@hyperscale0/hsx 1.0.125 → 1.0.130

package/std/booking.hsx

@@ -0,0 +1,75 @@
+header booking
+
+// Economics: Deposit and balance payments and every refund are principal. Completion
+// and any forfeit are earnings for the company, or pass the customer's cash through
+// to a bound outside operator.
+
+// Expose create, pay_deposit and pay_balance for the booking path, and
+// cancel_early, cancel_middle and cancel_late for the customer. Create captures
+// subject departure, price, deposit and balance, and refuses a deposit and balance
+// that do not add up to the price. The balance is payable only after the deposit
+// and before balance_due ahead of departure, so a cancelled booking never offers
+// it. cancel_early runs until early_until before departure and returns everything
+// held. cancel_middle runs from then until late_from; cancel_late runs from then
+// until departure, even when the clock's complete runs late. They keep
+// middle_forfeit or late_forfeit of the held money and return the rest. Both
+// forfeits default to 0%, so nothing is kept unless the author sets them. At
+// departure the clock completes a paid booking and pays operator, and lapses an
+// unpaid one on cancel_late's terms, so nothing stays held after departure.
+
+// Cost: create declares one owned account. Each payment declares one transfer;
+// cancellation and completion move the held balance. Run hsx cost for the
+// composed counts.
+
+instrument reservation(customer: party = party(person), operator: party = programOperator, early_until: duration = 30d, late_from: duration = 15d, balance_due: duration = 15d, middle_forfeit: percent = 0%, late_forfeit: percent = 0%) {
+  revisioned: true
+  summary: "Take a deposit and a balance for a dated booking, with cancellation windows before departure."
+  fields {
+    customer: account of customer, operator: account of operator, held: account of self
+    departure: date, price: money = subject.price
+    deposit: money = subject.deposit, balance: money = subject.balance
+    split: money = sum(self.deposit, self.balance)
+    balanceAt: date = before(self.departure, balance_due)
+    earlyAt: date = before(self.departure, early_until)
+    lateAt: date = before(self.departure, late_from)
+    refund: money?, forfeit: money?
+  }
+  lifecycle { states: [reserved, deposit_paid, paid, completed, cancelled], initial: reserved }
+  action create {
+    subject { departure: date, price: money, deposit: money, balance: money }
+    actor: { party: customer }
+    requires self.departure > self.now
+    requires self.split == self.price
+  }
+  action pay_deposit {
+    from: reserved, to: deposit_paid, actor: { party: customer }
+    moves self.deposit from customer to self.held economics { purpose: principal, sourceParty: customer }
+  }
+  action pay_balance {
+    from: deposit_paid, to: paid, actor: { party: customer }, deadline: { at: self.balanceAt }
+    moves self.balance from customer to self.held economics { purpose: principal, sourceParty: customer }
+  }
+  action complete {
+    from: paid, to: completed, actor: clock, due: { at: self.departure }
+    moves self.held.balance from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action cancel_early { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, deadline: { at: self.earlyAt }
+    moves self.held.balance from self.held to customer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action cancel_middle { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, due: { at: self.earlyAt }, deadline: { at: self.lateAt }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: middle_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action cancel_late { allowZero: true,
+    from: [reserved, deposit_paid, paid], to: cancelled, actor: { party: customer }, due: { at: self.lateAt }, deadline: { at: self.departure }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: late_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+  action lapse { allowZero: true,
+    from: [reserved, deposit_paid], to: cancelled, actor: clock, due: { at: self.departure }
+    calculate: [{ target: forfeit, op: rate, base: { field: self.held.balance }, bps: { literal: late_forfeit }, rounding: floor }, { target: refund, op: subtract, base: { field: self.held.balance }, subtract: [{ field: self.forfeit }] }]
+    moves self.refund from self.held to customer economics { purpose: principal, sourceParty: programOperator }; moves self.forfeit from self.held to operator economics { recipient: operator, company: { purpose: earning, sourceParty: customer }, participant: { purpose: pass_through, sourceParty: programOperator } }
+  }
+}

package/std/cards.hsx

@@ -1,6 +1,8 @@
 header cards
 
 // Activate holder and card before creating and approving an authorization.
+// Only the Product operator activates, suspends or resumes a cardholder; the
+// holder freezes, unfreezes and cancels their own card.
 // Expose authorization.create, approve and capture; expose decline and reverse
 // separately if callers need those paths. Issuer declines only from pending;
 // merchant captures or reverses an approved reservation. Expiry voids approved
@@ -21,9 +23,9 @@ instrument cardholder(holder: party) {
   fields { holder: account of holder }
   lifecycle { states: [pending, active, suspended, closed], initial: pending }
   action create {}
-  action activate { from: pending, to: active }
-  action suspend { from: active, to: suspended }
-  action resume { from: suspended, to: active }
+  action activate { from: pending, to: active, actor: { party: programOperator } }
+  action suspend { from: active, to: suspended, actor: { party: programOperator } }
+  action resume { from: suspended, to: active, actor: { party: programOperator } }
   action close { from: [active, suspended], to: closed }
 }
 

