = ?self.network, error = %e, "Chain lock query failed on active network");
-                    Some("RPC error — check Dash Core status".to_string())
+                    Some(format!("RPC error: {e}"))
                 } else {
+                    // Successful chain lock fetch — clear any lingering RPC error
+                    // so the connection status recovers after a transient outage.
+                    self.connection_status.set_rpc_last_error(None);
                     None
                 };
 

src/backend_task/error.rs

@@ -830,6 +830,16 @@ pub enum TaskError {
         source: Box<dash_sdk::Error>,
     },
 
+    /// The nonce used for a shielded transaction was stale. The wallet's cached
+    /// nonce was behind Platform's expected nonce. Retrying will use the correct nonce.
+    #[error(
+        "The transaction used an outdated sequence number. Please retry — the wallet will use the correct number automatically."
+    )]
+    ShieldedNonceMismatch {
+        #[source]
+        source_error: Box<dash_sdk::Error>,
+    },
+
     /// The address used for a shielded transaction does not have enough locked funds.
     #[error(
         "Not enough funds locked for this shielded transaction. \
@@ -1006,6 +1016,13 @@ pub fn shielded_broadcast_error(e: SdkError) -> TaskError {
             source_error: Box::new(e),
         };
     }
+    if let Some(ConsensusError::StateError(StateError::AddressInvalidNonceError(_))) =
+        consensus_error
+    {
+        return TaskError::ShieldedNonceMismatch {
+            source_error: Box::new(e),
+        };
+    }
     TaskError::ShieldedBroadcastFailed {
         source: Box::new(e),
     }

src/backend_task/shielded/sync.rs

@@ -110,11 +110,31 @@ pub async fn sync_notes(
     }
 
     // Persist and record decrypted notes that are new (position >= already_have).
+    // Also skip notes already in memory (loaded from DB during init) to prevent
+    // double-counting when the commitment tree resets but persisted notes remain.
+    // Build a HashMap of position->value for O(1) lookups and divergence detection.
+    let existing_notes: std::collections::HashMap<u64, u64> = shielded_state
+        .notes
+        .iter()
+        .map(|n| (u64::from(n.position), n.note.value().inner()))
+        .collect();
     let mut new_note_count = 0u32;
     for dn in result.decrypted_notes {
         if dn.position < already_have {
             continue; // already stored in a previous sync
         }
+        if let Some(&existing_value) = existing_notes.get(&dn.position) {
+            let new_value = dn.note.value().inner();
+            if new_value != existing_value {
+                tracing::warn!(
+                    position = dn.position,
+                    existing_value,
+                    new_value,
+                    "Shielded note dedup: value divergence at existing position"
+                );
+            }
+            continue; // already loaded from DB during init
+        }
 
         // Compute the spending nullifier from our FVK (dn.nullifier is the rho/nf
         // field from the compact action, not the spending nullifier).

src/context/shielded.rs

@@ -150,7 +150,7 @@ impl AppContext {
     }
 
     /// Initialize shielded wallet state by deriving ZIP32 keys from the wallet seed.
-    fn initialize_shielded_wallet(
+    pub(crate) fn initialize_shielded_wallet(
         self: &Arc<Self>,
         seed_hash: WalletSeedHash,
     ) -> Result<BackendTaskSuccessResult, TaskError> {
@@ -277,7 +277,7 @@ impl AppContext {
     }
 
     /// Sync shielded notes from platform.
-    async fn sync_shielded_notes(
+    pub(crate) async fn sync_shielded_notes(
         self: &Arc<Self>,
         seed_hash: WalletSeedHash,
     ) -> Result<BackendTaskSuccessResult, TaskError> {
@@ -539,7 +539,7 @@ impl AppContext {
     }
 
     /// Check nullifiers to detect spent notes.
-    async fn check_nullifiers_task(
+    pub(crate) async fn check_nullifiers_task(
         self: &Arc<Self>,
         seed_hash: WalletSeedHash,
     ) -> Result<BackendTaskSuccessResult, TaskError> {

src/context/wallet_lifecycle.rs

@@ -137,11 +137,18 @@ impl AppContext {
     }
 
     pub fn bootstrap_wallet_addresses(&self, wallet: &Arc<RwLock<Wallet>>) {
-        if let Ok(mut guard) = wallet.write()
-            && guard.known_addresses.is_empty()
-        {
-            tracing::info!(wallet = %hex::encode(guard.seed_hash()), "Bootstrapping wallet addresses");
-            guard.bootstrap_known_addresses(self);
+        if let Ok(mut guard) = wallet.write() {
+            // Bootstrap when no addresses exist (fresh wallet) or when
+            // platform payment addresses haven't been derived yet (wallet
+            // created with only a Core address via new_from_seed).
+            let has_platform_addresses = guard.watched_addresses.values().any(|info| {
+                info.path_reference
+                    == crate::model::wallet::DerivationPathReference::PlatformPayment
+            });
+            if guard.known_addresses.is_empty() || !has_platform_addresses {
+                tracing::info!(wallet = %hex::encode(guard.seed_hash()), "Bootstrapping wallet addresses");
+                guard.bootstrap_known_addresses(self);
+            }
         }
     }
 
