(+) #36114 Sjors wallet: harden external signer psbt processing, revamp mock P1 · fund safety Ready 1 Strong 66 + 328 tests Prevent buggy or compromised external signers and bridge software from altering transaction outputs or fees Reject unsafe sighash flags and finalized inputs, merging returned PSBTs instead of replacing them wholesale Allow functional tests to simulate and test malicious signer responses using an offline descriptor wallet P1 because it protects wallet users from fund theft and output tampering by buggy or malicious signers Bitcoin Core previously accepted returned PSBTs without verifying outputs, sighash types, or sequence numbers Ready for review All reported concerns and suggestions have been addressed with test coverage Substantive support with no open objections Concept approval for hardening signer handling and improving test mocks (jeanpablojp) Verified rejection of unsafe sighashes, finalized inputs, and corrupted signatures via tests (fametrano) Resolved objection: finalized PSBTs could bypass unsafe sighash checks, fixed by rejecting them (jeanpablojp) 66 lines added or modified outside tests 328 lines added or modified in tests 69 lines removed in total 6 files, 8 commits (+) #35998 achow101 wallet: Handle or explicitly ignore `WalletBatch` write failures P1 · fund safety Waiting on author 0 Mild 155 + 3 tests Prevent wallet corruption and data loss by handling or explicitly ignoring database write and erase failures Ensure persistent on-disk records stay synchronized with in-memory wallet state P1 because unhandled database write failures risk wallet corruption and memory-to-disk divergence Systemic protection against data loss directly impacts wallet fund safety and storage reliability Conflicts with master; review the logic now, the rebase is mechanical Mild agreement overall, with an open objection awaiting author reply Concept approval for enforcing database error handling to keep memory and disk consistent (rkrux) Concept approval without detailed rationale (l0rinc) Unaddressed objection: reporting corruption on disk full or permission errors misleads and locks users out (vicjuma) Objections about specific write failure edge cases and backup behavior were answered by the author (jeanpablojp) 155 lines added or modified outside tests 3 lines added or modified in tests 82 lines removed in total 8 files, 11 commits (+) #35901 pablomartin4btc wallet: Fix ScanForWalletTransactions missing tx when look-ahead pool expands mid-block P1 · bug fix Ready 0 (+1) Strong 26 + 728 tests Prevent descriptor wallet rescans from silently missing transactions and showing incorrect balances Ensure transactions in the same block that precede pool-expanding transactions are properly detected P1 because it fixes silent transaction omissions and wrong balances during rescans and restores Affects users restoring wallets or importing descriptors when payments expand the look-ahead pool Substantive support across multiple reviewers with no open objections Concept approval despite rescanning performance trade-offs (achow101) Concept approval while confirming lookahead bug validity (molnard) Support for re-check cleanliness and approach (polespinasa) Objections around intra-block child spends and cascading receives resolved via retry loop (molnard, jeanpablojp) 26 lines added or modified outside tests 728 lines added or modified in tests 6 lines removed in total 7 files, 3 commits (+) #34193 furszy wallet: make migration more robust against failures P1 · bug fix Needs rebase 0 (+1) Strong 140 + 47 tests Prevent legacy wallet data loss by delaying deletion of original files until SQLite migration completes Automatically restore original wallets if migration fails instead of requiring manual backup recovery P1 after comparing with the other PRs here (assessed alone as P2): Raised: mid-migration failure can destroy the original legacy wallet files, and migration correctness is the category's second-ranked concern after fund safety. P2 because it prevents potential wallet data loss during legacy database migration to SQLite Protects migrating users from mid-process failures that previously required manual backup recovery Ready for review now, though a mechanical rebase on master is pending Substantive support with all prior concerns resolved Strong support for safer database staging and cleaner migration error handling (ryanofsky) 140 lines added or modified outside tests 47 lines added or modified in tests 106 lines removed in total 5 files, 8 commits (+) #35294 achow101 wallet: Update tx chain state during loading during AttachChain instead of before P1 · bug fix Waiting on author 0 (+2) Blocked 13 + 81 tests Prevent wallet crashes from assertion failures when loading after an unclean shutdown Keep wallet transaction confirmation states consistent so confirmed transactions cannot be abandoned P1 because it fixes an assertion failure crash when loading a wallet that fell behind the active chain tip Prevents confirmed transactions from being erroneously marked as eligible for abandonment Concept approval for closing a race condition during wallet loading (pablomartin4btc, rkrux) Verified and tested fix against the assertion failure (shuv-amp, dergoegge) Unaddressed objection: reverse iteration may not visit child transactions before parents (l0rinc) Requests a unit test because the functional test passes with the fix reverted (l0rinc) 13 lines added or modified outside tests 81 lines added or modified in tests 13 lines removed in total 4 files, 2 commits (+) #36398 mzumsande wallet: only rebroadcast transactions originating from the wallet P1 · bug fix Waiting on author 0 -1 Blocked 18 + 10 tests Prevent wallet nodes from leaking their IP addresses by no longer rebroadcasting incoming transactions Stop observers from linking addresses to nodes by sending low-fee probe transactions P1 because it fixes a decade-old privacy leak linking wallet ownership to node IP addresses Attackers can probe any address with a low-fee transaction and observe which node rebroadcasts it Concept approval if the behavior is made configurable (vasild) Unaddressed objection: rebroadcast aids confirmation and mempool presence is needed for CPFP (achow101) Unaddressed objection: wallet CPFP children fail to reload or rebroadcast after restart or expiry (fametrano) 18 lines added or modified outside tests 10 lines added or modified in tests 6 lines removed in total 3 files, 2 commits (+) #36583 yusufyildiz34 wallet: fix migration of watch-only wallets with transactions P2 · bug fix Ready 1 Crickets 9 + 55 tests Allow users to migrate legacy watch-only wallets that contain transactions to descriptor wallets Prevent crashes from unhandled exceptions when wallet migration aborts P2 because it fixes deterministic migration failures for watch-only wallets with transaction records Prevents unhandled exceptions on abort that bypass wallet migration cleanup No substantive feedback yet 9 lines added or modified outside tests 55 lines added or modified in tests 3 lines removed in total 5 files, 2 commits (+) #36245 kriss39 wallet: start descriptor top up at range_start instead of index 0 P2 · bug fix Ready 0 Crickets 6 + 37 tests Prevent ranged descriptor imports from expanding keys starting from zero instead of the start index Avoid extreme import delays and memory exhaustion when using high range start values Fix inconsistent ownership tracking where transactions appear owned but lose ownership on reload P2 because it fixes descriptor imports deriving from zero instead of the requested range start Prevents extreme import slowdowns and potential memory exhaustion from deriving up to 2^31 keys Eliminates transient ownership bugs where imported transactions lose IsMine status across restarts No review verdicts recorded No reviews or comments yet 6 lines added or modified outside tests 37 lines added or modified in tests 3 lines removed in total 2 files, 1 commits (+) #35760 achow101 wallet: make corrupted transaction records fail wallet loading instead of forcing a rescan P2 · bug fix Waiting on author 0 Mild 39 + 23 tests Fail wallet loading with a corruption error instead of triggering a full rescan on startup Prevent wallets with corrupted transaction records from running in an inconsistent state P2 because it stops corrupted wallets from repeatedly rescanning the whole chain on every startup Prevents running with partially loaded records that bypass spend tracking and conflict caches Ranking pass: Moved up: corrupt-record handling sits with the other wallet-load/storage correctness fixes rather than below feature work. Reviewing now is worthwhile as no rebase, CI failure, or pending rework blocks review General agreement that failing fast is better than triggering endless, unreliable rescans Unaddressed objection: failing to load locks users out of funds with no recovery option (vicjuma) Unaddressed objection: error message inverts stored and calculated transaction hashes (jeanpablojp) Approach approval because rescan cannot repair corrupted records (pablomartin4btc) 39 lines added or modified outside tests 23 lines added or modified in tests 23 lines removed in total 8 files, 5 commits (+) #35302 Eunovo Silent Payments: Sending (take 2) P2 · new feature Ready 0 Blocked 1,096 + 1,604 tests Allow users to send and fee-bump transactions to BIP 352 silent payment addresses via wallet RPCs and the GUI Prevent address reuse and improve receiver privacy by deriving dynamic taproot outputs at send time P2 because it provides substantial user privacy value by enabling BIP 352 silent payment sending in the wallet Strategic milestone tracked in issue #28536 that unblocks further silent payment work Ready for review Open author action item to address an anchor filtering objection does not block review Blocked by unresolved objections regarding anchor filtering and MSVC build failure (Yudis-bit) Concept approval without stated reasons (rkrux, rustaceanrob, w0xlt) Unaddressed objection: anchor filtering drops valid inputs when subtracting fee at high feerates (Yudis-bit) Unaddressed objection: MSVC compilation fails in walletmodel due to deleted move constructor (Yudis-bit) Concerns on RBF recipient persistence loss and tx identity loss across restarts were answered (Yudis-bit) 1,096 lines added or modified outside tests 1,604 lines added or modified in tests 261 lines removed in total 43 files, 11 commits (+) #35990 shuv-amp wallet: harden the read-only BDB parser against crafted files P2 · DoS protection Ready 1 Strong 35 + 230 tests Harden the read-only Berkeley DB parser against crafted or corrupted files during wallet migration Prevent infinite loops, exponential traversal, and large memory bloat when loading legacy wallets P2 because malformed BDB files can hang wallet migration indefinitely or inflate memory to ~800 MB Protects users against denial-of-service and crashes when parsing corrupted legacy wallet databases Ranking pass: Moved up: hardening the BDB parser is on the migration path every legacy user must cross, grouping it with the other migration fixes. Ready for review; no known blockers or rework needed Substantive support with no open objections Verified bug reproduces on master and resolves here across