package/std/escrow.hsx

@@ -1,13 +1,28 @@
 header escrow
 
 // Economics: Funding and unspent returns are principal. Acceptance realizes earnings for
-// the company or a payout to a bound outside seller; tax is pass-through.
+// the company; the payer's cash passes through to a bound outside seller, less the
+// fee the company earns. Tax is pass-through.
 
 // Expose create, fund, deliver and accept for the purchase path. Create captures
 // subject.price; acceptance pays payee less the configured fee, not payer.
 // Expose dispute, verify_return and refund separately for the return path.
-// Payer disputes delivered goods; payee verifies return evidence from disputed;
-// payee refunds the entire held price from return_verified by default.
+// Payer disputes delivered goods; payee verifies return evidence from disputed.
+// Payee refunds the whole held balance before delivery, or from return_verified
+// by default after a dispute. While a financing plan funds the hold in any state
+// but cancelled, both refunds refuse, so a written-off plan never hands lender
+// principal to the payer. Only unwind returns the principal to capital and
+// cancels the plan; after that, refund returns the rest. Before delivery the
+// Product operator runs the plan's unwind_undelivered instead, which invokes
+// unwind_financed here to return the rest to the payer and close the hold.
+// After a paid plan's refund window, the plan's return_hold runs it from funded
+// or return_verified to return the whole balance to the payer.
+// Only an installments plan can run confirm and unwind_financed; without
+// financing neither action exists, so no hold reaches funded without fundedAt. The plan's confirm leaves fundedAt unset, so
+// refund_undelivered never comes due on a financed hold and no schedule offers it.
+// Expose refund_undelivered to let the payer take the whole held price back once
+// deliver_within has passed since funding without delivery. It is a payer action
+// that becomes available at that time; nothing runs it automatically.
 // Acceptance expiry enters disputed, never released. Neither verify_return nor
 // refund becomes public merely because dispute is exposed. Clock actions remain
 // internal. Expose cancel for a pending hold, including a checkout-funded hold;
@@ -18,12 +33,12 @@ header escrow
 // transfer; accept expands the configured fee and tax into moves. Run hsx cost
 // on the composed program for instruction counts. The executor supplies prices.
 
-instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }) {
+instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, deliver_within: duration = 14d, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }) {
   revisioned: true
   summary: "Hold the subject price through delivery, acceptance and verified return."
   fields {
     payer: account of payer, payee: account of payee
-    held: account of self, deliveredAt: date?
+    held: account of self, fundedAt: date?, deliveredAt: date?
     price: money = subject.price
   }
   lifecycle { states: [pending, funded, delivered, disputed, return_verified, released, refunded, cancelled], initial: pending }
@@ -33,11 +48,11 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
   }
   action fund {
     from: pending, to: funded, actor: { party: payer }
-    subject { price: money }
+    set: { fundedAt: { field: self.now } }
     moves self.price from payer to self.held economics { purpose: principal, sourceParty: payer }
   }
   action confirm {
-    from: pending, to: funded
+    from: pending, to: funded, actor: { parent: all(financing.installments) }
     requires self.held.balance == self.price
   }
   action deliver {
@@ -48,7 +63,7 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
     from: delivered, to: released, actor: { party: payer }
     input { acceptanceReference: text }
     deadline: { at: self.deliveredAt, offset: accept_within }
-    moves self.price from self.held to payee fee fee economics { payee: { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: participant_payout, sourceParty: programOperator } }, fee: { purpose: earning, sourceParty: payer }, tax: { purpose: pass_through, sourceParty: programOperator } }
+    moves self.price from self.held to payee fee fee economics { payee: { recipient: payee, company: { purpose: earning, sourceParty: payer }, participant: { purpose: pass_through, sourceParty: programOperator } }, fee: { purpose: earning, sourceParty: payer }, tax: { purpose: pass_through, sourceParty: programOperator } }
   }
   action expire_acceptance {
     from: delivered, to: disputed, actor: clock
@@ -63,9 +78,20 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
     input { returnEvidence: text }
   }
   action refund {
-    from: dispute.refund_after, to: refunded, actor: { party: payee }
+    from: [funded, dispute.refund_after], to: refunded, actor: { party: payee }
+    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 } == 0
+    moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
+  }
+  action refund_undelivered {
+    from: funded, to: refunded, actor: { party: payer }
+    due: { at: self.fundedAt, offset: deliver_within }
+    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 } == 0
     moves self.price from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
+  action unwind_financed { allowZero: true,
+    from: [funded, return_verified], to: refunded, actor: { parent: all(financing.installments) }
+    moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
+  }
   action cancel { allowZero: true,
     from: pending, to: cancelled, actor: { party: payer }
     moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }

