lightning: don't wedge the listener on an already-credited preimage

Skip settlements whose preimage was already credited instead of retrying
until the process exits, and reject previously used preimages when they
are queued.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2 files changed, 15 insertions, 2 deletions

diff --git a/lib/lightning.ts b/lib/lightning.ts
index 48410ffe..6c37ddf1 100644
--- a/lib/lightning.ts
+++ b/lib/lightning.ts
@@ -155,9 +155,15 @@ export async function listenForLightning() {
       });
 
       // credit() may decline a duplicate idempotency claim. Only advance the
-      // listener once the durable payment pointer proves the ledger write won.
-      if (!(await getPayment(paymentRequest)))
+      // listener once the durable payment pointer proves the ledger write won —
+      // unless the preimage was already credited by an earlier settlement (a
+      // reused merchant preimage), which can never persist and would otherwise
+      // wedge the listener in a restart loop.
+      if (!(await getPayment(paymentRequest))) {
+        if (preimage && (await db.get(`credited:${preimage}`)))
+          return warn("preimage already credited, skipping", paymentRequest);
         throw new Error(`lightning credit did not persist for ${paymentRequest}`);
+      }
     })();
 
     // db.set is awaited directly: s() is intentionally fire-and-forget and an
diff --git a/routes/preimages.ts b/routes/preimages.ts
index 49673d17..5e7c484f 100644
--- a/routes/preimages.ts
+++ b/routes/preimages.ts
@@ -51,6 +51,13 @@ export default {
       for (let p of preimages) {
         p = p.toLowerCase();
         if (seen.has(p)) continue;
+        // A preimage that already settled (or backs a live invoice) can't be
+        // credited again — reject it rather than let a buyer pay for nothing.
+        if (
+          (await db.exists(`credited:${p}`)) ||
+          (await db.exists(`preimage:${sha256(p)}`))
+        )
+          fail("preimage already used");
         seen.add(p);
         fresh.push(p);
       }