@gvnrdao/dh-sdk 0.0.301 → 0.0.304

package/dist/index.mjs

@@ -93,7 +93,8 @@ var init_deployment_addresses = __esm({
         mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
         PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
         FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+        CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
       },
       upgraded: {
         PositionManager: {
@@ -355,7 +356,9 @@ var init_deployment_addresses = __esm({
         FEE_RECIPIENT_REGISTRY_IMPL: "0xd08513a7cB2dd354B26cDDf549616F12054c34c9",
         OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0xe0D981B60351f0f8fFDA2b50C8180Fb37CeF3883",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA"
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA",
+        CARRY_AGENT_REGISTRY: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7",
+        CARRY_AGENT_REGISTRY_IMPL: "0x1b11a3D5e46F3672E643c997f0d569DFf0b64a01"
       }
     };
     SEPOLIA_CONTRACTS = {
@@ -383,7 +386,8 @@ var init_deployment_addresses = __esm({
       mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
       PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
       FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+      CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
     };
     MAINNET_DEPLOYMENT = {
       network: "mainnet",
@@ -418,10 +422,12 @@ var init_deployment_addresses = __esm({
       upgraded: {
         SimplePSMV2: {
           previousImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          newImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          upgradedAt: "2026-06-16T17:53:24.979Z",
-          upgradedBy: "0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f",
-          reason: "Initial PSM deploy / artifact sync"
+          newImplementation: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+          upgradedAt: "2026-07-06T10:41:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6 (block 25472960)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6",
+          block: 25472960
         },
         CollateralManagerModule: {
           previousImplementation: "0x1919860e528Cd2AbbD31a17858c986b8aCc8C185",
@@ -436,6 +442,65 @@ var init_deployment_addresses = __esm({
           upgradedAt: "2026-07-08T20:33:59Z",
           upgradedBy: "AdminModule generic-op 0x2603a486c0f34554b864cc1d909b325c7e105331da10ec0fd7e0b9373fa76207 (3-of-5 ADMIN_ROLE Safes, 24h timelock; executed by 0xfb3B8cbeFB7D666A6Af34C53e189EdC31862a7be in tx 0x430c8e450f12d3d9359cde356ac5e2ef39661d7a89884b5674a596c1090f6cff)",
           reason: "Validator gas fix (#420): BitcoinAddressValidator packed-table lookups; VERSION 1.0.0 -> 1.0.1"
+        },
+        UCDController: {
+          newImplementation: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+          upgradedBy: "Reconciled from chain \u2014 Upgraded event log unavailable; provenance omitted (never fabricated)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)"
+        },
+        PositionManagerCoreModule: {
+          previousImplementation: "0x6C8b0FB93F8d0239254aefaC24d4264cA2F8AAeB",
+          newImplementation: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+          upgradedAt: "2026-07-06T08:02:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d (block 25472167)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d",
+          block: 25472167
+        },
+        LiquidationManagerModule: {
+          previousImplementation: "0xc2f4517eeD7c4c516939a64c7938a6ab432D99c4",
+          newImplementation: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+          upgradedAt: "2026-07-06T10:40:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c (block 25472956)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c",
+          block: 25472956
+        },
+        BTCSpendAuthorizer: {
+          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
+          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          upgradedAt: "2026-07-06T10:40:59.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
+          block: 25472957
+        },
+        PositionManager: {
+          previousImplementation: "0x9f52BaBB40FbFC5863e45B1A4014cB433950c684",
+          newImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+          upgradedAt: "2026-07-06T08:42:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6 (block 25472368)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6",
+          block: 25472368
+        },
+        LoanOperationsManagerModule: {
+          previousImplementation: "0x56671D671e492Dae625413d463D47605Cf54edf6",
+          newImplementation: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+          upgradedAt: "2026-07-06T10:41:23.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a (block 25472959)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a",
+          block: 25472959
+        },
+        OperationAuthorizationRegistry: {
+          previousImplementation: "0x327662917Ac8EEda47851d74AF6A151348636fCe",
+          newImplementation: "0x493118746840EDB2D396E71632D2E774CA14070e",
+          upgradedAt: "2026-07-06T10:41:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b (block 25472961)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b",
+          block: 25472961
         }
       },
       latestEnv: {
@@ -448,9 +513,37 @@ var init_deployment_addresses = __esm({
         BITCOIN_PROVIDER_REGISTRY: "0x4ab3Fb96e02893Ed6FAa61bad1918390c8DbbFFC",
         BITCOIN_PROVIDER_REGISTRY_IMPL: "0x7Bc9473E45fb3EA594e8b13992F57D0444902ddB",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0xf667f77FDba7458345f227eB6Bfe4148243E7270",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x11731bFEC3068F2cc19D016381dfEA3B93013b1C",
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x190c08300Ae650fb88ed8156445BBeb13bE9E8a3",
         SIMPLE_PSM_V2: "0xfE0C14B4E614f40Bf58845b4B04CeD17fd116532",
-        SIMPLE_PSM_V2_IMPL: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A"
+        SIMPLE_PSM_V2_IMPL: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+        UCD_CONTROLLER: "0x4b4f8063048bCD59D469219E3f07C6aaDF4f6157",
+        UCD_CONTROLLER_IMPL: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+        UCD_TOKEN: "0xaAaB6B05E5EecB015898483d4e6703d7F218850b",
+        UCD_TOKEN_IMPL: "0x5f09C660036021D7e916DF47234C24a2536C3A72",
+        POSITION_MANAGER_CORE_MODULE: "0xd895B685914c1BE4e1c7aab9f89a90c203DE8d22",
+        POSITION_MANAGER_CORE_MODULE_IMPL: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+        TERM_MANAGER_MODULE: "0xDB99CdF883ffa38acD099bC39F8d1f4508c9239E",
+        TERM_MANAGER_MODULE_IMPL: "0x971f63f92990e59270E971612dd399fF2C63B0c3",
+        COLLATERAL_MANAGER_MODULE: "0x2Eb74FEc478218f5C260aAc78Bb8eC297F9d7135",
+        COLLATERAL_MANAGER_MODULE_IMPL: "0x55110B9dd6B2c9f812564e7a1ef42b3c76E1A3Bb",
+        LIQUIDATION_MANAGER_MODULE: "0x74B28695352E7bf736D6c9F76ccb7B4439477De9",
+        LIQUIDATION_MANAGER_MODULE_IMPL: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+        CIRCUIT_BREAKER_MODULE: "0xF7b545d3a4Ee056D06909AB367E2F7bFFE3cB1BC",
+        CIRCUIT_BREAKER_MODULE_IMPL: "0x40e8328D61342C6ADC51dfdC723296c908f95038",
+        ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
+        ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
+        BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        POSITION_MANAGER_VIEWS: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER_VIEWS_IMPL: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
+        POSITION_MANAGER_IMPL: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+        LOAN_OPERATIONS_MANAGER_MODULE: "0x2561974A40F1AEed1251d0A090A83cF8536FB9E9",
+        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+        UPGRADE_VALIDATOR: "0xC46Ae71F22e3741A6CF46E399aE914C4868fEbed",
+        UPGRADE_VALIDATOR_IMPL: "0x4f835e77D1211299a1cbb8Aa2b42d9B390cC95CA",
+        OPERATION_AUTHORIZATION_REGISTRY: "0xD4505645b724754f5170a2027804a4265e860d44",
+        OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0x493118746840EDB2D396E71632D2E774CA14070e"
       }
     };
     MAINNET_CONTRACTS = {
@@ -481,44 +574,44 @@ var init_deployment_addresses = __esm({
     LOCALHOST_DEPLOYMENT = {
       network: "localhost",
       chainId: 31337,
-      timestamp: "2026-03-23T15:33:34.068Z",
+      timestamp: "2026-06-11T12:30:59.589Z",
       deployer: "",
       contracts: {
-        MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-        UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+        MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+        UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
         UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
         UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-        PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-        TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-        LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+        PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+        TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+        LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
         BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
         CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
         LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-        CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+        CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
         AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-        PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-        PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-        OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-        PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+        PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+        PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+        OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+        PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
       }
     };
     LOCALHOST_CONTRACTS = {
-      MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-      UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+      MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+      UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
       UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
       UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-      PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-      TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-      LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+      PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+      TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+      LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
       BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
       CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
       LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-      CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+      CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
       AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-      PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-      PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-      OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-      PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+      PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+      PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+      OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+      PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
     };
     ALL_DEPLOYMENTS = {
       sepolia: SEPOLIA_DEPLOYMENT,
@@ -1210,30 +1303,30 @@ var require_pkg_src = __commonJS({
         }
       },
       btcTransactionSigner: {
-        cid: "QmcPG9C5Yx9JGrBKCfSVWbKuiRXn8XFwb91yNxQqY4VSJD",
+        cid: "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk",
         authorizedCidHex: cidToHex(
-          "QmcPG9C5Yx9JGrBKCfSVWbKuiRXn8XFwb91yNxQqY4VSJD"
+          "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk"
         ),
         name: "Btc Transaction Signer",
         description: "Production Btc Transaction Signer",
-        version: "1.0.1",
+        version: "1.1.1",
         deployed: true,
-        deployedAt: 1783451891948,
-        size: 43688,
-        hash: "1ea0f0ac66cc68fc9b098dabb3c5e3ba96c25f13b133b95a06eac477028fdb1a"
+        deployedAt: 1784316496778,
+        size: 63679,
+        hash: "b12aa725797af5ef07f8e6945f05741f583d6e479a4670b1121e97c58fe63191"
       },
       ucdMintValidator: {
-        cid: "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K",
+        cid: "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW",
         authorizedCidHex: cidToHex(
-          "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K"
+          "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW"
         ),
         name: "Ucd Mint Validator",
         description: "Production Ucd Mint Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542207366,
-        size: 72074,
-        hash: "567a51d3beaedbda4f0af2636835ca8a2af89c2264e91f8dc31f522c1a424b7b",
+        deployedAt: 1784316505431,
+        size: 80381,
+        hash: "132a0a8e6e9a1b85d02e00c0e57eaa371d825717255a28c9e644e4b521760026",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041ab17cd91fc5c0b761eea6092d032807561b621b82c488826776e04a9158d61ba64d809a4729f0501289d980732cb06d8dfd06999dd9c8efd2f495dad78b31bb",
@@ -1241,17 +1334,17 @@ var require_pkg_src = __commonJS({
         }
       },
       processPaymentValidator: {
-        cid: "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9",
+        cid: "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ",
         authorizedCidHex: cidToHex(
-          "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9"
