Tracking: no stale-state recovery path in wallet (StateUpdate rebinding is test-only)

[Rob1Ham]

Component: web-wallet/src/client.rs, lib/src/bip448_statechain/package.rs, lib/src/bip448_statechain/transaction.rs
Severity: High impact if triggered; explicitly documented as a PoC boundary — filing as a tracking issue.

Summary

If a previous owner broadcasts and confirms a stale update U(k) (always possible: all state locktimes are 1985–2001 timestamps, so every update gate is already open at all times), the current owner of state n > k has no wallet-supported recovery:

1. The wallet's unilateral exit supports only funding_update and settlement roles (submit_unilateral_exit; parse_recovery_role accepts only those two).
2. build_latest_state_recovery_package returns UnsupportedRecoveryRole::StateUpdate.
3. The rebinding helpers needed to recover — rebind_update_tx / rebind_settlement_tx — have no production callers (test-only usages), so rebinding the signed state-n update over the confirmed state-k output is not possible through any wallet flow.
4. There is also no chain watcher that would even detect the stale spend (funding_bindings tracks spends of the funding output but nothing acts on a stale state output appearing).

Result: a stale-state confirmation bricks the current owner's funds absent custom tooling.

What exists

• Consensus support works: the ignored integration test bip448_latest_state_fast_forwards_over_confirmed_old_state proves the manual sequence (rebind state-3 update over confirmed state-1 output → mine → rebind settlement → recover to current owner).
• Docs disclose the gap (docs/README.md, docs/bip448_rebindable_statechains.md — "no automatic stale-state watcher", "test-side orchestration").

Suggested direction (incremental)

1. Detect: surface stale-state spends in the wallet (the funding_bindings/outspend polling loop already has the data sources).
2. Recover manually: expose a "rebind latest state over confirmed stale state" flow reusing rebind_update_tx + build_state_templates + existing CPFP package builder, initially operator-triggered.
3. Automate later: a watcher service is explicitly out of scope for the PoC; this issue can track that too.

Found during security review of feature/bip448-web-wallet-mutinynet @ 64d2423.