crypto fix

server/implementations/Catcrafts.Server-Eurc.cpp

@@ -61,6 +61,14 @@ No permission is granted to copy, modify, distribute, or create derivative works
 // there is no cost to waiting when the destination is our own wallet.
 
 module;
+// The one place this codebase reaches past the standard library: durability.
+// std::ofstream::flush() reaches the kernel, not the disk, and there is no
+// portable "make this actually persistent" in C++ — so the cursor write below
+// needs fsync(2), and fsync needs a file descriptor. Included in the global
+// module fragment, which is what a module unit has instead of plain includes.
+#include <fcntl.h>
+#include <unistd.h>
+
 module Catcrafts.Server;
 
 import std;
@@ -71,6 +79,27 @@ using namespace Crafter;
 
 namespace Catcrafts::Server {
 
+namespace {
+
+// Flush one path all the way to the platter (or the drive's cache, which is as
+// far as fsync promises). Files and directories both, because a durable rename
+// needs the directory synced too, and only the directory case may be opened
+// read-only.
+bool FsyncPath(const std::filesystem::path& path, bool isDirectory) {
+    const int fd = ::open(path.c_str(), isDirectory ? (O_RDONLY | O_DIRECTORY)
+                                                   : O_WRONLY);
+    if (fd < 0) return false;
+    const int rc = ::fsync(fd);
+    // Report the fsync's verdict, not the close's, but still close: leaking a
+    // descriptor per issued address would outlast any single order.
+    const bool ok = rc == 0;
+    ::close(fd);
+    return ok;
+}
+
+} // namespace
+
+
 namespace {
 
 // keccak256("balanceOf(address)")[0..4). A constant of the ERC-20 ABI, not a
@@ -169,12 +198,24 @@ std::optional<std::int64_t> Pow10(int n) {
 } // namespace
 
