docs: QR/audio will transfer notes

BALQR-framed chunk scheduler (bal/core/qrtransfer.py) with zlib compression,
four chunk presets and a QR_CHUNK_SIZE setting (row 16).
Export/import dialogs (WillQrExportDialog/WillQrImportDialog), per-tx
review-and-sign wizard, export filters (All/Valid/Valid-NC) and an Auto
slideshow with speed + loop for the QR codes; optional audio_modem channel
with a local receive mirror. _prepare_and_sign_tx refactor (no behaviour
change); WillItem.status defaults to '' instead of None (import crash fix);
invalidate_will guard for a missing date_to_check. Docs: PLAN_QR_TRANSFER,
QML_PLAN, README, HANDOFF, CHANGELOG entry 56, AUDIO_MODEM_DEBIAN.

.gitignore

@@ -33,3 +33,4 @@ tmp*
 
 # Release artifacts
 bal_v*.zip.*
+tests/karen7

AUDIO_MODEM_DEBIAN.md

@@ -0,0 +1,170 @@
+# Audio MODEM on Debian — setup & troubleshooting
+
+How to make the optional **audio channel** of BAL (and Electrum's own
+`audio_modem` plugin) work on Debian/Ubuntu. The channel lets you send a will
+to another device as acoustic OFDM tones instead of scanning QR codes.
+
+Recommended reading before starting: `CHANGELOG.md` entry 56
+(Audio-environment notes) and `HANDOFF.md` (Dev-box audio prerequisites).
+
+---
+
+## 1. What you need (three independent pieces)
+
+| Piece                    | Provides                                   | Where it comes from                  |
+|--------------------------|--------------------------------------------|--------------------------------------|
+| `amodem` (Python)        | OFDM modulation/demodulation               | `pip install amodem` (any venv)       |
+| `libportaudio.so`        | sound I/O backend used by `amodem.audio`   | Debian package `libportaudio2` (+ dev symlink, see §2) |
+| Electrum `audio_modem`   | the plugin whose `_send`/`_recv` BAL reuses | built into Electrum                   |
+
+BAL shows the audio buttons only when the plugin is **enabled** (Tools →
+Plugins → Audio Modem) and `amodem` is importable.
+
+> On a headless/CI box there is no speaker/mic, but the channel can still be
+> verified with the **sink-monitor loopback** in §4.
+
+---
+
+## 2. The two line fixes (this is the part everyone forgets)
+
+Debian ships a versioned `libportaudio.so.2` but **not** the unversioned
+`libportaudio.so` that old `amodem` code uses, and `amodem` uses NumPy APIs
+removed in NumPy 2.x. Both fail **silently** (the plugin's `_send` runs the
+load inside a `WaitingDialog` thread without an `on_error` handler).
+
+### 2a. PortAudio unversioned symlink
+
+Install the dev package (creates the unversioned symlink), or create it by
+hand:
+
+```bash
+sudo apt install libportaudio2 libportaudio-dev   # preferred
+# or, without the package:
+sudo ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2 \
+           /usr/lib/x86_64-linux-gnu/libportaudio.so
+```
+
+Verify:
+
+```bash
+source "$BAL_HOME/electrum/env/bin/activate"
+python3 -c "import amodem.audio; print(amodem.audio.Interface(config=None).load('libportaudio.so').call('GetVersionText'))"
+# b'PortAudio V19...'  <-- success
+```
+
+> **No-sudo alternative** (fine for one-shot tests): point `LD_LIBRARY_PATH`
+> at a directory containing a `libportaudio.so` symlink to the `.so.2`:
+> ```bash
+> mkdir -p /tmp/portaudio_stub
+> ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2 /tmp/portaudio_stub/libportaudio.so
+> export LD_LIBRARY_PATH=/tmp/portaudio_stub:$LD_LIBRARY_PATH
+> ```
+
+### 2b. amodem vs NumPy 2.x (`tostring` removed)
+
+`amodem` 1.16.0 calls `numpy.ndarray.tostring()`, removed in NumPy 2.x
+(≥ 2.4.6 dies with `AttributeError` on the first sample write, so **no carrier
+is ever emitted**). Either pin NumPy < 2, or patch the single line in the
+installed package:
+
+```bash
+source "$BAL_HOME/electrum/env/bin/activate"
+python3 -m pip install "numpy<2"   # option A (downgrade)
+# option B (patch; path depends on your site-packages):
+sed -i "s/sym.astype('int16').tostring()/sym.astype('int16').tobytes()/" \
+  "$BAL_HOME/electrum/env/lib/python3.11/site-packages/amodem/common.py"
+```
+
+> This must be done on **every** machine that receives/sends audio (both ends
+> of the channel use the same code), and again after reinstalling/upgrading
+> `amodem`.
+
+---
+
+## 3. Environment checklist (dev box, already applied)
+
+These were applied on the current dev box and do NOT need to be re-done:
+
+- `amodem` installed in the runtime venv (`1.16.0`).
+- `amodem/common.py` patched `tostring()` → `tobytes()`.
+- System symlink or `LD_LIBRARY_PATH` stub for `libportaudio.so`.
+- PulseAudio running; default sink `ALC236 Analog`, default source DMIC.
+
+Check them in one command:
+
+```bash
+source "$BAL_HOME/electrum/env/bin/activate"
+python3 - <<'EOF'
+import amodem, ctypes, numpy, zlib
+print("amodem", amodem.__version__)
+print("numpy", numpy.__version__, "(2.x needs the tobytes patch)")
+import amodem.audio
+amodem.audio.Interface(config=None).load("libportaudio.so")
+print("libportaudio.so loaded OK (symlink or LD_LIBRARY_PATH in place)")
+EOF
+```
+
+---
+
+## 4. Verifying the channel (no speakers/mic needed)
+
+Full **send → sink → sink-monitor → recv** round-trip on one machine:
+
+```bash
+# 1) route capture at the loop and remember the original source
+MON="$(pactl get-default-sink).monitor"; ORIG=$(pactl get-default-source)
+pactl set-default-source "$MON"
+
+# 2) run the round-trip (uses zlib-compressed payload like the plugin)
+source "$BAL_HOME/electrum/env/bin/activate"
+timeout 90 python3 /tmp/opencode/bal_audio_loopback.py
+#   expected: bitrate 1.0 kbps ... send done ... RECV OK
+
+# 3) restore the original source
+pactl set-default-source "$ORIG"
+```
+
+Any payload you like: `python3 /tmp/opencode/bal_audio_loopback.py "BALQR|1|1|0|hi"`.
+
+With real speakers + mic instead, skip the `pactl` swapping, put the devices
+close, keep volumes high, and run the same script.
+
+---
+
+## 5. Testing through the real GUI
+
+1. **Tools → (Plugins) → Audio Modem** → enable it. If asked for settings,
+   pick a bitrate: default `slowest()` is ~1.0–1.2 kbps (a ~2 KB will takes
+   ~15–20 s of audio); higher bitrates are faster but less robust.
+2. Wallet A → BAL will list → **Export → QR Codes → Audio…**
+   (the audio transport sends the raw newline-joined tx list, no BAL framing).
+3. Wallet B → will list → **Import via QR → Audio…** → wait for
+   "Waiting for audio (... kbps)…", a loading cursor while demodulating,
+   then the decoded slots appear → review/sign wizard opens.
+4. One machine only: apply the §4 monitor trick in the shell where Electrum
+   runs (export plays to the sink; import records from the sink monitor).
+
+---
+
+## 6. Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| No sound at all, no error anywhere in the log | `libportaudio.so` not loadable (silent) | §2a symlink or `LD_LIBRARY_PATH` stub |
+| Sound played, "Timeout waiting for carrier" on the receive end | Capture routed to the wrong device / mic muted / no speakers | §4 monitor trick; `pactl` source check; raise volume; move devices closer |
+| "Decoding failed" after carrier, no payload | Send side died with numpy `tostring` → nothing modulated | §2b patch or `numpy<2` on BOTH machines |
+| Buttons "Audio…" missing in BAL dialogs | `audio_modem` disabled in Plugins, or `amodem` not importable in the running venv | Enable plugin; `pip install amodem` |
+| Audio too long / too slow | 1 kbps default | Raise bitrate in Audio Modem settings dialog |
+
+---
+
+## 7. No-sudo quick reference (all commands)
+
+```bash
+python3 -m pip install amodem
+mkdir -p /tmp/portaudio_stub
+ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2 /tmp/portaudio_stub/libportaudio.so
+export LD_LIBRARY_PATH=/tmp/portaudio_stub:$LD_LIBRARY_PATH
+# numpy >= 2 (one of):
+pip install "numpy<2"   # or patch amodem/common.py tobytes
+```

CHANGELOG.md

@@ -2909,6 +2909,108 @@ renumber the grid rows.
 
 **Outcome:** DONE.
 
+## 56. QR / audio will transfer (chunked multi-QR export/import + review-and-sign wizard)
+
+**Date:** 2026-08-27
+
+**Goal (owner request):** export a will to another device via QR codes (with
+an optional audio channel on top), and import it there with a per-transaction
+review-and-sign flow. QR codes are chunked because a full will usually exceeds
+a single code's capacity.
+
+**What changed:**
+
+- `bal/core/qrtransfer.py` (new, GUI-free): the wire format and chunk
+  scheduler — `BALQR{version}|{total}|{index}|{flags}|{payload}` frames,
+  `encode_transfer` / `decode_transfer`, `split_frames` / `parse_frame` /
+  `assemble`, optional `Z` (zlib+base64) compression at export, four chunk
+  presets (150/400/900/1800 bytes/frame, EC level M), plus
+  `preset_index_for_chunk_size` and the `QrTransferError` exception family.
+- `tests/test_core_qr_transfer.py` (new): round-trips (plain/compressed),
+  boundaries (exact-fit, size>payload, `|` in payload), min-size guard, bad
+  magic/version/numbers/flags, multi-frame reassembly, header consistency.
+- `bal/core/plugin_base.py`: new `QR_CHUNK_SIZE` config (default 150).
+- `bal/gui/qt/plugin.py`: settings-dialog row 16 "QR Code Size" combo
+  (4 presets) + reset button, visible in BASIC and ADVANCED.
+- `bal/gui/qt/dialogs.py`:
+  - `BalQrImage`: QR widget with MEDIUM error correction (Electrum's
+    `QRCodeWidget` is EC-L), reusing `draw_qr`.
+  - `WillQrExportDialog`: walks the frames (Prev/Next, "i of N" progress),
+    export filters **All / Valid / Valid-NC**, live chunk-preset selector,
+    **Auto slideshow** (toggle button + "QR codes per second" spinbox, stops on
+    the last frame and on filter/chunk changes), optional audio-send button.
+  - `WillQrImportDialog`: camera scan (Electrum `scan_qrcode_from_camera`,
+    one code at a time), manual paste fallback, slot grid (1..N) with
+    green=stored, total-mismatch reset, optional audio-receive that mirrors
+    the audio_modem `_recv` sink with a callback instead of `setText`.
+  - `WillTxReviewSignDialog`: per-transaction review (outputs via
+    `get_ui_address_str`, total outputs, fee) with Sign / Skip / Cancel and a
+    single wallet password; final page offers "Save signed file…" and
+    "Show signed QR…". Runs on the imported local copy only.
+- `bal/gui/qt/window.py`: `export_will_via_qr`, `import_will_via_qr`,
+  `get_audio_modem_plugin`, `_audio_send_payload`; `sign_transactions`
+  refactored into a byte-equivalent batch loop plus the reusable
+  `_prepare_and_sign_tx(…, txid, password)` single-transaction helper.
+- `bal/gui/qt/lists.py`: will-list menu gains **Export → QR Codes** and
+  **Import via QR**.
+- `tests/test_gui_qr_transfer.py` (new): export build/navigation/chunk
+  change, filters (Valid, Valid-NC, empty-revert), import frame flow,
+  assembly+decode, total-mismatch reset, manual entry.
+- `PLAN_QR_TRANSFER.md`: the full spec (wire format, settings, export,
+  import, wizard checklist P0–P6, findings log).
+- Docs: `README.md` QR-transfer section; `QML_PLAN.md` updated (Phase 2
+  `BalQrTransferModel`, Phase 3 dedicated QML export/import pages, R6
+  mitigation rewritten, deferred-chunks note removed).
+
+**Audio channel caveats:**
+- The audio send/receive buttons only appear when Electrum's `audio_modem`
+  plugin is enabled *and* `amodem` + PortAudio are installed (not present in
+  the current dev runtime — verified F22). On that channel the transport
+  zlib-compresses internally, so no BAL framing/`Z` flag is used.
+- `WaitingDialog` requires a real `QWidget` parent and the plugin's `_recv`
+  hard-wires `parent.setText`, so receive uses a local mirror with a
+  callback sink.
+
+**Verification:**
+- `python3 tests/test_core_qr_transfer.py`: all pass.
+- `QT_QPA_PLATFORM=offscreen python3 tests/test_gui_qr_transfer.py`: all pass.
+- Pytest batch `tests/test_core_*.py tests/test_gui_*.py`: 374 passed (only
+  the two pre-existing `test_bt_to_date_*` datetime compare failures remain).
+- `QT_QPA_PLATFORM=offscreen python3 tests/smoke_test.py
+  electrum.plugins.bal`: passed (clean import under real Electrum).
+- `ruff`: no new violations on changed files.
+
+**Audio-environment notes (dev box, discovered while testing):**
+- `amodem` 1.16.0 is old and uses `np.ndarray.tostring()`, removed in numpy 2.x;
+  the runtime venv (numpy 2.4.6) needs the one-line patch
+  `tostring()` → `tobytes()` in
+  `electrum/env/lib/python3.11/site-packages/amodem/common.py` (done locally,
+  not in the repo). Any machine with numpy>=2 and this amodem version needs
+  the same patch (or numpy<2).
+- Electrum's `audio_modem` plugin hardcodes `libportaudio.so` (unversioned).
+  Debian/Ubuntu only ship `libportaudio.so.2`, so the load fails silently
+  inside the plugin's `_send` `WaitingDialog` (no `on_error` → no sound, no
+  message). Fix on the dev box:
+  `sudo ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2 /usr/lib/x86_64-linux-gnu/libportaudio.so`
+  (created by the `libportaudio-dev` package; a `LD_LIBRARY_PATH` stub works
+  without root). The audio buttons stay hidden unless the plugin is enabled
+  and available.
+- Verified on the dev box (no physical mic required) via a full
+  send→sink→monitor→recv round-trip: set the default PulseAudio source to
+  `<sink>.monitor` at receive time; payload returned byte-identical.
+
+**Follow-up fixes (same session, reported during audio testing):**
+- `WillItem.__init__` now defaults `status` to `""` instead of `None`. A
+  `WillItem` built from a bare `{"tx": ...}` (QR/audio import, clipboard
+  merge) crashed in `set_status` with
+  `unsupported operand type(s) for +=: 'NoneType' and 'str'` during the
+  validity pass / `IMPORTED` marking.
+- `BalWindow.invalidate_will` guards a missing `date_to_check` (first-action
+  case) like `merge_will` already did, fixing
+  `AttributeError: 'BalWindow' object has no attribute 'date_to_check'` when
+  invalidating before the periodic check initialized it.
+- Regression test `test_imported_item_status_not_none` added to
+  `tests/test_gui_qr_transfer.py`; QR GUI suite 12/12, batch 377 passed.
 ---
 
 ## 57. Name the real cause of a failed build instead of guessing
@@ -2992,4 +3094,174 @@ misleading.
 - Manually tested by the owner in Electrum 4.8.1: `NO_FUTURE_DATE`,
   `WILLEXECUTOR_FEE` and `No Heirs` were all confirmed on screen.
 
+## 57. Remove all `copy.deepcopy` (ad-hoc copy helpers; `WillItem` copies serialize/deserialize)
+
+**Date:** 2026-08-28
+
+**Goal (owner request):** eliminate every `copy.deepcopy` from the codebase
+and replace it with ad-hoc copy methods; `WillItem` copies must be produced by
+serializing and deserializing the item rather than by deep-copying live
+runtime objects (which can hold a `threading.RLock` and cannot be pickled).
+
+**What changed:**
+
+- `bal/core/util.py`: new `copy_structure(value, _path="copy")` — the single
+  JSON-safe, deepcopy-free recursive cloner (dict / list / tuple cloned
+  structurally, JSON scalars kept as-is, any accidental runtime object coerced
+  to `str` + logged). It replaces the old `heirs._json_safe` implementation.
+- `bal/core/heirs.py`: `_json_safe` is now a thin backward-compatible alias of
+  `bal.core.util.copy_structure`; `Heirs.save` behaviour is unchanged.
+- `bal/core/will.py`:
+  - `WillItem.__init__` on a `WillItem` argument no longer does
+    `self.__dict__ = w.__dict__.copy()` + `copy.deepcopy`; instead it
+    serializes (`to_dict()`) and deserializes: the tx is re-parsed into a fresh
+    object, `STATUS` is rebuilt from a clone, and heirs / will-executors are
+    cloned recursively, so the copy shares no mutable state with the source.
+  - New `WillItem.copy(wallet=None)` (serialize/deserialize round trip; re-adds
+    wallet tx info when a wallet is passed) and the static
+    `WillItem.copy_status_table(table)` used for the `STATUS` tables.
+  - `to_dict()` now also emits `Father` / `Children` so the round trip is
+    faithful.
+  - `normalize_will` routes copies through the constructor / `copy()`.
+- `bal/gui/qt/window.py` and `bal/cli/controller.py`: the Build-will flow now
+  uses `copy_structure(...)` instead of `copy.deepcopy(...)` for heirs and
+  will-executors.
+- Dropped now-unused `import copy` (`will.py`, `controller.py`, `qt/common.py`,
+  `qt/window.py`).
+- Tests updated to the same helpers: STATUS tables via
+  `WillItem.copy_status_table`, heirs / built dicts via `copy_structure`
+  (`test_core_will.py`, `test_core_will_invalidate.py`,
+  `test_heir_relative_anchor.py`, `test_anticipate_manual_locktime.py`,
+  `test_no_willexecutor_karen7.py`, `test_reproduce_none_type.py`,
+  `test_group_e_mock_karen7.py`, `test_group_e_karen7_invalidate.py`,
+  `sim_update_flows.py`).
+
+**Verification:**
+- Full offline batch `tests/test_core_*.py tests/test_gui_*.py`: 377 passed,
+  only the two pre-existing `test_bt_to_date_*` datetime compare failures
+  remain (identical to HEAD — no regression; `test_heir_relative_anchor`
+  isolated-file failure is pre-existing test-pollution at HEAD too).
+- Ad-hoc semantics check: `copy()`/ctor copy share no mutable state with the
+  source (mutating source heirs/STATUS does not leak into the copy and vice
+  versa), `copy_status_table` returns fresh lists, `normalize_will` runs.
+- `ruff` on all touched files: no new violations (4 findings, all pre-existing
+  at HEAD).
+- `tests/smoke_test.py electrum.plugins.bal`: passed.
+- `python3 build_zip.py`: 45 files, 343591 bytes, sha256 `aa8f8154…`;
+  `tests/external_zip_test.py bal-electrum-plugin.zip`: passed (Plugin class
+  loads via the zipimport shim).
+
 **Outcome:** DONE.
+
+---
+
+## Next. Animated-QR interop (BC-UR v1/v2, BBQR)
+
+**Date:** 2026-09-08
+
+**Goal:** Let BAL export/import a will not only as its own BAL QR frame format
+but also as BC-UR v1 (`ur:bytes`, BC32 + SHA-256), BC-UR v2 (`ur:bytes`, CBOR
+bytewords-minimal fountain codes) and BBQR (Coinkite `B$…`) animated-QR
+sequences, so transfers interoperate with Blockchain Commons / Coldcard-style
+tools and BitKit. Codecs must be stdlib-only and the export must keep BAL QR
+as the default.
+
+**What changed:**
+
+- `bal/core/animated_qr.py` (new): stdlib-only codec module.
+  - BC32 (bech32_bis checksum, XOR `0x3FFFFFFF`) encode/decode matching the
+    BCR-2020-004/005 reference vectors.
+  - bytewords-minimal encode/decode (BCR-2020-012) with CRC-32 rejection;
+    the word list was transcribed verbatim from the reference C++.
+  - BC-UR v2: CBOR part writer/reader, CRC-32, `choose_fragments`
+    (xoshiro256** + alias + ary-threshold sampler) and XOR-based fountain
+    mixing/solving; emits a redundant mixed wave for loss tolerance.
+  - BC-UR v1: multipart with SHA-256 digest and single-part digest-less
+    frames; `1of1` handling.
+  - BBQR: base32 (encoding `2`), hex (uppercase, `H`) and zlib (lowercase,
+    `Z`, automatic compression fallback) frames; out-of-order reconstruction.
+  - One `AnimatedQrSession` + `detect_format` + `parse_for_detection` for
+    auto-detecting the incoming format and keying the GUI debounce.
+  - Safety caps: `_MAX_SESSION_PARTS = 20000`, `_MAX_MESSAGE_BYTES = 32 MB`,
+    zlib-bomb guard, `TransferConflictError`/`SessionLimitError`.
+- `bal/gui/qt/dialogs.py`:
+  - Export page (`BalQrExportWidget`) gained a **Format** selector
+    (BAL QR default, BC-UR v1, BC-UR v2, BBQR) reusing the QR-size presets,
+    with per-format intro/format-hint text.
+  - Import page (`BalQrImportWidget`) now routes every frame through
+    `parse_for_detection` + `AnimatedQrSession.add_part`, auto-detecting the
+    format and resetting when the transfer's session key changes; the
+    review/sign step resolves the session and decodes parts uniformly.
+  - `qr_import_accept_frame` generalised to
+    `(state, fmt, session_key, frame_total, index, payload, stable_reads=2)`.
+- `tests/test_core_animated_qr.py` (new, 32 tests): BC32 spec vectors,
+  bytewords round-trip/CRC, C++ reference-frame decode+re-encode parity
+  (single-part 12B, seq_len=2, seq_len=7), fountain solve with missing pure
+  part, out-of-order/duplicate handling, single/multipart UR v1, BBQR
+  Z/2/H round-trips, runt last part, zlib-bomb guard, detection positive/
+  negative.
+
+**Verification:**
+
+- `tests/test_core_animated_qr.py`: 32/32 pass.
+- `tests/test_gui_qr_transfer.py` (now 36 tests) + `test_gui_export_dialogs.py`: pass.
+- `ruff` clean on `animated_qr.py`, `dialogs.py` and both test files;
+  `pyright` 0 errors on the touched modules.
+- `tests/smoke_test.py electrum.plugins.bal`, `python3 build_zip.py` and
+  `external_zip_test.py` all pass.
+- Full regression: 462 passed; only pre-existing failures remain
+  (`test_bt_to_date_*`, will-invalidate fee, unrelated `sign_transactions`
+  stub test).
+
+**Notes / caveats:**
+
+- A real bug was found & fixed during this work: `_ur2_part_cost` used
+  `2 * body_len` but `bytewords_minimal_encode` appends a 4-byte CRC, so every
+  UR v2 frame was undercounted by 8 characters and could overflow the QR
+  budget for large transfers.
+- UR v1 multipart emits the digest-carrying `1of1/<digest>/<frag>` form for a
+  single part (both headered and headerless single parts are accepted on
+  import); this keeps deterministic digest verification.
+- Imported payloads are UTF-8 text; the codec sessions do not decode raw
+  binary transfer blobs.
+
+**Outcome:** DONE (uncommitted).
+
+---
+
+## Animated-QR bugfix: QVideoSink signal wiring + will-export JSON crash
+
+**Date:** 2026-09-08
+
+**Goal:** Fix two runtime crashes found by manual testing of the QR paths.
+
+**What changed:**
+
+- `bal/gui/qt/dialogs.py`:
+  - `_start_scan`/`_stop_scan` used `QVideoSink.videoFrame.connect/.disconnect`,
+    but on PyQt6 `videoFrame` is the frame **getter method**, not a signal —
+    this raised ``AttributeError: 'builtin_function_or_method' object has no
+    attribute 'connect'`` on camera scan. Switched to the `videoFrameChanged`
+    signal (same wiring Electrum's `QrReaderVideoSurface` uses).
+  - `_stop_scan` now tolerates `AttributeError` when disconnecting the sink
+    and guards the `errorOccurred` disconnect too, so a mid-init failure can
+    never cascade into a second uncaught exception.
+  - `_whole_will_json` (whole-will QR export) serialized ``WillItem.to_dict()``
+    with plain `json.dumps`, crashing with ``TypeError: Object of type
+    Transaction is not JSON serializable`` (the ``tx`` field holds a real
+    ``Transaction``). Now uses Electrum's `MyEncoder`, matching `write_json_file`.
+- `tests/test_gui_qr_transfer.py`: new `test_import_start_stop_scan_signal_wiring`
+  drives the real `QVideoSink` life-cycle with a mocked camera and fails if
+  the signal name regresses to `videoFrame`.
+- `tests/test_gui_export_dialogs.py`: new
+  `test_qr_whole_will_json_serializes_transaction` covers the JSON export.
+
+**Verification:**
+
+- `pytest tests/test_gui_qr_transfer.py tests/test_gui_export_dialogs.py -q`: pass.
+- Full offline batch `tests/test_core_*.py tests/test_gui_*.py`: 444 passed.
+- Regression test flips correctly (fails when reverted to the buggy call).
+- `ruff` clean on touched files; `tests/smoke_test.py`, `build_zip.py`,
+  `external_zip_test.py` all pass.
+
+**Outcome:** DONE (uncommitted).

COMPATIBILITY.md

@@ -23,6 +23,25 @@ is updated to mark them as supported.
 See [`README.md`](README.md) for supported Electrum versions (currently 4.7.2
 and 4.8.0).
 
