@hyperscale0/hsx 1.0.0 → 1.0.124

package/std/insurance.hsx

@@ -0,0 +1,89 @@
+header insurance
+
+// Economics: Company commission is earning; refunds reverse its captured transfer.
+// Outside broker commissions are pass-through. Adapter-owned premium and claim
+// accounts lack an authored source party, so their moves remain unclassified.
+
+// Expose cover.create, activate and cancel separately. Activation binds adapter;
+// each slice needs a separately created unique period and an active cover to collect.
+// Collection debits holder for insurerPremium to the insurer and commission to
+// broker as two moves. Broker defaults to programOperator; bind a declared business
+// for a distinct agency. The two amounts sum to premium. Zero portions are allowed.
+// Cover.cancel invokes refund only on paid slices, before each startsAt. It returns
+// insurerPremium from insurer and commission from broker to holder. Active or
+// expired periods are excluded; insufficient recipient funds refuse the reversal.
+// Slice refund is parent-owned, not a public alias. Expose cover.cancel instead.
+// Claims require active cover. Expose claim.create, approve, deny and pay as needed.
+// Inspector approves OR denies from submitted. After approval only pay or clock
+// expiry can consume the reservation; deny is never available after approval.
+// Inspector is a bound party, not necessarily staff. These are ledger transfers;
+// outside settlement needs the boundary protocol, not a claim of provider success.
+
+// Cost: each slice collection or refund declares two transfers. Claim approval
+// reserves once; pay posts once and expiry voids once. Cover cancellation adds
+// bounded slice invocations. Run hsx cost for composed counts, not provider prices.
+
+instrument cover(holder: party, adapter: text, commission: percent = 0%, broker: party = programOperator, covers: ref, premium: money = runtime) {
+  summary: "Recurring cover bound to an outside insurer across an ADL boundary."
+  fields { covers: ref<covers>, holder: account of holder, insurer: account(adapter(adapter), cash, "premium"), expiresAt: date }
+  lifecycle { states: [pending, active, cancelled, expired], initial: pending }
+  action create {}
+  action activate {
+    from: pending, to: active, actor: { party: programOperator }
+    subject { adapter: adapter }
+  }
+  action cancel {
+    from: active, to: cancelled, actor: { party: holder }
+    invoke: [{ selection: { instrument: slice, reference: "cover", anchor: self.id, states: [paid], limit: 366 }, action: refund, input: {} }]
+  }
+  action expire { from: active, to: expired, actor: clock, due: { at: self.expiresAt } }
+  records {
+    slice: {
+      summary: "A whole premium period, collected once and refundable only before it starts."
+      fields {
+        cover: ref<parent>, covers: ref<covers>, premium: money = premium, startsAt: date, endsAt: date
+        commission: money = rate(self.premium, commission)
+        insurerPremium: money = subtract(self.premium, self.commission), commissionReceipt: text?
+      }
+      lifecycle { states: [pending, paid, active, expired, refunded], initial: pending }
+      action create {
+        requires self.covers == self.cover.covers
+        requires self.startsAt < self.endsAt
+        requires unique "premium_period" on [self.cover, self.startsAt, self.endsAt]
+      }
+      action collect {
+        allowZero: true
+        requires self.premium > "0"
+        from: pending, to: paid, actor: { party: holder }
+        requires self.cover in [active]
+        moves self.insurerPremium from holder to self.cover.insurer
+        moves self.commission from holder to broker capture "commissionReceipt" economics { recipient: broker, company: { purpose: earning, sourceParty: holder }, participant: { purpose: pass_through, sourceParty: holder } }
+      }
+      action start { from: paid, to: active, actor: clock, due: { at: self.startsAt } }
+      action expire { from: active, to: expired, actor: clock, due: { at: self.endsAt } }
+      action refund {
+        allowZero: true
+        requires self.premium > "0"
+        from: paid, to: refunded, actor: { parent: parent }, deadline: { at: self.startsAt }
+        moves self.insurerPremium from self.cover.insurer to holder
+        moves self.commission from broker to holder economics { recipient: broker, company: { purpose: earning, sourceParty: broker, reversalOf: self.commissionReceipt }, participant: { purpose: pass_through, sourceParty: broker } }
+      }
+    }
+  }
+}
+
+instrument claim(cover: ref<insurance.cover>, inspector: party) {
+  summary: "A claim decision reserves one claim payment before settlement."