migration and unit tests (fametrano) 35 lines added or modified outside tests 230 lines added or modified in tests 5 lines removed in total 3 files, 4 commits (+) #36494 thomasbuilds wallet: reject unknown options in sendall P2 · fund safety Ready 2 -1 Mild 26 + 11 tests Reject unknown keys in the sendall RPC options parameter Protects users from accidental wallet-wide spends or unintended broadcasts caused by typos P2 because typos in sendall options can trigger severe errors like spending all wallet UTXOs Prevents accidental transaction broadcast when callers misspell options like add_to_wallet Ranking pass: Moved up: an unnoticed typo spending every wallet UTXO is a fund-safety defect, ranked with the other fund-safety P2s. Ready for review Nothing known that would invalidate a review Agreement on rejecting unknown options to prevent unintended behavior Support for rejecting unknown fields explicitly instead of silently ignoring them (maflcko) Verified by testing that misspelled options fail rather than broadcast on regtest (Zippo76) Objection to removing solving_data addressed by keeping the option (polespinasa) Open suggestion to add a release note for the validation change (kevkevinpal) 26 lines added or modified outside tests 11 lines added or modified in tests 1 lines removed in total 3 files, 1 commits (+) #36387 davidgumberg wallet: rpc: Deprecate `encryptwallet` RPC for encrypting existing wallets. P2 · fund safety Waiting on author 0 Strong 16 + 134 tests Deprecate encrypting existing wallets to prevent fund loss and backup invalidation Avoid leaving unencrypted keys on disk or unexpectedly altering spending conditions on users P2 because encrypting active wallets risks fund loss by invalidating prior backups unexpectedly Unencrypted key material can remain on storage and imported descriptor conditions can silently mutate Ready to review Author response to documentation notes on GUI encryption scope is pending Concept approval noting creating new encrypted wallets and sweeping is cleaner (pablomartin4btc) Nonblocking suggestion to clarify GUI deprecation scope in release notes (pablomartin4btc) Concept approval without stated reasons (pseudoramdom, w0xlt) 16 lines added or modified outside tests 134 lines added or modified in tests 73 lines removed in total 18 files, 8 commits (+) #35492 OSINTv96 wallet: fail dump on incomplete writes P2 · bug fix Author silent 100d 2 Strong 54 + 19 tests Ensure wallet dump fails with an error if writes fail instead of silently succeeding Prevents leaving behind a truncated, corrupted dump file when filesystem writes fail P2 because it prevents silent backup corruption when a dump runs out of disk space or hits I/O errors Users would otherwise be left with a truncated dump file while the tool reports success Ranking pass: Moved down slightly: silent truncated dumps matter, but less than the load/migration corruption fixes above it. Author has been silent for 90 days, so review feedback may wait a long time for a response Substantive support with all suggestions addressed Verified that disk durability is guaranteed across crashes and test coverage is added (pablomartin4btc) Code approval without detailed rationale (maflcko) 54 lines added or modified outside tests 19 lines added or modified in tests 43 lines removed in total 2 files, 2 commits (+) #34872 w0xlt wallet: fix mixed-input transaction accounting in history RPCs P2 · bug fix Needs rebase 0 (+1) -1 Mild 270 + 828 tests Prevent wallet history RPCs from reporting false recipient send entries and negative fees for mixed-input transactions Give users accurate accounting for collaborative transactions like CoinJoins and Payjoins P2 because it fixes a long-standing accounting flaw in history RPCs for collaborative transactions Users of CoinJoins and Payjoins will no longer see fabricated sends and erroneous or negative fees Initial approach objections against omitting send entries were addressed by a reworked proposal (luke-jr, rkrux, achow101) Past objection against omitting send entries has not been explicitly re-reviewed (achow101) Concept support for avoiding false history accounting on collaborative transactions (rkrux, murchandamus, arejula27) Tested on regtest and supported because the wallet avoids showing unverifiable data (Bicaru20) 270 lines added or modified outside tests 828 lines added or modified in tests 64 lines removed in total 11 files, 16 commits (+) #36154 jeanpablojp wallet: fill PSBT_GLOBAL_XPUB P2 · bug fix Ready 0 Neutral 160 + 251 tests Populate BIP 174 global xpubs when the wallet creates or updates PSBTs Allow stateless external signers to verify multisig policies and derivation paths without manual coordinator workarounds P2 because it fixes signing failures and interoperability issues with stateless hardware signers Resolves device rejections from BitBox02 and Trezor and removes coordinator workarounds Ranking pass: Moved up: stateless-signer refusals are a concrete interoperability failure, ranked with the other PSBT correctness fixes. Neutral overall with objections settled but no explicit approvals yet Author addressed objections regarding multisig-only restriction and MuSig key handling (achow101) Noted global xpub utility for non-HWI flows while asking for description clarifications (Sjors) 160 lines added or modified outside tests 251 lines added or modified in tests 3 lines removed in total 14 files, 2 commits (+) #36539 davidgumberg gui: Use PSBT v0 P2 · bug fix Ready 2 Positive 19 + 5 tests Restore PSBTv0 creation in the GUI for unsigned sends and watch-only fee bumping Fix interoperability with third-party wallet tools and hardware signers that reject PSBTv2 P2 because it fixes an interoperability regression introduced in 32.0 Prevents external wallet software and hardware signers from rejecting GUI-exported watch-only transactions Ranking pass: Moved up: it fixes a shipped 32.0 interoperability regression, which outranks the feature-oriented P2s. Support without stated reasons, no open objections (Sjors, w0xlt) Earlier scope objection to adding UI controls for backport resolved by keeping v0 default (achow101) 19 lines added or modified outside tests 5 lines added or modified in tests 10 lines removed in total 8 files, 2 commits (+) #36352 FlashWayne psbt: clear Taproot and MuSig2 signatures when joining P2 · bug fix Ready 1 Strong 4 + 26 tests Ensure joined PSBTs can be signed and finalized when using Taproot inputs Avoid broken transactions and manual PSBT editing after running joinpsbts P2 because it fixes broken Taproot transaction signing and finalization after joining PSBTs Users combining Taproot PSBTs will no longer get incomplete transactions requiring manual PSBT edits Ranking pass: Moved up: grouped with the other PSBT signing/finalization correctness fixes. Strong support with testing verifying stale Taproot and MuSig2 data is dropped on join (fametrano) Confirmed the functional test fails if any of the clearing steps are removed (fametrano) 4 lines added or modified outside tests 26 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #34533 vasild wallet: resubmit transactions with private broadcast if enabled P2 · bug fix Waiting on author 0 (+2) Mild 11 + 43 tests Prevent wallet rebroadcasts from leaking node IP addresses when private broadcast is enabled Route periodic rebroadcasts through anonymized connections instead of public broadcast P2 after comparing with the other PRs here (assessed alone as P1): Lowered from P1: same defect as #36330 P1 because the wallet resubmission logic exposes user IP addresses on public broadcast It resolves a serious privacy defect for wallet users configuring private broadcast Author silent for 159 days; reviews may wait a long time for a response Support for routing wallet rebroadcasts through the private broadcast mechanism (pablomartin4btc, w0xlt) Approval without stated reasons (andrewtoth) Unaddressed objection: attacker can send dust to force public rebroadcasts unless IsMine is handled (mzumsande) Answered objection: private broadcast to random peers delays dependent transactions like CPFP (achow101) 11 lines added or modified outside tests 43 lines added or modified in tests 11 lines removed in total 2 files, 2 commits (+) #36648 fametrano descriptor, rpc, wallet: do not echo key material in error messages P2 · bug fix CI failing 0 (+1) Positive 32 + 131 tests Prevent private keys and key material from leaking into error messages Keep secret data out of application logs, error reporters, and screenshots when descriptor parsing fails P2 because it prevents private keys from appearing in errors during descriptor imports and coin funding Protects wallet key confidentiality whenever descriptor parsing or derivation fails Check whether the CI failure is from this PR before deep review Support without stated reasons (jpk68) Author addressed concerns about error clarity and key indexing, awaiting follow-up (uqlidi) 32 lines added or modified outside tests 131 lines added or modified in tests 62 lines removed in total 11 files, 1 commits (+) #36330 instagibbs wallet: don't resubmit transactions under -privatebroadcast P2 · bug fix Waiting on author 3 -2 Blocked 10 + 21 tests Stop unconfirmed wallet transactions from being resubmitted when private broadcast is enabled Prevent nodes from leaking their identity as transaction senders or receivers over clearnet P2 because it keeps the wallet from violating user privacy expectations under private broadcast Prevents incoming dust or dropped transactions from triggering unexpected rebroadcasts Ranking pass: Moved up to sit directly beside #34533 Unaddressed objection: removing rebroadcast drops useful functionality and needs a general fix (polespinasa) Objection: coupling rebroadcast to private broadcast contradicts docs and disables a wallet feature (vasild) Supports preventing unexpected rebroadcast of wallet-associated transactions over clearnet (andrewtoth) Simple fix that is suitable for backporting (davidgumberg) 10 lines added or modified outside tests 21 lines added or modified in tests 0 lines removed in total 3 files, 1 commits (+) #36482 achow101 wallet: Only broadcast resubmitted transactions that were added to the mempool P2 · bug fix Waiting on author 0 Mild 15 + 148 tests Stop periodic wallet rebroadcasts from re-announcing transactions already resident in the local mempool Prevents leaking user IP and transaction ownership to connected peers P2 because it fixes a privacy leak that reveals wallet ownership and user IP to peers Redundant rebroadcasts signal to peers that the node has a special interest in unconfirmed transactions Support for the privacy fix, but an objection remains unanswered Strong support because it is an obvious privacy improvement (murchandamus) Unaddressed objection: attackers can still probe addresses, leaving receiver privacy leak open (mzumsande) Verified rebroadcast suppression on regtest and suggested extending test coverage (fametrano) Concept approval without stated reasons (polespinasa) 15 lines added or modified outside tests 148 lines added or modified in tests 65 lines removed in total 5 files, 5 commits (+) #36420 Yudis-bit descriptor: compare x-only public keys in Tapscript Miniscript duplicate check