v1: Decide optional feature deferrals before qualification freeze #166

Problem

The intended v1 is a small, auditable, real-funds recovery release. Each additional mode, prompt, worker or recovery branch increases the exact-candidate security review, Bitcoin Core/GUI/Tails qualification and documentation burden. Freeze a minimal feature set before final review (see #5 and #38). This issue records candidates for maintainer decisions, not approved removals.

Decisions to make

• create: Mix optional typed keystrokes into Core randomness #159, optional typed-keystroke entropy: adds scrypt, secret input, per-draw failure/latency, and GUI parity on top of create: Draw randomness from Core and the OS #145's Core+OS entropy. Decide whether optional hardening justifies qualification now.
• cli: Restore ms32 checksum as a separate generation command #144 / gui: Codex32 Book checksum page (only if requested) #153, Codex32 Book checksum generation: adds a separate sensitive-data creation flow and possible GUI page; the GUI page already requires a user request. Decide whether CLI checksum belongs in this release.
• cli: Derive several shares per run and allow repeated indices #103 / cli: Derive several shares per run and allow repeated indices #87, batch share derivation and repeated indices: one-share-at-a-time already works; repeated-card and shortened-input branches expand ceremony state. docs: Prepare the v1 review handoff #38 already calls for integrate-or-defer.
• gui: Refresh empty wallets automatically #66, automatic GUI wallet polling: adds periodic worker, shutdown and vanished-selection states; evaluate against a manual refresh flow.
• create: Let card re-entry catch a wrong card #140 / cli: Refuse pasted card text and group typing into fours #141, card error reveal after re-entry, paste detection and interactive grouping: potential extra confirmation disclosures and terminal-specific paths; defer until safety and Tails usability are established.
• wallet: Add checksummed recovery-record evidence #43 / qr: Add codex32 and wallet-record QR codes #44 / wallet: Encrypted descriptor backup keyed by the seed #55 / correct: Rank repair candidates by seed-derived identifiers #56 / wallet: Support nonzero accounts with Core-native setup #68, checksummed wallet records, QR, encrypted descriptor evidence, identifier-based ranking and nonzero Core accounts: broader formats and trust boundaries. Track separately after v1 unless an explicit release-blocking need is demonstrated.
• v1: Drop the BIP39 and Core Lightning profiles #147 / v1: Make the CLI an optional install #148, already-approved profile removal and CLI packaging split: complete or clearly document their effect on the frozen candidate; avoid reopening settled scope decisions.
• share: Show the master fingerprint after the threshold #100 / wallet: Ask for the record fingerprint before the cards #104 are already expressly deferred. Do not silently reintroduce them; keep the ten-second correction limit and omit an extended-search mode.

Preserve necessary safety and release work

Do not classify the existing corruption-recovery improvement #165, enforcement of the ten-second deadline #137, identity checks #118, real-pruned-Core restore correctness #113, no-hint recovery disclosure #155, or release gates #5 / #38 as optional simply because they add code. Preserve documented required correction classes, error handling, and Bitcoin Core compatibility.

Done when

1. Maintainer marks each candidate v1 / post-v1 / close with a short reason and records dependencies already under review.
2. Freeze the precise library/CLI and GUI heads; avoid introducing new v1 behaviors except proven release blockers.
3. Qualify the remaining feature set with full tests, real-Core fixtures, manual GUI/Tails checks, built artifacts, and independent final security review.

Surveyed open PRs/issues and master, reviewability-v1, gui-reviewability-v1 on 2026-10-22. No code removals proposed here: tradeoffs are for the maintainer.