fix(bifrost): stabilize confirmed ZEC input selection

ZlyDevMayarequested to merge
zly/zec-confirmed-inputs into develop

Summary

Validators can construct different ZEC signing transactions when their live UTXO views contain extra inputs or locally known unconfirmed change. Ordinary payments can therefore split TSS parties even when the validators share enough confirmed funds to pay.

Select a consistently ordered, sufficient prefix of confirmed inputs to reduce these disagreements.

Changes

  • Preserve Zebra’s UTXO creation heights and integer values. Order eligible inputs by height, normalized transaction ID and output index.
  • Stop ordinary input selection once payment, gas and funded memo outputs are covered. Deliberate consolidation retains its configured input target.
  • When MaxGas is absent, use the same ZIP-317 fee calculation for selection and construction. Incompatible local fee policy defers signing.
  • Check fresh expiry before constructing inputs. Preserve saved checkpoint inputs and expiry, and allow confirmed change mined after the signing reference.
  • Let local spent markers veto a selected plan without substituting other inputs.
  • Preserve confirmed vault-origin dust through validated transaction provenance and a lazy live Asgard membership lookup, with cached proof queries.

Limitations and rollout

Selection still uses live RPC state. Necessary inputs becoming confirmed, concurrent spends, reorganizations and live vault-membership changes can still produce different fresh plans. This change does not introduce shared input allocation.

Follow the existing preactivation deployment model: roll out a consistent build across the intended ZEC signers before activation.

Merge request reports