docs(10): record KEY-03 scoping correction — Core wallet path is uncalled

Bitcoin Core's wallet is legacy and unused: bitcoin.init-wallet-from-seed has
no caller outside its dispatcher registration, the wallet UI is LND-only
(lnd.sendcoins/estimatefee/getinfo), archi-dev-box has no bitcoin/wallets/ dir
so the handler's named descriptor wallet was never created there, and the
endpoint is authenticated + password-gated so F-13 was never remotely
reachable.

F-13 is therefore latent, not live. D-07's migration premise is unproven, so
KEY-03 is re-scoped discovery-first: check the fleet for any wallet this
handler created before planning any migration. Migration + checkpoint stay,
conditional on discovery.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/phases/10-key-material-hardening/10-CONTEXT.md

@@ -84,6 +84,39 @@ derivation paths, word counts, or the at-rest encryption envelope.
   depends entirely on the retained `wallet.dat` and the parity proof; a migration that loses
   UTXO visibility is a funds-visibility incident. Earns a checkpoint before execution.
 
+- **D-07a (scoping correction, 2026-08-01, after D-07 was recorded):** the user states Bitcoin
+  Core's wallet is no longer used by anything and is very old. Verified:
+  1. `bitcoin.init-wallet-from-seed` has **no caller anywhere** — the only occurrence outside
+     the handler is its dispatcher registration (`dispatcher.rs:122`). Nothing in `neode-ui/src`,
+     `core/`, or scripts.
+  2. **LND is the wallet.** `Web5Wallet.vue` and `SendBitcoinModal.vue` call `lnd.sendcoins`,
+     `lnd.estimatefee`, `lnd.getinfo`. Across all of `neode-ui/src` the only `bitcoin.*` calls
+     are `bitcoin.getinfo`, `bitcoin.prune-status`, `bitcoin.onion` — no wallet operations.
+  3. archi-dev-box has **no `/var/lib/archipelago/bitcoin/wallets/` directory**, so the named
+     descriptor wallet this handler creates (default `wallet_name` = `"archipelago"`,
+     `bitcoin.rs:172-174`) has never been created there. The `wallet.dat` at the datadir root is
+     Core's legacy default-wallet location, not this handler's output.
+  4. The endpoint is authenticated **and** requires the user's password (`verify_password`,
+     `bitcoin.rs:177-180`); it is absent from `UNAUTHENTICATED_METHODS`. F-13 was never remotely
+     reachable — it is key-at-rest duplication, not an exposed endpoint.
+
+  **Therefore F-13 is latent, not live**, and D-07's premise (funded wallets out there carrying
+  the xprv) is unproven. KEY-03 is re-scoped **discovery-first**: a fleet-wide check for any
+  wallet this handler created, and whether it holds balance/UTXO history, runs *before* any
+  migration. The migration and its checkpoint stay in the plan but become **conditional on
+  discovery finding a real wallet**. If discovery is empty fleet-wide, the correct fix is the
+  cheap one — make the handler watch-only by construction (xpub + key origin per D-09), or
+  delete the endpoint as dead code, recording the evidence either way. Deleting is to be
+  presented as a decision, not taken unilaterally. Only archi-dev-box is known-negative; the
+  rest of the fleet is UNVERIFIED. Discovery commands must never use `listdescriptors true`
+  (it returns private keys); `listwallets` / `getwalletinfo` / `listdescriptors` suffice.
+
+  *Consequence for D-08:* if Core's wallet is genuinely dead, LND is the only wallet that
+  matters, and `PSBT-SIGNING-ARCHITECTURE.md`'s honest LND limits (channel, revocation and HTLC
+  keys cannot be air-gapped) become the governing constraint on the phase's signing story. The
+  plan must say so plainly rather than implying a watch-only Core wallet delivers air-gapped
+  custody.
+
 - **D-08:** Default signing stays **daemon-side PSBT signing** using the seed already held in
   the encrypted envelope, with the air-gapped/external-signer path from
   `docs/security/PSBT-SIGNING-ARCHITECTURE.md` available as **opt-in**. Send UX is unchanged;