@gvnrdao/dh-sdk 0.0.300 → 0.0.303

package/dist/index.mjs

@@ -93,7 +93,8 @@ var init_deployment_addresses = __esm({
         mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
         PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
         FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+        CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
       },
       upgraded: {
         PositionManager: {
@@ -355,7 +356,9 @@ var init_deployment_addresses = __esm({
         FEE_RECIPIENT_REGISTRY_IMPL: "0xd08513a7cB2dd354B26cDDf549616F12054c34c9",
         OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0xe0D981B60351f0f8fFDA2b50C8180Fb37CeF3883",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA"
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA",
+        CARRY_AGENT_REGISTRY: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7",
+        CARRY_AGENT_REGISTRY_IMPL: "0x1b11a3D5e46F3672E643c997f0d569DFf0b64a01"
       }
     };
     SEPOLIA_CONTRACTS = {
@@ -383,7 +386,8 @@ var init_deployment_addresses = __esm({
       mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
       PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
       FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+      CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
     };
     MAINNET_DEPLOYMENT = {
       network: "mainnet",
@@ -418,10 +422,85 @@ var init_deployment_addresses = __esm({
       upgraded: {
         SimplePSMV2: {
           previousImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          newImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          upgradedAt: "2026-06-16T17:53:24.979Z",
-          upgradedBy: "0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f",
-          reason: "Initial PSM deploy / artifact sync"
+          newImplementation: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+          upgradedAt: "2026-07-06T10:41:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6 (block 25472960)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6",
+          block: 25472960
+        },
+        CollateralManagerModule: {
+          previousImplementation: "0x1919860e528Cd2AbbD31a17858c986b8aCc8C185",
+          newImplementation: "0x55110B9dd6B2c9f812564e7a1ef42b3c76E1A3Bb",
+          upgradedAt: "2026-07-08T20:33:59Z",
+          upgradedBy: "AdminModule generic-op 0x740efe0cfe85044479cbd8ee3058aa244057d90703dd2b37044dd6787cbf3485 (3-of-5 ADMIN_ROLE Safes, 24h timelock; executed by 0xfb3B8cbeFB7D666A6Af34C53e189EdC31862a7be in tx 0x430c8e450f12d3d9359cde356ac5e2ef39661d7a89884b5674a596c1090f6cff)",
+          reason: "Validator gas fix (#420): BitcoinAddressValidator packed-table lookups; VERSION 1.3.0 -> 1.3.1"
+        },
+        BitcoinWithdrawalAddressRegistry: {
+          previousImplementation: "0x11731bFEC3068F2cc19D016381dfEA3B93013b1C",
+          newImplementation: "0x190c08300Ae650fb88ed8156445BBeb13bE9E8a3",
+          upgradedAt: "2026-07-08T20:33:59Z",
+          upgradedBy: "AdminModule generic-op 0x2603a486c0f34554b864cc1d909b325c7e105331da10ec0fd7e0b9373fa76207 (3-of-5 ADMIN_ROLE Safes, 24h timelock; executed by 0xfb3B8cbeFB7D666A6Af34C53e189EdC31862a7be in tx 0x430c8e450f12d3d9359cde356ac5e2ef39661d7a89884b5674a596c1090f6cff)",
+          reason: "Validator gas fix (#420): BitcoinAddressValidator packed-table lookups; VERSION 1.0.0 -> 1.0.1"
+        },
+        UCDController: {
+          newImplementation: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+          upgradedBy: "Reconciled from chain \u2014 Upgraded event log unavailable; provenance omitted (never fabricated)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)"
+        },
+        PositionManagerCoreModule: {
+          previousImplementation: "0x6C8b0FB93F8d0239254aefaC24d4264cA2F8AAeB",
+          newImplementation: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+          upgradedAt: "2026-07-06T08:02:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d (block 25472167)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d",
+          block: 25472167
+        },
+        LiquidationManagerModule: {
+          previousImplementation: "0xc2f4517eeD7c4c516939a64c7938a6ab432D99c4",
+          newImplementation: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+          upgradedAt: "2026-07-06T10:40:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c (block 25472956)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c",
+          block: 25472956
+        },
+        BTCSpendAuthorizer: {
+          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
+          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          upgradedAt: "2026-07-06T10:40:59.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
+          block: 25472957
+        },
+        PositionManager: {
+          previousImplementation: "0x9f52BaBB40FbFC5863e45B1A4014cB433950c684",
+          newImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+          upgradedAt: "2026-07-06T08:42:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6 (block 25472368)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6",
+          block: 25472368
+        },
+        LoanOperationsManagerModule: {
+          previousImplementation: "0x56671D671e492Dae625413d463D47605Cf54edf6",
+          newImplementation: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+          upgradedAt: "2026-07-06T10:41:23.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a (block 25472959)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a",
+          block: 25472959
+        },
+        OperationAuthorizationRegistry: {
+          previousImplementation: "0x327662917Ac8EEda47851d74AF6A151348636fCe",
+          newImplementation: "0x493118746840EDB2D396E71632D2E774CA14070e",
+          upgradedAt: "2026-07-06T10:41:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b (block 25472961)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b",
+          block: 25472961
         }
       },
       latestEnv: {
@@ -434,9 +513,37 @@ var init_deployment_addresses = __esm({
         BITCOIN_PROVIDER_REGISTRY: "0x4ab3Fb96e02893Ed6FAa61bad1918390c8DbbFFC",
         BITCOIN_PROVIDER_REGISTRY_IMPL: "0x7Bc9473E45fb3EA594e8b13992F57D0444902ddB",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0xf667f77FDba7458345f227eB6Bfe4148243E7270",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x11731bFEC3068F2cc19D016381dfEA3B93013b1C",
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x190c08300Ae650fb88ed8156445BBeb13bE9E8a3",
         SIMPLE_PSM_V2: "0xfE0C14B4E614f40Bf58845b4B04CeD17fd116532",
-        SIMPLE_PSM_V2_IMPL: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A"
+        SIMPLE_PSM_V2_IMPL: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+        UCD_CONTROLLER: "0x4b4f8063048bCD59D469219E3f07C6aaDF4f6157",
+        UCD_CONTROLLER_IMPL: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+        UCD_TOKEN: "0xaAaB6B05E5EecB015898483d4e6703d7F218850b",
+        UCD_TOKEN_IMPL: "0x5f09C660036021D7e916DF47234C24a2536C3A72",
+        POSITION_MANAGER_CORE_MODULE: "0xd895B685914c1BE4e1c7aab9f89a90c203DE8d22",
+        POSITION_MANAGER_CORE_MODULE_IMPL: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+        TERM_MANAGER_MODULE: "0xDB99CdF883ffa38acD099bC39F8d1f4508c9239E",
+        TERM_MANAGER_MODULE_IMPL: "0x971f63f92990e59270E971612dd399fF2C63B0c3",
+        COLLATERAL_MANAGER_MODULE: "0x2Eb74FEc478218f5C260aAc78Bb8eC297F9d7135",
+        COLLATERAL_MANAGER_MODULE_IMPL: "0x55110B9dd6B2c9f812564e7a1ef42b3c76E1A3Bb",
+        LIQUIDATION_MANAGER_MODULE: "0x74B28695352E7bf736D6c9F76ccb7B4439477De9",
+        LIQUIDATION_MANAGER_MODULE_IMPL: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+        CIRCUIT_BREAKER_MODULE: "0xF7b545d3a4Ee056D06909AB367E2F7bFFE3cB1BC",
+        CIRCUIT_BREAKER_MODULE_IMPL: "0x40e8328D61342C6ADC51dfdC723296c908f95038",
+        ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
+        ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
+        BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        POSITION_MANAGER_VIEWS: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER_VIEWS_IMPL: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
+        POSITION_MANAGER_IMPL: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+        LOAN_OPERATIONS_MANAGER_MODULE: "0x2561974A40F1AEed1251d0A090A83cF8536FB9E9",
+        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+        UPGRADE_VALIDATOR: "0xC46Ae71F22e3741A6CF46E399aE914C4868fEbed",
+        UPGRADE_VALIDATOR_IMPL: "0x4f835e77D1211299a1cbb8Aa2b42d9B390cC95CA",
+        OPERATION_AUTHORIZATION_REGISTRY: "0xD4505645b724754f5170a2027804a4265e860d44",
+        OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0x493118746840EDB2D396E71632D2E774CA14070e"
       }
     };
     MAINNET_CONTRACTS = {
@@ -467,44 +574,44 @@ var init_deployment_addresses = __esm({
     LOCALHOST_DEPLOYMENT = {
       network: "localhost",
       chainId: 31337,
-      timestamp: "2026-03-23T15:33:34.068Z",
+      timestamp: "2026-06-11T12:30:59.589Z",
       deployer: "",
       contracts: {
-        MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-        UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+        MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+        UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
         UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
         UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-        PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-        TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-        LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+        PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+        TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+        LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
         BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
         CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
         LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-        CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+        CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
         AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-        PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-        PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-        OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-        PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+        PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+        PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+        OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+        PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
       }
     };
     LOCALHOST_CONTRACTS = {
-      MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-      UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+      MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+      UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
       UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
       UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-      PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-      TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-      LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+      PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+      TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+      LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
       BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
       CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
       LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-      CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+      CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
       AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-      PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-      PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-      OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-      PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+      PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+      PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+      OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+      PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
     };
     ALL_DEPLOYMENTS = {
       sepolia: SEPOLIA_DEPLOYMENT,
@@ -1196,30 +1303,30 @@ var require_pkg_src = __commonJS({
         }
       },
       btcTransactionSigner: {
-        cid: "QmZs56sVTCJv7mgvyRYfpYHFvFLcSeXa4H44qUYT7z14QP",
+        cid: "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk",
         authorizedCidHex: cidToHex(
-          "QmZs56sVTCJv7mgvyRYfpYHFvFLcSeXa4H44qUYT7z14QP"
+          "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk"
         ),
         name: "Btc Transaction Signer",
         description: "Production Btc Transaction Signer",
-        version: "1.0.0",
+        version: "1.1.1",
         deployed: true,
-        deployedAt: 1781542204806,
-        size: 42376,
-        hash: "f4aed3d88f6fbff6623ed2047436cecd4f561a74883171ea6f4ebe0a1129973c"
+        deployedAt: 1784316496778,
+        size: 63679,
+        hash: "b12aa725797af5ef07f8e6945f05741f583d6e479a4670b1121e97c58fe63191"
       },
       ucdMintValidator: {
-        cid: "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K",
+        cid: "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW",
         authorizedCidHex: cidToHex(
-          "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K"
+          "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW"
         ),
         name: "Ucd Mint Validator",
         description: "Production Ucd Mint Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542207366,
-        size: 72074,
-        hash: "567a51d3beaedbda4f0af2636835ca8a2af89c2264e91f8dc31f522c1a424b7b",
+        deployedAt: 1784316505431,
+        size: 80381,
+        hash: "132a0a8e6e9a1b85d02e00c0e57eaa371d825717255a28c9e644e4b521760026",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041ab17cd91fc5c0b761eea6092d032807561b621b82c488826776e04a9158d61ba64d809a4729f0501289d980732cb06d8dfd06999dd9c8efd2f495dad78b31bb",
@@ -1227,17 +1334,17 @@ var require_pkg_src = __commonJS({
         }
       },
       processPaymentValidator: {
-        cid: "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9",
+        cid: "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ",
         authorizedCidHex: cidToHex(
-          "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9"
+          "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ"
         ),
         name: "Process Payment Validator",
         description: "Production Process Payment Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542209526,
-        size: 68239,
-        hash: "ada27fea57aa3f3b861c49e75ed1f80b72500fdccc1d6e88ee1a3c1396b81867",
+        deployedAt: 1784316520125,
+        size: 76534,
+        hash: "dbdf43d3f1636e0ee883d349ca28f24c5c38ed7e062b76ca75498aaf5fe594ea",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04cfccb9b6c7addc79469c0e9fafebef4c70801302c62cdb26b610723a9b8527d23f98a40158c7340d83fd0e62d02b5ec74c12f7a86d98e8c6973b4811110f19ad",
@@ -1245,17 +1352,17 @@ var require_pkg_src = __commonJS({
         }
       },
       extendPositionValidator: {
-        cid: "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb",
+        cid: "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4",
         authorizedCidHex: cidToHex(
-          "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb"
+          "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4"
         ),
         name: "Extend Position Validator",
         description: "Production Extend Position Validator",
-        version: "1.0.1",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542211640,
-        size: 66543,
-        hash: "0db666fa2888e9acea13d8e4d79edd4ca252f5a4bb06d97e53aa14a9a34b7143",
+        deployedAt: 1784316534278,
+        size: 74352,
+        hash: "c17bfc9abef16f2372316a14c14281e2acc98afdd1662d095360f1d1c5383f1d",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04e52338f6a0c3362800f1a94c4c8f08be5030dde0fa217388c53d1c1a4790f4443c9f2886b2d2d8f4b75a9a156e9b028011b1a1cf7648da0e556aa980ec692836",
@@ -1263,17 +1370,17 @@ var require_pkg_src = __commonJS({
         }
       },
       btcWithdrawal: {
-        cid: "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ",
+        cid: "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2",
         authorizedCidHex: cidToHex(
-          "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ"
+          "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2"
         ),
         name: "Btc Withdrawal",
         description: "Production Btc Withdrawal",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542212709,
-        size: 79782,
-        hash: "e824eb473df8eba3a025ac3adc46730dbf89f90884d7c05a78cc07b90d6bc4df",
+        deployedAt: 1784316549409,
+        size: 90692,
+        hash: "ca7276763142fe1fc812b70f6319973000faf338a91c531f898f8f6406035c64",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1281,17 +1388,17 @@ var require_pkg_src = __commonJS({
         }
       },
       liquidationValidator: {
-        cid: "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF",
+        cid: "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx",
         authorizedCidHex: cidToHex(
-          "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF"
+          "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx"
         ),
         name: "Liquidation Validator",
         description: "Production Liquidation Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542213421,
-        size: 58444,
-        hash: "0f42e9f8984433fef95875d35eb3c8d985e7ce15ad309e6aa1093d6fd1ba0bb5",
+        deployedAt: 1784316560010,
+        size: 66523,
+        hash: "f74d0163c47d7db04d1547f72c3a9bc1e5b499669089cc6464479a361462ce81",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041a241de58976c13e3d7ca5a18e494f7330151e3818706135d50176e78ffb673e58b11f0b67a87c73fade6c6b27d6e7a7377ea9f4c10bf31880f1d725f18cc6f8",
@@ -1317,17 +1424,17 @@ var require_pkg_src = __commonJS({
         }
       },
       loanVaultBtcBalance: {
-        cid: "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG",
+        cid: "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu",
         authorizedCidHex: cidToHex(
-          "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG"
+          "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu"
         ),
         name: "Loan Vault Btc Balance",
         description: "Production Loan Vault Btc Balance",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542215432,
-        size: 48397,
-        hash: "da3750a70e532b87f3590a3e2d8c2d51e700589f6e111bb291384ab01304af35",
+        deployedAt: 1784316574669,
+        size: 56477,
+        hash: "917535f2911055b2ade2204fd868dd8b7294c7ade23e82aea488aeb0872e35d7",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1341,17 +1448,17 @@ var require_pkg_src = __commonJS({
       // Requires BitcoinProviderRegistry.addAllowedCid(chainId, keccak256(utf8(cid)))
       // on each target chain (the action decrypts registry slots). No OAR entry.