+          "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ"
         ),
         name: "Process Payment Validator",
         description: "Production Process Payment Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542209526,
-        size: 68239,
-        hash: "ada27fea57aa3f3b861c49e75ed1f80b72500fdccc1d6e88ee1a3c1396b81867",
+        deployedAt: 1784316520125,
+        size: 76534,
+        hash: "dbdf43d3f1636e0ee883d349ca28f24c5c38ed7e062b76ca75498aaf5fe594ea",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04cfccb9b6c7addc79469c0e9fafebef4c70801302c62cdb26b610723a9b8527d23f98a40158c7340d83fd0e62d02b5ec74c12f7a86d98e8c6973b4811110f19ad",
@@ -1259,17 +1352,17 @@ var require_pkg_src = __commonJS({
         }
       },
       extendPositionValidator: {
-        cid: "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb",
+        cid: "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4",
         authorizedCidHex: cidToHex(
-          "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb"
+          "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4"
         ),
         name: "Extend Position Validator",
         description: "Production Extend Position Validator",
-        version: "1.0.1",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542211640,
-        size: 66543,
-        hash: "0db666fa2888e9acea13d8e4d79edd4ca252f5a4bb06d97e53aa14a9a34b7143",
+        deployedAt: 1784316534278,
+        size: 74352,
+        hash: "c17bfc9abef16f2372316a14c14281e2acc98afdd1662d095360f1d1c5383f1d",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04e52338f6a0c3362800f1a94c4c8f08be5030dde0fa217388c53d1c1a4790f4443c9f2886b2d2d8f4b75a9a156e9b028011b1a1cf7648da0e556aa980ec692836",
@@ -1277,17 +1370,17 @@ var require_pkg_src = __commonJS({
         }
       },
       btcWithdrawal: {
-        cid: "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ",
+        cid: "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2",
         authorizedCidHex: cidToHex(
-          "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ"
+          "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2"
         ),
         name: "Btc Withdrawal",
         description: "Production Btc Withdrawal",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542212709,
-        size: 79782,
-        hash: "e824eb473df8eba3a025ac3adc46730dbf89f90884d7c05a78cc07b90d6bc4df",
+        deployedAt: 1784316549409,
+        size: 90692,
+        hash: "ca7276763142fe1fc812b70f6319973000faf338a91c531f898f8f6406035c64",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1295,17 +1388,17 @@ var require_pkg_src = __commonJS({
         }
       },
       liquidationValidator: {
-        cid: "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF",
+        cid: "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx",
         authorizedCidHex: cidToHex(
-          "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF"
+          "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx"
         ),
         name: "Liquidation Validator",
         description: "Production Liquidation Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542213421,
-        size: 58444,
-        hash: "0f42e9f8984433fef95875d35eb3c8d985e7ce15ad309e6aa1093d6fd1ba0bb5",
+        deployedAt: 1784316560010,
+        size: 66523,
+        hash: "f74d0163c47d7db04d1547f72c3a9bc1e5b499669089cc6464479a361462ce81",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041a241de58976c13e3d7ca5a18e494f7330151e3818706135d50176e78ffb673e58b11f0b67a87c73fade6c6b27d6e7a7377ea9f4c10bf31880f1d725f18cc6f8",
@@ -1331,17 +1424,17 @@ var require_pkg_src = __commonJS({
         }
       },
       loanVaultBtcBalance: {
-        cid: "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG",
+        cid: "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu",
         authorizedCidHex: cidToHex(
-          "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG"
+          "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu"
         ),
         name: "Loan Vault Btc Balance",
         description: "Production Loan Vault Btc Balance",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542215432,
-        size: 48397,
-        hash: "da3750a70e532b87f3590a3e2d8c2d51e700589f6e111bb291384ab01304af35",
+        deployedAt: 1784316574669,
+        size: 56477,
+        hash: "917535f2911055b2ade2204fd868dd8b7294c7ade23e82aea488aeb0872e35d7",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1355,17 +1448,17 @@ var require_pkg_src = __commonJS({
       // Requires BitcoinProviderRegistry.addAllowedCid(chainId, keccak256(utf8(cid)))
       // on each target chain (the action decrypts registry slots). No OAR entry.
       btcAddressBalance: {
-        cid: "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5",
+        cid: "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA",
         authorizedCidHex: cidToHex(
-          "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5"
+          "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA"
         ),
         name: "Btc Address Balance",
         description: "Address-only signed total BTC balance via registry consensus (no positionId, no price)",
-        version: "0.1.0",
+        version: "0.2.1",
         deployed: true,
-        deployedAt: 1781542217452,
-        size: 25519,
-        hash: "000e2f8bdbccdc95b0db0fb3f12412e2e76eea16a8456d37914d324437ae291c",
+        deployedAt: 1784316590403,
+        size: 26986,
+        hash: "49fb14265f3208916f12806df04492900bd08fb1b14d9651ee6278cd9ae4a428",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x0498cbb31facfa26e3ec83ccdabfe4fe341ca0282e0c3cb81da7113723b9726e1e49efa92165cc3faa66ced4454cea56dbab12267852d6525a55d7c4f128b912cd",
@@ -1399,17 +1492,17 @@ var require_pkg_src = __commonJS({
         hash: "03ee5be239c91c735d2c95db89a0d1b77e602cfc18af8eb64b3281fddcd90a72"
       },
       staleSpendRecoveryValidator: {
-        cid: "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5",
+        cid: "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK",
         authorizedCidHex: cidToHex(
-          "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5"
+          "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK"
         ),
         name: "Stale Spend Recovery Validator",
         description: "Production Stale Spend Recovery Validator",
-        version: "1.0.0",
+        version: "1.1.2",
         deployed: true,
-        deployedAt: 1781542219438,
-        size: 34413,
-        hash: "26b11730cf5d9eb4af0b1fe65192d26ccee50369c0472211a0ea11e26ef51cc5",
+        deployedAt: 1784316604502,
+        size: 36785,
+        hash: "28bfe44970541fefe3bae8bd54f25e8775d7cc61b5832a40ba1c18587b6b6358",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x046da0ad6da7dd4a0063cbeac6f2bdb6a9889c2178b23470833356a8ee5630f7f0eee0db348d9d9aaaadd23eccf0063c8f68ee5e446abe30b882bf1de4c932bc21",
@@ -2197,6 +2290,20 @@ ${errorReport}`);
       /* REGTEST */
       // Local development
     };
+    var CHAIN_TO_CHAIN_ID = {
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: 1,
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: 11155111,
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: 1337
+    };
     function validateChain(chain) {
       const normalized = chain.toLowerCase().trim();
       if (normalized === "sepolia") {
@@ -2493,6 +2600,27 @@ ${errorReport}`);
     function createProtocolParametersModule(config) {
       return new ProtocolParametersModule(config);
     }
+    function parseVaultAddress(rawVaultAddress, chain) {
+      try {
+        const parsed = JSON.parse(rawVaultAddress);
+        if (typeof parsed === "object" && parsed !== null) {
+          const chainLower = chain.toLowerCase();
+          if (chainLower === "sepolia") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          const bitcoinNetwork = getBitcoinNetworkForChain(chain);
+          if (bitcoinNetwork === "regtest") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          if (bitcoinNetwork === "testnet") {
+            return parsed.testnet || parsed.regtest || parsed.mainnet;
+          }
+          return parsed.mainnet;
+        }
+      } catch (e) {
+      }
+      return rawVaultAddress;
+    }
     var VaultSnapshotModule = class {
       constructor(config) {
         this.config = config;
@@ -2600,112 +2728,11 @@ ${errorReport}`);
           timestamp: Date.now()
         };
       }
-      /**
-       * Fast vault snapshot using balance method only (no UTXO validation)
-       * This is optimized for speed and should be used when UTXO details are not needed.
-       *
-       * WARNING: This method skips UTXO validation. Use ONLY for non-critical operations.
-       * For authorization/security operations, ALWAYS use getVaultSnapshot().
-       *
-       * @param positionId - Position to snapshot
-       * @returns Complete VaultSnapshot with all metrics (using fast balance method)
-       */
-      async getVaultSnapshotFast(positionId) {
-        const positionState = await this.queryPositionState(positionId);
-        console.log(
-          `[Vault Snapshot] Raw vault address from contract: "${positionState.vaultAddress}"`
-        );
-        const useStubbedBtcData = this.config.debugOverrides?.useStubbedBtcData === true;
-        const [balanceResult, btcPriceUsd] = useStubbedBtcData ? this.buildStubbedBtcSnapshotInputs(positionState) : await Promise.all([
-          this.config.vaultBalance.calculateTrustedBalance(
-            positionId,
-            positionState.vaultAddress,
-            true
-            // Always skip UTXO validation for fast path
-          ),
-          this.config.priceOracle.getBTCPrice()
-        ]);
-        const protocolParams = createProtocolParametersModule({
-          termManagerAddress: this.config.termManagerAddress,
-          loanOpsManagerAddress: this.config.loanOpsManagerAddress,
-          liquidationManagerAddress: this.config.liquidationManagerAddress,
-          chain: this.config.chain,
-          chainId: this.config.chainId || 1,
-          // Default to mainnet if not provided
-          rpcUrl: this.config.rpcUrl
-        });
-        const termForFees = this.config.termOverride ?? positionState.selectedTerm;
-        const [liquidationThresholdBps, maxEscalatedThresholdBps, termFees] = await Promise.all([
-          protocolParams.getLiquidationThreshold(),
-          protocolParams.getMaxEscalatedThreshold(),
-          protocolParams.getTermFees(termForFees)
-        ]);
-        const termStatus = calculateTermStatus(
-          positionState.termStartTimestamp,
-          positionState.selectedTerm
-        );
-        const currentLiquidationThreshold = calculateLiquidationThreshold(
-          termStatus.isExpired,
-          termStatus.daysIntoGracePeriod,
-          liquidationThresholdBps,
-          maxEscalatedThresholdBps
-        );
-        const collateralMetrics = calculateCollateralMetrics(
-          balanceResult.availableBalance,
-          btcPriceUsd,
-          positionState.ucdDebt
-        );
-        const isLiquidatable = collateralMetrics.collateralRatioBps < currentLiquidationThreshold;
-        const marginToLiquidationBps = collateralMetrics.collateralRatioBps - currentLiquidationThreshold;
-        return {
-          // Raw state
-          positionId: positionState.positionId,
-          pkpId: positionState.pkpId,
-          borrower: positionState.borrower,
-          vaultAddress: positionState.vaultAddress,
-          ucdDebt: positionState.ucdDebt,
-          termStartTimestamp: positionState.termStartTimestamp,
-          selectedTerm: positionState.selectedTerm,
-          status: positionState.status,
-          // Loan status enum value (0-7)
-          expiryAt: positionState.expiryAt,
-          // Loan expiry timestamp
-          previousExpiryAt: positionState.previousExpiryAt,
-          // expiryAt before last renewal; 0 if never renewed
-          totalTerm: positionState.totalTerm,
-          // total accumulated loan months; 0 before first renewal
-          lastRenewedAt: positionState.lastRenewedAt,
-          // timestamp of most recent renewal; createdAt at origination; 0 for pre-H-5 positions
-          // Bitcoin state
-          totalBTCSats: balanceResult.totalBalance,
-          totalUTXOs: balanceResult.totalUTXOs,
-          authorizedSpendsSats: balanceResult.authorizedBalance,
-          authorizedSpendsHash: balanceResult.authorizedSpendsHash,
-          availableBTCSats: balanceResult.availableBalance,
-          availableUTXOs: balanceResult.availableUTXOs,
-          // Price data
-          btcPriceUsd,
-          // Calculated metrics
-          collateralValueUsd: collateralMetrics.collateralValueUsd,
-          collateralRatioBps: collateralMetrics.collateralRatioBps,
-          // Term status
-          termDurationDays: termStatus.termDurationDays,
-          termLengthDays: termStatus.termLengthDays,
-          isExpired: termStatus.isExpired,
-          daysUntilExpiry: termStatus.daysUntilExpiry,
-          daysIntoGracePeriod: termStatus.daysIntoGracePeriod,
-          // Liquidation risk
-          currentLiquidationThreshold,
-          isLiquidatable,
-          marginToLiquidationBps,
-          // Protocol parameters (from smart contracts)
-          liquidationThresholdBps,
-          originationFeeBps: termFees.originationFeeBps,
-          extensionFeeBps: termFees.extensionFeeBps,
-          // Metadata
-          timestamp: Date.now()
-        };
-      }
+      // NOTE (remediation P1/#5): `getVaultSnapshotFast` — a snapshot built on the
+      // skip-UTXO-validation balance path — was deleted. It had zero callers, and
+      // a snapshot whose balance skipped UTXO validation + consensus must never
+      // exist within reach of a signing flow. Every snapshot now runs the full
+      // validation path above.
