Escrow Auto-Release: When The Inspection Clock Runs Out
How the cron-driven auto-release works, what stops it, and why it exists alongside the four-eyes manual confirmation rather than instead of it.
An escrow held forever is a bad outcome for everyone. The buyer either accepted or didn’t. The seller did the work. If neither party closes the loop, the platform does — automatically, after a configured window. Auto-release is the cron-driven backstop that prevents escrows from becoming forgotten.
The clock
The auto-release window is a tenant policy (see /escrow/policies, H7), measured in days from goods-received. The default is 7 days. When the window expires without an explicit acceptance, an explicit rejection, or an active dispute, the cron releases the funds to the seller and writes the release event to the immutable audit trail with the reason “auto-release: inspection window elapsed.”
What stops it
Three things halt the cron mid-window: an explicit acceptance (the buyer clicks Accept, funds release immediately), an explicit rejection (the buyer rejects with a reason, funds hold pending dispute), and an active dispute (a dispute pauses the clock until resolution). The cron checks each escrow row before deciding to release; nothing about the auto-release fires blindly.
Distinct from manual four-eyes
The four-eyes confirm (see escrow-four-eyes-deposit-confirmation) is a different control on the deposit side: two operators must agree the buyer’s wire arrived before the platform marks the deposit confirmed. Auto-release is on the release side: the platform releases on its own when the buyer doesn’t act. Both controls coexist. The deposit side gets the human pair; the release side gets the timer.
Cron behaviour
The /api/cron/escrow-auto-release job runs once an hour. It scans escrows whose goods-received date is older than the auto-release window, where status is still “held” and no dispute is open. For each match it executes the release transaction atomically: write the settlement row, flip the escrow status, post the audit event, queue the seller notification. The cron raises if the tenant policy is missing rather than silently doing nothing — a release without a policy is a release without an agreed window.
What the buyer sees
From day-of-shipment, the buyer sees a countdown on the deal: “release in 12 days unless you accept or dispute.” It’s a feature, not a threat — the timer means the buyer doesn’t have to remember to click Accept on a deal that went smoothly.