+  fields { cover: ref<cover>, amount: money, expiresAt: date, evidence: text, reservation: text? }
+  lifecycle { states: [submitted, approved, paid, denied, expired], initial: submitted }
+  action create { requires self.cover in [active] }
+  action approve {
+    from: submitted, to: approved
+    actor: { party: inspector }
+    deadline: { at: self.expiresAt }
+    moves reserve self.amount from self.cover.insurer to self.cover.holder capture "reservation"
+  }
+  action pay { from: approved, to: paid, actor: { party: inspector }, deadline: { at: self.expiresAt }, moves post self.reservation }
+  action deny { from: submitted, to: denied, actor: { party: inspector } }
+  action expire { from: approved, to: expired, actor: clock, due: { at: self.expiresAt }, moves void self.reservation }
+}

package/std/lending.hsx

@@ -0,0 +1,138 @@
+header lending
+
+// Economics: Funding and commitment returns are principal. Distribution tax is
+// pass-through; own-account fee and claim allocations are internal. Mixed
+// principal/profit distributions and unbound source owners remain unclassified.
+
+// Round target is plan.principal from runtime subject.price, not its credit limit.
+// Expose round.create and close plus commitment.create and withdraw. A commitment
+// debits the bound investor's original active wallet before closesAt. Investor cap
+// aggregates by investor across wallets. Failure refunds those original wallets.
+// Closing needs the exact target; it funds plan.capital and does not disburse the
+// loan. Expose plan.disburse separately after signing and limit approval.
+// Distribution.create needs a recorded, unconsumed settlement matching the plan.
+// Prepare cash or loss first, then create shares against funded commitments of
+// that round. Distribution needs pending share weights equal to the round target.
+// Cash fee is a percentage of retained profit, VAT a percentage of that fee.
+// Principal plus retained profit less fee and VAT goes to weighted wallets;
+// floored residual goes to residual_to. Loss mode moves claim balances, not cash.
+// Child share execution is parent-owned. No report or clock proves outside payout.
+
+// Cost: round.create declares one owned account. Close transfers its balance
+// and invokes commitments; failure invokes their refunds. Distribution adds moves
+// and bounded share invocations. Run hsx cost for counts after policy selection.
+
+instrument round(borrower: party, plan: ref<financing.installments> = object(financing.installments), operator: party = programOperator, minimum_ticket: money = 100 SAR, investor_cap: percent = 20%, commitments: ref<lending.commitment> = object(lending.commitment)) {
+  summary: "A threshold funding round; failed rounds return each original wallet contribution."
+  fields {
+    borrower: account of borrower, plan: ref<plan>, price: money = self.plan.principal, closesAt: date
+    minimumTicket: money = minimum_ticket, maximumTicket: money = rate(self.price, investor_cap)
+    held: account of self
+  }
+  lifecycle { states: [open, funded, failed], initial: open }
+  action create { requires unique "funding_plan" on [self.plan]; requires self.borrower == self.plan.borrower }
+  action close {
+    from: open, to: funded, actor: { party: operator }
+    requires sum "amount" of { instrument: commitments, reference: "round", anchor: self.id, states: [committed], limit: 366 } == self.price
+    requires self.held.balance == self.price
+    moves self.price from self.held to self.plan.capital economics { purpose: principal, sourceParty: programOperator }
+    invoke: [{ selection: { instrument: commitments, reference: "round", anchor: self.id, states: [committed], limit: 366 }, action: fund, input: {} }]
+  }
+  action fail {
+    from: open, to: failed, actor: clock, due: { at: self.closesAt }
+    requires self.held.balance < self.price
+    invoke: [{ selection: { instrument: commitments, reference: "round", anchor: self.id, states: [committed], limit: 366 }, action: refund, input: {} }]
+  }
+}
+
+instrument commitment(round: ref<lending.round>, wallet: ref<wallet.balance>, investor: party = party(person)) {
+  summary: "One investor's original-wallet contribution, capped cumulatively within the round."
