[huangminghuang]

Summary

• Keep earned operator pay, per-token returned collateral, and DClaim rewards/imported balances claimable indefinitely. Remove expiry fields, indexes, configuration, and DClaim expiry-cleanup actions.
• Preserve earned operator shadow yield when a terminated operator is pruned or re-registers. Archive banked balances in yielddebts without blocking registration; claimyield works after the operator record is gone.
• Bound yield collection by the token-specific backing pool and remaining WIRE remit capacity. Large debts can be collected in portions; unpaid balances neither expire nor accrue again. Preserve claimant authorization, custody, reward deduplication, and finalized import locking.
• Integrate the current syndication architecture: retain the retirement of sysio.reserv/sysio.uwrit and the existing unpaid-claim protection in sysio.bond. Rebuild the affected artifacts and document fresh-state schema and rollback requirements.

Why

WIRE-339 establishes the no-expiry policy; the approved WIRE-353 scope includes DClaim rewards and imported credits. Administrative operator removal must not erase earned yield or returned collateral. The upstream collateral redesign introduced a new forfeiture path during pruning and re-registration; the separate debt ledger preserves that entitlement without retaining an obsolete operator registration.

This is a pre-launch schema change for fresh state. Claim and debt rows intentionally retain system-funded storage until collected. Uncovered yield remains an obligation and becomes a payable WIRE remit only when its yield pool has backing. Slashing, settlement rulings, transport retention, and cleanup of fully paid bond requests keep their existing semantics.

Validation

• After merging master a16738c488, focused JIT operator-registry, DClaim, AuthEx, and emissions suites plus three bond-retention regressions passed 221 cases / 7,878 assertions. Coverage includes years of inactivity, delayed linking, repeated registrations, archived debt plus new yield, token identity, zero backing, bounded large-debt collection, and downstream LIQ-failure rollback.
• The incoming HTTP exception/response suite passed 16 cases / 380 assertions. The existing contract build passed, all 52 ABI/WASM comparisons matched, and CTest discovered all 39 contract suites.
• Both depot-flow coverage-map checks pass after updating the operator-termination reference to the renamed no-expiry regression; all 13 flow mappings retain their 67 native cases.
• Regenerated contract TypeScript passed standalone type checking. It includes token-aware claimremit and the new yielddebts table; the companion SDK still needs regeneration against this contract set.
• Independent correctness, architecture, and compliance reviews found no remaining actionable issues after correcting bounded debt collection and the boundary-test fixture.
• Earlier local operator-termination and emissions flows passed at Sysio 20591bfd, SDK fdbddd26, and Tools 78f39784. Those historical results do not validate the new syndication/debt interface; no current coordinated E2E result is claimed.

Companion PRs

• wire-libraries-ts #87: downstream SDK work must regenerate the current contract set, including token-aware collateral, archived yield debt, and retired-contract removal. Merge Sysio, then compatible SDK source, then publish through the normal release process.
• wire-tools-ts #107: consumer/bootstrap updates require the compatible SDK and registry-only validation. That downstream delivery remains pending and does not block review of this contract producer.

[heifner]

Could you add sysio.reserv to this PR as well? The 9/18 no-expiry decision (WIRE-339) covered all four claim ledgers, including sysio.reserv::wireclaims. That's the only ledger with a live sweep today. It holds swap payouts and refunds (paywire and refundwire credit it), so forfeiting there is the worst case of the four. Dropping the field and index is a schema change, so it should land before launch with the rest of this PR.

What would need to go:

• wire_claim::expires_at_sec, the byexpiry index, WIRE_CLAIM_WINDOW_SEC and MAX_CLAIM_SWEEP_PER_EPOCH
• sweep_expired_wire_claims and the sweepclaims action
• the forfeit-before-credit branch and the on-write sweep in credit_wire_claim
• the expiry refusal in claimwire
• the inline sweepclaims call in sysio.epoch::advance
• the expiry tests in sysio.reserv_tests.cpp, and the two sweepclaims entries in docs/contract-upgrade-order.md

The deploy order flips compared with when the sweep was added. sysio.epoch has to stop calling sweepclaims before sysio.reserv drops the action, or in the same transaction; otherwise every advance aborts. That also means rebuilding sysio.epoch.wasm, which #603 touches too, so whichever PR lands second rebuilds it. wire-libraries-ts #87 would also need the updated sysio.reserv types.

[heifner]

No code issues. The contracts compile from source, and every committed wasm/abi reproduces byte-for-byte.

• docs/contract-upgrade-order.md: rule 3 contradicts the call-edge bullet and the "inverts" paragraph below it (L216-225). For a removed action the caller deploys first, which is this release's order. Maybe phrase it as: every action the deployed caller inlines must exist in the deployed callee (added → callee first, removed → caller first). Downgrades step 2 still says "all three claim tables", but dclaim's rows changed too.
• Leftovers:
  • RESERV_ACCOUNT (sysio.epoch.hpp:129) and ../sysio.reserv/include (sysio.epoch/CMakeLists.txt:40) are unused now.
  • <sysio/system.hpp> in sysio.dclaim.hpp:8 only served now_sec().
  • The "nobody ever pulls" comment at emissions_tests.cpp:5096 no longer fits the test.

[heifner]

All addressed; contracts rebuild to the committed artifacts at b907fbb.