fix: rebase SND-003 onto PR893 + QA-campaign fix batches

[lklimek]

Why this PR exists

• Problem: The SND-003 "Receive (QR) is inert" fix needed rebasing onto PR892, and a full desktop-GUI walkthrough of the 175 user stories surfaced a batch of real defects (a crash, silent hangs, dead buttons, a wallet self-lockout, a missing delete confirmation) plus security gaps in local data deletion.
• What breaks without it: Updating a data contract crashes the app; Load-Identity / Load-Masternode / Fetch-Documents / Add-Token hang silently with no feedback; transfer-credits and several token buttons are dead; a locked wallet becomes permanently stuck; single-key wallets delete with no confirmation; and "Clear Database" can report success while identity private keys (including masternode voting/owner/payout keys) survive on disk.

What was done

• SND-003: the Receive (QR) dialog no longer dismisses itself on the click that opens it.
• QA fixes: DOC-002 crash → typed error; IDN-002 / MN-001 / DOC-004 / TOK-003 silent hangs → timeouts + typed errors; IDN-006 / TOK-005 / TOK-011 / TOK-018 dead buttons; WAL-005/006/007 (rename, unlock self-lockout, single-key removal confirmation); SND-005 fee + total shown before send; IDN-008/009/013a / DPN-008 navigation; MCP-001 cross-process wallet visibility; NEW-002/003/004.
• Security: SEC-001/002 — "Clear Database" now wipes identity private keys and surfaces partial failures fail-closed (was silent / warn-only). clear_identity_vault_keys propagates instead of swallowing read/decode/delete errors, IdentityKeyView::delete_all attempts every key rather than short-circuiting, and DashPay sidecar/overlay delete failures are accumulated instead of warn-only.
• New controls: NEW-006 developer-only "Wipe Platform Data" — on the Network Chooser, in the "Database Maintenance" section beside "Clear {Network} Database", alongside its sibling destructive controls (devnet only, type-WIPE-to-confirm). NEW-007 "View Profile" for contacts.
• Hardening: database-version migration safety gate; contact-request idempotency; platform dependency bump pulling the AssetLockProof rehydration fix; unified test env-var lock (removes a flaky cross-module test race); per-instance modal guard id so two popups on one screen can no longer dismiss each other.

Test plan

• cargo build — clean
• cargo clippy --all-features --all-targets -- -D warnings — clean (verified via a forced, non-cached recompile)
• cargo test --all-features --workspace — 2142 passed, 0 failed (68 network-gated backend-e2e ignored, as expected)
• Suite verified green under both parallel and serial execution — the previously flaky cross-module DASH_EVO_DATA_DIR test race is fixed in this PR
• cargo +nightly fmt --all -- --check — clean
• Desktop-GUI walkthrough across the 175-story catalog drove the QA fix batches; an annotated status report tracks every finding as Fixed/Open
• NEW-006 exercised live in the GUI (Developer role, fresh data dir): the control renders in "Database Maintenance" directly beneath "Clear Devnet Database"; the type-WIPE dialog holds (empty → confirm disabled, lowercase wipe → still disabled, Enter does not bypass, WIPE → enabled); confirming dispatches without panic. Gate verified live by round-trip with the role held constant — Devnet: present → Testnet: absent → Devnet: present.
• NEW-007 ("View Profile") is not yet exercised live in the GUI, nor is NEW-006's removal from the Identity Hub → Settings tab. Both screens require a loaded identity (and, for NEW-007, established DashPay contacts). The QA campaign's dataset cannot currently be opened by this branch: another checkout migrated the shared wallet storage in ~/.config/dash-evo-tool to schema 4, and this branch's platform-wallet pin supports max 3, so it fails closed with SchemaVersionUnsupported { found: 4, max_supported: 3 }. NEW-006's removal from the Settings tab is nonetheless certain statically — the button, its dialog field, and its helpers no longer exist in settings.rs, so no code path can render it. The security, modal-guard and test-lock fixes remain covered by unit + integration tests only.

Breaking changes

• None.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• master
• v1.0-dev

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2636922a-7386-4333-b3df-26fa7310bde6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/snd-003-receive-inert

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

Preliminary review — Codex only

Exact head ffa7ea0 has seven in-scope blocking defects: three unresolved prior issues, a stranded token-refresh guard, and three scheduled-vote regressions. The original migration/password scheduled-vote race is fixed, but no-op completion, retry eligibility, and nested vote-result handling remain incorrect. Focused tests could not run because fetching the pinned Platform revision required network access that was not approved.

