How the sender recover the transactions that he spent?

Question

In order to compute the balance of his own wallet, (I assume that) a client needs to retrieve:

1- The transaction that he is the receiver.(By scanning the whole block-chain and compare with his own view-key).

2- To reduce from 1, the transactions that he already spent.

According to 2, does he needs to keep the secret rs that he used to compute the stealth address of the the recipients?

What if he lost those secret values? (The only solution that is to see whether the transactions that he spent already spent in other transactions- but unfortunately I'm not sure it still possible to distinguish if that transaction were a decoy or not)

Answer 1

The user can recover the dates and amounts of the transactions they have made, but not the destination wallet addresses of any of those transactions or any encrypted payment id. They would be able to see any old style 256-bit payment id, because those old style transaction ids are not encrypted on the blockchain. The new style 64 bit payment ids (as used in integrated addresses) would be encrypted.

The spent outputs can be discovered because the user can use their private spend key to determine the 'key images' of all of their received outputs. Key images are published with every transaction, so they can scan the blockchain to determine which of their outputs have been spent. Therefore they can subtract the amount of that spent output from their wallet balance. They know the amount of that output for the same reason they knew it when they first received it. That reason is that it's communicated to them in the ecdhInfo part of the transaction, and encrypted using the transaction shared secret so that only they can decrypt it using their private view key.

The outgoing transaction payment ids cannot be recovered because they would have been encrypted with the transaction shared secret. As the sender, they would have needed to retain the transaction private key to know the transaction shared secret.

In algebra, the sender knows the shared secret as Hs(rA), and the recipient knows the same shared secret as Hs(aR). This is why the sender cannot recover the shared secret later. The sender would have needed to know both the transaction private key r and the recipient's public view key A in order to recover the transaction shared secret.

Answer 2

It is true that the sender risks losing the secret if he deletes his wallet cache or something like that happens. However, the only thing that would permanently be lost to the sender is the public address of the recipient. The amount sent is still able to be decoded.