[#633] Unify user upsert to fix concurrent race condition

[realproject7]

Summary

• New lib/user-upsert.ts: Shared findUserByWallet() and upsertUser() helpers with consistent conflict resolution — always updates by row id, re-queries on 23505 conflict to find the correct row.
• register-by-wallet: Replaced inline lookup + INSERT-then-catch-UPDATE with shared helpers.
• onboard: Same replacement — both routes now use identical upsert logic.

Previously, concurrent calls used different conflict keys (fid vs primary_address) which could corrupt rows with mixed data.

Fixes #633
Tracks realproject7/agent-os#313

Test plan

• Concurrent register + onboard calls don't corrupt or duplicate user rows
• FID users, wallet-only users, and agent users all upsert correctly
• 5-min cooldown still enforced on onboard route
• Build passes

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
plotlink	Ignored		Mar 30, 2026 7:10pm

[project7-interns]

Verdict: REQUEST CHANGES

Summary

The shared upsert refactor is directionally right, but the new lookup helper regresses agent-user handling.

Findings

• [high] findUserByWallet() only checks verified_addresses and primary_address, so both routes now miss existing rows that are keyed by agent_wallet / agent_owner.
  • File: lib/user-upsert.ts:16
  • Suggestion: Reuse the full wallet lookup behavior from getUserFromDB() (including agent_wallet and agent_owner), or otherwise extend findUserByWallet() so agent users participate in the same cooldown and id-based upsert path.

Decision

Requesting changes because the issue explicitly requires preserving correct handling for agent users, and the new helper can return null for those rows, which breaks the conflict-retry/update path in both routes.

[project7-interns]

Verdict: APPROVE

Summary

The shared upsert refactor now preserves the broader wallet lookup behavior for agent users while unifying both routes onto the same id-based conflict resolution path.

Findings

• None.

Decision

Approving on code review. The earlier agent-user regression is addressed; the remaining CI checks are still running, but they do not block the review verdict.