 // A 32-byte uint256 hex word, as eth_call returns it, reduced to an int64.
-// SATURATES rather than wraps: a balance larger than int64 can hold is still
-// unambiguously "covers any invoice this shop will ever issue", and saturating
-// there keeps every comparison downstream in ordinary signed arithmetic.
+// A value that does not fit is nullopt ("could not determine"), never a
+// saturated maximum: int64 base units is already far past EURC's whole supply,
+// so anything bigger is a broken or hostile node rather than a large balance,
+// and the one thing it must not do is satisfy the covering comparison.
 // Exported so the self-test can drive it with canned RPC bodies, the same way
 // ParseMolliePayment is driven — the HTTP around it is thin, the decoding is
 // where a mistake would cost money.
+// True when the reply carries exactly the numeric id we sent. Absent or
+// non-numeric is false: an answer that will not say which question it belongs
+// to is not evidence about a balance.
+bool JsonRpcIdIs(std::string_view json, std::int64_t want) {
+    auto doc = Json::Parse(json);
+    if (!doc || !doc->IsObject()) return false;
+    const Json::Value* id = doc->Find("id");
+    if (!id || id->type != Json::Type::Number) return false;
+    return static_cast<std::int64_t>(id->number) == want;
+}
+
 std::optional<std::int64_t> ParseEthCallUint(std::string_view json) {
     auto doc = Json::Parse(json);
     if (!doc || !doc->IsObject()) return std::nullopt;
@@ -200,9 +241,22 @@ std::optional<std::int64_t> ParseEthCallUint(std::string_view json) {
         if (c >= '0' && c <= '9') digit = c - '0';
         else if (c >= 'a' && c <= 'f') digit = c - 'a' + 10;
         else digit = c - 'A' + 10;
-        // Saturate on overflow instead of wrapping.
+        // A value too large for int64 is not a rich buyer, it is a broken or
+        // lying node, and it must NOT read as "covers the invoice".
+        //
+        // int64 base units at six decimals is nine trillion EURC — orders of
+        // magnitude past the token's entire supply, so no honest balanceOf can
+        // reach here. This used to saturate to INT64_MAX, which then satisfied
+        // every >= comparison downstream: a node answering 0xffff…ff marked
+        // any order paid. nullopt is the honest answer ("could not determine,
+        // retry"), and it is the safe one — an unknown never settles an order
+        // and never lapses one.
         if (out > (std::numeric_limits<std::int64_t>::max() - digit) / 16) {
-            return std::numeric_limits<std::int64_t>::max();
+            std::println(std::cerr,
+                         "eurc: a node returned a balance too large to be real "
+                         "({} hex digits) — treating it as unknown, not as paid",
+                         hex.size());
+            return std::nullopt;
         }
         out = out * 16 + digit;
     }
@@ -238,8 +292,36 @@ std::optional<std::vector<EurcChain>> ParseEurcChains(std::string_view json) {
         if (!IsAddress(c.contract)) return std::nullopt;
         if (!ParseEndpoint(c.rpcUrl)) return std::nullopt;
         // 2 is the floor because amounts arrive as cents; anything below it
-        // cannot represent the invoice at all.
-        if (c.decimals < 2 || c.decimals > 18) return std::nullopt;
+        // cannot represent the invoice at all. The ceiling is NOT 18 (the ERC-20
+        // maximum) but what the arithmetic can actually carry: RequiredUnits
+        // multiplies cents by 10^(decimals-2), so at 18 decimals any invoice
+        // over €9.22 overflows int64 and returns nullopt — and nullopt means
+        // "unknown, retry", so the order would never settle AND never lapse,
+        // silently, forever. A limit the maths cannot honour is not a limit.
+        // 12 leaves room for every invoice this shop can issue (10^10 cents,
+        // a hundred million euro) against every real EURC deployment, which is
+        // 6 everywhere Circle has issued it.
+        if (c.decimals < 2 || c.decimals > 12) return std::nullopt;
+        // The block tag is interpolated into the eth_call params array, so it
+        // is the one field that must be an allowlist rather than a shape check.
+        // Left unvalidated it took anything: a typo silenced the chain
+        // permanently (an unknown tag makes every call fail, which is nullopt
+        // forever — the same never-settles-never-lapses trap as above), and a
+        // value containing a quote closed the JSON string and appended further
+        // params, reaching the state-override slot on nodes that implement it.
+        static constexpr std::string_view kTags[] = {
+            "finalized", "safe", "latest", "earliest", "pending"
+        };
+        const bool namedTag = std::ranges::find(kTags, c.blockTag) != std::end(kTags);
+        // A specific block number is legitimate and is hex-quantity shaped.
+        const bool hexTag = c.blockTag.size() > 2 && c.blockTag.size() <= 18
+                            && c.blockTag.starts_with("0x")
+                            && std::ranges::all_of(
+                                   std::string_view(c.blockTag).substr(2),
+                                   [](unsigned char ch) {
+                                       return std::isxdigit(ch) != 0;
+                                   });
+        if (!namedTag && !hexTag) return std::nullopt;
         // "latest" is accepted but is a foot-gun worth naming: it reports state
         // that a reorg can still take back.
         if (c.blockTag == "latest") {
@@ -247,6 +329,44 @@ std::optional<std::vector<EurcChain>> ParseEurcChains(std::string_view json) {
                          "eurc: chain '{}' watches block_tag=latest — a reorg can "
                          "un-pay a settled order; prefer 'finalized'", c.name);
         }
+        // Circle's own EURC deployments, compiled in. NOT a refusal: Circle can
+        // deploy to a new chain, and a shop that cannot be pointed at one until
+        // this file is edited is worse than one that warns. But a contract that
+        // merely LOOKS like an address is otherwise checked by nobody —
+        // IsAddress accepts any 40 hex digits, EIP-55 is deliberately not
+        // verified, and asking balanceOf of the wrong token means a dust
+        // balance of something else can cover an invoice. So when the chain is
+        // one we know, say so loudly.
+        struct KnownContract { std::string_view chain; std::string_view contract; };
+        static constexpr KnownContract kCircle[] = {
+            { "base",      "0x60a3e35cc302bfa44cb288bc5a4f316fdb1adb42" },
+            { "ethereum",  "0x1abaea1f7c830bd89acc67ec4af516284b1bc33c" },
+        };
+        for (const KnownContract& known : kCircle) {
+            if (known.chain == c.name && known.contract != c.contract) {
+                std::println(std::cerr,
+                             "eurc: WARNING: chain '{}' points at contract {} but "
+                             "Circle's EURC on that chain is {} — a wrong contract "
+                             "means watching the wrong token. Verify against "
+                             "developers.circle.com/stablecoins/eurc-contract-addresses",
+                             c.name, c.contract, known.contract);
+            }
+        }
+        // Two chains sharing a name is not a naming nit: the HTTP clients are
+        // held in a map keyed by name, so the second entry silently reuses the
+        // first one's connection and its requests go to the FIRST host. One
+        // chain then goes unwatched, and during a testnet rehearsal a testnet
+        // balance could settle a mainnet order. The pool loader already refuses
+        // duplicate addresses for the same class of reason.
+        for (const EurcChain& seen : out) {
+            if (seen.name == c.name) {
+                std::println(std::cerr,
+                             "eurc: two chains are both named '{}' — names key the "
+                             "connection map, so one of them would never be queried",
+                             c.name);
+                return std::nullopt;
+            }
+        }
         out.push_back(std::move(c));
     }
     if (out.empty()) return std::nullopt;
@@ -286,7 +406,36 @@ public:
     bool Load() {
         if (!LoadChains()) return false;
         if (!LoadPool()) return false;
+        // One lock and one (initially empty) connection slot per chain, both
+        // created here so neither map is ever structurally modified again.
+        // That is what makes it safe for two chains to be in Call at the same
+        // time under different locks: operator[] on a missing key would insert,
+        // and inserting into a shared map from two threads is a race the
+        // per-chain locks could not see.
+        for (const EurcChain& chain : chains_) {
+            connLocks_.emplace(chain.name, std::make_unique<std::mutex>());
+            clients_.emplace(chain.name, nullptr);
+        }
         cursor_ = ReadCursor();
+        // The cursor is an index into a SPECIFIC pool file, but nothing in it
+        // ever said which — so a cursor and a pool that do not belong together
+        // used to load silently. Two routine operator actions produce exactly
+        // that: restoring an older ledger backup (the closing advice in
+        // tools/enable-eurc.sh has the operator back the cursor up alongside
+        // orders.jsonl, and restoring rewinds it), and replacing the pool with
+        // one from a different seed (the stale cursor then skips the new
+        // pool's head while every old order's index resolves to a different
+        // address, so the reconciler watches the wrong place and those orders
+        // never settle).
+        //
+        // A stamp file next to the cursor closes both. It records how many
+        // lines the pool had and a digest of the addresses the cursor has
+        // ALREADY issued — the prefix that must never change, since those are
+        // published. A pool that still starts with the same issued prefix and
+        // has only grown is a legitimate append; anything else is a refusal
+        // with the reason spelled out, because guessing here reissues live
+        // addresses.
+        if (!CheckPoolStamp()) return false;
         if (cursor_ >= pool_.size()) {
             std::println(std::cerr,
                          "eurc: address pool is exhausted ({} of {} used) — top it "
@@ -356,8 +505,21 @@ public:
 
