fix: recover user-wallet payments safely

[SuPuHe]

Summary

Fixes two user-wallet UX and safety gaps:

• A durable Team Report transaction hash can now be verified from Requests after reload without creating another payment.
• Replaying a prepared job with a durable transaction hash no longer opens a replacement wallet transfer.
• Circle x402 checks the connected wallet's Arc Testnet Gateway balance before requesting an authorization signature, so an unfunded Gateway balance is reported before signing.

Scope and acceptance criteria

• The change is limited to user-wallet recovery and Circle Gateway preflight.
• UNKNOWN USER_WALLET jobs expose recovery only when a durable transaction hash exists.
• Recovery submits only the exact server-returned hash to the existing verification endpoint.
• Existing payment state-machine, at-most-once, UNKNOWN, reconciliation, server-wallet, and x402 server behavior are unchanged.
• No replacement transfer is requested when a durable hash is already present.
• No secrets, tokens, signatures, credentials, or sensitive runtime configuration are included.

Product and security invariants

• One intent / at most one committed settlement remains unchanged.
• UNKNOWN remains fail-closed and is rechecked without blind retry.
• Circle Gateway balance lookup is read-only and uses only the connected public wallet address.
• A low Gateway balance prevents signing and forwarding.

Validation

pnpm exec vitest run --exclude apps/web/browser/**: PASS — 82 files / 1087 tests
pnpm --filter @oneshot/web exec vitest run --config vitest.config.ts test/components.test.tsx test/paid-api.test.tsx test/privy-session.test.tsx: PASS — 26 tests
pnpm --filter @oneshot/web exec node scripts/run-browser-tests.mjs: PASS — 8/8
pnpm build: PASS
pnpm typecheck: PASS
pnpm lint: PASS
pnpm format:check: PASS
pnpm check:generated: PASS
git diff --cached --check / git diff --check: PASS

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 3463daf7905a3f1b74e46e0884835b1cb7b433df

• Candidate tree SHA: 78e2ccf0bc5594f85f595a1338c0f3bb0f3a8976

• Candidate commit SHA: b193a0c885f78116ca202464ca1945e472e0360d

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS

• Findings: no blocking findings. Non-blocking notes cover optional future wallet balance preflight, mocked Gateway balance shape/domain coverage, an existing submit-loss replay window, and a recovery negative assertion.

• The reviewed staged tree equals the committed and pushed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending

• Remote head commit SHA: pending

• Remote head tree SHA: pending

• Reviewer tool: free-pi-cli

• Reviewer model: pending

• Verdict: pending

• Findings or residual risks: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Required CI checks pass.

Risk and rollback

• Residual risks: Gateway payments still require the user to fund a Circle Gateway balance; the preflight reports insufficient balance but does not deposit funds automatically. A transaction whose submit request never reaches the API still has the pre-existing durable-hash limitation.
• Rollback: revert this PR. Existing durable payment and reconciliation state remains unchanged.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	b193a0c	Sep 12 2026, 07:51 PM