Validated blockers were found in the Codex precheck. Sonnet is deferred until a fresh Codex revalidation clears the blocker gate.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed), gpt-5.6-sol — rust-quality (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet: not run (deferred by blocker gate)

🔴 7 blocking | 🟡 1 suggestion(s)

1 additional finding(s) omitted (not in diff).

3 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `src/backend_task/tokens/query_my_token_balances.rs`:
- [BLOCKING] src/backend_task/tokens/query_my_token_balances.rs:58-60: Do not strand the token refresh single-flight guard
  The guard that clears `token_balance_refresh_in_flight` is moved into the spawned network request. `await_managed_network_request_with_timeout` returns a timeout after 90 seconds but deliberately leaves that request running under a reaper. If the underlying request remains hung, the guard is never dropped and every later refresh returns `TokenBalanceRefreshInProgress` for the rest of the session. Add bounded cancellation or a completion protocol that can safely release and reconcile the single-flight state after timeout.

In `src/app.rs`:
- [BLOCKING] src/app.rs:1815-1818: Do not treat terminal no-op migration state as permanently in progress
  `migration_allows_scheduled_vote_sweep` excludes `Idle`, but `FinishUnwire::terminal_state(false)` deliberately returns `Idle` when the completion sentinel already exists or no legacy data was moved. Acknowledging unreadable-data warnings also returns to `Idle`. The reconciler's per-network dispatch guard prevents another migration run, while this branch records a deferred sweep every frame and never resumes voting. Track whether the cold-start run completed instead of interpreting every `Idle` state as pre-dispatch.
- [BLOCKING] src/app.rs:1819-1826: Retain recovery eligibility until the deferred sweep succeeds
  The preserved migration cutoff is removed before the asynchronous recovery sweep reads the database, loads identities, or casts any vote. Task-level failures do not restore it, and per-vote network failures are caught while the sweep returns outer success. Every later periodic sweep receives `None`, so votes that became stale during migration are permanently filtered out despite being logged as left for the next sweep. Keep the cutoff until all eligible recovery work reaches a durable terminal outcome.
- [SUGGESTION] src/app.rs:2052-2068: Exercise AppState snapshot wiring instead of ArcSwap ownership
  This test proves only that an `Arc` returned by `MigrationStatus::state` retains the previous allocation after a replacement is published. It never drives `AppState::update` or verifies that input claiming, prompt activation, overlay rendering, banner reconciliation, and scheduled-vote gating all consume the same frame snapshot. A direct `migration_status().state()` read could be reintroduced in any one consumer without failing this test. Add an AppState-level regression that publishes during a frame and checks those consumers remain consistent until the next frame.

In `src/backend_task/contested_names/mod.rs`:
- [BLOCKING] src/backend_task/contested_names/mod.rs:242-246: Do not mark a rejected recovered vote as executed
  `vote_on_dpns_name` returns `Ok(DPNSVoteResults(...))` even when the Platform broadcast failed; the failure is stored inside the result vector. This sweep treats every outer `Ok` as success and emits `CastScheduledVote`. `AppState` then marks the database row executed and shows a success banner, permanently suppressing retries for a rejected vote. Inspect the nested result for the scheduled voter and emit success only when its Platform result is `Ok`.

[thepastaclaw]

🔴 Blocking: Do not strand the token refresh single-flight guard

The guard that clears token_balance_refresh_in_flight is moved into the spawned network request. await_managed_network_request_with_timeout returns a timeout after 90 seconds but deliberately leaves that request running under a reaper. If the underlying request remains hung, the guard is never dropped and every later refresh returns TokenBalanceRefreshInProgress for the rest of the session. Add bounded cancellation or a completion protocol that can safely release and reconcile the single-flight state after timeout.

_{source: ['codex']}

[thepastaclaw]

Resolved in b633a52 — Do not strand the token refresh single-flight guard no longer present.