     std::optional<PaidStatus> CheckPaid(const std::string& payId,
                                         std::int64_t expectedMinor) override {
-        std::lock_guard lock(mutex_);
-
+        // NO rail mutex here, deliberately, and this is a fix rather than an
+        // omission. Everything this function reads — chains_, and the config —
+        // is immutable once Load has returned; the only shared mutable state it
+        // touches is each chain's HTTP connection, which Call now guards with
+        // that chain's own lock.
+        //
+        // Holding mutex_ across the calls below was a checkout outage waiting
+        // for a slow node. ClientHTTP1 defaults to a 30 s request and 15 s
+        // handshake timeout, so one hung endpoint held the rail for ~45 s per
+        // chain — and the reconciler walks EVERY awaiting order per sweep,
+        // each taking the same lock, while a real buyer's CreateLink (which
+        // needs the mutex only to hand out a pool address, no network at all)
+        // queued behind the whole procession. The Mollie side of this file's
+        // sibling had the identical incident; see the arrival-poll note in
+        // Catcrafts.Server-Http.cpp.
         const std::optional<PayIdParts> parts = SplitPayId(payId);
         if (!parts) return PaidStatus{ PayState::Dead, {} };
         const std::string& address = parts->address;
@@ -491,6 +653,17 @@ private:
 
         const std::optional<std::string> res = Call(chain, body);
         if (!res) return std::nullopt;
+        // The response's id must be the one we sent. On a fresh connection per
+        // call this is belt-and-braces, but the client keeps connections alive
+        // between polls, and a pipelined or mismatched reply read as this
+        // address's balance is the one decoding mistake that could settle the
+        // wrong order. Cheap to check, so check it.
+        if (!JsonRpcIdIs(*res, 1)) {
+            std::println(std::cerr,
+                         "eurc: chain '{}' answered with a different request id — "
+                         "discarding rather than reading it as this balance", chain.name);
+            return std::nullopt;
+        }
         const std::optional<std::int64_t> units = ParseEthCallUint(*res);
         if (!units) {
             std::println(std::cerr, "eurc: chain '{}' returned an undecodable balance: {}",
@@ -502,11 +675,19 @@ private:
 