       btcAddressBalance: {
-        cid: "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5",
+        cid: "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA",
         authorizedCidHex: cidToHex(
-          "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5"
+          "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA"
         ),
         name: "Btc Address Balance",
         description: "Address-only signed total BTC balance via registry consensus (no positionId, no price)",
-        version: "0.1.0",
+        version: "0.2.1",
         deployed: true,
-        deployedAt: 1781542217452,
-        size: 25519,
-        hash: "000e2f8bdbccdc95b0db0fb3f12412e2e76eea16a8456d37914d324437ae291c",
+        deployedAt: 1784316590403,
+        size: 26986,
+        hash: "49fb14265f3208916f12806df04492900bd08fb1b14d9651ee6278cd9ae4a428",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x0498cbb31facfa26e3ec83ccdabfe4fe341ca0282e0c3cb81da7113723b9726e1e49efa92165cc3faa66ced4454cea56dbab12267852d6525a55d7c4f128b912cd",
@@ -1385,17 +1492,17 @@ var require_pkg_src = __commonJS({
         hash: "03ee5be239c91c735d2c95db89a0d1b77e602cfc18af8eb64b3281fddcd90a72"
       },
       staleSpendRecoveryValidator: {
-        cid: "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5",
+        cid: "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK",
         authorizedCidHex: cidToHex(
-          "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5"
+          "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK"
         ),
         name: "Stale Spend Recovery Validator",
         description: "Production Stale Spend Recovery Validator",
-        version: "1.0.0",
+        version: "1.1.2",
         deployed: true,
-        deployedAt: 1781542219438,
-        size: 34413,
-        hash: "26b11730cf5d9eb4af0b1fe65192d26ccee50369c0472211a0ea11e26ef51cc5",
+        deployedAt: 1784316604502,
+        size: 36785,
+        hash: "28bfe44970541fefe3bae8bd54f25e8775d7cc61b5832a40ba1c18587b6b6358",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x046da0ad6da7dd4a0063cbeac6f2bdb6a9889c2178b23470833356a8ee5630f7f0eee0db348d9d9aaaadd23eccf0063c8f68ee5e446abe30b882bf1de4c932bc21",
@@ -2146,7 +2253,7 @@ ${errorReport}`);
     }
     init_debug_logger();
     init_session_signature_cache();
-    var import_ethers15 = __require("ethers");
+    var import_ethers16 = __require("ethers");
     var EXPIRED_LOAN_MIN_LIQUIDATION_THRESHOLD_BPS = 11e3;
     var GRACE_PERIOD_DAYS = 30;
     var SATOSHIS_PER_BITCOIN = 100000000n;
@@ -2183,6 +2290,20 @@ ${errorReport}`);
       /* REGTEST */
       // Local development
     };
+    var CHAIN_TO_CHAIN_ID = {
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: 1,
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: 11155111,
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: 1337
+    };
     function validateChain(chain) {
       const normalized = chain.toLowerCase().trim();
       if (normalized === "sepolia") {
@@ -2479,6 +2600,27 @@ ${errorReport}`);
     function createProtocolParametersModule(config) {
       return new ProtocolParametersModule(config);
     }
+    function parseVaultAddress(rawVaultAddress, chain) {
+      try {
+        const parsed = JSON.parse(rawVaultAddress);
+        if (typeof parsed === "object" && parsed !== null) {
+          const chainLower = chain.toLowerCase();
+          if (chainLower === "sepolia") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          const bitcoinNetwork = getBitcoinNetworkForChain(chain);
+          if (bitcoinNetwork === "regtest") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          if (bitcoinNetwork === "testnet") {
+            return parsed.testnet || parsed.regtest || parsed.mainnet;
+          }
+          return parsed.mainnet;
+        }
+      } catch (e) {
+      }
+      return rawVaultAddress;
+    }
     var VaultSnapshotModule = class {
       constructor(config) {
         this.config = config;
@@ -2586,112 +2728,11 @@ ${errorReport}`);
           timestamp: Date.now()
         };
       }
-      /**
-       * Fast vault snapshot using balance method only (no UTXO validation)
-       * This is optimized for speed and should be used when UTXO details are not needed.
-       *
-       * WARNING: This method skips UTXO validation. Use ONLY for non-critical operations.
-       * For authorization/security operations, ALWAYS use getVaultSnapshot().
-       *
-       * @param positionId - Position to snapshot
-       * @returns Complete VaultSnapshot with all metrics (using fast balance method)
-       */
-      async getVaultSnapshotFast(positionId) {
-        const positionState = await this.queryPositionState(positionId);
-        console.log(
-          `[Vault Snapshot] Raw vault address from contract: "${positionState.vaultAddress}"`
-        );
-        const useStubbedBtcData = this.config.debugOverrides?.useStubbedBtcData === true;
-        const [balanceResult, btcPriceUsd] = useStubbedBtcData ? this.buildStubbedBtcSnapshotInputs(positionState) : await Promise.all([
-          this.config.vaultBalance.calculateTrustedBalance(
-            positionId,
-            positionState.vaultAddress,
-            true
-            // Always skip UTXO validation for fast path
-          ),
-          this.config.priceOracle.getBTCPrice()
-        ]);
-        const protocolParams = createProtocolParametersModule({
-          termManagerAddress: this.config.termManagerAddress,
-          loanOpsManagerAddress: this.config.loanOpsManagerAddress,
-          liquidationManagerAddress: this.config.liquidationManagerAddress,
-          chain: this.config.chain,
-          chainId: this.config.chainId || 1,
-          // Default to mainnet if not provided
-          rpcUrl: this.config.rpcUrl
-        });
-        const termForFees = this.config.termOverride ?? positionState.selectedTerm;
-        const [liquidationThresholdBps, maxEscalatedThresholdBps, termFees] = await Promise.all([
-          protocolParams.getLiquidationThreshold(),
-          protocolParams.getMaxEscalatedThreshold(),
-          protocolParams.getTermFees(termForFees)
-        ]);
-        const termStatus = calculateTermStatus(
-          positionState.termStartTimestamp,
-          positionState.selectedTerm
-        );
-        const currentLiquidationThreshold = calculateLiquidationThreshold(
-          termStatus.isExpired,
-          termStatus.daysIntoGracePeriod,
-          liquidationThresholdBps,
-          maxEscalatedThresholdBps
-        );
-        const collateralMetrics = calculateCollateralMetrics(
-          balanceResult.availableBalance,
-          btcPriceUsd,
-          positionState.ucdDebt
-        );
-        const isLiquidatable = collateralMetrics.collateralRatioBps < currentLiquidationThreshold;
-        const marginToLiquidationBps = collateralMetrics.collateralRatioBps - currentLiquidationThreshold;
-        return {
-          // Raw state
-          positionId: positionState.positionId,
-          pkpId: positionState.pkpId,
-          borrower: positionState.borrower,
-          vaultAddress: positionState.vaultAddress,
-          ucdDebt: positionState.ucdDebt,
-          termStartTimestamp: positionState.termStartTimestamp,
-          selectedTerm: positionState.selectedTerm,
-          status: positionState.status,
-          // Loan status enum value (0-7)
-          expiryAt: positionState.expiryAt,
-          // Loan expiry timestamp
-          previousExpiryAt: positionState.previousExpiryAt,
-          // expiryAt before last renewal; 0 if never renewed
-          totalTerm: positionState.totalTerm,
-          // total accumulated loan months; 0 before first renewal
-          lastRenewedAt: positionState.lastRenewedAt,
-          // timestamp of most recent renewal; createdAt at origination; 0 for pre-H-5 positions
-          // Bitcoin state
-          totalBTCSats: balanceResult.totalBalance,
-          totalUTXOs: balanceResult.totalUTXOs,
-          authorizedSpendsSats: balanceResult.authorizedBalance,
-          authorizedSpendsHash: balanceResult.authorizedSpendsHash,
-          availableBTCSats: balanceResult.availableBalance,
-          availableUTXOs: balanceResult.availableUTXOs,
-          // Price data
-          btcPriceUsd,
-          // Calculated metrics
-          collateralValueUsd: collateralMetrics.collateralValueUsd,
-          collateralRatioBps: collateralMetrics.collateralRatioBps,
-          // Term status
-          termDurationDays: termStatus.termDurationDays,
-          termLengthDays: termStatus.termLengthDays,
-          isExpired: termStatus.isExpired,
-          daysUntilExpiry: termStatus.daysUntilExpiry,
-          daysIntoGracePeriod: termStatus.daysIntoGracePeriod,
-          // Liquidation risk
-          currentLiquidationThreshold,
-          isLiquidatable,
-          marginToLiquidationBps,
-          // Protocol parameters (from smart contracts)
-          liquidationThresholdBps,
-          originationFeeBps: termFees.originationFeeBps,
-          extensionFeeBps: termFees.extensionFeeBps,
-          // Metadata
-          timestamp: Date.now()
-        };
-      }
+      // NOTE (remediation P1/#5): `getVaultSnapshotFast` — a snapshot built on the
+      // skip-UTXO-validation balance path — was deleted. It had zero callers, and
+      // a snapshot whose balance skipped UTXO validation + consensus must never
+      // exist within reach of a signing flow. Every snapshot now runs the full
+      // validation path above.
       buildStubbedBtcSnapshotInputs(positionState) {
         const stubbedAvailableBtcSats = BigInt(
           this.config.debugOverrides?.stubbedAvailableBtcSats ?? "10000000"
@@ -2820,14 +2861,20 @@ ${errorReport}`);
           expiryAt,
           selectedTermMonths
         );
+        const parsedVaultAddress = parseVaultAddress(
+          position.vaultAddress,
+          validateChain(this.config.chain)
+        );
+        if (typeof parsedVaultAddress !== "string" || parsedVaultAddress.length === 0) {
+          throw new Error(
+            `Position ${positionIdBytes32} vaultAddress has no entry for chain "${this.config.chain}"`
+          );
+        }
         return {
           positionId: position.positionId,
           pkpId: position.pkpId,
           borrower: position.borrower,
-          vaultAddress: this.parseVaultAddress(
-            position.vaultAddress,
-            validateChain(this.config.chain)
-          ),
+          vaultAddress: parsedVaultAddress,
           ucdDebt: BigInt(position.ucdDebt.toString()),
           termStartTimestamp,
           selectedTerm: selectedTermMonths,
@@ -2838,36 +2885,8 @@ ${errorReport}`);
           lastRenewedAt
         };
       }
-      /**
-       * Parse vault address based on format and network
-       *
-       * Supports two formats:
-       * 1. Single string: "mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"
-       * 2. JSON object: {"mainnet":"bc1q...","testnet":"mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"}
-       *
-       * @param rawVaultAddress Raw vault address from contract
-       * @param chain EVM chain (sepolia, ethereum)
-       * @returns Parsed Bitcoin address for the appropriate network
-       */
-      parseVaultAddress(rawVaultAddress, chain) {
-        try {
-          const parsed = JSON.parse(rawVaultAddress);
-          if (typeof parsed === "object" && parsed !== null) {
-            const chainLower = chain.toLowerCase();
-            if (chainLower === "sepolia") {
-              return parsed.regtest || parsed.testnet || parsed.mainnet;
-            }
-            const bitcoinNetwork = getBitcoinNetworkForChain(chain);
-            if (bitcoinNetwork === "testnet") {
-              return parsed.testnet || parsed.regtest || parsed.mainnet;
-            } else {
-              return parsed.mainnet;
-            }
-          }
-        } catch (e) {
-        }
-        return rawVaultAddress;
-      }
+      // parseVaultAddress moved to `modules/vault-address.ts` (shared with the
+      // phase-2 signer for the P6/#7b vault-identity binding).
       /**
        * Quick check if position is liquidatable
        *
@@ -3205,6 +3224,13 @@ ${auth.clientId}`;
           return {};
       }
     }
+    function assertSaneSatoshis(value, context) {
+      if (!Number.isSafeInteger(value) || value < 0 || value > MAX_BTC_AMOUNT) {
+        throw new Error(
+          `${context}: satoshi value ${value} is not a sane amount (must be an integer in [0, ${MAX_BTC_AMOUNT}])`
+        );
+      }
+    }
     var BitcoinDataProvider = class {
       constructor(config) {
         this.config = config;
@@ -3351,13 +3377,16 @@ ${auth.clientId}`;
           address
         );
         const utxos = unspentOutputs.map(
-          (utxo) => ({
-            txid: utxo.txid,
-            vout: utxo.vout,
-            satoshis: BigInt(Math.round(utxo.amount * 1e8)),
-            // BTC to satoshis as bigint
-            confirmations: utxo.confirmations
-          })
+          (utxo) => {
+            const satNumber = Math.round(utxo.amount * 1e8);
+            assertSaneSatoshis(satNumber, `fetchUTXOsFromRPC ${utxo.txid}:${utxo.vout}`);
+            return {
+              txid: utxo.txid,
+              vout: utxo.vout,
+              satoshis: BigInt(satNumber),
+              confirmations: utxo.confirmations
+            };
+          }
         );
         return utxos;
       }
@@ -3399,6 +3428,7 @@ ${auth.clientId}`;
               "Invalid UTXO row: missing txid, vout/n, or value/satoshis"
             );
           }
+          assertSaneSatoshis(satRaw, `parseBlockstreamUTXOs ${txid}:${vout}`);
           utxos.push({
             txid,
             vout,
@@ -3577,7 +3607,10 @@ ${auth.clientId}`;
               `Invalid response: missing required fields. funded_txo_sum: ${fundedTxoSum}, spent_txo_sum: ${spentTxoSum}`
             );
           }
+          assertSaneSatoshis(fundedTxoSum, `getBalance ${cleanAddress} funded_txo_sum`);
+          assertSaneSatoshis(spentTxoSum, `getBalance ${cleanAddress} spent_txo_sum`);
           const confirmedBalance = fundedTxoSum - spentTxoSum;
+          assertSaneSatoshis(confirmedBalance, `getBalance ${cleanAddress} confirmed balance`);
           const balance = BigInt(confirmedBalance);
           this.logger.log("3", `Balance: ${balance.toString()} sats`);
           this.logger.log(
@@ -4056,20 +4089,590 @@ ${auth.clientId}`;
         return priceWith8Decimals;
       }
     };
+    var MAX_CLASSIFIED_PARENTS = 5;
+    var CLASSIFICATION_CONCURRENCY = 2;
+    var CONFIRMATION_SKEW_TOLERANCE = 3;
+    async function mapWithConcurrency(items, limit, fn) {
+      const results = new Array(items.length);
+      let next = 0;
+      const workers = Array.from(
+        { length: Math.min(limit, items.length) },
+        async () => {
+          while (true) {
+            const i = next++;
+            if (i >= items.length) {
+              return;
+            }
+            results[i] = await fn(items[i]);
+          }
+        }
+      );
+      await Promise.all(workers);
+      return results;
+    }
+    function findOutputClaimMismatch(claimedUtxos, outputs, cleanVaultAddress) {
+      for (const claim of claimedUtxos) {
+        const output = outputs.find((o) => o.index === claim.vout);
+        if (!output) {
+          return `claimed output ${claim.txid}:${claim.vout} not present in parent tx`;
+        }
+        if (output.scriptpubkey_address !== cleanVaultAddress) {
+          return `claimed output ${claim.txid}:${claim.vout} pays ${output.scriptpubkey_address ?? "<no address>"}, not the vault`;
+        }
+        if (output.value === void 0 || output.value !== claim.satoshis) {
+          return `claimed output ${claim.txid}:${claim.vout} value ${output.value?.toString() ?? "<missing>"} != reported ${claim.satoshis.toString()}`;
+        }
+      }
+      return null;
+    }
+    function stripNetworkPrefix(address) {
+      const prefixPattern = /^(REGTEST_|TESTNET_|MAINNET_)/;
+      return address.replace(prefixPattern, "");
+    }
+    var VaultBalanceConsensus = class {
+      /**
+       * @param minConsensusProviders Policy floor (`policy.minConsensusProviders`,
+       *   remediation P1/#1). Both consensus passes THROW when fewer providers are
+       *   configured than the floor demands — below it the cross-checks cannot run
+       *   and neither trusting the primary (inflation) nor excluding UTXOs
+       *   (deflation → wrongful liquidation) is a safe direction. A floor of 1
+       *   (hardhat / single-provider sepolia) preserves the trust-primary /
+       *   exclude-unconfirmed baseline unchanged.
+       */
+      constructor(primaryProvider, providerConfigs, minConsensusProviders) {
+        this.primaryProvider = primaryProvider;
+        this.providerConfigs = providerConfigs;
+        this.minConsensusProviders = minConsensusProviders;
+        this.readers = this.buildReaders();
+      }
+      /**
+       * Fail-closed floor check shared by both consensus passes. Only floors above
+       * 1 can bite: a floor of 1 with zero configs means "no esplora access
+       * configured" (dev/test), where the documented pre-gate behaviour —
+       * trust-primary confirmed set, exclude unconfirmed — remains correct.
