Red's review of the rail, fixed:
- A payer holds at most $1,000 of credit Gateway has only locked
(remittance.Hold, a set swapped per payer); past that a payment is
credited when Gateway confirms it. Confirmed releases the hold; only
completed settles.
- The credit is owed before the ledger is asked, landed after, and a
reversal re-lands before it claws back, so a credited payment Gateway
fails is always taken back, and a row fails only once its books are right.
- A nonce Gateway holds for a different payment fails the row for good.
- The reconciler takes accepted, then pending, then refused rows, due
first, with a doubling backoff, so stuck rows cannot starve new ones;
refused rows are looked up by nonce until they expire; an unsent row
expires.
- Gateway's network table is read single-flight with a 30 s failure
cache, and the options menu reads only the warm table.
zeekay
35aad2c1d5