@@ -150,6 +157,13 @@ impl AppContext {
             self.queue_spv_wallet_load(seed_hash, seed_bytes);
             // Note: Platform address sync is not done here.
             // Core UTXO refresh is handled at startup in bootstrap_loaded_wallets.
+
+            // Initialize shielded wallet on a background thread to avoid
+            // blocking the UI — ZIP32 key derivation and DB reads can stall.
+            // After init completes, queue async SyncNotes -> CheckNullifiers.
+            // This is the single init path — the UI never dispatches
+            // InitializeShieldedWallet.
+            self.queue_shielded_init_and_sync(seed_hash);
         }
     }
 
@@ -164,6 +178,72 @@ impl AppContext {
         self.queue_spv_wallet_unload(seed_hash);
     }
 
+    /// Queue shielded wallet initialization on a blocking thread, then
+    /// follow up with note sync + nullifier check. Tracked via `subtasks`
+    /// so it participates in graceful shutdown and cancellation.
+    fn queue_shielded_init_and_sync(self: &Arc<Self>, seed_hash: WalletSeedHash) {
+        let ctx = Arc::clone(self);
+        self.subtasks.spawn_sync("shielded_init", async move {
+            let ctx2 = Arc::clone(&ctx);
+            let init_result =
+                tokio::task::spawn_blocking(move || ctx2.initialize_shielded_wallet(seed_hash))
+                    .await;
+            match init_result {
+                Ok(Ok(_)) => {
+                    tracing::trace!(
+                        seed = %hex::encode(seed_hash),
+                        "Shielded wallet state initialized on unlock"
+                    );
+                    ctx.run_shielded_sync(seed_hash).await;
+                }
+                Ok(Err(e)) => tracing::debug!(
+                    seed = %hex::encode(seed_hash),
+                    error = %e,
+                    "Shielded wallet init skipped on unlock"
+                ),
+                Err(e) => tracing::debug!(
+                    seed = %hex::encode(seed_hash),
+                    error = %e,
+                    "Shielded init task panicked"
+                ),
+            }
+        });
+    }
+
+    /// Run SyncNotes -> CheckNullifiers sequence on a blocking thread.
+    async fn run_shielded_sync(self: &Arc<Self>, seed_hash: WalletSeedHash) {
+        let ctx = Arc::clone(self);
+        let handle = tokio::runtime::Handle::current();
+        let result = tokio::task::spawn_blocking(move || {
+            handle.block_on(async {
+                match ctx.sync_shielded_notes(seed_hash).await {
+                    Ok(_) => {
+                        if let Err(e) = ctx.check_nullifiers_task(seed_hash).await {
+                            tracing::debug!(
+                                seed = %hex::encode(seed_hash),
+                                error = %e,
+                                "Shielded nullifier check after init failed"
+                            );
+                        }
+                    }
+                    Err(e) => tracing::debug!(
+                        seed = %hex::encode(seed_hash),
+                        error = %e,
+                        "Shielded note sync after init failed"
+                    ),
+                }
+            })
+        })
+        .await;
+        if let Err(e) = result {
+            tracing::debug!(
+                seed = %hex::encode(seed_hash),
+                error = %e,
+                "Shielded sync task panicked"
+            );
+        }
+    }
+
     fn wallet_seed_snapshot(wallet: &Arc<RwLock<Wallet>>) -> Option<(WalletSeedHash, [u8; 64])> {
         let guard = wallet.read().ok()?;
         if !guard.is_open() {
@@ -841,7 +921,7 @@ impl AppContext {
                         net_amount: record.net_amount,
                         fee: record.fee,
                         label: record.label.clone(),
-                        is_ours: record.is_ours,
+                        is_ours: spv_is_ours_override(record.is_ours, record.net_amount),
                         status,
                     }
                 })
@@ -889,3 +969,51 @@ impl AppContext {
         self.connection_status.reset_timer();
     }
 }
+
+/// SPV transaction history is per-wallet — all entries involve our addresses
+/// (they passed bloom filter + `check_transaction()` address matching).
+/// Upstream sets `is_ours` only for sends (`net_amount < 0`); we override
+/// to `true` for all matched transactions since address ownership was
+/// already verified by the SPV layer.
+///
+/// Bloom filter false positives are filtered by `check_transaction()` before
+/// records reach this point, so the override is safe. Testing actual bloom
+/// filter FP behavior would require mocking the SPV layer's bloom filter,
+/// which is out of scope for unit tests.
+fn spv_is_ours_override(upstream_is_ours: bool, net_amount: i64) -> bool {
+    if !upstream_is_ours && net_amount >= 0 {
+        tracing::debug!(
+            net_amount,
+            "SPV: overriding is_ours to true for receive transaction"
+        );
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn is_ours_override_true_for_outgoing_already_ours() {
+        assert!(spv_is_ours_override(true, -50_000));
+    }
+
+    #[test]
+    fn is_ours_override_true_for_incoming_not_ours() {
+        // Upstream marks receive transactions as !is_ours — we override.
+        assert!(spv_is_ours_override(false, 100_000));
+    }
+
+    #[test]
+    fn is_ours_override_true_for_zero_amount_not_ours() {
+        // Edge case: net_amount == 0 (e.g. self-transfer minus fee)
+        assert!(spv_is_ours_override(false, 0));
+    }
+
+    #[test]
+    fn is_ours_override_true_for_outgoing_not_ours() {
+        // Even if upstream says !is_ours for a send, we override.
+        assert!(spv_is_ours_override(false, -10_000));
+    }
+}