+  fields { round: ref<round>, wallet: ref<wallet>, investor: account of investor, amount: money, loss: account(investor, claim, "loss") }
+  lifecycle { states: [committed, funded, withdrawn, refunded], initial: committed }
+  invariants sum "amount" of { instrument: all(lending.commitment), reference: "round", anchor: self.round, states: [committed, funded], limit: 366, where: { investor: { field: self.investor } } } <= self.round.maximumTicket
+  invariants sum "amount" of { instrument: all(lending.commitment), reference: "round", anchor: self.round, states: [committed, funded], limit: 366 } <= self.round.price
+  action create {
+    actor: { party: investor }
+    requires self.round in [open]
+    requires self.wallet in [active]
+    requires self.wallet.holder == self.investor
+    requires self.amount >= self.round.minimumTicket
+    deadline: { at: self.round.closesAt }
+    moves self.amount from self.wallet.held to self.round.held economics { purpose: principal, sourceParty: programOperator }
+  }
+  action fund { from: committed, to: funded, actor: { parent: round } }
+  action withdraw {
+    from: committed, to: withdrawn, actor: { party: investor }
+    requires self.round in [open]
+    deadline: { at: self.round.closesAt }
+    moves self.amount from self.round.held to self.wallet.held economics { purpose: principal, sourceParty: programOperator }
+  }
+  action refund {
+    from: committed, to: refunded, actor: { parent: round }
+    moves self.amount from self.round.held to self.wallet.held economics { purpose: principal, sourceParty: programOperator }
+  }
+}
+
+instrument distribution(round: ref<lending.round>, receipt: ref, commitments: ref<lending.commitment> = object(lending.commitment), mode: enum(cash, loss) = cash, residual_to: party = programOperator, operator: party = programOperator, fee: percent = 1%, tax: percent = 15%) {
+  summary: "Frozen weighted shares, floored once, with residual assigned to the chosen party."
+  fields {
+    round: ref<round>, source: ref<receipt>, mode: enum(cash, loss) = mode
+    principal: money?, profit: money?, grossTotal: money?, charge: money?, vat: money?, net: money?
+    held: account of self, losses: account(self, claim), residualLoss: account(residual_to, claim, "loss")
+  }
+  lifecycle { states: [pending, cash_ready, loss_ready, distributed], initial: pending }
+  action create { requires self.round in [funded]; requires self.source in [recorded]; requires self.source.plan == self.round.plan; requires unique "settlement_consumption" on [self.source.plan, self.source.identity] }
+  action prepare_cash {
+    from: pending, to: cash_ready
+    requires self.mode == "cash"; requires self.source.kind == "cash"; requires self.source in [recorded]
+    calculate: [
+      { target: "principal", op: "sum", values: [{ field: self.source.principal }] }
+      { target: "profit", op: "sum", values: [{ field: self.source.retainedProfit }] }
+      { target: "charge", op: "rate", base: { field: self.profit }, bps: { literal: fee }, rounding: "floor" }
+      { target: "vat", op: "rate", base: { field: self.charge }, bps: { literal: tax }, rounding: "floor" }
+      { target: "grossTotal", op: "sum", values: [{ field: self.principal }, { field: self.profit }] }
+      { target: "net", op: "subtract", base: { field: self.grossTotal }, subtract: [{ field: self.charge }, { field: self.vat }] }
+    ]
+  }
+  action prepare_loss {
+    from: pending, to: loss_ready
+    requires self.mode == "loss"; requires self.source.kind == "loss"; requires self.source in [recorded]
+    calculate: [{ target: "net", op: "sum", values: [{ field: self.source.loss }] }]
+  }
+  action distribute_cash { allowZero: true,
+    from: cash_ready, to: distributed, actor: { party: operator }
+    requires sum "weight" of { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 } == self.round.price
+    moves self.principal from self.source.capital to self.held; moves self.profit from self.source.profitIncome to self.held; moves self.charge from self.held to programOperator economics { purpose: internal, sourceParty: programOperator }; moves self.vat from self.held to programTax economics { purpose: pass_through, sourceParty: programOperator }
+    invoke: [{ selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: cash, input: {} }, { reference: self.id, action: residual_cash, input: {} }]