+       */
+      assertProviderFloor(pass) {
+        const configured = this.providerConfigs?.length ?? 0;
+        if (this.minConsensusProviders > 1 && configured < this.minConsensusProviders) {
+          throw new Error(
+            `${pass}: this chain requires at least ${this.minConsensusProviders} Bitcoin providers for consensus; ${configured} configured. Refusing to proceed without cross-check.`
+          );
+        }
+      }
+      /**
+       * Build one data reader per configured provider (primary first). Index 0
+       * reuses the injected primary instance; the rest are constructed from their
+       * configs so cross-check reads hit the right endpoint. Null when no providers
+       * are configured — both passes then fall back to primary-only behaviour.
+       */
+      buildReaders() {
+        const configs = this.providerConfigs;
+        if (!configs || configs.length === 0) {
+          return null;
+        }
+        return configs.map(
+          (cfg, i) => i === 0 ? this.primaryProvider : new BitcoinDataProvider({
+            providerUrl: cfg.providerUrl,
+            auth: cfg.auth,
+            ...cfg.timeout ? { timeout: cfg.timeout } : {}
+          })
+        );
+      }
+      /**
+       * Confirmed-UTXO-set consensus across every registered provider (strict).
+       *
+       * The signed balance is dominated by the primary's confirmed UTXOs, but the
+       * UTXO set — txid, vout, and value — is read only from the primary; the
+       * `assertBitcoinBalanceConsensus` check the validators run compares
+       * `chain_stats` totals, not individual outpoints. So a compromised primary
+       * can add a fabricated confirmed UTXO, or inflate a real one's value, and the
+       * balance consensus still passes (it serves honest `chain_stats`). This
+       * closes that: each UTXO the primary reports at or above `minConfirmations`
+       * must be present with the EXACT same value on every registered provider.
+       *
+       * Semantics:
+       *  - Absent on any provider, or value mismatch → THROW (fail-closed). Confirmed
+       *    transactions are fully propagated, so absence is unambiguous forgery, not
+       *    a race.
+       *  - Present + value-matched everywhere: the UTXO counts as confirmed only if
+       *    it meets `minConfirmations` on ALL providers (gated on the minimum
+       *    reported depth). A UTXO just past the boundary on the primary but a block
+       *    behind on a lagging provider is DEMOTED — excluded until it matures —
+       *    rather than signed over. A depth spread beyond CONFIRMATION_SKEW_TOLERANCE
+       *    is not benign skew but a provider lying about depth (to inflate a shallow
+       *    UTXO past the gate, or deflate a deep one into a wrongful liquidation) →
+       *    THROW.
+       *  - SYMMETRIC (finding #6): a confirmed outpoint any secondary reports that
+       *    the primary omits entirely, reports with a different value, or reports
+       *    at a depth more than the skew tolerance BELOW the secondary's → THROW.
+       *    Without this, a compromised primary deflates the balance by omission and
+       *    forces a wrongful liquidation.
+       *
+       * Below `minConsensusProviders` this THROWS (P1/#1). With a floor of 1 and
+       * 0/1 providers configured, no cross-check is possible and the primary's
+       * confirmed UTXOs are returned unchanged (behaviour identical to before
+       * this gate).
+       *
+       * Cross-checking `chain_stats` totals against the confirmed-UTXO sum was
+       * considered and rejected: `getBalance` reads mempool-blind `chain_stats`
+       * while `getUTXOSet` removes mempool-spent outputs, so the two legitimately
+       * diverge during any pending spend — precisely the self-change window — and
+       * that comparison would false-fail there. Outpoint-set consensus asserts
+       * agreement only on confirmed outpoints, which the mempool does not touch.
+       *
+       * @returns Set of "txid:vout" keys admitted as confirmed-with-consensus.
+       */
+      async confirmedUtxoConsensus(primaryUtxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        this.assertProviderFloor("confirmedUtxoConsensus");
+        const confirmedKeys = /* @__PURE__ */ new Set();
+        const primaryConfirmed = primaryUtxos.filter(
+          (utxo) => utxo.confirmations >= minConfirmations
+        );
+        for (const utxo of primaryConfirmed) {
+          confirmedKeys.add(`${utxo.txid}:${utxo.vout}`);
+        }
+        if (!providerConfigs || providerConfigs.length <= 1 || !readers) {
+          return confirmedKeys;
+        }
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          readers.slice(1).map((reader) => reader.getUTXOSet(vaultAddress, minConfirmations))
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i + 1) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Confirmed UTXO set read failed for ${vaultAddress} on ${failures.length}/${providerConfigs.length - 1} secondary provider(s): ${failures.join("; ")}`
+          );
+        }
+        const secondaryMaps = settled.map((r) => {
+          const map2 = /* @__PURE__ */ new Map();
+          for (const utxo of r.value.utxos) {
+            map2.set(`${utxo.txid}:${utxo.vout}`, {
+              value: utxo.satoshis,
+              confirmations: utxo.confirmations
+            });
+          }
+          return map2;
+        });
+        const demoted = [];
+        for (const utxo of primaryConfirmed) {
+          const key = `${utxo.txid}:${utxo.vout}`;
+          let minConfs = utxo.confirmations;
+          let maxConfs = utxo.confirmations;
+          for (let s = 0; s < secondaryMaps.length; s++) {
+            const entry = secondaryMaps[s].get(key);
+            const name = providerName(s + 1);
+            if (!entry) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${providerName(0)} but absent on ${name}; refusing to sign (possible fabricated UTXO).`
+              );
+            }
+            if (entry.value !== utxo.satoshis) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${utxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations < minConfs)
+              minConfs = entry.confirmations;
+            if (entry.confirmations > maxConfs)
+              maxConfs = entry.confirmations;
+          }
+          if (maxConfs - minConfs > CONFIRMATION_SKEW_TOLERANCE) {
+            throw new Error(
+              `Confirmed UTXO ${key} confirmation spread ${maxConfs - minConfs} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE} (min ${minConfs}, max ${maxConfs}); providers disagree on depth, refusing to sign.`
+            );
+          }
+          if (minConfs < minConfirmations) {
+            confirmedKeys.delete(key);
+            demoted.push(key);
+          }
+        }
+        if (demoted.length > 0) {
+          litDebugLog(
+            `[VaultBalance] confirmed-consensus: ${demoted.length} UTXO(s) demoted pending provider tip skew (excluded until matured): ${demoted.join(", ")}`
+          );
+        }
+        const primaryByKey = new Map(
+          primaryUtxos.map((utxo) => [`${utxo.txid}:${utxo.vout}`, utxo])
+        );
+        for (let s = 0; s < secondaryMaps.length; s++) {
+          const name = providerName(s + 1);
+          for (const [key, entry] of secondaryMaps[s]) {
+            if (entry.confirmations < minConfirmations)
+              continue;
+            const primaryUtxo = primaryByKey.get(key);
+            if (!primaryUtxo) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${name} (${entry.confirmations} confs) but absent on ${providerName(0)}; refusing to sign (possible omitted UTXO / balance deflation \u2014 may be transient during an in-flight vault spend).`
+              );
+            }
+            if (primaryUtxo.satoshis !== entry.value) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${primaryUtxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations - primaryUtxo.confirmations > CONFIRMATION_SKEW_TOLERANCE) {
+              throw new Error(
+                `Confirmed UTXO ${key} depth disagreement: ${providerName(0)}=${primaryUtxo.confirmations} vs ${name}=${entry.confirmations} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE}; the primary may be under-reporting depth to suppress collateral, refusing to sign.`
+              );
+            }
+          }
+        }
+        return confirmedKeys;
+      }
+      /**
+       * Classify unconfirmed UTXOs as protocol self-change.
+       *
+       * A UTXO below minConfirmations counts as confirmed-equivalent ONLY when the
+       * transaction that created it spends exclusively vault-owned, confirmed
+       * outputs. Such a transaction can only have been signed by the vault's PKP,
+       * so no third party can RBF-replace or double-spend it — the reversal risk
+       * the confirmation gate exists to close does not apply. Any non-vault input,
+       * unconfirmed funding tx, or coinbase input disqualifies the UTXO
+       * (fail-safe: exclusion, never inclusion).
+       *
+       * Multi-provider consensus (audit C-1/C-2 parity): the parent-tx proof is
+       * verified independently against EVERY configured provider and admitted
+       * only on unanimity. The confirmed-balance consensus the validators run
+       * covers `chain_stats` only, so without this the primary provider alone
+       * could fabricate an unconfirmed UTXO plus a self-consistent parent proof
+       * and inflate the signed balance. Any provider failure or verdict
+       * disagreement THROWS (fail-closed) — exclusion on a suppressed proof
+       * would deflate the balance and open a wrongful-liquidation window, so
+       * neither direction may proceed without agreement.
+       *
+       * The same per-provider `/tx` fetch also returns the parent's outputs, and
+       * every provider must corroborate each claimed UTXO (index, vault address,
+       * exact value) before admission — the UTXO list itself comes only from the
+       * primary, so an unchecked claim would let it attach a fabricated or
+       * inflated output to a genuine self-spend.
+       *
+       * Fetch cost: zero when every UTXO is confirmed (the common case); otherwise
+       * per provider: one tx lookup per classified parent (vins + vouts in one
+       * response), plus per distinct funding tx a confirmation check and — only
+       * when the provider omits vin prevout data — an output lookup. Classified
+       * parents are capped at MAX_CLASSIFIED_PARENTS (largest claimed value
+       * first, deterministic) and evaluated CLASSIFICATION_CONCURRENCY at a time,
+       * so third-party dust spam cannot amplify into provider rate-limiting and
+       * an action-wide outage.
+       *
+       * See docs/vault-balance-confirmed-gate-plan-2026-07-14.md §3.1.
+       *
+       * @param utxos - Full UTXO set for the vault address
+       * @param vaultAddress - Bitcoin address of the vault (may carry network prefix)
+       * @param minConfirmations - Confirmation threshold for the chain
+       * @returns Set of "txid:vout" keys for UTXOs verified as self-change
+       */
+      async classifySelfChange(utxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        const selfChange = /* @__PURE__ */ new Set();
+        const unconfirmed = utxos.filter(
+          (utxo) => utxo.confirmations < minConfirmations
+        );
+        if (unconfirmed.length === 0) {
+          return selfChange;
+        }
+        this.assertProviderFloor("classifySelfChange");
+        if (!providerConfigs || providerConfigs.length === 0 || !readers) {
+          litDebugLog(
+            `[VaultBalance] ${unconfirmed.length} unconfirmed UTXO(s) excluded: no bitcoinProviderConfigs for self-change classification`
+          );
+          return selfChange;
+        }
+        const cleanVaultAddress = stripNetworkPrefix(vaultAddress);
+        const claimsByParent = /* @__PURE__ */ new Map();
+        for (const utxo of unconfirmed) {
+          const claims = claimsByParent.get(utxo.txid) ?? [];
+          claims.push(utxo);
+          claimsByParent.set(utxo.txid, claims);
+        }
+        const claimedSum = (txid) => claimsByParent.get(txid).reduce((sum, utxo) => sum + utxo.satoshis, 0n);
+        const rankedParents = [...claimsByParent.keys()].sort((a, b) => {
+          const diff = claimedSum(b) - claimedSum(a);
+          if (diff !== 0n) {
+            return diff > 0n ? 1 : -1;
+          }
+          return a < b ? -1 : a > b ? 1 : 0;
+        });
+        const parentTxids = rankedParents.slice(0, MAX_CLASSIFIED_PARENTS);
+        const skippedParents = rankedParents.length - parentTxids.length;
+        if (skippedParents > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${skippedParents} parent tx(s) beyond the ${MAX_CLASSIFIED_PARENTS}-parent classification budget excluded (mempool-spam bound; largest claimed value classified first)`
+          );
+        }
+        const verdicts = await mapWithConcurrency(
+          parentTxids,
+          CLASSIFICATION_CONCURRENCY,
+          async (parentTxid) => ({
+            parentTxid,
+            verified: await this.verifyParentIsSelfSpendConsensus(
+              parentTxid,
+              claimsByParent.get(parentTxid),
+              cleanVaultAddress,
+              minConfirmations,
+              providerConfigs,
+              readers
+            )
+          })
+        );
+        const verifiedParents = new Set(
+          verdicts.filter((v) => v.verified).map((v) => v.parentTxid)
+        );
+        for (const utxo of unconfirmed) {
+          if (verifiedParents.has(utxo.txid)) {
+            selfChange.add(`${utxo.txid}:${utxo.vout}`);
+          }
+        }
+        if (verifiedParents.size > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${selfChange.size}/${unconfirmed.length} unconfirmed UTXO(s) verified as protocol change by ${providerConfigs.length} provider(s)`
+          );
+        }
+        return selfChange;
+      }
+      /**
+       * Run the self-spend proof against every configured provider and require
+       * unanimity. Fail-closed: a provider request failure or a verdict
+       * disagreement throws and aborts the balance calculation — see
+       * classifySelfChange for why exclusion is not a safe fallback here.
+       *
+       * When the parent IS a unanimous self-spend, every provider's view of the
+       * parent's OUTPUTS must additionally corroborate the primary's claimed
+       * UTXOs (index exists, pays the vault, exact value). Without this, a
+       * compromised primary could attach a fabricated or value-inflated output
+       * to a genuine self-spend the honest providers happily verify.
+       *
+       * @returns True when every provider verified the parent and corroborated
+       *          the claimed outputs, false when every provider rejected the
+       *          parent (genuine third-party deposit)
+       */
+      async verifyParentIsSelfSpendConsensus(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, providerConfigs, readers) {
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          providerConfigs.map(
+            (cfg, i) => this.evaluateParentForProvider(
+              parentTxid,
+              claimedUtxos,
+              cleanVaultAddress,
+              minConfirmations,
+              readers[i],
+              cfg
+            )
+          )
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Self-change classification failed for tx ${parentTxid} on ${failures.length}/${providerConfigs.length} provider(s): ${failures.join("; ")}`
+          );
+        }
+        const evaluations = settled.map(
+          (r) => r.value
+        );
+        const votes = evaluations.map((e) => e.selfSpend);
+        const disagreements = votes.map((vote, i) => ({ vote, name: providerName(i) })).filter((x) => x.vote !== votes[0]).map(
+          (x) => `${providerName(0)}=${votes[0]} vs ${x.name}=${x.vote}`
+        );
+        if (disagreements.length > 0) {
+          throw new Error(
+            `Self-change consensus mismatch for tx ${parentTxid}: ${disagreements.join("; ")}. A provider may be compromised or out of sync; refusing to sign.`
+          );
+        }
+        if (!votes[0]) {
+          return false;
+        }
+        const outputMismatches = evaluations.map((e, i) => e.outputMismatch ? `${providerName(i)} \u2192 ${e.outputMismatch}` : null).filter((m) => m !== null);
+        if (outputMismatches.length > 0) {
+          throw new Error(
+            `Self-change output claim mismatch for tx ${parentTxid}: ${outputMismatches.join("; ")}. The reported UTXO set contradicts the parent transaction; refusing to sign.`
+          );
+        }
+        return true;
+      }
+      /**
+       * Single provider's evaluation of a parent tx: the self-spend proof plus —
+       * when the proof holds — corroboration of the claimed outputs against this
+       * provider's view of the parent's vout set. The output check is skipped for
+       * non-self-spend parents (their UTXOs are excluded regardless, and a
+       * third-party deposit's values are not ours to police).
+       */
+      async evaluateParentForProvider(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, reader, providerConfig) {
+        const parentTx = await this.fetchParentTransaction(
+          parentTxid,
+          providerConfig
+        );
+        if (!parentTx || parentTx.inputs.length === 0) {
+          return { selfSpend: false, outputMismatch: null };
+        }
+        const selfSpend = await this.verifyInputsAreSelfSpend(
+          parentTx.inputs,
+          cleanVaultAddress,
+          minConfirmations,
+          reader
+        );
+        const outputMismatch = selfSpend ? findOutputClaimMismatch(claimedUtxos, parentTx.outputs, cleanVaultAddress) : null;
+        return { selfSpend, outputMismatch };
+      }
+      /**
+       * Verify that a transaction's inputs spend exclusively vault-owned,
+       * confirmed outputs, using a single provider's view of the chain.