package/std/financing.hsx

@@ -2,9 +2,14 @@ header financing
 
 // Economics: Principal advances and repayments are excluded from earnings. Claims, waivers,
 // write-offs and allocations are internal. Paid profit and company charges are
-// earnings; receipt refunds reverse captured cash. Outside recovery recipients
-// receive payouts from held company cash, or pass-through direct customer cash.
+// earnings; receipt refunds reverse captured cash. Borrower cash paid to outside
+// capital or recovery recipients passes through, whether held first or paid direct.
 
+// Pricing is required. amortizing reads profit_rate as an annual rate on the
+// declining balance: equal monthly instalments, the last absorbing rounding.
+// flat_total reads it as one charge on principal for the whole term (murabaha,
+// fixed-fee pay-later). 12,000 at 18% over 12 months costs 13,201.95 amortizing
+// and 14,160 flat_total.
 // Expose create and sign on installments, then collect_down_payment as checkout
 // for disburse_to: funds. Checkout requires a signed plan and pending escrow;
 // it tops up only the missing down payment, without advancing lender principal.
@@ -12,13 +17,44 @@ header financing
 // the fully funded hold. Existing escrow credit counts once toward the down payment.
 // Disburse first credits an active marketplace.reservation on the same hold,
 // so list the plan in its converters; the deposit then counts as escrow credit.
-// Borrower-directed disbursement excludes collect_down_payment. A down_payment
+// disburse_to: seller pays principal to the seller party at activation (pay later
+// with the merchant paid on day one). For a return, capital refunds each paid
+// payment to the borrower. Payments stay refundable while the plan is active. The
+// payment that clears the last slice completes the plan when no late charge or
+// recovery cost is outstanding; otherwise expose complete to close it once they
+// are settled or waived. When
+// the plan leaves active (paid, written off or cancelled) it sets refundUntil to
+// refund_within (default 30d) later, and payment, late charge and recovery cost
+// refunds stop at that time. A refund that reopens the plan clears refundUntil, which is set
+// from the calculated refundWindow so a restore can clear it. Once it passes,
+// nothing can move the plan's payments or late charges, so they stop counting as
+// open records. After the refunds, capital runs unwind: it takes principal back to
+// capital and cancels open slices with their claims. Seller mode debits the seller; funds mode
+// needs the hold in return_verified and debits the hold, after which the payee's
+// escrow refund returns only the down payment. Before delivery, the Product
+// operator runs unwind_undelivered on a funds-mode plan whose hold is still
+// funded: principal goes back to capital and the hold's unwind_financed returns
+// the down payment to the payer and closes the hold as refunded, all in one
+// operation, so deliver is refused afterwards. It also cancels proposed and
+// assessed late charges and recovery costs: goods that never arrived earn no
+// fines. Escrow refund refuses while any plan that is
+// not cancelled funds the hold, written off included, so the borrower never
+// receives lender principal. A funds-mode plan writes off only once its hold
+// has released principal to the seller: principal still held is not a loss, and
+// unwind or unwind_undelivered returns it. Both unwinds need no paid payments and no
+// collected late charges; refund them first. unwind also needs no assessed
+// late charges; waive them first. Once a paid plan's refund window has passed,
+// its payments can no longer be refunded, so the Product operator runs
+// return_hold to return an undelivered or returned hold's whole balance to the
+// borrower, who has repaid the principal.
+// Borrower- and seller-directed disbursement exclude collect_down_payment. A down_payment
 // there reduces principal but does not collect cash. Price is subject metadata,
 // not the borrower limit. The escrow payer and price must match the plan.
 // Expose escrow cancel to return checkout cash if financing is abandoned; plan
 // void alone cancels the agreement and does not refund its separate escrow.
 // Approve borrower and portfolio limits before disbursement. Create builds the
-// dated slice records; payments need a separate payment record and pay action.
+// dated slice records from future, strictly increasing dates; disbursement
+// refuses once a slice is due. Payments need a separate payment record and pay action.
 // Expose parent payoff separately and create a current, unexpired payoff_quote.
 // Expose late_charge.create as propose_assessment before the clock can assess;
 // provide matching plan, slice and borrower. Fine is fixed money, not a percentage.
@@ -26,19 +62,25 @@ header financing
 // payment does not settle the remaining fine. Recovery cost needs its own record.
 // Profit share credits capital's allocatedProfitPayable, not an outside agency.
 // Credit lines need adapter binding at activation; draws are ledger advances,
-// not evidence of outside funding. Caller-authorized limit approvals and advances
-// need the Product's operation authority. No clock declaration proves retries.
+// not evidence of outside funding. Only the Product operator approves borrower
+// and portfolio limits; caller-authorized advances need the Product's operation
+// authority. No clock declaration proves retries.
 