     // One JSON-RPC POST; nullopt on transport failure or a non-2xx answer. The
     // reconciler treats nullopt as "unknown, retry" — never as unpaid or dead.
+    // Called WITHOUT the rail mutex held — see the note on CheckPaid. What it
+    // needs instead is exclusive use of this chain's connection, which is its
+    // own lock, per chain: two chains can be in flight at once, and neither
+    // blocks a buyer's checkout.
     std::optional<std::string> Call(const EurcChain& chain, const std::string& body) {
         const std::optional<Endpoint> ep = ParseEndpoint(chain.rpcUrl);
         if (!ep) return std::nullopt;
+        std::mutex& connLock = ConnLockFor(chain.name);
+        std::lock_guard conn(connLock);
         try {
-            std::unique_ptr<Crafter::ClientHTTP1>& client = clients_[chain.name];
+            const auto slot = clients_.find(chain.name);
+            if (slot == clients_.end()) return std::nullopt;   // not a loaded chain
+            std::unique_ptr<Crafter::ClientHTTP1>& client = slot->second;
             if (!client) {
                 client = ep->tls
                              ? std::make_unique<Crafter::ClientHTTP1>(
@@ -533,7 +714,9 @@ private:
             return res.body;
         } catch (const std::exception& e) {
             std::println(std::cerr, "eurc: chain '{}' call failed: {}", chain.name, e.what());
-            clients_[chain.name].reset();   // dial fresh next time
+            if (const auto slot = clients_.find(chain.name); slot != clients_.end()) {
+                slot->second.reset();   // dial fresh next time
+            }
             return std::nullopt;
         }
     }
@@ -615,14 +798,134 @@ private:
         return true;
     }
 
