@hyperscale0/hsx 1.0.125 → 1.0.128

package/std/booking.hsx

@@ -0,0 +1,75 @@
+header booking
+
+// Economics: Deposit and balance payments and every refund are principal. Completion
+// and any forfeit are earnings for the company, or pass the customer's cash through
+// to a bound outside operator.
+
+// Expose create, pay_deposit and pay_balance for the booking path, and
+// cancel_early, cancel_middle and cancel_late for the customer. Create captures
+// subject departure, price, deposit and balance, and refuses a deposit and balance
+// that do not add up to the price. The balance is payable only after the deposit
+// and before balance_due ahead of departure, so a cancelled booking never offers
+// it. cancel_early runs until early_until before departure and returns everything
+// held. cancel_middle runs from then until late_from; cancel_late runs from then
+// until departure, even when the clock's complete runs late. They keep
+// middle_forfeit or late_forfeit of the held money and return the rest. Both
+// forfeits default to 0%, so nothing is kept unless the author sets them. At
+// departure the clock completes a paid booking and pays operator, and lapses an
+// unpaid one on cancel_late's terms, so nothing stays held after departure.
+
+// Cost: create declares one owned account. Each payment declares one transfer;
+// cancellation and completion move the held balance. Run hsx cost for the
+// composed counts.
+
+instrument reservation(customer: party = party(person), operator: party = programOperator, early_until: duration = 30d, late_from: duration = 15d, balance_due: duration = 14d, middle_forfeit: percent = 0%, late_forfeit: percent = 0%) {
+  revisioned: true
+  summary: "Take a deposit and a balance for a dated booking, with cancellation windows before departure."
+  fields {
+    customer: account of customer, operator: account of operator, held: account of self
+    departure: date, price: money = subject.price
+    deposit: money = subject.deposit, balance: money = subject.balance
+    split: money = sum(self.deposit, self.balance)
+    balanceAt: date = before(self.departure, balance_due)
+    earlyAt: date = before(self.departure, early_until)
+    lateAt: date = before(self.departure, late_from)
+    refund: money?, forfeit: money?
+  }
+  lifecycle { states: [reserved, deposit_paid, paid, completed, cancelled], initial: reserved }
+  action create {
+    subject { departure: date, price: money, deposit: money, balance: money }
+    actor: { party: customer }
+    requires self.departure > self.now
+    requires self.split == self.price
+  }
+  action pay_deposit {
+    from: reserved, to: deposit_paid, actor: { party: customer }
+    moves self.deposit from customer to self.held economics { purpose: principal, sourceParty: customer }
+  }
+  action pay_balance {
+    from: deposit_paid, to: paid, actor: { party: customer }, deadline: { at: self.balanceAt }
+    moves self.balance from customer to self.held economics { purpose: principal, sourceParty: customer }
+  }
+  action complete {
+    from: paid, to: completed, actor: clock, due: { at: self.departure }
+    moves self.held.balance from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action cancel_early { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, deadline: { at: self.earlyAt }
+    moves self.held.balance from self.held to customer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action cancel_middle { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, due: { at: self.earlyAt }, deadline: { at: self.lateAt }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: middle_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action cancel_late { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, due: { at: self.lateAt }, deadline: { at: self.departure }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: late_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action lapse { allowZero: true,
+    from: [reserved, deposit_paid], to: cancelled, actor: clock, due: { at: self.departure }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: late_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+}

package/std/escrow.hsx

@@ -1,13 +1,21 @@
 header escrow
 
 // Economics: Funding and unspent returns are principal. Acceptance realizes earnings for
-// the company or a payout to a bound outside seller; tax is pass-through.
+// the company; the payer's cash passes through to a bound outside seller, less the
+// fee the company earns. Tax is pass-through.
 