+  }
+  action residual_cash { allowZero: true,
+    from: distributed, to: distributed, actor: { parent: current() }
+    moves self.held.balance from self.held to residual_to
+  }
+  action distribute_loss { allowZero: true,
+    from: loss_ready, to: distributed, actor: { party: operator }
+    requires sum "weight" of { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 } == self.round.price
+    moves self.net from self.source.lossAccount to self.losses
+    invoke: [{ selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: loss, input: {} }, { reference: self.id, action: residual_loss, input: {} }]
+  }
+  action residual_loss { allowZero: true,
+    from: distributed, to: distributed, actor: { parent: current() }
+    moves self.losses.balance from self.losses to self.residualLoss economics { purpose: internal, sourceParty: programOperator }
+  }
+  records {
+    share: {
+      fields {
+        distribution: ref<parent>, commitment: ref<commitments>
+        weight: money = self.commitment.amount
+        gross: money = ratio(self.distribution.net, self.weight, self.distribution.round.price)
+      }
+      lifecycle { states: [pending, paid], initial: pending }
+      action create { requires self.distribution in [cash_ready, loss_ready]; requires self.commitment in [funded]; requires unique "distribution_weight" on [self.distribution, self.commitment]; requires self.commitment.round == self.distribution.round }
+      action cash { allowZero: true,
+        from: pending, to: paid, actor: { parent: parent }
+        moves self.gross from self.distribution.held to self.commitment.wallet.held
+      }
+      action loss { allowZero: true, from: pending, to: paid, actor: { parent: parent }, moves self.gross from self.distribution.losses to self.commitment.loss economics { purpose: internal, sourceParty: programOperator } }
+    }
+  }
+}

package/std/marketplace.hsx

@@ -0,0 +1,123 @@
+header marketplace
+
+// Economics: Deposit funding, escrow credit and returns are principal. Retention is
+// earning for the company or a payout to a bound outside recipient.
+
+// Listing, order and reservation are separate agreements. Expose their create
+// and decision actions individually. Order fulfillment does not move escrow cash.
+// Pair an order with escrow.hold and expose its fund, deliver, accept, dispute,
+// verify_return and refund aliases. Refund needs disputed -> return_verified,
+// with payee evidence, then returns the full price to payer; accept pays payee.
+// A reservation holds its own deposit. Activate requires an active listing and
+// no placed order. Only a declared converter may invoke credit. A financing
+// plan on the same hold credits it when the lender disburses. Credit consumes the
+// deposit once, credits at most the contribution, and returns excess to buyer.
+// Expose cancel, seller_cancel or operator_cancel for the intended actors.
+// Buyer cancel and expiry use configured refund percentages; seller/operator
+// cancellation return the whole reservation balance. Converted money is in escrow,
+// so subsequent return verification and refund use the escrow aliases.
+
+// Cost: listing and order actions declare no transfers. Reservation.create
+// declares one owned account; activate declares one deposit transfer. Cancellation
+// and credit split that balance into moves. Run hsx cost for the composed counts.
+
+instrument listing(seller: party) {
+  revisioned: true
+  summary: "A seller's offer and its asking price."
+  fields { seller: account of seller, title: text, price: money }
+  lifecycle { states: [draft, active, withdrawn, sold], initial: draft }
+  action create { actor: { party: seller } }
+  action publish {
+    from: draft, to: active, actor: { party: seller }
+  }
+  action withdraw { from: active, to: withdrawn, actor: { party: seller }, requires count of { instrument: all(marketplace.reservation), reference: "listing", anchor: self.id, states: [active], limit: 366 } == 0 }
+  action sell { from: active, to: sold, actor: { party: seller }, requires count of { instrument: all(marketplace.reservation), reference: "listing", anchor: self.id, states: [active], limit: 366 } == 0 }
+}
+
+instrument order(listing: ref<marketplace.listing>, buyer: party) {
+  revisioned: true
+  summary: "A buyer's order for one listing at its declared price."