 // Cost: installments include cash and claim moves, child-account creation and
 // bounded invocations across slices and assessments. Month and charge limits affect
 // the bound. Run hsx cost on the selected policies; profit is not a platform tariff.
 
-instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3, profit: percent, disburse_to: enum(funds, borrower) = funds, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
+instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, refund_within: duration = 30d, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
   dependencies {
     funds {
       selector: disburse_to, is: funds
       message: "Attachment `{attachment}` disburses into a hold, but `funds` is not bound."
-      fix: "Bind `funds: sale` to an escrow attachment. Choose `disburse_to: borrower` only if the borrower should receive the money directly."
+      fix: "Bind `funds: sale` to an escrow attachment. Choose `disburse_to: seller` to pay a seller on activation, or `disburse_to: borrower` only if the borrower should receive the money directly."
+    }
+    seller {
+      selector: disburse_to, is: seller
+      message: "Attachment `{attachment}` pays a seller, but `seller` is not bound."
+      fix: "Bind `seller: merchant` to the declared business that receives the principal."
     }
   }
   revisioned: true
@@ -48,12 +90,12 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
     funds: ref<funds>?, borrower: account of borrower, settlementIdentity: text, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>
     months: integer = months, dates: list(date, months)
     allocatedPayable: account(capital, cash, "allocatedProfitPayable"), capital: account(capital, cash, "capital"), profitIncome: account(capital, cash, "profitIncome"), loss: account(capital, claim, "loss")
-    downPaymentRemaining: money?, downPaymentCredit: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?
+    downPaymentRemaining: money?, downPaymentCredit: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?, refundWindow: date?, refundUntil: date?
+    openSlices: integer?, openCharges: money?, openCosts: money?
     price: money = subject.price
     downPayment: money = rate(self.price, down_payment)
     principal: money = subtract(self.price, self.downPayment)
-    profit: money = rate(self.principal, profit)
-    total: money = sum(self.principal, self.profit)
+    flatProfit: money?
   }
   lifecycle { states: [quoted, signed, active, paid, written_off, cancelled], initial: quoted }
   invariants count of { instrument: all(financing.installments), reference: "borrowerLimit", anchor: self.borrowerLimit, states: [active], limit: 366 } <= self.borrowerLimit.activePlans
@@ -62,8 +104,9 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   action create {
     subject { price: money }
     requires self.borrowerLimit.borrower == self.borrower
+    when pricing is flat_total { calculate: [{ target: flatProfit, op: rate, base: { field: self.principal }, bps: { literal: profit_rate }, rounding: floor }] }
     when disburse_to is funds { requires self.borrower == self.funds.payer; requires self.price == self.funds.price }
-    invoke: [{ range: { count: { literal: months }, maximum: months, bind: position }, instrument: slice, action: create, input: { plan: { field: self.id }, borrowerLimit: { field: self.borrowerLimit }, portfolioLimit: { field: self.portfolioLimit }, position: { field: position } } }]
+    invoke: [{ range: { count: { literal: months }, maximum: months, bind: position }, instrument: slice, action: create, input: { plan: { field: self.id }, borrowerLimit: { field: self.borrowerLimit }, portfolioLimit: { field: self.portfolioLimit }, position: { field: position } } }, { selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: months, where: { first: { literal: 0 } } }, action: check_order, input: {} }]
   }
   action sign {
     from: quoted, to: signed, actor: { party: borrower }, input { signedOffer: text, affordabilityReference: text }
@@ -72,6 +115,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   action collect_down_payment { allowZero: true,
     from: signed, to: signed, actor: { party: borrower }
     when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
     when disburse_to is funds {
       requires self.funds in [pending]
       calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: self.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: self.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
@@ -87,6 +131,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       invoke: [{ selection: { instrument: all(marketplace.reservation), reference: "funds", anchor: self.funds, states: [active], limit: 1 }, action: credit, input: { funds: { field: self.funds }, contribution: { field: self.downPayment } } }, { reference: self.id, action: fund_down_payment, input: {} }]
     }
     when disburse_to is borrower { moves self.principal from self.capital to self.borrower economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is seller { moves self.principal from self.capital to seller economics { purpose: principal, sourceParty: capital } }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: 366, order: [position] }, action: activate, input: {} }]
     when disburse_to is funds { invoke: [{ reference: self.funds, action: confirm, input: {} }] }
   }
@@ -100,11 +145,13 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   }
   action complete {
     from: active, to: paid
+    calculate: [{ target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
     requires count of { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 } == 0
     requires sum "receivable.balance" of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == "0"
     requires sum "receivable.balance" of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == "0"
   }
-  action restore { from: [active, paid], to: active, actor: { parent: payment } }