       buildStubbedBtcSnapshotInputs(positionState) {
         const stubbedAvailableBtcSats = BigInt(
           this.config.debugOverrides?.stubbedAvailableBtcSats ?? "10000000"
@@ -2834,14 +2861,20 @@ ${errorReport}`);
           expiryAt,
           selectedTermMonths
         );
+        const parsedVaultAddress = parseVaultAddress(
+          position.vaultAddress,
+          validateChain(this.config.chain)
+        );
+        if (typeof parsedVaultAddress !== "string" || parsedVaultAddress.length === 0) {
+          throw new Error(
+            `Position ${positionIdBytes32} vaultAddress has no entry for chain "${this.config.chain}"`
+          );
+        }
         return {
           positionId: position.positionId,
           pkpId: position.pkpId,
           borrower: position.borrower,
-          vaultAddress: this.parseVaultAddress(
-            position.vaultAddress,
-            validateChain(this.config.chain)
-          ),
+          vaultAddress: parsedVaultAddress,
           ucdDebt: BigInt(position.ucdDebt.toString()),
           termStartTimestamp,
           selectedTerm: selectedTermMonths,
@@ -2852,36 +2885,8 @@ ${errorReport}`);
           lastRenewedAt
         };
       }
-      /**
-       * Parse vault address based on format and network
-       *
-       * Supports two formats:
-       * 1. Single string: "mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"
-       * 2. JSON object: {"mainnet":"bc1q...","testnet":"mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"}
-       *
-       * @param rawVaultAddress Raw vault address from contract
-       * @param chain EVM chain (sepolia, ethereum)
-       * @returns Parsed Bitcoin address for the appropriate network
-       */
-      parseVaultAddress(rawVaultAddress, chain) {
-        try {
-          const parsed = JSON.parse(rawVaultAddress);
-          if (typeof parsed === "object" && parsed !== null) {
-            const chainLower = chain.toLowerCase();
-            if (chainLower === "sepolia") {
-              return parsed.regtest || parsed.testnet || parsed.mainnet;
-            }
-            const bitcoinNetwork = getBitcoinNetworkForChain(chain);
-            if (bitcoinNetwork === "testnet") {
-              return parsed.testnet || parsed.regtest || parsed.mainnet;
-            } else {
-              return parsed.mainnet;
-            }
-          }
-        } catch (e) {
-        }
-        return rawVaultAddress;
-      }
+      // parseVaultAddress moved to `modules/vault-address.ts` (shared with the
+      // phase-2 signer for the P6/#7b vault-identity binding).
       /**
        * Quick check if position is liquidatable
        *
@@ -3219,6 +3224,13 @@ ${auth.clientId}`;
           return {};
       }
     }
+    function assertSaneSatoshis(value, context) {
+      if (!Number.isSafeInteger(value) || value < 0 || value > MAX_BTC_AMOUNT) {
+        throw new Error(
+          `${context}: satoshi value ${value} is not a sane amount (must be an integer in [0, ${MAX_BTC_AMOUNT}])`
+        );
+      }
+    }
     var BitcoinDataProvider = class {
       constructor(config) {
         this.config = config;
@@ -3365,13 +3377,16 @@ ${auth.clientId}`;
           address
         );
         const utxos = unspentOutputs.map(
-          (utxo) => ({
-            txid: utxo.txid,
-            vout: utxo.vout,
-            satoshis: BigInt(Math.round(utxo.amount * 1e8)),
-            // BTC to satoshis as bigint
-            confirmations: utxo.confirmations
-          })
+          (utxo) => {
+            const satNumber = Math.round(utxo.amount * 1e8);
+            assertSaneSatoshis(satNumber, `fetchUTXOsFromRPC ${utxo.txid}:${utxo.vout}`);
+            return {
+              txid: utxo.txid,
+              vout: utxo.vout,
+              satoshis: BigInt(satNumber),
+              confirmations: utxo.confirmations
+            };
+          }
         );
         return utxos;
       }
@@ -3413,6 +3428,7 @@ ${auth.clientId}`;
               "Invalid UTXO row: missing txid, vout/n, or value/satoshis"
             );
           }
+          assertSaneSatoshis(satRaw, `parseBlockstreamUTXOs ${txid}:${vout}`);
           utxos.push({
             txid,
             vout,
@@ -3591,7 +3607,10 @@ ${auth.clientId}`;
               `Invalid response: missing required fields. funded_txo_sum: ${fundedTxoSum}, spent_txo_sum: ${spentTxoSum}`
             );
           }
+          assertSaneSatoshis(fundedTxoSum, `getBalance ${cleanAddress} funded_txo_sum`);
+          assertSaneSatoshis(spentTxoSum, `getBalance ${cleanAddress} spent_txo_sum`);
           const confirmedBalance = fundedTxoSum - spentTxoSum;
+          assertSaneSatoshis(confirmedBalance, `getBalance ${cleanAddress} confirmed balance`);
           const balance = BigInt(confirmedBalance);
           this.logger.log("3", `Balance: ${balance.toString()} sats`);
           this.logger.log(
@@ -4070,20 +4089,590 @@ ${auth.clientId}`;
         return priceWith8Decimals;
       }
     };
+    var MAX_CLASSIFIED_PARENTS = 5;
+    var CLASSIFICATION_CONCURRENCY = 2;
+    var CONFIRMATION_SKEW_TOLERANCE = 3;
+    async function mapWithConcurrency(items, limit, fn) {
+      const results = new Array(items.length);
+      let next = 0;
+      const workers = Array.from(
+        { length: Math.min(limit, items.length) },
+        async () => {
+          while (true) {
+            const i = next++;
+            if (i >= items.length) {
+              return;
+            }
+            results[i] = await fn(items[i]);
+          }
+        }
+      );
+      await Promise.all(workers);
+      return results;
+    }
+    function findOutputClaimMismatch(claimedUtxos, outputs, cleanVaultAddress) {
+      for (const claim of claimedUtxos) {
+        const output = outputs.find((o) => o.index === claim.vout);
+        if (!output) {
+          return `claimed output ${claim.txid}:${claim.vout} not present in parent tx`;
+        }
+        if (output.scriptpubkey_address !== cleanVaultAddress) {
+          return `claimed output ${claim.txid}:${claim.vout} pays ${output.scriptpubkey_address ?? "<no address>"}, not the vault`;
+        }
+        if (output.value === void 0 || output.value !== claim.satoshis) {
+          return `claimed output ${claim.txid}:${claim.vout} value ${output.value?.toString() ?? "<missing>"} != reported ${claim.satoshis.toString()}`;
+        }
+      }
+      return null;
+    }
+    function stripNetworkPrefix(address) {
+      const prefixPattern = /^(REGTEST_|TESTNET_|MAINNET_)/;
+      return address.replace(prefixPattern, "");
+    }
+    var VaultBalanceConsensus = class {
+      /**
+       * @param minConsensusProviders Policy floor (`policy.minConsensusProviders`,
+       *   remediation P1/#1). Both consensus passes THROW when fewer providers are
+       *   configured than the floor demands — below it the cross-checks cannot run
+       *   and neither trusting the primary (inflation) nor excluding UTXOs
+       *   (deflation → wrongful liquidation) is a safe direction. A floor of 1
+       *   (hardhat / single-provider sepolia) preserves the trust-primary /
+       *   exclude-unconfirmed baseline unchanged.
+       */
+      constructor(primaryProvider, providerConfigs, minConsensusProviders) {
+        this.primaryProvider = primaryProvider;
+        this.providerConfigs = providerConfigs;
+        this.minConsensusProviders = minConsensusProviders;
+        this.readers = this.buildReaders();
+      }
+      /**
+       * Fail-closed floor check shared by both consensus passes. Only floors above
+       * 1 can bite: a floor of 1 with zero configs means "no esplora access
+       * configured" (dev/test), where the documented pre-gate behaviour —
+       * trust-primary confirmed set, exclude unconfirmed — remains correct.
+       */
+      assertProviderFloor(pass) {
+        const configured = this.providerConfigs?.length ?? 0;
+        if (this.minConsensusProviders > 1 && configured < this.minConsensusProviders) {
+          throw new Error(
+            `${pass}: this chain requires at least ${this.minConsensusProviders} Bitcoin providers for consensus; ${configured} configured. Refusing to proceed without cross-check.`
+          );
+        }
+      }
+      /**
+       * Build one data reader per configured provider (primary first). Index 0
+       * reuses the injected primary instance; the rest are constructed from their
+       * configs so cross-check reads hit the right endpoint. Null when no providers
+       * are configured — both passes then fall back to primary-only behaviour.
+       */
+      buildReaders() {
+        const configs = this.providerConfigs;
+        if (!configs || configs.length === 0) {
+          return null;
+        }
+        return configs.map(
+          (cfg, i) => i === 0 ? this.primaryProvider : new BitcoinDataProvider({
+            providerUrl: cfg.providerUrl,
+            auth: cfg.auth,
+            ...cfg.timeout ? { timeout: cfg.timeout } : {}
+          })
+        );
+      }
+      /**
+       * Confirmed-UTXO-set consensus across every registered provider (strict).
+       *
+       * The signed balance is dominated by the primary's confirmed UTXOs, but the
+       * UTXO set — txid, vout, and value — is read only from the primary; the
+       * `assertBitcoinBalanceConsensus` check the validators run compares
+       * `chain_stats` totals, not individual outpoints. So a compromised primary
+       * can add a fabricated confirmed UTXO, or inflate a real one's value, and the
+       * balance consensus still passes (it serves honest `chain_stats`). This
+       * closes that: each UTXO the primary reports at or above `minConfirmations`
+       * must be present with the EXACT same value on every registered provider.
+       *
+       * Semantics:
+       *  - Absent on any provider, or value mismatch → THROW (fail-closed). Confirmed
+       *    transactions are fully propagated, so absence is unambiguous forgery, not
+       *    a race.
+       *  - Present + value-matched everywhere: the UTXO counts as confirmed only if
+       *    it meets `minConfirmations` on ALL providers (gated on the minimum
+       *    reported depth). A UTXO just past the boundary on the primary but a block
+       *    behind on a lagging provider is DEMOTED — excluded until it matures —
+       *    rather than signed over. A depth spread beyond CONFIRMATION_SKEW_TOLERANCE
+       *    is not benign skew but a provider lying about depth (to inflate a shallow
+       *    UTXO past the gate, or deflate a deep one into a wrongful liquidation) →
+       *    THROW.