 // Expose create, fund, deliver and accept for the purchase path. Create captures
 // subject.price; acceptance pays payee less the configured fee, not payer.
 // Expose dispute, verify_return and refund separately for the return path.
-// Payer disputes delivered goods; payee verifies return evidence from disputed;
-// payee refunds the entire held price from return_verified by default.
+// Payer disputes delivered goods; payee verifies return evidence from disputed.
+// Payee refunds the whole held balance before delivery, or from return_verified
+// by default after a dispute. While a signed, active or paid financing plan funds
+// the hold, both refunds refuse: the plan's unwind returns the lender's principal
+// first, then refund returns the rest. Unwind needs return_verified, so a
+// financed hold cannot be refunded before delivery.
+// Expose refund_undelivered to let the payer take the whole held price back once
+// deliver_within has passed since funding without delivery. It is a payer action
+// that becomes available at that time; nothing runs it automatically.
 // Acceptance expiry enters disputed, never released. Neither verify_return nor
 // refund becomes public merely because dispute is exposed. Clock actions remain
 // internal. Expose cancel for a pending hold, including a checkout-funded hold;
@@ -18,12 +26,12 @@ header escrow
 // transfer; accept expands the configured fee and tax into moves. Run hsx cost
 // on the composed program for instruction counts. The executor supplies prices.
 
-instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }) {
+instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, deliver_within: duration = 14d, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }) {
   revisioned: true
   summary: "Hold the subject price through delivery, acceptance and verified return."
   fields {
     payer: account of payer, payee: account of payee
-    held: account of self, deliveredAt: date?
+    held: account of self, fundedAt: date?, deliveredAt: date?
     price: money = subject.price
   }
   lifecycle { states: [pending, funded, delivered, disputed, return_verified, released, refunded, cancelled], initial: pending }
@@ -34,11 +42,13 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
   action fund {
     from: pending, to: funded, actor: { party: payer }
     subject { price: money }
+    set: { fundedAt: { field: self.now } }
     moves self.price from payer to self.held economics { purpose: principal, sourceParty: payer }
   }
   action confirm {
     from: pending, to: funded
     requires self.held.balance == self.price
+    set: { fundedAt: { field: self.now } }
   }
   action deliver {
     from: funded, to: delivered, actor: { party: payee }
@@ -48,7 +58,7 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
     from: delivered, to: released, actor: { party: payer }
     input { acceptanceReference: text }
     deadline: { at: self.deliveredAt, offset: accept_within }
-    moves self.price from self.held to payee fee fee economics { payee: { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }, fee: { purpose: earning, sourceParty: payer }, tax: { purpose: pass_through, sourceParty: programOperator } }
+    moves self.price from self.held to payee fee fee economics { payee: { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: pass_through, sourceParty: programOperator } }, fee: { purpose: earning, sourceParty: payer }, tax: { purpose: pass_through, sourceParty: programOperator } }
   }
   action expire_acceptance {
     from: delivered, to: disputed, actor: clock
@@ -63,7 +73,14 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
     input { returnEvidence: text }
   }
   action refund {
-    from: dispute.refund_after, to: refunded, actor: { party: payee }
+    from: [funded, dispute.refund_after], to: refunded, actor: { party: payee }
+    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [signed, active, paid], limit: 1 } == 0
+    moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action refund_undelivered {
+    from: funded, to: refunded, actor: { party: payer }
+    due: { at: self.fundedAt, offset: deliver_within }
+    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [signed, active, paid], limit: 1 } == 0
     moves self.price from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
   action cancel { allowZero: true,

package/std/financing.hsx

@@ -2,9 +2,14 @@ header financing
 
 // Economics: Principal advances and repayments are excluded from earnings. Claims, waivers,
 // write-offs and allocations are internal. Paid profit and company charges are
-// earnings; receipt refunds reverse captured cash. Outside recovery recipients
-// receive payouts from held company cash, or pass-through direct customer cash.
+// earnings; receipt refunds reverse captured cash. Borrower cash paid to outside
+// capital or recovery recipients passes through, whether held first or paid direct.
 