+  fields { listing: ref<listing>, buyer: account of buyer, price: money, reservations: integer?, ownReservations: integer?, blockingQuotes: integer?, ownBlockingQuotes: integer? }
+  lifecycle { states: [quoted, placed, fulfilled, cancelled], initial: quoted }
+  action create {
+    actor: { party: buyer }
+    requires self.listing in [active]
+    calculate: [
+      { target: blockingQuotes, op: aggregate, selection: { instrument: all(marketplace.reservation), reference: "listing", anchor: self.listing, states: [active], limit: 366, where: { quotePolicy: { literal: "blocked" } } }, measure: count }
+      { target: ownBlockingQuotes, op: aggregate, selection: { instrument: all(marketplace.reservation), reference: "listing", anchor: self.listing, states: [active], limit: 366, where: { quotePolicy: { literal: "blocked" }, buyer: { field: self.buyer } } }, measure: count }
+    ]
+    requires self.blockingQuotes == self.ownBlockingQuotes
+    requires self.price == self.listing.price
+  }
+  action commit {
+    from: [quoted, placed], to: placed
+    requires self.listing in [active]
+    calculate: [
+      { target: reservations, op: aggregate, selection: { instrument: all(marketplace.reservation), reference: "listing", anchor: self.listing, states: [active], limit: 366 }, measure: count }
+      { target: ownReservations, op: aggregate, selection: { instrument: all(marketplace.reservation), reference: "listing", anchor: self.listing, states: [active], limit: 366, where: { buyer: { field: self.buyer } } }, measure: count }
+    ]
+    requires self.reservations == self.ownReservations
+    requires count of { instrument: current(), reference: "listing", anchor: self.listing, states: [placed, fulfilled], limit: 366 } <= 1
+  }
+  invariants count of { instrument: current(), reference: "listing", anchor: self.listing, states: [placed, fulfilled], limit: 366 } <= 1
+  action fulfill { from: placed, to: fulfilled }
+  action cancel { from: [quoted, placed], to: cancelled, actor: { party: buyer } }
+}
+
+instrument reservation(listing: ref<marketplace.listing>, funds: ref<escrow.hold>, converters: ref[], buyer: party, seller: party, expires_after: duration = 48h, deposit: money = 1000 SAR, cancellation_refund: percent = 100%, expiry_refund: percent = 100%, retained_to: party = programOperator, operator: party = programOperator, competing_quotes: enum(allowed, blocked) = allowed) {
+  revisioned: true
+  summary: "Exclusive timed listing hold with explicit deposit credit and refund."
+  fields {
+    listing: ref<listing>, funds: ref<funds>, buyer: account of buyer, seller: account of seller, price: money, terms: text
+    held: account of self, quotePolicy: enum(allowed, blocked) = competing_quotes, deposit: money = deposit, proposalExpiresAt: date = after(self.createdAt, expires_after), expiresAt: date?
+    credit: money?, refund: money?, retained: money?, dispositionAt: date?, reason: text?