+## QR wire-format compatibility
+
+BAL exports/imports wills as QR codes. **BAL QR** (the default) is the plugin's
+own frame format and is only understood by BAL itself. The export page also
+supports **BC-UR v1**, **BC-UR v2** and **BBQR**:
+
+| Format    | Wire appearance            | Interop target                                       |
+|-----------|----------------------------|------------------------------------------------------|
+| BAL QR    | `BALQR1\|total\|index\|…`  | Past/other BAL versions (default, always exported)   |
+| BC-UR v1  | `ur:bytes/<bc32>`          | Blockchain Commons / Coldcard-style UR (BC32, SHA-256 digest, part counts per part) |
+| BC-UR v2  | `ur:bytes/<seq>-<seqlen>/<bytewords>` | BC-UR 2.x fountain codes (CBOR parts, CRC-32, bytewords-minimal) |
+| BBQR      | `B$<enc><type><N><n>…`     | Coinkite BitKit / Coldcard's BBQR animated-QR mode   |
+
+Import auto-detects the format of each scanned code; out-of-order, duplicate
+and (for UR v2) partially-lost fountain frames are handled. Interop is
+validation-tested against the reference C++ bc-ur encoder output and the
+BCR-2020-004/005 BC32 test vectors; it has not yet been cross-verified against
+third-party libraries (`ur`, `bbqr`, Coldcard firmwares).
+
 ## Reporting compatibility issues
 
 If you find a compatibility problem not listed here, please open an issue on

HANDOFF.md

@@ -392,3 +392,85 @@ See Section 5 for details.
    push to `origin/main`, then run `./make-release.sh` to create the Gitea
    **Release** with the ZIP + signatures attached (it becomes the owner's
    "Latest" download). Always give the owner the Release URL.
+
+### In progress: QR / audio will transfer (branch `feature/bal-qr-transfer`)
+
+- The full QR-transfer feature (P0–P6) is implemented, tested and committed on
+  `feature/bal-qr-transfer` (commits `d288b55`, `ce3e36d`, pushed to
+  `origin`). PR creation URL:
+  `https://bitcoin-after.life/gitea/bitcoinafterlife/bal-electrum-plugin/pulls/new/feature/bal-qr-transfer`
+- Included: core scheduler (`bal/core/qrtransfer.py`), `QR_CHUNK_SIZE`
+  setting (4 export presets), export/import dialogs + review/sign wizard +
+  lists/window wiring, export filters, auto slideshow with per-second rate +
+  loop option, audio send/receive buttons, and the crash fixes
+  (`status` default, `invalidate_will` guard). Docs: README, CHANGELOG entry
+  56, QML_PLAN, `AUDIO_MODEM_DEBIAN.md`.
+- Follow-up refactor (CHANGELOG entry 57): all `copy.deepcopy` removed —
+  `copy_structure()` in `bal/core/util.py`, `WillItem.copy()` / ctor
+  serialize/deserialize, `copy_status_table()`. Working tree clean after the
+  branch's three commits.
+- Verification: batch 377 passed / 2 pre-existing `test_bt_to_date_*`
+  failures; ruff no new violations; smoke + `build_zip.py` +
+  external-zip OK; pyright clean. The isolated
+  `test_heir_relative_anchor.py::test_karen7_frozen_delivery_not_expired`
+  failure is pre-existing test pollution (fails identically on clean HEAD,
+  passes inside the full batch) — not caused by entry 57.
+- Remaining: manual on-device walkthrough of the QR path (and, if wanted,
+  the audio path — buttons only appear when the `audio_modem` plugin +
+  `amodem` are installed; see the prerequisites below).
+
+### In progress: animated-QR interop (BC-UR v1/v2, BBQR)
+
+- `bal/core/animated_qr.py` implements stdlib-only codecs for **BC-UR v1**
+  (BC32 + SHA-256 digest; the bech32_bis checksum variant per
+  BCR-2020-004/005), **BC-UR v2** (CBOR part structure, bytewords-minimal,
+  CRC-32, xoshiro256-based fountain with alias-sampled mixing) and **BBQR**
+  (Coinkite `B$…` base32/hex/zlib frames), plus one shared
+  `AnimatedQrSession` with `detect_format` auto-detection and
+  `parse_for_detection` frame identity for the GUI debounce.
+- Current status as of this session: reference parity, GUI, and tests done;
+  not yet committed.
+  - **BC32/bytewords/codec parity:** BC32 reproduces the BCR-2020-004/005
+    test vectors (`Hello, world`, `Hello world`, the long seed vector);
+    bytewords-minimal round-trips with CRC rejection; UR v2 part encode +
+    decode is byte-exact against the reference C++ bc-ur encoder for a
+    single part, seq_len=2 (12 frames) and seq_len=7 (3 sampled mixes),
+    validating CBOR framing, bytewords, alias+ary-threshold sampling,
+    xoshiro256** and the XOR mix.
+  - **Sessions:** UR v2 single-part (no seq header), out-of-order frames,
+    duplicate drops, solve with a missing pure fragment (a second redundant
+    mixed wave is emitted by `ur2_frames`), UR v1 single-part
+    (digest-less `ur:bytes/<bc32>` accepted) and multipart, BBQR full-frame
+    decode in any order for Z/2/H encodings.
+  - **Safety:** `_MAX_SESSION_PARTS = 20000`, `_MAX_MESSAGE_BYTES = 32 MB`,
+    `TransferConflictError` on a frame from a different transfer,
+    `SessionLimitError`, BBQR zlib-bomb guard, UTF-8 payloads only.
+  - **GUI:** `BalQrExportWidget` gained a Format selector (BAL QR default,
+    BC-UR v1, BC-UR v2, BBQR) reusing the QR-size presets; the importer now
+    routes every frame through `detect_format` +
+    `AnimatedQrSession.add_part` with the shared
+    `qr_import_accept_frame(state, fmt, session_key, frame_total, index,
+    payload, stable_reads=2)` debounce (reset on session-key change).
+    `_review_and_sign` resolves the session to the transfer text and decodes
+    parts uniformly across formats.
+  - **Verification:** `tests/test_core_animated_qr.py` (32 tests incl. the
+    C++-reference parity vectors and BC32 spec vectors) and the extended
+    `tests/test_gui_qr_transfer.py` pass; ruff clean on the new/changed
+    files; pyright 0 errors; smoke test, `build_zip.py` and
+    `external_zip_test.py` green. Only the pre-existing failures remain
+    (`test_bt_to_date_*`, fee-exceeds-balance, karen7 pollution).
+  - **Any remaining work:** manual on-device walkthrough of the QR path with
+    the new formats; optionally validate against third-party libraries
+    (`ur`, `bbqr`) once available; add the docstrings/branch notes already
+    captured in `ag1.md`/`ag2.md` context where needed.
+
+**Dev-box audio prerequisites (audio_modem channel):**
+See `AUDIO_MODEM_DEBIAN.md` — the full Debian setup + verification, with the
+two pitfalls (unversioned `libportaudio.so`, numpy>=2 `tostring` removal):
+- `sudo ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2 /usr/lib/x86_64-linux-gnu/libportaudio.so`
+  (the unversioned name the plugin loads; Debian ships only `.so.2`).
+- numpy>=2 patch in `electrum/env/.../amodem/common.py`: `tostring()` →
+  `tobytes()` (already applied locally). Both are runtime-env fixes, not repo
+  changes; see CHANGELOG entry 56.
+- To loop-test on one machine without speakers/mic: during receive,
+  `pactl set-default-source <sink>.monitor` (restore after).

PLAN_QR_TRANSFER.md

@@ -0,0 +1,482 @@
+# PLAN — Will transfer via QR codes / audio modem (Qt now, QML planned)
+
+> Goal: let the user move an inheritance ("will") between devices over two
+> air-gap channels:
+>
+> 1. **QR codes** (primary): export the **valid** inheritance transactions as
+>    a sequence of QR codes, and import them back on another machine with the
+>    camera;
+> 2. **Audio modem** (secondary, when Electrum's `audio_modem` plugin is
+>    enabled): send/receive the same payload through the PC speaker +
+>    microphone.
+>
+> Both channels converge on the same review-and-sign flow afterwards.
+>
+> Status: APPROVED by owner (2026-08-25). No code written yet — this document
+> is the implementation contract. Work top-down through §9 Checklist.
+>
+> Chat language: Italian; this document is in English (global rule R1).
+
+---
+
+## 1. Scope
+
+### In scope
+
+- **Desktop PyQt6 GUI** (primary, implemented by this plan):
+  - New plugin setting: QR chunk size, offered as **4 standard presets**.
+  - *"Export via QR"* action: serializes the **valid** will transactions,
+    optionally compresses, splits the resulting string into fixed-size frames,
+    shows one QR at a time with prev/next navigation, live re-chunking and
+    progress (`i di N`).
+  - *"Import via QR"* action: camera capture dialog with a slot grid
+    (1..N); the user selects which shot he is about to capture, scans, the
+    frame lands in its slot; when 1..N are filled the payload is assembled,
+    parsed into `WillItem`s, validity-checked locally.
+  - **Post-capture flow (owner decision D6, amended)**: after capture
+    completes there is NO read-only preview. Instead a review-and-sign wizard
+    walks through every transaction one at a time showing **outputs
+    (address + amount), total outputs, total fees**, signs it (wallet
+    password asked once), and at the end **proposes exporting the signed
+    transactions** (to file and/or back via QR).
+- **Audio-modem channel** (owner decision D7): when the Electrum
+  `audio_modem` plugin is enabled and available, the export dialog gains a
+  *"Send via Audio Modem…"* button and the import dialog a *"Receive via
+  Audio Modem…"* button, reusing the same transfer string (no QR framing).
+- **QML**: document-only update to `QML_PLAN.md` adding dedicated view specs
+  (owner decision D1). No QML code in this feature.
+
+### Out of scope
+
+- Implementing the QML frontend (gated behind `QML_PLAN.md` Phases 0–2).
+- Merging imported wills into the live wallet state (existing Merge flows
+  stay unchanged).
+- Broadcast of the reviewed transactions (user exports them; broadcasting
+  remains an explicit action elsewhere).
+- CLI/cmdline parity for QR transfer.
+
+---
+
+## 2. Owner decisions (locked)
+
+| # | Decision |
+|---|----------|
+| D1 | QML part = update `QML_PLAN.md` document only; implementation later. |
+| D2 | Frames carry a small ASCII header (`BALQR1\|N\|i\|flags`) — import knows the total, auto-fills the grid, detects corrupt/duplicate/mismatched frames. Pure concatenation rejected. |
+| D3 | Payload = **serialized transaction strings only** (`str(wi.tx)`), NOT the JSON will dump. Loses statuses/metadata on purpose; import rebuilds items like `merge_single_transaction` does. |
+| D4 | Compression (zlib+base64 over the whole payload) = checkbox in the export dialog, **default OFF**, advertised via a frame flag. |
+| D5 | 4 standard size presets: **~150 / ~400 / ~900 / ~1800 bytes** of payload per QR (low-res cams → high-res cams). Error-correction level fixed **M**. Stored as plugin config default; selectable again inside the export dialog. |
+| D6 | After capture completes: **review + sign each tx one at a time** (show outputs, total outputs, total fees), then **propose export of the signed txs** (file and/or QR). Supersedes the earlier "WillDetailDialog preview" answer. |
+| D7 | Add an **audio-modem transfer path** gated on Electrum's `audio_modem` plugin being enabled and available (`amodem` importable). Same payload semantics as QR (transfer string of serialized txs), but NO BAL frame chunking — `amodem` handles transport framing internally. Buttons simply hidden when the plugin is absent/unavailable (info message pointing at `pip install amodem` when enabled-but-broken); graceful degradation, never a hard dependency. |
+
+---
+
+## 3. Verified facts (research done on the local checkouts)
+
+All verified by reading source; references are `file:line`.
+
+| # | Fact | Where |
+|---|------|-------|
+| F1 | Export today: `BalWindow.export_will()` writes `{wid: WillItem.to_dict()}` JSON; subsets All/Valid/Valid-NC built in `WillList` | `bal/gui/qt/window.py:1605-1621`, `lists.py:666-669, 743-767` |
+| F2 | Batch signer: `BalWindow.sign_transactions(password, will, txids)` loops valid txs, resolves input values from change prevouts (`txin._trusted_value_sats` …), calls `wallet.sign_transaction`, updates `COMPLETE` + signature counts | `window.py:1017-1086` |
+| F3 | External-will signing already supported (`will=` param, nothing saved to live wallet/history) | `window.py:1443-1484` |
+| F4 | Single-tx import precedent: `merge_single_transaction` wraps `WillItem({"tx": str(tx)}, _id=tx.txid(), wallet=...)` | `window.py:1715-1724` |
+| F5 | Local validity recomputation recipe (no network): `add_willtree` → `Util.get_available_utxos` → `check_invalidated` → `search_rai` → `check_signatures` | `window.py:1678-1701` |
+| F6 | Plugin config accessor pattern `BalConfig`; keys declared in ctor | `bal/core/plugin_base.py:130-154, 211-264` |
+| F7 | Plugin settings dialog: grid rows 0..12, `add_widget(grid,label,widget,row,help)` + `_make_reset_btn(cfgvar,widget,kind)`; ADVANCED-only rows wrapped with `_hide_if_basic(...)` | `bal/gui/qt/plugin.py:442-850` (rows at 677-850) |
+| F8 | `BalDialog(parent, bal_plugin, title=None, icon=...)` base class anchors to top-level window | `bal/gui/qt/dialogs.py:92-129` |
+| F9 | Fee display precedent: `fee = tx.input_value() - tx.output_value()`, fee rate = `fee / tx.estimated_size()` | `bal/gui/qt/widgets.py:1319-1328` |
+| F10 | Input-value resolution helper exists: `Will.add_info_from_will(will, wid, wallet)` sets trusted input values from sibling will change outputs | `bal/core/will.py:118-136` |
+| F11 | `str(tx)` = `tx.serialize()`: raw hex for complete txs; `PartialTransaction.serialize()` → base64 PSBT. Both accepted by `tx_from_any` (= `Will.get_tx_from_any`). This is exactly how BAL persists/reloads txs today | `electrum/transaction.py:907, 2539`; `will.py:106-113`; `window.py:1041-1044` |
+| F12 | `QRCodeWidget` exists but **hardcodes `ERROR_CORRECT_L`** → cannot satisfy D5/M; must render our own `qrcode` instance | `electrum/gui/qt/qrcodewidget.py:35-37` |
+| F13 | Camera scanning one-shot API with OS-permission handling: `scan_qrcode_from_camera(*, parent, config, callback(success: bool, error: str, data: Optional[str]))`; on Linux uses zbar CLI backend | `electrum/gui/qt/qrreader/__init__.py:47-64` |
+| F14 | QR painting without PIL: `draw_qr(qr, paint_device, ...)` from `electrum.gui.common_qt.util` (what `QRCodeWidget.paintEvent` uses) | `electrum/gui/qt/qrcodewidget.py:63-72` |
+| F15 | QR capacity sanity (byte mode, EC **M**): v40-M ≈ 2331 B ≥ 1800 ✓; v10-M ≈ 213 B ≥ 150 ✓; the `qrcode` lib auto-picks the version | `qrcode` lib |
+| F16 | `build_zip.py` walks the tree with `os.walk` → new `.py` files ship automatically | `build_zip.py:39-47` |
+| F17 | QML fork already has `QRImage.qml`, `QRScan.qml`, `ScanDialog.qml`; ScanDialog carries upstream comment "currently not used on android … qt6 camera support stops crashing" | `electrum/gui/qml/components/ScanDialog.qml:8-9` |
+| F18 | `QML_PLAN.md` currently defers chunked multi-QR streams (Phase 3 note + risk R6) — this feature supersedes that deferral | `QML_PLAN.md:228-231, 304` |
+| F19 | House test conventions: `def test_*` + `if __name__ == "__main__"` + `sys.path.insert(0, ..pardir)`; run standalone or via pytest | `tests/test_core_heirs.py:1-24` |
+| F20 | Fork ships an `audio_modem` plugin. `_send(parent, blob)` zlib-compresses an **ASCII** blob, plays it via speaker through `amodem` inside a `WaitingDialog`; bit-rate selectable in the plugin's own settings (default = `amodem.config.slowest()`) | `electrum/plugins/audio_modem/qt.py:96-110` |
+| F21 | `_recv(parent)` records from mic and delivers the decompressed ASCII text by calling `parent.setText(blob)` — the only integration contract is "an object with `setText(str)`"; there is no callback API | `audio_modem/qt.py:112-127` |
+| F22 | Plugin lookup for enabled plugins: `window.plugins.get(name)` → instance or `None` (`Plugins.get`, electrum/plugin.py:575-576); availability check is the plugin's own `is_available()` (imports `amodem`). **`amodem` is NOT installed in the runtime env today** → optional dependency (pip `amodem` + libportaudio); feature must degrade gracefully | `electrum/plugin.py:575`, runtime-env check |
+| F23 | `amodem.main.send/recv` stream the whole blob with their own framing/training → BAL must NOT apply QR frame chunking on this channel; and since `_send` compresses internally, BAL sends the **plain** transfer string to avoid double compression | consequence of F20/F21 |
+
+---
+
+## 4. Wire format specification
+
+### 4.1 Transfer string
+
+```
+transfer_string = "\n".join( tx_str(tx) for tx in valid_txs_sorted_by_txid )
+```
+
+- `tx_str(tx)` = `str(tx)` (F11): hex for complete txs, base64-PSBT for
+  partially-signed ones. Neither alphabet contains `\n` or `|`, so both are
+  safe delimiters.
+- Ordering: ascending `tx.txid()` → deterministic output for identical input.
+- If compression enabled (D4):
+  `transfer_string = base64_ascii( zlib_compress( transfer_string ) )`.
+
+### 4.2 Frame layout (one frame = content of ONE QR code)
+
+```
+BALQR1|<total>|<index>|<flags>|<payload>
+```
+
+- Magic+version literal `BALQR1` (reject anything else with a clear message;
+  keeps the door open for a future `BALQR2`).
+- `<total>` N, `<index>` i — integers, `1 ≤ i ≤ N`.
+- `<flags>`: subset of chars, today `` (empty ⇒ plain) or `Z` (compressed).
+- `<payload>`: the i-th slice of `transfer_string`, exactly
+  `chunk_size` bytes each (last slice may be shorter).
+- Header overhead ≈ 16–20 bytes → effective payload = `chunk_size − overhead`;
+  the chunker slices the transfer string so that **header+payload ≤ preset
+  size**.
+
+### 4.3 Size presets (D5)
+
+| Preset label | Payload budget (bytes/frame) | Typical QR version @EC-M |
+|--------------|------------------------------|--------------------------|
+| Small (low-res cameras) | 150 | ~v10 |
+| Medium | 400 | ~v15 |
+| Large | 900 | ~v22 |
+| XL (high-res cameras) | 1800 | ~v40 |
+
+EC level fixed **M** for scan reliability (D5). Presets live in
+`bal/core/qrtransfer.py::CHUNK_PRESETS` so core tests can cover them.
+
+### 4.4 Audio-modem channel (D7, F20-F23)
+
+- Payload = the **plain** `transfer_string` of §4.1 — no BAL frames
+  (`split_frames`/`parse_frame` are QR-only), no BAL compression (the plugin
+  compresses internally; double compression wastes airtime).
+- The existing core functions `encode_transfer(tx_strings,
+  compress=False)` + `decode_transfer(text, compressed=False)` are reused
+  unchanged; only the transport differs.
+- Bit-rate is owned by the audio_modem plugin's settings dialog — BAL adds
+  no setting of its own.
+
+---
+
+## 5. New core module — `bal/core/qrtransfer.py`
+
+GUI-free (never imports Qt — house rule). Public API:
+
+```python
+MAGIC = "BALQR"
+VERSION = 1
+FLAG_COMPRESSED = "Z"
+CHUNK_PRESETS = [(label_en, budget_bytes), ...]   # §4.3 table
+
+def encode_transfer(tx_strings: list[str], compress: bool = False) -> str
+    """Join -> optional zlib+base64 -> return transfer_string."""
+
+def split_frames(transfer_string: str, chunk_size: int) -> list[str]
+    """Slice into full frames 'BALQR1|N|i|flags|payload'. Raises
+    ValueError if chunk_size < MIN_CHUNK_SIZE."""
+
+def parse_frame(frame: str) -> tuple[int, int, bool, str]
+    """-> (total, index, compressed, payload); ValueError on bad magic/
+    version/arity/non-int fields."""
+
+def assemble(frames: dict[int, str]) -> str
+    """Validate indices form exactly range(1..max_total) (taken from any
+    frame header), concatenate payloads in order, decode flags ->
+    transfer_string. Raises MissingFramesError(indexes) / InconsistentTotalError."""
+
+def decode_transfer(transfer_string: str, compressed: bool) -> list[str]
+    """Inverse of encode_transfer -> list of tx strings."""
+```
+
+Plus exceptions `QrTransferError(ValueError)`, `MissingFramesError`,
+`InconsistentTotalError`. All docstrings/comments English; ruff-clean
+(line-length 88, E501 ignored).
+
+---
+
+## 6. Settings (Qt)
+
+1. `bal/core/plugin_base.py`: after `REBUILD_ON_CLOSE` (~line 264) add
+
+   ```python
+   self.QR_CHUNK_SIZE = BalConfig(config, "bal_qr_chunk_size", 150)
+   ```
+
+2. `bal/gui/qt/plugin.py::settings_dialog` (rows end at 12, ~line 844):
+   append row **13** — visible in BASIC and ADVANCED (do NOT wrap with
+   `_hide_if_basic`):
+
+   - Label: `"QR Code Size"`
+   - `QComboBox` fed from `CHUNK_PRESETS`; item text e.g.
+     `"Small — ~150 bytes/QR (low-res cameras)"`; `currentIndexChanged`
+     → `self.QR_CHUNK_SIZE.set(budget_bytes)`; initial index from
+     `QR_CHUNK_SIZE.get()` (fallback to nearest preset if the stored value
+     was customized).
+   - `HelpButton` text: explains trade-off (small QR = more shots but easier
+     to scan with poor cameras; large QR = fewer shots, needs good camera)
+     and that the size can also be changed inside the export dialog.
+   - Reset button via existing `_make_reset_btn(self.QR_CHUNK_SIZE, combo, ...)`
+     pattern (plugin.py:684).
+
+---
+
+## 7. Qt export flow
+
+### 7.1 Entry point
+
+`bal/gui/qt/lists.py::WillList.create_toolbar` (menu block lines 666-670):
+
+```python
+export_menu.addAction(_("Via QR…"), self.export_will_valid_qr)
+```
+
+New `WillList.export_will_valid_qr()` mirrors `export_will_valid`
+(lists.py:743-754): builds `{wid: wi}` subset of `VALID` items, empty →
+`show_message(_("No valid will item to export"))`, else
+`self.bal_window.export_will_via_qr(will=subset)`.
+
+### 7.2 `BalWindow.export_will_via_qr(will=None)` (new, `window.py` near
+`export_will`)
+
+- Collect `tx_strings = [str(wi.tx) for wid, wi in sorted-by-txid ...]`
+  (F11).
+- Mark exported items `EXPORTED` (parity with `export_json_file`,
+  window.py:1607-1609) — only when `will` came from the live list.
+- Open `WillQrExportDialog(self, tx_strings)`.
+
+Shared helper used by both dialogs:
+
+```python
+def get_audio_modem_plugin(self):        # on BalWindow
+    """Return the loaded audio_modem plugin if enabled AND available
+    (amodem importable), else None. Never raises."""
+    p = self.window.plugins.get("audio_modem")   # F22
+    return p if p is not None and p.is_available() else None
+```
+
+### 7.3 `WillQrExportDialog(BalDialog)` (new class in `dialogs.py`)
+
+Layout:
+
+```
+[Size ▾ Small/Medium/Large/XL]   [x Compress (zlib+base64)]
+[            QR image           ]   ← BalQrImage (see below)
+«i di N»        [◀ Prev] [Next ▶]
+[Save current QR as PNG…]  [Send via Audio Modem…]  [Close]
+```
+
+Behaviour:
+
+- On any control change: rebuild `split_frames(encode_transfer(...))`,
+  reset index to frame 1, refresh counter (owner requirement: "cambiare la
+  risoluzione").
+- `BalQrImage(QWidget)` ≈ trimmed copy of `QRCodeWidget`
+  (`electrum/gui/qt/qrcodewidget.py:21-72`) but constructing
+  `qrcode.QRCode(error_correction=ERROR_CORRECT_M, border=2)` and painting
+  via `electrum.gui.common_qt.util.draw_qr` (F12/F14). ~30 lines.
+- Prev/Next wrap or disable at ends (disable chosen: clearer).
+- PNG export optional convenience via existing
+  `getSaveFileName` + `QWidget.grab()` (same trick as
+  `qrcodewidget.py:110`).
+- **Send via Audio Modem…** (D7): shown only when
+  `bal_window.get_audio_modem_plugin()` returns a usable instance (below);
+  otherwise hidden. Handler: re-encode the payload **plain**
+  (`encode_transfer(tx_strings, compress=False)`) and call the plugin's
+  `_send(parent=self, blob=transfer_string)` — its own WaitingDialog owns
+  progress/cancellation (F20). Tooltip when hidden is unnecessary; instead,
+  if the plugin is enabled but `is_available()` is False, show an info
+  message pointing to `pip install amodem` + portaudio (F22).
+
+---
+
+## 8. Qt import flow + review/sign wizard
+
+### 8.1 Entry point
+
+`lists.py` toolbar menu, next to Import/Merge (lines 670-671):
+
+```python
+menu.addAction(_("Import via QR…"), lambda: self.bal_window.import_will_via_qr())
+```
+
+`BalWindow.import_will_via_qr()` opens `WillQrImportDialog(self)`.
+
+### 8.2 `WillQrImportDialog(BalDialog)`
+
+State: `self.frames: dict[int, str]`, `self.total: int | None`,
+`self.target_index: int | None`.
+
+Layout:
+
+```
+«Captured k of N»          [Scan ▶]   [Reset]
+[slot grid: push-buttons 1..N; states: empty / filled ✓ / selected-target]
+hint line («Select a slot, then scan» / «Scan the first QR»)
+              [Receive via Audio Modem…]  [Review & Sign ▶] [Close]
+```
+
+Behaviour:
+
+- **Scan** → `scan_qrcode_from_camera(parent=self,
+  config=self.bal_window.window.config, callback=self._on_scan)`
+  (F13). One-shot per press; dialog stays open between shots (simplest,
+  matches Electrum UX; no continuous mode).
+- `_on_scan(success, error, data)`:
+  - failure → `show_error(error)` (covers missing zbar/camera too);
+  - `parse_frame` errors → `show_warning(_("Not a BAL will QR"))`;
+  - first valid frame adopts `total` and materializes the slot grid;
+  - frame whose `total` ≠ adopted total → warn + offer Reset (user may have
+    restarted the export with another size);
+  - valid → `frames[index] = payload`; auto-advance `target_index` to the
+    lowest missing index; refresh grid + counter.
+- Clicking an empty slot sets `target_index` (owner requirement: manual
+  shot selection); a filled slot click asks to overwrite.
+- **Receive via Audio Modem…** (D7): shown only when
+  `bal_window.get_audio_modem_plugin()` returns a usable instance. Handler:
+  build a tiny adapter object exposing `setText(str)` that stores the text
+  and invokes the shared post-receive continuation, then call
+  `plugin._recv(parent=self, ...)`-style flow (F21 contract). On success the
+  received string is treated as the **whole payload**: skip frames/slots
+  entirely → `decode_transfer(text, compressed=False)` → continue at §8.2's
+  item-building step (WillItem construction + validity pass + wizard).
+  Errors from the modem surface through the plugin's own dialog; empty
+  result (user cancelled) is silently ignored.
+- **Review & Sign** enabled only when `set(frames) == set(range(1, N+1))`:
+  runs `assemble` + `decode_transfer` → `list[str]`; any `QrTransferError`
+  surfaces as `show_error` and keeps the dialog open.
+- Build items exactly like `merge_single_transaction` (F4):
+  `WillItem({"tx": s}, wallet=self.wallet)` per string; failures per-string
+  are collected and reported at the end (bad string ≠ fatal for the rest).
+- Local validity pass (F5 recipe) on the resulting dict; items failing
+  `VALID` are dropped and listed in a warning. Set
+  `wi.set_status("IMPORTED", True)` on survivors (mirrors
+  `import_will_into_details`, window.py:1753-1754).
+- Then `close()` and start the wizard (§8.3) with the valid subset. Empty
+  result → stop with a message.
+
+### 8.3 `WillTxReviewSignDialog(BalDialog)` — post-capture wizard (D6)
+
+Constructed with `(bal_window, willitems: dict[str, WillItem])` — the
+imported subset lives **outside** the live wallet state (external mode,
+F3).
+
+Flow:
+
+1. **Password once**: `password = bal_window.get_wallet_password()`
+   (window.py:1088-1100). Returns `False` on cancel → abort wizard; `None`
+   means unencrypted wallet → proceed without password.
+2. **Per-transaction page** (one `QStackedWidget` step per tx, ordered by
+   txid like export):
+
+   ```
+   Tx 2 of 5 — a1b2…c3d1 (short txid)
+   Locktime: 2033-04-05            Status: unsigned (0/1 sigs)
+   ┌ outputs ─────────────────────────────────┐
+   │ bc1q…heir1            0,042 BTC          │
+   │ bc1q…willexec fee     0,00012 BTC        │
+   │ bc1q…change           0,00988 BTC        │
+   └───────────────────────────────────────────┘
+   Total outputs: 0,052 BTC        Fees: 420 sat (1.2 sat/vB)
+   [Sign & Next ▶]   [Skip]   [Cancel all]
+   ```
+   - Outputs from `tx.outputs()` (address via `TxOutput.get_ui_address_str()`
+     style helpers already imported in the qt layer; value via
+     `bal_window.window.format_amount`).
+   - Totals: `output_value()` sum; fees via `input_value() - output_value()`
+     after resolving inputs with `Will.add_info_from_will(will, wid, wallet)`
+     (F10); `-1`/unknown handled like widgets.py:1319-1324 (F9).
+3. **Sign & Next** → sign this single tx through a **refactored helper**
+   extracted from the loop body of `sign_transactions`
+   (window.py:1037-1083 → `_sign_single_tx(tx, willitems, password)` kept
+   byte-equivalent; batch method calls the helper per iteration so existing
+   behaviour/tests are unaffected). Update `COMPLETE`/sig-counts exactly as
+   today; then advance.
+4. **Skip** leaves the tx untouched and advances. **Cancel all** stops; the
+   already-signed txs remain in the wizard's local dict (still exportable —
+   confirmation dialog warns about skipped ones).
+5. **Summary page**: `signed X of Y`, skipped/failed lists, then:
+
+   ```
+   [Save signed file…]   [Show QR…]   [Close]
+   ```
+   - *Save file* = existing JSON path: `export_meta_gui(window,
+     "will.json", writer)` writing `{wid: wi.to_dict()}` of the signed
+     subset (same serializer as `export_json_file`, window.py:1605).
+   - *Show QR* = `WillQrExportDialog` over `[str(wi.tx)]` of the signed
+     subset (the online machine can scan them straight into Merge).
+   - Nothing touches `self.willitems`/history (external-mode rule, F3).
+
+---
+
+## 9. Checklist (execution order — tick here when resuming work)
+
+- [x] **P0** `bal/core/qrtransfer.py` + unit tests `tests/test_core_qr_transfer.py`
+      (cases: round-trip plain/compressed; boundaries: len%size==0, size>len,
+      min-size guard; bad magic/version; missing middle frame; duplicate
+      overwrite; inconsistent totals; multi-PSBT mixes; presets sanity vs
+      qrcode capacities F15). Run:
+      `QT_QPA_PLATFORM=offscreen python3 tests/test_core_qr_transfer.py`
+- [x] **P1** Settings: `QR_CHUNK_SIZE` config var + settings-dialog row 16
+      (ø16) + reset kind (§6). Verify in `QT_QPA_PLATFORM=offscreen` GUI run.
+- [x] **P2** Export: `BalWindow.export_will_via_qr`, `get_audio_modem_plugin`
+      helper, `WillList` menu action, `WillQrExportDialog` + `BalQrImage`,
+      audio-modem send button (§7).
+- [x] **P3** Import: `import_will_via_qr`, `WillQrImportDialog` (§8.2),
+      incl. camera error paths, audio-modem receive button (local mirror of
+      `_recv`, `setText` sink replaced by a callback), plain-payload fast
+      path into the wizard.
+- [x] **P4** Wizard: `_prepare_and_sign_tx` refactor + `WillTxReviewSignDialog`
+      (§8.3). Regression-gate: full batch sign still green
+      (`tests/test_core_*.py` offline batch; `tests/test_gui_*.py` batch
+      including new `tests/test_gui_qr_transfer.py`).
+- [x] **P5** Docs & QML plan sync: update `QML_PLAN.md` — Phase 2 models +=
+      `BalQrTransferModel` (thin QObject over `bal.core.qrtransfer`),
+      Phase 3 += dedicated views `BalQrExportPage.qml` /
+      `BalQrImportPage.qml` (slot grid + `QRScan` reuse), delete the
+      "chunked streams deferred" note, rewrite R6 mitigation, add Android
+      caveat quoting F17 with file/paste fallback; README/HANDOFF sections;
+      CHANGELOG numbered entry 56 at END (house rule).
+- [x] **P6** Release hygiene: `python3 build_zip.py` +
+      `QT_QPA_PLATFORM=offscreen python3 tests/smoke_test.py
+      electrum.plugins.bal` + external-zip test; ruff (repo venv
+      `venv/bin/ruff`) no NEW violations; pyright false-positive policy per
+      AGENTS.md. Version bump only via `make-release.sh` (owner-driven).
+      Docs: document audio-modem as OPTIONAL channel — requires the
+      Electrum `audio_modem` plugin enabled plus `pip install amodem`
+      and libportaudio (not installed in the dev runtime env today, F22);
+      manual test matrix gains an audiomodem round-trip row (two machines,
+      default slowest bitrate) marked optional/skippable when hardware
+      unavailable.
+
+---
+
+## 10. Risks & mitigations
+
+| Risk | Mitigation |
+|------|------------|
+| High frame counts annoy users (e.g. 40+ QR at 150 B) | Presets span 150→1800; compress option; counter always visible |
+| Big QR versions fail on cheap cameras | EC=M fixed; Small preset targets low-res cams (D5 rationale) |
+| User rescans old export with different total | `InconsistentTotalError` → clear warning + Reset (§8.2) |
+| `_sign_single_tx` refactor regresses batch signing | Byte-equivalent extraction; batch callers unchanged; offline core tests gate P4 |
+| Imported txs reference UTXOs the importing wallet doesn't know | Validity pass drops them with an explicit report instead of silently merging garbage |
+| zbar/camera unavailable (esp. Windows/macOS packaging) | `scan_qrcode_from_camera` error path → suggest file export/import fallback |
+| `amodem`/portaudio not installed (current dev env state, F22) or audio_modem plugin disabled | Buttons simply hidden; QR/file remain the primary channels; P6 documents the optional dependency |
+| Audio transfer fails mid-way (noise, wrong volume) | Plugin's WaitingDialog surfaces the error; user retries — nothing to clean up on BAL side (single atomic blob, no slot state touched) |
+| Very slow airtime at default slowest bitrate | Bitrate is selectable in the audio_modem plugin's own settings (F20); BAL adds no knob; tooltip in export dialog hints at large payloads |
+| Qt6 camera instability on Android (future QML work) | Recorded as caveat in QML_PLAN update (P5), file/paste stays the primary mobile fallback |
+
+---
+
+## 11. Findings log (append-only)
+
+- 2026-08-25: plan drafted after code exploration; owner answered D1-D6
+  (D6 amended live from "preview dialog" to "review+sign wizard").
+- Verified F12 (QRCodeWidget hardcodes EC-L) and F11 (str(tx) round-trip
+  guarantees) — both shaped §§4/7.
+- 2026-08-25: owner requested an audio-modem transfer path → researched
+  `electrum/plugins/audio_modem/qt.py`, added D7 + F20-F23, §4.4, buttons
+  in §§7.3/8.2, checklist/risk updates. Key constraint found: `_recv`'s
+  only contract is `parent.setText(blob)` (F21) → thin adapter object; and
+  BAL must not chunk/compress on this channel (F23). `amodem` is NOT in
+  the runtime env yet — feature is strictly optional.