+       *  - SYMMETRIC (finding #6): a confirmed outpoint any secondary reports that
+       *    the primary omits entirely, reports with a different value, or reports
+       *    at a depth more than the skew tolerance BELOW the secondary's → THROW.
+       *    Without this, a compromised primary deflates the balance by omission and
+       *    forces a wrongful liquidation.
+       *
+       * Below `minConsensusProviders` this THROWS (P1/#1). With a floor of 1 and
+       * 0/1 providers configured, no cross-check is possible and the primary's
+       * confirmed UTXOs are returned unchanged (behaviour identical to before
+       * this gate).
+       *
+       * Cross-checking `chain_stats` totals against the confirmed-UTXO sum was
+       * considered and rejected: `getBalance` reads mempool-blind `chain_stats`
+       * while `getUTXOSet` removes mempool-spent outputs, so the two legitimately
+       * diverge during any pending spend — precisely the self-change window — and
+       * that comparison would false-fail there. Outpoint-set consensus asserts
+       * agreement only on confirmed outpoints, which the mempool does not touch.
+       *
+       * @returns Set of "txid:vout" keys admitted as confirmed-with-consensus.
+       */
+      async confirmedUtxoConsensus(primaryUtxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        this.assertProviderFloor("confirmedUtxoConsensus");
+        const confirmedKeys = /* @__PURE__ */ new Set();
+        const primaryConfirmed = primaryUtxos.filter(
+          (utxo) => utxo.confirmations >= minConfirmations
+        );
+        for (const utxo of primaryConfirmed) {
+          confirmedKeys.add(`${utxo.txid}:${utxo.vout}`);
+        }
+        if (!providerConfigs || providerConfigs.length <= 1 || !readers) {
+          return confirmedKeys;
+        }
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          readers.slice(1).map((reader) => reader.getUTXOSet(vaultAddress, minConfirmations))
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i + 1) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Confirmed UTXO set read failed for ${vaultAddress} on ${failures.length}/${providerConfigs.length - 1} secondary provider(s): ${failures.join("; ")}`
+          );
+        }
+        const secondaryMaps = settled.map((r) => {
+          const map2 = /* @__PURE__ */ new Map();
+          for (const utxo of r.value.utxos) {
+            map2.set(`${utxo.txid}:${utxo.vout}`, {
+              value: utxo.satoshis,
+              confirmations: utxo.confirmations
+            });
+          }
+          return map2;
+        });
+        const demoted = [];
+        for (const utxo of primaryConfirmed) {
+          const key = `${utxo.txid}:${utxo.vout}`;
+          let minConfs = utxo.confirmations;
+          let maxConfs = utxo.confirmations;
+          for (let s = 0; s < secondaryMaps.length; s++) {
+            const entry = secondaryMaps[s].get(key);
+            const name = providerName(s + 1);
+            if (!entry) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${providerName(0)} but absent on ${name}; refusing to sign (possible fabricated UTXO).`
+              );
+            }
+            if (entry.value !== utxo.satoshis) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${utxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations < minConfs)
+              minConfs = entry.confirmations;
+            if (entry.confirmations > maxConfs)
+              maxConfs = entry.confirmations;
+          }
+          if (maxConfs - minConfs > CONFIRMATION_SKEW_TOLERANCE) {
+            throw new Error(
+              `Confirmed UTXO ${key} confirmation spread ${maxConfs - minConfs} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE} (min ${minConfs}, max ${maxConfs}); providers disagree on depth, refusing to sign.`
+            );
+          }
+          if (minConfs < minConfirmations) {
+            confirmedKeys.delete(key);
+            demoted.push(key);
+          }
+        }
+        if (demoted.length > 0) {
+          litDebugLog(
+            `[VaultBalance] confirmed-consensus: ${demoted.length} UTXO(s) demoted pending provider tip skew (excluded until matured): ${demoted.join(", ")}`
+          );
+        }
+        const primaryByKey = new Map(
+          primaryUtxos.map((utxo) => [`${utxo.txid}:${utxo.vout}`, utxo])
+        );
+        for (let s = 0; s < secondaryMaps.length; s++) {
+          const name = providerName(s + 1);
+          for (const [key, entry] of secondaryMaps[s]) {
+            if (entry.confirmations < minConfirmations)
+              continue;
+            const primaryUtxo = primaryByKey.get(key);
+            if (!primaryUtxo) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${name} (${entry.confirmations} confs) but absent on ${providerName(0)}; refusing to sign (possible omitted UTXO / balance deflation \u2014 may be transient during an in-flight vault spend).`
+              );
+            }
+            if (primaryUtxo.satoshis !== entry.value) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${primaryUtxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations - primaryUtxo.confirmations > CONFIRMATION_SKEW_TOLERANCE) {
+              throw new Error(
+                `Confirmed UTXO ${key} depth disagreement: ${providerName(0)}=${primaryUtxo.confirmations} vs ${name}=${entry.confirmations} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE}; the primary may be under-reporting depth to suppress collateral, refusing to sign.`
+              );
+            }
+          }
+        }
+        return confirmedKeys;
+      }
+      /**
+       * Classify unconfirmed UTXOs as protocol self-change.
+       *
+       * A UTXO below minConfirmations counts as confirmed-equivalent ONLY when the
+       * transaction that created it spends exclusively vault-owned, confirmed
+       * outputs. Such a transaction can only have been signed by the vault's PKP,
+       * so no third party can RBF-replace or double-spend it — the reversal risk
+       * the confirmation gate exists to close does not apply. Any non-vault input,
+       * unconfirmed funding tx, or coinbase input disqualifies the UTXO
+       * (fail-safe: exclusion, never inclusion).
+       *
+       * Multi-provider consensus (audit C-1/C-2 parity): the parent-tx proof is
+       * verified independently against EVERY configured provider and admitted
+       * only on unanimity. The confirmed-balance consensus the validators run
+       * covers `chain_stats` only, so without this the primary provider alone
+       * could fabricate an unconfirmed UTXO plus a self-consistent parent proof
+       * and inflate the signed balance. Any provider failure or verdict
+       * disagreement THROWS (fail-closed) — exclusion on a suppressed proof
+       * would deflate the balance and open a wrongful-liquidation window, so
+       * neither direction may proceed without agreement.
+       *
+       * The same per-provider `/tx` fetch also returns the parent's outputs, and
+       * every provider must corroborate each claimed UTXO (index, vault address,
+       * exact value) before admission — the UTXO list itself comes only from the
+       * primary, so an unchecked claim would let it attach a fabricated or
+       * inflated output to a genuine self-spend.
+       *
+       * Fetch cost: zero when every UTXO is confirmed (the common case); otherwise
+       * per provider: one tx lookup per classified parent (vins + vouts in one
+       * response), plus per distinct funding tx a confirmation check and — only
+       * when the provider omits vin prevout data — an output lookup. Classified
+       * parents are capped at MAX_CLASSIFIED_PARENTS (largest claimed value
+       * first, deterministic) and evaluated CLASSIFICATION_CONCURRENCY at a time,
+       * so third-party dust spam cannot amplify into provider rate-limiting and
+       * an action-wide outage.
+       *
+       * See docs/vault-balance-confirmed-gate-plan-2026-07-14.md §3.1.
+       *
+       * @param utxos - Full UTXO set for the vault address
+       * @param vaultAddress - Bitcoin address of the vault (may carry network prefix)
+       * @param minConfirmations - Confirmation threshold for the chain
+       * @returns Set of "txid:vout" keys for UTXOs verified as self-change
+       */
+      async classifySelfChange(utxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        const selfChange = /* @__PURE__ */ new Set();
+        const unconfirmed = utxos.filter(
+          (utxo) => utxo.confirmations < minConfirmations
+        );
+        if (unconfirmed.length === 0) {
+          return selfChange;
+        }
+        this.assertProviderFloor("classifySelfChange");
+        if (!providerConfigs || providerConfigs.length === 0 || !readers) {
+          litDebugLog(
+            `[VaultBalance] ${unconfirmed.length} unconfirmed UTXO(s) excluded: no bitcoinProviderConfigs for self-change classification`
+          );
+          return selfChange;
+        }
+        const cleanVaultAddress = stripNetworkPrefix(vaultAddress);
+        const claimsByParent = /* @__PURE__ */ new Map();
+        for (const utxo of unconfirmed) {
+          const claims = claimsByParent.get(utxo.txid) ?? [];
+          claims.push(utxo);
+          claimsByParent.set(utxo.txid, claims);
+        }
+        const claimedSum = (txid) => claimsByParent.get(txid).reduce((sum, utxo) => sum + utxo.satoshis, 0n);
+        const rankedParents = [...claimsByParent.keys()].sort((a, b) => {
+          const diff = claimedSum(b) - claimedSum(a);
+          if (diff !== 0n) {
+            return diff > 0n ? 1 : -1;
+          }
+          return a < b ? -1 : a > b ? 1 : 0;
+        });
+        const parentTxids = rankedParents.slice(0, MAX_CLASSIFIED_PARENTS);
+        const skippedParents = rankedParents.length - parentTxids.length;
+        if (skippedParents > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${skippedParents} parent tx(s) beyond the ${MAX_CLASSIFIED_PARENTS}-parent classification budget excluded (mempool-spam bound; largest claimed value classified first)`
+          );
+        }
+        const verdicts = await mapWithConcurrency(
+          parentTxids,
+          CLASSIFICATION_CONCURRENCY,
+          async (parentTxid) => ({
+            parentTxid,
+            verified: await this.verifyParentIsSelfSpendConsensus(
+              parentTxid,
+              claimsByParent.get(parentTxid),
+              cleanVaultAddress,
+              minConfirmations,
+              providerConfigs,
+              readers
+            )
+          })
+        );
+        const verifiedParents = new Set(
+          verdicts.filter((v) => v.verified).map((v) => v.parentTxid)
+        );
+        for (const utxo of unconfirmed) {
+          if (verifiedParents.has(utxo.txid)) {
+            selfChange.add(`${utxo.txid}:${utxo.vout}`);
+          }
+        }
+        if (verifiedParents.size > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${selfChange.size}/${unconfirmed.length} unconfirmed UTXO(s) verified as protocol change by ${providerConfigs.length} provider(s)`
+          );
+        }
+        return selfChange;
+      }
+      /**
+       * Run the self-spend proof against every configured provider and require
+       * unanimity. Fail-closed: a provider request failure or a verdict
+       * disagreement throws and aborts the balance calculation — see
+       * classifySelfChange for why exclusion is not a safe fallback here.
+       *
+       * When the parent IS a unanimous self-spend, every provider's view of the
+       * parent's OUTPUTS must additionally corroborate the primary's claimed
+       * UTXOs (index exists, pays the vault, exact value). Without this, a
+       * compromised primary could attach a fabricated or value-inflated output
+       * to a genuine self-spend the honest providers happily verify.
