plans: names landed check spends the code

plans/names-codes/2026-10-21-store-api.md

@@ -475,7 +475,7 @@ Finds a name code's orders. Used by Check your code (the name code's verdict and
 - Message: `simplex.domains name <registrationId> <labelHash> <length> <duration> <commitment> <sha256(sealed)> <timestamp>`. An `owner` in the body is ignored.
 - A body whose fields equal the registration's current ones is a repeat: it answers the view unchanged and counts no move.
 - Allowed only (manager's ruling, 2026-10-21): for a paid registration in `taken`; for any registration in `failed`; and for any registration in `committed` whose reveal was refused for its links (`invalid_link`, recorded by the reveal). Never from a `committed` registration that has had no such refusal. Else `bad_request`. The new name may be the same name with other links.
-- From `failed`, `/name` first runs `/retry`'s check 1 (section 9) on the current name: a register that went through makes the order `registered`, and `/name` answers `409 registration_changed` with that view, so one payment never registers two names.
+- From `failed`, `/name` first runs `/retry`'s check 1 (section 9) on the current name: a register that went through makes the order `registered`, and `/name` answers `409 registration_changed` with that view, so one payment never registers two names. A failed chain read in that check answers `503 name_check_unavailable`.
 - At most `max_order_moves` (3) successful moves per order over its life, counted on success; past that, `409 {"error": "move_limit", "registration": {…the current view}}`. The order stays as it is (`failed`, `taken`, or `committed` with its links refused); the page shows its state with a line to contact SimpleX support and the order's reference, and support settles it by hand, refunding a paid order.
 - The order checks run on the new fields: formats, `invalid_name`, existing live orders for the new commitment or this owner and the new hash, other than this registration (`409 order_exists`), the duration for the registration's `years`, `name_taken`, `name_check_unavailable`.
 - A paid order: the new name's chain price for the registration's `years` must be at most its `price`, else `409 {"error": "price_too_high", "price": <cents>}`. A cheaper name refunds nothing, which the page says before the buyer chooses.
@@ -497,7 +497,7 @@ Finds a name code's orders. Used by Check your code (the name code's verdict and
 ### `POST /api/registration/:id/retry`
 
 Only from `failed`, else `400 bad_request`. In order:
-1. A register that went through with only its confirmation lost (a mined register with status 1, or `ownerOf` is the owner) makes it `registered`.
+1. A register that went through with only its confirmation lost (a mined register with status 1, or `ownerOf` is the owner) makes it `registered`. A code order's code is spent in the same write when it is still unused or held by this order; a code released and then spent, revoked or expired meanwhile leaves the order `registered` and alerts the operator, since the name was already paid with it.
 2. A code order whose code was released by the 30-day sweep and is now used, revoked, expired or held elsewhere answers that code error (`409 code_used`, `400 code_invalid`, `409 code_expired`, `409 code_reserved`); it stays `failed`.
 3. Otherwise it is `queued` again at no charge, re-reserving a released code. When the sponsor nonce moved since the intent, the label and intent are cleared, so the page reveals and signs again.