+       *
+       * @param inputs - Parsed inputs of the parent transaction
+       * @param cleanVaultAddress - Vault address with network prefix stripped
+       * @param minConfirmations - Required depth for every funding transaction
+       * @param reader - Data provider for funding-tx lookups (same provider the inputs came from)
+       * @returns True only when every input is a confirmed, vault-owned outpoint
+       */
+      async verifyInputsAreSelfSpend(inputs, cleanVaultAddress, minConfirmations, reader) {
+        const fundingTxids = [...new Set(inputs.map((input) => input.txid))];
+        const outputsByFundingTx = /* @__PURE__ */ new Map();
+        const needsOutputLookup = fundingTxids.filter(
+          (fundingTxid) => inputs.some(
+            (input) => input.txid === fundingTxid && input.prevoutAddress === void 0
+          )
+        );
+        await Promise.all(
+          needsOutputLookup.map(async (fundingTxid) => {
+            outputsByFundingTx.set(
+              fundingTxid,
+              await reader.getTransactionOutputs(fundingTxid)
+            );
+          })
+        );
+        for (const input of inputs) {
+          let ownerAddress = input.prevoutAddress;
+          if (ownerAddress === void 0) {
+            const outputs = outputsByFundingTx.get(input.txid);
+            ownerAddress = outputs?.find(
+              (output) => output.index === input.vout
+            )?.scriptpubkey_address;
+          }
+          if (ownerAddress !== cleanVaultAddress) {
+            return false;
+          }
+        }
+        const fundingStatuses = await Promise.all(
+          fundingTxids.map((fundingTxid) => reader.getTransaction(fundingTxid))
+        );
+        for (const status of fundingStatuses) {
+          if (!status || status.confirmations < minConfirmations) {
+            return false;
+          }
+        }
+        return true;
+      }
+      /**
+       * Fetch a parent transaction's inputs (vins) and outputs (vouts) via Esplora.
+       *
+       * A module-private fetch (not a `BitcoinDataProvider` method) so editing this
+       * consensus logic does not rebundle the shared provider module's other
+       * importers — see this file's header for the ripple-set constraint.
+       *
+       * @param txid - Transaction ID
+       * @param providerConfig - Esplora endpoint to query (one of the configured
+       *          consensus providers)
+       * @returns Parsed inputs + outputs, or null ONLY when the tx is provably not
+       *          a self-spend candidate (coinbase-funded). Provider inability —
+       *          404, malformed vin rows, missing vin array — THROWS (review
+       *          2026-07-15 P1): the parent of a UTXO the primary lists must
+       *          exist, so "can't fetch it" is a provider failure, and treating it
+       *          as a false self-change vote would silently deflate collateral
+       *          (wrongful-liquidation direction) if every provider failed the
+       *          same way.
+       */
+      async fetchParentTransaction(txid, providerConfig) {
+        if (!providerConfig.providerUrl) {
+          return null;
+        }
+        const timeout = providerConfig.timeout || 15e3;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+          const response = await fetch(`${providerConfig.providerUrl}/tx/${txid}`, {
+            signal: controller.signal,
+            headers: await authHeaders(providerConfig.auth, timeout)
+          });
+          if (!response.ok) {
+            if (response.status === 404) {
+              throw new Error(
+                `parent tx ${txid} not found on this provider \u2014 cannot verify the self-change proof`
+              );
+            }
+            throw new Error(
+              `Bitcoin provider error: ${response.status} ${response.statusText}`
+            );
+          }
+          const data = await response.json();
+          if (!data.vin || !Array.isArray(data.vin) || data.vin.length === 0) {
+            throw new Error(
+              `provider returned tx ${txid} without a vin array \u2014 malformed response`
+            );
+          }
+          const inputs = [];
+          for (const vin of data.vin) {
+            if (vin.is_coinbase) {
+              return null;
+            }
+            if (vin.txid === void 0 || vin.vout === void 0) {
+              throw new Error(
+                `provider returned tx ${txid} with a malformed vin row (missing txid/vout)`
+              );
+            }
+            inputs.push({
+              txid: vin.txid,
+              vout: vin.vout,
+              prevoutAddress: vin.prevout?.scriptpubkey_address
+            });
+          }
+          const outputs = Array.isArray(data.vout) ? data.vout.map((vout, index) => ({
+            index,
+            scriptpubkey_address: vout?.scriptpubkey_address,
+            value: typeof vout?.value === "number" ? BigInt(vout.value) : void 0
+          })) : [];
+          return { inputs, outputs };
+        } catch (error) {
+          if (isAbortError(error)) {
+            throw new Error(`Request timeout after ${timeout}ms`);
+          }
+          throw error;
+        } finally {
+          clearTimeout(timeoutId);
+        }
+      }
+    };
     var VaultBalanceModule = class {
       constructor(config) {
+        if (!Number.isInteger(config.minConfirmations) || config.minConfirmations < 1) {
+          throw new Error(
+            `VaultBalanceModule: minConfirmations must be a positive integer (got ${config.minConfirmations}). Pass the policy-derived balance-confirmation threshold \u2014 there is no default.`
+          );
+        }
         this.config = config;
         this.bitcoinProvider = config.bitcoinProvider;
       }
       /**
-       * Calculate balance (fast path - no UTXO validation)
+       * Calculate balance (arithmetic only - no UTXO validation)
        *
-       * Fast balance-only calculation that skips UTXO validation.
-       * Uses simple arithmetic: Total Balance - Authorized Balance = Available Balance
+       * Balance-only calculation: Total Balance - Authorized Balance = Available.
        *
-       * Use this when you only need the balance amount and don't need:
-       * - Individual UTXO details
-       * - Validation that authorized UTXOs were actually spent
+       * ⚠️ SECURITY (remediation P1/#5): this result skips UTXO validation, the
+       * confirmed-consensus gate, and self-change proofing. It must NEVER feed a
+       * signed BalanceConfirmation or any authorization decision. No production
+       * action calls it (the `skipUTXOValidation` fast path that used to route
+       * here was deleted); it exists for read-only diagnostics and tests. Adding
+       * a production caller requires Master sign-off.
        *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
@@ -4116,17 +4719,18 @@ ${auth.clientId}`;
        * 1. Authorized transaction not found on network (not broadcasted)
        * 2. Authorized transaction has insufficient confirmations (network updating)
        *
+       * NOTE: the `skipUTXOValidation` fast path was removed (remediation P1/#5).
+       * Every trusted-balance read runs full UTXO validation + consensus; a
+       * balance that skipped validation must never feed a signed
+       * BalanceConfirmation.
+       *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
-       * @param skipUTXOValidation - If true, use fast balance-only path (skips UTXO validation)
        * @returns Complete breakdown of vault balance
        * @throws Error if authorized spends are in invalid state
        */
-      async calculateTrustedBalance(positionId, vaultAddress, skipUTXOValidation) {
-        if (skipUTXOValidation) {
-          return await this.calculateBalance(positionId, vaultAddress);
-        }
-        const minConfirmations = this.config.minConfirmations || 6;
+      async calculateTrustedBalance(positionId, vaultAddress) {
+        const minConfirmations = this.config.minConfirmations;
         const utxoSet = await this.bitcoinProvider.getUTXOSet(
           vaultAddress,
           minConfirmations
@@ -4146,8 +4750,25 @@ ${auth.clientId}`;
           (sum, spend) => sum + spend.satoshis,
           0n
         );
+        const consensus = new VaultBalanceConsensus(
+          this.bitcoinProvider,
+          this.config.bitcoinProviderConfigs,
+          // Absent ⇒ 1: dev/test constructions without a policy keep the
+          // single-provider baseline; validators pass policy.minConsensusProviders.
+          this.config.minConsensusProviders ?? 1
+        );
+        const confirmedConsensusKeys = await consensus.confirmedUtxoConsensus(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
+        const selfChangeKeys = await consensus.classifySelfChange(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
         const availableUTXOs = utxoSet.utxos.filter(
-          (utxo) => !this.isUTXOAuthorized(utxo, authorizedSpends)
+          (utxo) => (confirmedConsensusKeys.has(`${utxo.txid}:${utxo.vout}`) || selfChangeKeys.has(`${utxo.txid}:${utxo.vout}`)) && !this.isUTXOAuthorized(utxo, authorizedSpends)
         );
         const availableBalance = availableUTXOs.reduce(
           (sum, utxo) => sum + utxo.satoshis,
@@ -4379,14 +5000,84 @@ ${auth.clientId}`;
     function createVaultBalanceModule(config) {
       return new VaultBalanceModule(config);
     }
+    var POLICY_BY_CHAIN = {
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: {
+        chain: "hardhat",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        allowArbitraryBitcoinProvider: true,
+        allowArbitraryEvmRpc: true,
+        allowDevSinglePriceProvider: true,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: {
+        chain: "sepolia",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: {
+        chain: "ethereum",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 6,
+        minBitcoinSpendConfirmations: 6,
+        minConsensusProviders: 2
+      }
+    };
+    function getChainPolicy(chain) {
+      const validated = validateChain(chain);
+      const policy = POLICY_BY_CHAIN[validated];
+      if (!policy) {
+        throw new Error(`No chain policy registered for "${chain}"`);
+      }
+      return policy;
+    }
     async function executeVaultSnapshot(params) {
       global.ethers = {
-        ...import_ethers15.ethers,
+        ...import_ethers16.ethers,
         providers: {
-          StaticJsonRpcProvider: import_ethers15.ethers.JsonRpcProvider
+          StaticJsonRpcProvider: import_ethers16.ethers.JsonRpcProvider
         },
-        Contract: import_ethers15.ethers.Contract,
-        utils: import_ethers15.ethers
+        Contract: import_ethers16.ethers.Contract,
+        utils: import_ethers16.ethers
         // v6 moved utils to top level
       };
       global.Lit = {
@@ -4423,7 +5114,7 @@ ${auth.clientId}`;
         // Default to mainnet if not provided
         rpcUrl: params.rpcUrl,
         bitcoinProvider,
-        minConfirmations: params.minConfirmations || 6
+        minConfirmations: params.minConfirmations ?? getChainPolicy(params.chain).minBitcoinBalanceConfirmations
       });
       const vaultSnapshot = createVaultSnapshotModule({
         contractAddress: params.contractAddress,
@@ -4657,7 +5348,8 @@ function getSepoliaConfig() {
       contractVersionRegistry: SEPOLIA_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: SEPOLIA_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: SEPOLIA_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: SEPOLIA_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       // Lazy getter for the same module-init snapshot reason as serviceEndpoint.
@@ -4697,7 +5389,8 @@ function getMainnetConfig() {
       contractVersionRegistry: MAINNET_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: MAINNET_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: MAINNET_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: MAINNET_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       diamondHandsUrl: "https://gateway-arbitrum.network.thegraph.com/api/subgraphs/id/CCTPsdYqco2jChDLLBQTbdJWwoukVoMt1cXeR9ti6r9A"
@@ -4837,7 +5530,7 @@ var init_network_configs = __esm({
 });
 
 // src/modules/diamond-hands-sdk.ts
-import { Contract as Contract6, Interface as Interface4, JsonRpcProvider, AbiCoder, keccak256 as keccak2565, solidityPackedKeccak256 as solidityPackedKeccak2564, toUtf8Bytes as toUtf8Bytes5, zeroPadValue as zeroPadValue4, toBeHex as toBeHex2, parseEther, formatEther, formatUnits, computeAddress, Signature, ZeroHash, ZeroAddress as ZeroAddress3, MaxUint256 } from "ethers";
+import { Contract as Contract6, Interface as Interface4, JsonRpcProvider, AbiCoder as AbiCoder2, keccak256 as keccak2565, solidityPackedKeccak256 as solidityPackedKeccak2564, toUtf8Bytes as toUtf8Bytes5, getBytes as getBytes4, zeroPadValue as zeroPadValue4, toBeHex as toBeHex2, parseEther, formatEther, formatUnits, computeAddress, Signature, ZeroHash, ZeroAddress as ZeroAddress3, MaxUint256 } from "ethers";
 
 // src/types/result.ts
 function success(value) {
@@ -5221,22 +5914,12 @@ var SDKError = class _SDKError extends Error {
 
 // src/utils/chunks/eip1559-broadcast.utils.ts
 import { parseUnits } from "ethers";
-var MINT_UCD_GAS_CEILING = BigInt(2e6);
+var MINT_UCD_GAS_CEILING = BigInt(13e5);
 var WITHDRAW_BTC_GAS_CEILING = BigInt(3e6);
 var MAKE_PAYMENT_GAS_CEILING = BigInt(1e6);
 var EXTEND_POSITION_GAS_CEILING = BigInt(1e6);
 var LIQUIDATION_COMMIT_GAS_CEILING = BigInt(1e6);
 var LIQUIDATION_REVEAL_GAS_CEILING = BigInt(2e6);
-var MINT_UCD_ESTIMATE_MARGIN_BPS = 2500;
-async function estimateContractCallGasWithMargin(provider, from, to, data, marginBps, ceiling) {
-  try {
-    const estimated = await provider.estimateGas({ from, to, data });
-    const withMargin = estimated * BigInt(1e4 + marginBps) / 10000n;
-    return withMargin > ceiling ? ceiling : withMargin;
-  } catch {
-    return null;
-  }
-}
 async function resolveEip1559FeeFields(provider) {
   const feeData = await provider.getFeeData();
   let maxFeePerGas = feeData.maxFeePerGas ?? void 0;
@@ -5744,21 +6427,117 @@ async function buildSignedLoginPayload(signer, chainId, audience) {
   return { chainId, message, signature };
 }
 
+// src/utils/server-session-store.ts
+var REAUTH_WINDOW_SECONDS = 24 * 60 * 60;
+var SAFETY_MARGIN_SECONDS = 5 * 60;
+var STORE_PREFIX = "dh-server-session:";
+function sessionStoreKey(address, chainId, endpoint) {
+  return STORE_PREFIX + `${address.trim().toLowerCase()}:${chainId}:${endpoint.replace(/\/+$/, "")}`;
+}
+function isPayloadShape(value) {
+  return !!value && typeof value === "object" && typeof value.chainId === "number" && typeof value.signature === "string" && !!value.message && typeof value.message.address === "string" && typeof value.message.issuedAt === "number" && typeof value.message.nonce === "string";
+}
+function isPersistedShape(value) {
+  return !!value && typeof value === "object" && value.version === 1 && typeof value.address === "string" && typeof value.chainId === "number" && typeof value.endpoint === "string" && isPayloadShape(value.payload) && (value.token === void 0 || typeof value.token === "string") && (value.tokenExpiresAt === void 0 || typeof value.tokenExpiresAt === "number");
+}
+var LocalStorageSessionStore = class {
+  load(key) {
+    let raw;
+    try {
+      raw = window.localStorage.getItem(key);
+    } catch {
+      return null;
+    }
+    if (!raw)
+      return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      this.clear(key);
+      return null;
+    }
+    if (!isPersistedShape(parsed)) {
+      this.clear(key);
+      return null;
+    }
+    return parsed;
+  }
+  save(key, session) {
+    try {
+      window.localStorage.setItem(key, JSON.stringify(session));
+    } catch {
+    }
+  }
+  clear(key) {
+    try {
+      window.localStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+var MemorySessionStore = class {
+  entries = /* @__PURE__ */ new Map();
+  load(key) {
+    return this.entries.get(key) ?? null;
+  }
+  save(key, session) {
+    this.entries.set(key, session);
+  }
+  clear(key) {
+    this.entries.delete(key);
+  }
+};
+function localStorageUsable() {
+  try {
+    if (typeof window === "undefined" || !window.localStorage)
+      return false;
+    const probe = "__dh_server_session_probe__";
+    window.localStorage.setItem(probe, "1");
+    window.localStorage.removeItem(probe);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDefaultSessionStore() {
+  return localStorageUsable() ? new LocalStorageSessionStore() : new MemorySessionStore();
+}
+
 // src/utils/server-session.ts
 var REFRESH_LEEWAY_SECONDS = 30;
+var ServerLoginError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "ServerLoginError";
+  }
+};
+function isLoginRejection(error) {
+  return error instanceof ServerLoginError && error.status >= 400 && error.status < 500 && error.status !== 429;
+}
 var ServerSession = class {
   signer;
   serviceEndpoint;
   chainId;
+  store;
+  onSignaturePrompt;
   now;
   fetchImpl;
   cached = null;
   inFlight = null;
+  /**
+   * Store key for the current signer, memoized on first use so the sync
+   * `clear()` can drop the persisted token without an async address lookup.