+    std::filesystem::path StampPath() const {
+        std::filesystem::path p = cfg_.eurcPoolPath;
+        p += ".issued";
+        return p;
+    }
+
+    // A cheap, dependency-free digest of the issued prefix. Not a security
+    // hash and not trying to be: the threat is an operator mistake — a
+    // restored backup, a swapped pool — not someone forging a stamp they
+    // already have write access to. FNV-1a over the issued addresses in order
+    // catches every reordering, substitution and truncation that matters.
+    std::string IssuedDigest(std::size_t upTo) const {
+        std::uint64_t h = 0xcbf29ce484222325ULL;
+        for (std::size_t i = 0; i < upTo && i < pool_.size(); ++i) {
+            for (const unsigned char c : pool_[i]) {
+                h = (h ^ c) * 0x100000001b3ULL;
+            }
+            h = (h ^ '\n') * 0x100000001b3ULL;
+        }
+        return std::format("{:016x}", h);
+    }
+
+    // Verify the cursor belongs to this pool, then record the new stamp.
+    // Missing stamp with a zero cursor is a fresh pool; missing stamp with a
+    // non-zero cursor is a pool from before stamping existed, which is
+    // accepted once (there is nothing to compare against) and stamped now.
+    bool CheckPoolStamp() {
+        if (cursor_ == std::numeric_limits<std::size_t>::max()) return true;  // already refusing
+
+        std::ifstream in(StampPath(), std::ios::binary);
+        if (in) {
+            std::size_t stampedCount = 0;
+            std::size_t stampedCursor = 0;
+            std::string stampedDigest;
+            if (!(in >> stampedCount >> stampedCursor >> stampedDigest)) {
+                std::println(std::cerr,
+                             "eurc: pool stamp '{}' is unreadable — refusing rather "
+                             "than risk reissuing a published address. Delete it only "
+                             "if you are certain the cursor matches the pool.",
+                             StampPath().string());
+                return false;
+            }
+            if (stampedCursor > cursor_) {
+                std::println(std::cerr,
+                             "eurc: the cursor went BACKWARDS ({} now, {} before) — "
+                             "a restored backup or a reverted write. Refusing: the "
+                             "addresses between the two are already published and "
+                             "reissuing one would settle two orders on one payment. "
+                             "To recover, set the cursor file to at least {} once you "
+                             "have confirmed against the order ledger which addresses "
+                             "really went out.",
+                             cursor_, stampedCursor, stampedCursor);
+                return false;
+            }
+            if (pool_.size() < stampedCount) {
+                std::println(std::cerr,
+                             "eurc: the pool SHRANK ({} lines now, {} before) — it is "
+                             "append-only. Refusing rather than reindexing addresses "
+                             "already bound to live orders.",
+                             pool_.size(), stampedCount);
+                return false;
+            }
+            if (stampedDigest != IssuedDigest(stampedCursor)) {
+                std::println(std::cerr,
+                             "eurc: the pool's first {} addresses — the ones already "
+                             "issued — are not the ones this cursor was written "
+                             "against. This is a different pool (a new seed?) with an "
+                             "old cursor. Refusing: every existing order's address "
+                             "would resolve somewhere else.",
+                             stampedCursor);
+                return false;
+            }
+        }
+        // Record where we are now. A write failure is a warning, not a
+        // refusal: the check is a safety net over the cursor, and refusing to
+        // start over an un-writable net would be its own outage.
+        if (!WriteStamp(cursor_)) {
+            std::println(std::cerr, "eurc: WARNING: could not write the pool stamp '{}'",
+                         StampPath().string());
+        }
+        return true;
+    }
+
+    // Written BEFORE the cursor it describes, deliberately. If the machine dies
+    // between the two, the stamp is ahead of the cursor and the next load sees
+    // "the cursor went backwards" and refuses — which is the outcome we want,
+    // because the address for that index is already out. The reverse order
+    // would leave the rewind invisible and hand the address out twice.
+    bool WriteStamp(std::size_t value) const {
+        std::filesystem::path tmp = StampPath();
+        tmp += ".tmp";
+        {
+            std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
+            if (!out) return false;
+            out << pool_.size() << ' ' << value << ' ' << IssuedDigest(value) << '\n';
+            out.flush();
+            if (!out) return false;
+        }
+        if (!FsyncPath(tmp, /*isDirectory=*/false)) return false;
+        std::error_code ec;
+        std::filesystem::rename(tmp, StampPath(), ec);
+        return !ec;
+    }
+
     // The cursor is the high-water mark of addresses ever issued. Missing reads
     // as zero (a fresh pool); anything unparseable is fatal at load rather than
     // silently rewinding to the start of a pool whose head is already published.
     std::size_t ReadCursor() const {
         std::ifstream in(CursorPath(), std::ios::binary);
         if (!in) return 0;
+        // Read the WHOLE file and parse it strictly. `in >> value` stops at the
+        // first non-digit, so it accepted "5 GARBAGE" as 5, "3.9" as 3 and "+4"
+        // as 4 — a cursor file corrupted into any of those shapes would have
+        // been believed, and believing a too-small cursor reissues addresses
+        // that are already published against live orders.
+        std::string text{ std::istreambuf_iterator<char>(in),
+                          std::istreambuf_iterator<char>() };
+        std::string_view body = text;
+        while (!body.empty() && (body.back() == '\n' || body.back() == '\r'
+                                 || body.back() == ' ' || body.back() == '\t')) {
+            body.remove_suffix(1);
+        }
         std::size_t value = 0;
-        if (!(in >> value)) {
+        const auto [end, ec] =
+            std::from_chars(body.data(), body.data() + body.size(), value);
+        const bool clean = ec == std::errc{} && end == body.data() + body.size()
+                           && !body.empty();
+        if (!clean) {
             std::println(std::cerr, "eurc: cursor file '{}' is unreadable — treating "
                                     "the pool as exhausted rather than reissuing",
                          CursorPath().string());
@@ -632,8 +935,30 @@ private:
     }
 
