Ledger crypto-input consumer: decide handling of Ignored/Failed payins (recurring ERROR since cutover)

[Danswar]

Context

Since the cutover went live on PRD (17.07. ~15:30 UTC) the crypto-input consumer raises ERROR every scan cycle for two payin states it has no branch for. The records themselves are intact (verified read-only via /gs/debug) — these are regular payin outcomes, not broken data. This is a design decision for the module owner, not a bug report.

Evidence

crypto_input 434587 — action=Ignored (0.000025 BNB dust on BSC, 17.07. 09:53 UTC). No buyFiat/buyCrypto link, no paymentLinkPayment — deliberately ignored by payin.

[CryptoInputConsumer] crypto_input 434587 has neither buyFiat/buyCrypto nor isPayment — skip seq0

Code path: crypto-input.consumer.ts productAnchor guard → logger.error + return undefined. The row is skipped and the watermark advances, but the §4.12 content-change scan re-visits it on every run, so the ERROR re-fires indefinitely.

crypto_input 434588 — action=Failed, asset never resolved (assetId NULL; failed deposit of an unresolved token, 17.07. 09:58 UTC).

[LedgerContentChangeScan] Content-change scan failed on crypto_input 434588: Error: crypto_input 434588 has no asset

Code path: walletAsset throws. The content-change scan catches it per-row and retries every run. Note: if a row in this state is ever ahead of the forward watermark, the throw is head-of-line-blocking for the whole crypto_input queue (failure-isolation break) — same wedge class as the BUY_CRYPTO_RETURN relation bug (#4259).

Question

Should action=Ignored / action=Failed crypto_inputs enter the ledger at all?

• (a) No — deliberate skip: treat both states as non-bookable by design; skip quietly (verbose/info, one line, watermark advances, scan ignores them). Removes a permanent false-positive from the error budget and the head-of-line risk for Failed rows.
• (b) Yes — book them: e.g. dust to a dust/suspense account; Failed deposits presumably still sit on the wallet address, so arguably they are balance-relevant.
• (c) Status quo: keep ERROR as a standing alarm.

The fail-closed philosophy of the consumers is understood to be intentional, so we did not want to pre-empt this with a PR. If (a) or (b), the change is small and we are happy to provide it.

Related

• fix(accounting): resolve the return buyCrypto via the chargeback relation #4259 — BUY_CRYPTO_RETURN read the wrong relation (buyCrypto instead of buyCryptoChargeback); wedged the bank_tx watermark since the cutover
• fix(accounting): name the source booking in the native-imbalance error #4258 — native-imbalance error now names its source booking (groundwork for the missing-fee-leg fix)
• DFXServer/server#780 — post-mortem of the cutover night; §7 covers the LedgerCutover unblocking that activated these consumers