+   */
+  lastStoreKey = null;
   constructor(opts) {
     assertSafeServiceEndpoint(opts.serviceEndpoint);
     this.signer = opts.signer;
     this.serviceEndpoint = opts.serviceEndpoint.replace(/\/+$/, "");
     this.chainId = opts.chainId;
+    this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
+    this.onSignaturePrompt = opts.onSignaturePrompt;
     this.now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
     this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
   }
@@ -5771,19 +6550,56 @@ var ServerSession = class {
   async getAuthHeader() {
     return { Authorization: `Bearer ${await this.getValidToken()}` };
   }
-  /** Drop the cached token (e.g. on 401 from server). Next call re-logs in. */
+  /**
+   * Drop the cached token (e.g. on 401 from server). The persisted envelope is
+   * kept — the next call re-mints silently — but its stored token copy is
+   * dropped too so a dead JWT can't be re-adopted from the store.
+   */
   clear() {
     this.cached = null;
     this.inFlight = null;
+    if (!this.store || !this.lastStoreKey)
+      return;
+    const persisted = this.store.load(this.lastStoreKey);
+    if (persisted?.token) {
+      this.store.save(this.lastStoreKey, {
+        ...persisted,
+        token: void 0,
+        tokenExpiresAt: void 0
+      });
+    }
+  }
+  /**
+   * Drop the session AND the persisted re-mint envelope (wallet disconnect /
+   * explicit sign-out paths — anything that must remove the 24h credential
+   * from storage).
+   */
+  async clearPersisted() {
+    this.cached = null;
+    this.inFlight = null;
+    if (!this.store)
+      return;
+    if (this.lastStoreKey) {
+      this.store.clear(this.lastStoreKey);
+      return;
+    }
+    try {
+      const address = (await this.signer.getAddress()).toLowerCase();
+      this.store.clear(
+        sessionStoreKey(address, this.chainId, this.serviceEndpoint)
+      );
+    } catch {
+    }
   }
   /**
-   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`).
-   * Clears the local cache regardless of server response so the client stops
-   * presenting the token.
+   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`)
+   * — which also tombstones the envelope's re-mint window server-side — and
+   * remove the persisted credential locally. Clears the local cache regardless
+   * of server response so the client stops presenting the token.
    */
   async logout() {
     const token = this.cached?.token ?? await this.getValidToken().catch(() => null);
-    this.clear();
+    await this.clearPersisted();
     if (!token)
       return;
     const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/logout`, {
@@ -5806,41 +6622,116 @@ var ServerSession = class {
       return this.inFlight;
     this.inFlight = (async () => {
       try {
+        const persisted = await this.loadPersisted();
+        if (persisted) {
+          if (persisted.token && typeof persisted.tokenExpiresAt === "number" && persisted.tokenExpiresAt - REFRESH_LEEWAY_SECONDS > this.now()) {
+            this.cached = {
+              token: persisted.token,
+              expiresAt: persisted.tokenExpiresAt
+            };
+            return this.cached;
+          }
+          try {
+            const session2 = await this.login(persisted.payload);
+            this.persist(persisted.payload, session2);
+            this.cached = session2;
+            return session2;
+          } catch (error) {
+            if (!isLoginRejection(error))
+              throw error;
+            if (this.store && this.lastStoreKey) {
+              this.store.clear(this.lastStoreKey);
+            }
+          }
+        }
+        this.onSignaturePrompt?.();
         const payload = await buildSignedLoginPayload(
           this.signer,
           this.chainId,
           this.serviceEndpoint
         );
-        const res = await this.fetchImpl(
-          `${this.serviceEndpoint}/api/auth/login`,
-          {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload)
-          }
-        );
-        if (!res.ok) {
-          const detail = await res.text().catch(() => "");
-          throw new Error(
-            `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`
-          );
-        }
-        const body = await res.json();
-        if (!body?.token || !body?.expiresAt) {
-          throw new Error("lit-ops-server login returned malformed response");
-        }
-        this.cached = { token: body.token, expiresAt: body.expiresAt };
-        return this.cached;
+        const session = await this.login(payload);
+        this.persist(payload, session);
+        this.cached = session;
+        return session;
       } finally {
         this.inFlight = null;
       }
     })();
     return this.inFlight;
   }
+  async login(payload) {
+    const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new ServerLoginError(
+        `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`,
+        res.status
+      );
+    }
+    const body = await res.json();
+    if (!body?.token || !body?.expiresAt) {
+      throw new Error("lit-ops-server login returned malformed response");
+    }
+    return { token: body.token, expiresAt: body.expiresAt };
+  }
+  /**
+   * Load the persisted session for the current signer, validating that it
+   * belongs to this address/chain/endpoint and that the envelope is still
+   * inside the re-auth window (with a safety margin). Invalid or expired
+   * entries are evicted.
+   */
+  async loadPersisted() {
+    if (!this.store)
+      return null;
+    try {
+      const address = (await this.signer.getAddress()).toLowerCase();
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      const persisted = this.store.load(key);
+      if (!persisted)
+        return null;
+      const withinWindow = this.now() < persisted.payload.message.issuedAt + REAUTH_WINDOW_SECONDS - SAFETY_MARGIN_SECONDS;
+      if (persisted.address !== address || persisted.chainId !== this.chainId || persisted.endpoint !== this.serviceEndpoint || persisted.payload.message.address.toLowerCase() !== address || !withinWindow) {
+        this.store.clear(key);
+        return null;
+      }
+      return persisted;
+    } catch {
+      return null;
+    }
+  }
+  /** Best-effort save of the envelope + live JWT for silent recovery. */
+  persist(payload, session) {
+    if (!this.store)
+      return;
+    const address = payload.message.address.toLowerCase();
+    try {
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      this.store.save(key, {
+        version: 1,
+        address,
+        chainId: this.chainId,
+        endpoint: this.serviceEndpoint,
+        payload,
+        token: session.token,
+        tokenExpiresAt: session.expiresAt
+      });
+    } catch {
+    }
+  }
 };
 
 // src/utils/quantum-revert.utils.ts
+import { AbiCoder } from "ethers";
 var DEAD_ZONE_VIOLATION_SELECTOR = "0xbe4b82c1";
+var ERROR_STRING_SELECTOR = "0x08c379a0";
+var PANIC_SELECTOR = "0x4e487b71";
 var QUANTUM_REVERT_NAMES = {
   "0xbe4b82c1": "DeadZoneViolation()",
   "0x137f3b70": "InDeadZone()",
@@ -5864,14 +6755,128 @@ function decodeQuantumRevert(e) {
   e?.error?.data?.data ?? e?.error?.data ?? e?.error?.error?.data;
   const data = typeof raw === "string" && raw.startsWith("0x") ? raw : null;
   const selector = data && data.length >= 10 ? data.slice(0, 10) : null;
-  const name = selector ? QUANTUM_REVERT_NAMES[selector] ?? null : null;
+  let name = selector ? QUANTUM_REVERT_NAMES[selector] ?? null : null;
+  if (!name && selector && data) {
+    try {
+      if (selector === ERROR_STRING_SELECTOR) {
+        const [message] = AbiCoder.defaultAbiCoder().decode(
+          ["string"],
+          "0x" + data.slice(10)
+        );
+        name = `Error("${message}")`;
+      } else if (selector === PANIC_SELECTOR) {
+        const [code] = AbiCoder.defaultAbiCoder().decode(
+          ["uint256"],
+          "0x" + data.slice(10)
+        );
+        name = `Panic(0x${code.toString(16)})`;
+      }
+    } catch {
+    }
+  }
   return { data, selector, name };
 }
 
+// src/utils/quantum-submission.utils.ts
+var MAX_DEADZONE_RESIMULATIONS = 3;
+var QuantumRevertError = class extends Error {
+  constructor(errorName, selector, data, cause) {
+    super(
+      `Pre-send simulation reverted: ${errorName ?? selector ?? "unknown"}`
+    );
+    this.errorName = errorName;
+    this.selector = selector;
+    this.data = data;
+    this.cause = cause;
+    this.name = "QuantumRevertError";
+  }
+};
+async function assertSafeQuantumSubmission(opts) {
+  const { provider, to, from, data, quantumTimestamp } = opts;
+  const maxResimulations = opts.maxResimulations ?? MAX_DEADZONE_RESIMULATIONS;
+  const now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
+  const onDebug = opts.onDebug ?? (() => {
+  });
+  const gateOpts = {
+    now,
+    ...opts.sleep ? { sleep: opts.sleep } : {}
+  };
+  await awaitSafeSubmissionWindow(quantumTimestamp, gateOpts);
+  for (let sim = 1; ; sim++) {
+    try {
+      await provider.call({ to, from, data });
+      break;
+    } catch (simError) {
+      const decoded = decodeQuantumRevert(simError);
+      if (decoded.selector === DEAD_ZONE_VIOLATION_SELECTOR && sim <= maxResimulations) {
+        const sigQuantum = Math.floor(quantumTimestamp / QUANTUM_WINDOW_SECONDS) * QUANTUM_WINDOW_SECONDS;
+        const realCurrentQuantum = Math.floor(now() / QUANTUM_WINDOW_SECONDS) * QUANTUM_WINDOW_SECONDS;
+        if (sigQuantum === realCurrentQuantum) {
+          onDebug(
+            "\u21AA\uFE0F  Simulated DeadZoneViolation is a stale-latest-block artifact (signature is the current quantum) \u2014 proceeding to broadcast"
+          );
+          break;
+        }
+        const gate = await awaitSafeSubmissionWindow(quantumTimestamp, gateOpts);
+        if (gate.waited) {
+          onDebug(
+            `\u{1F501} Re-simulating after crossing the quantum boundary (attempt ${sim}/${maxResimulations})`
+          );
+          continue;
+        }
+      }
+      if (!decoded.data) {
+        const label = simError instanceof Error ? simError.message : String(simError);
+        onDebug(
+          `\u26A0\uFE0F  Pre-send simulation failed without revert data (${label}) \u2014 proceeding to broadcast`
+        );
+        break;
+      }
+      throw new QuantumRevertError(
+        decoded.name,
+        decoded.selector,
+        decoded.data,
+        simError
+      );
+    }
+  }
+  await awaitSafeSubmissionWindow(quantumTimestamp, gateOpts);
+}
+
 // src/utils/btc-withdrawal-message.ts
 import { keccak256 as keccak2563, toUtf8Bytes as toUtf8Bytes3, solidityPackedKeccak256 as solidityPackedKeccak2563, getBytes as getBytes3, zeroPadValue } from "ethers";
 var QUANTUM_SECONDS = 60;
 var QUANTUM_SAFE_THRESHOLD = 40;
+function hashBtcInputSet(utxos) {
+  if (!Array.isArray(utxos) || utxos.length === 0) {
+    throw new Error("hashBtcInputSet: at least one input is required");
+  }
+  const normalized = utxos.map((u) => {
+    const txid = String(u.txid).toLowerCase().replace(/^0x/, "");
+    const vout = Number(u.vout);
+    const value = Number(u.value);
+    if (!/^[0-9a-f]{64}$/.test(txid)) {
+      throw new Error(`hashBtcInputSet: invalid txid "${u.txid}"`);
+    }
+    if (!Number.isSafeInteger(vout) || vout < 0) {
+      throw new Error(`hashBtcInputSet: invalid vout ${u.vout} for ${txid}`);
+    }
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new Error(`hashBtcInputSet: invalid value ${u.value} for ${txid}:${vout}`);
+    }
+    return { txid, vout, value };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const u of normalized) {
+    const key = `${u.txid}:${u.vout}`;
+    if (seen.has(key)) {
+      throw new Error(`hashBtcInputSet: duplicate outpoint ${key}`);
+    }
+    seen.add(key);
+  }
+  const canonical = normalized.sort((a, b) => a.txid < b.txid ? -1 : a.txid > b.txid ? 1 : a.vout - b.vout).map((u) => `${u.txid}:${u.vout}:${u.value}`).join("|");
+  return keccak2563(toUtf8Bytes3(canonical));
+}
 async function buildBtcExecuteEnvelope(params) {
   const {
     positionId,
@@ -5892,6 +6897,17 @@ async function buildBtcExecuteEnvelope(params) {
       "buildBtcExecuteEnvelope: targetAmount must be a positive number of satoshis"
     );
   }
+  const utxos = params.utxos && params.utxos.length > 0 ? params.utxos : [{ txid, vout, value: satoshis }];
+  const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+  const authorizedInSet = utxos.some(
+    (u) => normTxid(u.txid) === normTxid(txid) && Number(u.vout) === Number(vout)
+  );
+  if (!authorizedInSet) {
+    throw new Error(
+      `buildBtcExecuteEnvelope: the authorized UTXO ${txid}:${vout} must be part of utxos[]`
+    );
+  }
+  const utxosHash = hashBtcInputSet(utxos);
   const nowSec = Date.now() / 1e3;
   const currentQuantumStart = Math.floor(nowSec / QUANTUM_SECONDS) * QUANTUM_SECONDS;
   const secsIntoQuantum = nowSec - currentQuantumStart;
@@ -5928,6 +6944,8 @@ async function buildBtcExecuteEnvelope(params) {
       // targetAddress (BTC destination)
       "uint256",
       // targetAmount (sats authorized to recipient)
+      "bytes32",
+      // utxosHash (canonical hash of the FULL input set — P6/#8)
       "bytes32"
       // actionHash
     ],
@@ -5939,6 +6957,7 @@ async function buildBtcExecuteEnvelope(params) {
       networkFee,
       targetAddress,
       targetAmount,
+      utxosHash,
       actionHash
     ]
   );
@@ -5955,7 +6974,8 @@ async function buildBtcExecuteEnvelope(params) {
     chainId,
     timestamp,
     userSignature,
-    borrowerAddress
+    borrowerAddress,
+    utxos
   };
 }
 
@@ -8771,6 +9791,56 @@ var LoanQuery = class {
       })
     );
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   *
+   * Composes getUserPositions + getLoanEvents (the subgraph has no wallet-scoped
+   * event collection). Each returned LoanEvents carries its own positionId, so
+   * callers can flatten and merge into a single per-wallet timeline.
+   *
+   * Bitcoin deposits never appear in the subgraph — merge those in from an
+   * Esplora source on the consumer side.
+   *
+   * @param userAddress - Loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position (empty array if the wallet has none).
+   *
+   * @example
+   * ```typescript
+   * const result = await loanQuery.getWalletLoanEvents('0x830b...');
+   * if (result.success) {
+   *   const allEvents = result.value; // LoanEvents[] — one per position
+   * }
+   * ```
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    if (this.config.debug) {
+      log.info("\u{1F50D} Querying wallet loan events", { userAddress, filter });
+    }
+    return tryCatchAsync(
+      async () => {
+        const perPosition = await this.config.graphClient.getWalletLoanEvents(
+          userAddress,
+          filter
+        );
+        if (this.config.debug) {
+          log.info("\u2705 Retrieved wallet loan events", {
+            userAddress,
+            positions: perPosition.length,
+            totalEvents: perPosition.reduce((n, p) => n + p.totalEvents, 0)
+          });
+        }
+        return perPosition;
+      },
+      (error) => new SDKError({
+        message: "Failed to query wallet loan events",
+        category: "SUBGRAPH" /* SUBGRAPH */,
+        severity: "MEDIUM" /* MEDIUM */,
+        originalError: error instanceof Error ? error : new Error(String(error)),
+        context: { userAddress, filter }
+      })
+    );
+  }
   /**
    * Clear loan cache
    *
@@ -11512,6 +12582,39 @@ var DiamondHandsGraph = class {
       totalEvents
     };
   }
+  /**
+   * Get the full loan-event history for every position owned by a wallet.
+   *
+   * The subgraph has no wallet-scoped event collection (`User` only derives
+   * `positions`), so this composes the two existing wallet/position queries:
+   * `getUserPositions(wallet)` to enumerate the wallet's positions, then
+   * `getLoanEvents(positionId, filter)` per position. Each returned `LoanEvents`
+   * already carries its own `positionId`, so callers can flatten and merge into
+   * a single timeline.
