fix(ledger): recover feedless-crypto cutover owed openings via a widened last-mark lookup

[TaprootFreak]

Closes #4270.

Problem

A cutover owed (openBuyCryptoOwed) or manual-debt (openManualDebt) opening whose asset carries no mark in the 2-day preload window — a delisted/feedless crypto — currently fails loud (bookReceivedOwedOpening throws), so the whole cutover rolls back and retries every 5 minutes forever. It is defensive today (0 such rows for the current snapshot) but a real wedge risk for a future delisting (e.g. the DeFiChain sunset).

The value is recoverable: the owed buy_crypto row is ≤ OPEN_ROW_LOOKBACK_DAYS (90d) old and an asset cannot be sold unpriced, so its last finite mark ≤ snapshot sits within a 90d window (365d for a standing manual-debt) — one the 2d preload and the 5d getLatestMark bridge simply don't reach.

Change

• LedgerMarkService.getMarkAtWidened(assetId, asOf, lookbackDays) — read-only, lazy, memoized. Reuses the canonical preload → LedgerMarkCache.getMarkAt (binary-search "latest finite priceChf ≤ asOf") over a widened, daily-sampled window; the per-window cache is memoized so several feedless rows share one read. Returns undefined only for a truly-unpriced asset.
• openBuyCryptoOwed / openManualDebt — try the 2d full-tick cache first, then getMarkAtWidened as a ?? fallback (90d / 365d). The opening is valued at amount × last-mark and booked as fixed CHF on the existing CHF bucket LIABILITY/{bucket} (assetId NULL, needsMark false) — byte-identical to a priced owed opening. A still-missing mark logs an alarm and fails loud (deferred), unchanged.

Settlement code (payout-order.consumer, bank-tx.consumer) is not touched.

Why this design (S) and not the issue's asset-backed sketch (A)

The issue proposed booking the opening asset-backed on a per-asset account and teaching the discharge to close it. A design review rejected that: to be mark-to-market-revaluable the per-asset account (LIABILITY/{bucket}/{asset}, amountChf null) re-introduces the exact name-mismatch discharge trap that closed #4251 (the forward cutoverOwedOpeningChf matches the CHF-bucket name + reads leg.amountChf), and mark-to-market can't revalue a never-relisted delisted asset anyway (its own 2d getMarkAt is undefined) — so A's revaluation benefit is vacuous while its hot-settlement-code surgery is real risk. Valuing on the existing CHF bucket keeps the delisted subset consistent with every other owed opening (all historical-cost CHF), needs zero settlement-code change, and closes cent-exact via the existing withFxPlug (opening↔settlement drift → INCOME/EXPENSE fx-revaluation). The final settled state is bit-for-bit identical to A; only the timing of fx recognition differs. The issue's own Notes already sanctioned "keep the opening on the CHF bucket".

Verification (Node 20)

prettier / eslint / type-check / build clean · DI graph resolves (boot reaches JwtStrategy env, i.e. past DI) · full accounting suite 776/776.

Added tests:

• ledger-mark.service.spec — getMarkAtWidened: recovers a mark older than the 2d/5d windows; reads over asOf − lookbackDays (dailySample); never returns a future mark; undefined for a truly-unpriced asset; memoizes per window (single read).
• ledger-cutover.service.spec — a feedless buyCrypto-owed asset is recovered and booked on LIABILITY/buyCrypto-owed at amount × last-mark with no per-asset account (guards the fix(accounting): value foreign-fiat owed openings via the currency asset mark #4251 trap); a live asset is valued from the 2d cache without invoking the fallback; a feedless manual-debt is recovered over 365d; the truly-feedless cases still fail loud.

Coverage note: because a feedless opening is booked byte-identically to a priced owed opening (asserted directly by the cutover spec: same CHF-bucket account, real amountChf, needsMark false, no per-asset account), the forward discharge is unchanged code exercising an identical input — its cent-exact close is already covered by the existing priced-owed discharge tests. A separate payout_order integration harness was judged disproportionate for a defensive, 0-rows-today change; happy to add one if reviewers prefer.

[TaprootFreak]

Reviewed across two dimensions (conformance/quality + logic/correctness), two passes to zero findings.

• Pass 1 raised one real minor: getMarkAtWidened memoized the per-window preload promise before it resolved and never evicted it on rejection, so a transient DB error on the widened read could cache a rejected promise under the pinned-snapshot key and re-throw on every 5-min retry — wedging the cutover until a process restart, even after the DB recovered. Fixed in 2a0e57b (evict the key on rejection) with a regression test.
• Pass 2 clean (the only raised item was a refuted comment-wording nit — the 90d price-existence guarantee vs the 92d lookback is already explicit in the code, the log message, and the spec).

CI green (Build and test, review, CodeQL, analyze). Verified on Node 20: prettier / eslint / type-check / build, DI graph resolves, full accounting suite 776/776 (incl. the added cases).