QML_PLAN.md

@@ -0,0 +1,379 @@
+# QML PLAN — BAL on Electrum QML / Android (Option B: minimal viable support)
+
+> Goal: let Android users (Electrum QML GUI) use BAL. **The Android device is
+> the OFFLINE SIGNING DEVICE**: its primary job is to receive unsigned will
+> transactions from an online machine (desktop/another phone), sign them with
+> the wallet keys held on it, and return the signed transactions — a classic
+> air-gapped signer workflow. Online features (willexecutor contact,
+> broadcast, build) are secondary on Android and belong mainly to the online
+> machine.
+> Strategy: a *third frontend* (`bal/gui/qml/`) that reuses `bal/core` logic
+> through the existing GUI-free `BalController`, exactly like `bal/cli/`
+> already does. The PyQt6 desktop GUI remains untouched and primary.
+>
+> Status: DRAFT for owner review (rule R4 — no code until explicit OK).
+> Chat language: Italian; this document is in English per rule R1.
+
+---
+
+## 1. Verified facts (research done on the local checkouts)
+
+All items below were verified by reading source, not assumed.
+
+| # | Fact | Where |
+|---|------|-------|
+| F1 | The fork's Electrum ships a full QML GUI built on **PyQt6.QtQml** (PyQt6 6.11 installed in runtime env imports `QtQml`/`QtQuick` fine). | `electrum/electrum/gui/qml/` |
+| F2 | The QML GUI has a **plugin mechanism**: manifest `"available_for"` must contain `"qml"`; Electrum then loads `<plugin>/qml.py` and calls the `init_qml(app)` hook. | `electrum/plugin.py` (`load_plugin_by_name`, gui_name), `gui/qml/__init__.py:88` |
+| F3 | On load, `main.qml` reads `plugin.so.loader` and auto-creates the component from `<plugins>/<name>/qml/<loader>.qml`. The plugin itself sets `.so` (a `PluginQObject`). Canonical example: `electrum/plugins/labels/qml.py`. | `gui/qml/components/main.qml` (`onPluginLoaded`), `gui/common_qt/plugins.py` |
+| F4 | The plugin must support **both** target versions: the QML GUI + `common_qt/plugins.py` exist in the 4.7.x line too (verified on the local 4.7.0 checkout). Exact 4.7.2 parity is Phase-0 task T1. | `$BAL_HOME/electrum470/electrum/gui/{qml,common_qt}` |
+| F5 | `BalController(plugin, wallet)` is GUI-free, per-wallet, and already implements state init + sign/build/broadcast flows against the bare `wallet` object (no `ElectrumWindow` needed). This is the reuse cornerstone of this plan. | `bal/cli/controller.py:119-175`, `sign_transactions` at :646 |
+| F6 | In the repo, `bal` is already symlinked into the Electrum tree as an **internal** plugin: `electrum/electrum/plugins/bal -> ../../../bal-electrum-plugin/bal`. Internal plugins are plain files on disk → the QML engine can load `.qml` assets directly. | `ls -la electrum/electrum/plugins/` |
+| F7 | The APK build spec lists packaged plugins explicitly and **BAL is not yet in that list**. | `electrum/contrib/android/buildozer_qml.spec:34-48` |
+| F8 | The QML Preferences page has **hardcoded toggles only** for `labels` and `psbt_nostr`; there is no generic plugin manager UI. Plugin enabling works via config regardless (`plugins.bal.enabled = true`). | `gui/qml/components/Preferences.qml:168,186,511-512` |
+| F9 | Extension points inside the QML app are minimal: `run_hook('init_qml', app)`, `run_hook('load_wallet', wallet)` (**one** argument, unlike Qt's two), `get_tx_extra_fee`, `tc_sign_wrapper`, and one named-component injection slot (`pluginsComponentsByName('export_tx_button')`). No tools menu, no status bar. | grep over `gui/qml/*.py`, `main.qml:778` |
+| F10 | External ZIP plugins cannot serve `.qml` files from inside the zip (zipimport exposes Python modules only; `Qt.resolvedUrl` needs real disk paths). Distribution as internal plugin (F6) or runtime extraction avoids this. | consequence of F3 |
+| F11 | Core signing path used by the CLI controller calls `wallet.sign_transaction(tx, password)` and updates signature counts — identical flow works under `QEWallet.wallet`. | `bal/cli/controller.py:646-700` |
+
+---
+
+## 2. Scope
+
+### In scope (MVP)
+
+Two usage **profiles** share one codebase:
+
+- **Offline signer profile** (Android, PRIORITY): works with no network.
+  1. Import a will bundle exported by the online machine (existing JSON will
+     format, see F12) — via file share, paste, or QR.
+  2. Review what is being signed (destinations, amounts, locktimes, fees).
+  3. Sign internally (`wallet.sign_transaction` + password prompt).
+     Partial signatures are combined when the bundle is re-imported
+     (`combine_with_other_psbt`, already supported by `merge_will` logic).
+  4. Export the signed bundle back to the online machine.
+- **Online manager profile** (desktop QML, secondary):
+  - Will status overview (state, expiry/check-alive date, reminder info).
+  - Heirs list (view/add/edit/remove, addresses or URIs).
+  - Will-executor selection (list, enable/disable, fee display, refresh).
+  - Build will (simplified wizard reusing core validation).
+  - Sign in place (password) or hand off to an offline signer via bundles.
+  - Broadcast / push to will-executors; invalidate will; check-alive refresh.
+  - Basic settings mapped onto `will_settings`.
+
+The offline signer pages are built first and must function with the network
+disabled (Electrum runs fine offline; willexecutor refresh simply degrades).
+
+Also in scope:
+
+- Android packaging: BAL bundled as internal plugin in the custom APK,
+  **enabled by default** (owner decision D3).
+- Keep desktop (`qt`) and CLI (`cmdline`) behavior byte-for-byte unchanged.
+
+### Out of scope (explicitly deferred)
+
+- Full parity with the PyQt6 GUI (calendar widget, preview list editor,
+  advanced fee controls, themes).
+- External-ZIP distribution of QML assets (F10 workaround postponed; ZIP
+  builds keep working for desktop exactly as today, without `qml` UI).
+- iOS, upstream-Electrum (spesmilo) compatibility.
+- Lightning-related features (irrelevant to BAL).
+
+---
+
+## 3. Architecture
+
+```
+                 ┌───────────────────────────────────────────┐
+                 │                bal/core                   │
+                 │ heirs, will, willexecutors, checkalive,   │
+                 │ reminders, input_rules, plugin_base       │
+                 └────────────┬──────────────────────────────┘
+                              │ (no Qt anywhere)
+        ┌─────────────────────┼──────────────────────┐
+        ▼                     ▼                      ▼
+  bal/gui/qt/            bal/cli/               bal/gui/qml/   ← NEW
+  BalWindow etc.      BalController            qml_plugin.py  (BalQmlPlugin)
+  (~9.3k lines)       (headless flows)         models.py      (QObject VMs)
+                                               so.py          (PluginQObject)
+                                               *.qml          (views)
+                                                      ▲
+                                              wraps ONE BalController
+                                              per loaded wallet
+```
+
+Design rules:
+
+- **Reuse, do not duplicate.** `bal/gui/qml/models.py` holds thin QObject
+  wrappers around one `BalController` instance per wallet. No business logic
+  in QML or in the wrappers beyond formatting.
+- **Same persistence.** Wallet DB dicts (`heirs`, `will`, `will_settings`)
+  are registered by `bal/core/plugin_base.py` already; QML reads/writes them
+  through the controller, so a wallet moves between desktop/Android unchanged.
+- **Threading.** Network operations (willexecutor fetch/push, broadcast)
+  run in worker threads exactly as the CLI does; results marshalled to the UI
+  thread via Qt signals on the wrapper objects. No blocking calls in slots.
+- **One transfer format.** The airgap round trip reuses the existing JSON
+  will serialization (`WillItem.to_dict()` maps, exactly what the Qt GUI's
+  `export_json_file`/`import` + `merge_will` flow already produces and
+  consumes — see F12). No new format is invented; export/merge logic gets a
+  single shared home usable by both frontends.
+- **Version gating.** Every import of `electrum.gui.qml.*` happens lazily and
+  defensively; if absent (e.g., odd build), the plugin degrades to core-only
+  behavior instead of crashing the daemon.
+
+---
+
+## 4. Work breakdown
+
+### Phase 0 — Verification spikes (no product code)
+
+| Task | Description | Exit criterion |
+|------|-------------|----------------|
+| T1 | Diff `gui/qml` + `gui/common_qt` between the 4.7.0 checkout here and current 4.8.x, focused on: `PluginQObject`, `init_qml` hook call sites, `onPluginLoaded` handler, `load_wallet` hook arity. If 4.7.2 differs, note shims needed. | Written compatibility note appended to COMPATIBILITY.md draft section |
+| T2 | Run desktop QML GUI headless with BAL enabled via config: `QT_QPA_PLATFORM=offscreen run_electrum -g qml` with `plugins.bal.enabled=true`, manifest updated ad-hoc (throwaway branch). Confirms discovery/loading path end-to-end before writing any code. | Log shows `init_qml` called for bal; no crash |
+| T3 | APK feasibility: add `electrum/plugins/bal` to `buildozer_qml.spec` package list locally, confirm p4a includes `.qml` data files and icons (may need `source.include_exts` adjustment). Do NOT ship. | Test APK contains `plugins/bal/qml/*.qml` |
+| T4 | Decide entry-point UX given F9 (no menu hook): candidate = tiny patch in fork's `main.qml` adding a "BAL" item in the wallet drawer/menu that opens our window object from `app.pluginobjects['bal']`. Confirm with owner. | Decision recorded in this file |
+
+Deliverable: short findings report appended to this document; go/no-go.
+
+### Phase 1 — Skeleton integration
+
+Files (all NEW unless noted):
+
+```
+bal/qml.py                     zipimport-style shim mirroring qt.py/cmdline.py
+bal/gui/qml/__init__.py        package docstring
+bal/gui/qml/qml_plugin.py      class BalQmlPlugin(BalPluginBase)
+bal/gui/qml/so.py              class BalSignalObject(PluginQObject)
+bal/manifest.json              MODIFIED: available_for += ["qml"]
+```
+
+Details:
+
+- `qml_plugin.py`:
+  - `@hook init_qml(self, app)`: store app ref; create `so` parented to app;
+    for each already-loaded wallet call `_on_wallet_loaded(wallet)`
+    (mirrors labels' pattern, see F3).
+  - `@hook load_wallet(self, wallet)` — **single argument** (F9); creates the
+    per-wallet view-model bundle (Phase 2) keyed by `wallet`.
+  - `@hook unload_wallet(self, wallet)`: drop controllers, close windows.
+- `so.py`: `BalSignalObject(PluginQObject)` exposing:
+  - `loader` property returning `"BalMain.qml"` (drives F3 auto-create);
+  - signals: `walletChanged`, `willStateChanged`, `heirsChanged`,
+    `willexecutorsChanged`, `busyChanged`;
+  - slots called from QML: open/close window, refresh willexecutors,
+    check-alive now, build/sign/broadcast/invalidate commands.
+- `manifest.json`: append `"qml"` to `available_for`. Desktop untouched
+  (Electrum filters per running GUI, verified F2).
+
+Exit criterion: with `-g qml`, plugin loads, `so.loader` component is created
+(log line from `onPluginLoaded`), no functional UI yet.
+
+### Phase 2 — View-models (QObject layer)
+
+New file `bal/gui/qml/models.py`:
+
+- `BalQmlWallet(QObject)`: owns one `BalController`; exposes read-only
+  properties (`willState`, `dateToCheck`, `expired`, `reminderInfo`,
+  `sigsHave/sigsRequired` per tx) + notification signals; forwards actions to
+  controller methods (`build_will`, `sign_transactions`, `broadcast_will`,
+  `invalidate_will_headless`, `check_alive`... — names per controller).
+  - **Airgap methods (priority):** `export_will_bundle()` and
+    `import_will_bundle(json_text)` returning summary of what changed. These
+    are small ports of the Qt GUI's `export_json_file` (window.py:1605) and
+    `merge_will` (window.py:1620) semantics. Preferred implementation: move
+    the logic into shared helpers (controller level or `bal/core/will.py`
+    static functions) and make the Qt GUI call the same helpers, so the two
+    frontends cannot diverge; regression-covered by existing core tests plus
+    new round-trip tests.
+  - Offline profile detection: expose an `isOffline` property derived from
+    `wallet.network is None` / config, so QML can hide online-only pages.
+- `HeirListModel(QAbstractListModel)`: roles `name`, `address`, `amountPct`,
+  `valid`; edit methods delegate to `Heirs` helpers through controller.
+- `WillTxListModel(QAbstractListModel)`: roles `txid`, `status`, `fee`,
+  `sigsHave`, `sigsRequired`, `isComplete`.
+- `WillExecutorListModel(QAbstractListModel)`: roles `url`, `selected`,
+  `fee`, `valid`; toggle + async refresh.
+- `BalQrTransferModel(QObject)`: thin scheduler over the shared transfer
+  planner `bal.core.qrtransfer` (already battle-tested by the desktop Qt
+  plugin, P1-P4). Exposes `encode(items)` → frames, `frameAt(i)` (data URL /
+  pixmap for QML), `decode(text)` → tx list, `total`, `current`, presets;
+  re-emits a `frameChanged` notifier so the QML page can step 1..N. No QR
+  rendering inside the model (QML paints it).
+- All list mutations happen on the controller state then `beginResetModel/
+  endResetModel` (datasets are small; simplicity over incremental updates).
+
+Exit criterion: pytest-driven model tests pass offscreen (create models over a
+regtest/testnet wallet fixture, assert roles after mutations).
+
+### Phase 3 — QML views
+
+New directory `bal/gui/qml/components/`:
+
+```
+BalMain.qml            top-level Window; stack of pages below
+BalSignPage.qml        PRIORITY (offline signer): import bundle
+                       (paste / file / QR), review summary of each tx,
+                       password-sign, export signed bundle back
+BalQrExportPage.qml    QR export view: drives BalQrTransferModel, one
+                       frame at a time (Prev/Next, progress i/N, chunk
+                       preset selector), mirror of desktop Qt dialog
+BalQrImportPage.qml    QR import view: slot grid (1..N), camera via
+                       Electrum `QRScan` reuse, manual paste fallback,
+                       then jump into BalSignPage review/sign
+BalStatusPage.qml      will state, expiry countdown, check-alive button
+                       (works offline with last-known data)
+BalHeirsPage.qml       ListView + add/edit dialog            [online profile]
+BalExecutorsPage.qml   ListView with switches + refresh      [online profile]
+BalBuildPage.qml       simplified build form (threshold selector, fees,
+                       executor pick) → runs controller.build_will
+                                                              [online profile]
+BalSettingsPage.qml    maps onto will_settings subset
+controls/BalButton.qml, BalField.qml   minimal styled primitives
+qmldir                 module registration
+```
+
+Notes:
+
+- **BalSignPage review screen is mandatory**: before signing, the user must
+  see per-transaction heir address, amount, locktime (date), and fee — this
+  device is the security boundary, so no "blind signing".
+- QR transfer: a full will bundle may exceed one QR's capacity when there are
+  many heirs/transactions. The desktop Qt plugin now resolves this with
+  chunked multi-QR streams (`bal/core/qrtransfer.py`, chunk presets
+  150/400/900/1800 bytes/frame, EC level M); the QML GUI reuses the same
+  scheduler via a thin model. Order of preference stays (1) share/save file +
+  paste text; (2) chunked QR streams through `BalQrTransferModel`.
+- Styling minimal, follow existing QML components' look (reuse
+  `controls/` from Electrum where importable — prefer copying tiny primitives
+  to avoid coupling to upstream churn; decide during implementation).
+- Every string wrapped with `electrum.i18n._`.
+
+Exit criterion: full manual walkthrough on desktop QML GUI (offscreen +
+interactive) performing BOTH: (a) online profile — configure heirs → select
+executors → build → sign → broadcast → invalidate; and (b) offline signer
+profile — export unsigned bundle from an online wallet, import into a second
+offline wallet instance, sign, re-export, import signed bundle back into the
+first wallet and verify signatures combined/status COMPLETE. Walkthrough (b)
+must pass with networking disabled.
+
+### Phase 4 — Android integration
+
+- Add `electrum/plugins/bal` (+ data extensions for `.qml`, `icons/*`) to
+  `contrib/android/buildozer_qml.spec` in the Electrum fork.
+- Patch fork's `Preferences.qml` with a BAL toggle **(owner approved, D1)**
+  and default-enable BAL in the APK build (D3: enabled by default).
+- Entry point per T4 decision (menu/drawer patch in fork's `main.qml`, D1
+  approved). Fallback if T4 picks auto-open: window opens on wallet load.
+- Rebuild APK; smoke-test on device/emulator:
+  install → BAL already enabled → open wallet → full MVP walkthrough,
+  including airplane-mode signing round trip (file/QR transfer between an
+  online desktop and the offline device — for emulator testing, "offline" =
+  network disabled via settings).
+- Watch-outs: filesystem paths (use `os.path.join`, no hardcoded separators —
+  already house style), background network on mobile (willexecutor timeouts),
+  APK size impact (bal is small; icons only), share-intent/file access
+  permissions for bundle import/export.
+
+Exit criterion: signed test APK passes the same walkthrough as Phase 3.
+
+### Phase 5 — Tests & CI hygiene
+
+- New tests following repo conventions (`def test_*` + `__main__` block):
+  - `tests/test_qml_models.py` — models over fake/controller-backed wallet
+    (offscreen, no network).
+  - `tests/test_qml_airgap_roundtrip.py` — PRIORITY: export unsigned bundle
+    from wallet A → import into wallet B (same seed, offline) → sign →
+    export signed → merge back into A; assert COMPLETE status and signature
+    counts. Must pass with no network.
+  - `tests/test_qml_plugin_loading.py` — plugin instantiates under a stubbed
+    QML app object; `so` wiring correct; load/unload wallet lifecycle.
+  - Extend `tests/smoke_test.py` usage: `QT_QPA_PLATFORM=offscreen python3
+    tests/smoke_test.py electrum.plugins.bal` still green (qt path intact).
+- Regression gate: full `tests/test_core_*.py` batch + ruff (no NEW
+  violations) before any delivery ZIP.
+- Manual matrix recorded in CHANGELOG entry: [desktop qt, desktop qml
+  offscreen, Android APK] × [4.7.2, 4.8.0] where applicable.
+
+### Phase 6 — Release plumbing & docs
+
+- `build_zip.py`: ensure new `bal/gui/qml/**` and `components/*.qml` included
+  in deterministic zip (harmless on desktop; enables future extraction-based
+  loading).
+- `COMPATIBILITY.md`, `README.md`, `HANDOFF.md`: document QML/Android status,
+  limitations, and how to enable (`-g qml` / APK toggle).
+- `CHANGELOG.md`: numbered entry at END per house rules.
+- Version bump + release handled by `make-release.sh` as usual (owner-driven).
+
+---
+
+## 5. Risks & mitigations
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| R1: 4.7.2 vs 4.8 QML internals drift | broken load on one version | Phase-0 T1 diff first; lazy imports + capability checks; shim module if needed |
+| R2: no generic plugin UI in QML (F8) | users can't enable BAL from UI | config default-enable in fork APK; small Preferences.qml patch in fork (we control it); document manual config for desktop |
+| R3: no natural entry point in main.qml (F9) | user can't find/open BAL window | T4 decision: fork-side menu/drawer patch; fallback = auto-open window on wallet load behind a setting |
+| R4: dual-GUI maintenance burden | long-term cost | strict reuse of `BalController`; QML layer forbidden from business logic (review rule); parity features stay in qt GUI |
+| R5: threading bugs on mobile networks | ANRs/crashes | all network ops in threads like CLI; signals-only UI updates; timeouts already configurable |
+| R6: airgap transfer friction (bundle size vs QR capacity, share permissions on Android) | users cannot move bundles reliably | desktop Qt: chunked multi-QR streams + audio-modem optional channel shipped (P1-P4) and regression-gated; QML: file share + paste first, QR via `BalQrTransferModel` (Phase 2/3 notes); Android camera on Qt6 is known-flaky, file/paste stays the primary mobile fallback and is tested first in Phase 4 |
+| R7: export/merge semantics divergence between frontends | signed bundles rejected or double-counted | single shared helper used by qt GUI and qml layer (Phase 2); round-trip regression test |
+| R8: hidden coupling of qt code into shared modules | qml import pulls QtWidgets | lint guard idea: import-linter/ruff rule forbidding `PyQt6.QtWidgets` under `bal/gui/qml/` |
+| R9: zip distribution ambiguity (F10) | confusion about what ships where | clear policy: ZIP = desktop qt+cmdline only; QML requires internal-plugin/APK route (Phase 6 documents this) |
+| R10: unknown Android/Electrum baseline (owner to confirm, OQ4) | wrong Qt/PyQt6 assumptions in APK build | Phase-0 T3 builds against the fork's current toolchain; code keeps 4.7.x/4.8.x dual support so the answer can arrive late without rework |
+
+---
+
+## 6. Questions for the owner — ANSWERED (2026-08-25)
+
+1. **Fork patches (T4/R3):** ✅ **D1 — APPROVED.** Patching the fork's
+   `main.qml`/`Preferences.qml` is allowed for the BAL menu entry and toggle.
+2. **Offline signing topology:** ✅ **D2 — Android IS the offline device.**
+   The phone holds the keys and acts as air-gapped signer: import unsigned
+   bundle → review → sign → export signed bundle back to the online machine.
+   The sign/import/export page is therefore the top priority of Phase 3, and
+   the round-trip test is the top priority of Phase 5.
+3. **Enable-by-default:** ✅ **D3 — BAL pre-enabled in the custom APK**
+   (toggle still available to disable).
+4. **Target Android/Electrum baseline:** ⏳ **OPEN (OQ4)** — owner will get
+   back later. Not blocking: see risk R10 mitigation.
+
+---
+
+## 7. Effort estimate
+
+| Phase | Rough size |
+|-------|-----------|
+| 0 spikes | ~half day (mostly reading + one throwaway branch) |
+| 1 skeleton | ~300 lines Python |
+| 2 models (incl. shared export/merge helpers) | ~600–800 lines Python |
+| 3 views (offline signer page first) | ~900–1300 lines QML |
+| 4 android | fork-side patches + build iteration (device-dependent) |
+| 5 tests | ~500 lines |
+| 6 release/docs | small |
+
+Overall: comparable to a medium feature, dominated by Phase 3 UI polish and
+Phase 4 device iteration.
+
+---
+
+## 8. Findings log (append-only)
+
+- **F12** — The airgap round trip already exists in the Qt GUI layer and can
+  be ported almost verbatim: `export_json_file()` (window.py:1605) exports
+  all will items as `{wid: WillItem.to_dict()}` JSON (marking them
+  `EXPORTED`); the import side goes through `merge_will()`
+  (window.py:1620), which carries operational statuses, combines partial
+  signatures via `tx.combine_with_other_psbt()` when txids match, substitutes
+  the tx otherwise, and recomputes validity locally without network.
+  Conclusion: no new transfer format is needed; the plan is to give this
+  logic a shared home (controller/core) so Qt, CLI-adjacent tooling and QML
+  all use one implementation.
+
+### Decisions
+
+- **D1** — Fork-side patches to `main.qml` / `Preferences.qml` approved by
+  the owner.
+- **D2** — Android = offline signing device; sign/import/export flow has
+  top priority.
+- **D3** — BAL enabled by default in the custom APK.
+- **OQ4** — Android/Electrum baseline: open, non-blocking (see R10).