P2 · bug fix Ready 0 (+1) Strong 6 + 20 tests Prevent duplicate public keys differing only by parity from passing Tapscript Miniscript sanity checks Protect descriptor wallets against third-party transaction malleability from identical script branches P2 because it fixes a descriptor validation bug that breaks BIP-379 non-malleability guarantees Prevents third parties from malleating transactions by switching branches without private keys Strong support with thorough test verification (fametrano) Confirmed new tr descriptor tests fail as expected without the descriptor comparison fix (fametrano) Resolved earlier feedback by dropping an invalid multi_a test and adding a WIF test case (fametrano) 6 lines added or modified outside tests 20 lines added or modified in tests 1 lines removed in total 3 files, 1 commits (+) #33033 achow101 wallet, sqlite: Encapsulate SQLite statements in a RAII class P2 · cleanup Needs rebase 0 (+3) Blocked 230 Automate SQLite statement lifecycle management in the wallet database backend Prevent resource leaks and manual allocation errors across wallet database operations Clean up database code in preparation for more complex SQL statements P2 after comparing with the other PRs here (assessed alone as P3): Raised from P3: it is the prerequisite for #33034 #27865 P3 because it is an internal refactoring to reduce database boilerplate and prevent resource leaks Prepares the wallet SQLite backend for upcoming work on storing transactions in a separate table Provides no direct user-facing bug fix or feature Ready to review Nothing known that would invalidate a review now Unaddressed safety objection: copying statements causes double finalization and crash (polespinasa) Unaddressed objection: uncompiled trailing SQL is silently ignored without checking pzTail (Eunovo) Approved after error handling and finalization reviews (vasild, pablomartin4btc, w0xlt) Concept approval without full implementation signoff (rkrux, polespinasa) 230 lines added or modified outside tests 0 lines added or modified in tests 212 lines removed in total 2 files, 10 commits (+) #33034 achow101 wallet: Store transactions in a separate sqlite table P2 · unblocks #27865 Needs rebase 0 Strong 1,036 + 9 tests Store wallet transactions in a dedicated SQLite table so they load in sequential order Simplify wallet transaction state reconstruction by eliminating composite key-value serialization P2 because it unblocks sequential transaction ordering in #27865 Significantly reduces architectural complexity when reasoning about sequential dependencies Prevents wallet loading issues caused by arbitrary database iteration order Ranking pass: Moved up to keep the #33033 #33034 #27865 Review #32895 and #33033 Conflicts with master, but review is worthwhile now because the rebase is mechanical Clean concept support with no objections raised Concept approval because relational tables make transaction serialization cleaner and explicit (rkrux) Concept approval without stated reasons (w0xlt) 1,036 lines added or modified outside tests 9 lines added or modified in tests 256 lines removed in total 15 files, 27 commits (+) #27865 achow101 wallet: Track no-longer-spendable TXOs separately P2 · speedup Needs rebase 0 (+1) Mild 389 + 160 tests Speed up balance calculation and coin selection for active wallets with extensive transaction histories Avoid repeatedly scanning outputs that are already spent or conflicted P2 because it cuts balance checking and coin selection overhead by orders of magnitude for active wallets Synthetic benchmarks demonstrate up to 500x speedups by excluding spent historical outputs Ranking pass: Moved down: large speedup, but it is the tip of a chain whose bases (#33033 #33034 Worth reviewing now because the rebase conflict with master is mechanical Broad support for massive performance improvements on large wallets (remyers, w0xlt, Zeegaths) Concept approval as a natural follow-up or pending performance verification (murchandamus, jonatack, rkrux) Unaddressed objections: reorg balance omissions, assertion aborts, and db writes on load failure (jeanpablojp) 389 lines added or modified outside tests 160 lines added or modified in tests 162 lines removed in total 18 files, 19 commits (+) #34400 Eunovo wallet: parallel fast rescan (approx 8x speed up with 8 threads) P2 · speedup Ready 0 Strong 561 + 177 tests Speed up wallet fast rescans and restores on multi-core systems Cut rescan times from several minutes down to under one minute by checking filters in parallel P2 because fast rescan times drop by 3x to 8x on multi-core systems Rescanning large block ranges or restoring wallets finishes much faster for users Ranking pass: Moved down: a real user-visible speedup, but ranked below the correctness and privacy fixes above it. Strong support with verified benchmark speedups and all earlier concerns resolved Verified 4.5x to 6x rescan speedup in benchmarks (ismaelsadeeq) Verified 3x speedup on HDD hardware (l0rinc) Strong concept approval after moving away from a shared threadpool (rkrux) Concept approval without stated reasons (w0xlt) 561 lines added or modified outside tests 177 lines added or modified in tests 139 lines removed in total 8 files, 7 commits (+) #33112 Sjors wallet: relax external_signer flag constraints P2 · new feature Ready 0 (+3) Strong 179 + 91 tests Allow external signer wallets to keep private keys enabled and let existing wallets toggle the signer flag Enables hybrid multisig and MuSig2 setups combining local hot keys with external signer devices P2 because it unblocks hybrid multisig and MuSig2 setups combining hot keys with external signer devices Users can manage joint hot and hardware-signed keys in a single wallet instead of forcing watch-only mode Ranking pass: Moved down: prerequisite value for MuSig2/hardware multisig is real but speculative relative to shipped-bug fixes. Broad support with multiple tested ACKs and all prior objections addressed Unblocks hybrid hot-key and external-signer multisig workflows (PraneethGunas) Verified by testing on mock signers, CLI, and GUI workflows (adyshimony, naiyoma, jeanpablojp) Confirmed hardware signer fix on Ledger Flex (PraneethGunas) Verified signing reduces repeated calls to the external device (fametrano) 179 lines added or modified outside tests 91 lines added or modified in tests 136 lines removed in total 11 files, 10 commits (+) #35377 achow101 wallet: Allow importing of descriptors without private keys when the wallet has the private keys P2 · user request Waiting on author 0 Blocked 140 + 74 tests Allow importing public descriptors into a wallet that already has the private keys Avoid exposing sensitive private key material in RPC calls when importing descriptors P2 because it fulfills a long-standing user request for descriptor imports Improves operational security by eliminating the need to expose private keys over RPC Ranking pass: Moved down: long-requested usability/opsec improvement, ranked below the correctness fixes. CI is failing due to an IWYU header issue Awaiting author response to duplicate descriptor creation on re-import Concept support for avoiding manual private key handling (rkrux, polespinasa, Sjors) Unaddressed objection: re-importing an existing descriptor creates a duplicate descriptor ID (fametrano) Unaddressed objection: missing array header causes an IWYU build failure (fametrano) Open suggestion: consider giving parsing access to the wallet extended keys instead (Sjors) 140 lines added or modified outside tests 74 lines added or modified in tests 19 lines removed in total 7 files, 4 commits (+) #32966 Eunovo Silent Payments: Receiving P2 · new feature Needs rebase 0 Neutral 15,289 + 3,665 tests Add BIP 352 Silent Payments receiving capabilities to the Bitcoin Core wallet Allow users to share a single static address without sacrificing privacy from address reuse P2 because it delivers major user privacy gains by enabling silent payment address reception Substantial new milestone capability rather than an urgent fund-safety or bug fix Ranking pass: Moved down: depends on the sending work (#35302 Review the logic now as the required rebase is mechanical No review verdicts recorded Prior objections are largely settled, but no reviewers have formally endorsed the PR yet Agreed to fix missed block sync payments and fragile test checksums on rebase (bitsagarob, rkrux) Addressed earlier issues with change outputs, block filters, and immutable wallet flags (Sjors) Scoped key tweaking methods specifically to BIP 352 to avoid generic footguns (josibake) 15,289 lines added or modified outside tests 3,665 lines added or modified in tests 165 lines removed in total 94 files, 41 commits (+) #36442 achow101 descriptor: Represent multipath descriptors in a single Descriptor object P2 · new feature Waiting on author 0 Blocked 642 + 163 tests Preserve multipath descriptor strings during parsing instead of immediately splitting them Enable RPCs like getdescriptorinfo to return the original unexpanded multipath descriptor P2 because it lets wallet RPCs return and round-trip original multipath descriptor strings It unblocks follow-on multipath descriptor functionality Ranking pass: Moved down slightly to head the multipath chain #36442 #36443 #36444 Review the logic now; conflicts with master are mechanical and will need a rebase Unaddressed objection: migratewallet marks all imported key origin steps as hardened (fametrano) Suggested adding a release note for changed display formatting of mixed hardening characters (fametrano) Concept approval without stated reasons (w0xlt, Sjors) 642 lines added or modified outside tests 163 lines added or modified in tests 712 lines removed in total 39 files, 8 commits (+) #36443 achow101 descriptor: Reconstruct a multipath descriptor from its expansion P2 · new feature Waiting on author 0 Blocked 900 + 331 tests Recover a unified multipath descriptor from its expanded single-path sibling descriptors Allow reversing descriptor expansion back into the original combined multipath form P2 after comparing with the other PRs here (assessed alone as P3): Raised from P3: it is the prerequisite for P2 #36444 P3 because it provides a helper to reconstruct unified multipath descriptors from their expansions Offers clear utility for descriptor workflows without addressing critical blockers or fund-safety risks Review #36442 Ready to review now because the rebase conflict against master is mechanical Unaddressed objection: accepts repeated path values instead of failing (fametrano) Verified by testing against btclib-wallet that repeated values yield invalid output (fametrano) Concept approval without stated reasons (w0xlt) 900 lines added or modified outside tests 331 lines added or modified in tests 709 lines removed in total 39 files, 12 commits (+) #36444 achow101 wallet: Store information about created and imported multipath descriptors P2 · new feature Needs rebase 0 Positive 1,047 + 389 tests Preserve multipath descriptor relationships for imported and generated wallet descriptors Allows users coordinating with hardware signers to retrieve original descriptors for policy registration P2 because it unlocks hardware signer workflows that require policy registration Users