     bool WriteCursor(std::size_t value) const {
-        // Write-then-rename so a crash mid-write cannot leave a truncated
-        // cursor that reads as a smaller number than the addresses already out.
+        // Write-then-rename AND fsync, in that order, because the two protect
+        // against different crashes and only one of them was here before.
+        //
+        // Rename alone survives a process crash: a reader sees either the old
+        // cursor or the new one, never a half-written one. It does NOT survive
+        // a machine crash — without fsync the bytes may still be in the page
+        // cache when the power goes, and the rename can be durable while the
+        // data it points at is not. Both post-crash outcomes are the money bug
+        // this file's header calls unrecoverable: a cursor that rewinds hands
+        // the next order an address already published against a live one (two
+        // buyers, one address, and CheckPaid compares the address's TOTAL
+        // balance, so one payment settles both), and a cursor that lands empty
+        // reads as unparseable and refuses the rail.
+        //
+        // So: fsync the temp file, rename, then fsync the DIRECTORY, which is
+        // what makes the rename itself durable. This costs one flush per
+        // issued address, on a path that issues at most one per checkout.
+        // Stamp first — see WriteStamp for why this order is the safe one.
+        if (!WriteStamp(value)) {
+            std::println(std::cerr,
+                         "eurc: WARNING: could not write the pool stamp '{}' — a power "
+                         "cut from here could rewind the cursor undetected",
+                         StampPath().string());
+        }
         std::filesystem::path tmp = CursorPath();
         tmp += ".tmp";
         {
@@ -643,9 +968,23 @@ private:
             out.flush();
             if (!out) return false;
         }
+        if (!FsyncPath(tmp, /*isDirectory=*/false)) return false;
         std::error_code ec;
         std::filesystem::rename(tmp, CursorPath(), ec);
-        return !ec;
+        if (ec) return false;
+        // A failure here means the rename may not survive a power cut. That is
+        // worth a warning, not a refusal: the address IS out either way, and
+        // returning false would fail a checkout whose address is already spent.
+        if (!FsyncPath(CursorPath().parent_path().empty()
+                           ? std::filesystem::path(".")
+                           : CursorPath().parent_path(),
+                       /*isDirectory=*/true)) {
+            std::println(std::cerr,
+                         "eurc: WARNING: could not fsync the directory holding '{}' — "
+                         "the cursor is written but a power cut could still rewind it",
+                         CursorPath().string());
+        }
+        return true;
     }
 
     std::filesystem::path CursorPath() const {
@@ -654,8 +993,19 @@ private:
         return p;
     }
 
+    // One connection lock per chain, created at load and never rehashed after,
+    // so ConnLockFor needs no lock of its own. Sized from chains_ in Load.
+    std::mutex& ConnLockFor(const std::string& name) {
+        auto it = connLocks_.find(name);
+        // Every chain gets an entry in Load; a name that is not there cannot
+        // reach here, but falling back to the rail mutex is safer than a
+        // dangling reference if that ever stops being true.
+        return it == connLocks_.end() ? mutex_ : *it->second;
+    }
+
     RailConfig cfg_;
     std::vector<EurcChain> chains_;
+    std::map<std::string, std::unique_ptr<std::mutex>> connLocks_;
     std::vector<std::string> pool_;
     std::size_t cursor_ = 0;
     std::mutex mutex_;

server/implementations/Catcrafts.Server-Http.cpp

@@ -483,6 +483,26 @@ constexpr std::size_t kMaxSubmissionsPerPeer = 6;
 constexpr std::size_t kMaxSubmissionsPerWindow = 240;
 constexpr auto kRateWindow = std::chrono::minutes(10);
 
+// A SECOND, tighter budget, for crypto submissions only.
+//
+// Choosing the crypto rail spends a receiving address out of a finite pool
+// that only an offline wallet ceremony can refill, and the address is spent
+// per SUBMISSION rather than per payment — an order nobody ever pays has
+// still consumed one. Under the general budget alone, a stranger needs no
+// account, no card and no money to walk the pool to zero (six per peer is
+// plenty when a default pool is a hundred addresses), and then no buyer can
+// choose crypto until the owner is at a desk with paper.
+//
+// So crypto gets its own smaller allowance on the same window and the same
+// peer key. A real buyer picks crypto once, maybe twice after a mistyped
+// field; nobody legitimately opens six crypto orders in ten minutes. The
+// global leg is the backstop against a spread-out flood, sized so a broad
+// attack costs many addresses rather than the whole pool.
+constexpr std::size_t kMaxCryptoPerPeer = 2;
+constexpr std::size_t kMaxCryptoPerWindow = 20;
+std::deque<RatePoint> gRecentCrypto;
+std::unordered_map<std::string, std::deque<RatePoint>> gRecentCryptoPerPeer;
+
 bool RateLimitAllows(std::string_view peer) {
     const auto now = std::chrono::steady_clock::now();
     std::lock_guard lock(gRateMutex);
@@ -511,6 +531,71 @@ bool RateLimitAllows(std::string_view peer) {
     return true;
 }
 