+  action restore { from: [active, paid], to: active, actor: { parent: payment }, input { refundUntil: date? }, set: { refundUntil: { field: input.refundUntil } } }
   action payoff {
     from: active, to: paid, actor: { party: borrower }
     input { quote: ref<payoff_quote> }
@@ -112,7 +159,9 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
     deadline: { at: input.quote.expiresAt }
     calculate: [
       { target: "principalReturned", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }
+      { target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }
     ]
+    set: { refundUntil: { field: self.refundWindow } }
     invoke: [{ selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366, order: [overdueAt] }, action: payoff, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366, order: [overdueAt] }, action: payoff, input: {} }]
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: payoff, input: { identity: { field: self.settlementIdentity } } }, { reference: self.id, action: record_payoff, input: {} }]
   }
@@ -124,18 +173,64 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
   action write_off {
     from: active, to: written_off, actor: { parent: write_off_request }
     input { overdueSlice: ref<slice> }
-    calculate: [{ target: "lossRecorded", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }]
+    calculate: [{ target: "lossRecorded", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }, { target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
     due: { at: input.overdueSlice.lossEligibleAt }
     requires input.overdueSlice.plan == self.id; requires input.overdueSlice.principalReceivable.balance > "0"
+    when disburse_to is funds { requires self.funds in [released] }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: write_off, input: {} }, { instrument: settlement, action: create, input: { plan: { field: self.id }, identity: { field: self.settlementIdentity }, principal: { literal: "0" }, profit: { literal: "0" }, loss: { field: self.lossRecorded }, kind: { literal: "loss" } } }]
   }
   action record_payment {
     from: active, to: active, actor: { parent: payment }
     input { identity: text, principal: money, profit: money }
+    calculate: [
+      { target: openSlices, op: aggregate, selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: count }
+      { target: openCharges, op: aggregate, selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 }, measure: { sum: "receivable.balance" } }
+      { target: openCosts, op: aggregate, selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 }, measure: { sum: "receivable.balance" } }
+    ]
     invoke: [{ instrument: settlement, action: create, input: { plan: { field: self.id }, identity: { field: input.identity }, principal: { field: input.principal }, profit: { field: input.profit }, loss: { literal: "0" }, kind: { literal: "cash" } } }]
+    invoke: [{ selection: { instrument: current(), reference: "borrowerLimit", anchor: self.borrowerLimit, states: [active], limit: 1, where: { id: { field: self.id }, openSlices: { literal: 0 }, openCharges: { literal: "0" }, openCosts: { literal: "0" } } }, action: complete, input: {} }]
   }
   action cancel { from: quoted, to: cancelled }
   action void { from: signed, to: cancelled, actor: { party: borrower } }
+  action unwind { allowZero: true,
+    from: active, to: cancelled, actor: { party: capital }
+    calculate: [{ target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is funds { requires self.funds in [return_verified] }
+    requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
+    when disburse_to is funds { moves self.principal from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is seller { moves self.principal from seller to self.capital economics { purpose: principal, sourceParty: seller } }
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
+  }
+  action unwind_undelivered { allowZero: true,
+    from: active, to: cancelled, actor: { party: programOperator }
+    calculate: [{ target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
+    when disburse_to is funds { requires self.funds in [funded] }
+    requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
+    when disburse_to is funds { moves self.principal from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
+    invoke: [{ selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }]
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: unwind_financed, input: {} }] }
+  }
+  action return_hold {
+    from: paid, to: paid, actor: { party: programOperator }
+    requires self.refundUntil < self.now
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
+    when disburse_to is funds {
+      requires self.funds in [funded, return_verified]
+      invoke: [{ reference: self.funds, action: unwind_financed, input: {} }]
+    }
+  }
   records {
     write_off_request: {
       fields { plan: ref<parent>, overdueSlice: ref<slice> }
@@ -251,31 +346,48 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       revisioned: true
       fields {
         plan: ref<parent>, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>, position: integer(1, months)
-        originalDueAt: date = at(self.plan.dates, self.position), dueAt: date?, nextDueAt: date?, previousDueAt: date?, previousPosition: integer?, previousDate: date?, extensionLimit: date = after(self.originalDueAt, max_extension), lossEligibleAt: date?
-        principalBase: money = divide(self.plan.principal, months)
-        principalAllocated: money = multiply(self.principalBase, months)
-        principalRemainder: money = subtract(self.plan.principal, self.principalAllocated)
-        profitBase: money = divide(self.plan.profit, months)
-        profitAllocated: money = multiply(self.profitBase, months)
-        profitRemainder: money = subtract(self.plan.profit, self.profitAllocated)