_{Auto-resolved by the review system based on the latest commit diff. If you believe this was closed in error, reopen the thread.}

[thepastaclaw]

🔴 Blocking: Do not treat terminal no-op migration state as permanently in progress

migration_allows_scheduled_vote_sweep excludes Idle, but FinishUnwire::terminal_state(false) deliberately returns Idle when the completion sentinel already exists or no legacy data was moved. Acknowledging unreadable-data warnings also returns to Idle. The reconciler's per-network dispatch guard prevents another migration run, while this branch records a deferred sweep every frame and never resumes voting. Track whether the cold-start run completed instead of interpreting every Idle state as pre-dispatch.

_{source: ['codex']}

[thepastaclaw]

Resolved in 0fda1f6 — Do not treat terminal no-op migration state as permanently in progress no longer present.

_{Auto-resolved by the review system based on the latest commit diff. If you believe this was closed in error, reopen the thread.}

[thepastaclaw]

🔴 Blocking: Retain recovery eligibility until the deferred sweep succeeds

The preserved migration cutoff is removed before the asynchronous recovery sweep reads the database, loads identities, or casts any vote. Task-level failures do not restore it, and per-vote network failures are caught while the sweep returns outer success. Every later periodic sweep receives None, so votes that became stale during migration are permanently filtered out despite being logged as left for the next sweep. Keep the cutoff until all eligible recovery work reaches a durable terminal outcome.

_{source: ['codex']}

[thepastaclaw]

Resolved in 0fda1f6 — Retain recovery eligibility until the deferred sweep succeeds no longer present.

_{Auto-resolved by the review system based on the latest commit diff. If you believe this was closed in error, reopen the thread.}

[thepastaclaw]

🟡 Suggestion: Exercise AppState snapshot wiring instead of ArcSwap ownership

This test proves only that an Arc returned by MigrationStatus::state retains the previous allocation after a replacement is published. It never drives AppState::update or verifies that input claiming, prompt activation, overlay rendering, banner reconciliation, and scheduled-vote gating all consume the same frame snapshot. A direct migration_status().state() read could be reintroduced in any one consumer without failing this test. Add an AppState-level regression that publishes during a frame and checks those consumers remain consistent until the next frame.

_{source: ['codex']}

[thepastaclaw]

Resolved in 0fda1f6 — Exercise AppState snapshot wiring instead of ArcSwap ownership no longer present.

_{Auto-resolved by the review system based on the latest commit diff. If you believe this was closed in error, reopen the thread.}

[thepastaclaw]

Preliminary review — Codex only

Carried-forward revalidation confirms three scheduled-vote blockers remain, while four prior issues are fixed, token-refresh guard retention is intentional, and the AppState snapshot test remains a suggestion. The latest delta adds six blockers involving future database versions, incomplete data wiping, and uncorrelated document results. With nine confirmed blockers total, this PR requires changes.

Validated blockers were found in the Codex precheck. Sonnet is deferred until a fresh Codex revalidation clears the blocker gate.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (failed), gpt-5.6-sol — rust-quality (failed), gpt-5.6-sol — general (completed), gpt-5.6-sol — rust-quality (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet: not run (deferred by blocker gate)

🔴 9 blocking

4 additional finding(s) omitted (not in diff).

2 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `src/model/data_migration.rs`:
- [BLOCKING] src/model/data_migration.rs:6-9: Reject database versions newer than the understood schema
  The current schema and migration ladder end at version 38, but this gate accepts versions 39 and 40 despite having no definitions for either layout. A newer build can change SQL columns or serialized blob formats under either version, after which this older binary may skip undecodable records and write completion sentinels. Set the ceiling to the newest schema whose exact layout is understood, currently DEFAULT_DB_VERSION.

In `src/wallet_backend/mod.rs`:
- [BLOCKING] src/wallet_backend/mod.rs:1194-1214: Use fallible enumeration for the authoritative wallet wipe
  forget_all_wallets_local relies on WalletMetaView::list and SingleKeyView::list_persisted to discover every secret that must be removed. Both APIs log and suppress listing, key-parsing, and blob-decoding failures, returning an empty or incomplete vector. Clear Database can therefore report success while seeds or imported private keys remain on disk. Add fallible enumeration for this destructive path and propagate every listing or decoding failure into ClearAllOutcome.failures.