can retrieve and re-verify original multipath descriptors through RPC Review #36442 #36443 Needs rebase against master, but logic can be reviewed now Early concept support with no technical objections Concept approval without stated reasons (w0xlt) 1,047 lines added or modified outside tests 389 lines added or modified in tests 740 lines removed in total 45 files, 18 commits (+) #10102 ryanofsky Multiprocess bitcoin P2 · new feature Review #29409 0 (+1) -1 Strong 4,152 + 197 tests Run Bitcoin Core node, wallet, and GUI components in isolated processes Prevent memory corruption or crashes in the GUI or wallet from compromising or taking down the node P2 because running the wallet as an independent process shields the node from wallet crashes Provides durable isolation against wallet-level memory corruption vulnerabilities Broad support for the architectural direction of process separation (jonasschnelli, gmaxwell, dcousens, laanwj) Concept approval citing ability to run the node continuously while opening the GUI on demand (Sjors) Concerns over Cap'n Proto dependency were accepted as internal IPC for this change (gmaxwell, dcousens) Open question on whether capnp should be added to depends in a future PR (Sjors) 4,152 lines added or modified outside tests 197 lines added or modified in tests 634 lines removed in total 146 files, 24 commits (+) #36344 Bruce039 wallet: reject duplicate inputs in sendall P3 · bug fix Ready 2 (+1) Strong 4 + 19 tests Prevent sendall from creating consensus-invalid transactions when duplicate inputs are specified Avoids locking UTXOs and displaying a negative balance that requires manual transaction abandonment P3 because it fixes an RPC bug that locks wallet UTXOs when duplicate inputs are passed to sendall Resolves invalid transaction generation and negative balance accounting without risk of permanent fund loss Ready to review Nothing known that would invalidate a review now Substantive support with no open objections Verified state transition with functional tests (l0rinc) Tested on Windows confirming duplicate inputs are properly rejected (molnard) Approval without stated reasons (achow101) 4 lines added or modified outside tests 19 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #36342 Bruce039 wallet: reject recipient amounts above MAX_MONEY P3 · bug fix Ready 0 (+1) Strong 3 + 22 tests Prevent node assertion crashes and integer overflows when wallet transaction creation receives huge amounts Reject recipient amounts and totals exceeding the maximum money limit before coin selection P3 because it fixes node crashes and overflow bugs caused by amounts exceeding maximum money Triggering the bug requires an authenticated RPC caller to provide invalid out-of-range amounts Ranking pass: Moved up: it prevents an assertion crash and an int64 overflow, the strongest of the P3 bug fixes. Substantive support as a helpful sanity check and improvement for sanitizers (maflcko) Loop refactoring feedback addressed and incorporated (furszy, maflcko) Nonblocking suggestion to close other PRs and focus on one to avoid review fatigue (pinheadmz) 3 lines added or modified outside tests 22 lines added or modified in tests 4 lines removed in total 2 files, 1 commits (+) #36313 ArvinFarrelP wallet: fix persistent coin lock upgrade P3 · bug fix Ready 1 Strong 4 + 39 tests Prevent spent coins from reappearing as locked when a wallet is restarted or reloaded Ensure upgraded persistent coin locks are properly cleared when coins are spent P3 because it fixes an edge-case locking inconsistency that does not risk funds or wallet corruption Prevents confusing ghost locks for wallet users upgrading temporary coin locks before spending Ranking pass: Moved up: a reproducible persistent-lock bug with a linked issue outranks the P3 cleanups it was scored beside. Review is worthwhile now with no blocking changes or pending author updates General agreement that the fix is correct and improves wallet consistency (vicjuma, jcastros) Verified through manual testing and automated regression tests (vicjuma, jcastros) Previous objection about temporary locks downgrading persistent locks was fixed and verified (jcastros) 4 lines added or modified outside tests 39 lines added or modified in tests 1 lines removed in total 2 files, 1 commits (+) #34603 achow101 wallet: Fix detection of symlinks on Windows P3 · bug fix Author silent 159d 0 Strong 30 + 27 tests Detect symlinks properly on Windows builds Prevents wallets from unintentionally traversing symlinked directories or misclassifying symlinks P3 because it fixes unintended recursive traversal of directory symlinks on Windows Resolves platform discrepancies and restores functional test coverage for Windows wallet paths Author has been silent for 121 days so reviews may wait long for a response Concept approval with testing across MinGW, MSVC, and clang-cl on Windows 11 (molnard) Approval without detailed rationale (sedited) Resolved objection regarding redundant filesystem checks (luke-jr) 30 lines added or modified outside tests 27 lines added or modified in tests 40 lines removed in total 5 files, 4 commits (+) #34698 shuv-amp wallet: handle MiniMiner bump fee calculation failures P3 · bug fix Waiting on author 1 Strong 33 + 114 tests Return clear user-facing errors when wallet fee calculation fails on large unconfirmed transaction clusters Prevent transaction creation RPCs from failing with a cryptic internal exception P3 because it fixes transaction creation failing with a cryptic internal exception during an edge case Only affects spending unconfirmed coins whose mempool cluster exceeds 500 transactions Strong support with bug reproduction and validation across releases (DevaanshPathak) Approved after earlier error propagation concerns were addressed (achow101) Nonblocking suggestion to document or assert MiniMiner return invariants (DevaanshPathak) Open question asking to confirm RPC error code mapping for send (DevaanshPathak) 33 lines added or modified outside tests 114 lines added or modified in tests 37 lines removed in total 11 files, 1 commits (+) #36393 gjija wallet: enforce max_tx_weight for preset inputs P3 · bug fix Ready 0 (+1) Strong 5 + 14 tests Enforce caller-specified max_tx_weight when preset inputs fully cover a wallet transaction Prevents RPC calls like fundrawtransaction from generating transactions heavier than requested P3 because it fixes a bug where explicit weight limits were ignored when coin selection was bypassed Affects users funding transactions with preset inputs who rely on max_tx_weight constraints Ranking pass: Moved up: an explicitly requested constraint being silently ignored is a bug, ranked with the other P3 bug fixes. Ready for review, with no known blockers or invalidating changes Substantive support with no open objections Verified fix by reproducing max_tx_weight behavior with legacy inputs and functional tests (jcastros) Verified fix by testing transactions with preset inputs and outputs (vicjuma) Resolved question on whether to enforce TRUC child limits now or in a follow-up (jcastros) 5 lines added or modified outside tests 14 lines added or modified in tests 3 lines removed in total 2 files, 1 commits (+) #36040 Bicaru20 Wallet: Don't backdate locktime rbf P3 · bug fix Ready 0 (+2) Strong 28 + 137 tests Prevent fee-bumped wallet transactions from receiving an older locktime than the original Eliminates an unnatural on-chain pattern that fingerprints the wallet as Bitcoin Core P3 because it fixes an on-chain privacy leak where fee bumps fingerprint wallet software The backdating flaw only affects an estimated 200 to 300 replacement transactions per week Ready to review Nothing known that would invalidate a review now Strong support with no open objections after addressing edge cases and test flakiness Verified by code review and running tests locally (molnard, nervana21) Approach approval (polespinasa) Concept approval without stated reasons (vicjuma) Contested suggestion to place locktime logic inside anti-fee-sniping check (achow101) 28 lines added or modified outside tests 137 lines added or modified in tests 8 lines removed in total 6 files, 2 commits (+) #36005 pythcoiner rpc, descriptor: warn when multipath expansion clones single-path key expressions P3 · bug fix Needs rebase 1 Strong 57 + 88 tests Warn users when multipath descriptor expansion duplicates single-path keys across branches Prevent unintended key reuse and address clustering between receive and change outputs Expose descriptor warnings during inspection rather than waiting until wallet import P3 because it alerts users to unintended key reuse across receive and change wallet paths Prevents privacy loss from silent key cloning when mixing multipath and single-path keys Needs rebase due to conflicts with master, but the descriptor logic is ready to review Verified by testing that deliberate code mutations fail the new unit and functional tests (jeanpablojp) Suggested adding test coverage for multiple simultaneous warnings (jeanpablojp) 57 lines added or modified outside tests 88 lines added or modified in tests 10 lines removed in total 8 files, 4 commits (+) #36577 fametrano psbt: accept taproot ALL sigs with sighash unset P3 · bug fix Ready 1 Strong 8 + 79 tests Accept valid 65-byte Taproot SIGHASH_ALL signatures when the PSBT sighash type is unset Prevents false mismatch errors that block downstream signing and finalization with external signers P3 because it fixes an interoperability bug where valid 65-byte Taproot signatures trigger SIGHASH_MISMATCH Restores multi-signer and finalization workflows when external signers omit the sighash type field Ranking pass: Moved up to sit with the other PSBT signing interoperability fixes (#36039 #35747 Support because SIGHASH_ALL and SIGHASH_DEFAULT commit to the identical BIP-341 digest (Husteem) Verified by testing on Windows (Yudis-bit) 8 lines added or modified outside tests 79 lines added or modified in tests 2 lines removed in total 2 files, 1 commits (+) #36039 btcpavao psbt: classify missing Taproot script-path signatures as signer P3 · bug fix Waiting on author 0 Strong 12 + 11 tests Classify missing Taproot script-path signatures properly during PSBT analysis Prevent misleading wallet warnings that inputs are missing information when ready to sign P3 because it fixes a false warning in the GUI when signing Taproot script-path spends Prevents PSBT analysis from misclassifying inputs as needing an updater instead of a signer No review verdicts recorded Verified by testing that unsigned script-path PSBT inputs correctly transition to signer (fametrano) Suggestion to avoid an output parameter by updating signature data directly (achow101) Suggestion to cover key-path changes with tests if adopting the suggested restructure (fametrano) 12 lines added or modified outside tests 11 lines added or modified in tests 3 lines removed in total 3 files, 1 commits (+) #35747 nervana21 wallet: Fix FillPSBT failing to sign owned inputs when UTXOs disagree P3 · bug fix Ready 1 Strong 9 + 85 tests Ensure the wallet successfully signs owned inputs when a PSBT input has conflicting UTXO data Prevents confusing signing failures caused by mismatched witness and non-witness UTXO records