fix: rebase SND-003 onto PR893 + QA-campaign fix batches

.gitignore

@@ -36,3 +36,6 @@ explorer.log
 .gitaipconfig
 .claude/worktrees
 .codex/
+
+# QA scenario screenshots — archived to /data/artifacts, not tracked in git
+docs/ai-design/*/scenarios/screenshots/

CHANGELOG.md

@@ -41,6 +41,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **The first launch after an upgrade asks for each password-protected wallet's
+  password**: the app moves your wallets into a new storage format on that first
+  launch, and it needs each protected wallet's password to finish the move for
+  that wallet. You are asked once per wallet, one at a time. If you don't have a
+  password to hand, you can skip that wallet: it stays locked, no coins are lost,
+  and its move finishes the next time you unlock it with its password. The
+  password is used for the update and is not kept unlocked afterwards.
+
+- **The previous version's database is kept on this device as a read-only
+  recovery copy**: it is never written to, and it is no longer erased by "Clear
+  Database" or "Remove Wallet". Those actions remove the data *this* version
+  uses; the older recovery database remains and may still contain wallet recovery
+  data, which both confirmation dialogs now say before you confirm. Because that
+  database is read-only, the "Clear Platform Addresses" developer tool is
+  unavailable, and says why.
+
 - **Masternode and evonode identities no longer appear in the Identity Hub or
   Identities picker**: they now live exclusively on the new Masternodes tab,
   so you're never offered actions (like registering a username) that don't
@@ -164,6 +180,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
+- **Submitted Platform actions are no longer reported as rejected when only
+  confirmation failed**: if a state transition was broadcast but its result
+  could not be confirmed, the app now tells you to check whether it completed
+  before trying again instead of showing an unsafe rejection-and-retry message.
+
+- **Shielded actions now say when they are unavailable instead of failing
+  obscurely**: if shielding, sending, or withdrawing shielded funds is not
+  available on your network yet, the app says so and points you at a regular
+  payment, rather than starting the action and failing part-way through.
+
+- **DashPay contact details and request actions are protected from accidental loss or duplicate
+  fees**: declining, cancelling, unhiding, or renaming a contact now preserves every unrelated
+  encrypted detail. If another client saved details this app cannot read, the app offers a clear,
+  confirmed replacement path instead of silently erasing them or leaving the contact permanently
+  hidden. Switching Identity Hub tabs also keeps paid request actions disabled until their original
+  task finishes.
+
 - **Your settings and scheduled votes now survive an upgrade**: upgrading from an
   earlier version no longer starts the app with a blank configuration. The first
   launch after the upgrade brings across your selected network, start screen,

CLAUDE.md

@@ -72,6 +72,7 @@ scripts/safe-cargo.sh +nightly fmt --all
 * **i18n-ready strings**: All user-facing strings (labels, messages, tooltips, errors) must be simple, complete sentences. Avoid concatenating fragments, positional assumptions, or grammar that breaks in other languages. Each string should be extractable as a single translation unit with named placeholders for dynamic values and no logic in the text itself. Current code uses standard Rust format specifiers (`{name}`, `{max}`). When i18n extraction happens later, these will become Fluent-style placeholders (`{ $name }`, `{ $max }`).
 * **Never parse error strings** to extract information. Always use the typed error chain (downcast, match on variants, access structured fields). If no typed variant exists for the information you need, define a new `TaskError` variant or extend the existing error type. String parsing is fragile, breaks on message changes, and bypasses the type system.
 * **Validation placement**: Pure input validation (format, length, character sets) lives in `model/` as stateless functions — single source of truth, unit-testable, no dependencies on `AppContext` or `Sdk`. Backend tasks are the authoritative enforcement layer: they call model validators for format checks AND perform stateful validation that requires network or database (existence checks, uniqueness, business rules). UI screens may call model validators for instant user feedback, but must never implement their own validation logic — always delegate to the model function.
+* **Never commit secrets.** Never put plaintext recovery phrases (BIP39 mnemonics), private keys, passwords, seeds, or API tokens anywhere in the repository — not in source, tests, fixtures, or documentation (including QA notes, design docs, and `docs/ai-design/**`). Refer to wallets and keys by name or public identifier only; import real secrets from the operator's secure store at runtime, never by pasting them into a file. A secret committed even once persists in git history after removal, so any exposed secret must be treated as compromised and rotated.
 
 ### DET Module Placement Policy