Wallet: ranking notes

No PR was originally banded P1, yet the list contains a clear cluster of crash, corruption, wrong-balance, migration and fund-loss defects that would be seriously harmful to leave for another release cycle; those eight were promoted so that the band structure distinguishes them from the feature, privacy and performance work that fills P2. Everything else kept its band except #33033 and #35918 (raised because they gate P2 work) and #35342/#35358 (lowered for weak efficacy and redundancy).

• Same problem, three PRs: #35998 (nodiscard on all WalletBatch writes), #35752 (atomic encryption/key-insert state) and #35966 (log instead of failing on post-encryption unlock) all concern wallet DB write-failure handling. Review #35998 first as the systematic fix, then #35752; #35966's approach was contradicted by the maintainer and should be reworked or closed against them.
• Duplicate work: #35358's output/sighash validation has been absorbed into #36114. Review #36114; #35358 needs no further review.
• Chain whose order matters: #33033 (SQLite statement RAII) and #32895 (client-version records) are prerequisites for #33034 (transactions table), which #27865 (no-longer-spendable TXO tracking) explicitly builds on. Review order 33033/32895 -> 33034 -> 27865.
• Chain: #34457 introduces private broadcast for wallet transactions; #34533 extends it to periodic resubmission and waits on it. Review #34457 first.
• Chain: #32966 (Silent Payments receiving) precedes #35302 (sending), which also sits on unlisted prerequisite #35301.
• Two PRs serving the same project: #36070 (deriveHDKey interface) and #35918 (expose key expression parsing) are both prerequisites for the multisig wizard #35645; they belong in the same band and should be reviewed together, #36070 first.
• Overlapping area: #36245 (top-up from range_start), #35901 (look-ahead pool expanding mid-block) and #35989 (huge descriptor ranges/keypool) all touch descriptor derivation and keypool top-up correctness; fixes may interact and #34907 hardens the corresponding fast-rescan test.
• Overlapping area: #36284 (double-discarded output groups) and #34405 (skip the APS pass when no partial spend exists) both change the avoidpartialspends coin-selection path; review together to avoid conflicting logic.
• Two PRs on importdescriptors timestamp/rescan semantics: #31668 (timestamp 'never') and #36236 (verify_balance with backwards rescan extension) will conflict; settle the intended import/rescan UX once.
• #35317 fixes one snake_case alias while reviewers asked for a project-wide RPC naming decision; the decision, not the patch, is the blocker.
• Stated base dependencies outside this category: #19460 sits on the multiprocess stack (#10102/#29409), #30343 on #29256/#34778, #25722 on #25665/#26022, and #34400/#35901 on the merged #34681.

• #36245: P2 alone, P1 after comparison. Promoted to P1: imported funds vanish on wallet reload and derivation blows up to O(M) on high range_start imports.
• #35752: P2 alone, P1 after comparison. Promoted to P1: same silent-persistence failure class as #35998, with a direct fund-loss scenario after restart.
• #36230: Perf regression flagged for 32.x backport, so placed ahead of feature work in this band.
• #29278: Valuable guardrail rather than an active defect, so below the measured performance and privkey-exposure work.
• #35492: Backup integrity (truncated dumps trusted as valid) kept just under the fund-safety cluster it neighbours.
• #32966: Biggest privacy feature here, but benefit is still uncertain (upstream libsecp dependency), so ranked below ready correctness and perf work.
• #35302: Sending builds on receiving and on #35301; discounted for the same uncertainty as #32966.
• #35742: Invalid multipath descriptors that break wallet reload; grouped with the other descriptor-correctness P2 items.
• #33033: P3 alone, P2 after comparison. Raised to P2: prerequisite for #33034, which itself unblocks #27865; it cannot sit below them.
• #33112: Enabling feature for hybrid signer and MuSig2 setups rather than an active defect, so below the correctness P2s.
• #34457: Privacy gain depends on the wider private-broadcast stack; placed below ready correctness work.
• #34533: Follow-up to #34457 and unresolved on package/CPFP rebroadcast, so reviewed after it.
• #35918: P3 alone, P2 after comparison. Raised to P2: like #36070 it is a prerequisite for the multisig wizard (#35645); the two must share a band.
• #36133: Real hardware-wallet interop value but the storage approach is contested; below the settled P2 items.
• #36040: Moved up: a confirmed on-chain fingerprinting defect outranks the deferrable convenience items around it.
• #35440: Moved up: out-of-bounds read on corrupted descriptor cache is a memory-safety fix, ahead of convenience P3s.
• #35760: Moved up: today's behaviour is an endless rescan from genesis on every startup, a real reliability defect.
• #35747: Moved up: concrete signing failure on owned inputs, grouped with the other bug fixes.
• #34698: Grouped with the other user-visible failure fixes (unhandled exception surfaced to RPC users).
• #36031: Encryption-key debt removal ranked with the other technical-debt cleanups.
• #30343: Internal logging standardisation; ranked with the other refactors rather than above behavioural fixes.
• #25722: Error-handling refactor with no observable behaviour change; ranked with the other refactors.
• #32993: Fuzz harness work grouped together below the behavioural fixes.
• #34264: Fuzz coverage grouped with the other harness PRs.
• #34907: Test hardening grouped with the other test-only changes.
• #35433: Deprecation cleanup is deferrable; placed below the fix and coverage work.
• #36122: Explicitly experimental draft accompanying unfinished BIP proposals; wallet-side value is speculative, so last among substantive P3s.
• #35342: P3 alone, P4 after comparison. Lowered to P4: reviewers argue fuzzing wallet RPCs without chain state or UTXOs has very low efficacy, so the coverage claim is weakly supported.
• #36068: Measured 4-6x fuzz throughput gain makes it the most useful of the marginal items.
• #35768: Minor validation fix, first among the purely cosmetic items.
• #36264: Help-text and error-argument accuracy touches every RPC caller, so ahead of the other cosmetic changes.
• #35429: Internal decoupling with no stated payoff; ranked with the other no-op cleanups.
• #35151: Pure deduplication of ~20 lines with no user-visible effect.
• #35358: P3 alone, P4 after comparison. Lowered to P4: the code has been absorbed into #36114, making this PR redundant.

This pass by claude-opus-5 on 2026-09-17 saw every PR in the category at once and checked the bands given to each PR alone against each other, ordered the PRs, and noted chains and overlaps. Back to the category.