P3 after comparing with the other PRs here (assessed alone as P2): Lowered from P2: only yields an incomplete PSBT, never a bad signature, matching #36577 #36039 P2 because it fixes wallet signing failures on owned inputs during multi-step PSBT workflows Prevents failures when buggy or malicious coordinators provide conflicting UTXO records Ready to review Nothing known that would invalidate a review now Verified by testing reproduction and fix on master (8144225309) Confirmed script selection now aligns across PSBT signing steps (8144225309) Clarified coordinator risks and failure modes after question (vicjuma) 9 lines added or modified outside tests 85 lines added or modified in tests 7 lines removed in total 4 files, 2 commits (+) #36489 maflcko wallet: rpc: Add snake_case aliases for wallet funding options P3 · bug fix Ready 1 Mild 43 + 11 tests Make wallet funding RPC option names consistently support snake_case Reject conflicting camelCase and snake_case options instead of silently ignoring one Fix a bug where subtract_fee_from_outputs was silently ignored by the server P3 because it fixes an ignored fee subtraction option and standardizes wallet funding RPC options Modest usability and consistency improvement that is reasonably deferrable Verified fixes on regtest after reproducing issues on master (Conradgabe) Concept approval without stated reasons (psychemist, kevkevinpal) Objection answered: schema rejects camelCase options still accepted by server, breaking validating clients (fametrano) Unanswered suggestion to update leftover camelCase names in help and error text (fametrano) 43 lines added or modified outside tests 11 lines added or modified in tests 18 lines removed in total 7 files, 2 commits (+) #36597 pseudoramdom wallet: return broadcast errors from CommitTransaction P3 · bug fix Waiting on author 0 Positive 150 + 110 tests Let wallet frontends learn whether a transaction was accepted into the mempool. Stops interfaces like the QML GUI from reporting transactions as sent when rejected by the node. P3 after comparing with the other PRs here (assessed alone as P2): Lowered from P2: no behavior change for current Core callers; the payoff accrues to downstream gui-qml, like #36685 P2 because it fixes a flaw where broadcast errors were discarded and only logged internally. Prevents callers from falsely reporting success when the node rejects a transaction. Concept approval without stated reasons (w0xlt, Naomi-Gift) Author clarified why synchronous broadcast errors are needed rather than async alerts (maflcko) Open request to add interface test coverage for mempool rejections (ViniciusCestarii) 150 lines added or modified outside tests 110 lines added or modified in tests 116 lines removed in total 22 files, 4 commits (+) #36685 vasild wallet: export replaces_txid and replaced_by_txid P3 · bug fix Ready 2 Strong 4 Restore transaction replacement metadata to the wallet interface after an earlier cleanup removed it Allows downstream interfaces like gui-qml to display replacement transaction details P3 because it restores replacement transaction IDs lost in an earlier interface cleanup Downstream consumers like gui-qml need these fields to display replacement details Ranking pass: Moved up to sit beside #36597 Strong support with no open objections Confirmed gui-qml lost access when the backing value map was removed (pseudoramdom) Supports merging so downstream gui-qml can update (johnny9) 4 lines added or modified outside tests 0 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #32857 Sjors wallet: allow skipping script paths P3 · new feature Author silent 69d 0 (+1) Strong 66 + 177 tests Allow wallet users spending Taproot outputs to restrict spending to key paths Prevents fee waste and privacy leaks from exposing fallback scripts prematurely P3 because it lets Taproot users avoid fee waste and metadata leakage from unused script paths Reduces risk of triggering firmware bugs in external signing devices Prevents accidental broadcast of fallback recovery scripts during normal spends Strong support with no open objections Concept approval citing useful motivation and clear use cases (rkrux) Concept approval without stated reasons (w0xlt) Tested spending tests pass and script paths remain untouched (jeanpablojp) 66 lines added or modified outside tests 177 lines added or modified in tests 27 lines removed in total 13 files, 9 commits (+) #35370 junbyjun1238 rpc: add key-origin modes to PSBT processing RPCs P3 · user request Waiting on author 0 Blocked 86 + 245 tests Allow PSBT processing RPCs to explicitly add, preserve, or strip key-origin derivation metadata Let participants in collaborative workflows sanitize sensitive derivation paths and xpubs before sharing P3 because users in collaborative workflows can sanitize sensitive derivation paths and xpubs Prevents leaking internal wallet structure before sharing transactions with outside signers Ranking pass: Moved down: resolves a long-standing issue, but it is a feature addition behind the P3 bug fixes. Author has been silent for 84 days New reviews may wait a long time for an author response Concept and approach approval for adding strip options to PSBT processing RPCs (willcl-ark, rkrux) Unaddressed objection: strip mode breaks MuSig2 signing on PSBTs lacking key origins (fametrano) Open question on whether participant pubkeys should also be stripped to avoid fingerprinting (fametrano) 86 lines added or modified outside tests 245 lines added or modified in tests 10 lines removed in total 9 files, 2 commits (+) #36236 musaHaruna wallet, rpc: add verify_balance option to importdescriptors P3 · user request Needs rebase 0 Crickets 320 + 250 tests Prevent missed transactions and inaccurate balances when importing descriptors with too-recent timestamps Let users verify imported wallet balances against the active chainstate UTXO set P3 because it helps users who import descriptors avoid silent balance inaccuracies Directly resolves a user-requested check against the active UTXO set Ranking pass: Kept with the descriptor-import feature group. Reviewable now, with no blockers or rebases required No review verdicts recorded No external review comments yet 320 lines added or modified outside tests 250 lines added or modified in tests 46 lines removed in total 11 files, 4 commits (+) #35918 pseudoramdom descriptor: Expose key expression parsing P3 · unblocks #35645 Ready 1 Positive 125 + 185 tests Allow wallet flows to validate and inspect standalone descriptor key expressions directly Eliminate the need for dummy descriptor wrappers when verifying pasted keys in setup wizards Fix musig descriptor parsing to properly reject invalid trailing characters P3 because it unblocks multisig wizard tracking issue #35645 Enables wallet tools to parse standalone key expressions and inspect derivation paths cleanly Ranking pass: Moved down to head a contiguous multisig-wizard (#35645 ) block with #36070 #36143 Approval without stated rationale (w0xlt) Concept approval without stated reasons (pablomartin4btc) Open suggestion to split the musig parser fix into a separate PR for backporting (fametrano) 125 lines added or modified outside tests 185 lines added or modified in tests 95 lines removed in total 3 files, 3 commits (+) #36070 PraneethGunas wallet: Add deriveHDKey interface P3 · unblocks #35645 Ready 0 Positive 97 + 45 tests Allows the GUI to derive shareable extended public keys from HD keys during multisig setup Makes key derivation accessible outside of RPC without exposing private key material P3 because it directly unblocks multisig setup wizard tracking issue #35645 Benefits GUI users setting up multisig wallets once downstream wizard integration lands Ranking pass: Moved up to sit with the other #35645 prerequisites it shares a project with. Ready for review, waiting on reviewers to verify the reworked commits and error handling Concept and approach approval without detailed rationale (polespinasa, jeanpablojp, pseudoramdom, w0xlt) Resolved objection against collapsing caller parameter errors into vague wallet errors (achow101) Resolved concern over altering the RPC error contract for derivehdkey (pseudoramdom) Resolved issues with test coverage and unreachable wallet lock checks (jeanpablojp, polespinasa) 97 lines added or modified outside tests 45 lines added or modified in tests 66 lines removed in total 7 files, 5 commits (+) #36143 rxbryan descriptor: add CreateMultisigDescriptor() P3 · new feature Ready 0 -1 Mild 116 + 85 tests Avoid errors from manually assembling multisig descriptor strings during wallet setup Validates cosigner keys and builds multisig descriptors safely to support multisig setup tools P3 because safe descriptor creation avoids setup errors but lacks direct end-user callers so far Unblocks multisig wizard tooling and planned modernization of createmultisig Ranking pass: Kept adjacent to the other #35645 wizard prerequisites. Ready to review Nothing known that would invalidate a review now Unaddressed objection: adding unused C++ helper code is premature before flow validation in Python (Sjors) The author answered proposing callers including createmultisig, awaiting reviewer response (Sjors) Concept approval because the GUI needs this helper and createmultisig should be modernized (achow101) 116 lines added or modified outside tests 85 lines added or modified in tests 0 lines removed in total 3 files, 2 commits (+) #31668 saikiran57 Added rescan option for import descriptors P3 · user request Ready 0 Strong 36 + 156 tests Allow callers importing descriptors to completely bypass blockchain rescanning Saves rescan time for callers importing known unused keys or deferring rescan P3 because it eliminates redundant rescan overhead when importing unused descriptors Benefits wallet users importing fresh keys or managing rescans separately Substantive support for bypassing rescan with no open blocking objections Concept approval for allowing users to skip rescanning (rkrux) Verified that timestamp never skips rescan while now rescans (davidrobinsonau) Open suggestion to use timestamp new instead of never (furszy) Unaddressed request to split validation error checks into a separate commit (furszy, rkrux) 36 lines added or modified outside tests 156 lines added or modified in tests 20 lines removed in total 3 files, 1 commits (+) #32861 Sjors Have createwalletdescriptor auto-detect an unused(KEY) P3 · new feature Ready 0 Strong 49 + 25 tests Auto-detect unused HD keys during descriptor creation so users do not need to copy-paste xpubs Streamlines scripted blank wallet setups and prevents importing duplicate HD keys P3 because it improves RPC ergonomics for automated and scripted descriptor wallet setups Offers moderate usability gains for wallet configuration without affecting fund safety Substantive support after testing (adyshimony) Concept approval without stated reasons (w0xlt, jeanpablojp) Resolved objections about duplicate key checks and code reuse (adyshimony, jeanpablojp) Answered concern regarding whether to delete unused descriptors in this change (rkrux) 49 lines added or modified outside tests 25 lines added or modified in tests 9 lines removed in total 7 files, 5 commits (+) #36481 achow101 