README.md

@@ -26,6 +26,8 @@ bal/                     the installable Electrum plugin package
 │   ├── willexecutors.py
 │   ├── checkalive.py
 │   ├── reminders.py
+│   ├── qrtransfer.py       BAL QR will-transfer wire format / chunk scheduler
+│   ├── animated_qr.py      BC-UR v1/v2 + BBQR codecs (stdlib-only)
 │   └── input_rules.py
 ├── cli/                 headless command-line layer (no Qt)
 │   ├── commands.py      bal_* daemon commands (@plugin_command)
@@ -87,6 +89,29 @@ Copy the `bal/` directory into your Electrum installation's
 `electrum/plugins/` directory, so that `electrum/plugins/bal/manifest.json`
 exists, then enable it from **Tools → Plugins**.
 
+## Transfer a will with QR codes (or audio)
+
+From the will list (**Export → QR Codes**) a will can be exported as a
+sequence of QR codes and imported on another device (**Import via QR**). The
+export offers All / Valid / Valid-NC filters plus a QR size preset
+(150–1800 bytes/frame); the import flow reviews and sign each transaction
+one at a time, then proposes exporting the signed transactions. When
+Electrum's `audio_modem` plugin is enabled (optional, requires `amodem` +
+PortAudio) Send/Receive audio buttons complement the QR channel. See
+[`PLAN_QR_TRANSFER.md`](PLAN_QR_TRANSFER.md) for the BAL QR wire-format spec.
+
+### Animated-QR formats (interop)
+
+BAL QR is the default export format, but the export page's **Format** selector
+also emits **BC-UR v1** (`ur:bytes`, BC32 + SHA-256), **BC-UR v2**
+(`ur:bytes`, CBOR fountain codes) and **BBQR** (`B$…`, Coinkite, used by
+BitKit) animated-QR sequences. The importer auto-detects the format of each
+code it sees, so any of the four formats can be imported on a BAL device, and
+a BAL export can be imported by any tool that understands these standards.
+UR v2 imports tolerate out-of-order and duplicate frames (fountain decoding);
+BBQR frames may arrive in any order. Rotation/redundancy caps and the
+32 MB message limit (zlib-bomb guard) bound untrusted scanner input.
+
 ## Command-line / headless usage
 
 BAL can be used without the Qt GUI via Electrum's daemon mode. The CLI layer

bal/cli/controller.py

@@ -22,7 +22,6 @@ This module is imported lazily (only when a ``bal_*`` command actually runs),
 so a missing wallet or a network-less daemon can still start Electrum.
 """
 
-import copy
 import json
 import time
 
@@ -47,7 +46,7 @@ from ..core.checkalive import (
 )
 from ..core.heirs import Heirs, is_op_return_address
 from ..core.plugin_base import BalConfig, BalPlugin
-from ..core.util import Util
+from ..core.util import Util, copy_structure
 from ..core.will import Will, WillItem
 from ..core.willexecutors import Willexecutors, is_onion_url, is_tor_active
 
@@ -346,11 +345,11 @@ class BalController:
                 tx["my_locktime"] = txs[txid].my_locktime
                 tx["heirsvalue"] = txs[txid].heirsvalue
                 tx["description"] = txs[txid].description
-                tx["willexecutor"] = copy.deepcopy(txs[txid].willexecutor)
+                tx["willexecutor"] = copy_structure(txs[txid].willexecutor)
                 tx["status"] = _("New")
                 tx["baltx_fees"] = txs[txid].tx_fees
                 tx["time"] = creation_time
-                tx["heirs"] = copy.deepcopy(txs[txid].heirs)
+                tx["heirs"] = copy_structure(txs[txid].heirs)
                 tx["txchildren"] = []
                 will[txid] = WillItem(tx, _id=txid, wallet=self.wallet)
             Will.update_will(self.willitems, will)

bal/core/heirs.py

@@ -59,7 +59,7 @@ from electrum.util import (
     write_json_file,
 )
 
-from .util import Util
+from .util import Util, copy_structure
 from .willexecutors import Willexecutors
 
 if TYPE_CHECKING:
@@ -321,40 +321,14 @@ def get_change_output(wallet, in_amount, out_amount, fee):
         return out
 
 
-def _json_safe(value, _path="heirs", _depth=0):
+def _json_safe(value, _path="heirs"):
-    """Return a JSON-serializable deep copy of *value*.
+    """Backward-compatible alias of :func:`bal.core.util.copy_structure`.
 
-    The wallet DB persists the heirs dict via ``json_db.put``, which calls
+    Kept so call sites that imported ``_json_safe`` directly keep working; the
-    ``copy.deepcopy`` on the value.  If any nested element is a live runtime
+    actual implementation (a JSON-safe, deepcopy-free clone) lives in
-    object (e.g. one holding a ``threading.RLock``), deepcopy raises
+    ``bal.core.util`` so every copy path shares one code base.
-    ``TypeError: cannot pickle '_thread.RLock' object`` and the whole
-    "Build will" task fails.
-
-    To make persistence robust we coerce the structure to plain
-    JSON-compatible types (dict / list / str / int / float / bool / None).
-    Anything else is converted to ``str(value)`` and logged with its path so
-    the offending field can be identified, instead of crashing the task.
     """
-    # Primitive JSON scalars are kept as-is.
+    return copy_structure(value, _path=_path)
-    if value is None or isinstance(value, (bool, int, float, str)):
-        return value
-    if isinstance(value, dict):
-        return {
-            str(k): _json_safe(v, "{}[{!r}]".format(_path, k), _depth + 1)
-            for k, v in value.items()
-        }
-    if isinstance(value, (list, tuple)):
-        return [
-            _json_safe(v, "{}[{}]".format(_path, i), _depth + 1)
-            for i, v in enumerate(value)
-        ]
-    # Unexpected runtime object: do not let it reach deepcopy.  Log where it
-    # was found so the real source can be fixed, then store a safe string.
-    _logger.error(
-        "heirs.save: non-serializable value at {} (type={}); coercing to str. "
-        "value={!r}".format(_path, type(value).__name__, value)
-    )
-    return str(value)
 
 
 class Heirs(dict, Logger):

bal/core/plugin_base.py

@@ -24,7 +24,7 @@ This module performs **no** GUI work and imports nothing from PyQt / electrum.gu
 import json
 import os
 import platform
-from datetime import date, datetime, timedelta, timezone
+from datetime import datetime, timedelta, timezone
 
 from electrum import constants, json_db
 from electrum.logging import get_logger
@@ -109,7 +109,9 @@ def get_will(x):
 
 try:
     # Electrum >= 4.8.0
-    from electrum.stored_dict import register_name as _electrum_register_name  # pyright: ignore[reportMissingImports]
+    from electrum.stored_dict import (
+        register_name as _electrum_register_name,  # pyright: ignore[reportMissingImports]
+    )
 
     def _register_will_dict(name, method, _type=None):
         """Register a plugin dict in the wallet DB (Electrum >= 4.8.0 API)."""
@@ -279,6 +281,13 @@ class BalPlugin(BasePlugin):
         # stay display-only outside the wizard unless the user opts in.
         self.EDITABLE_DATES = BalConfig(config, "bal_editable_dates", False)
 
+        # QR_CHUNK_SIZE (will transfer via QR): payload budget, in bytes, used
+        # per QR frame when exporting/importing a will through the QR channel.
+        # The settings dialog offers the 4 standard presets of
+        # bal.core.qrtransfer.CHUNK_PRESETS; this stores the selected budget.
+        # Default 150 (small QR, low-resolution cameras).
+        self.QR_CHUNK_SIZE = BalConfig(config, "bal_qr_chunk_size", 150)
+
         # NUM_REMINDERS (Group D / D1): how many SEPARATE reminder events the
         # exported .ics calendar should contain. Each reminder becomes its own
         # VEVENT (its own date in the calendar). The dates are spread uniformly

bal/core/qrtransfer.py

@@ -0,0 +1,212 @@
+"""
+bal.core.qrtransfer
+===================
+
+GUI-free helpers for moving BAL will data between devices via QR codes or
+the Electrum ``audio_modem`` plugin (see ``PLAN_QR_TRANSFER.md``).
+
+Scope
+-----
+* converts will transactions into a compact ``transfer_string``
+  (newline-joined serialized transactions, optionally zlib + base64
+  compressed);
+* splits that string into fixed-size ``BALQR1|N|i|flags|payload`` frames for
+  multi-QR export, and reassembles/validates them on import.
+
+The audio-modem channel deliberately bypasses the framing helpers here
+(PLAN_QR_TRANSFER.md section 4.4): its transport compresses internally and
+carries the whole transfer string in a single blob, so callers only use
+:func:`encode_transfer` / :func:`decode_transfer`.
+
+This module never imports Qt or any Electrum GUI code (house rule).
+"""
+
+from __future__ import annotations
+
+import base64
+import zlib
+
+MAGIC = "BALQR"
+VERSION = 1
+FLAG_COMPRESSED = "Z"
+
+# 4 standard presets (label, payload budget in bytes per QR). Ordered from
+# low-resolution cameras to high-resolution cameras (owner decision D5).
+CHUNK_PRESETS = (
+    ("Small - ~150 bytes/QR (low-res cameras)", 150),
+    ("Medium - ~400 bytes/QR", 400),
+    ("Large - ~900 bytes/QR", 900),
+    ("XL - ~1800 bytes/QR (high-res cameras)", 1800),
+)
+
+# Smallest allowed payload budget per frame, below which the frame header
+# could consume the whole budget.
+MIN_CHUNK_SIZE = 40
+
+_FRAME_MAGIC = MAGIC + str(VERSION)
+
+
+class QrTransferError(ValueError):
+    """Base error for will QR / audio transfer processing."""
+
+
+class MissingFramesError(QrTransferError):
+    """Some frame indices of a multi-QR transfer are missing."""
+
+    def __init__(self, missing):
+        self.missing = list(missing)
+        super().__init__("Missing QR frames: {}".format(self.missing))
+
+
+class InconsistentTotalError(QrTransferError):
+    """Frames disagree about the advertised frame total."""
+
+
+def encode_transfer(tx_strings, compress=False):
+    """Join serialized transaction strings into a transfer string.
+
+    ``compress=True`` wraps the joined text in zlib + base64 (ASCII-safe) so
+    the whole bundle shrinks before being printed/scanned. The optional flags
+    of the frame header let the importer reverse this automatically.
+    """
+    return __compress("\n".join(tx_strings), enabled=compress)
+
+
+def decode_transfer(transfer_string, compressed):
+    """Inverse of :func:`encode_transfer`.
+
+    Returns the list of serialized transaction strings; empty frames are
+    dropped so a trailing newline (or an empty payload) cannot produce an
+    empty trailing element.
+    """
+    text = __decompress(transfer_string, enabled=compressed)
+    return [part for part in text.split("\n") if part]
+
+
+def split_frames(transfer_string, chunk_size, compressed=False):
+    """Split ``transfer_string`` into full ``BALQR`` frames.
+
+    Every returned frame is at most ``chunk_size`` characters long (header
+    included). ``compressed`` propagates the ``Z`` flag into every frame so
+    the importer knows how to reverse the encoding.
+
+    Raises :class:`QrTransferError` when ``chunk_size`` is too small to hold
+    the header plus any payload.
+    """
+    flags = FLAG_COMPRESSED if compressed else ""
+    total = __compute_total(len(transfer_string), chunk_size, flags)
+    frames = []
+    pos = 0
+    length = len(transfer_string)
+    for index in range(1, total + 1):
+        overhead = len(__frame_header(total, index, flags))
+        budget = chunk_size - overhead
+        end = min(pos + budget, length)
+        frames.append(__build_frame(total, index, flags, transfer_string[pos:end]))
+        pos = end
+        if pos >= length:
+            break
+    if pos < length:
+        # __compute_total guarantees this cannot happen; keep a safety net.
+        raise QrTransferError("internal error: frames did not cover the transfer string")
+    return frames
+
+
+def parse_frame(frame):
+    """Parse a single frame.
+
+    Returns ``(total, index, compressed: bool, payload: str)``. Raises
+    :class:`QrTransferError` on malformed input (bad magic/version, wrong
+    arity, non-integer or out-of-range frame numbers, unknown flags).
+    """
+    parts = frame.split("|", maxsplit=4)
+    if len(parts) != 5:
+        raise QrTransferError("Not a BAL will QR (bad frame structure)")
+    magic_seen, total_s, index_s, flags, payload = parts
+    if magic_seen != _FRAME_MAGIC:
+        raise QrTransferError("Not a BAL will QR (unknown magic/version)")
+    try:
+        total = int(total_s)
+        index = int(index_s)
+    except ValueError as e:
+        raise QrTransferError("Not a BAL will QR (bad frame numbers)") from e
+    if total < 1 or not 1 <= index <= total:
+        raise QrTransferError("Not a BAL will QR (frame numbering out of range)")
+    if flags not in ("", FLAG_COMPRESSED):
+        raise QrTransferError("Not a BAL will QR (unknown flags)")
+    return total, index, flags == FLAG_COMPRESSED, payload
+
+
+def assemble(frames, total):
+    """Concatenate frame payloads back into a transfer string.
+
+    ``frames`` maps 1-based index -> payload. Every index ``1..total`` must
+    be present (else :class:`MissingFramesError`) and no index may exceed
+    ``total`` (else :class:`InconsistentTotalError`).
+    """
+    if total < 1:
+        raise QrTransferError("invalid frame total")
+    missing = [index for index in range(1, total + 1) if index not in frames]
+    if missing:
+        raise MissingFramesError(missing)
+    extra = [index for index in frames if index > total]
+    if extra:
+        raise InconsistentTotalError()
+    return "".join(frames[index] for index in range(1, total + 1))
+
+
+def preset_index_for_chunk_size(chunk_size):
+    """Return the :data:`CHUNK_PRESETS` index whose budget best matches a size."""
+    best, best_diff = 0, abs(chunk_size - CHUNK_PRESETS[0][1])
+    for index, (_label, budget) in enumerate(CHUNK_PRESETS):
+        diff = abs(chunk_size - budget)
+        if diff < best_diff:
+            best, best_diff = index, diff
+    return best
+
+
+# --------------------------------------------------------------------------- #
+# Internals
+# --------------------------------------------------------------------------- #
+
+def __compress(text, *, enabled):
+    if not enabled:
+        return text
+    return base64.b64encode(zlib.compress(text.encode("utf-8"))).decode("ascii")
+
+
+def __decompress(text, *, enabled):
+    if not enabled:
+        return text
+    return zlib.decompress(base64.b64decode(text.encode("ascii"))).decode("utf-8")
+
+
+def __frame_header(total, index, flags):
+    return "{}|{}|{}|{}|".format(_FRAME_MAGIC, total, index, flags)
+
+
+def __build_frame(total, index, flags, payload):
+    return __frame_header(total, index, flags) + payload
+
+
+def __compute_total(transfer_len, chunk_size, flags):
+    """Smallest frame count whose budget covers the whole transfer string.
+
+    The budget shrinks as ``total`` gains digits (wider header), so the count
+    is recomputed iteratively until it converges.
+    """
+    if chunk_size < MIN_CHUNK_SIZE:
+        raise QrTransferError(
+            "chunk size too small to hold a BAL QR frame: {}".format(chunk_size)
+        )
+    total = 1
+    while True:
+        overhead = len(__frame_header(total, total, flags))
+        budget = chunk_size - overhead
+        if budget <= 0:
+            raise QrTransferError(
+                "chunk size too small for the BAL QR frame header: {}".format(chunk_size)
+            )
+        if transfer_len <= budget * total:
+            return total
+        total += 1

bal/core/util.py

@@ -21,8 +21,11 @@ import bisect
 from datetime import datetime, timedelta, timezone
 
 from electrum.address_synchronizer import TX_HEIGHT_FUTURE, TX_HEIGHT_LOCAL
+from electrum.logging import get_logger
 from electrum.transaction import PartialTxOutput
 
+_logger = get_logger(__name__)
+
 # Bitcoin consensus rule: an nLockTime value strictly below this threshold is
 # interpreted as a *block height*, otherwise it is interpreted as a *UNIX
 # timestamp*.
@@ -35,6 +38,41 @@ from electrum.transaction import PartialTxOutput
 LOCKTIME_THRESHOLD = 500000000
 
 
+def copy_structure(value, _path="copy"):
+    """Return a JSON-serializable deep copy of *value*.
+
+    This is the ad-hoc, deepcopy-free stand-in used every time the plugin needs
+    an independent copy of a plain-data structure (heirs dicts, will-executor
+    dicts, status tables).  It recursively clones dict / list / tuple values
+    while leaving JSON scalars (str / int / float / bool / None) as-is.
+
+    If any nested element is a live runtime object (e.g. one holding a
+    ``threading.RLock``), ``copy.deepcopy`` would raise
+    ``TypeError: cannot pickle '_thread.RLock' object``; instead we coerce the
+    offending value to ``str(value)`` and log it with its path so the source
+    field can be identified, without crashing the caller.
+    """
+    # Primitive JSON scalars are kept as-is.
+    if value is None or isinstance(value, (bool, int, float, str)):
+        return value
+    if isinstance(value, dict):
+        return {
+            str(k): copy_structure(v, "{}[{!r}]".format(_path, k))
+            for k, v in value.items()
+        }
+    if isinstance(value, (list, tuple)):
+        return [
+            copy_structure(v, "{}[{}]".format(_path, i)) for i, v in enumerate(value)
+        ]
+    # Unexpected runtime object: do not let it reach deepcopy.  Log where it
+    # was found so the real source can be fixed, then store a safe string.
+    _logger.error(
+        "copy_structure: non-serializable value at {} (type={}); coercing to "
+        "str. value={!r}".format(_path, type(value).__name__, value)
+    )
+    return str(value)
+
+
 class Util:
     """Namespace of static helpers (kept as a class to preserve the original
     ``Util.method(...)`` call sites used throughout the plugin)."""

bal/core/will.py

@@ -26,7 +26,6 @@ The status flags themselves (the source of truth) stay here; only the mapping
 "status -> colour" now lives in the GUI layer.  No behaviour changed.
 """
 
-import copy
 from datetime import datetime, timezone
 
 from electrum.i18n import _
@@ -45,7 +44,7 @@ from electrum.util import (
 )
 
 from .heirs import WillExecutorFeeTooHighException
-from .util import Util
+from .util import Util, copy_structure
 from .willexecutors import Willexecutors
 
 MIN_LOCKTIME = 1
@@ -143,7 +142,7 @@ class Will:
         willitems = {}
         for wid in will:
             Will.add_info_from_will(will, wid, wallet)
-            willitems[wid] = WillItem(will[wid])
+            willitems[wid] = WillItem(will[wid], wallet=wallet)
         will = willitems
         errors = {}
         for wid in will:
@@ -165,7 +164,7 @@ class Will:
                 outputs = will[wid].tx.outputs()
                 ow = will[wid]
                 ow.normalize_locktime(others_input)
-                will[wid] = WillItem(ow.to_dict())
+                will[wid] = ow.copy()
 
                 for i in range(0, len(outputs)):
                     Will.change_input(
@@ -465,7 +464,7 @@ class Will:
                 continue
             utxo_str = utxo.prevout.to_str()
             if utxo_str in prevout_to_spend:
-                balance += inputs[utxo_str][0][2].value_sats()
+                balance += utxo.value_sats()
                 utxo_to_spend.append(utxo)
         _logger.debug("utxo to spend: {}".format(utxo_to_spend))
         if len(utxo_to_spend) > 0:
@@ -1327,49 +1326,76 @@ class WillItem(Logger):
         return self.STATUS[status][1]
 
     def __init__(self, w, _id=None, wallet=None):
-        if isinstance(
+        if isinstance(w, WillItem):
-            w,
+            # Copy a WillItem WITHOUT deepcopy. Serialize it to its plain-dict
-            WillItem,
+            # form and deserialize from there: the tx is re-parsed into a fresh
-        ):
+            # object, STATUS is rebuilt from the clones below and heirs /
-            self.__dict__ = w.__dict__.copy()
+            # will-executors are cloned recursively, so the copy shares no
-            self.STATUS = copy.deepcopy(w.STATUS)
+            # mutable state with the source. See also copy().
-            self.heirs = copy.deepcopy(w.heirs) if w.heirs is not None else None
+            data = w.to_dict()
-        else:
+            data["heirs"] = copy_structure(w.heirs) if w.heirs is not None else None
-            self.tx = Will.get_tx_from_any(w["tx"])
+            data["willexecutor"] = (
-            self.heirs = w.get("heirs", None)
+                copy_structure(w.we) if w.we is not None else None
-            self.we = w.get("willexecutor", None)
+            )
-            self.status = w.get("status", None)
-            self.description = w.get("description", None)
-            self.time = w.get("time", None)
-            self.change = w.get("change", None)
-            self.tx_fees = w.get("baltx_fees", 0)
-            self.sigs_required = int(w.get("sigs_required", 0))
-            self.sigs_have = int(w.get("sigs_have", 0))
-            self.father = w.get("Father", None)
-            self.children = w.get("Children", None)
-            self.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
-            for s in self.STATUS:
-                self.STATUS[s][1] = w.get(s, WillItem.STATUS_DEFAULT[s][1])
-            # Backward-compatibility migration (A2): the "PENDING" status was
-            # renamed to "MEMPOOL". Wills saved by older versions of the plugin
-            # store the flag under the legacy "PENDING" key, so if that key is
-            # present and set, carry it over to "MEMPOOL". This way no state is
-            # lost when loading an older will. The new key always wins if both
-            # happen to be present.
-            if "MEMPOOL" not in w and w.get("PENDING"):
-                self.STATUS["MEMPOOL"][1] = True
             if not _id:
-                self._id = self.tx.txid()
+                _id = w._id
-            else:
+            w = data
-                self._id = _id
+        self.tx = Will.get_tx_from_any(w["tx"])
+        self.heirs = w.get("heirs", None)
+        self.we = w.get("willexecutor", None)
+        self.status = w.get("status") or ""
+        self.description = w.get("description", None)
+        self.time = w.get("time", None)
+        self.change = w.get("change", None)
+        self.tx_fees = w.get("baltx_fees", 0)
+        self.sigs_required = int(w.get("sigs_required", 0))
+        self.sigs_have = int(w.get("sigs_have", 0))
+        self.father = w.get("Father", None)
+        self.children = w.get("Children", None)
+        self.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
+        for s in self.STATUS:
+            self.STATUS[s][1] = w.get(s, WillItem.STATUS_DEFAULT[s][1])
+        # Backward-compatibility migration (A2): the "PENDING" status was
+        # renamed to "MEMPOOL". Wills saved by older versions of the plugin
+        # store the flag under the legacy "PENDING" key, so if that key is
+        # present and set, carry it over to "MEMPOOL". This way no state is
+        # lost when loading an older will. The new key always wins if both
+        # happen to be present.
+        if "MEMPOOL" not in w and w.get("PENDING"):
+            self.STATUS["MEMPOOL"][1] = True
+        if not _id:
+            self._id = self.tx.txid()
+        else:
+            self._id = _id
 
-            if not self._id:
+        if not self._id:
-                self.status += "ERROR!!!"
+            self.status += "ERROR!!!"
-                self.valid = False
+            self.valid = False
 
         if wallet:
             self.tx.add_info_from_wallet(wallet)
 
+    def copy(self, wallet=None):
+        """Return an independent copy of this WillItem (no deepcopy).
+
+        The copy is produced by serializing this item and deserializing it:
+        the transaction is re-parsed, the STATUS table is rebuilt and
+        heirs / will-executors are cloned recursively, so the result shares no
+        mutable state with ``self``.  Pass a ``wallet`` when the copy's tx
+        needs its address/value information restored
+        (``tx.add_info_from_wallet``).
+        """
+        return WillItem(self, _id=self._id, wallet=wallet)
+
+    @staticmethod
+    def copy_status_table(status_table):
+        """Clone a STATUS table (``{flag: [label, bool]}``) without deepcopy.
+
+        Both the outer dict and every inner ``[label, bool]`` list are new
+        objects, so mutating the returned table never affects the source.
+        """
+        return {k: [label, value] for k, (label, value) in status_table.items()}
+
     def to_dict(self):
         out = {
             "_id": self._id,
@@ -1383,6 +1409,8 @@ class WillItem(Logger):
             "baltx_fees": self.tx_fees,
             "sigs_required": self.sigs_required,
             "sigs_have": self.sigs_have,
+            "Father": self.father,
+            "Children": self.children,
         }
         for key in self.STATUS:
             try:

bal/gui/qt/calendar.py

@@ -16,11 +16,10 @@ the Qt button and the OS/subprocess glue.
 import os
 import subprocess
 
+from electrum.gui.qt.util import getSaveFileName
 from PyQt6.QtGui import QAction
 from PyQt6.QtWidgets import QInputDialog, QMenu, QToolButton
 
-from electrum.gui.qt.util import getSaveFileName
-
 from ...core.reminders import write_temp_ics
 from .common import _, _logger
 

bal/gui/qt/common.py

@@ -15,7 +15,6 @@ hosts a few GUI helpers that do not deserve a module of their own:
       (:class:`CheckAliveError` now lives in ``bal.core.checkalive``.)
 """
 
-import copy
 import enum
 import os
 import subprocess
@@ -28,6 +27,7 @@ from functools import partial
 from typing import Any, Callable, Mapping, Optional, Union
 
 from electrum.bitcoin import NLOCKTIME_BLOCKHEIGHT_MAX, NLOCKTIME_MAX, NLOCKTIME_MIN
+from electrum.gui.common_qt.util import draw_qr
 from electrum.gui.qt.amountedit import BTCAmountEdit
 from electrum.gui.qt.main_window import ElectrumWindow, StatusBarButton
 from electrum.gui.qt.my_treeview import MyTreeView
@@ -42,6 +42,7 @@ from electrum.gui.qt.util import (
     MessageBoxMixin,
     OkButton,
     TaskThread,
+    WaitingDialog,
     WindowModalDialog,
     char_width_in_lineedit,
     getOpenFileName,
@@ -80,6 +81,7 @@ from PyQt6.QtWidgets import (
     QAbstractItemView,
     QAbstractSpinBox,
     QApplication,
+    QButtonGroup,
     QCheckBox,
     QComboBox,
     QDateTimeEdit,
@@ -92,6 +94,7 @@ from PyQt6.QtWidgets import (
     QMenu,
     QMenuBar,
     QPushButton,
+    QRadioButton,
     QScrollArea,
     QSizePolicy,
     QSpinBox,
@@ -119,7 +122,7 @@ from ...core.heirs import (
 