+// Pricing is required. amortizing reads profit_rate as an annual rate on the
+// declining balance: equal monthly instalments, the last absorbing rounding.
+// flat_total reads it as one charge on principal for the whole term (murabaha,
+// fixed-fee pay-later). 12,000 at 18% over 12 months costs 13,201.95 amortizing
+// and 14,160 flat_total.
 // Expose create and sign on installments, then collect_down_payment as checkout
 // for disburse_to: funds. Checkout requires a signed plan and pending escrow;
 // it tops up only the missing down payment, without advancing lender principal.
@@ -12,13 +17,22 @@ header financing
 // the fully funded hold. Existing escrow credit counts once toward the down payment.
 // Disburse first credits an active marketplace.reservation on the same hold,
 // so list the plan in its converters; the deposit then counts as escrow credit.
-// Borrower-directed disbursement excludes collect_down_payment. A down_payment
+// disburse_to: seller pays principal to the seller party at activation (pay later
+// with the merchant paid on day one). For a return, capital refunds each paid
+// payment to the borrower, then runs unwind: it takes principal back to capital and
+// cancels open slices with their claims. Seller mode debits the seller; funds mode
+// needs the hold in return_verified and debits the hold, after which the payee's
+// escrow refund returns only the down payment. Escrow refund refuses while a live
+// plan funds the hold. Unwind needs no assessed or collected late charges; waive
+// them first.
+// Borrower- and seller-directed disbursement exclude collect_down_payment. A down_payment
 // there reduces principal but does not collect cash. Price is subject metadata,
 // not the borrower limit. The escrow payer and price must match the plan.
 // Expose escrow cancel to return checkout cash if financing is abandoned; plan
 // void alone cancels the agreement and does not refund its separate escrow.
 // Approve borrower and portfolio limits before disbursement. Create builds the
-// dated slice records; payments need a separate payment record and pay action.
+// dated slice records from future, strictly increasing dates; disbursement
+// refuses once a slice is due. Payments need a separate payment record and pay action.
 // Expose parent payoff separately and create a current, unexpired payoff_quote.
 // Expose late_charge.create as propose_assessment before the clock can assess;
 // provide matching plan, slice and borrower. Fine is fixed money, not a percentage.
@@ -33,12 +47,17 @@ header financing
 // bounded invocations across slices and assessments. Month and charge limits affect
 // the bound. Run hsx cost on the selected policies; profit is not a platform tariff.
 
-instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3, profit: percent, disburse_to: enum(funds, borrower) = funds, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
+instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
   dependencies {
     funds {
       selector: disburse_to, is: funds
       message: "Attachment `{attachment}` disburses into a hold, but `funds` is not bound."
-      fix: "Bind `funds: sale` to an escrow attachment. Choose `disburse_to: borrower` only if the borrower should receive the money directly."
+      fix: "Bind `funds: sale` to an escrow attachment. Choose `disburse_to: seller` to pay a seller on activation, or `disburse_to: borrower` only if the borrower should receive the money directly."
+    }
+    seller {
+      selector: disburse_to, is: seller
+      message: "Attachment `{attachment}` pays a seller, but `seller` is not bound."
+      fix: "Bind `seller: merchant` to the declared business that receives the principal."
     }
   }
   revisioned: true
@@ -52,8 +71,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
     price: money = subject.price
     downPayment: money = rate(self.price, down_payment)
     principal: money = subtract(self.price, self.downPayment)
-    profit: money = rate(self.principal, profit)
-    total: money = sum(self.principal, self.profit)
+    flatProfit: money?
   }
   lifecycle { states: [quoted, signed, active, paid, written_off, cancelled], initial: quoted }
   invariants count of { instrument: all(financing.installments), reference: "borrowerLimit", anchor: self.borrowerLimit, states: [active], limit: 366 } <= self.borrowerLimit.activePlans
@@ -62,8 +80,9 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   action create {
     subject { price: money }
     requires self.borrowerLimit.borrower == self.borrower
+    when pricing is flat_total { calculate: [{ target: flatProfit, op: rate, base: { field: self.principal }, bps: { literal: profit_rate }, rounding: floor }] }
     when disburse_to is funds { requires self.borrower == self.funds.payer; requires self.price == self.funds.price }
-    invoke: [{ range: { count: { literal: months }, maximum: months, bind: position }, instrument: slice, action: create, input: { plan: { field: self.id }, borrowerLimit: { field: self.borrowerLimit }, portfolioLimit: { field: self.portfolioLimit }, position: { field: position } } }]
+    invoke: [{ range: { count: { literal: months }, maximum: months, bind: position }, instrument: slice, action: create, input: { plan: { field: self.id }, borrowerLimit: { field: self.borrowerLimit }, portfolioLimit: { field: self.portfolioLimit }, position: { field: position } } }, { selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: months, where: { first: { literal: 0 } } }, action: check_order, input: {} }]
   }
   action sign {
     from: quoted, to: signed, actor: { party: borrower }, input { signedOffer: text, affordabilityReference: text }
@@ -72,6 +91,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   action collect_down_payment { allowZero: true,
     from: signed, to: signed, actor: { party: borrower }
     when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
     when disburse_to is funds {
       requires self.funds in [pending]
       calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: self.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: self.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
@@ -87,6 +107,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       invoke: [{ selection: { instrument: all(marketplace.reservation), reference: "funds", anchor: self.funds, states: [active], limit: 1 }, action: credit, input: { funds: { field: self.funds }, contribution: { field: self.downPayment } } }, { reference: self.id, action: fund_down_payment, input: {} }]
     }
     when disburse_to is borrower { moves self.principal from self.capital to self.borrower economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is seller { moves self.principal from self.capital to seller economics { purpose: principal, sourceParty: capital } }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: 366, order: [position] }, action: activate, input: {} }]
     when disburse_to is funds { invoke: [{ reference: self.funds, action: confirm, input: {} }] }
   }
@@ -136,6 +157,17 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   }
   action cancel { from: quoted, to: cancelled }
   action void { from: signed, to: cancelled, actor: { party: borrower } }
+  action unwind { allowZero: true,
+    from: active, to: cancelled, actor: { party: capital }
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is funds { requires self.funds in [return_verified] }
+    requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
+    when disburse_to is funds { moves self.principal from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is seller { moves self.principal from seller to self.capital economics { purpose: principal, sourceParty: seller } }
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
+  }
   records {
     write_off_request: {
       fields { plan: ref<parent>, overdueSlice: ref<slice> }
@@ -251,31 +283,48 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       revisioned: true
       fields {
         plan: ref<parent>, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>, position: integer(1, months)
-        originalDueAt: date = at(self.plan.dates, self.position), dueAt: date?, nextDueAt: date?, previousDueAt: date?, previousPosition: integer?, previousDate: date?, extensionLimit: date = after(self.originalDueAt, max_extension), lossEligibleAt: date?
-        principalBase: money = divide(self.plan.principal, months)
-        principalAllocated: money = multiply(self.principalBase, months)
-        principalRemainder: money = subtract(self.plan.principal, self.principalAllocated)
-        profitBase: money = divide(self.plan.profit, months)
-        profitAllocated: money = multiply(self.profitBase, months)
-        profitRemainder: money = subtract(self.plan.profit, self.profitAllocated)
+        originalDueAt: date = at(self.plan.dates, self.position), dueAt: date?, nextDueAt: date?, previousDueAt: date?, prior: integer = subtract(self.position, 1), previousPosition: integer = sum(self.prior, self.first), previousDate: date = at(self.plan.dates, self.previousPosition), extensionLimit: date = after(self.originalDueAt, max_extension), lossEligibleAt: date?
         first: integer = divide(1, self.position)
-        principalAdjustment: money = multiply(self.principalRemainder, self.first)
-        profitAdjustment: money = multiply(self.profitRemainder, self.first)
-        principal: money = sum(self.principalBase, self.principalAdjustment)
-        profit: money = sum(self.profitBase, self.profitAdjustment)
+        principalBase: money?, principalAllocated: money?, principalRemainder: money?, principalAdjustment: money?
+        profitBase: money?, profitAllocated: money?, profitRemainder: money?, profitAdjustment: money?
+        principal: money, profit: money, instalment: money
         principalReceivable: account(self, claim), profitReceivable: account(self, claim), profitEarned: account(self, claim)
         payoffIdentity: text?, payoffRebate: money?, payoffProfitTotal: money?, payoffProfit: money?
-        paymentBudget: money?, principalPayment: money?, principalBasePayment: money?, principalRatio: money?, profitPayment: money?, profitBudget: money?, collectibleProfit: money?, collectibleTotal: money?, ratioDenominator: integer = sum(10000, profit)
+        paymentBudget: money?, principalPayment: money?, principalBasePayment: money?, principalRatio: money?, profitPayment: money?, profitBudget: money?, collectibleProfit: money?, collectibleTotal: money?, ratioDenominator: integer = sum(10000, profit_rate)