+        originalDueAt: date = at(self.plan.dates, self.position), dueAt: date?, nextDueAt: date?, previousDueAt: date?, prior: integer = subtract(self.position, 1), previousPosition: integer = sum(self.prior, self.first), previousDate: date = at(self.plan.dates, self.previousPosition), extensionLimit: date = after(self.originalDueAt, max_extension), lossEligibleAt: date?
         first: integer = divide(1, self.position)
-        principalAdjustment: money = multiply(self.principalRemainder, self.first)
-        profitAdjustment: money = multiply(self.profitRemainder, self.first)
-        principal: money = sum(self.principalBase, self.principalAdjustment)
-        profit: money = sum(self.profitBase, self.profitAdjustment)
+        principalBase: money?, principalAllocated: money?, principalRemainder: money?, principalAdjustment: money?
+        profitBase: money?, profitAllocated: money?, profitRemainder: money?, profitAdjustment: money?
+        principal: money, profit: money, instalment: money
         principalReceivable: account(self, claim), profitReceivable: account(self, claim), profitEarned: account(self, claim)
         payoffIdentity: text?, payoffRebate: money?, payoffProfitTotal: money?, payoffProfit: money?
-        paymentBudget: money?, principalPayment: money?, principalBasePayment: money?, principalRatio: money?, profitPayment: money?, profitBudget: money?, collectibleProfit: money?, collectibleTotal: money?, ratioDenominator: integer = sum(10000, profit)
+        paymentBudget: money?, principalPayment: money?, principalBasePayment: money?, principalRatio: money?, profitPayment: money?, profitBudget: money?, collectibleProfit: money?, collectibleTotal: money?, ratioDenominator: integer = sum(10000, profit_rate)
         debt: account(borrower, claim, contra, "debt"), loss: account(capital, claim, "loss")
       }
-      lifecycle { states: [draft, pending, due, paid, written_off], initial: draft }
+      lifecycle { states: [draft, pending, due, paid, written_off, cancelled], initial: draft }
       action create {
         actor: { parent: parent }
         input { plan: ref<parent>, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>, position: integer(1, months) }
         set: { dueAt: { field: self.originalDueAt } }
+        when pricing is flat_total {
+          calculate: [
+            { target: principalBase, op: divide, amount: { field: self.plan.principal }, divisor: { literal: months }, rounding: floor }
+            { target: principalAllocated, op: multiply, amount: { field: self.principalBase }, units: { literal: months } }
+            { target: principalRemainder, op: subtract, base: { field: self.plan.principal }, subtract: [{ field: self.principalAllocated }] }
+            { target: principalAdjustment, op: multiply, amount: { field: self.principalRemainder }, units: { field: self.first } }
+            { target: principal, op: sum, values: [{ field: self.principalBase }, { field: self.principalAdjustment }] }
+            { target: profitBase, op: divide, amount: { field: self.plan.flatProfit }, divisor: { literal: months }, rounding: floor }
+            { target: profitAllocated, op: multiply, amount: { field: self.profitBase }, units: { literal: months } }
+            { target: profitRemainder, op: subtract, base: { field: self.plan.flatProfit }, subtract: [{ field: self.profitAllocated }] }
+            { target: profitAdjustment, op: multiply, amount: { field: self.profitRemainder }, units: { field: self.first } }
+            { target: profit, op: sum, values: [{ field: self.profitBase }, { field: self.profitAdjustment }] }
+            { target: instalment, op: sum, values: [{ field: self.principal }, { field: self.profit }] }
+          ]
+        }
+        when pricing is amortizing {
+          calculate: [
+            { target: principal, op: annuity, amount: { field: self.plan.principal }, rate: { literal: profit_rate }, periods: { literal: months }, position: { field: self.position }, part: principal }
+            { target: profit, op: annuity, amount: { field: self.plan.principal }, rate: { literal: profit_rate }, periods: { literal: months }, position: { field: self.position }, part: interest }
+            { target: instalment, op: sum, values: [{ field: self.principal }, { field: self.profit }] }
+          ]
+        }
         invoke: [{ reference: self.id, action: refresh_loss_date, input: {} }]
         requires self.plan in [quoted]; requires unique "signed_position" on [self.plan, self.position]; requires self.borrowerLimit == self.plan.borrowerLimit; requires self.portfolioLimit == self.plan.portfolioLimit
+        requires self.originalDueAt > self.now; requires self.originalDueAt >= self.previousDate
       }
+      action check_order { from: draft, to: draft, actor: { parent: parent }, requires self.originalDueAt > self.previousDate }
       action quote_pending {
         from: pending, to: pending, actor: { parent: payoff_quote }, input { quote: ref<payoff_quote> }
         requires input.quote.plan == self.plan
@@ -310,6 +422,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
       }
       action activate { allowZero: true,
         from: draft, to: pending, actor: { parent: parent }
+        requires self.dueAt > self.now
         moves self.principal from self.debt to self.principalReceivable economics { purpose: internal, sourceParty: borrower }
         moves self.profit from self.debt to self.profitReceivable economics { purpose: internal, sourceParty: borrower }
         when profit_earned is at_disbursement { moves self.profit from self.profitReceivable to self.profitEarned economics { purpose: internal, sourceParty: programOperator } }
@@ -356,7 +469,10 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         calculate: [
           { target: collectibleTotal, op: sum, values: [{ field: self.principalReceivable.balance }, { field: self.collectibleProfit }] }
           { target: paymentBudget, op: minimum, values: [{ field: input.payment.held.balance }, { field: self.collectibleTotal }] }
