[ctfbruce]

Behaviour

An order's settlement is now decided in one place, recorded once, durably, and delivered reliably from the run's terminal result:

• Dispatcher schema 21 adds order_settlements: one immutable row per settled order (credit or refund, amount, currency, executor and run), written in the same database transaction as the order's conditional state change and the executor's earnings credit or the chain refund. A repeated or concurrent delivery of the same decision leaves a settled order as it is.
• The decision stays what it was (exit code 0 credits the executor, any other exit refunds the order) and is taken in one function used by the terminal report, the cancellation path and a new bounded pass of the existing maintenance loop, which settles terminal runs with a recorded exit code whose inline settlement failed. A terminal run without a recorded exit code is left pending; nothing infers an outcome.
• A TEST order of a failed run becomes refunded locally, moving nothing; TEST intents are still never refunded as a whole, so a refused batch keeps its intent spendable.
• Every intent records the pricing rule it was priced under (transactions.pricing_rule, bw-s-ceil-ms-v1); rows written before the column read as the rule of the writing release. The API guide states that a USDC intent is a local record created without any chain call.

Proof

• Base reproduction: with a trigger making the inline credit fail, a terminal run's order stayed Outstanding after the trigger was dropped and the dispatcher restarted; with this change the next maintenance pass credits it once.
• Real-SQLite tests: credit once with one settlement row; failed TEST run refunded locally and a later success report changes nothing; a refused settlement row rolls back the state change and the earnings for both kinds; settlement rows cannot be updated or deleted; eight concurrent completions on one handle and two handles on one file record one row; a credit racing a refund has exactly one winner; the sweep delivers after an inline failure across a restart, once, honours its limit, skips non-terminal and exit-code-less runs and a closed dispatcher; stored intents carry the rule name after a reopen.
• The whole internal/dispatcher tree and cmd/dispatcher pass under -race; generated bindings match the pinned generator.

Upgrade

Dispatcher schema 21 is required: stop the dispatcher, back up the database and run the explicit upgrade (-upgrade-database, or deploy/ansible/upgrade-database.yml) before starting this build.

Requires #364 (dispatcher schema 20) first; this branch is based on its head.

Limits

• Chain-currency refunds still perform the chain transfer inside the local transaction, so the maintenance pass retries only wholly local settlements (credits of any currency and TEST refunds) and defers chain refunds without touching the backend; a chain refund whose inline attempt failed stays outstanding until the durable transfer record of the following change takes it over. The pass continues after the last run it attempted and starts over once the listing is exhausted, so a failing order never blocks later ones.
• A cancellation whose inline refund failed is not retried by the pass, because a cancellation records no executor exit code and nothing infers one.
• No live chain path is exercised; chain payments remain disabled in every shipped configuration.

GitHub issues #76, #77 and #78.

Candidate CI

Run 37288440585 on 83de859: 16 of 16 lanes and required succeeded (an earlier head passed run 37284687485).