Order lifecycle

Every way an order ends, and exactly what still works when trading is paused or the feed goes down.

States

State	How it is reached
Open	Escrowed, in both index sets, fillable while the clock runs
Filled	sellRemaining == 0; de-indexed automatically on the last fill
Cancelled	The order is closed and its remainder is refunded to the maker
Expired	Its deadline passed and the remainder was refunded to the maker

orderStatus reports Expired for an order that is still Open in storage but past its deadline, so a reader never has to compute that themselves.

Expiry and refunds

After an order’s deadline, anyone may trigger its expiry. The remaining escrow always goes back to the maker, and expiry remains available while trading is paused.

What a pause stops

Action	Paused
Create an order	blocked
Fill an order	blocked
Cancel or expire an order	available

What an unusable reference price stops

Action	Stale feed or unavailable five-minute average
create, either kind	blocked
fill a Pegged order	blocked
fill a Fixed order	works
cancel · expire	works

A pegged order has no price of its own, so pricing it from a stale or under-sampled average is exactly the thing worth refusing. A fixed order’s ratio was locked at creation and needs nothing from the feed.

No Rondo control path disables an exit. Cancellation remains callable regardless of the oracle, protocol pause, or whether the maker still holds MAKER_ROLE. If a token transfer is unavailable, the refund waits until the transfer can complete.

Enumeration has a sharp edge

EnumerableSet.remove swaps the last element into the freed slot. So an order cancelled between two page reads slides backwards into a page the reader has already passed, and is never seen — while still being open and fillable.

Any consumer paging the open set must read every page at one pinned block. The reference interface reads count, id pages and order data as a single block-pinned query for exactly this reason.