pastilhasandClaude Opus 5
e0f6a469aa
two holes found auditing the wallet sidecar after the frozen-utxo fix. the brute-force backoff lived inside UnlockSession.unlock alone, so /unlock capped at five guesses a minute while export-seed — the one endpoint that returns the words in the clear — took unlimited ones. every passphrase check now goes through the same guard. verifyPassphrase rethrows LOCKED_OUT rather than folding it into `false`, so a caller can tell "wrong" from "stop". nextUnused advanced its mark on every issuance, paid or not, so a run of unpaid addresses walked it past the end of the window the next scan covers; a payment there would never be found again, and esplora has no rescan to go looking. sources now declare how far past a scan's last index they can still see, and issuance clamps to it — re-offering a virgin address rather than handing out one that could lose money. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>