From 0129ac0388479e5485c1e9055d076e2358141783 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Wed, 14 Oct 2026 02:10:39 +0000
Subject: [PATCH] fix: the defective xprv wallet notice says the user needs
 their own copy of the key (closes #255)

The notice told the user that these addresses are reachable by software
that repeats the same derivation, while the same wallet blocks Export
Private Key, so there was no way to take that route from here. The
second paragraph now names private key export among the disabled
controls and says the addresses can be reached only with the extended
private key the user imported, if they kept a copy of it. No behaviour
changes. A test checks the new wording.

Model: opus-5-5
---
 src/shared/walletDefects.js | 11 ++++++-----
 tests/walletDefects.test.js | 12 ++++++++++++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/shared/walletDefects.js b/src/shared/walletDefects.js
index eb4ed27..4e0e3e0 100644
--- a/src/shared/walletDefects.js
+++ b/src/shared/walletDefects.js
@@ -36,11 +36,12 @@ const DEFECTS = {
                 "derivation path beneath that key instead of from a master " +
                 "key, so the addresses listed here are not the ones that key " +
                 "produces under the standard path.",
-            "Signing and sending are disabled for this wallet. The addresses " +
-                "do descend from the extended private key you imported, so " +
-                "anything they hold is still reachable by software that " +
-                "repeats the same non-standard derivation. Check them in a " +
-                "block explorer before deciding what to do.",
+            "Signing, sending and private key export are disabled for this " +
+                "wallet. Anything these addresses hold can be reached only " +
+                "with the extended private key you imported, if you kept a " +
+                "copy of it, in software that repeats the same non-standard " +
+                "derivation. Check the addresses in a block explorer before " +
+                "deciding what to do.",
             "To see the addresses this key produces under the standard path, " +
                 "import the master extended private key, or the recovery " +
                 "phrase it came from, as a new wallet. Nothing here has been " +
diff --git a/tests/walletDefects.test.js b/tests/walletDefects.test.js
index a9fd35d..2e7de77 100644
--- a/tests/walletDefects.test.js
+++ b/tests/walletDefects.test.js
@@ -153,6 +153,18 @@ describe("the explanatory copy", () => {
         expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
     });
 
+    // The wallet holds the imported key but will not export it, so the copy
+    // must not send the user to other software without saying they need
+    // their own copy of that key.
+    test("it says only the user's own copy of the imported key reaches the addresses", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toMatch(/private key export are disabled/);
+        expect(body).toMatch(
+            /only with the extended private key you imported, if you kept a copy of it/,
+        );
+    });
+
     test("it says the wallet is not deleted and what the user can do", () => {
         const body = defect.paragraphs.join(" ");