         debt: account(borrower, claim, contra, "debt"), loss: account(capital, claim, "loss")
       }
-      lifecycle { states: [draft, pending, due, paid, written_off], initial: draft }
+      lifecycle { states: [draft, pending, due, paid, written_off, cancelled], initial: draft }
       action create {
         actor: { parent: parent }
         input { plan: ref<parent>, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>, position: integer(1, months) }
         set: { dueAt: { field: self.originalDueAt } }
+        when pricing is flat_total {
+          calculate: [
+            { target: principalBase, op: divide, amount: { field: self.plan.principal }, divisor: { literal: months }, rounding: floor }
+            { target: principalAllocated, op: multiply, amount: { field: self.principalBase }, units: { literal: months } }
+            { target: principalRemainder, op: subtract, base: { field: self.plan.principal }, subtract: [{ field: self.principalAllocated }] }
+            { target: principalAdjustment, op: multiply, amount: { field: self.principalRemainder }, units: { field: self.first } }
+            { target: principal, op: sum, values: [{ field: self.principalBase }, { field: self.principalAdjustment }] }
+            { target: profitBase, op: divide, amount: { field: self.plan.flatProfit }, divisor: { literal: months }, rounding: floor }
+            { target: profitAllocated, op: multiply, amount: { field: self.profitBase }, units: { literal: months } }
+            { target: profitRemainder, op: subtract, base: { field: self.plan.flatProfit }, subtract: [{ field: self.profitAllocated }] }
+            { target: profitAdjustment, op: multiply, amount: { field: self.profitRemainder }, units: { field: self.first } }
+            { target: profit, op: sum, values: [{ field: self.profitBase }, { field: self.profitAdjustment }] }
+            { target: instalment, op: sum, values: [{ field: self.principal }, { field: self.profit }] }
+          ]
+        }
+        when pricing is amortizing {
+          calculate: [
+            { target: principal, op: annuity, amount: { field: self.plan.principal }, rate: { literal: profit_rate }, periods: { literal: months }, position: { field: self.position }, part: principal }
+            { target: profit, op: annuity, amount: { field: self.plan.principal }, rate: { literal: profit_rate }, periods: { literal: months }, position: { field: self.position }, part: interest }
+            { target: instalment, op: sum, values: [{ field: self.principal }, { field: self.profit }] }
+          ]
+        }
         invoke: [{ reference: self.id, action: refresh_loss_date, input: {} }]
         requires self.plan in [quoted]; requires unique "signed_position" on [self.plan, self.position]; requires self.borrowerLimit == self.plan.borrowerLimit; requires self.portfolioLimit == self.plan.portfolioLimit
+        requires self.originalDueAt > self.now; requires self.originalDueAt >= self.previousDate
       }
+      action check_order { from: draft, to: draft, actor: { parent: parent }, requires self.originalDueAt > self.previousDate }
       action quote_pending {
         from: pending, to: pending, actor: { parent: payoff_quote }, input { quote: ref<payoff_quote> }
         requires input.quote.plan == self.plan
@@ -310,6 +359,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       }
       action activate { allowZero: true,
         from: draft, to: pending, actor: { parent: parent }
+        requires self.dueAt > self.now
         moves self.principal from self.debt to self.principalReceivable economics { purpose: internal, sourceParty: borrower }
         moves self.profit from self.debt to self.profitReceivable economics { purpose: internal, sourceParty: borrower }
         when profit_earned is at_disbursement { moves self.profit from self.profitReceivable to self.profitEarned economics { purpose: internal, sourceParty: programOperator } }
@@ -356,7 +406,10 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         calculate: [
           { target: collectibleTotal, op: sum, values: [{ field: self.principalReceivable.balance }, { field: self.collectibleProfit }] }
           { target: paymentBudget, op: minimum, values: [{ field: input.payment.held.balance }, { field: self.collectibleTotal }] }
-          { target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { literal: 10000 }, denominator: { field: self.ratioDenominator }, rounding: floor }
+        ]
+        when pricing is flat_total { calculate: [{ target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { literal: 10000 }, denominator: { field: self.ratioDenominator }, rounding: floor }] }
+        when pricing is amortizing { calculate: [{ target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { field: self.principal }, denominator: { field: self.instalment }, rounding: floor }] }
+        calculate: [
           { target: principalBasePayment, op: minimum, values: [{ field: self.principalRatio }, { field: self.principalReceivable.balance }] }
           { target: profitBudget, op: subtract, base: { field: self.paymentBudget }, subtract: [{ field: self.principalBasePayment }] }
           { target: profitPayment, op: minimum, values: [{ field: self.profitBudget }, { field: self.collectibleProfit }] }
@@ -387,6 +440,10 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         from: [pending, due], to: written_off, actor: { parent: parent }
         moves self.principalReceivable.balance from self.principalReceivable to self.loss economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.loss economics { purpose: internal, sourceParty: programOperator }
       }
+      action cancel { allowZero: true,
+        from: [pending, due], to: cancelled, actor: { parent: parent }
+        moves self.principalReceivable.balance from self.principalReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.debt economics { purpose: internal, sourceParty: programOperator }
+      }
     }
     recognition: {
       fields { slice: ref<slice>, dueAt: date = after(self.slice.dueAt, 0) }
@@ -467,7 +524,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         actor: { parent: slice }
         input { slice: ref<slice>, payment: ref<payment>, limit: money }
         requires unique "profit_receipt" on [self.slice, self.payment]
-        moves self.amount from self.payment.held to self.slice.plan.profitIncome capture "cashReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+        moves self.amount from self.payment.held to self.slice.plan.profitIncome capture "cashReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }
         when profit_earned is on_payment { moves self.amount from self.slice.profitReceivable to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
         when profit_earned is by_schedule { moves self.amount from self.slice.profitEarned to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
         when profit_earned is at_disbursement { moves self.amount from self.slice.profitEarned to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
@@ -555,7 +612,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
     receipt: {
       fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
       lifecycle { states: [paid, refunded], initial: paid }
-      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
       action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from fines_to to self.payment.plan.borrower economics { recipient: fines_to, company: { purpose: earning, sourceParty: fines_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
     }
 