wallet, rpc, gui: Allow users to manually rebroadcast a wallet transaction P3 · new feature CI failing 0 Blocked 99 + 24 tests Let users manually rebroadcast unconfirmed wallet transactions through RPC or the GUI Avoids needing to extract raw transaction hex and call sendrawtransaction manually P3 because it gives users an in-wallet way to rebroadcast stuck transactions Saves users from manually extracting raw hex, but remains a deferrable convenience feature Ranking pass: Moved down: convenience wrapper over existing sendrawtransaction, below the feature work with linked user demand. CI is failing, so verify whether failures relate to this PR before deep review Broad concept support for manual transaction rebroadcast (mzumsande, polespinasa, murchandamus, jpk68) Approach ACK with suggestions on error handling and RPC docs (vasild) Unaddressed objection: fails with empty error if feerate exceeds maxfeerate (fametrano) 99 lines added or modified outside tests 24 lines added or modified in tests 4 lines removed in total 9 files, 2 commits (+) #36380 vasild wallet: extend -walletbroadcast to allow initial send only P3 · new feature Ready 0 -1 Mild 41 + 1 tests Allow wallets to send an initial transaction broadcast without recurring rebroadcasts Prevents leaking transaction ownership to the network over time for privacy-conscious users P3 because it lets privacy-conscious users avoid transaction ownership leaks from rebroadcasts Default behavior is unchanged and the opt-in privacy feature is reasonably deferrable Ranking pass: Moved up to sit with the other opt-in rebroadcast-policy options. Objections to disabling rebroadcasts by default were addressed by preserving default behavior (achow101, vicjuma) Adopted suggestion to extend existing broadcast setting instead of adding a new option (w0xlt) Unaddressed suggestion to also disable mempool resubmission when rebroadcasts are disabled (mzumsande) 41 lines added or modified outside tests 1 lines added or modified in tests 20 lines removed in total 4 files, 1 commits (+) #33043 w0xlt [POC] wallet: Enable non-electronic (paper-based) wallet backup with codex32 P3 · new feature Waiting on author 0 Mild 965 + 472 tests Enable physical, human-verifiable paper backups and recovery for wallets using codex32 encoding Allow descriptor wallets to retain seed material instead of requiring raw databases or long descriptors P3 after comparing with the other PRs here (assessed alone as P2): Lowered from P2: an explicit proof of concept seeking feedback on whether Core should store seeds at all; value is speculative until that is settled. P2 because it fills a key feature gap by enabling paper-based backup and recovery for descriptor wallets Provides human-verifiable recovery without relying on raw database files or full descriptor strings Waiting on author to answer open objections from Sjors and BenWestgate Needs rebase No review verdicts recorded Concept support because paper backups are a standard feature missing since legacy wallet removal (rkrux) Unaddressed objection: bypasses descriptor backups and fragments key import logic away from addhdkey (Sjors) Unaddressed objection: lacks wallet birth timestamps for rescanning and descriptor associations (BenWestgate) 965 lines added or modified outside tests 472 lines added or modified in tests 46 lines removed in total 31 files, 5 commits (+) #36697 jaromil wallet: Add exportaddresskey RPC for descriptor wallets P3 · new feature Needs rebase 0 Crickets 824 + 2,785 tests Export private keys for single addresses directly from descriptor wallets Eliminates having to parse descriptors and recompute derivation math externally P3 because it restores direct address key export lost with dumpprivkey removal Helps external clients extract keys without manual derivation outside Core Driven by a specific client use case without wide reported demand Ranking pass: Moved down: single-client motivation with no corroborating demand places it at the bottom of the feature group. Conflicts with master; review the logic now, the rebase is mechanical No review verdicts recorded No substantive comments either way yet 824 lines added or modified outside tests 2,785 lines added or modified in tests 0 lines removed in total 22 files, 8 commits (+) #36126 polespinasa wallet, rpc: Implements set key label functionality P3 · new feature Needs rebase 0 -2 Blocked 294 + 156 tests Help users and GUIs track which master key corresponds to which physical device or cosigner Allow assigning and querying friendly labels for keys in multisig setups P3 because tracking device identities across cosigners is a UX convenience for multisig workflows It is a deferrable feature enhancement rather than an essential wallet capability Ranking pass: Moved down: convenience labelling whose persistence design is still contested. Unaddressed objection: labels should only be temporary in the GUI and not stored in the wallet (achow101) Objection: ongoing maintenance costs for RPCs offer little benefit (rkrux) Support for persisting key labels to help users identify signers at signing time (davidgumberg) Concept and approach approval with testing (jeanpablojp, vicjuma, Eunovo) 294 lines added or modified outside tests 156 lines added or modified in tests 1 lines removed in total 11 files, 11 commits (+) #34405 8144225309 wallet: skip APS when no partial spend exists P3 · bug fix Ready 0 Positive 33 + 81 tests Skip unnecessary grouped coin selection when the initial pass leaves no partially spent addresses Ensure tracepoints and debug logs accurately reflect when Avoid Partial Spends is actually used P3 because the computational savings from skipping the redundant coin selection pass are modest The impact is primarily correcting overreported partial spend avoidance in tracepoints and logs Ranking pass: Moved up: it corrects misreported APS usage in tracepoints/logs, which is more than a pure cleanup. Concept approval without detailed review reasons (polespinasa) Suggestions on memory allocations and test assertions resolved (achow101, polespinasa) 33 lines added or modified outside tests 81 lines added or modified in tests 15 lines removed in total 4 files, 2 commits (+) #35716 achow101 wallet: Replace mapWallet and wtxOrdered with a boost::multi_index P3 · cleanup Needs rebase 0 (+1) Strong 331 + 36 tests Prevent wallet transaction tracking from desynchronizing across lookups Eliminate lifetime risks from holding raw pointers to stored wallet transactions P3 because it reduces wallet fragility by consolidating transaction storage into one container Removes raw pointer indirection and eliminates container desynchronization hazards Structurally prevents an issue where transaction reordering missed the ordered view Ranking pass: Moved down: structural fragility reduction with no user-visible payoff, ranked with the other internal refactors. Ready to review: no blockers or invalidating changes known Strong support for eliminating container sync burdens and raw pointer storage Verified it structurally fixes a transaction reordering bug on master (pablomartin4btc) Concept approval because multi-index is appropriate and scoped to wallet (theuni) Resolved concern regarding modify semantics by switching to extract and insert (theuni) Concept approval for improving wallet transaction naming and structure (rkrux) 331 lines added or modified outside tests 36 lines added or modified in tests 302 lines removed in total 19 files, 4 commits (+) #19460 ryanofsky multiprocess: Add bitcoin-wallet -ipcconnect option P3 · new feature Review #10102 0 Blocked 4,183 + 197 tests Allow the standalone wallet tool to connect to a running node over IPC instead of running strictly offline Prepare the wallet tool for future online actions like querying chain state and syncing balances P3 because it lays the foundation for online wallet operations like balance syncing The immediate change only checks socket presence and defers wallet features to future PRs Ranking pass: Moved down: scaffolding only; the user-visible online-wallet features are deferred to later PRs. Review #10102 Stacked on top of open multiprocess PR #10102 No review verdicts recorded Unaddressed objection: combining CLI tool and daemon behavior adds work and risks user footguns (ajtowns) Answered objection: offline operation remains fully supported without requiring a node (jonasschnelli) Approvals from accounts with no project history provided no rationale 4,183 lines added or modified outside tests 197 lines added or modified in tests 644 lines removed in total 149 files, 26 commits (+) #34909 rkrux wallet, refactor: modularise wallet by extracting out legacy wallet migration P3 · cleanup Ready 0 Positive 865 + 4 tests Make core wallet code easier to maintain by separating legacy wallet migration logic Isolate legacy migration flows to keep the primary wallet implementation descriptor-focused P3 because it is an internal cleanup with no user-facing changes or correctness fixes Reduces wallet maintenance complexity by separating one-off legacy upgrades from core operations Ranking pass: Heads the internal refactor block; see note about conflict ordering with #34193 Concept approval without stated reasons (pablomartin4btc, w0xlt) Clarified scope and design questions around future migration types (pablomartin4btc) 865 lines added or modified outside tests 4 lines added or modified in tests 837 lines removed in total 16 files, 5 commits (+) #35444 w0xlt wallet: make descriptor SPKM mutex non-recursive P3 · cleanup Ready 1 Strong 326 + 125 tests Eliminate deadlock hazards from recursive locking during wallet callbacks Clarify wallet locking hierarchies and enable compile-time thread safety checks P3 because it is internal concurrency maintenance without an active user-facing failure Reduces wallet deadlock risks during synchronous callbacks and improves maintainability Substantive support with all technical questions and objections addressed Verified rebased commits and restored availability test coverage (pablomartin4btc) Behavior change objection around index writing was resolved by author (polespinasa) Concept approval without stated reasons (hebasto, polespinasa) 326 lines added or modified outside tests 125 lines added or modified in tests 224 lines removed in total 9 files, 4 commits (+) #36333 davidgumberg wallet: Delete `removeprunedfunds` and delete transaction delete code P3 · cleanup Waiting on author 1 Strong 5 + 2 tests Remove the deprecated removeprunedfunds RPC and all wallet transaction deletion code Eliminate complex synchronization between wallet memory and storage Stop unnecessary database operations when migrating legacy wallets P3 because it cleans up fragile transaction deletion code and simplifies wallet storage handling Reduces maintenance complexity without fixing an active critical defect Review is worthwhile now as the conflicts with master are purely mechanical Strong support after verifying no code references the removed deletion functions (pablomartin4btc) Concept approval without stated reasons (w0xlt) Nonblocking suggestions to retain test coverage and document migration details (pablomartin4btc) 5 lines added or modified outside tests 2 lines added or modified in tests 230 lines removed in