Atomic invite claim — prevents duplicate Submissions

[tx-joshg]

What

Replace the racy read-then-conditional-update on Invite.usedAt with an atomic updateMany claim. Eliminates duplicate Submission rows when a wizard submits twice (double-click, mobile retry, browser back+resubmit).

Why

Alexa Roberson's I-9 landed as two Pending Review rows in the open-i9 admin Submissions table, both linked to the same externalId=NTX-2001. Investigation showed both POSTs hit before either update({ usedAt }) committed, so both saw usedAt=null, both passed the guard, both inserted a Submission. PR #14's externalId lookup then funneled both onto the same Employee — which is why both rows share NTX-2001 but you still see two of them.

How

const claim = await prisma.invite.updateMany({
  where: { token, usedAt: null, expiresAt: { gt: now } },
  data: { usedAt: now },
});

if (claim.count === 0) {
  // Already used / expired / missing — look up the original
  // Submission and return its id with 200 (idempotent),
  // OR 400 / 410 / 409 as appropriate.
}

Postgres serializes writes against the same row, so exactly one concurrent caller's UPDATE matches. Everyone else gets count=0 and either:

State	Response
Invite missing	400 { error: "Invalid invite token" }
Invite expired	410 { error: "Invite has expired" }
Already used, prior submission found	200 { id, success: true, idempotent: true }
Already used, no submission	409 { error: "Invite already used" }

Client compatibility

Staff-portal's lib/i9-submission.ts reads json.id and checks res.ok, so it handles 200 and 201 identically. No client change needed.

What this doesn't do

Doesn't repair the existing Alexa duplicate row in prod — that's a separate cleanup after merge. Plan is to wipe her Employee + both Submissions + Invite, reset her staff-portal Form, and have her re-submit on the fixed code path.

Test plan

• Deploy ships clean
• Alexa wiped in both DBs
• Alexa re-runs wizard → exactly one Submission row in open-i9
• Stretch: manual double-POST to /api/submissions with same inviteToken → first returns 201, second returns 200 with same submission id