+  }
+  lifecycle { states: [proposed, active, converted, cancelled, expired], initial: proposed }
+  invariants count of { instrument: current(), reference: "listing", anchor: self.listing, states: [active], limit: 366 } <= 1
+  action create { actor: { party: buyer }, requires self.listing in [active]; requires self.seller == self.listing.seller; requires self.price == self.listing.price }
+  action activate {
+    from: proposed, to: active, actor: { party: buyer }, deadline: { at: self.proposalExpiresAt }
+    calculate: [{ target: expiresAt, op: shift, date: { field: self.now }, milliseconds: { literal: expires_after }, direction: after }]
+    requires self.listing in [active]; requires self.price == self.listing.price
+    requires count of { instrument: all(marketplace.order), reference: "listing", anchor: self.listing, states: [placed, fulfilled], limit: 366 } == 0
+    moves self.deposit from self.buyer to self.held economics { purpose: principal, sourceParty: buyer }
+  }
+  action convert_cash {
+    from: active, to: active, actor: { party: buyer }, deadline: { at: self.expiresAt }
+    invoke: [{ reference: self.funds, action: fund, input: {} }]
+  }
+  action credit { allowZero: true,
+    from: active, to: converted, actor: { parent: converters }, deadline: { at: self.expiresAt }
+    input { funds: ref<funds>, contribution: money }
+    requires input.funds == self.funds; requires input.funds in [pending, funded]; requires input.funds.payer == self.buyer; requires input.funds.price == self.price
+    requires input.contribution <= self.price
+    calculate: [{ target: credit, op: minimum, values: [{ field: self.held.balance }, { field: input.contribution }] }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.credit }] }]
+    set: { dispositionAt: { field: self.now } }
+    moves self.credit from self.held to input.funds.held economics { purpose: principal, sourceParty: programOperator }
+    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action cancel { allowZero: true,
+    from: active, to: cancelled, actor: { party: buyer }, input { reason: text }
+    calculate: [{ target: refund, op: rate, base: { field: self.held.balance }, bps: { literal: cancellation_refund }, rounding: floor }, { target: retained, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.refund }] }]
+    set: { reason: { field: input.reason }, dispositionAt: { field: self.now } }
+    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+  }
+  action seller_cancel {
+    from: active, to: cancelled, actor: { party: seller }, input { reason: text }
+    set: { reason: { field: input.reason }, dispositionAt: { field: self.now } }
+    moves self.held.balance from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action operator_cancel {
+    from: active, to: cancelled, actor: { party: operator }, input { reason: text }
+    set: { reason: { field: input.reason }, dispositionAt: { field: self.now } }
+    moves self.held.balance from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action withdraw { from: proposed, to: cancelled, actor: { party: buyer } }
+  action expire { allowZero: true,
+    from: active, to: expired, actor: clock, due: { at: self.expiresAt }
+    calculate: [{ target: refund, op: rate, base: { field: self.held.balance }, bps: { literal: expiry_refund }, rounding: floor }, { target: retained, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.refund }] }]
+    set: { dispositionAt: { field: self.now } }
+    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+  }
+  action expire_proposal { from: proposed, to: expired, actor: clock, due: { at: self.proposalExpiresAt } }
+}

package/std/money.hsx

@@ -0,0 +1,173 @@
+header money
+
+// Economics: Held funding and returns are principal. Release to the company realizes
+// earnings; release to another participant is a payout. Generic transfers, splits,
+// schedules, swaps, boundary payouts and metered fees retain no assumed purpose.
+
+// Expose each attachment's create and caller actions explicitly. A transfer or
+// split pays once; a hold exposes fund, release and refund separately. Release
+// pays payee and refund returns payer. A hold has no dispute or damage decision.
+// A schedule needs count unique occurrence records before activation; each due
+// occurrence pays only while the schedule is active. A due time promises no retry.
+// A pool accepts whole contributions only up to its remaining target and at most
+// 366 paid records. Expose pay to release the exact target. Clock failure refunds
+// original contributors; excess acceptance and partial contribution are absent.
+// A swap reserves both legs before exchange or voids reservations on expiry.
+// Payout instruct reserves across the selected adapter; confirm/reject require
+// matching terminal instruction evidence. An acknowledgement cannot settle it.
+// Metered bill charges a unique usage identity at the fixed unit price.
+
+// Cost: transfer.pay declares one transfer. Hold.create declares one owned account;
+// fund, release and refund each declare one transfer. Schedules and pools add bounded
+// child invocations. Run hsx cost on the composed program for counts, not SAR prices.
+
+instrument transfer(payer: party, payee: party, amount: money = runtime) {
+  summary: "One transfer between the bound parties."
+  fields { amount: money = amount }
+  lifecycle { states: [pending, paid, cancelled], initial: pending }
+  action create { actor: { party: payer }, requires self.amount > "0" }
+  action pay {
+    from: pending, to: paid, actor: { party: payer }
+    moves self.amount from payer to payee
+  }
+  action cancel { from: pending, to: cancelled, actor: { party: payer } }
+}
+
+instrument hold(payer: party, payee: party, amount: money = runtime) {
+  summary: "Hold the declared amount until release or refund."
