fix(tbtc): monitor the ECDSA and FROST sortition pools independently

[mswilkison]

Summary

Follow-up to #3866 (review finding #3). Fixes sortition-pool monitoring for the dual-pool window of the ECDSA→FROST migration.

During the migration an operator is a member of both sortition pools at once: existing ECDSA wallets keep draining via redemptions while FROST is live. The seven sortition.Chain methods on TbtcChain switch on hasFrostAuthorization() (true whenever FROST is configured), and a single MonitorPool loop consumed them — so:

• During overlap (DisableLegacyECDSA=false): the loop labeled "legacy ECDSA sortition pool monitoring" actually maintained the FROST pool; the ECDSA pool got no maintenance.
• Post-cutover (DisableLegacyECDSA=true): the only loop stopped entirely, leaving the FROST pool — the one new FROST wallet DKG selects from — unmonitored.

The ECDSA drain itself is unaffected either way: signing an existing wallet uses the locally-held key share + the wallet's fixed roster, never sortition-pool state. This is a pool-membership/selection-eligibility fix, not a fund-availability one.

Change

Bind monitoring explicitly per pool. Two sortition.Chain views (ecdsaSortitionChain, frostSortitionChain) route directly to their own registry/pool with no hasFrostAuthorization() switch, and the node runs one MonitorPool loop per pool:

• ECDSA loop — existing flags + policy, now correctly ECDSA-bound (data path and beta policy read the ECDSA pool).
• FROST loop — new DisableFrostSortitionPoolMonitoring flag (default-on), beta policy only (the ECDSA pre-params gate doesn't apply to FROST DKG), gated on FROST being configured and independent of DisableLegacyECDSA so the FROST pool stays monitored during the drain and after the legacy pool is retired.

The operator isn't necessarily registered in both pools, so the FROST loop treats sortition.ErrOperatorUnknown (now exported) as non-fatal — it warns and leaves FROST monitoring inactive rather than aborting startup. The legacy loop keeps its existing fail-fast (the operator is ECDSA-registered during the drain).

TbtcChain's own sortition.Chain methods are left unchanged, so heartbeat and other callers are unaffected; GetOperatorID stays ECDSA-bound. Both loops' join/update txs already share tc.transactionMutex + tc.nonceManager, so they cannot race on the operator account nonce.

Design input baked in (per maintainer + Codex)

• FROST loop join policy = beta-operator only (no FROST equivalent of the ECDSA pre-params gate; FROST DKG readiness is announced separately).
• Operator compensation is out-of-band, so ECDSA-pool staleness during the drain is benign; the FROST loop is the load-bearing one.
• GetOperatorID asymmetry preserved (separate GetFrostOperatorID exists).

Known limitation

MonitorPool (shared with the beacon) hard-returns at startup without starting its ticker, so an operator that registers for FROST after node start needs a restart to begin FROST monitoring. Logged clearly; deliberately not changing the shared MonitorPool here.

Tests / verification

• New tbtc_sortition_chain_views_test.go pins each view to its intended pool (legacy→ECDSA, FROST→FROST, unconfigured→nil) — negative-checked (mis-binding the legacy view to the FROST pool makes it fail).
• gofmt + go vet clean; untagged go build ./... clean; builds under -tags 'frost_native frost_tbtc_signer cgo frost_roast_retry'; pkg/sortition + pkg/chain/ethereum tests pass; full pkg/tbtc suite passes.
• Adversarial review (3 angles → verify): 0 confirmed findings; adapter fidelity confirmed line-for-line across all 13 methods; cross-loop nonce safety confirmed.

Found during review of #3866.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9eabbf7d-5ce6-4479-91ee-335063e00237

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dual-pool-sortition-monitoring

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}