@@ -622,7 +679,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
         receipt: {
           fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
           lifecycle { states: [paid, refunded], initial: paid }
-          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
           action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from costs_to to self.payment.plan.borrower economics { recipient: costs_to, company: { purpose: earning, sourceParty: costs_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
         }
       }

package/std/insurance.hsx

@@ -4,7 +4,11 @@ header insurance
 // Outside broker commissions are pass-through. Adapter-owned premium and claim
 // accounts lack an authored source party, so their moves remain unclassified.
 
-// Expose cover.create, activate and cancel separately. Activation binds adapter;
+// Expose cover.create, activate and cancel separately. The adapter names a
+// registered boundary adapter (conformance_boundary in sandbox). covers is an
+// optional link to a sibling attachment; the attached object is already the
+// insured thing. claim_limit is the sum insured: approved and paid claims on one
+// cover never total more. Activation binds adapter;
 // each slice needs a separately created unique period and an active cover to collect.
 // Collection debits holder for insurerPremium to the insurer and commission to
 // broker as two moves. Broker defaults to programOperator; bind a declared business
@@ -23,9 +27,9 @@ header insurance
 // reserves once; pay posts once and expiry voids once. Cover cancellation adds
 // bounded slice invocations. Run hsx cost for composed counts, not provider prices.
 
