[droplister]

Internal transactions must not use Counterparty asset outputs as ordinary BTC funding. A local Bitcoin Core 30 / Counterparty 11.5 regtest reproduced the original bug: a second attach consumed a pending 546-sat asset output plus 536 sats of change, consolidating the original 0.1 XCP and new 0.2 XCP on the new output. It did not destroy assets in that reproduction. This change: - Reuses pending-attachment evidence when selecting unconfirmed funding. - Rechecks actual inputs before every internal software/hardware signing operation, including Core fallback inputs and confirmed-but-unindexed outputs. - Allows Move/Detach to spend only the asset source selected in the user's form; additional inputs must be proven asset-free. Missing or substituted sources are refused. - Uses the same evidence checks for the separate ZELD selector. - Marks displayed outputs spent in Bitcoin's mempool or chain, removing list Move/Detach actions while asset balances catch up. Checks are deduplicated and limited to four concurrent requests; unknown reads do not claim a spend, and refresh can clear dropped/reorged spends. Validation: - Pre-fix behavior reproduced using production coin selection and real regtest transactions. - 13 funding-guard cases / 19 assertions passed in Docker with Bun's test runner (temporary test copy adapts only the runner import/import paths; network adapters stubbed). - Added native Vitest coverage for selection, ZELD, outspend status, refresh recovery, and stale card actions. Both full native Vitest shards pass on the final revision, along with lint/type checking, CodeQL, and Trezor emulator integration. The full browser E2E suite is still running. - Original attach-only patch passed both native unit-test shards, lint and type checking before this expansion. - git diff --check passed. No wallet release or marketplace changes are included. This does not establish what happened to the reporting user's assets; their transaction IDs are still needed.