fix(offline-queue): watchdog reclaim + idempotent payment INSERTs (#52)

[TortoiseWolfe]

Closes #52.

Summary

Two coupled changes that close the offline-queue retry-safety hole:

1. Watchdog reclaim in base-queue.ts — stuck processing rows older than processingTimeoutMs (default 60s) reset to pending, so a tab-crash mid-process doesn't leave the user in limbo.
2. Idempotency on the INSERT side — partial unique index on payment_intents.idempotency_key + upsert(..., { onConflict, ignoreDuplicates: true }). A retry whose prior attempt actually succeeded is now a server-side no-op, not a double-charge.

Shipping reclaim alone would create double-charges; idempotency alone wouldn't fix the limbo case. They land together.

Why this matters (failure mode being closed)

A user clicks "Pay" while offline → IndexedDB queues a payment_intent row. Network restores; sync() starts; tab atomically claims the item (status: pending → processing); tab calls INSERT INTO payment_intents; before the response comes back, the laptop closes.

Today: the row stays processing forever. The claim guard (status === 'pending') blocks any other tab from re-claiming. The user's payment is in limbo. They re-click "Pay" because they don't see it succeeded; now they get charged twice when the original eventually flushes through some other path.

After this PR: the watchdog flips processing back to pending on next sync; ON CONFLICT DO NOTHING makes the retry a no-op against the row the prior attempt actually wrote. The user is charged exactly once, regardless of which side of the network call the crash happened on.

What changed

File	Change
supabase/migrations/20251006_complete_monolithic_setup.sql	payment_intents.idempotency_key TEXT + partial unique index (only enforced when set)
src/lib/offline-queue/types.ts	processingTimeoutMs (default 60_000), SyncResult.conflicted, ProcessItemResult discriminator
src/lib/offline-queue/base-queue.ts	Watchdog reclaim sweep at top of sync(); conflict-aware accounting in per-item branch; abstract signature accepts ProcessItemResult | void
src/lib/offline-queue/payment-adapter.ts	Generate idempotency_key at queue-time; switch INSERT to upsert(..., ignoreDuplicates: true); return {status: completed | conflicted}
src/lib/offline-queue/__tests__/base-queue.test.ts	+3 cases: watchdog reclaim, fresh-processing-not-reclaimed, conflict accounting
src/lib/offline-queue/__tests__/payment-adapter.test.ts	New file: +2 cases for idempotency_key flow + conflict-on-zero-row
docs/superpowers/specs/2026-04-27-offline-queue-watchdog-and-idempotency-design.md	Design rationale (new)
docs/superpowers/plans/2026-04-27-offline-queue-watchdog-and-idempotency.md	Implementation plan (new)

Out of scope

• Messaging offline queue (src/services/messaging/offline-queue-service.ts) — separate service, separate concerns. If the same shape bites there, file separately.
• subscription_update operation — UPDATE is implicitly idempotent by primary key.
• Backfill of pre-existing payment_intents rows — they expire at 24h.

Test plan

• pnpm vitest run src/lib/offline-queue/ — 21/21 pass (19 base-queue + 2 payment-adapter)
• pnpm vitest run tests/unit/ — 379/379 pass (no regressions in shared types)
• pnpm test:rls against cloud — 55/55 pass (RLS policies unaffected by the column addition)
• pnpm run type-check — clean
• pnpm exec eslint src/lib/offline-queue/ — clean
• Cloud schema migrated via Supabase Management API per CLAUDE.md (column + partial unique index verified via information_schema.columns + pg_indexes)

Commit narrative (8 commits)

1. c5c7083 schema: idempotency_key + partial unique index
2. 53c3024 types: processingTimeoutMs, conflicted, ProcessItemResult
3. f310bf6 watchdog reclaim impl + 2 regression tests
4. 89fa6da conflict-aware accounting + 1 test
5. 3aec59d adapter: generate idempotency_key at queue-time
6. 19630de adapter: upsert with ignoreDuplicates
7. ad83012 adapter dedupe regression tests
8. b30ef90 docs: spec + implementation plan

🤖 Generated with Claude Code