Wallet: ranking notes

This is an unusually large category and the P2 band is correspondingly wide: it holds the migration/storage correctness fixes, the PSBT and hardware-signer interoperability fixes, the rebroadcast-privacy cluster, and the two multi-PR feature projects (Silent Payments, multipath descriptors). P1 was reserved for defects that can lose funds, corrupt or destroy wallet data, crash loading, silently hide balances, or leak node identity for all wallet users. Several bands were adjusted only to keep dependency chains from inverting (#33033, #36443) or to put PRs attacking the identical defect in the same band (#34533 vs #36330).

• Rebroadcast privacy is attacked by six overlapping PRs: #36398 (only rebroadcast IsFromMe), #36482 (only announce what was re-added to mempool), #36330 (no resubmission under -privatebroadcast), #34533 (resubmit via private broadcast instead), #36380 (-walletbroadcast=initialonly) and #36481 (manual rebroadcast). Review #36398 first since it sets the baseline policy the others build on.
• #34533 and #36330 are opposite approaches to the identical defect (wallet resubmission defeating -privatebroadcast); they were previously split P1/P2. They now share P2 and a decision on approach should precede review of either.
• Dependency chain #33033 (SQLite RAII) -> #33034 (tx table) -> #27865 (no-longer-spendable TXOs): review base-first; #33033 was scored P3 but cannot sit below the P2 work it unblocks.
• Dependency chain #36442 -> #36443 -> #36444 (multipath descriptors): #36443 was scored P3 but is a prerequisite for P2 #36444, so it was raised and the three are kept contiguous.
• #35302 (Silent Payments sending) is stated to help unblock #32966 (receiving); review sending first despite receiving scoring higher alone.
• #10102 (multiprocess) is the base for #19460; #19460 cannot be evaluated independently of it.
• #35918, #36070 and #36143 are all prerequisites for the same multisig wizard project (#35645) and should be reviewed as one block rather than in isolation.
• #35492 (fail dump on incomplete writes) and #35998 (handle WalletBatch write failures) address the same class of defect — ignored persistence failures; #35998 is the systemic fix and should go first.
• #34193 (migration robustness) and #34909 (move ~800 lines of migration code out of wallet.cpp) touch the same code; the behavior fix #34193 should land before the move-only refactor. #36333 also touches migration-time transaction deletion.
• #35716 (multi_index for mapWallet) overlaps the transaction-storage rework in #33034/#27865; coordinate so one does not invalidate the other.
• #36488 (deprecate confTarget) and #36489 (add snake_case funding aliases) are the same RPC option-naming cleanup from the same author and should be reviewed together; #36489 also carries an actual bug fix.
• #36550 supersedes #36551 per its own description; only one should be reviewed.

