zeekay 35aad2c1d5 gateway: cap unconfirmed credit, follow every row to its end ...

Red's review of the rail, fixed:

- A payer holds at most $1,000 of credit Gateway has only locked
  (remittance.Hold, a set swapped per payer); past that a payment is
  credited when Gateway confirms it. Confirmed releases the hold; only
  completed settles.
- The credit is owed before the ledger is asked, landed after, and a
  reversal re-lands before it claws back, so a credited payment Gateway
  fails is always taken back, and a row fails only once its books are right.
- A nonce Gateway holds for a different payment fails the row for good.
- The reconciler takes accepted, then pending, then refused rows, due
  first, with a doubling backoff, so stuck rows cannot starve new ones;
  refused rows are looked up by nonce until they expire; an unsent row
  expires.
- Gateway's network table is read single-flight with a 30 s failure
  cache, and the options menu reads only the warm table.

2026-10-26 20:24:53 -07:00

..

entity_guard.go

gateway: cap unconfirmed credit, follow every row to its end

2026-10-26 20:24:53 -07:00

remittance.go

gateway: cap unconfirmed credit, follow every row to its end

2026-10-26 20:24:53 -07:00