Status: ready-for-human

# 12 — C2: On-chain settlement idempotency (deferred)

## What to build

Harden payout idempotency so Solana transaction retries never double-pay. Design accepted in ADR-0019 §1; **implementation deferred post-alpha**.

**Code refs:**

- `packages/tracker/meshnet_tracker/server.py` — `_settlement_loop` resend (~3331–3356), `_send_settlement` (~3358–3376)
- `packages/contracts/meshnet_contracts/solana_adapter.py` — `send_payouts` (~186–213)

Today: pending debited before broadcast with stable `settlement_id`; unconfirmed batches resent. Gap: on-chain confirmation vs ledger state if tx succeeds but confirm fails.

## Acceptance criteria

- [ ] `confirm_settlement` only after RPC finalized confirmation
- [ ] Retry path reuses same `settlement_id` and detects already-confirmed signature
- [ ] Property test: N retries → single on-chain transfer per wallet per settlement_id
- [ ] Document recovery procedure for stuck unconfirmed batches

## ADR links

- [ADR-0019](../../docs/adr/0019-money-path-consistency-multi-tracker.md) §1

## Blocked by

Alpha release (ADR-0016 single settlement tracker)