-instrument cover(holder: party, adapter: text, commission: percent = 0%, broker: party = programOperator, covers: ref, premium: money = runtime) {
+instrument cover(holder: party, adapter: text, commission: percent = 0%, broker: party = programOperator, covers: ref?, premium: money = runtime, claim_limit: money = runtime) {
   summary: "Recurring cover bound to an outside insurer across an ADL boundary."
-  fields { covers: ref<covers>, holder: account of holder, insurer: account(adapter(adapter), cash, "premium"), expiresAt: date }
+  fields { covers: ref<covers>?, holder: account of holder, insurer: account(adapter(adapter), cash, "premium"), expiresAt: date, claimLimit: money = claim_limit }
   lifecycle { states: [pending, active, cancelled, expired], initial: pending }
   action create {}
   action activate {
@@ -41,13 +45,12 @@ instrument cover(holder: party, adapter: text, commission: percent = 0%, broker:
     slice: {
       summary: "A whole premium period, collected once and refundable only before it starts."
       fields {
-        cover: ref<parent>, covers: ref<covers>, premium: money = premium, startsAt: date, endsAt: date
+        cover: ref<parent>, premium: money = premium, startsAt: date, endsAt: date
         commission: money = rate(self.premium, commission)
         insurerPremium: money = subtract(self.premium, self.commission), commissionReceipt: text?
       }
       lifecycle { states: [pending, paid, active, expired, refunded], initial: pending }
       action create {
-        requires self.covers == self.cover.covers
         requires self.startsAt < self.endsAt
         requires unique "premium_period" on [self.cover, self.startsAt, self.endsAt]
       }
@@ -76,6 +79,7 @@ instrument claim(cover: ref<insurance.cover>, inspector: party) {
   summary: "A claim decision reserves one claim payment before settlement."
   fields { cover: ref<cover>, amount: money, expiresAt: date, evidence: text, reservation: text? }
   lifecycle { states: [submitted, approved, paid, denied, expired], initial: submitted }
+  invariants sum "amount" of { instrument: current(), reference: "cover", anchor: self.cover, states: [approved, paid], limit: 366 } <= self.cover.claimLimit
   action create { requires self.cover in [active] }
   action approve {
     from: submitted, to: approved

package/std/marketplace.hsx

@@ -1,7 +1,7 @@
 header marketplace
 
 // Economics: Deposit funding, escrow credit and returns are principal. Retention is
-// earning for the company or a payout to a bound outside recipient.
+// earning for the company or passes the buyer's cash through to a bound outside recipient.
 
 // Listing, order and reservation are separate agreements. Expose their create
 // and decision actions individually. Order fulfillment does not move escrow cash.
@@ -100,7 +100,7 @@ instrument reservation(listing: ref<marketplace.listing>, funds: ref<escrow.hold
     from: active, to: cancelled, actor: { party: buyer }, input { reason: text }
     calculate: [{ target: refund, op: rate, base: { field: self.held.balance }, bps: { literal: cancellation_refund }, rounding: floor }, { target: retained, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.refund }] }]
     set: { reason: { field: input.reason }, dispositionAt: { field: self.now } }
-    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: pass_through, sourceParty: programOperator } }
   }
   action seller_cancel {
     from: active, to: cancelled, actor: { party: seller }, input { reason: text }
@@ -117,7 +117,7 @@ instrument reservation(listing: ref<marketplace.listing>, funds: ref<escrow.hold
     from: active, to: expired, actor: clock, due: { at: self.expiresAt }
     calculate: [{ target: refund, op: rate, base: { field: self.held.balance }, bps: { literal: expiry_refund }, rounding: floor }, { target: retained, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.refund }] }]
     set: { dispositionAt: { field: self.now } }
-    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+    moves self.refund from self.held to self.buyer economics { purpose: principal, sourceParty: programOperator }; moves self.retained from self.held to retained_to economics { recipient: retained_to, company: { purpose: earning, sourceParty: buyer }, participant: { purpose: pass_through, sourceParty: programOperator } }
   }
   action expire_proposal { from: proposed, to: expired, actor: clock, due: { at: self.proposalExpiresAt } }
 }

package/std/money.hsx

@@ -1,7 +1,7 @@
 header money
 
 // Economics: Held funding and returns are principal. Release to the company realizes
-// earnings; release to another participant is a payout. Generic transfers, splits,
+// earnings; release to another participant passes the payer's cash through. Generic transfers, splits,
 // schedules, swaps, boundary payouts and metered fees retain no assumed purpose.
 