+       *
+       * @returns True when every provider verified the parent and corroborated
+       *          the claimed outputs, false when every provider rejected the
+       *          parent (genuine third-party deposit)
+       */
+      async verifyParentIsSelfSpendConsensus(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, providerConfigs, readers) {
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          providerConfigs.map(
+            (cfg, i) => this.evaluateParentForProvider(
+              parentTxid,
+              claimedUtxos,
+              cleanVaultAddress,
+              minConfirmations,
+              readers[i],
+              cfg
+            )
+          )
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Self-change classification failed for tx ${parentTxid} on ${failures.length}/${providerConfigs.length} provider(s): ${failures.join("; ")}`
+          );
+        }
+        const evaluations = settled.map(
+          (r) => r.value
+        );
+        const votes = evaluations.map((e) => e.selfSpend);
+        const disagreements = votes.map((vote, i) => ({ vote, name: providerName(i) })).filter((x) => x.vote !== votes[0]).map(
+          (x) => `${providerName(0)}=${votes[0]} vs ${x.name}=${x.vote}`
+        );
+        if (disagreements.length > 0) {
+          throw new Error(
+            `Self-change consensus mismatch for tx ${parentTxid}: ${disagreements.join("; ")}. A provider may be compromised or out of sync; refusing to sign.`
+          );
+        }
+        if (!votes[0]) {
+          return false;
+        }
+        const outputMismatches = evaluations.map((e, i) => e.outputMismatch ? `${providerName(i)} \u2192 ${e.outputMismatch}` : null).filter((m) => m !== null);
+        if (outputMismatches.length > 0) {
+          throw new Error(
+            `Self-change output claim mismatch for tx ${parentTxid}: ${outputMismatches.join("; ")}. The reported UTXO set contradicts the parent transaction; refusing to sign.`
+          );
+        }
+        return true;
+      }
+      /**
+       * Single provider's evaluation of a parent tx: the self-spend proof plus —
+       * when the proof holds — corroboration of the claimed outputs against this
+       * provider's view of the parent's vout set. The output check is skipped for
+       * non-self-spend parents (their UTXOs are excluded regardless, and a
+       * third-party deposit's values are not ours to police).
+       */
+      async evaluateParentForProvider(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, reader, providerConfig) {
+        const parentTx = await this.fetchParentTransaction(
+          parentTxid,
+          providerConfig
+        );
+        if (!parentTx || parentTx.inputs.length === 0) {
+          return { selfSpend: false, outputMismatch: null };
+        }
+        const selfSpend = await this.verifyInputsAreSelfSpend(
+          parentTx.inputs,
+          cleanVaultAddress,
+          minConfirmations,
+          reader
+        );
+        const outputMismatch = selfSpend ? findOutputClaimMismatch(claimedUtxos, parentTx.outputs, cleanVaultAddress) : null;
+        return { selfSpend, outputMismatch };
+      }
+      /**
+       * Verify that a transaction's inputs spend exclusively vault-owned,
+       * confirmed outputs, using a single provider's view of the chain.
+       *
+       * @param inputs - Parsed inputs of the parent transaction
+       * @param cleanVaultAddress - Vault address with network prefix stripped
+       * @param minConfirmations - Required depth for every funding transaction
+       * @param reader - Data provider for funding-tx lookups (same provider the inputs came from)
+       * @returns True only when every input is a confirmed, vault-owned outpoint
+       */
+      async verifyInputsAreSelfSpend(inputs, cleanVaultAddress, minConfirmations, reader) {
+        const fundingTxids = [...new Set(inputs.map((input) => input.txid))];
+        const outputsByFundingTx = /* @__PURE__ */ new Map();
+        const needsOutputLookup = fundingTxids.filter(
+          (fundingTxid) => inputs.some(
+            (input) => input.txid === fundingTxid && input.prevoutAddress === void 0
+          )
+        );
+        await Promise.all(
+          needsOutputLookup.map(async (fundingTxid) => {
+            outputsByFundingTx.set(
+              fundingTxid,
+              await reader.getTransactionOutputs(fundingTxid)
+            );
+          })
+        );
+        for (const input of inputs) {
+          let ownerAddress = input.prevoutAddress;
+          if (ownerAddress === void 0) {
+            const outputs = outputsByFundingTx.get(input.txid);
+            ownerAddress = outputs?.find(
+              (output) => output.index === input.vout
+            )?.scriptpubkey_address;
+          }
+          if (ownerAddress !== cleanVaultAddress) {
+            return false;
+          }
+        }
+        const fundingStatuses = await Promise.all(
+          fundingTxids.map((fundingTxid) => reader.getTransaction(fundingTxid))
+        );
+        for (const status of fundingStatuses) {
+          if (!status || status.confirmations < minConfirmations) {
+            return false;
+          }
+        }
+        return true;
+      }
+      /**
+       * Fetch a parent transaction's inputs (vins) and outputs (vouts) via Esplora.
+       *
+       * A module-private fetch (not a `BitcoinDataProvider` method) so editing this
+       * consensus logic does not rebundle the shared provider module's other
+       * importers — see this file's header for the ripple-set constraint.
+       *
+       * @param txid - Transaction ID
+       * @param providerConfig - Esplora endpoint to query (one of the configured
+       *          consensus providers)
+       * @returns Parsed inputs + outputs, or null ONLY when the tx is provably not
+       *          a self-spend candidate (coinbase-funded). Provider inability —
+       *          404, malformed vin rows, missing vin array — THROWS (review
+       *          2026-07-15 P1): the parent of a UTXO the primary lists must
+       *          exist, so "can't fetch it" is a provider failure, and treating it
+       *          as a false self-change vote would silently deflate collateral
+       *          (wrongful-liquidation direction) if every provider failed the
+       *          same way.
+       */
+      async fetchParentTransaction(txid, providerConfig) {
+        if (!providerConfig.providerUrl) {
+          return null;
+        }
+        const timeout = providerConfig.timeout || 15e3;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+          const response = await fetch(`${providerConfig.providerUrl}/tx/${txid}`, {
+            signal: controller.signal,
+            headers: await authHeaders(providerConfig.auth, timeout)
+          });
+          if (!response.ok) {
+            if (response.status === 404) {
+              throw new Error(
+                `parent tx ${txid} not found on this provider \u2014 cannot verify the self-change proof`
+              );
+            }
+            throw new Error(
+              `Bitcoin provider error: ${response.status} ${response.statusText}`
+            );
+          }
+          const data = await response.json();
+          if (!data.vin || !Array.isArray(data.vin) || data.vin.length === 0) {
+            throw new Error(
+              `provider returned tx ${txid} without a vin array \u2014 malformed response`
+            );
+          }
+          const inputs = [];
+          for (const vin of data.vin) {
+            if (vin.is_coinbase) {
+              return null;
+            }
+            if (vin.txid === void 0 || vin.vout === void 0) {
+              throw new Error(
+                `provider returned tx ${txid} with a malformed vin row (missing txid/vout)`
+              );
+            }
+            inputs.push({
+              txid: vin.txid,
+              vout: vin.vout,
+              prevoutAddress: vin.prevout?.scriptpubkey_address
+            });
+          }
+          const outputs = Array.isArray(data.vout) ? data.vout.map((vout, index) => ({
+            index,
+            scriptpubkey_address: vout?.scriptpubkey_address,
+            value: typeof vout?.value === "number" ? BigInt(vout.value) : void 0
+          })) : [];
+          return { inputs, outputs };
+        } catch (error) {
+          if (isAbortError(error)) {
+            throw new Error(`Request timeout after ${timeout}ms`);
+          }
+          throw error;
+        } finally {
+          clearTimeout(timeoutId);
+        }
+      }
+    };
     var VaultBalanceModule = class {
       constructor(config) {
+        if (!Number.isInteger(config.minConfirmations) || config.minConfirmations < 1) {
+          throw new Error(
+            `VaultBalanceModule: minConfirmations must be a positive integer (got ${config.minConfirmations}). Pass the policy-derived balance-confirmation threshold \u2014 there is no default.`
+          );
+        }
         this.config = config;
         this.bitcoinProvider = config.bitcoinProvider;
       }
       /**
-       * Calculate balance (fast path - no UTXO validation)
+       * Calculate balance (arithmetic only - no UTXO validation)
        *
-       * Fast balance-only calculation that skips UTXO validation.
-       * Uses simple arithmetic: Total Balance - Authorized Balance = Available Balance
+       * Balance-only calculation: Total Balance - Authorized Balance = Available.
        *
-       * Use this when you only need the balance amount and don't need:
-       * - Individual UTXO details
-       * - Validation that authorized UTXOs were actually spent
+       * ⚠️ SECURITY (remediation P1/#5): this result skips UTXO validation, the
+       * confirmed-consensus gate, and self-change proofing. It must NEVER feed a
+       * signed BalanceConfirmation or any authorization decision. No production
+       * action calls it (the `skipUTXOValidation` fast path that used to route
+       * here was deleted); it exists for read-only diagnostics and tests. Adding
+       * a production caller requires Master sign-off.
        *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
@@ -4130,17 +4719,18 @@ ${auth.clientId}`;
        * 1. Authorized transaction not found on network (not broadcasted)
        * 2. Authorized transaction has insufficient confirmations (network updating)
        *
+       * NOTE: the `skipUTXOValidation` fast path was removed (remediation P1/#5).
+       * Every trusted-balance read runs full UTXO validation + consensus; a
+       * balance that skipped validation must never feed a signed
+       * BalanceConfirmation.
+       *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
-       * @param skipUTXOValidation - If true, use fast balance-only path (skips UTXO validation)
        * @returns Complete breakdown of vault balance
        * @throws Error if authorized spends are in invalid state
        */
-      async calculateTrustedBalance(positionId, vaultAddress, skipUTXOValidation) {
-        if (skipUTXOValidation) {
-          return await this.calculateBalance(positionId, vaultAddress);
-        }
-        const minConfirmations = this.config.minConfirmations || 6;
+      async calculateTrustedBalance(positionId, vaultAddress) {
+        const minConfirmations = this.config.minConfirmations;
         const utxoSet = await this.bitcoinProvider.getUTXOSet(
           vaultAddress,
           minConfirmations
@@ -4160,8 +4750,25 @@ ${auth.clientId}`;
           (sum, spend) => sum + spend.satoshis,
           0n
         );
+        const consensus = new VaultBalanceConsensus(
+          this.bitcoinProvider,
+          this.config.bitcoinProviderConfigs,
+          // Absent ⇒ 1: dev/test constructions without a policy keep the
+          // single-provider baseline; validators pass policy.minConsensusProviders.