+  fields { payer: account of payer, payee: account of payee, amount: money = amount, price: money = self.amount, held: account of self }
+  lifecycle { states: [pending, funded, released, refunded, cancelled], initial: pending }
+  action create { }
+  action fund {
+    from: pending, to: funded, actor: { party: payer }
+    moves self.amount from payer to self.held economics { purpose: principal, sourceParty: payer }
+  }
+  action confirm {
+    from: pending, to: funded
+    requires self.held.balance == self.amount
+  }
+  action release {
+    from: funded, to: released, actor: { party: payer }
+    moves self.amount from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+  }
+  action refund {
+    from: funded, to: refunded, actor: { party: payee }
+    moves self.amount from self.held to payer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action cancel { from: pending, to: cancelled }
+}
+
+instrument split(payer: party, amount: money = runtime, shares: split = { programOperator: 100% }) {
+  summary: "Split one amount; the last declared recipient receives the rounding remainder."
+  fields { amount: money = amount }
+  lifecycle { states: [pending, paid, cancelled], initial: pending }
+  action create {}
+  action pay { allowZero: true, requires self.amount > "0"; from: pending, to: paid, actor: { party: payer }, moves self.amount from payer shares shares }
+  action cancel { from: pending, to: cancelled }
+}
+
+instrument schedule(payer: party, payee: party, amount: money = runtime, count: integer(1, 366) = 12) {
+  summary: "A finite schedule whose dated pieces sum exactly to the declared total."
+  fields { amount: money = amount, count: integer = count, dates: list(date, count) }
+  lifecycle { states: [draft, active, complete, cancelled], initial: draft }
+  action create {}
+  action activate {
+    from: draft, to: active
+    requires count of { instrument: occurrence, reference: "schedule", anchor: self.id, states: [pending], limit: 366 } == self.count
+  }
+  action complete {
+    from: active, to: complete
+    requires count of { instrument: occurrence, reference: "schedule", anchor: self.id, states: [pending], limit: 366 } == 0
+  }
+  action cancel { from: [draft, active], to: cancelled }
+  records {
+    occurrence: {
+      fields {
+        schedule: ref<parent>, position: integer(1, count), dueAt: date = at(self.schedule.dates, self.position)
+        base: money = divide(self.schedule.amount, count)
+        allocated: money = multiply(self.base, count)
+        remainder: money = subtract(self.schedule.amount, self.allocated)
+        first: integer = divide(1, self.position)
+        adjustment: money = multiply(self.remainder, self.first)
+        amount: money = sum(self.base, self.adjustment)
+      }
+      lifecycle { states: [pending, paid, cancelled], initial: pending }
+      action create { requires self.schedule in [draft]; requires unique "scheduled_position" on [self.schedule, self.position] }
+      action pay { allowZero: true, from: pending, to: paid, actor: clock, due: { at: self.dueAt }, requires self.schedule in [active], moves self.amount from payer to payee }
+      action cancel { from: pending, to: cancelled, requires self.schedule in [cancelled] }
+    }
+  }
+}
+
+instrument pool(payer: party, payee: party, target: money, closes: date) {
+  summary: "Contributions fund one threshold or return to their original contributor."
+  fields { target: money = target, closesAt: date = closes, held: account of self }
+  lifecycle { states: [open, paid, failed], initial: open }
+  action create { }
+  action pay {
+    from: open, to: paid, actor: { party: payee }
+    requires self.held.balance == self.target
+    moves self.target from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+  }
+  action fail {
+    from: open, to: failed, actor: clock, due: { at: self.closesAt }
+    requires self.held.balance < self.target
+    invoke: [{ selection: { instrument: contribution, reference: "pool", anchor: self.id, states: [paid], limit: 366 }, action: refund, input: {} }]
+  }
+  records {
+    contribution: {
+      fields { pool: ref<parent>, payer: account of payer, amount: money, remaining: money? }
+      lifecycle { states: [pending, paid, refunded], initial: pending }
+      invariants count of { instrument: current(), reference: "pool", anchor: self.pool, states: [paid], limit: 366 } <= 366
+      action create { requires self.pool in [open] }
+      action pay { from: pending, to: paid, actor: { party: payer }, deadline: { at: self.pool.closesAt }, requires self.pool in [open], calculate: [{ target: remaining, op: subtract, base: { field: self.pool.target }, subtract: [{ field: self.pool.held.balance }] }], requires self.amount <= self.remaining, moves self.amount from self.payer to self.pool.held economics { purpose: principal, sourceParty: payer } }
+      action refund { from: paid, to: refunded, actor: { parent: parent }, moves self.amount from self.pool.held to self.payer economics { purpose: principal, sourceParty: programOperator } }
+    }
+  }
+}
+
+instrument swap(first: party, second: party, first_amount: money, second_amount: money, expires: date) {
+  summary: "Two reservations settle together or both return."