In `src/context/identity_db.rs`:
- [BLOCKING] src/context/identity_db.rs:994-1011: Do not purge identity metadata when its private keys were not deleted
  clear_identity_vault_keys silently returns when the stored identity cannot be read or decoded and only logs delete_all failures. Both Clear Database and Wipe Platform Data then purge the identity scope and enumeration index, leaving private keys in the secret store while deleting the metadata needed to identify and retry those deletions. Return a typed error and preserve the identity record and index until all associated vault rows are removed successfully.

In `src/context/wallet_lifecycle/spv.rs`:
- [BLOCKING] src/context/wallet_lifecycle/spv.rs:41-114: Wait for and propagate every database-clear operation
  Upstream wallet removal and shielded-store clearing are detached, while DashPay listing and deletion failures are only logged. The method can return Ok before durable cleanup finishes or after persisted contacts, wallet state, or shielded state failed to clear, and the UI immediately reports that all local data was removed. Await the asynchronous operations and add every synchronous or asynchronous failure to the authoritative WalletDataClearIncomplete result.

In `src/ui/contracts_documents/contracts_documents_screen.rs`:
- [BLOCKING] src/ui/contracts_documents/contracts_documents_screen.rs:582-604: Correlate successful document-query results before updating the screen
  Failures are checked against pending_fetch_context, but successful Documents and PageDocuments results still use the context-blind callback. Fetch Documents remains enabled while a request is pending, and document results can also arrive from other screens. An older or unrelated completion can therefore clear the active request and replace its documents and pagination state. Override display_backend_task_result and mutate state only when the supplied context matches pending_fetch_context.

In `src/ui/tokens/view_token_claims_screen.rs`:
- [BLOCKING] src/ui/tokens/view_token_claims_screen.rs:80-99: Prevent stale document results from replacing token claims
  The claims screen correlates failures but accepts every successful Documents result routed to the visible screen. Both Refresh and Fetch claims remain available during Fetching, so multiple requests can overlap, and results from unrelated document queries can also reach this callback. Correlate successful results to the pending operation; because repeated claims queries have identical contexts, also disable duplicate dispatches while fetching or add a unique operation identifier.

In `src/app.rs`:
- [BLOCKING] src/app.rs:84-92: Treat a completed no-op migration as terminal
  migration_allows_scheduled_vote_sweep excludes Idle, while finish_unwire deliberately leaves a successful no-op run in Idle. MigrationReconciler dispatches only once per network, so an ordinary launch with no data to move remains Idle permanently and defers scheduled votes on every frame. Represent completed-with-no-changes as a distinct terminal state or track cold-start completion separately from MigrationState::Idle.

In `src/backend_task/contested_names/mod.rs`:
- [BLOCKING] src/backend_task/contested_names/mod.rs:231-247: Do not mark nested vote failures as successful casts
  vote_on_dpns_name returns an outer Ok(DPNSVoteResults) even when Platform rejected the submission, storing that failure inside the nested result vector. This branch treats every outer Ok as success and emits CastScheduledVote, after which AppState marks the database row executed and shows a success message. Inspect the nested result and emit CastScheduledVote only when the scheduled voter's submission succeeded.

[thepastaclaw]

🔴 Blocking: Reject database versions newer than the understood schema

The current schema and migration ladder end at version 38, but this gate accepts versions 39 and 40 despite having no definitions for either layout. A newer build can change SQL columns or serialized blob formats under either version, after which this older binary may skip undecodable records and write completion sentinels. Set the ceiling to the newest schema whose exact layout is understood, currently DEFAULT_DB_VERSION.

_{source: ['codex']}

[thepastaclaw]

🔴 Blocking: Wait for and propagate every database-clear operation

Upstream wallet removal and shielded-store clearing are detached, while DashPay listing and deletion failures are only logged. The method can return Ok before durable cleanup finishes or after persisted contacts, wallet state, or shielded state failed to clear, and the UI immediately reports that all local data was removed. Await the asynchronous operations and add every synchronous or asynchronous failure to the authoritative WalletDataClearIncomplete result.

_{source: ['codex']}

[thepastaclaw]

🔴 Blocking: Treat a completed no-op migration as terminal

migration_allows_scheduled_vote_sweep excludes Idle, while finish_unwire deliberately leaves a successful no-op run in Idle. MigrationReconciler dispatches only once per network, so an ordinary launch with no data to move remains Idle permanently and defers scheduled votes on every frame. Represent completed-with-no-changes as a distinct terminal state or track cold-start completion separately from MigrationState::Idle.