+          this.config.minConsensusProviders ?? 1
+        );
+        const confirmedConsensusKeys = await consensus.confirmedUtxoConsensus(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
+        const selfChangeKeys = await consensus.classifySelfChange(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
         const availableUTXOs = utxoSet.utxos.filter(
-          (utxo) => !this.isUTXOAuthorized(utxo, authorizedSpends)
+          (utxo) => (confirmedConsensusKeys.has(`${utxo.txid}:${utxo.vout}`) || selfChangeKeys.has(`${utxo.txid}:${utxo.vout}`)) && !this.isUTXOAuthorized(utxo, authorizedSpends)
         );
         const availableBalance = availableUTXOs.reduce(
           (sum, utxo) => sum + utxo.satoshis,
@@ -4393,6 +5000,76 @@ ${auth.clientId}`;
     function createVaultBalanceModule(config) {
       return new VaultBalanceModule(config);
     }
+    var POLICY_BY_CHAIN = {
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: {
+        chain: "hardhat",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        allowArbitraryBitcoinProvider: true,
+        allowArbitraryEvmRpc: true,
+        allowDevSinglePriceProvider: true,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: {
+        chain: "sepolia",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: {
+        chain: "ethereum",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 6,
+        minBitcoinSpendConfirmations: 6,
+        minConsensusProviders: 2
+      }
+    };
+    function getChainPolicy(chain) {
+      const validated = validateChain(chain);
+      const policy = POLICY_BY_CHAIN[validated];
+      if (!policy) {
+        throw new Error(`No chain policy registered for "${chain}"`);
+      }
+      return policy;
+    }
     async function executeVaultSnapshot(params) {
       global.ethers = {
         ...import_ethers16.ethers,
@@ -4437,7 +5114,7 @@ ${auth.clientId}`;
         // Default to mainnet if not provided
         rpcUrl: params.rpcUrl,
         bitcoinProvider,
-        minConfirmations: params.minConfirmations || 6
+        minConfirmations: params.minConfirmations ?? getChainPolicy(params.chain).minBitcoinBalanceConfirmations
       });
       const vaultSnapshot = createVaultSnapshotModule({
         contractAddress: params.contractAddress,
@@ -4671,7 +5348,8 @@ function getSepoliaConfig() {
       contractVersionRegistry: SEPOLIA_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: SEPOLIA_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: SEPOLIA_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: SEPOLIA_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       // Lazy getter for the same module-init snapshot reason as serviceEndpoint.
@@ -4711,7 +5389,8 @@ function getMainnetConfig() {
       contractVersionRegistry: MAINNET_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: MAINNET_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: MAINNET_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: MAINNET_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       diamondHandsUrl: "https://gateway-arbitrum.network.thegraph.com/api/subgraphs/id/CCTPsdYqco2jChDLLBQTbdJWwoukVoMt1cXeR9ti6r9A"
@@ -4851,7 +5530,7 @@ var init_network_configs = __esm({
 });
 
 // src/modules/diamond-hands-sdk.ts
-import { Contract as Contract6, Interface as Interface4, JsonRpcProvider, AbiCoder as AbiCoder2, keccak256 as keccak2565, solidityPackedKeccak256 as solidityPackedKeccak2564, toUtf8Bytes as toUtf8Bytes5, zeroPadValue as zeroPadValue4, toBeHex as toBeHex2, parseEther, formatEther, formatUnits, computeAddress, Signature, ZeroHash, ZeroAddress as ZeroAddress3, MaxUint256 } from "ethers";
+import { Contract as Contract6, Interface as Interface4, JsonRpcProvider, AbiCoder as AbiCoder2, keccak256 as keccak2565, solidityPackedKeccak256 as solidityPackedKeccak2564, toUtf8Bytes as toUtf8Bytes5, getBytes as getBytes4, zeroPadValue as zeroPadValue4, toBeHex as toBeHex2, parseEther, formatEther, formatUnits, computeAddress, Signature, ZeroHash, ZeroAddress as ZeroAddress3, MaxUint256 } from "ethers";
 
 // src/types/result.ts
 function success(value) {
@@ -5748,26 +6427,144 @@ async function buildSignedLoginPayload(signer, chainId, audience) {
   return { chainId, message, signature };
 }
 
+// src/utils/server-session-store.ts
+var REAUTH_WINDOW_SECONDS = 24 * 60 * 60;
+var SAFETY_MARGIN_SECONDS = 5 * 60;
+var STORE_PREFIX = "dh-server-session:";
+function sessionStoreKey(address, chainId, endpoint) {
+  return STORE_PREFIX + `${address.trim().toLowerCase()}:${chainId}:${endpoint.replace(/\/+$/, "")}`;
+}
+function isPayloadShape(value) {
+  return !!value && typeof value === "object" && typeof value.chainId === "number" && typeof value.signature === "string" && !!value.message && typeof value.message.address === "string" && typeof value.message.issuedAt === "number" && typeof value.message.nonce === "string";
+}
+function isPersistedShape(value) {
+  return !!value && typeof value === "object" && value.version === 1 && typeof value.address === "string" && typeof value.chainId === "number" && typeof value.endpoint === "string" && isPayloadShape(value.payload) && (value.token === void 0 || typeof value.token === "string") && (value.tokenExpiresAt === void 0 || typeof value.tokenExpiresAt === "number");
+}
+var LocalStorageSessionStore = class {
+  load(key) {
+    let raw;
+    try {
+      raw = window.localStorage.getItem(key);
+    } catch {
+      return null;
+    }
+    if (!raw)
+      return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      this.clear(key);
+      return null;
+    }
+    if (!isPersistedShape(parsed)) {
+      this.clear(key);
+      return null;
+    }
+    return parsed;
+  }
+  save(key, session) {
+    try {
+      window.localStorage.setItem(key, JSON.stringify(session));
+    } catch {
+    }
+  }
+  clear(key) {
+    try {
+      window.localStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+var MemorySessionStore = class {
+  entries = /* @__PURE__ */ new Map();
+  load(key) {
+    return this.entries.get(key) ?? null;
+  }
+  save(key, session) {
+    this.entries.set(key, session);
+  }
+  clear(key) {
+    this.entries.delete(key);
+  }
+};
+function localStorageUsable() {
+  try {
+    if (typeof window === "undefined" || !window.localStorage)
+      return false;
+    const probe = "__dh_server_session_probe__";
+    window.localStorage.setItem(probe, "1");
+    window.localStorage.removeItem(probe);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDefaultSessionStore() {
+  return localStorageUsable() ? new LocalStorageSessionStore() : new MemorySessionStore();
+}
+
 // src/utils/server-session.ts
 var REFRESH_LEEWAY_SECONDS = 30;
+var ServerLoginError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "ServerLoginError";
+  }
+};
+function isLoginRejection(error) {
+  return error instanceof ServerLoginError && error.status >= 400 && error.status < 500 && error.status !== 429;
+}
 var ServerSession = class {
   signer;
   serviceEndpoint;
   chainId;
+  store;
+  onSignaturePrompt;
   now;
   fetchImpl;
   cached = null;
   inFlight = null;
+  /**
+   * Bumped by `clearPersisted()` (logout / disconnect). An in-flight
+   * `getOrRefresh()` captures this at start and refuses to write its freshly
+   * minted token back to `this.cached`/the store if the value changed
+   * meanwhile — so a refresh racing a sign-out can't silently "un-clear" the
+   * credential it was told to drop.
+   */
+  generation = 0;
+  /**
+   * Store key for the current signer, memoized on first use so the sync
+   * `clear()` can drop the persisted token without an async address lookup.
+   */
+  lastStoreKey = null;
   constructor(opts) {
     assertSafeServiceEndpoint(opts.serviceEndpoint);
     this.signer = opts.signer;
     this.serviceEndpoint = opts.serviceEndpoint.replace(/\/+$/, "");
     this.chainId = opts.chainId;
+    this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
+    this.onSignaturePrompt = opts.onSignaturePrompt;
     this.now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
     this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
   }
-  /** Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds. */
-  async getValidToken() {
+  /**
+   * Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds.
+   * Pass `{ silent: true }` to forbid a fresh wallet signature: it resolves ONLY
+   * from a live cached token or the persisted re-mint envelope, never prompting
+   * and never joining a prompt-capable in-flight refresh (used by `logout()`,
+   * which must never pop the wallet during sign-out). Rejects when only a fresh
+   * signature could produce a token.
+   */
+  async getValidToken(opts) {
+    if (opts?.silent) {
+      const session2 = await this.tryResolveSilently(this.generation);
+      if (!session2) {
+        throw new Error("ServerSession: no existing session to refresh");
+      }
+      return session2.token;
+    }
     const session = await this.getOrRefresh();
     return session.token;
   }
@@ -5775,19 +6572,61 @@ var ServerSession = class {
   async getAuthHeader() {
     return { Authorization: `Bearer ${await this.getValidToken()}` };
   }
-  /** Drop the cached token (e.g. on 401 from server). Next call re-logs in. */
+  /**
+   * Drop the cached token (e.g. on 401 from server). The persisted envelope is
+   * kept — the next call re-mints silently — but its stored token copy is
+   * dropped too so a dead JWT can't be re-adopted from the store.
+   */
   clear() {
     this.cached = null;
     this.inFlight = null;
+    if (!this.store || !this.lastStoreKey)
+      return;
+    const persisted = this.store.load(this.lastStoreKey);
+    if (persisted?.token) {
+      this.store.save(this.lastStoreKey, {
+        ...persisted,
+        token: void 0,
+        tokenExpiresAt: void 0
+      });
+    }
+  }
+  /**
+   * Drop the session AND the persisted re-mint envelope (wallet disconnect /
+   * explicit sign-out paths — anything that must remove the 24h credential
+   * from storage).
+   */
+  async clearPersisted() {
+    this.generation += 1;
+    this.cached = null;
+    this.inFlight = null;
+    if (!this.store)
+      return;
+    try {
+      if (this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      } else {
+        const address = (await this.signer.getAddress()).toLowerCase();
+        this.store.clear(
+          sessionStoreKey(address, this.chainId, this.serviceEndpoint)
+        );
+      }
+    } catch {
+    } finally {
+      this.generation += 1;
+      this.cached = null;
+    }
   }
   /**
-   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`).
-   * Clears the local cache regardless of server response so the client stops
-   * presenting the token.
+   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`)
+   * — which also tombstones the envelope's re-mint window server-side — and
+   * remove the persisted credential locally. Clears the local cache regardless
+   * of server response so the client stops presenting the token.
    */
   async logout() {
-    const token = this.cached?.token ?? await this.getValidToken().catch(() => null);
-    this.clear();
+    const cached = this.cached;
+    const token = cached && cached.expiresAt > this.now() ? cached.token : await this.getValidToken({ silent: true }).catch(() => null);
+    await this.clearPersisted();
     if (!token)
       return;
     const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/logout`, {
@@ -5801,6 +6640,50 @@ var ServerSession = class {
       );
     }
   }
+  /**
+   * Resolve a session WITHOUT ever prompting for a wallet signature: a live
+   * cached token, else the persisted JWT (adopted if still fresh, otherwise
+   * silently re-minted from the envelope). Returns `null` only when a fresh
+   * wallet signature would be required (dead/absent envelope). Never touches
+   * `this.inFlight`, so a silent caller (logout) can resolve independently
+   * instead of being dragged into a prompt-capable refresh already in flight.
+   *
+   * `gen` is the caller's clear-generation snapshot: writes to `this.cached`
+   * and the store are skipped if a `clearPersisted()` landed meanwhile.