 // Expose each attachment's create and caller actions explicitly. A transfer or
@@ -48,7 +48,7 @@ instrument hold(payer: party, payee: party, amount: money = runtime) {
   }
   action release {
     from: funded, to: released, actor: { party: payer }
-    moves self.amount from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+    moves self.amount from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: pass_through, sourceParty: programOperator } }
   }
   action refund {
     from: funded, to: refunded, actor: { party: payee }
@@ -107,7 +107,7 @@ instrument pool(payer: party, payee: party, target: money, closes: date) {
   action pay {
     from: open, to: paid, actor: { party: payee }
     requires self.held.balance == self.target
-    moves self.target from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+    moves self.target from self.held to payee economics { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: pass_through, sourceParty: programOperator } }
   }
   action fail {
     from: open, to: failed, actor: clock, due: { at: self.closesAt }

package/std/wallet.hsx

@@ -1,6 +1,7 @@
 header wallet
 
-// Economics: Topups and withdrawals are excluded prepaid credit. Spending remains
+// Economics: Topups and withdrawals are excluded prepaid credit; a top-up fee is
+// Company earning. Spending remains
 // unclassified because the bound payee alone does not state the purchase purpose.
 
 // Expose balance.create, activate, topup and withdraw as needed. Holder moves
@@ -12,20 +13,30 @@ header wallet
 // Existing reservations may still post after the wallet freezes. There is no
 // daily aggregate limit, partial spend or card-network settlement in this header.
 
-// Cost: balance.create declares one owned account; topup and withdraw each
-// declare one transfer. Spend reserve, pay and cancel each declare one transfer
+// Top-up fee: topup_fee takes a floored percentage of each top-up for the Company;
+// the wallet receives the rest. At 1%, a 100.00 top-up credits 99.00 and earns 1.00.
+// The default 0% moves nothing to the Company.
+
+// Cost: balance.create declares one owned account; topup declares two transfers
+// and withdraw one. Spend reserve, pay and cancel each declare one transfer
 // instruction. These are counts, not the executor tariff.
 
-instrument balance(holder: party, spend_limit: money = 100000 SAR) {
+instrument balance(holder: party, spend_limit: money = 100000 SAR, topup_fee: percent = 0%) {
   summary: "A holder's reusable balance with an immutable per-spend ceiling."
-  fields { holder: account of holder, held: account of self, spendLimit: money = spend_limit }
+  fields { holder: account of holder, held: account of self, spendLimit: money = spend_limit, topupFee: money?, topupCredit: money? }
   lifecycle { states: [pending, active, frozen, closed], initial: pending }
   action create { }
   action activate { from: pending, to: active, actor: { party: holder } }
   action topup {
+    allowZero: true, requires input.amount > "0"
     from: active, to: active, actor: { party: holder }
     input { amount: money }
-    moves input.amount from holder to self.held economics { purpose: prepaid_credit, sourceParty: holder }
+    calculate: [
+      { target: topupFee, op: rate, base: { field: input.amount }, bps: { literal: topup_fee }, rounding: floor }
+      { target: topupCredit, op: subtract, base: { field: input.amount }, subtract: [{ field: self.topupFee }] }
+    ]
+    moves self.topupCredit from holder to self.held economics { purpose: prepaid_credit, sourceParty: holder }
+    moves self.topupFee from holder to programOperator economics { purpose: earning, sourceParty: holder }
   }
   action withdraw {
     from: active, to: active, actor: { party: holder }