mirror payment records to arc + atomic /confirm lock to prevent double-credits

Apr 29 double-credit prevention, ported from master 0e368dab and adapted
to staging's hono/tigerbeetle structure. Two parallel callers of /confirm
(walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false
and each run tbConfirm — doubling the pending→balance transfer.
tbConfirm itself isn't idempotent on its own, so the race materializes
as a real double-credit even with TB.

- routes/payments.ts: SET NX EX 60 lock around the confirmation block
  keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit
  cleanly. Released on success and on every early-return.

- lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment
  + invoice records and the `payment:<txid>:<vout>` / `payment:<hash>`
  pointer keys into arc as soon as they're written. gf() will then find
  the prior credit via arc fallback even if the main-db copy is wiped
  by a future data-loss event.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

0 files changed, 0 insertions, 0 deletions