+   *
+   * Note: Bitcoin deposits are UTXOs on the Bitcoin network and never appear in
+   * the EVM subgraph — surface those from an Esplora source and merge separately.
+   *
+   * @param userAddress - The loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position; empty array if the wallet has none.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    const { positions } = await this.getUserPositions(userAddress);
+    const positionIds = positions.map((p) => p?.id != null ? String(p.id) : "").filter((id) => id.length > 0);
+    if (positionIds.length === 0)
+      return [];
+    const CONCURRENCY = 5;
+    const results = [];
+    for (let i = 0; i < positionIds.length; i += CONCURRENCY) {
+      const batch = positionIds.slice(i, i + CONCURRENCY);
+      const settled = await Promise.all(
+        batch.map((positionId) => this.getLoanEvents(positionId, filter))
+      );
+      results.push(...settled);
+    }
+    return results;
+  }
   // ============================================================================
   // Protocol-wide Events
   // ============================================================================
@@ -14928,6 +16031,15 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       return {};
     return this.serverSession.getAuthHeader();
   }
+  /**
+   * Remove the persisted lit-ops-server session (the 24h re-mint envelope and
+   * its JWT) for the current auth signer. Call on wallet disconnect or
+   * explicit sign-out so the credential does not outlive the wallet
+   * connection. No-op in standalone mode.
+   */
+  async clearServerSession() {
+    await this.serverSession?.clearPersisted();
+  }
   /**
    * Audit H-9: invalidate the LoanQuery cache so subsequent reads return
    * the post-write state. We clear the entire loan-query cache (not just
@@ -15039,7 +16151,10 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       this.serverSession = new ServerSession({
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
-        chainId: config.chainId
+        chainId: config.chainId,
+        persistSession: config.sessionPersistence?.enabled,
+        sessionStore: config.sessionPersistence?.store,
+        onSignaturePrompt: config.onSessionSignaturePrompt
       });
     }
     const contractManagerResult = createContractManager({
@@ -16223,8 +17338,8 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
         throw new Error(`Position not found: ${request.positionId}`);
       }
       const currentDebt = position.ucdDebt.toString();
-      const ucdDebtHash = keccak2565(AbiCoder.defaultAbiCoder().encode(["uint256"], [currentDebt]));
-      const contractHash = keccak2565(AbiCoder.defaultAbiCoder().encode(
+      const ucdDebtHash = keccak2565(AbiCoder2.defaultAbiCoder().encode(["uint256"], [currentDebt]));
+      const contractHash = keccak2565(AbiCoder2.defaultAbiCoder().encode(
         ["address", "address", "address", "address"],
         [
           positionManagerAddress,
@@ -16235,263 +17350,55 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       ));
       if (this.config.debug) {
         log.info("\u{1F50D} DEBUG: Detailed Contract Call Parameters", {});
-        log.info("   === LIT Action Response ===", {});
-        log.info(
-          `   authorizedSpendsHash: ${validationResponse.authorizedSpendsHash}`,
-          {}
-        );
-        log.info(`   mintAmount: ${validationResponse.mintAmount}`, {});
-        log.info(`   mintFee: ${validationResponse.mintFee}`, {});
-        log.info(`   newDebt: ${validationResponse.newDebt}`, {});
-        log.info(`   newCollateral: ${validationResponse.newCollateral}`, {});
-        log.info(`   btcPrice: ${validationResponse.btcPrice}`, {});
-        log.info(
-          `   timestamp (quantumTimestamp): ${validationResponse.timestamp}`,
-          {}
-        );
-        log.info("   === SDK Calculated Hashes ===", {});
-        log.info(`   Current UCD Debt (from position): ${currentDebt}`, {});
-        log.info(`   ucdDebtHash: ${ucdDebtHash}`, {});
-        log.info("   === Contract Addresses for contractHash ===", {});
-        log.info(`   PositionManager: ${positionManagerAddress}`, {});
-        log.info(
-          `   LoanOpsManager: ${this.getContractAddressesOrThrow().loanOperationsManager}`,
-          {}
-        );
-        log.info(
-          `   TermManager: ${this.getContractAddressesOrThrow().termManager}`,
-          {}
-        );
-        log.info(
-          `   UCDController: ${this.getContractAddressesOrThrow().ucdController}`,
-          {}
-        );
-        log.info(`   contractHash: ${contractHash}`, {});
-        log.info("   === Signature ===", {});
-        log.info(
-          `   Signature (first 20 chars): ${finalSignature.substring(
-            0,
-            20
-          )}...`,
-          {}
-        );
-        log.info(`   Signature length: ${finalSignature.length}`, {});
-        log.info(
-          `   Final signature (first 50 chars): ${finalSignature ? finalSignature.substring(0, 50) : "EMPTY"}`,
-          {}
-        );
-        log.info(
-          `   Final signature is empty: ${!finalSignature || finalSignature.length === 0}`,
-          {}
-        );
-      }
-      if (this.config.debug) {
-        log.info("\u{1F50D} PREFLIGHT: Attempting diagnostic gas estimation...", {});
-      }
-      try {
-        const iface = new Interface4(positionManagerAbi);
-        const signatureHex = finalSignature.startsWith("0x") ? finalSignature : "0x" + finalSignature;
-        if (this.config.debug) {
-          log.info("\u{1F50D} DEBUG: Signature details:", {
-            finalSignature: finalSignature ? `${finalSignature.substring(0, 20)}... (length: ${finalSignature.length})` : "UNDEFINED/EMPTY",
-            signatureHex: signatureHex ? `${signatureHex.substring(0, 22)}... (length: ${signatureHex.length})` : "UNDEFINED/EMPTY"
-          });
-        }
-        const calldata = iface.encodeFunctionData("mintUCD", [
-          positionIdBytes32,
-          validationResponse.mintAmount,
-          validationResponse.mintFee,
-          validationResponse.newDebt,
-          validationResponse.newCollateral,
-          validationResponse.btcPrice,
-          validationResponse.authorizedSpendsHash,
-          ucdDebtHash,
-          contractHash,
-          validationResponse.timestamp,
-          signatureHex
-        ]);
-        if (this.config.debug) {
-          log.info("\u{1F50D} DEBUG: Encoded calldata:", {
-            length: calldata.length,
-            signaturePortion: calldata.substring(650, 670)
-          });
-        }
-        const provider = this.getSignerOrThrow().provider;
-        if (!provider) {
-          throw new Error("Provider not available");
-        }
-        const signerAddress = await this.getSignerOrThrow().getAddress();
-        if (this.config.debug) {
-          log.info("   Executing diagnostic eth_call...", {});
-        }
-        await provider.call({
-          to: positionManagerAddress,
-          from: signerAddress,
-          data: calldata
-        });
-        if (this.config.debug) {
-          log.info("   \u2705 Diagnostic eth_call succeeded!", {});
-        }
-      } catch (preflightError) {
-        if (this.config.debug) {
-          log.error(
-            "\u274C PREFLIGHT CHECK FAILED - Diagnostic eth_call reverted",
-            {}
-          );
-          log.error(`   Error message: ${preflightError?.message}`, {});
-          log.error(`   Error code: ${preflightError?.code}`, {});
-          log.error(`   Error data: ${preflightError?.data || "none"}`, {});
-          log.error(`   Error reason: ${preflightError?.reason || "none"}`, {});
-          log.error(
-            `   Error.error: ${JSON.stringify(preflightError?.error || {})}`,
-            {}
-          );
-        }
-        let errorData = preflightError?.data || preflightError?.info?.error?.data || preflightError?.error?.data?.data || preflightError?.error?.data || preflightError?.error?.error?.data;
-        const errorMessage = preflightError?.reason || preflightError?.error?.reason || preflightError?.error?.error?.reason || preflightError?.message || "Unknown error";
-        let requireMessage;
-        if (errorData && typeof errorData === "string" && errorData.startsWith("0x") && errorData.length > 138) {
-          try {
-            const errorSelector = errorData.slice(0, 10);
-            if (errorSelector === "0x08c379a0") {
-              const iface = new Interface4([
-                "function Error(string)"
-              ]);
-              const decoded = iface.decodeFunctionData("Error", errorData);
-              requireMessage = decoded[0];
-            }
-          } catch (e) {
-          }
-        }
-        const isDeadZonePreflightArtifact = decodeQuantumRevert(preflightError).selector === DEAD_ZONE_VIOLATION_SELECTOR;
-        if (isDeadZonePreflightArtifact) {
-          const nowSec = Math.floor(Date.now() / 1e3);
-          const sigQuantum2 = Math.floor(Number(validationResponse.timestamp) / 60) * 60;
-          const realCurrentQuantum = Math.floor(nowSec / 60) * 60;
-          if (sigQuantum2 === realCurrentQuantum) {
-            if (this.config.debug) {
-              log.info(
-                "\u21AA\uFE0F  Preflight DeadZoneViolation is a stale-latest-block artifact (signature is the current quantum) \u2014 proceeding to broadcast",
-                {}
-              );
-            }
-          } else {
-            if (this.config.debug) {
-              log.info(
-                "\u{1F501} Preflight DeadZoneViolation near the boundary \u2014 deferring across it, then proceeding",
-                {}
-              );
-            }
-            await awaitSafeSubmissionWindow(
-              Number(validationResponse.timestamp)
-            );
-          }
-        }
-        if (requireMessage && !isDeadZonePreflightArtifact) {
-          throw new Error(
-            `Preflight check failed - mintUCD would revert:
-${requireMessage}
-Context: Quantum timestamp=${validationResponse.timestamp}, Position=${request.positionId}`
-          );
-        }
-        if (errorData && typeof errorData === "string" && errorData.startsWith("0x") && errorData.length > 10) {
-          const selector = errorData.slice(0, 10);
-          const knownErrors = {
-            "0x8baa579f": "InvalidSignature()",
-            "0xd92e233d": "ValidationFailed()",
-            "0x3ee5aeb5": "OperationNotAuthorized()",
-            "0x70f4b32a": "UnauthorizedSigner()",
-            "0x48f5c3ed": "Unauthorized()",
-            "0x36bfdeea": "StateHashMismatch()",
-            "0x131d9a21": "QuantumExpired()",
-            "0x52ce5d58": "QuantumAlreadyUsed()",
-            "0x137f3b70": "InDeadZone()",
-            "0xbe4b82c1": "DeadZoneViolation()",
-            "0x3e76a3c9": "QuantumOutsideWindow()",
-            "0x62278171": "InvalidValidatorSignature()",
-            "0xb9d419a7": "DebtUpdateVerificationFailed()",
-            "0xc7e20553": "DebtUpdateVerificationFailedDetailed(bytes32,uint256,uint256,uint256,uint256,uint256)",
-            "0x0cfd2a97": "MintVerificationMismatch(uint256,uint256)",
-            "0x07637bd8": "MintFailed()"
-          };
-          const errorName = knownErrors[selector] || `Unknown error ${selector}`;
-          const mintDebtDiagnostics = selector === "0xb9d419a7" || selector === "0xc7e20553" || selector === "0x0cfd2a97" || selector === "0x07637bd8" ? `
-
-Mint/debt diagnostics (LoanOperationsManager mint path \u2192 increaseDebtFromMint):
-  positionId: ${request.positionId}
-  on-chain ucdDebt before tx: ${currentDebt}
-  Lit newDebt: ${validationResponse.newDebt}
-  Lit mintAmount: ${validationResponse.mintAmount}
-  Lit mintFee: ${validationResponse.mintFee}
-  Call path: mintUCD -> mintUCDWithAuthorization -> increaseDebtFromMint -> finalizeMintDebtIncrease
-  Contract expects UCD supply increase to match mintAmount+mintFee and debt update to newDebt.
