docs(10-05): record the Core-wallet fleet census — 4 nodes clear, 6 unchecked (D-07b)

Task 3 of plan 10-05, run by the operator over Tailscale on 2026-08-02 using the
read-only procedure in KEY-03-SIGNING-POSTURE.md. No escalation: nothing found.

Examined and CLEAR (4): archi-dev-box, shorty-s/.228, archy-x250-beta,
archy-x250-pa. On every one there is no wallet named `archipelago` — the deleted
handler's default wallet_name — `listwallets` returns only the unnamed default,
and that default reports blank=true, keypoolsize=0, txcount=0, balance=0. The
only named wallets are Fedimint gatewayd-*. The result holds across two
container vintages (bitcoin-knots and bitcoin-core), so it is not four copies of
one image behaving identically.

Not examined (6), recorded with reasons rather than omitted: framework-pt,
archipelago-1, archipelago and archy-dev-pa (SSH permission denied — password
rotated/not held), archipelago-5 (timed out during banner exchange), and
archy-x250-dev (offline). Password auth was deliberately not attempted: several
fleet nodes lock PAM quickly on a wrong password, and locking out an in-use
production node is a worse outcome than an incomplete census.

The conclusion is stated at the strength the evidence supports — no *examined*
node holds a wallet the deleted handler created, and no examined node holds any
wallet with keys or funds. It is deliberately NOT generalised to "the fleet is
clear" while six nodes are unknown. F-13 is closed by deletion regardless: the
code that could create such a wallet is gone from every future build.

No key material appeared in any output and `listdescriptors true` was never run.

Also corrects the now-stale R-04/F-13 entry in UNIFIED-TASK-TRACKER.md, which
still described `handle_bitcoin_init_wallet_from_seed` and a watch-only
migration as pending work — that code no longer exists. Marks it done-by-
deletion and adds the six unchecked nodes as a standing item, flagged as a
natural fold-in for KEY-04's on-node work but tracked independently so it does
not vanish if KEY-04 is re-scoped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/UNIFIED-TASK-TRACKER.md

@@ -203,19 +203,33 @@ those are marked ✅ below with the commit that did it, so we stop re-litigating
       authentication boundary on a live fleet — **needs its own `/gsd-plan-phase` with a
       federation re-verify**, not an opportunistic patch.
 
-- [ ] **PSBT-first signing: Phase 1 — move the Bitcoin private key out of Core**
-      (entropy audit R-04, finding **F-13** + `docs/security/PSBT-SIGNING-ARCHITECTURE.md`
-      §8 Phase 1). `handle_bitcoin_init_wallet_from_seed` passes
-      `disable_private_keys = false` (`core/archipelago/src/api/rpc/bitcoin.rs:203`) and
-      imports `wpkh(xprv/0/*)` / `wpkh(xprv/1/*)` (`:229-231`), so the BIP-84 account
-      **private** key is persisted in Bitcoin Core's `wallet.dat` — with an empty wallet
-      passphrase (`:205`) — in addition to the daemon's Argon2 envelope. The descriptors
-      also carry **no `[fingerprint/derivation]` key origin**, so no hardware signer
-      could ever locate its key even if the private key were removed. Fix: watch-only
-      (`disable_private_keys=true`) + xpub-with-origin descriptors + a migration that
-      verifies balance and UTXO parity **before** removing the old wallet. This is the
-      single highest-value change in the PSBT spec and unblocks every later phase.
-      Needs a node with real UTXO history to verify.
+- [x] **PSBT-first signing: Phase 1 — move the Bitcoin private key out of Core** — **DONE
+      2026-08-02 by deletion, not conversion** (entropy audit R-04, finding **F-13**;
+      Phase 10 plan 10-05, decision **D-07b**). The handler that imported the BIP-84
+      account **private** key into Core's `wallet.dat` had no caller anywhere, LND is the
+      wallet the UI drives, and the endpoint was authenticated *and* password-gated — so
+      it was deleted outright rather than rewritten watch-only. `bitcoin.rs`'s wallet-init
+      handler and its `dispatcher.rs` arm are gone; **no daemon code path writes the
+      BIP-84 private key into Bitcoin Core.** No migration was performed or is needed —
+      a 4-node fleet census found no wallet the handler created. D-09's key-origin
+      requirement moved to the PSBT itself: `lnd.create-psbt` now reports
+      `key_origin` (`psbt_key_origin_report`, `api/rpc/lnd/wallet.rs`).
+      **Read `docs/security/KEY-03-SIGNING-POSTURE.md` for the current state** — it also
+      records the verdict that **no fleet node is provisioned watch-only**, so what ships
+      today is PSBT *transport*, not air-gapped custody.
+
+- [ ] **Finish the Core-wallet fleet census — 6 nodes unchecked** (Phase 10 plan 10-05,
+      Task 3; standing item). The 2026-08-02 census examined 4 nodes (archi-dev-box,
+      shorty-s/.228, archy-x250-beta, archy-x250-pa) and found **no** wallet created by
+      the deleted handler and no wallet holding keys or funds. Six were not examined:
+      framework-pt, archipelago-1, archipelago, archy-dev-pa and archipelago-5
+      (SSH auth/connectivity) and archy-x250-dev (offline). Re-run the **read-only**
+      procedure in `docs/security/KEY-03-SIGNING-POSTURE.md` § *Fleet census* when
+      credentials or connectivity allow — a natural fold-in for KEY-04's on-node work.
+      **Never run `listdescriptors true`** (it returns private keys). If any node reports
+      a wallet named `archipelago`, or any descriptor wallet with
+      `private_keys_enabled: true` that is not blank/empty, **stop and escalate — do not
+      migrate or modify it** (D-07b).
 
 - [ ] **PSBT-first signing: Phases 2-7 rollout**
       (`docs/security/PSBT-SIGNING-ARCHITECTURE.md` §8) — the spec is written to be