+  fields { firstAmount: money = first_amount, secondAmount: money = second_amount, expiresAt: date = expires, firstReceipt: text?, secondReceipt: text? }
+  lifecycle { states: [pending, first_ready, second_ready, both_ready, exchanged, cancelled], initial: pending }
+  action create {}
+  action fund_first { from: pending, to: first_ready, actor: { party: first }, deadline: { at: self.expiresAt }, moves reserve self.firstAmount from first to second capture "firstReceipt" }
+  action fund_second { from: first_ready, to: both_ready, actor: { party: second }, deadline: { at: self.expiresAt }, moves reserve self.secondAmount from second to first capture "secondReceipt" }
+  action start_second { from: pending, to: second_ready, actor: { party: second }, deadline: { at: self.expiresAt }, moves reserve self.secondAmount from second to first capture "secondReceipt" }
+  action finish_first { from: second_ready, to: both_ready, actor: { party: first }, deadline: { at: self.expiresAt }, moves reserve self.firstAmount from first to second capture "firstReceipt" }
+  action expire_second { from: second_ready, to: cancelled, actor: clock, due: { at: self.expiresAt }, moves void self.secondReceipt }
+  action exchange { from: both_ready, to: exchanged, actor: { party: first }, moves post self.firstReceipt; moves post self.secondReceipt }
+  action cancel { from: pending, to: cancelled }
+  action expire_first { from: first_ready, to: cancelled, actor: clock, due: { at: self.expiresAt }, moves void self.firstReceipt }
+  action expire_both { from: both_ready, to: cancelled, actor: clock, due: { at: self.expiresAt }, moves void self.firstReceipt; moves void self.secondReceipt }
+}
+
+instrument payout(payer: party, payee: party, adapter: text, max_age: duration, amount: money = runtime) {
+  summary: "Reserve funds until matching terminal boundary evidence permits posting."
+  fields { amount: money = amount, receipt: text? }
+  lifecycle { states: [pending, instructed, settled, rejected], initial: pending }
+  action create {}
+  action instruct {
+    from: pending, to: instructed, actor: { party: payer }
+    moves reserve self.amount from payer to payee capture "receipt" boundary adapter
+  }
+  action confirm {
+    from: instructed, to: settled
+    requires evidence self.id family boundary check outcome result confirmed maxAge max_age instruction self.receipt
+    moves post self.receipt
+  }
+  action reject {
+    from: instructed, to: rejected
+    requires evidence self.id family boundary check outcome result rejected maxAge max_age instruction self.receipt
+    moves void self.receipt
+  }
+}
+
+instrument metered(payer: party, payee: party, unit_price: money, units: integer = 1, fee: fee = { seller: 0% }) {
+  summary: "A unique usage event priced once at the fixed unit price."
+  fields { usageIdentity: text, unitPrice: money = unit_price, units: integer = units, amount: money = multiply(self.unitPrice, self.units) }
+  lifecycle { states: [recorded, billed, cancelled], initial: recorded }
+  action create { requires unique "usage_event" on [self.usageIdentity] }
+  action bill { allowZero: true, requires self.amount > "0"; from: recorded, to: billed, actor: { party: payee }, moves self.amount from payer to payee fee fee }
+  action cancel { from: recorded, to: cancelled }
+}