+// The crypto leg of the same limiter, charged only when the buyer picked the
+// rail that spends an address. Deliberately a separate budget rather than a
+// smaller kMaxSubmissionsPerPeer: tightening the general limit would punish
+// the ordinary buyer who fixes a form error, and it is not form errors that
+// exhaust the pool.
+bool CryptoRateLimitAllows(std::string_view peer) {
+    const auto now = std::chrono::steady_clock::now();
+    std::lock_guard lock(gRateMutex);
+
+    auto expire = [&](std::deque<RatePoint>& seen) {
+        while (!seen.empty() && now - seen.front() > kRateWindow) seen.pop_front();
+    };
+
+    expire(gRecentCrypto);
+    if (gRecentCrypto.size() >= kMaxCryptoPerWindow) return false;
+
+    if (!peer.empty()) {
+        // Same leak-avoidance as the general limiter: expire every peer and
+        // drop the emptied entries rather than keeping a row per address that
+        // ever submitted.
+        std::erase_if(gRecentCryptoPerPeer, [&](auto& entry) {
+            expire(entry.second);
+            return entry.second.empty();
+        });
+        std::deque<RatePoint>& seen = gRecentCryptoPerPeer[std::string(peer)];
+        if (seen.size() >= kMaxCryptoPerPeer) return false;
+        seen.push_back(now);
+    }
+
+    gRecentCrypto.push_back(now);
+    return true;
+}
+
+// The inverse of NowIso8601, for the one caller that needs an order's real age:
+// exactly "YYYY-MM-DDTHH:MM:SSZ", which is the only shape this codebase writes.
+// nullopt for anything else — a ledger line from another tool, or a truncated
+// write — so the caller can fall back rather than trust a half-parsed date.
+// (std::chrono::parse would be the obvious tool and is not in this libc++.)
+std::optional<std::chrono::sys_seconds> ParseIso8601Utc(std::string_view s) {
+    if (s.size() != 20 || s[4] != '-' || s[7] != '-' || s[10] != 'T'
+        || s[13] != ':' || s[16] != ':' || s[19] != 'Z') {
+        return std::nullopt;
+    }
+    auto num = [&](std::size_t at, std::size_t len) -> std::optional<int> {
+        int v = 0;
+        const auto [end, ec] =
+            std::from_chars(s.data() + at, s.data() + at + len, v);
+        if (ec != std::errc{} || end != s.data() + at + len) return std::nullopt;
+        return v;
+    };
+    const auto y = num(0, 4), mo = num(5, 2), d = num(8, 2);
+    const auto h = num(11, 2), mi = num(14, 2), sec = num(17, 2);
+    if (!y || !mo || !d || !h || !mi || !sec) return std::nullopt;
+    if (*mo < 1 || *mo > 12 || *d < 1 || *d > 31) return std::nullopt;
+    if (*h > 23 || *mi > 59 || *sec > 60) return std::nullopt;
+    const std::chrono::year_month_day ymd{ std::chrono::year{ *y },
+                                           std::chrono::month{
+                                               static_cast<unsigned>(*mo) },
+                                           std::chrono::day{
+                                               static_cast<unsigned>(*d) } };
+    if (!ymd.ok()) return std::nullopt;
+    return std::chrono::sys_days{ ymd } + std::chrono::hours{ *h }
+           + std::chrono::minutes{ *mi } + std::chrono::seconds{ *sec };
+}
+
 // RFC 3339 UTC. Recorded so the order log can be read chronologically
 // without depending on file order.
 std::string NowIso8601() {
@@ -646,6 +731,16 @@ HTTPResponse HandleCheckout(const HTTPRequest& req, const Route& route) {
         return reject({{ "", "Too many submissions just now — please try again shortly." }},
                       parsed.value, "429");
     }
+    // Crypto pays a second, tighter toll: this submission is about to spend a
+    // receiving address that only an offline wallet ceremony can replace. The
+    // charge happens here rather than at CreateLink so the general budget is
+    // already spent too — a peer probing the pool burns their ordinary
+    // checkout allowance at the same time.
+    if (wantsCrypto && !CryptoRateLimitAllows(peer)) {
+        return reject({{ "pay", "Too many crypto orders from here just now — please "
+                                "try again shortly, or pick bank or card." }},
+                      parsed.value, "429");
+    }
 
