WIRE-339/WIRE-353: keep all four claim ledgers claimable indefinitely

[huangminghuang]

Summary

• Keep all four claim ledgers claimable indefinitely: earned operator pay, returned collateral, DClaim rewards/imported balances, and reserve swap payouts/refunds.
• Remove expiry fields/indexes, DClaim expiry configuration, forfeiture paths, and the setclmwindow, flushexpired, and sweepclaims actions. Epoch advancement no longer sweeps reserve claims into the treasury.
• Preserve claimant authorization, erase-before-transfer withdrawals, reward deduplication, import locking, and backing for outstanding claims. Regenerate the affected ABI/WASM artifacts and document epoch-before-reserve deployment. Clarify action-addition/removal ordering and rollback prerequisites for all four ledgers, including preservation of DClaim’s finalized import lock.

Why

WIRE-339 establishes the no-expiry policy for claim balances; the approved WIRE-353 resolution includes DClaim rewards and imported credits. Swap payouts and refunds are likewise owed to recipients and cannot fund emissions just because they remain unclaimed. All affected rows deliberately retain storage until claimed.

This is a pre-launch schema change for fresh state. Deploy sysio.epoch before sysio.reserv, or deploy both atomically, so epoch stops calling the removed sweep action first. SYSIO #603 also changes epoch WASM; whichever PR lands second must rebuild that artifact from the merged source.

Validation

• After integrating current master, JIT epoch, DClaim, reserve, and message-channel chain suites passed 104 cases; the separate aged-claim/balance-blocked epoch regression passed. Total: 105 cases and 2,741 assertions. The merge preserves upstream envelope-retention behavior; independent architecture and correctness/compliance reviews found no remaining actionable issues.
• Earlier selected JIT reserve, emissions, epoch, operator-registry, dispatch, DClaim, and AuthEx suites: all 357 selected cases passed (309 unaffected cases from the combined run, then all 48 reserve cases after correcting the duplicate-transaction fixture).
• Delayed-claim regressions cover old refunds and swap proceeds, recredits, claimant authorization, exact withdrawals, custody conservation, duplicate rejection, delayed AuthX linking, and operator pruning. A balance-blocked epoch preserves aged reserve claims and advances only after independent funding.
• Current merged contract build and all 48 tracked artifact comparisons passed. Generated contract types exactly match the Libraries companion; unused epoch/DClaim dependencies were removed without changing contract artifacts. The reserve primary table ID is preserved; only its expiry field/index and sweep action are removed.
• Earlier matching SDK generation, ESM/CJS compilation, strict-null checking, and 22 targeted generic/reserve client tests passed. Independent correctness and architecture/compliance reviews found no remaining actionable issues.
• Earlier local operator-termination and 30-minute emissions flows passed at Sysio 20591bfd, SDK fdbddd26, and Tools 78f39784; those results precede this reserve follow-up and do not validate it.

Companion PRs

• wire-libraries-ts #87: removes the corresponding generated expiry fields and actions, including reserve claims. Merge contracts, then SDK source, then publish through the normal library release process.
• wire-tools-ts #107: adapts emissions assertions and bootstrap documentation and preserves exact collateral-code identity. It remains draft pending a compatible SDK release, dependency-minimum update, and registry-only validation; published SDK 1.0.92 still exposes the old expiry interface.

[heifner]

Could you add sysio.reserv to this PR as well? The 9/18 no-expiry decision (WIRE-339) covered all four claim ledgers, including sysio.reserv::wireclaims. That's the only ledger with a live sweep today. It holds swap payouts and refunds (paywire and refundwire credit it), so forfeiting there is the worst case of the four. Dropping the field and index is a schema change, so it should land before launch with the rest of this PR.

What would need to go:

• wire_claim::expires_at_sec, the byexpiry index, WIRE_CLAIM_WINDOW_SEC and MAX_CLAIM_SWEEP_PER_EPOCH
• sweep_expired_wire_claims and the sweepclaims action
• the forfeit-before-credit branch and the on-write sweep in credit_wire_claim
• the expiry refusal in claimwire
• the inline sweepclaims call in sysio.epoch::advance
• the expiry tests in sysio.reserv_tests.cpp, and the two sweepclaims entries in docs/contract-upgrade-order.md

The deploy order flips compared with when the sweep was added. sysio.epoch has to stop calling sweepclaims before sysio.reserv drops the action, or in the same transaction; otherwise every advance aborts. That also means rebuilding sysio.epoch.wasm, which #603 touches too, so whichever PR lands second rebuilds it. wire-libraries-ts #87 would also need the updated sysio.reserv types.

[heifner]

No code issues. The contracts compile from source, and every committed wasm/abi reproduces byte-for-byte.

• docs/contract-upgrade-order.md: rule 3 contradicts the call-edge bullet and the "inverts" paragraph below it (L216-225). For a removed action the caller deploys first, which is this release's order. Maybe phrase it as: every action the deployed caller inlines must exist in the deployed callee (added → callee first, removed → caller first). Downgrades step 2 still says "all three claim tables", but dclaim's rows changed too.
• Leftovers:
  • RESERV_ACCOUNT (sysio.epoch.hpp:129) and ../sysio.reserv/include (sysio.epoch/CMakeLists.txt:40) are unused now.
  • <sysio/system.hpp> in sysio.dclaim.hpp:8 only served now_sec().
  • The "nobody ever pulls" comment at emissions_tests.cpp:5096 no longer fits the test.

[heifner]

All addressed; contracts rebuild to the committed artifacts at b907fbb.