M6 FDQ-73 — expiry/terminal reconciliation sweep (grey_two)

[Mayakovsky]

Follows #32 (C′). Closes the FDQ-73 gap: the SDK never delivers job.expired/job.rejected to the adapter (acpAgent.fireHandler gates on shouldRespond, whose RESPONDERS map omits job.expired and sets job.rejected:[]), there's no client-side expiry timer, and the delivery poll is FUNDED-only — so a submitted-then-terminal job that isn't completed strands as status='submitted' and no stiff is ever recorded. The reputation ladder can't advance without this sweep, so it's a hard prerequisite for flip-to-enforce.

What it does

Each poll tick: listExpiredSubmitted(now) (bounded, oldest-first SELECT of still-submitted rows past expires_at) → for each, fetch the job's true on-chain status → discriminate:

• expired → resolve + one stiff (via the gate's idempotent onJobTerminal, clean→warned→…)
• rejected / completed → resolve, no stiff
• still funded / open / unknown → left submitted, retried next tick

Port-mapping rationale

Ported from plugin-acp reconcileTrackedJobs (read-only under lock #5), with one deliberate change: it triggers on expires_at < now (bounded SELECT) rather than "dropped out of the live active set." That removes the source's "dropped-from-active but actually still live" ambiguity — the authoritative-status check is the sole discriminator, so a past-SLA row that's still funded on-chain maps to null and is left alone. Marking a rejected job as expired-and-stiffed would be a false strike; this prevents it by construction. No duplicated resolve/stiff logic — it reuses the gate's onJobTerminal (which owns resolveIfSubmitted's WHERE status='submitted' idempotency guard + stiff-only-on-expired).

Safety

• Never signs — reads job status + writes reputation tables only (zero setBudget/submit/reject); safe under OBSERVE_ONLY.
• Fail-soft — a sweep-query error skips the tick; a per-row error skips that row; nothing throws into the poll loop.
• Idempotent — a real event (or a concurrent sweep) that also resolves the row is a no-op for the second observer.
• Grant-compliant (FDQ-65) — new statement is SELECT-only; resolve/stiff go through the existing UPDATE/upsert.
• Runs on the existing poll cadence; cleared by stop().

Fail-safe empirical note (verified in soak, not a blocker)

toTerminal assumes getJob returns expired/rejected/completed. If the API uses other tokens → toTerminal returns null → the row stays submitted (under-resolves — never a false stiff). Confirmed against a real stranded job during the post-redeploy soak (a controlled expiry test), adding any missing token as a one-line follow-up.

Gates

vitest run 50/50 (10 new) · tier-1 smoke ✓ · typecheck ✓ · build ✓ · lint ✓

Sequencing

C′ (#32) merged → this PR → one box redeploy carrying both (separate authorized step): BUYER_GATING_BLOCK_ENABLED=false, verify reputationGate: 'shadow' + sweep running + seller healthy on 0xa966… + grey stopped.