+   */
+  async tryResolveSilently(gen) {
+    const nowSec = this.now();
+    if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
+      return this.cached;
+    }
+    const persisted = await this.loadPersisted();
+    if (!persisted)
+      return null;
+    if (persisted.token && typeof persisted.tokenExpiresAt === "number" && persisted.tokenExpiresAt - REFRESH_LEEWAY_SECONDS > this.now()) {
+      const adopted = {
+        token: persisted.token,
+        expiresAt: persisted.tokenExpiresAt
+      };
+      if (gen === this.generation)
+        this.cached = adopted;
+      return adopted;
+    }
+    try {
+      const session = await this.login(persisted.payload);
+      if (gen === this.generation) {
+        this.persist(persisted.payload, session);
+        this.cached = session;
+      }
+      return session;
+    } catch (error) {
+      if (!isLoginRejection(error))
+        throw error;
+      if (gen === this.generation && this.store && this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      }
+      return null;
+    }
+  }
   async getOrRefresh() {
     const nowSec = this.now();
     if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
@@ -5808,39 +6691,97 @@ var ServerSession = class {
     }
     if (this.inFlight)
       return this.inFlight;
+    const gen = this.generation;
+    const notCleared = () => gen === this.generation;
     this.inFlight = (async () => {
       try {
+        const existing = await this.tryResolveSilently(gen);
+        if (existing)
+          return existing;
+        this.onSignaturePrompt?.();
         const payload = await buildSignedLoginPayload(
           this.signer,
           this.chainId,
           this.serviceEndpoint
         );
-        const res = await this.fetchImpl(
-          `${this.serviceEndpoint}/api/auth/login`,
-          {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload)
-          }
-        );
-        if (!res.ok) {
-          const detail = await res.text().catch(() => "");
-          throw new Error(
-            `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`
-          );
+        const session = await this.login(payload);
+        if (notCleared()) {
+          this.persist(payload, session);
+          this.cached = session;
         }
-        const body = await res.json();
-        if (!body?.token || !body?.expiresAt) {
-          throw new Error("lit-ops-server login returned malformed response");
-        }
-        this.cached = { token: body.token, expiresAt: body.expiresAt };
-        return this.cached;
+        return session;
       } finally {
-        this.inFlight = null;
+        if (notCleared())
+          this.inFlight = null;
       }
     })();
     return this.inFlight;
   }
+  async login(payload) {
+    const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new ServerLoginError(
+        `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`,
+        res.status
+      );
+    }
+    const body = await res.json();
+    if (!body?.token || !body?.expiresAt) {
+      throw new Error("lit-ops-server login returned malformed response");
+    }
+    return { token: body.token, expiresAt: body.expiresAt };
+  }
+  /**
+   * Load the persisted session for the current signer, validating that it
+   * belongs to this address/chain/endpoint and that the envelope is still
+   * inside the re-auth window (with a safety margin). Invalid or expired
+   * entries are evicted.
+   */
+  async loadPersisted() {
+    if (!this.store)
+      return null;
+    try {
+      const address = (await this.signer.getAddress()).toLowerCase();
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      const persisted = this.store.load(key);
+      if (!persisted)
+        return null;
+      const withinWindow = this.now() < persisted.payload.message.issuedAt + REAUTH_WINDOW_SECONDS - SAFETY_MARGIN_SECONDS;
+      if (persisted.address !== address || persisted.chainId !== this.chainId || persisted.endpoint !== this.serviceEndpoint || persisted.payload.message.address.toLowerCase() !== address || !withinWindow) {
+        this.store.clear(key);
+        return null;
+      }
+      return persisted;
+    } catch {
+      return null;
+    }
+  }
+  /** Best-effort save of the envelope + live JWT for silent recovery. */
+  persist(payload, session) {
+    if (!this.store)
+      return;
+    const address = payload.message.address.toLowerCase();
+    try {
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      this.store.save(key, {
+        version: 1,
+        address,
+        chainId: this.chainId,
+        endpoint: this.serviceEndpoint,
+        payload,
+        token: session.token,
+        tokenExpiresAt: session.expiresAt
+      });
+    } catch {
+    }
+  }
 };
 
 // src/utils/quantum-revert.utils.ts
@@ -5963,6 +6904,36 @@ async function assertSafeQuantumSubmission(opts) {
 import { keccak256 as keccak2563, toUtf8Bytes as toUtf8Bytes3, solidityPackedKeccak256 as solidityPackedKeccak2563, getBytes as getBytes3, zeroPadValue } from "ethers";
 var QUANTUM_SECONDS = 60;
 var QUANTUM_SAFE_THRESHOLD = 40;
+function hashBtcInputSet(utxos) {
+  if (!Array.isArray(utxos) || utxos.length === 0) {
+    throw new Error("hashBtcInputSet: at least one input is required");
+  }
+  const normalized = utxos.map((u) => {
+    const txid = String(u.txid).toLowerCase().replace(/^0x/, "");
+    const vout = Number(u.vout);
+    const value = Number(u.value);
+    if (!/^[0-9a-f]{64}$/.test(txid)) {
+      throw new Error(`hashBtcInputSet: invalid txid "${u.txid}"`);
+    }
+    if (!Number.isSafeInteger(vout) || vout < 0) {
+      throw new Error(`hashBtcInputSet: invalid vout ${u.vout} for ${txid}`);
+    }
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new Error(`hashBtcInputSet: invalid value ${u.value} for ${txid}:${vout}`);
+    }
+    return { txid, vout, value };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const u of normalized) {
+    const key = `${u.txid}:${u.vout}`;
+    if (seen.has(key)) {
+      throw new Error(`hashBtcInputSet: duplicate outpoint ${key}`);
+    }
+    seen.add(key);
+  }
+  const canonical = normalized.sort((a, b) => a.txid < b.txid ? -1 : a.txid > b.txid ? 1 : a.vout - b.vout).map((u) => `${u.txid}:${u.vout}:${u.value}`).join("|");
+  return keccak2563(toUtf8Bytes3(canonical));
+}
 async function buildBtcExecuteEnvelope(params) {
   const {
     positionId,
@@ -5983,6 +6954,17 @@ async function buildBtcExecuteEnvelope(params) {
       "buildBtcExecuteEnvelope: targetAmount must be a positive number of satoshis"
     );
   }
+  const utxos = params.utxos && params.utxos.length > 0 ? params.utxos : [{ txid, vout, value: satoshis }];
+  const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+  const authorizedInSet = utxos.some(
+    (u) => normTxid(u.txid) === normTxid(txid) && Number(u.vout) === Number(vout)
+  );
+  if (!authorizedInSet) {
+    throw new Error(
+      `buildBtcExecuteEnvelope: the authorized UTXO ${txid}:${vout} must be part of utxos[]`
+    );
+  }
+  const utxosHash = hashBtcInputSet(utxos);
   const nowSec = Date.now() / 1e3;
   const currentQuantumStart = Math.floor(nowSec / QUANTUM_SECONDS) * QUANTUM_SECONDS;
   const secsIntoQuantum = nowSec - currentQuantumStart;
@@ -6019,6 +7001,8 @@ async function buildBtcExecuteEnvelope(params) {
       // targetAddress (BTC destination)
       "uint256",
       // targetAmount (sats authorized to recipient)
+      "bytes32",
+      // utxosHash (canonical hash of the FULL input set — P6/#8)
       "bytes32"
       // actionHash
     ],
@@ -6030,6 +7014,7 @@ async function buildBtcExecuteEnvelope(params) {
       networkFee,
       targetAddress,
       targetAmount,
+      utxosHash,
       actionHash
     ]
   );
@@ -6046,7 +7031,8 @@ async function buildBtcExecuteEnvelope(params) {
     chainId,
     timestamp,
     userSignature,
-    borrowerAddress
+    borrowerAddress,
+    utxos
   };
 }
 
@@ -8862,6 +9848,56 @@ var LoanQuery = class {
       })
     );
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   *
+   * Composes getUserPositions + getLoanEvents (the subgraph has no wallet-scoped
+   * event collection). Each returned LoanEvents carries its own positionId, so
+   * callers can flatten and merge into a single per-wallet timeline.
+   *
+   * Bitcoin deposits never appear in the subgraph — merge those in from an
+   * Esplora source on the consumer side.
+   *
+   * @param userAddress - Loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position (empty array if the wallet has none).
+   *
+   * @example
+   * ```typescript
+   * const result = await loanQuery.getWalletLoanEvents('0x830b...');
+   * if (result.success) {
+   *   const allEvents = result.value; // LoanEvents[] — one per position
+   * }
+   * ```
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    if (this.config.debug) {
+      log.info("\u{1F50D} Querying wallet loan events", { userAddress, filter });
+    }
+    return tryCatchAsync(
+      async () => {
+        const perPosition = await this.config.graphClient.getWalletLoanEvents(
+          userAddress,
+          filter
+        );
+        if (this.config.debug) {
+          log.info("\u2705 Retrieved wallet loan events", {
+            userAddress,
+            positions: perPosition.length,
+            totalEvents: perPosition.reduce((n, p) => n + p.totalEvents, 0)
+          });
+        }
+        return perPosition;
+      },
+      (error) => new SDKError({
+        message: "Failed to query wallet loan events",
+        category: "SUBGRAPH" /* SUBGRAPH */,
+        severity: "MEDIUM" /* MEDIUM */,
+        originalError: error instanceof Error ? error : new Error(String(error)),
+        context: { userAddress, filter }
+      })
+    );
+  }
   /**
    * Clear loan cache
    *
@@ -11603,6 +12639,39 @@ var DiamondHandsGraph = class {
       totalEvents
     };
   }
+  /**
+   * Get the full loan-event history for every position owned by a wallet.
+   *
+   * The subgraph has no wallet-scoped event collection (`User` only derives
+   * `positions`), so this composes the two existing wallet/position queries:
+   * `getUserPositions(wallet)` to enumerate the wallet's positions, then
+   * `getLoanEvents(positionId, filter)` per position. Each returned `LoanEvents`
+   * already carries its own `positionId`, so callers can flatten and merge into
+   * a single timeline.
+   *
+   * Note: Bitcoin deposits are UTXOs on the Bitcoin network and never appear in
+   * the EVM subgraph — surface those from an Esplora source and merge separately.
+   *
+   * @param userAddress - The loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position; empty array if the wallet has none.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    const { positions } = await this.getUserPositions(userAddress);
+    const positionIds = positions.map((p) => p?.id != null ? String(p.id) : "").filter((id) => id.length > 0);
+    if (positionIds.length === 0)
+      return [];
+    const CONCURRENCY = 5;
+    const results = [];
+    for (let i = 0; i < positionIds.length; i += CONCURRENCY) {
+      const batch = positionIds.slice(i, i + CONCURRENCY);
+      const settled = await Promise.all(
+        batch.map((positionId) => this.getLoanEvents(positionId, filter))
+      );
+      results.push(...settled);
+    }
+    return results;
+  }
   // ============================================================================
   // Protocol-wide Events
   // ============================================================================
@@ -15019,6 +16088,27 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       return {};
     return this.serverSession.getAuthHeader();
   }
+  /**
+   * Sign out of the lit-ops-server session for the current auth signer. Call on
+   * wallet disconnect or explicit sign-out so the credential does not outlive
+   * the wallet connection. No-op in standalone mode.
+   *
+   * Attempts a server-side revocation first (`ServerSession.logout()` — which
+   * tombstones the envelope's 24h re-mint window and invalidates the JWT), then
+   * always removes the local credential. If the revocation call fails (offline,
+   * server down, wallet already disconnected) we still clear locally so the
+   * session cannot silently re-mint after sign-out; `logout()` is best-effort
+   * and never prompts the wallet.