-` : "";
-          let quantumContext = "";
-          if (selector === "0x131d9a21" || selector === "0x52ce5d58" || selector === "0x137f3b70" || selector === "0xbe4b82c1" || selector === "0x3e76a3c9") {
-            const currentTime2 = Math.floor(Date.now() / 1e3);
-            const currentQuantum = Math.floor(currentTime2 / 60) * 60;
-            const sigQuantum2 = Math.floor(validationResponse.timestamp / 60) * 60;
-            const timeDiff = currentTime2 - validationResponse.timestamp;
-            quantumContext = `
-
-Quantum Timing Analysis:
-  Signature created: ${validationResponse.timestamp} (${new Date(
-              validationResponse.timestamp * 1e3
-            ).toISOString()})
-  Current time: ${currentTime2} (${new Date(
-              currentTime2 * 1e3
-            ).toISOString()})
-  Time elapsed: ${timeDiff} seconds
-  Signature quantum: ${sigQuantum2}
-  Current quantum: ${currentQuantum}
-  Quantum window: 60 seconds
-  Status: ${sigQuantum2 < currentQuantum ? "\u274C EXPIRED - Signature created in older quantum window" : "\u2705 VALID"}
-  Note: QuantumOutsideWindow can also occur if the tx is mined outside the accepted past/current/next quantum set.`;
-          }
-          if (!isDeadZonePreflightArtifact) {
-            throw new Error(
-              `Preflight check failed - mintUCD would revert:
-Error: ${errorName}
-Selector: ${selector}
-Message: ${errorMessage}
-Data: ${errorData}${quantumContext}${mintDebtDiagnostics}`
-            );
-          }
-        } else {
-          const currentTime2 = Math.floor(Date.now() / 1e3);
-          const timeSinceSig = currentTime2 - validationResponse.timestamp;
-          const currentQuantum = Math.floor(currentTime2 / 60) * 60;
-          const sigQuantum2 = Math.floor(validationResponse.timestamp / 60) * 60;
-          throw new Error(
-            `Preflight check failed - mintUCD would revert:
-${errorMessage}
-
-Error Details:
-  Error data: ${errorData || "0x (empty - no custom error)"}
-  Error code: ${preflightError?.code || "none"}
-
-Quantum Timing Analysis:
-  Signature created: ${validationResponse.timestamp} (${new Date(
-              validationResponse.timestamp * 1e3
-            ).toISOString()})
-  Current time: ${currentTime2} (${new Date(
-              currentTime2 * 1e3
-            ).toISOString()})
-  Time elapsed: ${timeSinceSig} seconds
-  Signature quantum: ${sigQuantum2}
-  Current quantum: ${currentQuantum}
-  Status: ${sigQuantum2 < currentQuantum ? "\u274C EXPIRED - Signature too old" : "\u2705 VALID"}
-
-Possible Causes (when error data is empty):
-  \u2022 Quantum signature expired (current=${currentQuantum}, signature=${sigQuantum2})
-  \u2022 Contract paused or circuit breaker active
-  \u2022 Position state changed since LIT Action signed
-  \u2022 Authorization registry validation failed
-  \u2022 RPC provider not returning detailed revert data
-
-Position: ${request.positionId}`
-          );
-        }
+        log.info("   === LIT Action Response ===", {});
+        log.info(
+          `   authorizedSpendsHash: ${validationResponse.authorizedSpendsHash}`,
+          {}
+        );
+        log.info(`   mintAmount: ${validationResponse.mintAmount}`, {});
+        log.info(`   mintFee: ${validationResponse.mintFee}`, {});
+        log.info(`   newDebt: ${validationResponse.newDebt}`, {});
+        log.info(`   newCollateral: ${validationResponse.newCollateral}`, {});
+        log.info(`   btcPrice: ${validationResponse.btcPrice}`, {});
+        log.info(
+          `   timestamp (quantumTimestamp): ${validationResponse.timestamp}`,
+          {}
+        );
+        log.info("   === SDK Calculated Hashes ===", {});
+        log.info(`   Current UCD Debt (from position): ${currentDebt}`, {});
+        log.info(`   ucdDebtHash: ${ucdDebtHash}`, {});
+        log.info("   === Contract Addresses for contractHash ===", {});
+        log.info(`   PositionManager: ${positionManagerAddress}`, {});
+        log.info(
+          `   LoanOpsManager: ${this.getContractAddressesOrThrow().loanOperationsManager}`,
+          {}
+        );
+        log.info(
+          `   TermManager: ${this.getContractAddressesOrThrow().termManager}`,
+          {}
+        );
+        log.info(
+          `   UCDController: ${this.getContractAddressesOrThrow().ucdController}`,
+          {}
+        );
+        log.info(`   contractHash: ${contractHash}`, {});
+        log.info("   === Signature ===", {});
+        log.info(
+          `   Signature (first 20 chars): ${finalSignature.substring(
+            0,
+            20
+          )}...`,
+          {}
+        );
+        log.info(`   Signature length: ${finalSignature.length}`, {});
+        log.info(
+          `   Final signature (first 50 chars): ${finalSignature ? finalSignature.substring(0, 50) : "EMPTY"}`,
+          {}
+        );
+        log.info(
+          `   Final signature is empty: ${!finalSignature || finalSignature.length === 0}`,
+          {}
+        );
       }
       try {
         const coreAddress = this.getContractAddressesOrThrow().positionManagerCore;
@@ -16510,7 +17417,7 @@ Position: ${request.positionId}`
           positionIdBytes32
         );
         const currentDebtHash = keccak2565(
-          AbiCoder.defaultAbiCoder().encode(
+          AbiCoder2.defaultAbiCoder().encode(
             ["uint256"],
             [currentPosition.ucdDebt]
           )
@@ -16688,146 +17595,121 @@ Position: ${request.positionId}`
         signatureHexMint
       ]);
       const fromAddress = await signer.getAddress();
-      const estimatedGas = await estimateContractCallGasWithMargin(
-        signerProvider,
-        fromAddress,
-        positionManagerAddress,
-        mintCalldata,
-        MINT_UCD_ESTIMATE_MARGIN_BPS,
-        MINT_UCD_GAS_CEILING
-      );
-      let tx;
-      if (estimatedGas !== null) {
-        if (this.config.debug) {
-          log.info(
-            `\u{1F4DD} Broadcasting mintUCD (gasLimit=${estimatedGas.toString()})`,
-            {}
-          );
-        }
-        await awaitSafeSubmissionWindow(Number(validationResponse.timestamp));
-        tx = await sendEip1559Transaction({
-          signer,
+      try {
+        await assertSafeQuantumSubmission({
+          provider: signerProvider,
           to: positionManagerAddress,
+          from: fromAddress,
           data: mintCalldata,
-          gasLimit: estimatedGas
+          quantumTimestamp: Number(validationResponse.timestamp),
+          onDebug: this.config.debug ? (msg) => log.info(msg, {}) : void 0
         });
-      } else {
-        if (this.config.debug) {
-          log.info(
-            "\u{1F50D} eth_estimateGas failed for mintUCD; running static call",
-            {}
-          );
-        }
-        try {
-          await signerProvider.call({
-            to: positionManagerAddress,
-            from: fromAddress,
-            data: mintCalldata
-          });
-        } catch (callError) {
-          if (this.config.debug) {
-            log.info("\u{1F50D} DEBUG: mintUCD static call failed", {});
-            log.info(`   Error message: ${callError?.message}`, {});
-            log.info(`   Error code: ${callError?.code}`, {});
-            log.info(`   Error data type: ${typeof callError?.data}`, {});
-            log.info(`   Error data value: ${callError?.data}`, {});
-          }
-          let errorData = callError?.data || callError?.info?.error?.data || callError?.error?.data?.data || callError?.error?.data;
-          const errorMessage = callError?.reason || callError?.message || "Unknown error";
-          const isDeadZoneArtifact = decodeQuantumRevert(callError).selector === DEAD_ZONE_VIOLATION_SELECTOR;
-          if (isDeadZoneArtifact && this.config.debug) {
-            log.info(
-              "\u{1F536} mintUCD static-call DeadZoneViolation is a stale-latest-block artifact; broadcasting anyway (gated)",
-              {}
-            );
-          }
-          if (!isDeadZoneArtifact && errorData && typeof errorData === "string" && errorData.startsWith("0x") && errorData.length > 10) {
-            const selector = errorData.slice(0, 10);
-            const knownErrors = {
-              "0x8baa579f": "InvalidSignature()",
-              "0xd92e233d": "ValidationFailed()",
-              "0x3ee5aeb5": "OperationNotAuthorized()",
-              "0x70f4b32a": "UnauthorizedSigner()",
-              "0x48f5c3ed": "Unauthorized()",
-              "0x36bfdeea": "StateHashMismatch()",
-              "0x131d9a21": "QuantumExpired()",
-              "0x52ce5d58": "QuantumAlreadyUsed()",
-              "0x137f3b70": "InDeadZone()",
-              "0xbe4b82c1": "DeadZoneViolation()",
-              "0x3e76a3c9": "QuantumOutsideWindow()",
-              "0x62278171": "InvalidValidatorSignature()",
-              "0xb9d419a7": "DebtUpdateVerificationFailed()",
-              "0xc7e20553": "DebtUpdateVerificationFailedDetailed(bytes32,uint256,uint256,uint256,uint256,uint256)",
-              "0x0cfd2a97": "MintVerificationMismatch(uint256,uint256)",
-              "0x07637bd8": "MintFailed()"
-            };
-            const errorName = knownErrors[selector] || `Unknown error ${selector}`;
-            throw new Error(
-              `mintUCD reverted: ${errorName}
-Error selector: ${selector}
-Error data: ${errorData}
-Call path: mintUCD -> mintUCDWithAuthorization -> increaseDebtFromMint -> finalizeMintDebtIncrease
-Message: ${errorMessage}`
-            );
-          }
-          if (errorData === "0x" || !errorData) {
-            const viewsAddress = this.config.contractAddresses?.positionManagerViews;
-            if (viewsAddress) {
-              try {
-                const views = new Contract6(
-                  viewsAddress,
-                  [
-                    "function diagnoseMintUCD(bytes32,uint256,uint256,uint256,uint256,uint256,bytes32,bytes32,bytes32,uint256,bytes) view returns (string)"
-                  ],
-                  signerProvider
-                );
-                const diagnosis = await views["diagnoseMintUCD"](
-                  request.positionId,
-                  validationResponse.mintAmount,
-                  validationResponse.mintFee,
-                  validationResponse.newDebt,
-                  validationResponse.newCollateral,
-                  validationResponse.btcPrice,
-                  validationResponse.authorizedSpendsHash,
-                  ucdDebtHash,
-                  contractHash,
-                  validationResponse.timestamp,
-                  signatureHexMint
-                );
-                throw new Error(
-                  `mintUCD reverted with empty data; diagnosis: ${diagnosis}`
+      } catch (simError) {
+        if (!(simError instanceof QuantumRevertError)) {
+          throw simError;
+        }
+        const simCause = simError.cause;
+        const causeMessage = simCause?.reason ?? simCause?.shortMessage ?? (simCause instanceof Error ? simCause.message : String(simCause));
+        if (!simError.data) {
+          const viewsAddress = this.config.contractAddresses?.positionManagerViews;
+          if (viewsAddress) {
+            let diagnosis = null;
+            try {
+              const views = new Contract6(
+                viewsAddress,
+                [
+                  "function diagnoseMintUCD(bytes32,uint256,uint256,uint256,uint256,uint256,bytes32,bytes32,bytes32,uint256,bytes) view returns (string)"
+                ],
+                signerProvider
+              );
+              diagnosis = await views["diagnoseMintUCD"](
+                request.positionId,
+                validationResponse.mintAmount,
+                validationResponse.mintFee,
+                validationResponse.newDebt,
+                validationResponse.newCollateral,
+                validationResponse.btcPrice,
+                validationResponse.authorizedSpendsHash,
+                ucdDebtHash,
+                contractHash,
+                validationResponse.timestamp,
+                signatureHexMint
+              );
+            } catch (diagErr) {
+              if (this.config.debug) {
+                log.info(
+                  `   diagnoseMintUCD unavailable or failed: ${diagErr?.message || diagErr}`,
+                  {}
                 );
-              } catch (diagErr) {
-                if (this.config.debug) {
-                  log.info(
-                    `   diagnoseMintUCD unavailable or failed: ${diagErr?.message || diagErr}`,
-                    {}
-                  );
-                }
               }
             }
+            if (diagnosis !== null) {
+              throw new Error(
+                `mintUCD reverted with empty data; diagnosis: ${diagnosis}`
+              );
+            }
           }
-          if (!isDeadZoneArtifact) {
-            throw new Error(
-              `mintUCD reverted: ${errorMessage}
-Error data: ${errorData || "none"}`
-            );
-          }
-        }
-        if (this.config.debug) {
-          log.info(
-            "\u2705 Static call clear \u2014 broadcasting mintUCD with fixed gas ceiling",
-            {}
+          throw new Error(
+            `mintUCD would revert (pre-send simulation): ${causeMessage}
+Error data: none`
           );
         }
-        await awaitSafeSubmissionWindow(Number(validationResponse.timestamp));
-        tx = await sendEip1559Transaction({
-          signer,
-          to: positionManagerAddress,
-          data: mintCalldata,
-          gasLimit: MINT_UCD_GAS_CEILING
-        });
+        const selector = simError.selector;
+        const errorName = simError.errorName ?? (selector ? `Unknown error ${selector}` : "unknown");
+        const mintDebtDiagnostics = selector === "0xb9d419a7" || // DebtUpdateVerificationFailed()
+        selector === "0xc7e20553" || // DebtUpdateVerificationFailedDetailed(...)
+        selector === "0x0cfd2a97" || // MintVerificationMismatch(uint256,uint256)
+        selector === "0x07637bd8" ? `
+
+Mint/debt diagnostics (LoanOperationsManager mint path \u2192 increaseDebtFromMint):
+  positionId: ${request.positionId}
+  on-chain ucdDebt before tx: ${currentDebt}
+  Lit newDebt: ${validationResponse.newDebt}
+  Lit mintAmount: ${validationResponse.mintAmount}
+  Lit mintFee: ${validationResponse.mintFee}
+  Call path: mintUCD -> mintUCDWithAuthorization -> increaseDebtFromMint -> finalizeMintDebtIncrease
+  Contract expects UCD supply increase to match mintAmount+mintFee and debt update to newDebt.
+` : "";
+        let quantumContext = "";
+        if (selector === "0x131d9a21" || // QuantumExpired()
+        selector === "0x52ce5d58" || // QuantumAlreadyUsed()
+        selector === "0x137f3b70" || // InDeadZone()
+        selector === "0xbe4b82c1" || // DeadZoneViolation()
+        selector === "0x3e76a3c9") {
+          const nowSecs = Math.floor(Date.now() / 1e3);
+          const nowQuantum = Math.floor(nowSecs / 60) * 60;
+          const signedQuantum = Math.floor(Number(validationResponse.timestamp) / 60) * 60;
+          const timeDiff = nowSecs - Number(validationResponse.timestamp);
+          quantumContext = `
+
+Quantum Timing Analysis:
+  Signature created: ${validationResponse.timestamp} (${new Date(
+            Number(validationResponse.timestamp) * 1e3
+          ).toISOString()})
+  Current time: ${nowSecs} (${new Date(
+            nowSecs * 1e3
+          ).toISOString()})
+  Time elapsed: ${timeDiff} seconds
+  Signature quantum: ${signedQuantum}
+  Current quantum: ${nowQuantum}
+  Quantum window: 60 seconds
+  Status: ${signedQuantum < nowQuantum ? "\u274C EXPIRED - Signature created in older quantum window" : "\u2705 VALID"}
+  Note: QuantumOutsideWindow can also occur if the tx is mined outside the accepted past/current/next quantum set.`;
+        }
+        throw new Error(
+          `mintUCD would revert (pre-send simulation): ${errorName}
+Error selector: ${selector}
+Error data: ${simError.data}
+Call path: mintUCD -> mintUCDWithAuthorization -> increaseDebtFromMint -> finalizeMintDebtIncrease
+Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
+        );
       }
+      const tx = await sendEip1559Transaction({
+        signer,
+        to: positionManagerAddress,
+        data: mintCalldata,
+        gasLimit: MINT_UCD_GAS_CEILING
+      });
       const receipt = await signerProvider.waitForTransaction(
         tx.hash,
         1,
@@ -17913,9 +18795,12 @@ Error data: ${errorData || "none"}`
         userSignature: auth.signature,
         rpcUrl: _rpcUrl || this.config.ethRpcUrl,
         // Forward a Bitcoin provider so the validator reaches a reachable esplora on Hardhat
-        // (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat. Prefer
+        // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+        // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+        // is resolved from the on-chain BitcoinProviderRegistry and this field is server-ignored
+        // — emitting it there only misleads readers into thinking it is caller-controlled. Prefer
         // a per-request override (mirrors the mint path's customBitcoinRpcUrl) over the config default.
-        ...(_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
+        ...this.config.chain === "hardhat" && (_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
           bitcoinProviderUrl: _bitcoinRpcUrl || this.config.bitcoinProviders[0].url
         },
         ...this.config.priceProviders && {
@@ -17991,26 +18876,43 @@ Error data: ${errorData || "none"}`
     if (!signatureBytes.startsWith("0x")) {
       signatureBytes = "0x" + signatureBytes;
     }
-    const contractManager = this.getContractManager();
-    const positionManagerResult = contractManager.getPositionManager();
-    if (!positionManagerResult.success) {
-      throw new Error(
-        `Failed to get PositionManager: ${positionManagerResult.error.message}`
-      );
-    }
-    const positionManager = positionManagerResult.value;
-    await awaitSafeSubmissionWindow(Number(quantumTimestamp));
-    const extendPositionFn = positionManager["extendPosition"];
-    const tx = await extendPositionFn(
+    const extendIface = new Interface4([
+      "function extendPosition(bytes32 positionId, uint256 selectedTerm, uint256 quantumTimestamp, uint256 btcPrice, uint256 availableBTCBalance, uint256 proRataRenewalFee, bytes calldata extensionValidatorSignature) external returns (bool)"
+    ]);
+    const extendCalldata = extendIface.encodeFunctionData("extendPosition", [
       positionIdBytes32,
       BigInt(_selectedTerm),
       quantumTimestamp,
       btcPrice,
       availableBTCBalance,
       proRataRenewalFee,
-      signatureBytes,
-      { gasLimit: EXTEND_POSITION_GAS_CEILING }
-    );
+      signatureBytes
+    ]);
+    const extendTo = this.getContractAddressesOrThrow().positionManager;
+    const extendSigner = this.getSignerOrThrow();
+    try {
+      await assertSafeQuantumSubmission({
+        provider: this.getProviderOrThrow(),
+        to: extendTo,
+        from: await extendSigner.getAddress(),
+        data: extendCalldata,
+        quantumTimestamp: Number(quantumTimestamp),
+        onDebug: this.config.debug ? (msg) => log.info(msg, {}) : void 0
+      });
+    } catch (simError) {
+      if (!(simError instanceof QuantumRevertError)) {
+        throw simError;
+      }
+      throw new Error(
+        `extendPosition would revert (pre-send simulation): ${simError.errorName ?? simError.selector ?? "unknown"}`
+      );
+    }
+    const tx = await sendEip1559Transaction({
+      signer: extendSigner,
+      to: extendTo,
+      data: extendCalldata,
+      gasLimit: EXTEND_POSITION_GAS_CEILING
+    });
     const txWithProvider = tx;
     if (!txWithProvider.provider) {
       const signer2 = this.getSignerOrThrow();
@@ -18679,9 +19581,10 @@ Error data: ${errorData || "none"}`
           rpcUrl: this.config.ethRpcUrl,
           // Pass the SDK's RPC URL to LIT Action
           ...request.rpcUrl && { rpcUrl: request.rpcUrl },
-          // Forward the configured Bitcoin provider so the validator reaches a reachable esplora on
-          // Hardhat (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat.
-          ...this.config.bitcoinProviders?.[0]?.url && {
+          // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+          // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+          // comes from the on-chain BitcoinProviderRegistry and this field is server-ignored.