-          { target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { literal: 10000 }, denominator: { field: self.ratioDenominator }, rounding: floor }
+        ]
+        when pricing is flat_total { calculate: [{ target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { literal: 10000 }, denominator: { field: self.ratioDenominator }, rounding: floor }] }
+        when pricing is amortizing { calculate: [{ target: principalRatio, op: ratio, amount: { field: self.paymentBudget }, numerator: { field: self.principal }, denominator: { field: self.instalment }, rounding: floor }] }
+        calculate: [
           { target: principalBasePayment, op: minimum, values: [{ field: self.principalRatio }, { field: self.principalReceivable.balance }] }
           { target: profitBudget, op: subtract, base: { field: self.paymentBudget }, subtract: [{ field: self.principalBasePayment }] }
           { target: profitPayment, op: minimum, values: [{ field: self.profitBudget }, { field: self.collectibleProfit }] }
@@ -387,6 +503,10 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         from: [pending, due], to: written_off, actor: { parent: parent }
         moves self.principalReceivable.balance from self.principalReceivable to self.loss economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.loss economics { purpose: internal, sourceParty: programOperator }
       }
+      action cancel { allowZero: true,
+        from: [pending, due], to: cancelled, actor: { parent: parent }
+        moves self.principalReceivable.balance from self.principalReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.debt economics { purpose: internal, sourceParty: programOperator }
+      }
     }
     recognition: {
       fields { slice: ref<slice>, dueAt: date = after(self.slice.dueAt, 0) }
@@ -434,7 +554,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         invoke: [{ reference: self.plan, action: record_payment, input: { identity: { field: self.paymentIdentity }, principal: { field: self.principalReturned }, profit: { field: self.profitReturned } } }]
       }
       action refund {
-        from: paid, to: refunded, actor: { party: capital }
+        from: paid, to: refunded, actor: { party: capital }, deadline: { at: self.plan.refundUntil }
         requires unique "settlement_consumption" on [self.plan, self.paymentIdentity]; requires self.plan in [active, paid]
         requires count of { instrument: settlement, reference: "plan", anchor: self.plan, states: [recorded], limit: 366, where: { identity: { field: self.paymentIdentity } } } == 1
         invoke: [{ selection: { instrument: settlement, reference: "plan", anchor: self.plan, states: [recorded], limit: 366, where: { identity: { field: self.paymentIdentity } } }, action: refund, input: {} }]
@@ -467,7 +587,7 @@ instrument installments(months: integer(1, 366), charge_limit: integer(1, 3) = 3
         actor: { parent: slice }
         input { slice: ref<slice>, payment: ref<payment>, limit: money }
         requires unique "profit_receipt" on [self.slice, self.payment]
-        moves self.amount from self.payment.held to self.slice.plan.profitIncome capture "cashReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }
+        moves self.amount from self.payment.held to self.slice.plan.profitIncome capture "cashReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }
         when profit_earned is on_payment { moves self.amount from self.slice.profitReceivable to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
         when profit_earned is by_schedule { moves self.amount from self.slice.profitEarned to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
         when profit_earned is at_disbursement { moves self.amount from self.slice.profitEarned to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
@@ -519,6 +639,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
   }
   action finish { from: assessed, to: collected, actor: { parent: current() }, requires self.receivable.balance == "0" }
   action cancel { from: proposed, to: waived }
+  action cancel_undelivered { allowZero: true, from: [proposed, assessed], to: waived, actor: { parent: on }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
   action waive_for_amendment {
     from: [assessed, collected], to: assessed, actor: { parent: child(on, amendment) }, input { amendment: ref<on.amendment> }
     requires input.amendment.plan == self.plan; requires input.amendment in [applied]
@@ -526,7 +647,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
   }
   action waive { allowZero: true, from: [assessed, collected], to: waived, actor: { parent: waiver_request }, input { reason: text, evidence: text }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
   action refund {
-    from: [assessed, collected], to: assessed, actor: { party: fines_to }, input { payment: ref<on.payment> }
+    from: [assessed, collected], to: assessed, actor: { party: fines_to }, input { payment: ref<on.payment> }, deadline: { at: self.plan.refundUntil }
     requires input.payment in [paid, refunded]
     requires input.payment.plan == self.plan
     invoke: [{ selection: { instrument: receipt, reference: "payment", anchor: input.payment, states: [paid], limit: 1, where: { assessment: { field: self.id } } }, action: refund, input: {} }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
@@ -555,7 +676,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
     receipt: {
       fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
       lifecycle { states: [paid, refunded], initial: paid }
-      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
       action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from fines_to to self.payment.plan.borrower economics { recipient: fines_to, company: { purpose: earning, sourceParty: fines_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
     }
 