 # --- Core (GUI-free) logic layer ---
 from ...core.plugin_base import BalPlugin, BalTimestamp
-from ...core.util import Util
+from ...core.util import Util, copy_structure
 from ...core.will import (
     AmountException,
     HeirChangeException,

bal/gui/qt/lists.py

@@ -20,15 +20,13 @@ from PyQt6.QtWidgets import QLineEdit as _QLineEdit
 from PyQt6.QtWidgets import QMessageBox, QStyledItemDelegate
 
 from .common import (
-    _,
+    OP_RETURN_PREFIX,
-    _logger,
     BalTimestamp,
     Buttons,
     CancelButton,
     HelpButton,
     MessageBoxMixin,
     MyTreeView,
-    OP_RETURN_PREFIX,
     OkButton,
     QAbstractItemView,
     QApplication,
@@ -46,15 +44,17 @@ from .common import (
     QSpinBox,
     QStandardItem,
     QStandardItemModel,
+    Qt,
     QToolButton,
     QVBoxLayout,
     QWidget,
-    Qt,
     TaskThread,
     Util,
     Will,
-    WillItem,
     Willexecutors,
+    WillItem,
+    _,
+    _logger,
     char_width_in_lineedit,
     datetime,
     enum,
@@ -63,8 +63,8 @@ from .common import (
     import_meta_gui,
     is_op_return_address,
     partial,
-    read_QIcon_from_bytes,
     read_json_file,
+    read_QIcon_from_bytes,
     server_status_text,
     server_status_tooltip,
     signature_suffix,
@@ -663,11 +663,11 @@ class PreviewList(MyTreeView, MessageBoxMixin):
         menu.addAction(_("Prepare"), self.build_transactions)
         menu.addAction(_("Display"), self.bal_window.preview_modal_dialog)
         menu.addAction(_("Sign"), self.ask_password_and_sign_transactions)
-        export_menu = menu.addMenu(_("Export"))
+        # Export/Import open a single window that offers all transports
-        export_menu.addAction(_("All"), self.export_will)
+        # (file / QR / audio). The Choose Filter / transport settings live
-        export_menu.addAction(_("Valid"), self.export_will_valid)
+        # inside that window.
-        export_menu.addAction(_("Valid NC"), self.export_will_valid_incomplete)
+        menu.addAction(_("Export"), self.export_will)
-        menu.addAction(_("Import"), self.import_will_into_details)
+        menu.addAction(_("Import"), self.import_will)
         menu.addAction(_("Merge"), self.merge_will)
         menu.addAction(_("Broadcast"), self.broadcast)
         menu.addAction(_("Check"), self.check)
@@ -733,38 +733,11 @@ class PreviewList(MyTreeView, MessageBoxMixin):
         if will:
             self.update_will(will)
 
-    def export_json_file(self, path):
-        write_json_file(path, self.will)
-
     def export_will(self):
-        self.bal_window.export_will()
+        self.bal_window.export_will_dialog()
-        self.update()
 
-    def export_will_valid(self):
+    def import_will(self):
-        """Export only the will items that are valid."""
+        self.bal_window.import_will_dialog()
-        subset = {
-            wid: wi
-            for wid, wi in self.will.items()
-            if wi.get_status("VALID")
-        }
-        if not subset:
-            self.show_message(_("No valid will item to export"))
-            return
-        self.bal_window.export_will(will=subset)
-        self.update()
-
-    def export_will_valid_incomplete(self):
-        """Export only the will items that are valid but not yet fully signed (V-NC)."""
-        subset = {
-            wid: wi
-            for wid, wi in self.will.items()
-            if wi.get_status("VALID") and not wi.get_status("COMPLETE")
-        }
-        if not subset:
-            self.show_message(_("No valid, incomplete will item to export"))
-            return
-        self.bal_window.export_will(will=subset)
-        self.update()
 
     def import_will_into_details(self):
         self.bal_window.import_will_into_details()

bal/gui/qt/plugin.py

@@ -19,9 +19,8 @@ from electrum.plugin import hook
 from electrum.util import EventListener, event_listener
 from PyQt6.QtWidgets import QLayout
 
+from ...core.qrtransfer import CHUNK_PRESETS, preset_index_for_chunk_size
 from .common import (
-    _,
-    _logger,
     BalPlugin,
     Buttons,
     EnterButton,
@@ -38,6 +37,8 @@ from .common import (
     QWidget,
     UserCancelled,
     Willexecutors,
+    _,
+    _logger,
     add_widget,
     partial,
     read_QIcon_from_bytes,
@@ -531,6 +532,21 @@ class Plugin(BalPlugin, EventListener):
         # users (BASIC and ADVANCED).
         heir_auto_rebuild = BalCheckBox(self.AUTO_REBUILD)
 
+        # QR Code Size selector (will transfer via QR). A 4-standard-size combo
+        # bound to the QR_CHUNK_SIZE config (payload budget in bytes per frame).
+        # Ordered low -> high so the user picks the resolution matching their
+        # camera. Visible to all users (BASIC and ADVANCED).
+        qr_size_combo = QComboBox()
+        qr_size_combo.addItems([label for label, _budget in CHUNK_PRESETS])
+        qr_size_combo.setCurrentIndex(
+            preset_index_for_chunk_size(int(self.QR_CHUNK_SIZE.get()))
+        )
+
+        def on_qr_size_change(index):
+            self.QR_CHUNK_SIZE.set(CHUNK_PRESETS[index][1])
+
+        qr_size_combo.currentIndexChanged.connect(on_qr_size_change)
+
         # USER TYPE selector (SIMPLE / ADVANCED, global). A two-choice combo
         # (not a free-text field) bound to the USER_TYPE config:
         #   index 0 -> "BASIC"    -> stored value "basic"    (DEFAULT)
@@ -647,6 +663,10 @@ class Plugin(BalPlugin, EventListener):
                     widget.setCurrentIndex(
                         1 if str(cfg.default).lower() == "advanced" else 0
                     )
+                elif kind == "qr_size":
+                    widget.setCurrentIndex(
+                        preset_index_for_chunk_size(int(cfg.default))
+                    )
             btn.clicked.connect(reset)
             return btn
 
@@ -905,6 +925,25 @@ class Plugin(BalPlugin, EventListener):
         )
         grid.addWidget(reset_btn_auto_rebuild, 15, 3)
 
+        # "QR Code Size" row (always visible, BASIC + ADVANCED). Default QR
+        # size used when exporting a will via QR codes; changeable per export
+        # inside the export dialog itself.
+        lbl_qr_size = QLabel(_("QR Code Size"))
+        help_qr_size = HelpButton(
+            "Payload size of a single QR code when exporting a will via QR.\n\n"
+            "Larger QR codes hold more data (fewer shots) but are easier to "
+            "scan with a high-resolution camera; smaller QR codes scan fine "
+            "even with low-resolution cameras but require more shots.\n"
+            "The same selector is available inside the export dialog."
+        )
+        grid.addWidget(lbl_qr_size, 16, 0)
+        grid.addWidget(qr_size_combo, 16, 1)
+        grid.addWidget(help_qr_size, 16, 2)
+        reset_btn_qr_size = _make_reset_btn(
+            self.QR_CHUNK_SIZE, qr_size_combo, "qr_size"
+        )
+        grid.addWidget(reset_btn_qr_size, 16, 3)
+
         # ----------------------------------------------------------------- #
         # Group C / C4b: "Reset" button that restores the dialog settings to  #
         # their factory defaults. It only resets the settings exposed by THIS #
@@ -938,6 +977,7 @@ class Plugin(BalPlugin, EventListener):
                 (self.HISTORY_LABEL, edit_history_label, "line"),
                 (self.REBUILD_ON_CLOSE, heir_rebuild_on_close, "check"),
                 (self.AUTO_REBUILD, heir_auto_rebuild, "check"),
+                (self.QR_CHUNK_SIZE, qr_size_combo, "qr_size"),
             ]
             for cfg, widget, kind in resets:
                 # Persist the default value back into the Electrum config.
@@ -958,6 +998,10 @@ class Plugin(BalPlugin, EventListener):
                     widget.setCurrentIndex(
                         1 if str(cfg.default).lower() == "advanced" else 0
                     )
+                elif kind == "qr_size":
+                    widget.setCurrentIndex(
+                        preset_index_for_chunk_size(int(cfg.default))
+                    )
             # Re-sync the history-label field's enabled state after a reset: the
             # reset restores SAVE_HISTORY to its default, so the field must
             # follow the (default) checkbox state again.

bal/gui/qt/widgets.py

@@ -29,17 +29,15 @@ from ...core.input_rules import (
 from ...core.reminders import build_ics_reminders, write_temp_ics
 from .calendar import BalCalendar, BalCalendarButton
 from .common import (
-    _,
-    _logger,
-    Any,
-    BTCAmountEdit,
-    BalTimestamp,
-    ColorScheme,
     DECIMAL_POINT,
-    Decimal,
-    HelpButton,
     NLOCKTIME_BLOCKHEIGHT_MAX,
     NLOCKTIME_MAX,
+    Any,
+    BalTimestamp,
+    BTCAmountEdit,
+    ColorScheme,
+    Decimal,
+    HelpButton,
     Optional,
     QAbstractSpinBox,
     QCheckBox,
@@ -57,13 +55,15 @@ from .common import (
     QSpinBox,
     QStyle,
     QStyleOptionFrame,
+    Qt,
     QTextEdit,
     QVBoxLayout,
     QWidget,
-    Qt,
     Union,
     Util,
     Will,
+    _,
+    _logger,
     char_width_in_lineedit,
     datetime,
     getSaveFileName,

bal/gui/qt/window.py

@@ -25,8 +25,7 @@ from ...core.checkalive import (
     resolve_date_to_check,
 )
 from .common import (
-    _,
+    OP_RETURN_PREFIX,
-    _logger,
     AmountException,
     BalPlugin,
     Buttons,
@@ -40,10 +39,10 @@ from .common import (
     Mapping,
     Network,
     NoHeirsException,
-    NoWillExecutorNotPresent,
     NotCompleteWillException,
-    OP_RETURN_PREFIX,
+    NoWillExecutorNotPresent,
     OkButton,
+    Optional,
     PaymentIdentifier,
     QGridLayout,
     QLabel,
@@ -57,15 +56,17 @@ from .common import (
     TxFeesChangedException,
     Util,
     Will,
+    WillexecutorChangeException,
     WillExecutorFeeTooHighException,
     WillExecutorNotPresent,
+    Willexecutors,
     WillExpiredException,
     WillItem,
     WillPostponedException,
-    WillexecutorChangeException,
+    _,
-    Willexecutors,
+    _logger,
     char_width_in_lineedit,
-    copy,
+    copy_structure,
     export_meta_gui,
     import_meta_gui,
     is_onion_url,
@@ -73,8 +74,8 @@ from .common import (
     is_tor_active,
     log_error,
     partial,
-    read_QIcon_from_bytes,
     read_json_file,
+    read_QIcon_from_bytes,
     show_on_top,
     shown_cv,
     time,
@@ -88,6 +89,10 @@ from .dialogs import (
     BalWizardDialog,
     WillDetailDialog,
     WillExecutorDialog,
+    WillExportDialog,
+    WillImportDialog,
+    _complete_import,
+    decode_will_payload,
 )
 from .lists import HeirListWidget, PreviewList
 from .widgets import LockTimeWidget, PercAmountEdit
@@ -515,11 +520,11 @@ class BalWindow:
                     tx["my_locktime"] = txs[txid].my_locktime
                     tx["heirsvalue"] = txs[txid].heirsvalue
                     tx["description"] = txs[txid].description
-                    tx["willexecutor"] = copy.deepcopy(txs[txid].willexecutor)
+                    tx["willexecutor"] = copy_structure(txs[txid].willexecutor)
                     tx["status"] = _("New")
                     tx["baltx_fees"] = txs[txid].tx_fees
                     tx["time"] = creation_time
-                    tx["heirs"] = copy.deepcopy(txs[txid].heirs)
+                    tx["heirs"] = copy_structure(txs[txid].heirs)
                     tx["txchildren"] = []
                     will[txid] = WillItem(tx, _id=txid, wallet=self.wallet)
                 self.update_will(will)
@@ -980,6 +985,13 @@ class BalWindow:
         return self.show_transaction_real(tx, parent=parent)
 
     def invalidate_will(self, will=None):
+        # The reference timestamp is normally set by init_class_variables();
+        # fall back to "now" so a first-action invalidation always has it.
+        if not hasattr(self, "date_to_check") or self.date_to_check is None:
+            self.date_to_check = resolve_date_to_check(
+                self.bal_plugin.is_basic_mode(), self.will_settings
+            )
+
         def on_success(result):
             if result:
                 self.show_message(
@@ -1015,75 +1027,93 @@ class BalWindow:
         self.waiting_dialog.exe()
 
     def sign_transactions(self, password, will=None, txids=None):
-        try:
+            try:
-            willitems = will if will is not None else self.willitems
+                willitems = will if will is not None else self.willitems
-            txs = {}
+                txs = {}
-            signed = None
+                signed = None
-            tosign = None
+                tosign = None
 
-            def get_message():
+                def get_message():
-                msg = ""
+                    msg = ""
-                if signed:
+                    if signed:
-                    msg = _(f"signed: {signed}\n")
+                        msg = _(f"signed: {signed}\n")
-                return msg + _(f"signing: {tosign}")
+                    return msg + _(f"signing: {tosign}")
 
-            if txids is not None:
+                if txids is not None:
-                targets = [
+                    targets = [
-                    t for t in txids
+                        t for t in txids
-                    if t in willitems and willitems[t].get_status("VALID")
+                        if t in willitems and willitems[t].get_status("VALID")
-                ]
+                    ]
-            else:
+                else:
-                targets = Will.only_valid(willitems)
+                    targets = Will.only_valid(willitems)
-            for txid in targets:
+                for txid in targets:
-                wi = willitems[txid]
+                    wi = willitems[txid]
-                # Do NOT deepcopy: the stored tx carries wallet-derived objects
+                    if wi.get_status("COMPLETE"):
-                # (utxo / script_descriptor) that hold a threading.RLock, and
+                        # Already signed and complete: keep as-is (the single-tx
-                # copy.deepcopy raises "cannot pickle '_thread.RLock'".  Re-parse
+                        # helper short-circuits without touching the wallet).
-                # from the serialized form instead, which is exactly how the will
+                        tx, _ = self._prepare_and_sign_tx(willitems, txid, password)
-                # is persisted/loaded (WillItem.to_dict -> serialize -> tx_from_any).
+                        txs[txid] = tx
-                tx = Will.get_tx_from_any(str(wi.tx))
+                        continue
-                if wi.get_status("COMPLETE"):
+                    tosign = txid
+                    try:
+                        self.waiting_dialog.update(get_message())
+                    except Exception:
+                        pass
+                    tx, _signed = self._prepare_and_sign_tx(willitems, txid, password)
+                    signed = tosign
                     txs[txid] = tx
-                    continue
+            except Exception:
-                tosign = txid
+                return None
+            return txs
+
+    def _prepare_and_sign_tx(self, willitems, txid, password):
+        """Prepare one will transaction and sign it.
+
+        Shared by the batch signer (:meth:`sign_transactions`) and the
+        per-transaction review wizard of the QR import flow
+        (:class:`WillTxReviewSignDialog`).
+
+        Returns ``(tx, newly_signed)``: ``newly_signed`` is False when the
+        transaction was already COMPLETE (nothing was signed).
+        """
+        wi = willitems[txid]
+        # Do NOT deepcopy: the stored tx carries wallet-derived objects
+        # (utxo / script_descriptor) that hold a threading.RLock, and
+        # copy.deepcopy raises "cannot pickle '_thread.RLock'".  Re-parse
+        # from the serialized form instead, which is exactly how the will
+        # is persisted/loaded (WillItem.to_dict -> serialize -> tx_from_any).
+        tx = Will.get_tx_from_any(str(wi.tx))
+        if wi.get_status("COMPLETE"):
+            return tx, False
+        for txin in tx.inputs():
+            prevout = txin.prevout.to_json()
+            if prevout[0] in willitems:
+                change = willitems[prevout[0]].tx.outputs()[prevout[1]]
+                txin._trusted_value_sats = change.value
                 try:
-                    self.waiting_dialog.update(get_message())
+                    txin.script_descriptor = change.script_descriptor
                 except Exception:
                     pass
-                for txin in tx.inputs():
+                txin.is_mine = True
-                    prevout = txin.prevout.to_json()
+                txin._TxInput__address = change.address
-                    if prevout[0] in willitems:
+                txin._TxInput__scriptpubkey = change.scriptpubkey
-                        change = willitems[prevout[0]].tx.outputs()[prevout[1]]
+                txin._TxInput__value_sats = change.value
-                        txin._trusted_value_sats = change.value
+                txin._trusted_value_sats = change.value
-                        try:
-                            txin.script_descriptor = change.script_descriptor
-                        except Exception:
-                            pass
-                        txin.is_mine = True
-                        txin._TxInput__address = change.address
-                        txin._TxInput__scriptpubkey = change.scriptpubkey
-                        txin._TxInput__value_sats = change.value
 
-                self.wallet.sign_transaction(tx, password, ignore_warnings=True)
+        self.wallet.sign_transaction(tx, password, ignore_warnings=True)
-                signed = tosign
+        if tx.is_complete():
-                # is_complete = False
+            wi.set_status("COMPLETE", True)
-                if tx.is_complete():
+        # Refresh the per-item signature counts from the freshly signed
-                    # is_complete = True
+        # partial tx: at this point the signatures are still present
-                    wi.set_status("COMPLETE", True)
+        # (before any finalization), so the will list can show the real
-                # Refresh the per-item signature counts from the freshly signed
+        # "added/required" count (e.g. "1/2" for a multisig).
-                # partial tx: at this point the signatures are still present
+        try:
-                # (before any finalization), so the will list can show the real
+            have, required = tx.signature_count()
-                # "added/required" count (e.g. "1/2" for a multisig).
+            wi.sigs_have = int(have)
-                try:
+            wi.sigs_required = int(required)
-                    have, required = tx.signature_count()
+        except Exception as e:
-                    wi.sigs_have = int(have)
+            _logger.debug(f"signature_count after signing failed: {e}")
-                    wi.sigs_required = int(required)
+        return tx, True
-                except Exception as e:
-                    _logger.debug(f"signature_count after signing failed: {e}")
-                txs[txid] = tx
-        except Exception:
-            return None
-        return txs
 
     def get_wallet_password(self, message=None, parent=None):
         parent = self.window if not parent else parent
@@ -1611,6 +1641,19 @@ class BalWindow:
         else:
             write_json_file(path, {wid: wi.to_dict() for wid, wi in will.items()})
 
+    def export_tx_file(self, path, will=None):
+        """Export only the serialized transactions of the given will items.
+
+        Writes a plain text file with every transaction (or PSBT) serialized
+        on a single line, separated by a comma (``tx1,tx2,tx3``). The raw hex
+        and PSBT base64 alphabets never contain a comma, so the separator is
+        unambiguous. When ``will`` is omitted the live will items are used.
+        """
+        willitems = will if will is not None else self.willitems
+        serialized = ",".join(str(wi.tx) for wid, wi in willitems.items())
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(serialized)
+
     def export_will(self, will=None):
         try:
             export_meta_gui(
@@ -1620,6 +1663,73 @@ class BalWindow:
             self.show_error(str(e))
             raise e
 
+    def export_will_dialog(self, will=None, initial_mode: Optional[str] = None):
+        """Open the unified export window (File / QR / Audio).
+
+        The window lets the user pick an All / Valid / Valid NC filter in
+        the top row and choose one of the three transports, each with its
+        contextual settings (file format for File, QR-code size and autoplay
+        for QR, KB/sec for Audio). ``will`` defaults to the live will items;
+        ``initial_mode`` opens the window directly on the given transport.
+        """
+        try:
+            willitems = will if will is not None else self.willitems
+            d = WillExportDialog(
+                self,
+                will=willitems,
+                bal_plugin=self.bal_plugin,
+                initial_mode=initial_mode or "file",
+            )
+            show_on_top(d)
+        except Exception as e:
+            self.show_error(str(e))
+            raise e
+
+    def get_audio_modem_plugin(self):
+        """Return Electrum's ``audio_modem`` plugin instance, or None.
+
+        The plugin is only usable when Electrum exposes it (the ``Plugins``
+        manager knows the name) and its optional runtime dependency
+        ``amodem`` is installed (:meth:`is_available`). Every other case
+        returns None so callers can simply hide the audio buttons.
+        """
+        try:
+            p = self.window.gui_object.plugins.get("audio_modem")
+        except Exception:
+            return None
+        if not p or not getattr(p, "is_available", lambda: False)():
+            return None
+        return p
+
+    def _audio_send_payload(self, payload):
+        """Send a transfer payload through the audio_modem plugin.
+
+        Wraps the plugin's own ``_send`` with a proper parent widget. The
+        audio channel zlib-compresses internally, so the payload is passed
+        uncompressed (no BAL ``Z`` flag needed on that transport).
+        """
+        plugin = self.get_audio_modem_plugin()
+        if plugin is None:
+            self.show_error(_("Audio MODEM plugin is not available."))
+            return
+        plugin._send(parent=self.window, blob=payload)
+
+    def set_audio_modem_bitrate(self, kbps):
+        """Set the ``audio_modem`` plugin transfer speed to ``kbps`` KB/sec.
+
+        Both the send and the receive paths read ``modem_config``, so the
+        sender and the receiver must be configured with the same speed. Raises
+        when the plugin (or its ``amodem`` dependency) is unavailable.
+        """
+        plugin = self.get_audio_modem_plugin()
+        if plugin is None:
+            raise Exception(_("Audio MODEM plugin is not available."))
+        try:
+            import amodem.config
+        except Exception as e:
+            raise Exception(str(e)) from e
+        plugin.modem_config = amodem.config.bitrates[int(kbps)]
+
     def merge_will(self, imported):
         """Merge imported will items into the live will.
 
@@ -1743,16 +1853,34 @@ class BalWindow:
 
         def on_file(path):
             try:
-                willitems = self._load_will_file(path)
+                with open(path, "r", encoding="utf-8") as f:
+                    text = f.read()
             except Exception as e:
                 self.show_error(_("Invalid will file: {}").format(e))
                 return
-            # Attach wallet/input info so the imported txs can be signed and
+            kind, data = decode_will_payload(text)
-            # broadcast (mirrors what merge_will_from_file does).
+            try:
-            Will.normalize_will(willitems, self.wallet)
+                if kind == "will":
-            for wi in willitems.values():
+                    willitems = self._load_will_payload(data)
-                wi.set_status("IMPORTED", True)
+                    # Attach wallet/input info so the imported txs can be
-            imported.update(willitems)
+                    # signed and broadcast (mirrors merge_will_from_file).
+                    Will.normalize_will(willitems, self.wallet)
+                    for wi in willitems.values():
+                        wi.set_status("IMPORTED", True)
+                    imported.update(willitems)
+                else:
+                    # Serialized transactions: route through the shared import
+                    # tail (validity pass + review/sign wizard).
+                    _complete_import(
+                        self,
+                        self.bal_plugin,
+                        text,
+                        show_error=self.show_error,
+                        show_warning=self.show_warning,
+                        close=lambda: None,
+                    )
+            except Exception as e:
+                self.show_error(_("Invalid will file: {}").format(e))
 
         def on_success():
             if not imported:
@@ -1762,6 +1890,18 @@ class BalWindow:
 
         import_meta_gui(self.window, _("will"), on_file, on_success)
 
+    def import_will_dialog(self):
+        """Open the unified import window (File / QR / Audio).
+
+        The window offers three transports: File opens the read-only
+        :class:`WillDetailDialog` preview; QR and Audio capture the
+        transfer and send it through the per-transaction review wizard
+        (:class:`WillTxReviewSignDialog`). Every flow works on fresh
+        :class:`WillItem` objects and never touches the live will.
+        """
+        d = WillImportDialog(self, bal_plugin=self.bal_plugin)
+        show_on_top(d)
+
     def _load_will_file(self, path):
         data = read_json_file(path)
         willitems = {}
@@ -1770,6 +1910,15 @@ class BalWindow:
             willitems[k] = WillItem(data[k], _id=k)
         return willitems
 
+    def _load_will_payload(self, data):
+        """Build WillItems from decoded whole-will JSON data."""
+        willitems = {}
+        for k, v in data.items():
+            d = dict(v)
+            d["tx"] = tx_from_any(d["tx"])
+            willitems[k] = WillItem(d, _id=k)
+        return willitems
+
     def check_transactions_task(self, will):
         start = time.time()
         # Servers are now contacted in parallel (see

pyproject.toml

@@ -6,6 +6,9 @@ target-version = "py312"
 select =["E", "W", "F", "I", "N", "B"]
 ignore = ["E501"]
 
+[tool.ruff.lint.pep8-naming]
+classmethod-decorators = ["classmethod", "classproperty"]  # electrum.util.classproperty uses cls
+
 [tool.ruff.lint.per-file-ignores]
 "bal/gui/qt/common.py" = ["F401"]       # re-exports consumed via explicit imports
 "bal/gui/qt/dialogs.py" = ["N802"]      # Qt overrides: closeEvent/hideEvent/getText

tests/sim_update_flows.py

@@ -21,12 +21,12 @@ Run:
     QT_QPA_PLATFORM=offscreen PYTHONPATH=electrum-src python3 tests/sim_update_flows.py
 """
 
-import copy
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
 
+from bal.core.util import copy_structure
 from bal.core.will import (
     HeirNotFoundException,
     NoHeirsException,
@@ -58,7 +58,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
     is forced to ``tx_locktime`` (the value frozen in the signed Bitcoin tx)."""
     d = {
         "tx": _VALID_TX_HEX,
-        "heirs": copy.deepcopy(heirs),
+        "heirs": copy_structure(heirs),
         "willexecutor": None,
         "status": "",
         "description": "",
@@ -67,7 +67,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
         "baltx_fees": TX_FEES,
     }
     item = WillItem(d, _id="willid_1")
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     # Force the locktime frozen "inside" the signed tx.
     item.tx.locktime = tx_locktime
     if status_complete:
@@ -118,7 +118,7 @@ def main():
     # Scenario 0: nothing changed -> should be coherent.
     heirs = {"alice": ["addr_alice", 5000, same_lt]}
     _run("0. nothing changed",
-         will_heirs=heirs, current_heirs=copy.deepcopy(heirs),
+         will_heirs=heirs, current_heirs=copy_structure(heirs),
          tx_locktime=base_lt, check_date=0)
 
     # Scenario 1: delivery date moved forward (postpone), will NOT yet signed.

tests/test_anticipate_manual_locktime.py

@@ -27,7 +27,6 @@ Run:
         tests/test_anticipate_manual_locktime.py -q
 """
 
-import copy
 import os
 import sys
 
@@ -35,6 +34,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
 
 import pytest  # noqa: E402  # pyright: ignore[reportMissingImports]
 