total 11 files, 4 commits (+) #35733 achow101 sign: Remove FillableSigningProvider P3 · cleanup Needs rebase 0 Strong 86 + 104 tests Remove an obsolete signing provider abstraction leftover from legacy wallet removal Confine remaining legacy signing logic strictly to legacy wallet migration P3 because it cleans up obsolete signing code left behind after legacy wallet removal Confines legacy wallet signing behavior strictly to legacy migration logic Support for removing the outdated provider and containerizing legacy code (rkrux, vicjuma) Approach approved after testing (jeanpablojp) Resolved objections: consensus-invalid P2SH signing and fuzz test issues (jeanpablojp) 86 lines added or modified outside tests 104 lines added or modified in tests 288 lines removed in total 22 files, 7 commits (+) #36031 achow101 wallet: Remove mapMasterKeys and enforce that only one encryption key can exist P3 · cleanup Waiting on author 0 (+1) Strong 24 + 2 tests Remove dead multi-passphrase handling logic from the wallet encryption system Prevent inconsistent wallet states and simplify key management for wallet maintainers P3 because it cleans up obsolete multi-passphrase design that was never implemented Improves code maintainability by eliminating redundant loops without changing wallet features Broad agreement that keeping only one encryption key simplifies maintenance (rkrux, jeanpablojp) Verified backward compatibility with nonstandard master key identifiers through testing (vicjuma) Considered safe since corrupted edge-case wallets failing to load is acceptable (davidgumberg) Concept approval with open questions on unloadable wallets and safety assertions (polespinasa) 24 lines added or modified outside tests 2 lines added or modified in tests 40 lines removed in total 6 files, 3 commits (+) #25722 ryanofsky refactor: Use util::Result class for wallet loading P3 · cleanup Review #25665 0 Strong 1,156 + 280 tests Standardize error reporting and propagation across wallet loading, creation, and migration Eliminate cumbersome mutable out-parameters for error statuses and warning lists across the stack P3 because it standardizes internal error handling across wallet loading and migration routines Provides maintainers a cleaner wallet architecture without changing behavior or user-facing impact Ranking pass: Moved down: behavior-preserving error-plumbing refactor, ranked with the other internal cleanups. No review verdicts recorded Substantive support praising the expanded result utility as powerful yet simple to use (martinus) Resolved objections regarding compile errors and ambiguous boolean type conversions (martinus, sedited) 1,156 lines added or modified outside tests 280 lines added or modified in tests 783 lines removed in total 44 files, 24 commits (+) #35041 brunoerg descriptor: speed-up `Parse` (xpub/xpriv) in ~30% P3 · speedup Waiting on author 1 Strong 71 Speed up descriptor parsing by roughly 30% to improve descriptor loading and fuzzing Eliminate redundant work when parsing extended keys and computing descriptor checksums P3 because descriptor parsing runs roughly 30% faster on large multisig descriptors Sub-millisecond savings per descriptor benefit fuzz targets but remain deferrable for normal wallet use Ranking pass: Moved down: sub-millisecond per-descriptor gain mainly benefits fuzzing, not normal wallet use. Strong support citing a 36.7% benchmarked speedup and fuzzing benefits (hodlinator) Concept approval without stated reasons (sedited) Nonblocking suggestion to add an argument precondition or use an unsigned length (hodlinator) 71 lines added or modified outside tests 0 lines added or modified in tests 28 lines removed in total 5 files, 2 commits (+) #35433 rkrux wallet: deprecate replaceable argument from transaction (and psbt) creation (and modification) RPCs P3 · cleanup Ready 0 Strong 53 + 125 tests Deprecate redundant replaceable parameters across raw transaction and wallet RPCs Clean up interfaces after network transactions became replaceable by default P3 because it deprecates obsolete replaceability flags across wallet spend methods Unblocks eventual code removal without impacting core wallet logic or fund safety Ranking pass: Moved down: RPC surface deprecation with no behavior fix, grouped with the other cleanups. Ready to review Author addressed feedback and pushed a rebase with updated tests Concept approval for deprecating the arguments across RPCs (polespinasa) Resolved objections on silent parameter omission and test coverage (polespinasa, achow101, w0xlt) Author addressed all reviewer comments in the latest rebase 53 lines added or modified outside tests 125 lines added or modified in tests 77 lines removed in total 15 files, 7 commits (+) #30343 ryanofsky wallet, logging: Replace WalletLogPrintf() with LogInfo() P3 · cleanup Review #29256 0 (+1) Strong 338 + 207 tests Allow wallet logging to use proper severity levels instead of forcing every message to info level Ensure source-location logging reports actual call sites while preserving wallet-name prefixes P3 because it standardizes wallet logging on modern severity levels while preserving wallet prefixes Fixes source location reporting in wallet logs without altering core wallet behavior Substantive support after concerns were resolved (adyshimony) Objected to using fatal error level for non-fatal wallet issues, addressed by dropping commit (maflcko) Interface suggestions and lifetime safety concerns were addressed (hodlinator, adyshimony) 338 lines added or modified outside tests 207 lines added or modified in tests 210 lines removed in total 18 files, 13 commits (+) #35786 furszy wallet: drop spent parents redundant cache invalidation and notification P3 · cleanup Waiting on author 0 (+2) Blocked 7 + 101 tests Eliminate redundant cache recalculation and unnecessary UI refreshes when wallet outputs are spent P3 because it is a routine cleanup removing redundant cache invalidations and dead GUI notifications The performance gain is minor, saving unneeded recalculations and status refreshes after spends Ranking pass: Moved down: unmeasured micro-optimization plus dead-notification removal. Unaddressed objection: keypool expansion during spend leaves parent cache outdated in gettransaction (w0xlt) Confirmed the edge case with keypool expansion during a spend (vicjuma) Support for removing redundant cache invalidations and GUI notifications (pablomartin4btc, Bicaru20) Concept approval for simplifying confusing invalidation code (rkrux) 7 lines added or modified outside tests 101 lines added or modified in tests 32 lines removed in total 4 files, 3 commits (+) #36028 sipa miniscript: make typing rule match BIP-379 exactly P3 · cleanup Waiting on author 0 Strong 4 Align Miniscript typing rules with the exact BIP-379 specification text Ensure consistency with proposed cross-implementation BIP-379 test vectors P3 because the divergence is mathematically equivalent for validity and malleability checking Ensures cross-implementation consistency against standardized BIP-379 test vectors Ranking pass: Moved down: explicitly equivalent in outcome; value is cross-implementation spec alignment only. Concept approval for aligning with BIP-379 test vectors (guggero) Suggests adopting an alternative approach developed in BIP-379 discussions (guggero) Notes test vectors require dropping properties on malleable expressions instead (fametrano) 4 lines added or modified outside tests 0 lines added or modified in tests 6 lines removed in total 1 files, 1 commits (+) #32993 brunoerg fuzz: wallet: add target for tx scanning P3 · test coverage Author silent 142d 0 (+1) Strong 0 + 111 tests Add automated fuzz testing for wallet transaction scanning to catch rescan boundary and filter edge cases P3 because it adds dedicated fuzz testing for wallet rescanning edge cases Valuable test coverage that is reasonably deferrable and does not reproduce known crash issue #31474 Ranking pass: Moved down: useful coverage, but it does not reproduce the known rescan crash, so it ranks below behavior-affecting work. Author silent for over 100 days, so reviews may wait a long time for a response Tested ACK confirming the target runs without crashing (Chand-ra) Past UBSan integer overflow and heap-use-after-free objections were resolved (fanquake, ekzyis) 0 lines added or modified outside tests 111 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #35443 mjdietzx tests: add functional test for tr musig2 miniscript decaying multisig P3 · test coverage Author silent 151d 1 Positive 13 + 177 tests Add end-to-end tests for wallet PSBT flows combining MuSig2 aggregate keys with Miniscript timelocks Provide documentation and regression coverage for decaying multisig setups across signer wallets P3 because it provides end-to-end integration tests for complex multi-party descriptor workflows Guards against regressions in wallet PSBT handling across watch-only and single-key signer wallets Author has been silent for 146 days, so reviews may wait a long time for a response Approval without stated reasons (rkrux) Unaddressed suggestion to avoid mentioning halvening timelocks in the doc description (rkrux) 13 lines added or modified outside tests 177 lines added or modified in tests 0 lines removed in total 3 files, 1 commits (+) #35224 kevkevinpal wallet: importdescriptors should output the request on error P3 · bug fix Ready 0 Crickets 1 + 3 tests Help users identify which descriptor failed when batch-importing descriptors with a missing timestamp Prevents having to guess which item caused the entire batch import call to abort P3 because it improves error diagnostics for a specific failure mode during batch descriptor imports Provides modest usability value to operators debugging import errors without affecting core wallet logic CI is failing, so verify whether the test failure is related before doing an in-depth review No review verdicts recorded No substantive comments or reviews from external contributors yet Awaiting initial review 1 lines added or modified outside tests 3 lines added or modified in tests 3 lines removed in total 2 files, 1 commits (+) #36255 murchandamus Refactor CoinGrinder tests P3 · test coverage CI failing 0 Mild 0 + 194 tests Moves CoinGrinder unit tests into the modern test suite to consolidate wallet testing Tests use realistic feerates and effective values instead of obsolete dummy parameters P3 because it refactors internal unit tests to use realistic parameters rather than fixing bugs Helps consolidate fragmented wallet test suites toward eventual removal of the legacy test file CI is failing, so check whether the failure is from this PR before a deep review Concept support for migrating and consolidating coin selection tests (l0rinc, yancyribbens) Unaddressed objection: helper assertions obscure line numbers and block independent runs (l0rinc) Unaddressed objection: float conversion risks precision loss compared to integer satoshis (l0rinc) Unrelated test bugs were agreed to be handled in a separate PR instead (Zeegaths, yancyribbens) 0 lines added or modified outside tests 194 lines added or modified in tests 274 lines removed in total 2 files, 11 commits (+) #36122 fjahr BIP460: CISA for Taproot key path spends P4 · new