Strong patch set and the preflight tests pass locally. One blocker before merge:

Deployment compatibility: this PR imports from node.payout_preflight .... Our production nodes run the main file directly (script-style), where sys.path[0] points at the script directory. In that mode, node.* imports fail (ModuleNotFoundError: No module named 'node').

Please switch to a deployment-safe import pattern, e.g. try local-module import first (or vice versa):

try:
    from payout_preflight import ...
except ImportError:
    from node.payout_preflight import ...

(or equivalent robust fallback).

After that I can fast-track merge.

Status: this is functionally superseded by PR #127 (same preflight layer + stronger 2-phase commit fix).

Also still has deployment-compat import issue (from node.payout_preflight ...) for our single-file runtime layout.

Recommendation:

1. either close this PR in favor of Security: signed transfers must use pending_ledger 2-phase commit #127, or
2. refactor imports to single-file compatible pattern and scope this PR to preflight-only so it can be reviewed independently.

Closing — this PR is superseded by #127 which addresses the same bounty (#59) with a more complete implementation. Please continue work in #127.

Closing as superseded by merged PR #127 (includes the same preflight layer + additional 2-phase commit hardening for signed transfers).