+from bal.core.util import copy_structure  # noqa: E402
 from bal.core.will import (  # noqa: E402
     NotCompleteWillException,
     Will,
@@ -70,7 +70,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
     """
     d = {
         "tx": _VALID_TX_HEX,
-        "heirs": copy.deepcopy(heirs),
+        "heirs": copy_structure(heirs),
         "willexecutor": None,
         "status": "",
         "description": "",
@@ -79,7 +79,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
         "baltx_fees": TX_FEES,
     }
     item = WillItem(d, _id="willid_1")
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     item.tx.locktime = tx_locktime
     if status_complete:
         item.set_status("COMPLETE", True)

tests/test_core_animated_qr.py

@@ -0,0 +1,478 @@
+"""
+Tests for ``bal.core.animated_qr`` (BC-UR v1, BC-UR v2, BBQR interop).
+
+Validates the self-contained codecs against the published spec vectors
+(BCR-2020-004/005 BC32, BCR-2020-012 bytewords) and against byte-exact
+output captured from the reference C++ bc-ur encoder (fountain/xoshiro/
+alias-sampler parity), plus round trips, out-of-order assembly, missing-part
+fountain solving and malformed-input rejection for all four formats.
+
+Run:
+    source electrum/env/bin/activate
+    python3 tests/test_core_animated_qr.py
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
+
+import random
+
+from bal.core import animated_qr as aq
+
+
+def _payload(plen: int) -> bytes:
+    """Deterministic payload matching the C++ reference driver (``(i*7)&0xff``)."""
+    return bytes((i * 7) & 0xFF for i in range(plen))
+
+
+# --------------------------------------------------------------------------- #
+# BC32 (BCR-2020-004 / bcr-2020-005 rev1 reference implementation vectors)
+# --------------------------------------------------------------------------- #
+
+
+def test_bc32_official_vectors():
+    cases = [
+        (b"Hello, world", "fpjkcmr09ss8wmmjd3jq6ax7w9"),
+        (b"Hello world", "fpjkcmr0ypmk7unvvsh4ra4j"),
+        (
+            bytes.fromhex("d934063e82001eec0585ee41ab5d8e4b703a4be1f73aec21e143912c56"),
+            "my6qv05zqq0wcpv9aeq6khvwfdcr5jlp7uawcg0pgwgjc4shjm6xu",
+        ),
+    ]
+    for payload, encoded in cases:
+        assert aq.bc32_encode(payload) == encoded
+        assert aq.bc32_decode(encoded) == payload
+
+
+def test_bc32_checksum_rejected():
+    good = aq.bc32_encode(b"Hello, world")
+    corrupted = good[:-1] + ("a" if good[-1] != "a" else "b")
+    try:
+        aq.bc32_decode(corrupted)
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for corrupted BC32")
+
+
+def test_bc32_bad_char_rejected():
+    try:
+        aq.bc32_decode("1" * 26)
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for '1' (not in alphabet)")
+
+
+# --------------------------------------------------------------------------- #
+# Bytewords (BCR-2020-012)
+# --------------------------------------------------------------------------- #
+
+
+def test_bytewords_minimal_roundtrip():
+    samples = [bytes(range(256)), _payload(59), b"\x00"] + [
+        os.urandom(64) for _ in range(4)
+    ]
+    for data in samples:
+        words = aq.bytewords_minimal_encode(data)
+        assert len(words) == (len(data) + 4) * 2  # 2 chars per byte incl. CRC
+        assert aq.bytewords_minimal_decode(words) == data
+
+
+def test_bytewords_rejects_corrupted_crc():
+    data = _payload(40)
+    words = aq.bytewords_minimal_encode(data)
+    flip = "a" if words[-1] != "a" else "b"
+    try:
+        aq.bytewords_minimal_decode(words[:-1] + flip)
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for corrupted CRC")
+
+
+def test_bytewords_rejects_odd_length():
+    try:
+        aq.bytewords_minimal_decode("abc")
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for odd-length bytewords")
+
+
+# --------------------------------------------------------------------------- #
+# BC-UR v2: byte-exact parity with the reference C++ encoder
+# --------------------------------------------------------------------------- #
+
+# Reference frames from the bc-ur C++ fountain encoder
+# (payload x=(i*7)&0xFF, cbor wrapped, single-part and multipart).
+REF_V2_SINGLE_12 = "ur:bytes/gsaeatbabzcecndrehetfhfggtoeemhpmo"
+
+REF_V2_MULTI_59 = [
+    "ur:bytes/2-2/lpaoaocsfscyrpdpjzbyhdctsbtdtavtvdwyykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtaeeccasket",
+    "ur:bytes/3-2/lpaxaocsfscyrpdpjzbyhdcthdfraeatbabzcecndrehetfhfggtghhpidinjoktkblplkmunyoypdperpryssimryrldt",
+    "ur:bytes/4-2/lpaaaocsfscyrpdpjzbyhdctsbtdtavtvdwyykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtaefeimteue",
+    "ur:bytes/5-2/lpahaocsfscyrpdpjzbyhdctmuwltavdwlzowlurdtfrdtdihkjekkjlhkdnesdidtuywlzmwluydtdiesdnssgdaontls",
+    "ur:bytes/6-2/lpamaocsfscyrpdpjzbyhdctmuwltavdwlzowlurdtfrdtdihkjekkjlhkdnesdidtuywlzmwluydtdiesdnssisescmwt",
+    "ur:bytes/7-2/lpataocsfscyrpdpjzbyhdcthdfraeatbabzcecndrehetfhfggtghhpidinjoktkblplkmunyoypdperprysslsspplgm",
+    "ur:bytes/8-2/lpayaocsfscyrpdpjzbyhdctsbtdtavtvdwyykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtaeonlrzebg",
+    "ur:bytes/9-2/lpasaocsfscyrpdpjzbyhdctsbtdtavtvdwyykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtaeaaryknzt",
+    "ur:bytes/10-2/lpbkaocsfscyrpdpjzbyhdctmuwltavdwlzowlurdtfrdtdihkjekkjlhkdnesdidtuywlzmwluydtdiesdnsslotsfrfn",
+    "ur:bytes/11-2/lpbdaocsfscyrpdpjzbyhdctmuwltavdwlzowlurdtfrdtdihkjekkjlhkdnesdidtuywlzmwluydtdiesdnssdtwyrstd",
+    "ur:bytes/12-2/lpbnaocsfscyrpdpjzbyhdctsbtdtavtvdwyykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtaegswnvdin",
+    "ur:bytes/13-2/lpbtaocsfscyrpdpjzbyhdctmuwltavdwlzowlurdtfrdtdihkjekkjlhkdnesdidtuywlzmwluydtdiesdnsshknlptee",
+]
+
+# Reference message for the 59-byte payload: byte-string head (0x58,0x3b) + data.
+REF_V2_MULTI_59_MSG = bytes([0x58, 0x3B]) + _payload(59)
+
+
+def test_v2_single_part_matches_reference():
+    frames = aq.ur2_frames(_payload(12), len(REF_V2_SINGLE_12))
+    assert frames == [REF_V2_SINGLE_12]
+
+
+def test_v2_reference_frames_decode_and_reencode_exactly():
+    message = REF_V2_MULTI_59_MSG
+    fragment_len = -(-len(message) // 2)
+    for frame in REF_V2_MULTI_59:
+        seq, seq_len, message_len, checksum, data = aq.ur2_parse_part(frame)
+        assert seq_len == 2
+        assert message_len == len(message)
+        assert checksum == aq.crc32_int(message)
+        assert len(data) == fragment_len
+        # re-encoding the parsed values reproduces the reference line exactly
+        assert aq._ur2_part_string(seq, seq_len, message_len, checksum, data) == frame
+        # our choose_fragments + partition + xor reproduces the reference data
+        indexes = aq.choose_fragments(seq, seq_len, checksum)
+        assert seq_num_indexes_valid(seq, seq_len, indexes)
+        mixed = aq._mix_fragments(aq._partition_message(message, fragment_len), indexes, fragment_len)
+        assert mixed == data
+
+
+def seq_num_indexes_valid(seq, seq_len, indexes):
+    # pure part for seq <= seq_len contains exactly fragment seq-1
+    if seq <= seq_len:
+        return indexes == {seq - 1}
+    return set(indexes) <= set(range(seq_len)) and bool(indexes)
+
+
+def test_v2_multipart_encoder_matches_reference_from_seq2():
+    # Our frames start at seq 1 (spec-aligned); parts seq 2.. must equal the
+    # reference (which starts at seq 2 due to first_seq_num=1).
+    mine = aq.ur2_frames(_payload(59), 120)
+    assert mine[0].split("/", 1)[1].startswith("1-2") or "1-2" in mine[0].split("/")[1]
+    assert mine[1:4] == REF_V2_MULTI_59[:3]
+
+
+def test_v2_reference_seq7_mix_parity():
+    # Higher-degree mixed parts (seq_len=7) also match: message uses the
+    # reference head 0x58|0x00 for the 256-byte driver payload.
+    message = bytes([0x58, 0x00]) + _payload(256)
+    seq_len = 7
+    fragment_len = -(-len(message) // seq_len)
+    frames = [
+        "ur:bytes/9-7/lpasatcfadaocyfysnjlsrhddaykztaxbkbycsctdsdpeefrfwgagdhghyihjzjkknlylomymtntoxpyprrhrtsttotluovlwdwnsrfejzhd",
+        "ur:bytes/10-7/lpbkatcfadaocyfysnjlsrhddazeahbnbwcycldedlenfsfygrgmhkhniojtkpkelslememkneolpmqzrksasotitsuevwwpwfzswzpmdrvo",
+        "ur:bytes/11-7/lpbdatcfadaocyfysnjlsrhddawkwtbbbefnaefnbebbjojybebnaebndybbbewkwtceaecedyeebebbjobnaebnbeeedybbbeztwproyapd",
+    ]
+    for frame in frames:
+        seq, sl, mlen, checksum, data = aq.ur2_parse_part(frame)
+        assert sl == seq_len and mlen == len(message)
+        assert checksum == aq.crc32_int(message)
+        mixed = aq._mix_fragments(
+            aq._partition_message(message, fragment_len),
+            aq.choose_fragments(seq, seq_len, checksum),
+            fragment_len,
+        )
+        assert mixed == data
+
+
+# --------------------------------------------------------------------------- #
+# BC-UR v2: sessions / fountain decoding
+# --------------------------------------------------------------------------- #
+
+
+def test_v2_roundtrip_in_order():
+    payload = ("BAL transfer " * 9).encode()
+    frames = aq.ur2_frames(payload, 120)
+    seq_len = int(frames[0].split("/")[1].split("-")[1])
+    assert len(frames) == 2 * seq_len  # pure wave + redundant mixed wave
+    session = aq.AnimatedQrSession()
+    for frame in frames:
+        session.add_part(frame)
+    assert session.done
+    assert session.received == session.total
+    text, _ = session.resolve()
+    assert text == payload.decode()
+
+
+def test_v2_out_of_order_and_duplicate():
+    payload = ("BAL transfer " * 9).encode()
+    frames = aq.ur2_frames(payload, 120)
+    order = list(range(len(frames)))
+    random.Random(11).shuffle(order)
+    session = aq.AnimatedQrSession()
+    for i in order:
+        status = session.add_part(frames[i])
+        assert status in ("ok", "dup")
+    session.add_part(frames[0])  # duplicate of an already-received part
+    assert session.done
+    assert session.resolve()[0] == payload.decode()
+
+
+def test_v2_solves_without_a_pure_fragment():
+    payload = ("BAL transfer " * 9).encode()
+    frames = aq.ur2_frames(payload, 120)
+    session = aq.AnimatedQrSession()
+    for frame in frames[1:]:  # drop the first pure fragment
+        session.add_part(frame)
+    assert session.done
+    assert session.resolve()[0] == payload.decode()
+
+
+def test_v2_single_part_import():
+    session = aq.AnimatedQrSession()
+    session.add_part(REF_V2_SINGLE_12)
+    assert session.done and session.total == 1
+    assert session.resolve()[0] == _payload(12).decode("latin-1")
+
+
+def test_v2_conflicting_transfer_rejected():
+    payload_a = b"AAAAAAAAAAAAAAAA"
+    payload_b = b"BBBBBBBBBBBBBBBB"
+    fa = aq.ur2_frames(payload_a, 500)[0]
+    fb = aq.ur2_frames(payload_b, 500)[0]
+    session = aq.AnimatedQrSession()
+    session.add_part(fa)
+    try:
+        session.add_part(fb)
+    except aq.TransferConflictError:
+        pass
+    else:
+        raise AssertionError("expected TransferConflictError for a different transfer")
+
+
+def test_v2_corrupt_crc_rejected():
+    frame = list(REF_V2_MULTI_59[0])
+    idx = len(frame) - 1
+    frame[idx] = "a" if frame[idx] != "a" else "b"
+    try:
+        aq.ur2_parse_part("".join(frame))
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for a corrupt v2 part")
+
+
+def test_v2_session_cap_rejected():
+    part = aq._ur2_part_string(1, 30000, 100, 1234, b"\x00" * 100)
+    session = aq._Ur2Session()
+    try:
+        session.add(part)
+    except aq.SessionLimitError:
+        pass
+    else:
+        raise AssertionError("expected SessionLimitError for oversized seq_len")
+
+
+# --------------------------------------------------------------------------- #
+# BC-UR v1
+# --------------------------------------------------------------------------- #
+
+
+def test_v1_multipart_roundtrip():
+    payload = ("v1 transfer payload " * 6).encode()
+    frames = aq.ur1_frames(payload, 120)
+    assert len(frames) > 1
+    session = aq.AnimatedQrSession()
+    for frame in reversed(frames):
+        session.add_part(frame)
+    assert session.done
+    assert session.resolve()[0] == payload.decode()
+
+
+def test_v1_single_part_roundtrip():
+    payload = b"hello, bal"
+    frames = aq.ur1_frames(payload, 400)
+    assert len(frames) == 1
+    session = aq.AnimatedQrSession()
+    session.add_part(frames[0])
+    assert session.done and session.total == 1
+    assert session.resolve()[0] == payload.decode()
+
+
+def test_v1_headerless_single_part_import():
+    # bcr-2020-005 rev1 allows omitting the sequence header + digest entirely.
+    payload = b"hello, bal"
+    message = aq.cbor_byte_string(payload)
+    single = "ur:bytes/" + aq.bc32_encode(message)
+    assert aq.detect_format(single) == "ur1"
+    session = aq.AnimatedQrSession()
+    session.add_part(single)
+    assert session.done
+    assert session.resolve()[0] == payload.decode()
+
+
+def test_v1_digest_mismatch_rejected():
+    frame = aq.ur1_frames(b"hello, bal", 400)[0]
+    tampered = frame[:-4] + "abcd"
+    session = aq.AnimatedQrSession()
+    session.add_part(tampered)
+    try:
+        session.resolve()
+    except aq.ChecksumError:
+        pass
+    else:
+        raise AssertionError("expected ChecksumError for a tampered v1 digest")
+
+
+def test_v1_part_numbers_validated():
+    for bad in (
+        "ur:bytes/0of1/{}full".format("x" * 51),
+        "ur:bytes/2of1/{}full".format("x" * 51),
+        "ur:bytes/1of0/{}full".format("x" * 51),
+        "ur:bytes/1aof1/{}full".format("x" * 51),
+    ):
+        try:
+            aq.ur1_parse_part(bad)
+        except aq.AnimatedQrError:
+            pass
+        else:
+            raise AssertionError("expected AnimatedQrError for: {}".format(bad))
+
+
+# --------------------------------------------------------------------------- #
+# BBQR
+# --------------------------------------------------------------------------- #
+
+
+def test_bbqr_all_encodings_roundtrip():
+    payload = ("BBQR payload " * 8).encode()
+    for encoding in ("Z", "2", "H"):
+        frames = aq.bbqr_frames(payload, 90, encoding=encoding)
+        assert len(frames) >= 1
+        order = list(range(len(frames)))
+        random.Random(3).shuffle(order)
+        session = aq.AnimatedQrSession()
+        for i in order:
+            session.add_part(frames[i])
+        assert session.done
+        assert session.resolve()[0] == payload.decode()
+
+
+def test_bbqr_compression_default_and_fallback():
+    payload = ("repetitive data " * 40).encode()  # compresses well
+    frames_z = aq.bbqr_frames(payload, 90, encoding="Z")
+    # Highly compressible: Z yields one frame and a 'Z' flag.
+    assert all(f[2] == "Z" for f in frames_z)
+    assert len(frames_z) == 1
+    raw = os.urandom(600)  # incompressible
+    frames_2 = aq.bbqr_frames(raw, 90, encoding="Z")
+    assert all(f[2] == "2" for f in frames_2)  # Z loses, '2' is used
+
+
+def test_bbqr_hex_uppercase():
+    payload = b"\xde\xad\xbe\xef"
+    frame = aq.bbqr_frames(payload, 50, encoding="H")[0]
+    assert "DEADBEEF" in frame
+    encoding, _type, total, index, frag = aq.bbqr_parse_part(frame)
+    assert (encoding, total, index) == ("H", 1, 0)
+
+
+def test_bbqr_runt_last_part():
+    payload = os.urandom(33)
+    frames = aq.bbqr_frames(payload, 60, encoding="2")
+    parts = [aq.bbqr_parse_part(f)[4] for f in frames]
+    joined = aq._bbqr_decode(parts, "2")
+    assert joined == payload
+    assert len(parts[-1]) < len(parts[0])  # last part is a runt
+
+
+def test_bbqr_zlib_bomb_rejected():
+    compressed = aq._bbqr_encode(b"\x00" * 1000000, "Z")[1]
+    try:
+        aq._bbqr_decode(["0" * len(compressed)], "2")  # not zlib data
+    except aq.AnimatedQrError:
+        pass
+    # direct inflate bomb guard:
+    inflated = aq._bbqr_encode(b"\x00" * 1000000, "Z")
+    assert inflated[0] == "Z"  # 1MB zeros compresses
+    bomb = aq._bbqr_encode(b"\x00" * (aq._MAX_MESSAGE_BYTES + 100), "Z")[1]
+    parts = [bomb[i : i + 90] for i in range(0, len(bomb), 90)]
+    try:
+        aq._bbqr_decode(parts, "Z")
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for an oversized decompression")
+
+
+def test_bbqr_part_number_limits():
+    try:
+        aq.bbqr_frames(os.urandom(30000), 40, encoding="2")
+    except aq.AnimatedQrError:
+        pass
+    else:
+        raise AssertionError("expected AnimatedQrError for too many BBQR parts")
+
+
+# --------------------------------------------------------------------------- #
+# Detection / parse_for_detection
+# --------------------------------------------------------------------------- #
+
+
+def test_detect_format_recognises_all_formats():
+    assert aq.detect_format("BALQR1|1|1||payload") == "balqr"
+    assert aq.detect_format(aq.ur1_frames(b"x", 400)[0]) == "ur1"
+    assert aq.detect_format(aq.ur2_frames(b"x", 400)[0]) == "ur2"
+    assert aq.detect_format(aq.bbqr_frames(b"x", 50)[0]) == "bbqr"
+    assert aq.detect_format(REF_V2_SINGLE_12) == "ur2"
+    assert aq.detect_format("ur:bytes/" + aq.bc32_encode(aq.cbor_byte_string(b"x"))) == "ur1"
+
+
+def test_detect_format_rejects_garbage():
+    for text in ("", "hello world", "BALQ|1|1||a", "ur:", "ur:txn/xyz"):
+        assert aq.detect_format(text) is None, text
+    # Lenient prefix probe: a string that merely *starts* with "balqr" is
+    # reported as balqr (the strict parse then rejects it downstream).
+    assert aq.detect_format("BALQRX|1|1||a") == "balqr"
+
+
+def test_parse_for_detection_keys():
+    bal = aq.parse_for_detection("BALQR1|3|2||payload")
+    assert bal == ("balqr", "balqr:3", 3, 2)
+    v2 = aq.parse_for_detection(aq.ur2_frames(b"x"*50, 400)[0])
+    assert v2[0] == "ur2" and v2[2] == 1 and v2[3] == 1
+    v1 = aq.parse_for_detection(aq.ur1_frames(b"x"*50, 120)[0])
+    assert v1[0] == "ur1" and v1[2] > 1 and 1 <= v1[3] <= v1[2]
+    bb = aq.parse_for_detection(aq.bbqr_frames(b"x"*50, 40)[0])
+    assert bb[0] == "bbqr" and bb[2] >= 1 and 0 <= bb[3] < bb[2]
+
+
+def test_format_names_exist():
+    for fmt in ("balqr", "ur1", "ur2", "bbqr"):
+        assert aq.format_name(fmt)
+    assert aq.format_name("nope") == "nope"
+
+
+# --------------------------------------------------------------------------- #
+if __name__ == "__main__":
+    import traceback
+
+    failures = 0
+    for _name, fn in sorted(globals().items()):
+        if _name.startswith("test_") and callable(fn):
+            try:
+                fn()
+                print("ok: {}".format(_name))
+            except Exception:
+                failures += 1
+                print("FAIL: {}".format(_name))
+                traceback.print_exc()
+    if failures:
+        print("{} test(s) failed".format(failures))
+        sys.exit(1)
+    print("all tests passed")

tests/test_core_plugin_base.py

@@ -14,7 +14,7 @@ import time
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
 
-from datetime import date, datetime, timedelta
+from datetime import date, datetime, timedelta, timezone
 
 from bal.core.plugin_base import BalConfig, BalPlugin, BalTimestamp
 
@@ -74,7 +74,7 @@ def test_bt_to_date_absolute():
 
 
 def test_bt_to_date_relative():
-    now = datetime.now()
+    now = datetime.now(timezone.utc)
 
     # relative days from now
     bt = BalTimestamp("7d")
@@ -86,8 +86,8 @@ def test_bt_to_date_relative():
     d_rev = bt.to_date(reverse=True)
     assert d_rev < now
 
-    # from explicit datetime
+    # from explicit datetime (UTC, so the naive-timestamp roundtrip below is stable)
-    base = datetime(2025, 6, 1, 12, 0, 0)
+    base = datetime(2025, 6, 1, 12, 0, 0, tzinfo=timezone.utc)
     d = bt.to_date(from_date=base)
     expected = (base + timedelta(days=7)).replace(hour=0, minute=0, second=0, microsecond=0)
     assert d == expected
@@ -101,7 +101,7 @@ def test_bt_to_date_relative():
 def test_bt_to_date_years():
     bt = BalTimestamp("1y")
     d = bt.to_date()
-    assert d > datetime.now()
+    assert d > datetime.now(timezone.utc)
 
 
 def test_bt_to_date_overflow():

tests/test_core_qr_transfer.py

@@ -0,0 +1,326 @@
+"""
+Tests for ``bal.core.qrtransfer``.
+
+Covers the BALQR frame encoding used for will transfer via QR codes /
+audio modem: encoding, framing, reassembly, malformed input and the preset
+list (optionally cross-checked against the ``qrcode`` library's EC-M
+capacity when it is installed).
+
+Run:
+    source electrum/env/bin/activate
+    python3 tests/test_core_qr_transfer.py
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
+
+from bal.core.qrtransfer import (
+    CHUNK_PRESETS,
+    MIN_CHUNK_SIZE,
+    InconsistentTotalError,
+    MissingFramesError,
+    QrTransferError,
+    assemble,
+    decode_transfer,
+    encode_transfer,
+    parse_frame,
+    preset_index_for_chunk_size,
+    split_frames,
+)
+
+
+def _frames(tx_strings, chunk_size, compress=False):
+    """Split a payload and return (payload, total, {index: payload})."""
+    payload = encode_transfer(tx_strings, compress=compress)
+    parsed = {}
+    total = None
+    for frame in split_frames(payload, chunk_size, compressed=compress):
+        t, index, _compressed, p = parse_frame(frame)
+        if total is not None:
+            assert total == t
+        total = t
+        parsed[index] = p
+    assert total is not None
+    return payload, total, parsed
+
+
+# --------------------------------------------------------------------------- #
+# Round trips
+# --------------------------------------------------------------------------- #
+
+
+def test_encode_decode_plain():
+    tx_strings = ["00" * 32, "aa" * 40, "ff" * 50]
+    payload = encode_transfer(tx_strings, compress=False)
+    assert decode_transfer(payload, compressed=False) == tx_strings
+
+
+def test_encode_decode_compressed():
+    tx_strings = ["00" * 32, "aa" * 40, "ff" * 50]
+    payload = encode_transfer(tx_strings, compress=True)
+    assert decode_transfer(payload, compressed=True) == tx_strings
+
+
+def test_empty_list_roundtrip():
+    assert decode_transfer(encode_transfer([]), compressed=False) == []
+
+
+# --------------------------------------------------------------------------- #
+# Framing
+# --------------------------------------------------------------------------- #
+
+
+def test_single_frame():
+    tx_strings = ["11" * 10]
+    payload = encode_transfer(tx_strings)
+    frames = split_frames(payload, 150)
+    assert len(frames) == 1
+    total, index, compressed, p = parse_frame(frames[0])
+    assert (total, index, compressed) == (1, 1, False)
+    assert p == payload
+
+
+def test_multiple_frames_reassemble():
+    tx_strings = ["ab" * 100, "cd" * 100]  # 600 chars -> multiple frames
+    _payload, total, parsed = _frames(tx_strings, CHUNK_PRESETS[0][1])
+    assert total > 1
+    decoded = decode_transfer(assemble(parsed, total), compressed=False)
+    assert decoded == tx_strings
+
+
+def test_size_greater_than_payload():
+    tx_strings = ["12" * 5]
+    payload = encode_transfer(tx_strings)
+    frames = split_frames(payload, 1800)
+    assert len(frames) == 1
+    _t, _i, _c, p = parse_frame(frames[0])
+    assert p == payload
+
+
+def test_exact_single_frame_boundary():
+    # A 138-byte payload exactly fills the 150-byte preset budget (the 12-char
+    # empty-flags header plus payload), so the encoded frame is exactly 150.
+    tx_strings = ["a" * 138]
+    payload = encode_transfer(tx_strings)
+    frames = split_frames(payload, 150)
+    assert len(frames) == 1
+    assert len(frames[0]) == 150
+    _t, _i, _c, p = parse_frame(frames[0])
+    assert p == payload
+
+
+def test_frames_fit_chunk_size():
+    tx_strings = ["".join("{:02x}".format(i) * 2) for i in range(300)]
+    payload = encode_transfer(tx_strings)
+    for _label, size in CHUNK_PRESETS:
+        for frame in split_frames(payload, size):
+            assert len(frame) <= size, (size, len(frame))
+
+
+def test_single_tx_larger_than_chunk():
+    # A huge serialized tx must be split over several frames and reassemble
+    # exactly (positional slicing is safe for hex/base64 text).
+    tx_strings = ["7b" * 1000]  # 2000 chars
+    payload = encode_transfer(tx_strings)
+    frames = split_frames(payload, 150)
+    assert len(frames) > 1
+    parsed = {parse_frame(f)[1]: parse_frame(f)[3] for f in frames}
+    total = parse_frame(frames[0])[0]
+    assert assemble(parsed, total) == payload
+
+
+def test_compressed_frames_carry_flag():
+    tx_strings = ["ab" * 40]
+    frames = split_frames(encode_transfer(tx_strings, compress=True), 150, compressed=True)
+    for frame in frames:
+        _t, _i, compressed, _p = parse_frame(frame)
+        assert compressed is True
+    # Plain frames do not.
+    frames_plain = split_frames(encode_transfer(tx_strings), 150)
+    _t, _i, compressed, _p = parse_frame(frames_plain[0])
+    assert compressed is False
+
+
+def test_compressed_roundtrip_through_frames():
+    tx_strings = ["ab" * 50, "cd" * 50, "12" * 60]
+    payload = encode_transfer(tx_strings, compress=True)
+    parsed = {}
+    total = None
+    for frame in split_frames(payload, 400, compressed=True):
+        t, index, _c, p = parse_frame(frame)
+        total = t
+        parsed[index] = p
+    assert total is not None
+    decoded = decode_transfer(assemble(parsed, total), compressed=True)
+    assert decoded == tx_strings
+
+
+# --------------------------------------------------------------------------- #
+# Malformed input
+# --------------------------------------------------------------------------- #
+
+
+def test_parse_bad_magic_and_version():
+    for frame in (
+        "BALQR|1|1||a",  # missing version
+        "BALQR2|1|1||a",  # unknown version
+        "XXXXX1|1|1||a",  # unknown magic
+    ):
+        try:
+            parse_frame(frame)
+        except QrTransferError:
+            pass
+        else:
+            raise AssertionError("expected QrTransferError for: {}".format(frame))
+
+
+def test_parse_bad_arity():
+    for frame in ("BALQR1", "BALQR1|1|1|"):
+        try:
+            parse_frame(frame)
+        except QrTransferError:
+            pass
+        else:
+            raise AssertionError("expected QrTransferError for: {}".format(frame))
+
+
+def test_parse_pipe_in_payload_is_folded():
+    # maxsplit keeps the tail (including any inner '|') in the payload part.
+    frame = "BALQR1|1|1||a|b|c"
+    total, index, compressed, payload = parse_frame(frame)
+    assert (total, index, compressed) == (1, 1, False)
+    assert payload == "a|b|c"
+
+
+def test_parse_bad_numbers():
+    for frame in (
+        "BALQR1|x|1||a",
+        "BALQR1|1|y||a",
+        "BALQR1|0|1||a",
+        "BALQR1|1|0||a",
+        "BALQR1|1|2||a",  # index beyond total
+        "BALQR1|-1|1||a",
+    ):
+        try:
+            parse_frame(frame)
+        except QrTransferError:
+            pass
+        else:
+            raise AssertionError("expected QrTransferError for: {}".format(frame))
+
+
+def test_parse_bad_flags():
+    try:
+        parse_frame("BALQR1|1|1|Q|payload")
+    except QrTransferError:
+        pass
+    else:
+        raise AssertionError("expected QrTransferError for unknown flags")
+
+
+def test_assemble_missing_frames():
+    try:
+        assemble({1: "a", 3: "c"}, total=3)
+    except MissingFramesError as e:
+        assert e.missing == [2]
+    else:
+        raise AssertionError("expected MissingFramesError")
+
+
+def test_assemble_index_beyond_total():
+    try:
+        assemble({1: "a", 2: "b"}, total=1)
+    except InconsistentTotalError:
+        pass
+    else:
+        raise AssertionError("expected InconsistentTotalError")
+
+
+def test_assemble_order_and_total_validation():
+    assert assemble({1: "a", 2: "b"}, total=2) == "ab"
+    try:
+        assemble({}, total=0)
+    except QrTransferError:
+        pass
+    else:
+        raise AssertionError("expected QrTransferError")
+
+
+# --------------------------------------------------------------------------- #
+# Constants / presets
+# --------------------------------------------------------------------------- #
+
+
+def test_preset_count_and_order():
+    assert len(CHUNK_PRESETS) == 4
+    budgets = [budget for _label, budget in CHUNK_PRESETS]
+    assert budgets == sorted(budgets)
+
+
+def test_preset_index_for_chunk_size():
+    for index, (_label, budget) in enumerate(CHUNK_PRESETS):
+        assert preset_index_for_chunk_size(budget) == index
+    assert preset_index_for_chunk_size(150) == 0
+    assert preset_index_for_chunk_size(1800) == 3
+
+
+def test_min_chunk_size_guard():
+    try:
+        split_frames("x" * 10, MIN_CHUNK_SIZE - 1)
+    except QrTransferError:
+        pass
+    else:
+        raise AssertionError("expected QrTransferError for tiny chunk size")
+
+
+def test_split_frame_headers_consistent():
+    tx_strings = ["ab" * 80]
+    payload = encode_transfer(tx_strings)
+    frames = split_frames(payload, 150)
+    totals = {parse_frame(frame)[0] for frame in frames}
+    assert len(totals) == 1
+    assert totals.pop() == len(frames)
+
+
+# --------------------------------------------------------------------------- #
+# Optional: cross-check presets against the qrcode library (EC level M)
+# --------------------------------------------------------------------------- #
+
+
+def test_presets_fit_qrcode_ec_m():
+    """Every preset budget must render inside a QR at EC level M."""
+    try:
+        import qrcode
+        from qrcode.constants import ERROR_CORRECT_M
+    except ImportError:
+        print("qrcode not installed - skipping capacity check")
+        return
+    for _label, size in CHUNK_PRESETS:
+        # Worst-case frame: header with the largest plausible total/index plus
+        # a full payload of the preset budget.
+        frame = "BALQR1|9999|9999|Z|" + "a" * (size - 14)
+        qr = qrcode.QRCode(error_correction=ERROR_CORRECT_M, border=2)
+        qr.add_data(frame)
+        qr.get_matrix()  # raises DataOverflowError if it does not fit
+
+
+# --------------------------------------------------------------------------- #
+if __name__ == "__main__":
+    import traceback
+
+    failures = 0
+    for _name, fn in sorted(globals().items()):
+        if _name.startswith("test_") and callable(fn):
+            try:
+                fn()
+                print("ok: {}".format(_name))
+            except Exception:
+                failures += 1
+                print("FAIL: {}".format(_name))
+                traceback.print_exc()
+    if failures:
+        print("{} test(s) failed".format(failures))
+        sys.exit(1)
+    print("all tests passed")

