F0b: index cambiatus.es::expire closes as status 'expired' (land before contract deploy)

[lucca65]

F0b (1/3) — Index cambiatus.es::expire closes as status expired

🔴 Land this before the hardened escrow contract deploys. contracts #47 added expire (closes a deposit, erases the row, pays the buyer) and the indexer doesn't know it exists. Unindexed, the first expire leaves the replica row open forever and the hourly reconciler reports permanent only_in_db drift — the exact divergence the reconciliation packet exists to detect, created by construction.

Companion PRs: backend fix/escrow-expired-status (status validation + payout reconciliation) and contracts fix/escrow-docs-offchain (DEPLOYMENT.md).

Changes

• src/updaters.js — registers cambiatus.es::expire between refund and sweep, with a comment recording that setminimum is deliberately not indexed (configuration, not money movement; the reconciler reads nothing from it; the P3.2/P3.3 buy flow reads the mindeposit row from chain when validating amounts).
• src/updaters/escrow.js — new expire() updater routes through the existing closeDeposit with status 'expired', so the replay guards (status = 'open' scope, created_block <= action block bound) apply unchanged — same UPDATE, verified. expired is distinct from refunded on purpose: the P3.5 escalation work needs to tell "seller refunded" from "counterparty went silent and the backstop fired".
• closed_by records the buyer (from the row being closed, via COALESCE($5, buyer_id) with NULL passed for expired), not the action's actor. expire is permissionless — payload.authorization can be empty from a programmatic client, so authorization[0].actor would crash; and the actor says nothing about where the money went — the contract always pays the buyer, which is what reconciliation needs.

Acceptance (local chain, make node-fresh && make build && make bootstrap on contracts master — deploys the hardened escrow)

Deposit order_ref=777001 (carol→dave, arbiter alice, 10 TST); short-expiry wasm (ESCROW_EXPIRY_SECONDS=3, the test-suite shape) deployed; expire fired by third party eve; production wasm restored (code hash matches checked-in escrow.wasm before and after):

order_ref | status  | closed_tx          | closed_block | closed_by
----------+---------+--------------------+--------------+----------
 777001   | expired | 0514d195c62a74c5…  | 1997         | carol      <- buyer, not eve (caller)

Chain confirms: deposit erased, carol refunded 10 TST, inline transfer cambiatus.es → carol 10 TST.

Replay (safe rewind: UPDATE _index_state SET block_number=1996 … WHERE id=1 + DELETE FROM _processed_actions WHERE global_seq=2064, then reindex):

row_fingerprint before: 52c9dd6edaa96753b8bc4dc6cbf8af5e
row_fingerprint after:  52c9dd6edaa96753b8bc4dc6cbf8af5e   (identical, no duplicate)
log: Escrow expired: no open deposit for order_ref 777001 (tx 0514d195…) — skipping
_processed_actions: global_seq 2064 re-claimed, count 1

The deleted ledger row forced the replay through closeDeposit itself, and the status='open' + created_block bound made it a no-op — the two-layer guard holds for the new status path.

yarn format (StandardJS) clean.