@@ -586,6 +707,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
       }
       action finish { from: assessed, to: collected, actor: { parent: current() }, requires self.receivable.balance == "0" }
       action cancel { from: proposed, to: waived }
+      action cancel_undelivered { allowZero: true, from: [proposed, assessed], to: waived, actor: { parent: on }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
       action waive_for_amendment {
         from: [assessed, collected], to: assessed, actor: { parent: child(on, amendment) }, input { amendment: ref<on.amendment> }
         requires input.amendment.plan == self.plan; requires input.amendment in [applied]
@@ -593,7 +715,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
       }
       action waive { allowZero: true, from: [assessed, collected], to: waived, actor: { parent: waiver_request }, input { reason: text, evidence: text }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
       action refund {
-        from: [assessed, collected], to: assessed, actor: { party: costs_to }, input { payment: ref<on.payment> }
+        from: [assessed, collected], to: assessed, actor: { party: costs_to }, input { payment: ref<on.payment> }, deadline: { at: self.plan.refundUntil }
         requires input.payment in [paid, refunded]
         requires input.payment.plan == self.plan
         invoke: [{ selection: { instrument: receipt, reference: "payment", anchor: input.payment, states: [paid], limit: 1, where: { assessment: { field: self.id } } }, action: refund, input: {} }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
@@ -622,7 +744,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
         receipt: {
           fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
           lifecycle { states: [paid, refunded], initial: paid }
-          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: participant_payout, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
           action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from costs_to to self.payment.plan.borrower economics { recipient: costs_to, company: { purpose: earning, sourceParty: costs_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
         }
       }
@@ -637,7 +759,7 @@ instrument limits(per_borrower: money, borrower: party = party(person), active_p
   fields { borrower: account of borrower, limit: money = per_borrower, activePlans: integer = active_plans }
   lifecycle { states: [pending, approved], initial: pending }
   action create { requires unique "borrower_limit" on [self.borrower] }
-  action approve { from: pending, to: approved }
+  action approve { from: pending, to: approved, actor: { party: programOperator } }
 }
 
 instrument portfolio_limit(limit: money) {
@@ -647,7 +769,7 @@ instrument portfolio_limit(limit: money) {
   fields { key: text = "portfolio", limit: money = limit }
   lifecycle { states: [pending, approved], initial: pending }
   action create { requires unique "portfolio_limit" on [self.key] }
-  action approve { from: pending, to: approved }
+  action approve { from: pending, to: approved, actor: { party: programOperator } }
 }
 
 instrument credit_line(borrower: party = programOperator, adapter: text, limit: money, expires: date) {