+          ...this.config.chain === "hardhat" && this.config.bitcoinProviders?.[0]?.url && {
             bitcoinProviderUrl: this.config.bitcoinProviders[0].url
           },
           ...this.config.priceProviders && {
@@ -18870,7 +19773,6 @@ Error data: ${errorData || "none"}`
           quantumTimestamp: quantumTimestamp.toString()
         });
       }
-      await awaitSafeSubmissionWindow(Number(quantumTimestamp));
       const paymentAmountStr = paymentAmountWei.toString();
       const quantumTimestampStr = quantumTimestamp.toString();
       const btcPriceStr = btcPrice.toString();
@@ -18888,58 +19790,30 @@ Error data: ${errorData || "none"}`
         btcPriceStr,
         signature
       ]);
-      const decodePaymentRevert = (e) => {
-        const { selector, name } = decodeQuantumRevert(e);
-        if (!selector)
-          return null;
-        return name ?? `Unknown error ${selector}`;
-      };
-      const MAX_DEADZONE_RESIMULATIONS = 3;
-      for (let sim = 1; ; sim++) {
-        try {
-          await paymentProvider.call({
-            to: paymentContractAddress,
-            from: paymentFrom,
-            data: paymentCalldata
-          });
-          break;
-        } catch (simError) {
-          const decoded = decodePaymentRevert(simError);
-          if (decoded === "DeadZoneViolation()" && sim <= MAX_DEADZONE_RESIMULATIONS) {
-            const nowSec = Math.floor(Date.now() / 1e3);
-            const sigQuantum = Math.floor(Number(quantumTimestamp) / 60) * 60;
-            const realCurrentQuantum = Math.floor(nowSec / 60) * 60;
-            if (sigQuantum === realCurrentQuantum) {
-              if (this.config.debug) {
-                log.info(
-                  "\u21AA\uFE0F  Simulated DeadZoneViolation is a stale-latest-block artifact (signature is the current quantum) \u2014 proceeding to broadcast",
-                  {}
-                );
-              }
-              break;
-            }
-            const gate = await awaitSafeSubmissionWindow(Number(quantumTimestamp));
-            if (gate.waited) {
-              if (this.config.debug) {
-                log.info(
-                  `\u{1F501} Re-simulating makePayment after crossing the quantum boundary (attempt ${sim}/${MAX_DEADZONE_RESIMULATIONS})`,
-                  {}
-                );
-              }
-              continue;
-            }
-          }
-          const label = decoded ?? simError?.reason ?? simError?.shortMessage ?? (simError instanceof Error ? simError.message : String(simError));
-          if (this.config.debug) {
-            log.error("\u274C makePayment pre-send simulation reverted", { error: label });
-          }
-          return {
-            success: false,
-            error: `Payment would revert (pre-send simulation): ${label}`,
-            positionId: request.positionId,
-            paymentAmountUCD: request.paymentAmount
-          };
+      try {
+        await assertSafeQuantumSubmission({
+          provider: paymentProvider,
+          to: paymentContractAddress,
+          from: paymentFrom,
+          data: paymentCalldata,
+          quantumTimestamp: Number(quantumTimestamp),
+          onDebug: this.config.debug ? (msg) => log.info(msg, {}) : void 0
+        });
+      } catch (simError) {
+        if (!(simError instanceof QuantumRevertError)) {
+          throw simError;
+        }
+        const simCause = simError.cause;
+        const label = simError.errorName ?? (simError.selector ? `Unknown error ${simError.selector}` : null) ?? simCause?.reason ?? simCause?.shortMessage ?? (simCause instanceof Error ? simCause.message : String(simCause));
+        if (this.config.debug) {
+          log.error("\u274C makePayment pre-send simulation reverted", { error: label });
         }
+        return {
+          success: false,
+          error: `Payment would revert (pre-send simulation): ${label}`,
+          positionId: request.positionId,
+          paymentAmountUCD: request.paymentAmount
+        };
       }
       const tx = await sendEip1559Transaction({
         signer: paymentSigner,
@@ -19613,13 +20487,6 @@ Error data: ${errorData || "none"}`
           error: "PositionManager address not configured"
         };
       }
-      const positionManagerContract = new Contract6(
-        positionManagerAddress,
-        [
-          "function withdrawBTC((bytes32 positionId, bytes32 actionHash, bytes32 authorizedSpendsHash, bytes32 ucdDebtHash, bytes32 contractBundleHash, string withdrawalAddress, uint256 totalDeduction, uint256 newCollateral, uint256 quantumTimestamp, uint256 btcPrice, string utxoTxid, uint32 utxoVout) params, bytes withdrawalValidatorSignature, bytes btcSpendAuthSignature) external returns (bool)"
-        ],
-        this.getSignerOrThrow()
-      );
       const withdrawalParams = {
         positionId: positionIdBytes32,
         actionHash: validationResponse.actionHash,
@@ -19652,86 +20519,56 @@ Error data: ${errorData || "none"}`
           utxoVout: withdrawalParams.utxoVout
         });
       }
-      await awaitSafeSubmissionWindow(Number(withdrawalParams.quantumTimestamp));
+      const withdrawIface = new Interface4([
+        "function withdrawBTC((bytes32 positionId, bytes32 actionHash, bytes32 authorizedSpendsHash, bytes32 ucdDebtHash, bytes32 contractBundleHash, string withdrawalAddress, uint256 totalDeduction, uint256 newCollateral, uint256 quantumTimestamp, uint256 btcPrice, string utxoTxid, uint32 utxoVout) params, bytes withdrawalValidatorSignature, bytes btcSpendAuthSignature) external returns (bool)"
+      ]);
+      const withdrawCalldata = withdrawIface.encodeFunctionData("withdrawBTC", [
+        withdrawalParams,
+        signatureBytes,
+        btcSpendAuthBytes
+      ]);
+      const withdrawSigner = this.getSignerOrThrow();
       let tx;
       try {
-        tx = await positionManagerContract["withdrawBTC"](
-          withdrawalParams,
-          signatureBytes,
-          btcSpendAuthBytes,
-          { gasLimit: WITHDRAW_BTC_GAS_CEILING }
-        );
+        await assertSafeQuantumSubmission({
+          provider: this.getProviderOrThrow(),
+          to: positionManagerAddress,
+          from: await withdrawSigner.getAddress(),
+          data: withdrawCalldata,
+          quantumTimestamp: Number(withdrawalParams.quantumTimestamp),
+          onDebug: this.config.debug ? (msg) => log.info(msg, {}) : void 0
+        });
+        tx = await sendEip1559Transaction({
+          signer: withdrawSigner,
+          to: positionManagerAddress,
+          data: withdrawCalldata,
+          gasLimit: WITHDRAW_BTC_GAS_CEILING
+        });
       } catch (txError) {
-        const txErrorMsg = txError instanceof Error ? txError.message : String(txError);
+        const txErrorMsg = txError instanceof QuantumRevertError ? `Withdrawal would revert (pre-send simulation): ${txError.errorName ?? txError.selector ?? "unknown"}` : txError instanceof Error ? txError.message : String(txError);
         if (this.config.debug) {
-          log.warn(
-            "\u26A0\uFE0F  withdrawBTC contract interface failed, falling back to raw transaction",
-            { error: txErrorMsg }
-          );
+          log.error("\u274C withdrawBTC transaction submission failed", {
+            error: txErrorMsg,
+            withdrawalParams,
+            signatureBytesLength: signatureBytes.length
+          });
         }
         try {
-          const contractAddress = this.getContractAddressesOrThrow().positionManager;
-          const iface = new Interface4([
-            "function withdrawBTC((bytes32 positionId, bytes32 actionHash, bytes32 authorizedSpendsHash, bytes32 ucdDebtHash, bytes32 contractBundleHash, string withdrawalAddress, uint256 totalDeduction, uint256 newCollateral, uint256 quantumTimestamp, uint256 btcPrice, string utxoTxid, uint32 utxoVout) params, bytes withdrawalValidatorSignature, bytes btcSpendAuthSignature) external returns (bool)"
-          ]);
-          const calldata = iface.encodeFunctionData("withdrawBTC", [
-            withdrawalParams,
-            signatureBytes,
-            btcSpendAuthBytes
-          ]);
-          const signer = this.getSignerOrThrow();
-          const fromAddress = await signer.getAddress();
-          const estimatedGas = await estimateContractCallGasWithMargin(
-            this.getProviderOrThrow(),
-            fromAddress,
-            contractAddress,
-            calldata,
-            MINT_UCD_ESTIMATE_MARGIN_BPS,
-            WITHDRAW_BTC_GAS_CEILING
-          );
-          const gasLimit = estimatedGas ?? WITHDRAW_BTC_GAS_CEILING;
-          await awaitSafeSubmissionWindow(
-            Number(withdrawalParams.quantumTimestamp)
+          const position = await this.getPosition(positionId);
+          const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
+          const message = formatBTCWithdrawalFailureMessage(
+            btcAmount,
+            position?.vaultAddress || "unknown",
+            withdrawalAddress,
+            positionId
           );
-          tx = await signer.sendTransaction({
-            to: contractAddress,
-            data: calldata,
-            value: "0x0",
-            gasLimit
-          });
-          if (this.config.debug) {
-            log.info("\u2705 withdrawBTC raw transaction fallback succeeded", {
-              txHash: tx.hash,
-              gasLimit: gasLimit.toString(),
-              estimated: estimatedGas !== null
-            });
-          }
-        } catch (rawError) {
-          const rawErrorMsg = rawError instanceof Error ? rawError.message : String(rawError);
-          if (this.config.debug) {
-            log.error("\u274C withdrawBTC transaction failed (raw fallback also failed)", {
-              error: rawErrorMsg,
-              withdrawalParams,
-              signatureBytesLength: signatureBytes.length
-            });
-          }
-          try {
-            const position = await this.getPosition(positionId);
-            const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
-            const message = formatBTCWithdrawalFailureMessage(
-              btcAmount,
-              position?.vaultAddress || "unknown",
-              withdrawalAddress,
-              positionId
-            );
-            await this._relayNotification(message);
-          } catch {
-          }
-          return {
-            success: false,
-            error: `Transaction submission failed: ${rawErrorMsg}`
-          };
+          await this._relayNotification(message);
+        } catch {
         }
+        return {
+          success: false,
+          error: `Transaction submission failed: ${txErrorMsg}`
+        };
       }
       if (this.config.debug) {
         log.info("\u2705 Transaction submitted, waiting for confirmation:", {
@@ -19754,6 +20591,12 @@ Error data: ${errorData || "none"}`
           error: `Transaction confirmation failed: ${waitErrorMsg}`
         };
       }
+      if (!receipt) {
+        return {
+          success: false,
+          error: `Transaction confirmation returned no receipt. Hash: ${tx.hash}`
+        };
+      }
       if (this.config.debug) {
         log.info("\u2705 BTC withdrawal confirmed", {
           blockNumber: receipt.blockNumber,
@@ -19869,7 +20712,8 @@ Error data: ${errorData || "none"}`
         targetAmount: request.targetAmount,
         networkFee: request.networkFee,
         chainId,
-        signer
+        signer,
+        ...request.utxos ? { utxos: request.utxos } : {}
       });
       const headers = {
         "Content-Type": "application/json",
@@ -19900,7 +20744,10 @@ Error data: ${errorData || "none"}`
               userSignature: envelope.userSignature,
               borrowerAddress: envelope.borrowerAddress,
               chainId: envelope.chainId,
-              timestamp: envelope.timestamp
+              timestamp: envelope.timestamp,
+              // P6/#8: the exact input set hashed into the user signature.
+              // The server must forward this set verbatim to the signer.
+              utxos: envelope.utxos
             })
           }
         );
@@ -20240,10 +21087,13 @@ Error data: ${errorData || "none"}`
             }
           },
           rpcUrl,
-          ...sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
+          // Hardhat-ONLY: never emitted on prod chains (server-ignored there; provider comes
+          // from the on-chain BitcoinProviderRegistry). The stale-spend action reads
+          // `devBitcoinProviderUrl` directly on Hardhat — this legacy alias is redundant but
+          // kept behind the Hardhat gate so no prod request carries the caller-looking field.
+          ...this.config.chain === "hardhat" && sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
           // Hardhat (chainId 1337/31337) has no on-chain BitcoinProviderRegistry —
-          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Always pass;
-          // non-hardhat chains ignore it. (Single source of truth: bitcoinProviderUrl.)
+          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Non-hardhat chains ignore it.
           ...sdkBitcoinProviderUrl && { devBitcoinProviderUrl: sdkBitcoinProviderUrl },
           ...params.minConfirmations !== void 0 && {
             minConfirmations: params.minConfirmations
@@ -20566,6 +21416,15 @@ Error data: ${errorData || "none"}`
   async getLoanEvents(positionId, filter) {
     return this.loanQuery.getLoanEvents(positionId, filter);
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   * Composes getUserPositions + getLoanEvents; returns one LoanEvents per
+   * position (each carrying its own positionId). Bitcoin deposits are not on the
+   * subgraph — merge those in from an Esplora source on the consumer side.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    return this.loanQuery.getWalletLoanEvents(userAddress, filter);
+  }
   /**
    * Get protocol-wide events across all indexed entity types.
    * Returns a merged, sorted discriminated-union timeline.
@@ -21022,6 +21881,38 @@ Error data: ${errorData || "none"}`
       }));
     }
   }
+  /**
+   * List a vault address's PENDING (not-yet-confirmed) incoming BTC deposits.
+   *
+   * A deposit is "pending" until it reaches the protocol's minimum confirmation
+   * depth (6) — the confirmed balance endpoints (`getVaultBalance` /
+   * `getAddressBalance`) omit anything shallower, so this surfaces in-flight
+   * deposits (0–5 confirmations). Server-delegated: lit-ops-server queries its
+   * configured premium Esplora provider (`/api/lit/pending-deposits`). Requires
+   * service mode.
+   */
+  async getPendingDeposits(vaultAddress) {
+    this.ensureInitialized();
+    if (!isServiceModeConfig(this.config)) {
+      throw new Error("getPendingDeposits requires service mode \u2014 standalone mode is not supported");
+    }
+    const trimmedAddress = vaultAddress?.trim();
+    if (!trimmedAddress) {
+      throw new Error("vaultAddress is required");
+    }
+    const serviceEndpoint = this.config.serviceEndpoint;
+    const url = `${serviceEndpoint}/api/lit/pending-deposits?vaultAddress=${encodeURIComponent(trimmedAddress)}`;
+    const response = await fetch(url, {
+      headers: await this.getAuthHeader()
+    });
+    if (!response.ok) {
+      throw new Error(`Pending deposits request failed: ${response.status} ${response.statusText}`);
+    }
+    const json = await response.json();
+    if (!json.success)
+      throw new Error(json.error ?? "Pending deposits request failed");
+    return json.data ?? [];
+  }
   // ============================================================================
   // HIGH-LEVEL API - Mock Token Operations (Test Networks Only)
   // ============================================================================
@@ -21517,6 +22408,20 @@ Error data: ${errorData || "none"}`
     if (this.config.debug) {
       log.info(`\u{1F310} Calling liquidation server endpoint: ${endpoint}`);
     }
+    const signer = this.getSignerOrThrow();
+    const intentSigner = await signer.getAddress();
+    const chainId = Number(
+      (await this.getProviderOrThrow().getNetwork()).chainId
+    );
+    const rawPositionId = /^0x/i.test(params.positionId.trim()) ? params.positionId.trim().slice(2) : params.positionId.trim();
+    const canonicalPositionId = "0x" + rawPositionId.padStart(64, "0").toLowerCase();
+    const intentTimestamp = Math.floor(Date.now() / 1e3);
+    const intentActionHash = keccak2565(toUtf8Bytes5("liquidate-position"));
+    const intentHash = solidityPackedKeccak2564(
+      ["bytes32", "uint256", "uint256", "address", "bytes32"],
+      [canonicalPositionId, intentTimestamp, chainId, intentSigner, intentActionHash]
+    );
+    const intentSignature = await signer.signMessage(getBytes4(intentHash));
     const response = await fetch(endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -21532,6 +22437,11 @@ Error data: ${errorData || "none"}`
           UCDController: params.contractAddresses.ucdController,
           LiquidationManagerModule: params.contractAddresses.liquidationManager
         },
+        liquidatorIntent: {
+          timestamp: intentTimestamp,
+          chainId,
+          signature: intentSignature
+        },
         rpcUrl: params.rpcUrl || this.config.ethRpcUrl,
         priceProviders: this.config.priceProviders,
         pkpTokenId: params.pkpData.tokenId,