tests/test_core_will.py

@@ -8,12 +8,12 @@ Run:
     python3 tests/test_core_will.py
 """
 
-import copy
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), os.pardir))
 
+from bal.core.util import copy_structure
 from bal.core.will import Will, WillItem
 
 # A valid serialized Bitcoin transaction hex (1 input + 1 P2PKH output, version 2)
@@ -48,7 +48,7 @@ def _make_willitem_blank():
     """Create a fresh WillItem from scratch."""
     item = WillItem(_make_minimal_willitem_dict())
     # Reset STATUS to clean defaults
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     return item
 
 
@@ -151,8 +151,8 @@ def test_will_only_valid_list():
 def _make_will_with_heirs(heirs, tx_locktime):
     """Build a single-item will whose stored heirs == ``heirs`` and whose
     frozen tx.locktime == ``tx_locktime`` (what the will-executors hold)."""
-    item = WillItem(_make_minimal_willitem_dict(heirs=copy.deepcopy(heirs)))
+    item = WillItem(_make_minimal_willitem_dict(heirs=copy_structure(heirs)))
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     item.tx.locktime = tx_locktime
     return {"willid_1": item}
 
@@ -163,7 +163,7 @@ def test_check_heirs_unchanged_is_coherent():
     heirs = {"alice": ["addr_alice", 5000, str(lt)]}
     will = _make_will_with_heirs(heirs, lt)
     result = Will.check_willexecutors_and_heirs(
-        will, copy.deepcopy(heirs), {}, False, 0, 100
+        will, copy_structure(heirs), {}, False, 0, 100
     )
     assert result is True
 

tests/test_core_will_invalidate.py

@@ -17,7 +17,6 @@ Run:
         python3 -m pytest tests/test_core_will_invalidate.py -q
 """
 
-import copy
 import os
 import sys
 from unittest.mock import MagicMock, patch
@@ -75,7 +74,7 @@ def _make_willitem(value_sats=1000000, valid=True, extra_heirs=None):
         "change": "",
         "baltx_fees": 100,
     })
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     # Set the input value so the balance calculation works.
     # Use the name-mangled attribute because tx_from_any creates a
     # Transaction whose inputs are TxInput objects; TxInput.value_sats()
@@ -270,7 +269,7 @@ class TestInvalidateWill:
         """
         item = _make_willitem(value_sats=100)
         will = {"willtxid1": item}
-        wallet = _mock_wallet([_make_utxo()])
+        wallet = _mock_wallet([_make_utxo(value_sats=100)])
 
         result, mock_from_io, _ = _run_invalidate(will, wallet, fees_per_byte=100)
 

tests/test_group_e_karen7_invalidate.py

@@ -21,7 +21,6 @@ Run:
         python3 -m pytest tests/test_group_e_karen7_invalidate.py -q
 """
 
-import copy
 import json
 import os
 import sys
@@ -46,6 +45,7 @@ from electrum.transaction import (
 from electrum.util import bfh
 
 from bal.core.heirs import Heirs
+from bal.core.util import copy_structure
 from bal.core.will import Will, WillItem
 
 # ------------------------------------------------------------------ #
@@ -219,7 +219,7 @@ def _txs_to_will(txs, heirs_data):
     for txid, tx in txs.items():
         item_dict = {
             "tx": tx,
-            "heirs": copy.deepcopy(heirs_data),
+            "heirs": copy_structure(heirs_data),
             "willexecutor": None,
             "status": "",
             "description": "",

tests/test_group_e_mock_karen7.py

@@ -22,7 +22,6 @@ Run:
         python3 -m pytest tests/test_group_e_mock_karen7.py -q
 """
 
-import copy
 import json
 import os
 import sys
@@ -43,6 +42,7 @@ from bal.core.reminders import (
     ical_escape,
     write_temp_ics,
 )
+from bal.core.util import copy_structure
 from bal.core.will import HeirNotFoundException, Will, WillItem
 from bal.core.willexecutors import Willexecutors
 
@@ -136,7 +136,7 @@ def _make_willitem(**overrides):
     }
     d.update(overrides)
     item = WillItem(d)
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     return item
 
 
@@ -343,7 +343,7 @@ def test_e2_heir_change_triggers_rebuild():
     item = WillItem(
         {
             "tx": _VALID_TX_HEX,
-            "heirs": copy.deepcopy(will_heirs),
+            "heirs": copy_structure(will_heirs),
             "willexecutor": None,
             "status": "",
             "description": "",
@@ -352,7 +352,7 @@ def test_e2_heir_change_triggers_rebuild():
             "baltx_fees": 100,
         }
     )
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     item.tx.locktime = lt
     will = {"willid_1": item}
 

tests/test_gui_export_dialogs.py

@@ -0,0 +1,456 @@
+"""
+Tests for the filter-based unified export/import dialogs and the BalWindow
+transport helpers (``bal.gui.qt.dialogs``, ``bal.gui.qt.window``).
+
+Covers the shared export filters (All / Valid / Valid NC), the unified
+``WillExportDialog`` file page (whole item vs tx-only content, empty-filter
+abort), the audio export/import pages (KB/sec wiring, missing plugin guard,
+receive flow) and the comma-separated tx-only file writer. The audio pages
+run against a stub plugin so no sound hardware is exercised.
+
+Run:
+    QT_QPA_PLATFORM=offscreen python3 tests/test_gui_export_dialogs.py
+"""
+
+import base64
+import json
+import sys
+import zlib
+from unittest.mock import patch
+
+sys.path.insert(0, __file__.rsplit("/", 2)[0])
+
+from PyQt6.QtWidgets import QApplication, QMainWindow
+
+import bal.gui.qt.dialogs as dialogs
+from bal.core.qrtransfer import CHUNK_PRESETS
+
+_app = QApplication.instance() or QApplication(sys.argv)
+
+# A valid 1x1 transparent PNG, good enough for BalDialog's window icon.
+_PNG_BYTES = base64.b64decode(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=="
+)
+
+# A valid serialized Bitcoin transaction hex (1 input + 1 P2PKH output,
+# version 2); used for real-WillItem serialization tests.
+_VALID_TX_HEX = (
+    "01000000012a5c9a94fcde98f5581cd00162c60a13936ceb75389ea65b"
+    "f38633b424eb4031000000006c493046022100a82bbc57a0136751e543"
+    "3f41cf000b3f1a99c6744775e76ec764fb78c54ee100022100f9e80b7d"
+    "e89de861dc6fb0c1429d5da72c2b6b2ee2406bc9bfb1beedd729d98501"
+    "2102e61d176da16edd1d258a200ad9759ef63adf8e14cd97f53227bae3"
+    "5cdb84d2f6ffffffff0140420f00000000001976a914230ac37834073a"
+    "42146f11ef8414ae929feaafc388ac00000000"
+)
+
+
+class _Cfg:
+    def __init__(self, value):
+        self._value = value
+
+    def get(self):
+        return self._value
+
+
+class FakePlugin:
+    QR_CHUNK_SIZE = _Cfg(CHUNK_PRESETS[0][1])
+
+    def read_file(self, path):
+        return _PNG_BYTES
+
+
+class FakeWindow(QMainWindow):
+    config = {}
+
+    def format_amount(self, amount):
+        return "{:.8f}".format(amount)
+
+    def format_amount_and_units(self, amount):
+        return "{:.8f} sat".format(amount)
+
+
+class FakeAudioPlugin:
+    """Duck-typed ``audio_modem`` plugin for the audio pages."""
+
+    def __init__(self):
+        self.modem_config = None
+
+    def is_available(self):
+        return True
+
+
+class _FakeModemConfig:
+    def __init__(self, kbps):
+        self.modem_bps = kbps * 1000
+
+
+class FakeBalWindow:
+    """Duck-typed stand-in for BalWindow (dialog layer only)."""
+
+    def __init__(self, audio_plugin=None):
+        self.window = FakeWindow()
+        self.bal_plugin = FakePlugin()
+        self.willitems = {}
+        self.audio_plugin = audio_plugin
+        self.bitrate_set = None
+        self.audio_payloads = []
+
+    def get_audio_modem_plugin(self):
+        return self.audio_plugin
+
+    def set_audio_modem_bitrate(self, kbps):
+        self.bitrate_set = kbps
+        if self.audio_plugin is not None:
+            self.audio_plugin.modem_config = _FakeModemConfig(kbps)
+
+    def _audio_send_payload(self, payload):
+        self.audio_payloads.append(payload)
+
+    def export_json_file(self, path, will=None):
+        items = will if will is not None else self.willitems
+        with open(path, "w", encoding="utf-8") as f:
+            json.dump({wid: wi.to_dict() for wid, wi in items.items()}, f)
+
+    def export_tx_file(self, path, will=None):
+        items = will if will is not None else self.willitems
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(",".join(str(wi.tx) for _, wi in items.items()))
+
+
+class StubTx:
+    def __init__(self, payload):
+        self.payload = payload
+
+    def txid(self):
+        return "{:064x}".format(hash(self.payload) & 0xFFFFFFFFFFFFFFFF)
+
+    def __str__(self):
+        return self.payload
+
+
+class StubWillItem:
+    def __init__(self, payload, statuses=None):
+        self.tx = StubTx(payload)
+        self.statuses = statuses or {}
+
+    def get_status(self, name):
+        return self.statuses.get(name, False)
+
+    def to_dict(self):
+        return {"tx": str(self.tx)}
+
+
+def _make_willitems(n=3, payload_len=60, statuses=None):
+    return {
+        "item{}".format(i): StubWillItem(
+            "T{}".format(i) * payload_len, statuses=statuses
+        )
+        for i in range(n)
+    }
+
+
+# ------------------------------------------------------------------ #
+# Shared export filters
+# ------------------------------------------------------------------ #
+
+def test_export_filter_options():
+    opts = dialogs.export_filter_options()
+    assert [label for label, _fn in opts] == ["All", "Valid", "Valid NC"]
+    complete = StubWillItem("C*", statuses={"VALID": True, "COMPLETE": True})
+    valid = StubWillItem("V*", statuses={"VALID": True})
+    plain = StubWillItem("P*")
+    assert opts[0][1](complete) and opts[0][1](plain)
+    assert opts[1][1](complete) and opts[1][1](valid) and not opts[1][1](plain)
+    assert not opts[2][1](complete)
+    assert opts[2][1](valid) and not opts[2][1](plain)
+
+
+def test_filter_willitems_by_index():
+    items = {
+        "a": StubWillItem("A*", statuses={"VALID": True, "COMPLETE": True}),
+        "b": StubWillItem("B*", statuses={"VALID": True}),
+        "c": StubWillItem("C*"),
+    }
+    opts = dialogs.export_filter_options()
+    assert set(dialogs.filter_willitems(items, opts, 0)) == {"a", "b", "c"}
+    assert set(dialogs.filter_willitems(items, opts, 1)) == {"a", "b"}
+    assert dialogs.filter_willitems(items, opts, 2) == {"b": items["b"]}
+
+
+# ------------------------------------------------------------------ #
+# WillExportDialog file page
+# ------------------------------------------------------------------ #
+
+def test_file_export_selects_by_filter():
+    bw = FakeBalWindow()
+    items = _make_willitems(3)
+    items["item0"].statuses = {"VALID": True, "COMPLETE": True}
+    items["item1"].statuses = {"VALID": True}
+    d = dialogs.WillExportDialog(bw, will=items, bal_plugin=bw.bal_plugin)
+    assert set(d._selected_items()) == set(items)
+
+    d._on_filter_change(1)
+    assert set(d._selected_items()) == {"item0", "item1"}
+    d._on_filter_change(2)
+    assert list(d._selected_items()) == ["item1"]
+    d.close()
+
+
+def test_file_export_run_tx_only(tmpdir):
+    bw = FakeBalWindow()
+    items = _make_willitems(3)
+    d = dialogs.WillExportDialog(bw, will=items, bal_plugin=bw.bal_plugin)
+    d.content_check.setChecked(False)
+    captured = {}
+
+    def fake_gui(window, title, exporter):
+        captured["title"] = title
+        captured["exporter"] = exporter
+
+    with patch.object(dialogs, "export_meta_gui", side_effect=fake_gui):
+        d._export_file()
+    assert captured["title"] == "will_tx"
+    out = tmpdir.join("will_tx.txt").strpath
+    captured["exporter"](out)
+    expected = ",".join(str(wi.tx) for _, wi in items.items())
+    assert open(out, encoding="utf-8").read() == expected
+    d.close()
+
+
+def test_file_export_run_willitem(tmpdir):
+    bw = FakeBalWindow()
+    items = _make_willitems(2)
+    d = dialogs.WillExportDialog(bw, will=items, bal_plugin=bw.bal_plugin)
+    assert d.content_check.isChecked()
+    captured = {}
+
+    def fake_gui(window, title, exporter):
+        captured["title"] = title
+        captured["exporter"] = exporter
+
+    with patch.object(dialogs, "export_meta_gui", side_effect=fake_gui):
+        d._export_file()
+    assert captured["title"] == "will"
+    out = tmpdir.join("will.json").strpath
+    captured["exporter"](out)
+    data = json.load(open(out, encoding="utf-8"))
+    assert set(data) == set(items)
+    assert data["item0"]["tx"] == str(items["item0"].tx)
+    d.close()
+
+
+def test_file_export_empty_under_filter_aborts():
+    bw = FakeBalWindow()
+    items = {
+        "a": StubWillItem("A*", statuses={"VALID": True, "COMPLETE": True})
+    }
+    d = dialogs.WillExportDialog(bw, will=items, bal_plugin=bw.bal_plugin)
+    messages = []
+    d.show_message = lambda msg: messages.append(msg)  # type: ignore[assignment]
+    d._filter_index = 2  # force an empty "Valid NC" selection
+    with patch.object(dialogs, "export_meta_gui") as gui:
+        d._export_file()
+    assert not gui.called
+    assert messages
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# BalWindow transport helpers
+# ------------------------------------------------------------------ #
+
+def test_bal_window_export_tx_file(tmpdir):
+    import bal.gui.qt.window as window
+
+    items = _make_willitems(3)
+    bw = object.__new__(window.BalWindow)
+    bw.willitems = items
+    out = tmpdir.join("will_tx.txt").strpath
+    bw.export_tx_file(out)
+    expected = ",".join(str(wi.tx) for _, wi in items.items())
+    assert open(out, encoding="utf-8").read() == expected
+
+
+def test_bal_window_set_audio_modem_bitrate():
+    try:
+        import amodem.config
+    except ImportError:
+        return
+    import bal.gui.qt.window as window
+
+    class P:
+        def __init__(self):
+            self.modem_config = None
+
+    probe = P()
+    bw = object.__new__(window.BalWindow)
+    bw.get_audio_modem_plugin = lambda: probe
+    bw.set_audio_modem_bitrate(1)
+    assert probe.modem_config is amodem.config.bitrates[1]
+
+
+# ------------------------------------------------------------------ #
+# WillExportDialog audio page
+# ------------------------------------------------------------------ #
+
+def test_audio_export_page_send():
+    bw = FakeBalWindow(audio_plugin=FakeAudioPlugin())
+    items = _make_willitems(3, payload_len=30)
+    bw.willitems = items
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin)
+    assert d.audio_send_btn.text() == dialogs._("Send")
+    assert d.audio_send_btn.isEnabled()
+    assert d.kbps_combo.count() > 0
+
+    kbps = int(d.kbps_combo.currentText())
+    d._send_audio()
+    assert bw.bitrate_set == kbps
+    # Whole-will default: the audio payload is a single JSON document.
+    assert len(bw.audio_payloads) == 1
+    data = json.loads(bw.audio_payloads[0])
+    assert set(data) == set(items)
+    d.close()
+
+
+def test_audio_export_page_send_tx_only():
+    bw = FakeBalWindow(audio_plugin=FakeAudioPlugin())
+    items = _make_willitems(3, payload_len=30)
+    bw.willitems = items
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin)
+    d.content_check.setChecked(False)
+
+    kbps = int(d.kbps_combo.currentText())
+    d._send_audio()
+    assert bw.bitrate_set == kbps
+    expected = "\n".join(dialogs.serialize_tx_list(items))
+    assert bw.audio_payloads == [expected]
+    d.close()
+
+
+def test_audio_export_page_plugin_missing():
+    # The window stays usable: only the audio option is disabled.
+    bw = FakeBalWindow(audio_plugin=None)
+    bw.willitems = _make_willitems(2)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin)
+    assert not d.audio_send_btn.isEnabled()
+    assert "not available" in d.audio_warn_label.text()
+    assert len(d.qr_page.frames) >= 1  # QR still usable
+    assert d.file_export_btn.isEnabled()
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# WillImportDialog audio page
+# ------------------------------------------------------------------ #
+
+def test_audio_import_page_build():
+    bw = FakeBalWindow(audio_plugin=FakeAudioPlugin())
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    assert d.kbps_combo.count() > 0
+    assert d.receive_btn.text() == dialogs._("Receive by audio…")
+    assert d.receive_btn.isEnabled()
+    d.close()
+
+
+def test_audio_import_page_plugin_missing():
+    bw = FakeBalWindow(audio_plugin=None)
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    assert not d.receive_btn.isEnabled()
+    assert "not available" in d.audio_warn_label.text()
+    assert d.qr_page is not None  # QR import still usable
+    d.close()
+
+
+def test_audio_import_receive_wiring():
+    bw = FakeBalWindow(audio_plugin=FakeAudioPlugin())
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    captured = {}
+
+    class FakeWaitingDialog:
+        def __init__(self, parent, msg, task, on_success=None, on_error=None):
+            captured["msg"] = msg
+            captured["task"] = task
+            captured["success"] = on_success
+            captured["error"] = on_error
+
+    imported = []
+
+    def fake_complete(bal_window, bal_plugin, payload, **kwargs):
+        imported.append(payload)
+
+    blob = zlib.compress(b"A" * 40 + b"\n" + b"B" * 40)
+    with patch.object(dialogs, "WaitingDialog", FakeWaitingDialog), patch.object(
+        dialogs, "_complete_import", side_effect=fake_complete
+    ):
+        d._audio_receive()
+        kbps = int(d.kbps_combo.currentText())
+        assert bw.bitrate_set == kbps
+        assert captured["task"] is not None
+        captured["success"](blob)
+    # Payload is the raw decompressed text; autodetect handles the splitting.
+    assert imported == ["A" * 40 + "\n" + "B" * 40]
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# Whole-will JSON payload serializes a real Transaction (MyEncoder)
+# ------------------------------------------------------------------ #
+
+def test_qr_whole_will_json_serializes_transaction():
+    """Regression: _whole_will_json must not raise
+    "Object of type Transaction is not JSON serializable".
+
+    Real WillItems keep a ``Transaction`` object in ``tx``; the whole-will
+    QR payload (default content scope) must serialize it via MyEncoder the
+    same way write_json_file does.
+    """
+    from bal.core.will import WillItem
+
+    item = WillItem({
+        "tx": _VALID_TX_HEX,
+        "heirs": {},
+        "willexecutor": None,
+        "status": "",
+        "description": "",
+        "time": 0,
+        "change": "",
+        "baltx_fees": 100,
+    })
+    bw = FakeBalWindow()
+    d = dialogs.WillExportDialog(
+        bw, will={"imp0": item}, bal_plugin=bw.bal_plugin, initial_mode="qr"
+    )
+    j = d._whole_will_json()
+    data = json.loads(j)
+    assert data["imp0"]["tx"] == _VALID_TX_HEX
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# Main
+# ------------------------------------------------------------------ #
+
+if __name__ == "__main__":
+    import inspect
+    import os
+    import tempfile
+
+    class _Path:
+        def __init__(self, d, name):
+            self.strpath = os.path.join(d, name)
+
+    class _Tmp:
+        def __init__(self):
+            self._d = tempfile.mkdtemp()
+
+        def join(self, name):
+            return _Path(self._d, name)
+
+    tmp = _Tmp()
+    for name in sorted(dir()):
+        if name.startswith("test_"):
+            fn = globals()[name]
+            fn(tmp) if inspect.signature(fn).parameters else fn()
+            print("  [OK] {}".format(name))
+    print("[OK] All export dialog GUI tests passed")