• #34193: P2 alone, P1 after comparison. Raised: mid-migration failure can destroy the original legacy wallet files, and migration correctness is the category's second-ranked concern after fund safety.
• #35760: Moved up: corrupt-record handling sits with the other wallet-load/storage correctness fixes rather than below feature work.
• #35990: Moved up: hardening the BDB parser is on the migration path every legacy user must cross, grouping it with the other migration fixes.
• #36494: Moved up: an unnoticed typo spending every wallet UTXO is a fund-safety defect, ranked with the other fund-safety P2s.
• #35492: Moved down slightly: silent truncated dumps matter, but less than the load/migration corruption fixes above it.
• #36154: Moved up: stateless-signer refusals are a concrete interoperability failure, ranked with the other PSBT correctness fixes.
• #36539: Moved up: it fixes a shipped 32.0 interoperability regression, which outranks the feature-oriented P2s.
• #36352: Moved up: grouped with the other PSBT signing/finalization correctness fixes.
• #34533: P1 alone, P2 after comparison. Lowered from P1: same defect as #36330 with an opposite approach, and scope is limited to the opt-in -privatebroadcast feature; the two must share a band.
• #36330: Moved up to sit directly beside #34533, which addresses the identical defect by the opposite method.
• #33033: P3 alone, P2 after comparison. Raised from P3: it is the prerequisite for #33034, which in turn unblocks #27865; a base cannot sit below what it unblocks.
• #33034: Moved up to keep the #33033 -> #33034 -> #27865 chain contiguous and in base-first order.
• #27865: Moved down: large speedup, but it is the tip of a chain whose bases (#33033, #33034) must be reviewed first.
• #34400: Moved down: a real user-visible speedup, but ranked below the correctness and privacy fixes above it.
• #33112: Moved down: prerequisite value for MuSig2/hardware multisig is real but speculative relative to shipped-bug fixes.
• #35377: Moved down: long-requested usability/opsec improvement, ranked below the correctness fixes.
• #32966: Moved down: depends on the sending work (#35302) and on upstream libsecp256k1, so it is not the first thing a reviewer can land.
• #36442: Moved down slightly to head the multipath chain #36442 -> #36443 -> #36444 as a contiguous block.
• #36443: P3 alone, P2 after comparison. Raised from P3: it is the prerequisite for P2 #36444 and cannot sit below it.
• #36342: Moved up: it prevents an assertion crash and an int64 overflow, the strongest of the P3 bug fixes.
• #36313: Moved up: a reproducible persistent-lock bug with a linked issue outranks the P3 cleanups it was scored beside.
• #36393: Moved up: an explicitly requested constraint being silently ignored is a bug, ranked with the other P3 bug fixes.
• #36577: Moved up to sit with the other PSBT signing interoperability fixes (#36039, #35747).
• #35747: P2 alone, P3 after comparison. Lowered from P2: only yields an incomplete PSBT, never a bad signature, matching #36577 and #36039 in consequence.
• #36597: P2 alone, P3 after comparison. Lowered from P2: no behavior change for current Core callers; the payoff accrues to downstream gui-qml, like #36685.
• #36685: Moved up to sit beside #36597, the other interface restoration serving gui-qml.
• #35370: Moved down: resolves a long-standing issue, but it is a feature addition behind the P3 bug fixes.
• #36236: Kept with the descriptor-import feature group.
• #35918: Moved down to head a contiguous multisig-wizard (#35645) block with #36070 and #36143.
• #36070: Moved up to sit with the other #35645 prerequisites it shares a project with.
• #36143: Kept adjacent to the other #35645 wizard prerequisites.
• #36481: Moved down: convenience wrapper over existing sendrawtransaction, below the feature work with linked user demand.
• #36380: Moved up to sit with the other opt-in rebroadcast-policy options.
• #33043: P2 alone, P3 after comparison. Lowered from P2: an explicit proof of concept seeking feedback on whether Core should store seeds at all; value is speculative until that is settled.
• #36697: Moved down: single-client motivation with no corroborating demand places it at the bottom of the feature group.
• #36126: Moved down: convenience labelling whose persistence design is still contested.
• #34405: Moved up: it corrects misreported APS usage in tracepoints/logs, which is more than a pure cleanup.
• #35716: Moved down: structural fragility reduction with no user-visible payoff, ranked with the other internal refactors.
• #19460: Moved down: scaffolding only; the user-visible online-wallet features are deferred to later PRs.
• #34909: Heads the internal refactor block; see note about conflict ordering with #34193.
• #25722: Moved down: behavior-preserving error-plumbing refactor, ranked with the other internal cleanups.
• #35041: Moved down: sub-millisecond per-descriptor gain mainly benefits fuzzing, not normal wallet use.
• #35433: Moved down: RPC surface deprecation with no behavior fix, grouped with the other cleanups.
• #35786: Moved down: unmeasured micro-optimization plus dead-notification removal.
• #36028: Moved down: explicitly equivalent in outcome; value is cross-implementation spec alignment only.
• #32993: Moved down: useful coverage, but it does not reproduce the known rescan crash, so it ranks below behavior-affecting work.
• #36122: P3 alone, P4 after comparison. Lowered from P3: explicitly a draft accompanying unaccepted BIPs and vendoring unmerged libsecp256k1 work; wallet value is speculative until consensus work lands.
• #35342: P3 alone, P4 after comparison. Lowered from P3: fuzzing wallet RPCs without chain state or UTXOs yields very little real coverage, making the benefit weakly justified.
• #36614: P3 alone, P4 after comparison. Lowered from P3: one narrow mutation-killing unit test, equivalent in consequence to the other test-only P4 entries.

This pass by claude-opus-5 on 2026-11-01 saw every PR in the category at once and checked the bands given to each PR alone against each other, ordered the PRs, and noted chains and overlaps. Back to the category.