     std::int64_t unitMinor = 0;
     Money::Totals totals;
@@ -977,7 +1072,21 @@ void ReconcilerLoop(const std::stop_token& stop) {
             auto [it, inserted] = seen.try_emplace(order.token, Seen{ now, now });
             if (!inserted) {
                 using namespace std::chrono;
-                const auto age = now - it->second.first;
+                // Age from the ORDER, not from when this process first saw it.
+                // Steady-clock first-seen restarts the seven days on every
+                // deploy, so a year-old awaiting order gets polled for another
+                // week after each one — wasted calls against both providers,
+                // growing with every abandoned order the ledger has ever held.
+                // The record's timestamp is the real age; a timestamp that will
+                // not parse falls back to the old behaviour rather than
+                // dropping an order that might be live.
+                const std::optional<std::chrono::sys_seconds> placed =
+                    ParseIso8601Utc(order.createdAt);
+                const auto age =
+                    placed ? std::chrono::duration_cast<
+                                 std::chrono::steady_clock::duration>(
+                                 std::chrono::system_clock::now() - *placed)
+                           : now - it->second.first;
                 if (age > hours(24 * 7)) continue;
                 const auto due = age > hours(2)
                                      ? seconds(minutes(10))
@@ -1180,7 +1289,14 @@ int Serve(std::uint16_t port) {
     });
 
     ListenerHTTP1 listener(port, std::move(routes), std::move(fallback));
-    std::println("catcrafts-server: listening on 127.0.0.1:{} "
+    // std::cerr like every other diagnostic, and not for consistency alone:
+    // under journald stdout is a pipe, so it is FULLY buffered — this line
+    // once sat invisible for hours (or died unflushed with the process) while
+    // deploy tooling polled the journal for it as a liveness signal. stderr
+    // is unbuffered; the one line that announces what the server IS must not
+    // arrive after the fact.
+    std::println(std::cerr,
+                 "catcrafts-server: listening on 127.0.0.1:{} "
                  "({} projects, {} posts, payments: bank={} crypto={})",
                  port, gContent.projects.size(), gContent.posts.size(),
                  gRails.bank ? gRails.bank->Name() : "off",

server/implementations/main.cpp

@@ -327,22 +327,47 @@ int main(int argc, char** argv) {
             out = Server::MakeRail(cfg);
             // "off" is a legitimate choice and yields no rail; a mode nobody
             // recognises silently would too, which is how a typo becomes a
-            // shop that quietly stops taking one kind of money.
+            // shop that quietly stops taking one kind of money. So an
+            // unrecognised mode is still a hard refusal — but a mode we DO
+            // recognise, failing on its runtime data, is not the same fault
+            // and must not be answered the same way (see below).
             if (!out && mode != "off") {
-                // "eurc" is the one mode that constructs to nullptr for a
-                // reason other than a typo — its chains file or address pool
-                // did not load, and MakeEurcRail has already said which and
-                // why. Repeating "unknown rail" over the top of that would
-                // send the operator looking for a spelling mistake.
-                if (mode == "eurc") {
-                    std::println(std::cerr,
-                                 "catcrafts-server: the eurc rail could not load its "
-                                 "chains file ({}) or address pool ({}) — see above",
-                                 eurcChainsPath.string(), eurcPoolPath.string());
-                } else {
+                static constexpr std::string_view kKnown[] = {
+                    "mollie", "eurc", "fake", "fake-crypto"
+                };
+                const bool known = std::ranges::find(kKnown, mode) != std::end(kKnown);
+                if (!known) {
                     std::println(std::cerr, "catcrafts-server: unknown rail '{}'", mode);
+                    return false;
                 }
-                return false;
+                // A KNOWN rail that could not load its data — for "eurc",
+                // its chains file or address pool. MakeEurcRail has already
+                // said which and why, so this only names the files.
+                //
+                // This is a WARNING and not a refusal, and the reason is the
+                // blast radius. An exhausted address pool is a state a
+                // stranger can drive the shop into (every crypto checkout
+                // spends an address), and answering it with "the process
+                // refuses to boot" turns a spent pool into the entire website
+                // down — every page, the bank rail included — held down by
+                // Restart=always until a human runs an offline wallet
+                // ceremony. That trade is never right: this box already
+                // "serves the whole site minus checkout" when no credentials
+                // exist at all (see the slot notes above), and one rail's
+                // data going bad is strictly less than that.
+                //
+                // Silent degradation is the other failure to avoid, so the
+                // warning is loud, the listening line below reports
+                // crypto=off, and tools/enable-eurc.sh refuses to call an
+                // enable successful without the rail's own load line.
+                std::println(std::cerr,
+                             "catcrafts-server: WARNING: the '{}' rail could not load "
+                             "its chains file ({}) or address pool ({}) — see above. "
+                             "CONTINUING WITHOUT IT: that payment choice is off and "
+                             "the rest of the site is unaffected.",
+                             mode, eurcChainsPath.string(), eurcPoolPath.string());
+                out.reset();
+                return true;
             }
             return true;
         };