Spike: Design non-disputed milestone release flow and persistent storage TTL/rent strategy

[meshackyaro]

Description

Two related gaps in the live, deployed contract (contracts/trustflow/src/lib.rs):

1. No happy-path fund release. The only code path that ever transfers escrowed tokens out of the contract is resolve_dispute (~line 534), which only runs after a dispute has been raised and voted on. There is no approve_milestone, release, or withdraw entrypoint for the non-disputed case, despite EscrowRecord.milestones and init_escrow (~line 256) accepting a Vec<Milestone>. It's unclear whether release for undisputed milestones is meant to be triggered by depositor sign-off, a timelock, or an external event.

2. No TTL/rent management. The contract writes many storage().persistent() entries (Escrow, Dispute, JurorStake, JurorVote, DisputeVoters, JurorSlashCount) but never calls extend_ttl/bump anywhere — contrast with the (dead) contracts/src/storage.rs::extend_ttl. On Soroban, persistent entries that aren't extended will expire and archive, which could permanently lock funds in an escrow or dispute that nobody paid to keep alive.

Both are blocking gaps for a protocol that's meant to actually pay people.

Component

Contract

Difficulty

🟣 Spike — investigation required, scope not yet defined

Tasks

• Design the non-disputed release/approval model (depositor sign-off vs. timelock vs. oracle-triggered) and its authorization checks
• Prototype a release_milestone/approve_milestone entrypoint against Soroban testnet
• Design the TTL/rent-bumping strategy — who pays for extension, at what cadence, and how restore-on-access is handled for entries that do lapse
• Prototype TTL extension on at least one storage entry type and verify behavior under Soroban's archival rules

Acceptance Criteria

• A written recommendation for the release-authorization model
• A written recommendation for the TTL/rent strategy
• Working prototypes (even if not merged) for both
• Follow-up implementation issue(s) filed
• Any blocking unknowns flagged

Estimated Time

2-3 days (time-boxed spike)