tests/test_gui_qr_transfer.py

@@ -0,0 +1,749 @@
+"""
+Tests for the QR / audio will-transfer dialogs (``bal.gui.qt.dialogs``).
+
+Covers the unified ``WillExportDialog`` (transport radios, stacked pages,
+QR build/navigation, chunk-size / autoplay, filter revert) and the unified
+``WillImportDialog`` (QR frame capture, slot grid, complete-review enabling,
+total mismatch reset, frame assembly -> decode). The wizard and the
+camera/audio paths need a live wallet/hardware and are exercised only
+through the shared frame-assembly path here.
+
+Run:
+    QT_QPA_PLATFORM=offscreen python3 tests/test_gui_qr_transfer.py
+"""
+
+import base64
+import json
+import sys
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, __file__.rsplit("/", 2)[0])
+
+from electrum.transaction import Transaction
+from PyQt6.QtWidgets import QApplication, QMainWindow
+
+import bal.gui.qt.dialogs as dialogs
+from bal.core.qrtransfer import CHUNK_PRESETS, encode_transfer, split_frames
+from bal.core.will import WillItem
+
+_app = QApplication.instance() or QApplication(sys.argv)
+
+# A valid 1x1 transparent PNG, good enough for BalDialog's window icon.
+_PNG_BYTES = base64.b64decode(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=="
+)
+
+# A valid serialized Bitcoin transaction hex (1 input + 1 P2PKH output),
+# reused for the WillItem status regression test.
+_VALID_TX_HEX = (
+    "01000000012a5c9a94fcde98f5581cd00162c60a13936ceb75389ea65b"
+    "f38633b424eb4031000000006c493046022100a82bbc57a0136751e543"
+    "3f41cf000b3f1a99c6744775e76ec764fb78c54ee100022100f9e80b7d"
+    "e89de861dc6fb0c1429d5da72c2b6b2ee2406bc9bfb1beedd729d98501"
+    "2102e61d176da16edd1d258a200ad9759ef63adf8e14cd97f53227bae3"
+    "5cdb84d2f6ffffffff0140420f00000000001976a914230ac37834073a"
+    "42146f11ef8414ae929feaafc388ac00000000"
+)
+
+
+class _Cfg:
+    def __init__(self, value):
+        self._value = value
+
+    def get(self):
+        return self._value
+
+
+class FakePlugin:
+    # Smallest QR preset: long transfers produce several frames.
+    QR_CHUNK_SIZE = _Cfg(CHUNK_PRESETS[0][1])
+
+    def read_file(self, path):
+        return _PNG_BYTES
+
+
+class FakeWindow(QMainWindow):
+    config = {}
+
+    def format_amount(self, amount):
+        return "{:.8f}".format(amount)
+
+    def format_amount_and_units(self, amount):
+        return "{:.8f} sat".format(amount)
+
+
+class FakeBalWindow:
+    """Duck-typed stand-in for BalWindow (dialog layer only)."""
+
+    def __init__(self):
+        self.window = FakeWindow()
+        self.bal_plugin = FakePlugin()
+        self.willitems = {}
+
+    def get_audio_modem_plugin(self):
+        return None
+
+
+class StubTx:
+    def __init__(self, payload):
+        self.payload = payload
+
+    def txid(self):
+        return "{:064x}".format(hash(self.payload) & 0xFFFFFFFFFFFFFFFF)
+
+    def __str__(self):
+        return self.payload
+
+
+class StubWillItem:
+    def __init__(self, payload, statuses=None):
+        self.tx = StubTx(payload)
+        self.statuses = statuses or {}
+
+    def get_status(self, name):
+        return self.statuses.get(name, False)
+
+    def to_dict(self):
+        return {"tx": str(self.tx), "status": self.statuses}
+
+
+def _make_willitems(n=3, payload_len=120):
+    return {
+        "item{}".format(i): StubWillItem("T{}".format(i) * payload_len)
+        for i in range(n)
+    }
+
+
+# ------------------------------------------------------------------ #
+# WillExportDialog (QR transport via d.qr_page)
+# ------------------------------------------------------------------ #
+
+def test_export_dialog_builds():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems()
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert d.transport_qr.isChecked()
+    assert page.tx_strings
+    assert page.frames
+    assert len(page.frames) >= 1
+    # Frame 1 is shown.
+    assert page.qr_view.text == page.frames[0]
+    assert "1" in page.progress_label.text()
+    d.close()
+
+
+def test_export_dialog_unified_transports():
+    # One window hosts the three transports as stacked, radio-selected pages.
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems()
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin)
+    assert d.stacked.count() == 3
+    assert d.transport_file.isChecked()
+    assert d.stacked.currentWidget() is d.file_page
+    d._on_mode_clicked(d.MODE_QR)
+    assert d.stacked.currentWidget() is d.qr_page
+    d._on_mode_clicked(d.MODE_AUDIO)
+    assert d.stacked.currentWidget() is d.audio_page
+    d.close()
+
+
+def test_import_dialog_qr_page_has_no_audio():
+    # Audio lives on the import dialog's own audio page, never in the QR page.
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    assert not hasattr(page, "_audio_receive")
+    texts = [b.text() for b in page.findChildren(dialogs.QPushButton)]
+    assert not any("Audio" in t for t in texts)
+    assert d.receive_btn is not None
+    d.close()
+
+
+def test_export_dialog_empty_close():
+    # An empty will shows a modal message and no widgets are built; stub the
+    # message out for the test.
+    orig = dialogs.MessageBoxMixin.show_message
+    dialogs.MessageBoxMixin.show_message = lambda self, msg, icon=None: None
+    try:
+        bw = FakeBalWindow()
+        d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin)
+        assert not d.isVisible()
+        assert not hasattr(d, "qr_page")
+        d.close()
+    finally:
+        dialogs.MessageBoxMixin.show_message = orig
+
+
+def test_imported_item_status_not_none():
+    # Regression: a WillItem built from a bare {"tx": hex} had a None status,
+    # so set_status (e.g. IMPORTED / INVALIDATED from the import validity
+    # pass) crashed with "unsupported operand type(s) for +=: 'NoneType' and
+    # 'str'".
+    with patch.object(Transaction, "add_info_from_wallet"):
+        wi = WillItem({"tx": _VALID_TX_HEX}, wallet=None)
+        assert wi.status == ""
+        assert wi.set_status("IMPORTED", True) is True
+        assert wi.set_status("INVALIDATED", True) is True
+        assert "Imported" in wi.status and "Invalidated" in wi.status
+
+
+def test_export_auto_scroll():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(n=6, payload_len=400)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert page.fps_spin is not None
+    assert not page.auto_timer.isActive()
+
+    page.fps_spin.setValue(2)
+    page._toggle_auto()
+    assert page.auto_timer.isActive()
+    assert page.auto_btn.text() == dialogs._("Stop")
+    page._auto_step()
+    assert page.index == 1
+    page._toggle_auto()
+    assert not page.auto_timer.isActive()
+    assert page.auto_btn.text() == dialogs._("Auto")
+
+    # Advancing past the last frame stops the slideshow automatically.
+    page._toggle_auto()
+    page.index = len(page.frames) - 1
+    page._auto_step()
+    assert not page.auto_timer.isActive()
+    d.close()
+
+
+def test_export_auto_scroll_loop():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(n=6, payload_len=400)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert page.loop_check is not None
+
+    # Loop on: reaching the last code wraps back to the first and keeps going.
+    page.loop_check.setChecked(True)
+    page._toggle_auto()
+    assert page.auto_timer.isActive()
+    page.index = len(page.frames) - 1
+    page._auto_step()
+    assert page.index == 0
+    assert page.auto_timer.isActive()
+    page._toggle_auto()
+
+    # Loop off: reaching the last code stops the slideshow.
+    page.loop_check.setChecked(False)
+    page._toggle_auto()
+    page.index = len(page.frames) - 1
+    page._auto_step()
+    assert not page.auto_timer.isActive()
+    d.close()
+
+
+def test_export_filter_valid_and_valid_nc():
+    bw = FakeBalWindow()
+    a = StubWillItem("A" * 120, statuses={"VALID": True, "COMPLETE": True})
+    b = StubWillItem("B" * 120, statuses={"VALID": True})
+    c = StubWillItem("C" * 120)
+    bw.willitems = {"a": a, "b": b, "c": c}
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert d.filter_combo.count() == 3
+    # Whole-will default: a single JSON document carrying all selected items.
+    assert d.content_check.isChecked()
+    assert len(page.tx_strings) == 1
+    data = json.loads(page.tx_strings[0])
+    assert set(data) == {"a", "b", "c"}
+
+    # Switch to tx-only content, then exercise the filters.
+    d.content_check.setChecked(False)
+    assert len(page.tx_strings) == 3
+
+    # "Valid" filter -> only the valid items (a, b).
+    d._on_filter_change(1)
+    assert sorted(page.tx_strings) == ["A" * 120, "B" * 120]
+
+    # "Valid NC" filter -> only the valid, not-complete item (b).
+    d._on_filter_change(2)
+    assert sorted(page.tx_strings) == ["B" * 120]
+    assert page.qr_view.text == page.frames[0]
+    d.close()
+
+
+def test_export_filter_empty_reverts():
+    bw = FakeBalWindow()
+    # Only a COMPLETE valid item: "Valid NC" selects nothing -> revert.
+    bw.willitems = {
+        "a": StubWillItem("A" * 120, statuses={"VALID": True, "COMPLETE": True})
+    }
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    messages = []
+    d.show_message = lambda msg: messages.append(msg)  # type: ignore[assignment]
+    d._on_filter_change(2)  # "Valid NC" -> empty subset
+    assert messages
+    assert d._filter_index == 0  # reverted to "All"
+    assert d.filter_combo.currentIndex() == 0
+    assert len(d.qr_page.tx_strings) == 1
+    d.close()
+
+
+def test_export_navigation_and_chunk_change():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(n=6, payload_len=400)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    first_count = len(page.frames)
+    assert first_count > 1  # long transfer, small default chunk
+
+    assert not page.prev_btn.isEnabled()
+    page._next()
+    assert page.index == 1
+    assert page.qr_view.text == page.frames[1]
+    assert page.prev_btn.isEnabled()
+    page._prev()
+    assert page.index == 0
+    assert page.qr_view.text == page.frames[0]
+
+    # Switch to the largest preset: fewer, bigger frames.
+    page._on_chunk_change(len(dialogs.CHUNK_PRESETS) - 1)
+    assert len(page.frames) < first_count
+    assert page.index == 0
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# WillImportDialog (QR transport via d.qr_page)
+# ------------------------------------------------------------------ #
+
+def test_import_frame_flow():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    assert not page.review_btn.isEnabled()
+    assert not page.slot_area.isVisible()
+
+    transfer = encode_transfer(["A" * 120, "B" * 120, "C" * 120])
+    frames = split_frames(transfer, 150)
+    assert len(frames) > 1
+
+    for frame in frames:
+        page._add_frame(frame)
+    assert page.total == len(frames)
+    assert page.review_btn.isEnabled()
+    # isVisible() needs a shown parent; assert the widget is not hidden instead.
+    assert not page.slot_area.isHidden()
+    assert len(page.slot_widgets) == page.total
+    assert "All" in page.status_label.text()
+    # Duplicate capture is harmless.
+    page._add_frame(frames[0])
+    assert len(page.frames) == page.total
+    d.close()
+
+
+def test_import_assembles_and_decodes():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    captured = {}
+
+    def fake_finish(payload):
+        captured["payload"] = payload
+
+    page._finish_import = fake_finish
+    transfer = encode_transfer(["P" * 130, "Q" * 130])
+    for frame in split_frames(transfer, 150):
+        page._add_frame(frame)
+    page._review_and_sign()
+    # The payload is rejoined into an opaque string for autodetect.
+    assert captured["payload"].split("\n") == ["P" * 130, "Q" * 130]
+    d.close()
+
+
+def test_decode_will_payload_autodetect():
+    # Whole-will JSON is recognized as a will document.
+    payload = json.dumps({"item1": {"tx": "AAAA", "status": {"VALID": True}}})
+    kind, data = dialogs.decode_will_payload(payload)
+    assert kind == "will"
+    assert data["item1"]["tx"] == "AAAA"
+
+    # A singleton dict whose value is not an item dict falls back to txs.
+    kind, data = dialogs.decode_will_payload('{"foo": 1}')
+    assert kind == "txs"
+
+    # Comma and/or newline separated transactions.
+    kind, data = dialogs.decode_will_payload("AAAA,BBBB\nCCCC")
+    assert kind == "txs"
+    assert data == ["AAAA", "BBBB", "CCCC"]
+
+    # A single transaction with no separators.
+    kind, data = dialogs.decode_will_payload("HEXHEX")
+    assert kind == "txs"
+    assert data == ["HEXHEX"]
+
+
+def test_whole_will_qr_roundtrip():
+    # "Whole will" produces a single JSON document that survives a full
+    # QR encode -> frame capture -> assemble -> decode cycle.
+    bw = FakeBalWindow()
+    items = _make_willitems(2)
+    bw.willitems = items
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert d.content_check.isChecked()
+    assert len(page.tx_strings) == 1
+
+    # Rebuild the transfer from the dialog's own strings, as the importer does.
+    transfer = encode_transfer(page.tx_strings)
+    impl = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    import_page = impl.qr_page
+    for frame in split_frames(transfer, dialogs.CHUNK_PRESETS[0][1]):
+        import_page._add_frame(frame)
+    assert import_page.review_btn.isEnabled()
+    caught = {}
+
+    def fake_finish(payload):
+        caught["payload"] = payload
+
+    import_page._finish_import = fake_finish
+    import_page._review_and_sign()
+    kind, data = dialogs.decode_will_payload(caught["payload"])
+    assert kind == "will"
+    assert set(data) == {"item0", "item1"}
+    d.close()
+    impl.close()
+
+
+def test_import_total_mismatch_resets():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    warnings = []
+    page.show_warning = lambda msg: warnings.append(msg)  # type: ignore[assignment]
+
+    frames_a = split_frames(encode_transfer(["A" * 120, "B" * 120]), 150)
+    frames_b = split_frames(encode_transfer(["A" * 120, "B" * 120, "C" * 120]), 150)
+    for frame in frames_a:
+        page._add_frame(frame)
+    assert page.total == len(frames_a)
+
+    # A frame with a different total wipes the import; the first frame of
+    # the new transfer must be scanned afresh.
+    page._add_frame(frames_b[0])
+    assert warnings
+    assert page.total == 0
+    assert not page.frames
+    assert not page.review_btn.isEnabled()
+    d.close()
+
+
+def test_import_manual_entry():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    frames = split_frames(encode_transfer(["M" * 120]), 150)
+    page.manual_edit.setText(frames[0])
+    page._add_from_manual()
+    assert page.manual_edit.text() == ""
+    assert page.total == 1
+    assert page.review_btn.isEnabled()
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# Continuous camera scan (change/detection debounce + auto-finish)
+# ------------------------------------------------------------------ #
+
+def _fresh_debounce():
+    return {
+        "last_index": None,
+        "last_payload": None,
+        "pending_index": None,
+        "pending_payload": None,
+        "pending_count": 0,
+    }
+
+
+def test_qr_import_debounce_pending_then_accept():
+    s = _fresh_debounce()
+    # First sighting of a new identity: pending, not yet stored.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "PAYLOAD1") == "pending"
+    assert s["pending_count"] == 1
+    assert s["last_index"] is None
+    # A second stable read of the same identity: accepted.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "PAYLOAD1") == "accept"
+    assert s["last_index"] == 1
+    assert s["last_payload"] == "PAYLOAD1"
+    assert s["pending_count"] == 0
+
+
+def test_qr_import_debounce_re_reading_last_is_ignored():
+    s = _fresh_debounce()
+    dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "P1")
+    dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "P1")  # accepted
+    # The exporter is still showing frame 1: must be ignored, not accepted.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "P1") == "ignore"
+    assert s["last_index"] == 1
+    assert s["pending_count"] == 0
+
+
+def test_qr_import_debounce_transition_pending_resets():
+    s = _fresh_debounce()
+    dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "P1")
+    dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 1, "P1")  # accept frame 1
+    # A new identity interrupts the pending accumulation.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 2, "P2") == "pending"
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 2, "P2") == "accept"
+    # Same-index duplicate with different payload is treated as new identity.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:2", 2, 2, "P2") == "ignore"
+
+
+def test_qr_import_debounce_total_mismatch_resets():
+    s = _fresh_debounce()
+    # In-range frame is accepted even though its declared total is ignored.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:3", 3, 2, "P2") == "pending"
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:3", 3, 2, "P2") == "accept"
+    # A frame that belongs to a different transfer.
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:4", 4, 2, "P2B") == "reset"
+    # Once the policy is rebased on the new transfer, frames resume normally
+    # (the widget clears the debounce while wiping the import).
+    s["key"] = None
+    assert dialogs.qr_import_accept_frame(s, "balqr", "balqr:4", 4, 2, "P2B") == "pending"
+
+
+def test_qr_import_handle_scanned_text_autofinish():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    reviewed = []
+    page._review_and_sign = lambda: reviewed.append(True)  # type: ignore[assignment]
+
+    frames = split_frames(encode_transfer(["A" * 120, "B" * 120]), 150)
+    assert len(frames) > 1
+
+    # The camera session is running and every frame needs two stable reads.
+    page._scanning = True
+    for frame in frames:
+        for _rep in range(2):
+            page._handle_scanned_text(frame)
+    assert page.total == len(frames)
+    assert len(page.frames) == len(frames)
+    assert page.review_btn.isEnabled()
+
+    # With all frames stored, the loop auto-finishes exactly once.
+    _app.processEvents()
+    assert reviewed == [True]
+    # The camera loop was stopped before handing over to the review step.
+    assert not page._scanning
+    assert not page._scan_timer.isActive()
+    d.close()
+
+
+def test_qr_import_handle_scanned_text_manual_does_not_autofinish():
+    # Without a camera session running, extra frames never auto-proceed.
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    reviewed = []
+    page._review_and_sign = lambda: reviewed.append(True)  # type: ignore[assignment]
+
+    frames = split_frames(encode_transfer(["A" * 120, "B" * 120]), 150)
+    assert len(frames) > 1
+    assert not page._scanning
+    for frame in frames:
+        for _rep in range(2):
+            page._handle_scanned_text(frame)
+    assert len(page.frames) == len(frames)
+    _app.processEvents()
+    assert reviewed == []
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# Animated-QR formats (BC-UR v1/v2, BBQR) via the export/import pages
+# ------------------------------------------------------------------ #
+
+def test_export_format_combo_switches_codecs():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(n=6, payload_len=400)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    assert page.format == "balqr"
+    assert page.frames[0].startswith("BALQR1|")
+    assert page.format_combo.count() == 4
+
+    page._on_format_change(1)  # BC-UR v1
+    assert page.format == "ur1"
+    assert page.frames[0].startswith("ur:bytes/")
+    assert page.index == 0
+    assert page.qr_view.text == page.frames[0]
+
+    page._on_format_change(2)  # BC-UR v2
+    assert page.format == "ur2"
+    assert page.frames[0].startswith("ur:bytes/")
+
+    page._on_format_change(3)  # BBQR
+    assert page.format == "bbqr"
+    assert page.frames[0].startswith("B$")
+    d.close()
+
+
+def test_export_animated_format_frames_fit_budget():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(n=6, payload_len=400)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    for index in range(1, 4):
+        page._on_format_change(index)
+        for frame in page.frames:
+            assert len(frame) <= dialogs.CHUNK_PRESETS[0][1]
+    d.close()
+
+
+def _import_roundtrip_fmt(fmt_index):
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(2)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    page._on_format_change(fmt_index)
+    frames = list(page.frames)
+    assert frames
+    d.close()
+
+    impl = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    import_page = impl.qr_page
+    caught = {}
+    import_page._finish_import = lambda payload: caught.__setitem__("payload", payload)
+    for frame in frames:
+        import_page._add_frame(frame)
+    assert import_page.review_btn.isEnabled()
+    import_page._review_and_sign()
+    kind, data = dialogs.decode_will_payload(caught["payload"])
+    assert kind == "will"
+    assert set(data) == {"item0", "item1"}
+    impl.close()
+
+
+def test_import_ur1_roundtrip():
+    _import_roundtrip_fmt(1)
+
+
+def test_import_ur2_roundtrip():
+    _import_roundtrip_fmt(2)
+
+
+def test_import_bbqr_roundtrip():
+    _import_roundtrip_fmt(3)
+
+
+def test_import_animated_scan_debounce_autofinish():
+    bw = FakeBalWindow()
+    bw.willitems = _make_willitems(2)
+    d = dialogs.WillExportDialog(bw, bal_plugin=bw.bal_plugin, initial_mode="qr")
+    page = d.qr_page
+    page._on_format_change(2)  # BC-UR v2 fountain
+    frames = list(page.frames)
+    d.close()
+
+    impl = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    import_page = impl.qr_page
+    reviewed = []
+    import_page._review_and_sign = lambda: reviewed.append(True)  # type: ignore[assignment]
+    import_page._scanning = True
+    for frame in frames:
+        for _rep in range(2):
+            import_page._handle_scanned_text(frame)
+    assert import_page.review_btn.isEnabled()
+    # The fountain transfer's part count is ``len(frames) // 2`` (pure + one
+    # redundant mixed wave).
+    assert import_page.total == len(frames) // 2
+    assert len(import_page.frames) >= import_page.total
+    assert import_page.review_btn.isEnabled()
+    _app.processEvents()
+    assert reviewed == [True]
+    assert not import_page._scanning
+    impl.close()
+
+
+def test_import_garbage_scan_is_ignored():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    for garbage in ("hello world", "12345", "B$ZZ", ""):
+        page._handle_scanned_text(garbage)
+        assert not page.frames
+        assert page.total == 0
+        assert not page.review_btn.isEnabled()
+    d.close()
+
+
+def test_import_different_animated_transfer_resets():
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    warnings = []
+    page.show_warning = lambda msg: warnings.append(msg)  # type: ignore[assignment]
+
+    frames_a = split_frames(encode_transfer(["A" * 120, "B" * 120]), 150)
+    frames_b = split_frames(encode_transfer(["A" * 120, "B" * 120, "C" * 120]), 150)
+    for frame in frames_a:
+        page._add_frame(frame)
+    assert page.total == len(frames_a)
+    assert not warnings
+
+    page._add_frame(frames_b[0])
+    assert warnings
+    assert page.total == 0
+    assert not page.frames
+    assert not page.review_btn.isEnabled()
+    d.close()
+
+
+def test_import_start_stop_scan_signal_wiring():
+    """Regression: _start_scan/_stop_scan must use the QVideoSink signal
+    videoFrameChanged, not the videoFrame frame getter.
+
+    On PyQt6, ``QVideoSink.videoFrame`` is a method (the frame getter), so
+    ``.videoFrame.connect(...)`` raises AttributeError. This test drives the
+    real sink life-cycle with a mocked camera and asserts the scan session
+    starts/ends cleanly with no error.
+    """
+    from PyQt6.QtMultimedia import QCamera, QMediaCaptureSession, QMediaDevices
+
+    bw = FakeBalWindow()
+    d = dialogs.WillImportDialog(bw, bal_plugin=bw.bal_plugin)
+    page = d.qr_page
+    errors = []
+    page.show_error = lambda msg: errors.append(msg)  # type: ignore[assignment]
+
+    fake_device = MagicMock()
+    fake_device.isNull.return_value = False
+
+    with (
+        patch.object(QMediaDevices, "defaultVideoInput", return_value=fake_device),
+        # Mock camera + capture session; the QVideoSink stays real so the
+        # videoFrameChanged connect/disconnect wiring is exercised for real.
+        patch.object(QCamera, "__new__", return_value=MagicMock()),
+        patch.object(QMediaCaptureSession, "__new__", return_value=MagicMock()),
+    ):
+        page._start_scan()
+        assert page._scanning is True
+        assert not errors
+
+        page._stop_scan()
+    assert page._scanning is False
+    assert page._camera is None
+    assert page._video_sink is None
+    assert not errors
+    d.close()
+
+
+# ------------------------------------------------------------------ #
+# Main
+# ------------------------------------------------------------------ #
+
+if __name__ == "__main__":
+    for name in sorted(dir()):
+        if name.startswith("test_"):
+            globals()[name]()
+            print(f"  [OK] {name}")
+    print("[OK] All QR transfer GUI tests passed")

tests/test_heir_relative_anchor.py

@@ -28,7 +28,6 @@ Run:
     python3 tests/test_heir_relative_anchor.py
 """
 
-import copy
 import json
 import os
 import sys
@@ -40,6 +39,7 @@ from electrum import constants  # noqa: E402  (path insert above)
 constants.net = constants.BitcoinRegtest
 
 from bal.core.checkalive import resolve_date_to_check  # noqa: E402
+from bal.core.util import copy_structure  # noqa: E402
 from bal.core.will import (  # noqa: E402
     HeirNotFoundException,
     NoHeirsException,
@@ -71,7 +71,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
     is forced to ``tx_locktime`` (the value frozen in the signed Bitcoin tx)."""
     d = {
         "tx": _VALID_TX_HEX,
-        "heirs": copy.deepcopy(heirs),
+        "heirs": copy_structure(heirs),
         "willexecutor": None,
         "status": "",
         "description": "",
@@ -80,7 +80,7 @@ def _make_will_item(heirs, tx_locktime, status_complete=False):
         "baltx_fees": 1,
     }
     item = WillItem(d, _id="willid_1")
-    item.STATUS = copy.deepcopy(WillItem.STATUS_DEFAULT)
+    item.STATUS = WillItem.copy_status_table(WillItem.STATUS_DEFAULT)
     item.tx.locktime = tx_locktime
     if status_complete:
         item.set_status("COMPLETE", True)
@@ -111,7 +111,7 @@ def test_unchanged_relative_recipe_signed_is_coherent():
     read as a postpone just because the clock has advanced past build day."""
     heirs = {"alice": ["addr_alice", 5000, "1y"]}
     outcome = _run_heir_check(
-        copy.deepcopy(heirs), copy.deepcopy(heirs), _FROZEN, status_complete=True
+        copy_structure(heirs), copy_structure(heirs), _FROZEN, status_complete=True
     )
     assert outcome.startswith("coherent"), outcome
 
@@ -119,7 +119,7 @@ def test_unchanged_relative_recipe_signed_is_coherent():
 def test_unchanged_relative_recipe_unsigned_is_coherent():
     heirs = {"alice": ["addr_alice", 5000, "1y"]}
     outcome = _run_heir_check(
-        copy.deepcopy(heirs), copy.deepcopy(heirs), _FROZEN, status_complete=False
+        copy_structure(heirs), copy_structure(heirs), _FROZEN, status_complete=False
     )
     assert outcome.startswith("coherent"), outcome
 
@@ -145,7 +145,7 @@ def test_relative_recipe_shortened_on_signed_is_rebuild():
 def test_unchanged_absolute_recipe_is_coherent():
     built = {"alice": ["addr_alice", 5000, str(_FROZEN)]}
     outcome = _run_heir_check(
-        copy.deepcopy(built), copy.deepcopy(built), _FROZEN, status_complete=True
+        copy_structure(built), copy_structure(built), _FROZEN, status_complete=True
     )
     assert outcome.startswith("coherent"), outcome
 
@@ -176,6 +176,7 @@ def test_karen7_frozen_delivery_not_expired():
     valid_wid = "28b64bfd83878d15c668473aa695a2b9bc23196bc61ab3149e8f33241826978d"
     wi = WillItem(data["will"][valid_wid], _id=valid_wid)
     built_locktime = Will.get_min_locktime({valid_wid: wi})
+    assert built_locktime is not None
     assert built_locktime == int(wi.tx.locktime)
 
     date_to_check = resolve_date_to_check(
@@ -195,7 +196,6 @@ def test_karen7_unchanged_heirs_are_coherent():
     signed tx: the plugin must NOT ask to invalidate the will."""
     data = _load_karen7()
     valid_wid = "28b64bfd83878d15c668473aa695a2b9bc23196bc61ab3149e8f33241826978d"
-    wi = WillItem(data["will"][valid_wid], _id=valid_wid)
     # Use _FROZEN (a UTC-midnight value) so the check is compatible with
     # the UTC anchoring code.
     frozen_locktime = _FROZEN

tests/test_import_will_details.py

@@ -127,6 +127,11 @@ def test_sign_transactions_external_only():
         wallet=FakeWallet(),
         waiting_dialog=SimpleNamespace(update=lambda msg: None),
     )
+    # sign_transactions dispatches to self._prepare_and_sign_tx; bind the real
+    # implementation onto the fake so the external-sign run actually executes.
+    fake._prepare_and_sign_tx = MethodType(
+        window_mod.BalWindow._prepare_and_sign_tx, fake
+    )
 
     result = window_mod.BalWindow.sign_transactions(fake, None, will=imported)
 

tests/test_no_willexecutor_karen7.py

@@ -27,7 +27,6 @@ Run::
         python3 -m pytest tests/test_no_willexecutor_karen7.py -v -s
 """
 
-import copy
 import json
 import logging
 import os
@@ -49,6 +48,7 @@ from electrum.transaction import PartialTxInput, TxOutpoint
 from electrum.util import bfh
 
 from bal.core.heirs import Heirs
+from bal.core.util import copy_structure
 from bal.core.will import (
     NotCompleteWillException,
     NoWillExecutorNotPresent,
@@ -278,11 +278,11 @@ class FakeBalWindow:
                 tx["my_locktime"] = txs[txid].my_locktime
                 tx["heirsvalue"] = txs[txid].heirsvalue
                 tx["description"] = txs[txid].description
-                tx["willexecutor"] = copy.deepcopy(txs[txid].willexecutor)
+                tx["willexecutor"] = copy_structure(txs[txid].willexecutor)
                 tx["status"] = "New"
                 tx["baltx_fees"] = txs[txid].tx_fees
                 tx["time"] = creation_time
-                tx["heirs"] = copy.deepcopy(txs[txid].heirs)
+                tx["heirs"] = copy_structure(txs[txid].heirs)
                 tx["txchildren"] = []
                 will[txid] = WillItem(tx, _id=txid, wallet=self.wallet)
             self.update_will(will)

tests/test_reproduce_none_type.py

@@ -7,7 +7,6 @@ but without requiring a full Qt event loop.
 """
 
 import contextlib
-import copy
 import json
 import os
 import sys
@@ -24,6 +23,7 @@ if os.path.isdir(ELECTRUM_DIR):
 
 from bal.core.heirs import Heirs
 from bal.core.plugin_base import BalPlugin, BalTimestamp
+from bal.core.util import copy_structure
 from bal.core.will import (
     NoHeirsException,
     NotCompleteWillException,
@@ -145,11 +145,11 @@ class FakeBalWindow:
                 tx["my_locktime"] = txs[txid].my_locktime
                 tx["heirsvalue"] = txs[txid].heirsvalue
                 tx["description"] = txs[txid].description
-                tx["willexecutor"] = copy.deepcopy(txs[txid].willexecutor)
+                tx["willexecutor"] = copy_structure(txs[txid].willexecutor)
                 tx["status"] = "New"
                 tx["baltx_fees"] = txs[txid].tx_fees
                 tx["time"] = creation_time
-                tx["heirs"] = copy.deepcopy(txs[txid].heirs)
+                tx["heirs"] = copy_structure(txs[txid].heirs)
                 tx["txchildren"] = []
                 will[txid] = WillItem(tx, _id=txid, wallet=self.wallet)
             Will.update_will(self.willitems, will)