_{source: ['codex']}

[thepastaclaw]

🔴 Blocking: Do not mark nested vote failures as successful casts

vote_on_dpns_name returns an outer Ok(DPNSVoteResults) even when Platform rejected the submission, storing that failure inside the nested result vector. This branch treats every outer Ok as success and emits CastScheduledVote, after which AppState marks the database row executed and shows a success message. Inspect the nested result and emit CastScheduledVote only when the scheduled voter's submission succeeded.

_{source: ['codex']}

[thepastaclaw]

Preliminary review — Codex only

All nine carried-forward blocker candidates and the prior test-coverage suggestion remain valid; the three Clear Database blockers are consolidated into one comment because they share the same false-success outcome. Latest-delta review adds one blocker for dynamic help popups sharing a guard ID and one suggestion for immediate same-popup reopening. With eight consolidated blockers and two suggestions, this PR requires changes.

Validated blockers were found in the Codex precheck. Sonnet is deferred until a fresh Codex revalidation clears the blocker gate.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed), gpt-5.6-sol — rust-quality (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet: not run (deferred by blocker gate)

🔴 8 blocking | 🟡 1 suggestion(s)

2 additional finding(s) omitted (not in diff).

6 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `src/ui/contracts_documents/contracts_documents_screen.rs`:
- [BLOCKING] src/ui/contracts_documents/contracts_documents_screen.rs:582-604: Correlate successful document-query results before updating the screen
  Failures are checked against `pending_fetch_context`, but successful `Documents` and `PageDocuments` results still use the context-blind callback. The fetch control remains available while a request is pending, and results are routed to whichever screen is visible. An older or unrelated completion can therefore clear the active request and replace its documents and pagination state. Override `display_backend_task_result` and mutate state only when the supplied context matches the pending query.

In `src/ui/tokens/view_token_claims_screen.rs`:
- [BLOCKING] src/ui/tokens/view_token_claims_screen.rs:80-99: Prevent stale document results from replacing token claims
  The claims screen correlates failures but accepts every successful `Documents` result routed to the visible screen. Refresh and Fetch claims can dispatch overlapping requests, and an unrelated document query can also complete while this screen is visible. Correlate successful results with the expected claims-query context and prevent duplicate identical requests while a fetch is active, or add a unique operation identifier.

In `src/ui/identities/add_existing_identity_screen.rs`:
- [BLOCKING] src/ui/identities/add_existing_identity_screen.rs:1117-1120: Give each dynamic help popup its own guard ID
  This screen multiplexes at least five help messages through one `InfoPopup` ID. Because the popup does not block background input, clicking a different help icon while one popup is open replaces the message before rendering. The guard sees the same ID on consecutive passes, treats that opening click as an ordinary outside click, and immediately closes the second popup. Include the message or another stable help-site discriminator in the ID; the same dynamic-single-ID pattern appears in `AddNewIdentityScreen` and `ContactProfileViewerScreen`.

In `src/ui/helpers.rs`:
- [SUGGESTION] src/ui/helpers.rs:66-70: Re-arm a modal guard after an outside-click dismissal
  The helper records the current pass before reporting an outside-click dismissal. If the same popup ID is reopened on the immediately following pass, the stored pass still looks continuous, so the reopening click closes the popup again. Remove the temporary pass entry when dismissal is reported so a new rendering episode is recognized even without a full non-rendering pass between episodes.

[thepastaclaw]

🔴 Blocking: Give each dynamic help popup its own guard ID

This screen multiplexes at least five help messages through one InfoPopup ID. Because the popup does not block background input, clicking a different help icon while one popup is open replaces the message before rendering. The guard sees the same ID on consecutive passes, treats that opening click as an ordinary outside click, and immediately closes the second popup. Include the message or another stable help-site discriminator in the ID; the same dynamic-single-ID pattern appears in AddNewIdentityScreen and ContactProfileViewerScreen.

