filterInputs

Selects UTXOs from this vault that can be used as inputs in a new transaction, with four gates layered on top of the wallet's general selector (CommonWallet.filterInputs):

1. Ownership — sp.contractId == this.contractId. UTXOs that belong to another contract (or none) are skipped. They were tagged by markInterestingSpendable when this contract first saw them.

2. Maturity — isVaultMature reports the vault spendable. This is the CHECKLOCKTIMEVERIFY clause: the network rejects a spend whose nLockTime is below the vault's unlock value, so a pre-unlock UTXO cannot be turned into a confirmed transaction. We refuse it here rather than build an invalid tx the node will reject. The check follows the same height/time split CLTV uses — block height for sub-500M unlock values, chain median time for a timestamp vault. When the wallet is too disconnected to prove maturity (isVaultMature is null), or no vault has been built (unlockValue is null), the gate is closed — we refuse to offer the input.

3. Current vault — sp.address equals the snapshot vault's address. Several vaults can share one factory contractId, and a spend commits to a single CLTV unlock value, so only the current (index, unlockValue) vault's UTXOs are offered (see selectVaultInputs).

4. Selection — what the caller actually wants:

• filter == null (default): only ungrouped (native Nexa) UTXOs count, and they count by satoshi amount. Mirrors the multisig contract's filterInputs and the wallet's own no-filter default so minAmt semantics stay in satoshis. Token UTXOs at this vault's address are skipped here, not because the contract can't spend them but because mixing token-amount and satoshi-amount returns into a single minAmt accumulator would lie about whether the threshold was reached.

• filter != null: the caller decides. The caller can opt into tokens by returning sp.groupInfo()?.tokenAmount ?: 0 (or any other token-aware accounting) — the ownership and maturity gates still run first, so the filter only sees mature, ours UTXOs.

The wallet's existing unspent / not-reserved / minConfirms gates run inside CommonWallet.filterInputs before the lambda is called, so this implementation does not need to replicate them.