Dual-mode Solana wallet (transparent + shielded) on devnet — looking for feedback on UX + threat model

We’re testing a devnet prototype of a Solana wallet that supports transparent transfers and a shielded mode intended to reduce linkability. Looking for technical critique on: (1) UX footguns when switching modes, (2) common metadata leaks that break “shielded” assumptions, (3) how you’d frame a realistic threat model, and (4) what tests you’d run first.