+   */
+  async clearServerSession() {
+    if (!this.serverSession)
+      return;
+    try {
+      await this.serverSession.logout();
+    } catch {
+      await this.serverSession.clearPersisted();
+    }
+  }
   /**
    * Audit H-9: invalidate the LoanQuery cache so subsequent reads return
    * the post-write state. We clear the entire loan-query cache (not just
@@ -15130,7 +16220,10 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       this.serverSession = new ServerSession({
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
-        chainId: config.chainId
+        chainId: config.chainId,
+        persistSession: config.sessionPersistence?.enabled,
+        sessionStore: config.sessionPersistence?.store,
+        onSignaturePrompt: config.onSessionSignaturePrompt
       });
     }
     const contractManagerResult = createContractManager({
@@ -17771,9 +18864,12 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
         userSignature: auth.signature,
         rpcUrl: _rpcUrl || this.config.ethRpcUrl,
         // Forward a Bitcoin provider so the validator reaches a reachable esplora on Hardhat
-        // (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat. Prefer
+        // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+        // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+        // is resolved from the on-chain BitcoinProviderRegistry and this field is server-ignored
+        // — emitting it there only misleads readers into thinking it is caller-controlled. Prefer
         // a per-request override (mirrors the mint path's customBitcoinRpcUrl) over the config default.
-        ...(_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
+        ...this.config.chain === "hardhat" && (_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
           bitcoinProviderUrl: _bitcoinRpcUrl || this.config.bitcoinProviders[0].url
         },
         ...this.config.priceProviders && {
@@ -18554,9 +19650,10 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
           rpcUrl: this.config.ethRpcUrl,
           // Pass the SDK's RPC URL to LIT Action
           ...request.rpcUrl && { rpcUrl: request.rpcUrl },
-          // Forward the configured Bitcoin provider so the validator reaches a reachable esplora on
-          // Hardhat (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat.
-          ...this.config.bitcoinProviders?.[0]?.url && {
+          // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+          // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+          // comes from the on-chain BitcoinProviderRegistry and this field is server-ignored.
+          ...this.config.chain === "hardhat" && this.config.bitcoinProviders?.[0]?.url && {
             bitcoinProviderUrl: this.config.bitcoinProviders[0].url
           },
           ...this.config.priceProviders && {
@@ -19615,6 +20712,42 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       };
     }
   }
+  /**
+   * TEMPORARY (multi-UTXO withdrawal fix, Phase A): fetch the vault's confirmed
+   * UTXO set from lit-ops-server (`GET /api/lit/vault-utxos`) so the caller can
+   * assemble and sign the FULL input set for a multi-UTXO consolidation
+   * withdrawal. Phase 1 only returns ONE representative UTXO, so a vault whose
+   * balance is spread across several UTXOs otherwise fails the Phase-2 signer
+   * with "Insufficient UTXO value ... across 1 input(s)".
+   *
+   * Returns `[]` on any failure (non-service mode, network error, bad shape) so
+   * callers transparently fall back to the single authorized UTXO. Superseded
+   * by the btc-withdrawal Lit Action returning its own confirmedUTXOs (Phase B).
+   */
+  async fetchConfirmedVaultUtxos(positionId) {
+    if (this.config.mode !== "service" || !this.config.serviceEndpoint)
+      return [];
+    try {
+      const pid = positionId.startsWith("0x") ? positionId : `0x${positionId}`;
+      const resp = await fetch(
+        `${this.config.serviceEndpoint}/api/lit/vault-utxos?positionId=${encodeURIComponent(pid)}`,
+        { method: "GET", headers: { ...await this.getAuthHeader() } }
+      );
+      if (!resp.ok)
+        return [];
+      const json = await resp.json();
+      if (!json.success || !Array.isArray(json.data?.utxos))
+        return [];
+      return json.data.utxos.map((u) => ({
+        txid: String(u.txid),
+        vout: Number(u.vout),
+        value: Number(u.value),
+        confirmations: Number(u.confirmations ?? 0)
+      }));
+    } catch {
+      return [];
+    }
+  }
   /**
    * Execute Bitcoin withdrawal (Phase 2)
    *
@@ -19684,7 +20817,8 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
         targetAmount: request.targetAmount,
         networkFee: request.networkFee,
         chainId,
-        signer
+        signer,
+        ...request.utxos ? { utxos: request.utxos } : {}
       });
       const headers = {
         "Content-Type": "application/json",
@@ -19715,7 +20849,10 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
               userSignature: envelope.userSignature,
               borrowerAddress: envelope.borrowerAddress,
               chainId: envelope.chainId,
-              timestamp: envelope.timestamp
+              timestamp: envelope.timestamp,
+              // P6/#8: the exact input set hashed into the user signature.
+              // The server must forward this set verbatim to the signer.
+              utxos: envelope.utxos
             })
           }
         );
@@ -20055,10 +21192,13 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
             }
           },
           rpcUrl,
-          ...sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
+          // Hardhat-ONLY: never emitted on prod chains (server-ignored there; provider comes
+          // from the on-chain BitcoinProviderRegistry). The stale-spend action reads
+          // `devBitcoinProviderUrl` directly on Hardhat — this legacy alias is redundant but
+          // kept behind the Hardhat gate so no prod request carries the caller-looking field.
+          ...this.config.chain === "hardhat" && sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
           // Hardhat (chainId 1337/31337) has no on-chain BitcoinProviderRegistry —
-          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Always pass;
-          // non-hardhat chains ignore it. (Single source of truth: bitcoinProviderUrl.)
+          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Non-hardhat chains ignore it.
           ...sdkBitcoinProviderUrl && { devBitcoinProviderUrl: sdkBitcoinProviderUrl },
           ...params.minConfirmations !== void 0 && {
             minConfirmations: params.minConfirmations
@@ -20224,13 +21364,44 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       if (this.config.debug) {
         log.info("\u{1F50D} Found vault UTXO for execution", { utxoIdentifier });
       }
+      let executionUtxos;
+      const gatheredUtxos = await this.fetchConfirmedVaultUtxos(positionId);
+      if (gatheredUtxos.length > 0) {
+        const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+        const byOutpoint = /* @__PURE__ */ new Map();
+        for (const u of gatheredUtxos) {
+          const txid = normTxid(u.txid);
+          byOutpoint.set(`${txid}:${u.vout}`, {
+            txid,
+            vout: Number(u.vout),
+            value: Number(u.value)
+          });
+        }
+        const repKey = `${normTxid(authResult.utxoTxid)}:${authResult.utxoVout}`;
+        if (!byOutpoint.has(repKey)) {
+          byOutpoint.set(repKey, {
+            txid: normTxid(authResult.utxoTxid),
+            vout: Number(authResult.utxoVout),
+            value: Number(authResult.utxoSatoshis)
+          });
+        }
+        if (byOutpoint.size > 1) {
+          executionUtxos = Array.from(byOutpoint.values());
+          if (this.config.debug) {
+            log.info("\u{1F9E9} Multi-UTXO withdrawal: signing full input set", {
+              inputs: executionUtxos.length
+            });
+          }
+        }
+      }
       const executionResult = await this.executeBTCWithdrawal({
         positionId,
         utxoIdentifier,
         utxoSatoshis: Number(authResult.utxoSatoshis),
         networkFee,
         destination: withdrawalAddress,
-        targetAmount: withdrawalAmount
+        targetAmount: withdrawalAmount,
+        ...executionUtxos ? { utxos: executionUtxos } : {}
       });
       if (this.config.debug) {
         log.info("\u2705 Phase 2 complete: Bitcoin transaction executed", {
@@ -20381,6 +21552,15 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
   async getLoanEvents(positionId, filter) {
     return this.loanQuery.getLoanEvents(positionId, filter);
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   * Composes getUserPositions + getLoanEvents; returns one LoanEvents per
+   * position (each carrying its own positionId). Bitcoin deposits are not on the
+   * subgraph — merge those in from an Esplora source on the consumer side.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    return this.loanQuery.getWalletLoanEvents(userAddress, filter);
+  }
   /**
    * Get protocol-wide events across all indexed entity types.
    * Returns a merged, sorted discriminated-union timeline.
@@ -20837,6 +22017,38 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       }));
     }
   }
+  /**
+   * List a vault address's PENDING (not-yet-confirmed) incoming BTC deposits.
+   *
+   * A deposit is "pending" until it reaches the protocol's minimum confirmation
+   * depth (6) — the confirmed balance endpoints (`getVaultBalance` /
+   * `getAddressBalance`) omit anything shallower, so this surfaces in-flight
+   * deposits (0–5 confirmations). Server-delegated: lit-ops-server queries its
+   * configured premium Esplora provider (`/api/lit/pending-deposits`). Requires
+   * service mode.
+   */
+  async getPendingDeposits(vaultAddress) {
+    this.ensureInitialized();
+    if (!isServiceModeConfig(this.config)) {
+      throw new Error("getPendingDeposits requires service mode \u2014 standalone mode is not supported");
+    }
+    const trimmedAddress = vaultAddress?.trim();
+    if (!trimmedAddress) {
+      throw new Error("vaultAddress is required");
+    }
+    const serviceEndpoint = this.config.serviceEndpoint;
+    const url = `${serviceEndpoint}/api/lit/pending-deposits?vaultAddress=${encodeURIComponent(trimmedAddress)}`;
+    const response = await fetch(url, {
+      headers: await this.getAuthHeader()
+    });
+    if (!response.ok) {
+      throw new Error(`Pending deposits request failed: ${response.status} ${response.statusText}`);
+    }
+    const json = await response.json();
+    if (!json.success)
+      throw new Error(json.error ?? "Pending deposits request failed");
+    return json.data ?? [];
+  }
   // ============================================================================
   // HIGH-LEVEL API - Mock Token Operations (Test Networks Only)
   // ============================================================================
@@ -21332,6 +22544,20 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
     if (this.config.debug) {
       log.info(`\u{1F310} Calling liquidation server endpoint: ${endpoint}`);
     }
+    const signer = this.getSignerOrThrow();
+    const intentSigner = await signer.getAddress();
+    const chainId = Number(
+      (await this.getProviderOrThrow().getNetwork()).chainId
+    );
+    const rawPositionId = /^0x/i.test(params.positionId.trim()) ? params.positionId.trim().slice(2) : params.positionId.trim();
+    const canonicalPositionId = "0x" + rawPositionId.padStart(64, "0").toLowerCase();
+    const intentTimestamp = Math.floor(Date.now() / 1e3);
+    const intentActionHash = keccak2565(toUtf8Bytes5("liquidate-position"));
+    const intentHash = solidityPackedKeccak2564(
+      ["bytes32", "uint256", "uint256", "address", "bytes32"],
+      [canonicalPositionId, intentTimestamp, chainId, intentSigner, intentActionHash]
+    );
+    const intentSignature = await signer.signMessage(getBytes4(intentHash));
     const response = await fetch(endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -21347,6 +22573,11 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
           UCDController: params.contractAddresses.ucdController,
           LiquidationManagerModule: params.contractAddresses.liquidationManager
         },
+        liquidatorIntent: {
+          timestamp: intentTimestamp,
+          chainId,
+          signature: intentSignature
+        },
         rpcUrl: params.rpcUrl || this.config.ethRpcUrl,
         priceProviders: this.config.priceProviders,
         pkpTokenId: params.pkpData.tokenId,