OptionalperUserCapMinor?: bigintCeiling (CREDIT minor units) one buyer may spend in this session. Bounds the velocity/risk exposure the fast lane forgoes and the cross-node residual race. Production configs set it.
Optionalprefund?: { amountMinor: bigint }Prefund mode (host opt-in): each buyer's first purchase moves amountMinor of matured
spendable credits into a per-(user, session) escrow account by a real ledger posting, and
every movement in this lane debits that escrow instead of spendable. The account key is
the crash-safe attribution — recovery derives the unspent remainder from durable postings
plus the journal — and the accept screen becomes session-local (the escrow belongs to this
session alone), which is what removes the cross-node contention on the buyer's spendable.
Settle refunds the remainder to spendable; the orphan sweep repairs a crashed refund.
The lane's knobs: the session's batch bounds and shared registry, the per-buyer spend cap, and the prefund escrow opt-in.