use pending_confirmation lock on TVar

there still seem to be issues with exceptions etc.