Skip to content
Bitcoin Roots

v29.4-roots.3 · Commit 29: [PATCH 29/30] docs(release): prepare v29.4-roots.3 candidate notes

doc/wallet-privacy.md

Before: doc/wallet-privacy.md · After: doc/wallet-privacy.md

File metadata
index b0d8d59f10bfd34b347b6510b1526d0f4dc9f591..2dc7bf69280544d7549bb9a54cdd3469b422032e 100644

Download original patch · Release notes

Diff rows 1–78 of 78. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.

doc/wallet-privacy.md CHANGED
@@ -1,10 +1,10 @@
1
- # Advanced wallet privacy tools (unreleased)
1
+ # Advanced wallet privacy tools (`v29.4-roots.3` candidate)
2
2
 
3
- This guide describes the advanced wallet tools in this unreleased
4
- post-`v29.4-roots.2` topic. They are not part of the published
5
- `v29.4-roots.2` release. Bitcoin Core v29.4 remains the direct upstream base;
6
- selected Bitcoin Knots history is lineage only, not an upstream dependency or
7
- product specification.
3
+ This guide describes the advanced wallet tools intended for the
4
+ `v29.4-roots.3` candidate. This is candidate documentation, not a release
5
+ announcement; the tools are not part of the published `v29.4-roots.2` release.
6
+ Bitcoin Core v29.4 remains the direct upstream base; selected Bitcoin Knots
7
+ history is lineage only, not an upstream dependency or product specification.
8
8
 
9
9
  ## Sweep an external private key
10
10
 
@@ -36,11 +36,15 @@ external key, not routine wallet import or consolidation.
36
36
  retain an independent, secure backup until the sweep confirms.
37
37
 
38
38
  The Qt **Sweep Private Key** dialog applies the same contract. Its key field is
39
- masked and disables copy, cut, and context-menu actions. It clears the entered
40
- key after a preview request, when dismissed, or when the wallet unloads.
41
- Showing the key still exposes it on screen; use that control only when the
42
- display is safe. Broadcasting is irreversible and may fail after a chain or fee
43
- change.
39
+ masked and disables copy, cut, and context-menu actions. The dialog uses a
40
+ transient secure key cache, cleans its temporary encoded input, and overwrites
41
+ then clears its input control when it can invalidate a request. A cancellation
42
+ can stop an outstanding scan or preview; once broadcast submission passes its
43
+ final authorization boundary, it cannot be cancelled and the dialog waits for
44
+ the result. These measures reduce the lifetime of the entered secret, but do
45
+ not promise to erase every copy retained by the GUI toolkit or host. Showing
46
+ the key still exposes it on screen; use that control only when the display is
47
+ safe. Broadcasting is irreversible and may fail after a chain or fee change.
44
48
 
45
49
  ## Inspect and select wallet inputs
46
50
 
@@ -53,8 +57,13 @@ anonymous.
53
57
  - A **Reused address** indicator and grouping describe observable wallet facts.
54
58
  Selecting a group combines its inputs and can reveal an on-chain relationship;
55
59
  neither label is a privacy recommendation or score.
56
- - Explicit input selections are honored for the prepared send. Locked, unsafe,
57
- immature, or unavailable inputs are reported by the wallet. A material wallet
60
+ - The dialog starts with the wallet's normal available-output list. Locked
61
+ outputs remain visible so their lock state can be inspected, but cannot be
62
+ selected. Unsafe and immature outputs are not added merely to show a status;
63
+ outputs excluded by those normal availability filters are absent until their
64
+ state changes. “Not spendable” is metadata for a displayed output, not an
65
+ inventory of unavailable outputs.
66
+ - Explicit input selections are honored for the prepared send. A material wallet
58
67
  change, including a competing spend or reorganization, clears the selection
59
68
  so the operator must review current inputs again.
60
69
  - The confirmation shows the effective inputs, fee, change, and whether the
@@ -67,11 +76,22 @@ anonymous.
67
76
  These tools do not add CoinJoin, payjoin, silent automatic consolidation,
68
77
  private-key export, a transaction-history product, or any anonymity guarantee.
69
78
 
70
- ## Verification references
79
+ ## Candidate verification
71
80
 
72
- The reviewed behavior is exercised by
81
+ The candidate behavior is exercised by
73
82
  [`wallet_sweepprivkeys.py`](/test/functional/wallet_sweepprivkeys.py),
74
83
  [`wallet_send.py`](/test/functional/wallet_send.py), wallet unit tests, and
75
- [`src/qt/test/wallettests.cpp`](/src/qt/test/wallettests.cpp). Use
76
- `bitcoin-cli help sweepprivkeys` and the final transaction preview as the
77
- authority for a particular binary and transaction.
84
+ [`src/qt/test/wallettests.cpp`](/src/qt/test/wallettests.cpp). Before operating
85
+ on funds, compare the intended command with the built binary and inspect a
86
+ non-broadcast preview:
87
+
88
+ ```sh
89
+ bitcoin-cli help sweepprivkeys
90
+ build/test/functional/test_runner.py wallet_sweepprivkeys.py
91
+ python3 ci/test/test_wallet_privacy_contract.py
92
+ ```
93
+
94
+ `bitcoin-cli help sweepprivkeys` and the final transaction preview are the
95
+ authority for a particular binary and transaction. Verify the executable's
96
+ identity separately with `bitcoin-cli --version`; the intended
97
+ `v29.4-roots.3` candidate label in this guide does not replace that check.