Suggested change

	let mut popup = InfoPopup::new(
	egui::Id::new("load_identity_info_popup"),
	"Load Identity Information",
	&show_pop_up_info_text,
	let mut popup = InfoPopup::new(
	egui::Id::new("load_identity_info_popup").with(&show_pop_up_info_text),
	"Load Identity Information",
	&show_pop_up_info_text,
	);

_{source: ['codex']}

[thepastaclaw]

🟡 Suggestion: Re-arm a modal guard after an outside-click dismissal

The helper records the current pass before reporting an outside-click dismissal. If the same popup ID is reopened on the immediately following pass, the stored pass still looks continuous, so the reopening click closes the popup again. Remove the temporary pass entry when dismissal is reported so a new rendering episode is recognized even without a full non-rendering pass between episodes.

Suggested change

	let this_pass = ctx.cumulative_pass_nr();
	let last_pass: Option<u64> = ctx.data(|d| d.get_temp(id));
	ctx.data_mut(|d| d.insert_temp(id, this_pass));
	let is_opening_frame = last_pass != Some(this_pass.wrapping_sub(1));
	!is_opening_frame && clicked_outside_window(ctx, window_rect)
	let this_pass = ctx.cumulative_pass_nr();
	let last_pass: Option<u64> = ctx.data(|d| d.get_temp(id));
	ctx.data_mut(|d| d.insert_temp(id, this_pass));
	let is_opening_frame = last_pass != Some(this_pass.wrapping_sub(1));
	if is_opening_frame {
	return false;
	}
	let clicked = clicked_outside_window(ctx, window_rect);
	if clicked {
	ctx.data_mut(|d| d.remove::<u64>(id));
	}
	clicked

_{source: ['codex']}

[thepastaclaw]

Preliminary review — Codex only

Nine in-scope blocking issues remain at head 0e79a89, including a newly committed, cryptographically valid mnemonic and testnet private key. All ten prior findings remain valid; the two modal-guard findings are consolidated into one canonical blocker, leaving nine blockers and one suggestion within the comment budget.

Validated blockers were found in the Codex precheck. Sonnet is deferred until a fresh Codex revalidation clears the blocker gate.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed), gpt-5.6-sol — rust-quality (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet: not run (deferred by blocker gate)

🔴 9 blocking

2 additional finding(s) omitted (not in diff).

7 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `docs/ai-design/2026-07-14-pr892-user-story-qa/scenarios/WAL.md`:
- [BLOCKING] docs/ai-design/2026-07-14-pr892-user-story-qa/scenarios/WAL.md:116-117: Remove committed wallet recovery material
  These lines contain a checksum-valid 12-word BIP39 mnemonic, and line 140 contains a checksum-valid compressed testnet WIF private key. Deleting the test wallets or recording that they currently have no balance does not revoke these credentials: anyone with repository access can derive their addresses and spend funds sent there later, and removing the text in a later commit leaves it recoverable from history. Remove the literals, rewrite the affected history, and treat both credentials as compromised.

In `src/ui/contracts_documents/contracts_documents_screen.rs`:
- [BLOCKING] src/ui/contracts_documents/contracts_documents_screen.rs:582-604: Correlate successful document-query results before updating the screen
  Failures are correlated against `pending_fetch_context`, but successful `Documents` and `PageDocuments` results still use the legacy context-blind callback. The fetch control remains available while a request is pending, and results are routed asynchronously to whichever screen is visible. An older or unrelated completion can therefore clear the active request and replace its documents and pagination state. Override `display_backend_task_result` and mutate state only when its context matches the pending query.

In `src/ui/tokens/view_token_claims_screen.rs`:
- [BLOCKING] src/ui/tokens/view_token_claims_screen.rs:80-99: Prevent stale document results from replacing token claims
  The claims screen compares task context only for failures and accepts every successful `Documents` result routed to it. Both Refresh and Fetch claims can dispatch while work is active, and unrelated document queries can also complete while this screen is visible. A stale completion can overwrite the claims and reset `fetch_status`; successful results need the same context correlation as failures, with duplicate identical requests suppressed or assigned unique operation identifiers.

[thepastaclaw]

🔴 Blocking: Remove committed wallet recovery material

These lines contain a checksum-valid 12-word BIP39 mnemonic, and line 140 contains a checksum-valid compressed testnet WIF private key. Deleting the test wallets or recording that they currently have no balance does not revoke these credentials: anyone with repository access can derive their addresses and spend funds sent there later, and removing the text in a later commit leaves it recoverable from history. Remove the literals, rewrite the affected history, and treat both credentials as compromised.

_{source: ['codex']}