feature Waiting on author 0 Strong 7,680 + 3,565 tests Allow cross-input signature aggregation for Taproot key path spends to reduce transaction size and fees Lower fee overhead for multi-party collaborative transactions like CoinJoin and Payjoin P4 after comparing with the other PRs here (assessed alone as P3): Lowered from P3: explicitly a draft accompanying unaccepted BIPs and vendoring unmerged libsecp256k1 work; wallet value is speculative until consensus work lands. P3 because it introduces descriptor and PSBT support for aggregated Taproot spends It allows wallet users to construct and test multi-party collaborative transactions end to end Worth reviewing now, but check if CI failures are caused by this PR before a deep review No review verdicts recorded Substantive support after testing consensus logic against BIP460 vectors and edge cases (fametrano) Objections regarding wallet signing and PSBT input grouping were addressed in code (BarneyChambers) Open suggestion to update vendored consensus test vectors to match the latest BIP copy (fametrano) 7,680 lines added or modified outside tests 3,565 lines added or modified in tests 219 lines removed in total 111 files, 22 commits (+) #34520 maflcko refactor: Add [[nodiscard]] to functions returning bool+mutable ref P4 · cleanup CI failing 0 (+2) Strong 74 + 1 tests Prevent callers from accidentally using invalid or uninitialized output when getter functions fail Ensure callers check return values by enforcing compiler warnings on legacy retrieval functions P4 because it is internal defensive hygiene adding compiler warnings for ignored return values It fixes no active wallet bug or user-visible problem CI is failing, so check whether the failure is caused by this PR before doing a deep review Strong support with no open objections (sedited, ryanofsky) Support because preventing ignored returns could prevent bugs (ryanofsky) Concept support but questioned whether an incremental approach is best (sedited) Addressed earlier concerns on proxy isolation and descriptor cache handling (ajtowns) 74 lines added or modified outside tests 1 lines added or modified in tests 77 lines removed in total 22 files, 3 commits (+) #34502 rkrux wallet: remove most asserts of `WALLET_FLAG_DESCRIPTORS` flag P4 · cleanup Ready 0 Neutral 8 Reduce developer cognitive overhead by removing obsolete descriptor wallet assertions Clarify internal code paths where legacy wallets can still be encountered during migration P4 because it is an internal code cleanup following legacy wallet deprecation Removes obsolete assertions without user-facing impact or bug fixes No review verdicts recorded Neutral sentiment with previous objections addressed but no explicit approvals yet Questioned removing the assertion in EncryptWallet due to descriptor logic in migration (frankomosh) Concerned removing the EncryptWallet assert causes later crashes on non-descriptor wallets (b-l-u-e) 8 lines added or modified outside tests 0 lines added or modified in tests 17 lines removed in total 2 files, 2 commits (+) #35429 w0xlt wallet: avoid global access in external signer SPKM P4 · cleanup Author silent 153d 0 Crickets 44 + 11 tests Improve wallet modularity by avoiding direct access to global state in external signer handling Helps decouple the wallet engine from global arguments and chain parameters P4 because it is an internal refactoring removing global state from wallet internals Modularity benefit is modest with no direct user impact or stated dependencies Needs rebase Author has been silent for 108 days No review verdicts recorded No reviews or substantive comments yet Pinged author for a rebase (sedited) 44 lines added or modified outside tests 11 lines added or modified in tests 27 lines removed in total 5 files, 2 commits (+) #35151 musaHaruna wallet, follow-up: Refactor IsSpent to use HowSpent P4 · cleanup Author silent 180d 1 -1 Mild 8 Deduplicate spend-checking traversal logic across wallet methods Maintain early-exit behavior when checking if a transaction output is spent P4 because it is an internal cleanup with no user-visible payoff or performance gain Removes duplicated spend traversal code without altering wallet behavior Author silent for 142 days, so review feedback may wait a long time for a response Clean refactoring approved after adding an early-exit option (polespinasa) Objection over loop efficiency and missing early exit addressed by author (luke-jr) Concept NACK over loop performance not formally withdrawn (luke-jr) 8 lines added or modified outside tests 0 lines added or modified in tests 24 lines removed in total 2 files, 1 commits (+) #36488 maflcko rpc: wallet: Schedule mixed-case confTarget option deprecation P4 · cleanup Ready 1 Strong 13 + 5 tests Deprecate the legacy mixed-case confTarget option in wallet bumpfee and psbtbumpfee RPCs Require the -deprecatedrpc=confTarget flag to use it, preparing for removal next cycle Eliminate naming inconsistencies and duplicate parameter handling alongside conf_target P4 because it only cleans up parameter naming in fee-bump calls without changing logic P4 because the benefit is minor maintainer cleanup of duplicate options Substantive support with no open objections (fametrano) Verified on regtest with and without flag against a client library (fametrano) Author declined suggestion to add functional tests for the deprecated option (maflcko) 13 lines added or modified outside tests 5 lines added or modified in tests 1 lines removed in total 4 files, 1 commits (+) #35342 kevkevinpal test: fuzz wallet_rpc target P4 · test coverage Waiting on author 0 -1 Mild 0 + 530 tests Add fuzz testing for wallet RPC commands with randomized arguments Protects wallet RPC parameter parsing and validation against malformed inputs P4 after comparing with the other PRs here (assessed alone as P3): Lowered from P3: fuzzing wallet RPCs without chain state or UTXOs yields very little real coverage, making the benefit weakly justified. P3 because hardening wallet RPC parameter parsing and input validation protects against malformed inputs Testing in isolation without full wallet state limits the coverage of stateful wallet operations Waiting on author to reply to an open objection from brunoerg Approach objection: fuzzing wallet RPCs without context like blocks or coins has minimal value (brunoerg) Unaddressed objection: keypool limits for performance further degrade fuzzing efficacy (brunoerg) Questions raised about the performance of calling multiple wallet RPCs per run (maflcko) 0 lines added or modified outside tests 530 lines added or modified in tests 176 lines removed in total 6 files, 2 commits (+) #36614 Naomi-Gift test: check algorithm after SelectionResult::Merge P4 · test coverage Ready 1 Strong 0 + 23 tests Preserve coin selection algorithm reporting when combining preset manual inputs with automatic selection Prevents unnoticed regressions in selection metadata reporting P4 after comparing with the other PRs here (assessed alone as P3): Lowered from P3: one narrow mutation-killing unit test, equivalent in consequence to the other test-only P4 entries. P3 because it adds regression test coverage for coin selection metadata retention Kills a surviving mutant found by mutation testing tools Strong support with no open objections Verified by confirming the new test kills a surviving mutation (mercie-ux) 0 lines added or modified outside tests 23 lines added or modified in tests 0 lines removed in total 1 files, 1 commits (+) #36705 Conradgabe test: Replace stale TODO with mempoolminfee test in wallet_send.py P4 · test coverage CI failing 0 Crickets 0 + 36 tests Add test coverage for send RPC behavior when fee rates fall below mempool minimums Cleans up stale, commented-out test code left behind from an earlier pull request P4 because it only adds functional test coverage for an existing edge case Alters no wallet logic and offers marginal impact on scarce wallet review resources CI is failing, so verify whether the failure belongs to this PR before deep review No review verdicts recorded No substantive reviews or feedback yet Awaiting review after pinging another contributor (fanquake) 0 lines added or modified outside tests 36 lines added or modified in tests 10 lines removed in total 1 files, 1 commits (+) #36378 aaron-leeb test: Add SKIP_WRITE edge case to wallet_startup P4 · test coverage Ready 1 Strong 0 + 5 tests Verify that reloading an already-listed startup wallet skips dynamic settings writes without warnings Close a test coverage gap for startup settings edge cases P4 because it only adds functional test coverage for a narrow edge case It provides no direct bug fixes or functional node improvements Verified by testing locally that the test passes as expected under -nosettings (mercie-ux) 0 lines added or modified outside tests 5 lines added or modified in tests 0 lines removed in total 1 files, 1 commits (+) #34879 rkrux wallet, test: remove unnecessary node restart from wallet_reindex P4 · cleanup Ready 0 (+1) Strong 0 + 90 tests Clarify wallet birthtime functional test intent and reduce run time by removing an unneeded node restart P4 because it is a minor functional test cleanup that trims about two seconds off test execution Touches only test code with no behavioral changes to the wallet itself Substantive support, no open objections Agrees rescan tests birthtime updates and node restart was misleading (pablomartin4btc) Concerned removing restart drops coverage of birthtime across restarts, answered by author (polespinasa) 0 lines added or modified outside tests 90 lines added or modified in tests 93 lines removed in total 3 files, 2 commits (+) #36402 nebula-21 refactor: `wallet_importdescriptors` to separate `run_test()` contents into specific functions P4 · cleanup Ready 0 Positive 0 + 543 tests Make the descriptor import functional test easier to read, debug, and extend by splitting a monolithic test P4 because it is an internal test reorganization without changing test coverage or behavior Modifies a single functional test file to improve maintainability for test writers Concept and approach approval without stated reasons (w0xlt, polespinasa) Author explained why some modified newlines were needed to keep test separation (polespinasa) 0 lines added or modified outside tests 543 lines added or modified in tests 494 lines removed in total 1 files, 1 commits (+) #36591 nebula-21 test: deduplicate PSBT unknown-field coverage in `rpc_psbt.py` P4 · test coverage Ready 1 Strong 0 + 25 tests Make PSBT unknown-field test failures point directly to the broken behavior during mutation testing Maintainers benefit from cleanly separated pass-through and merge test coverage without duplicate checks P4 because it only refactors test assertions and does not alter wallet behavior or user-facing code The benefit is confined to clearer test failures and deduplication for maintainers working on PSBT tests Ready to review now with no blocking issues or prerequisites Strong support with no open objections Verified by mutation testing that failures now trigger in the dedicated combine test (Naomi-Gift) 0 lines added or modified outside tests 25 lines added or modified in tests 24 lines removed in total 1 files, 2 commits