@hyperscale0/hsx 1.0.128 → 1.0.132

package/std/financing.hsx

@@ -18,13 +18,56 @@ header financing
 // Disburse first credits an active marketplace.reservation on the same hold,
 // so list the plan in its converters; the deposit then counts as escrow credit.
 // disburse_to: seller pays principal to the seller party at activation (pay later
-// with the merchant paid on day one). For a return, capital refunds each paid
-// payment to the borrower, then runs unwind: it takes principal back to capital and
-// cancels open slices with their claims. Seller mode debits the seller; funds mode
-// needs the hold in return_verified and debits the hold, after which the payee's
-// escrow refund returns only the down payment. Escrow refund refuses while a live
-// plan funds the hold. Unwind needs no assessed or collected late charges; waive
-// them first.
+// with the merchant paid on day one). Capital may refund any paid payment to
+// the borrower. Payments stay refundable while the plan is active. The
+// payment that clears the last slice completes the plan when no late charge or
+// recovery cost is outstanding; otherwise expose complete to close it once they
+// are settled or waived. When
+// the plan leaves active (paid, written off or cancelled) it sets refundUntil to
+// refund_within (default 30d) later, and payment, late charge and recovery cost
+// refunds stop at that time. A refund that reopens the plan clears refundUntil, which is set
+// from the calculated refundWindow so a restore can clear it. Once it passes,
+// nothing can move the plan's payments or late charges, so they stop counting as
+// open records. On a return, capital runs unwind: it takes the outstanding
+// principal back to capital and cancels open slices with their claims. Seller
+// mode debits the seller, who also returns the principal the borrower repaid;
+// funds mode needs the hold in return_verified and debits the hold, after which
+// the payee's escrow refund returns the down payment and the repaid principal.
+// Before delivery, the Product
+// operator runs unwind_undelivered on a funds-mode plan whose hold is still
+// funded: principal goes back to capital and the hold's unwind_financed returns
+// the down payment to the payer and closes the hold as refunded, all in one
+// operation, so deliver is refused afterwards. It also cancels proposed and
+// assessed late charges and recovery costs: goods that never arrived earn no
+// fines. Escrow refund refuses while any plan that is
+// not cancelled funds the hold, written off included, so the borrower never
+// receives lender principal. A funds-mode plan writes off only once its hold
+// has released principal to the seller: principal still held is not a loss, and
+// unwind or unwind_undelivered returns it. unwind_undelivered needs no paid
+// payments and no collected late charges; refund them first. unwind needs no
+// assessed late charges; waive them first. When goods never arrive on a paid plan, the
+// Product operator runs unwind_paid once the hold's deliverBy has passed, so an
+// early payoff never cuts the seller's delivery window short. It refunds every
+// payment, share, profit piece, fine and cost receipt and reverses the payoff's
+// profit, fines and costs, cancels the plan, and returns the hold's whole price
+// to the borrower; capital keeps the principal the borrower repaid. A settlement
+// a lending.distribution has paid out keeps its profit and share, since investors
+// hold that profit; only the other settlements' profit is refunded. unwind_paid
+// selects at most max_history (default and most 366) of each record kind, so
+// a payment refuses when it would leave more paid payments than max_history
+// less one, keeping a settlement for the payoff, or more paid profit pieces,
+// fine receipts or cost receipts than max_history; a fine or a recovery cost
+// refuses past max_history unwaived fines or costs on the plan, counted across
+// every late charge attachment, so a waived fine's cost keeps its own slot. A company lowers it to keep unwinds smaller. If any
+// source account is short, the whole action refuses and nothing moves; a
+// company that wants a partial refund writes that rule in its own program.
+// returned_goods decides the split on returned goods, before or after payoff.
+// keep_profit, the default, keeps the profit and fines paid so far with the
+// company: unwind runs with payments still paid, and on a paid plan the Product
+// operator runs return_hold after the refund window to return a return_verified
+// hold's whole balance. refund_all makes unwind wait until capital has refunded
+// every payment and collected charge, removes return_hold, and lets unwind_paid
+// settle returned goods too.
 // Borrower- and seller-directed disbursement exclude collect_down_payment. A down_payment
 // there reduces principal but does not collect cash. Price is subject metadata,
 // not the borrower limit. The escrow payer and price must match the plan.
@@ -37,17 +80,20 @@ header financing
 // Expose late_charge.create as propose_assessment before the clock can assess;
 // provide matching plan, slice and borrower. Fine is fixed money, not a percentage.
 // Collection uses the minimum of payment cash and outstanding fine; a partial
-// payment does not settle the remaining fine. Recovery cost needs its own record.
+// payment does not settle the remaining fine. Recovery cost needs its own record,
+// which only the Product operator creates; only it cancels a proposed fine or cost.
 // Profit share credits capital's allocatedProfitPayable, not an outside agency.
 // Credit lines need adapter binding at activation; draws are ledger advances,
-// not evidence of outside funding. Caller-authorized limit approvals and advances
-// need the Product's operation authority. No clock declaration proves retries.
+// not evidence of outside funding. Only the line's borrower, the Product operator
+// by default, opens and closes the line and creates, draws, repays or cancels an
+// advance on it. Only the Product operator creates the portfolio limit and
+// approves borrower and portfolio limits. No clock declaration proves retries.
 
 // Cost: installments include cash and claim moves, child-account creation and
 // bounded invocations across slices and assessments. Month and charge limits affect
 // the bound. Run hsx cost on the selected policies; profit is not a platform tariff.
 
-instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
+instrument installments(months: integer(1, 366), max_history: integer(2, 366) = 366, pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, refund_within: duration = 30d, returned_goods: enum(keep_profit, refund_all) = keep_profit, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
   dependencies {
     funds {
       selector: disburse_to, is: funds
@@ -65,9 +111,10 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
   summary: "Funding, profit recognition and payment order chosen by the program."
   fields {
     funds: ref<funds>?, borrower: account of borrower, settlementIdentity: text, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>
-    months: integer = months, dates: list(date, months)
+    months: integer = months, dates: list(date, months), historyLimit: integer = max_history, paymentLimit: integer = subtract(max_history, 1)
     allocatedPayable: account(capital, cash, "allocatedProfitPayable"), capital: account(capital, cash, "capital"), profitIncome: account(capital, cash, "profitIncome"), loss: account(capital, claim, "loss")
-    downPaymentRemaining: money?, downPaymentCredit: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?
+    downPaymentRemaining: money?, downPaymentCredit: money?, principalOutstanding: money?, principalRepaid: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?, refundWindow: date?, refundUntil: date?
+    openSlices: integer?, openCharges: money?, openCosts: money?, payoffRefunds: integer?
     price: money = subject.price
     downPayment: money = rate(self.price, down_payment)
     principal: money = subtract(self.price, self.downPayment)
@@ -79,6 +126,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
   invariants sum "principalReceivable.balance" of { instrument: all(financing.installments.slice), reference: "portfolioLimit", anchor: self.portfolioLimit, states: [pending, due, paid], limit: 366 } <= self.portfolioLimit.limit
   action create {
     subject { price: money }
+    actor: { party: borrower }
     requires self.borrowerLimit.borrower == self.borrower
     when pricing is flat_total { calculate: [{ target: flatProfit, op: rate, base: { field: self.principal }, bps: { literal: profit_rate }, rounding: floor }] }
     when disburse_to is funds { requires self.borrower == self.funds.payer; requires self.price == self.funds.price }
@@ -121,11 +169,13 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
   }
   action complete {
     from: active, to: paid
+    calculate: [{ target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
     requires count of { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 } == 0
     requires sum "receivable.balance" of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == "0"
     requires sum "receivable.balance" of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == "0"
   }
-  action restore { from: [active, paid], to: active, actor: { parent: payment } }
+  action restore { from: [active, paid], to: active, actor: { parent: payment }, input { refundUntil: date? }, set: { refundUntil: { field: input.refundUntil } } }
   action payoff {
     from: active, to: paid, actor: { party: borrower }
     input { quote: ref<payoff_quote> }
@@ -133,7 +183,9 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
     deadline: { at: input.quote.expiresAt }
     calculate: [
       { target: "principalReturned", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }
+      { target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }
     ]
+    set: { refundUntil: { field: self.refundWindow } }
     invoke: [{ selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366, order: [overdueAt] }, action: payoff, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366, order: [overdueAt] }, action: payoff, input: {} }]
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: payoff, input: { identity: { field: self.settlementIdentity } } }, { reference: self.id, action: record_payoff, input: {} }]
   }
@@ -145,28 +197,95 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
   action write_off {
     from: active, to: written_off, actor: { parent: write_off_request }
     input { overdueSlice: ref<slice> }
-    calculate: [{ target: "lossRecorded", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }]
+    calculate: [{ target: "lossRecorded", op: "aggregate", selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }, { target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
     due: { at: input.overdueSlice.lossEligibleAt }
     requires input.overdueSlice.plan == self.id; requires input.overdueSlice.principalReceivable.balance > "0"
+    when disburse_to is funds { requires self.funds in [released] }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: write_off, input: {} }, { instrument: settlement, action: create, input: { plan: { field: self.id }, identity: { field: self.settlementIdentity }, principal: { literal: "0" }, profit: { literal: "0" }, loss: { field: self.lossRecorded }, kind: { literal: "loss" } } }]
   }
   action record_payment {
     from: active, to: active, actor: { parent: payment }
     input { identity: text, principal: money, profit: money }
+    calculate: [
+      { target: openSlices, op: aggregate, selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: count }
+      { target: openCharges, op: aggregate, selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 }, measure: { sum: "receivable.balance" } }
+      { target: openCosts, op: aggregate, selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 }, measure: { sum: "receivable.balance" } }
+    ]
     invoke: [{ instrument: settlement, action: create, input: { plan: { field: self.id }, identity: { field: input.identity }, principal: { field: input.principal }, profit: { field: input.profit }, loss: { literal: "0" }, kind: { literal: "cash" } } }]
+    invoke: [{ selection: { instrument: current(), reference: "borrowerLimit", anchor: self.borrowerLimit, states: [active], limit: 1, where: { id: { field: self.id }, openSlices: { literal: 0 }, openCharges: { literal: "0" }, openCosts: { literal: "0" } } }, action: complete, input: {} }]
   }
   action cancel { from: quoted, to: cancelled }
   action void { from: signed, to: cancelled, actor: { party: borrower } }
   action unwind { allowZero: true,
     from: active, to: cancelled, actor: { party: capital }
+    calculate: [
+      { target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }
+      { target: principalOutstanding, op: aggregate, selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366 }, measure: { sum: "principalReceivable.balance" } }
+      { target: principalRepaid, op: subtract, base: { field: self.principal }, subtract: [{ field: self.principalOutstanding }] }
+    ]
+    set: { refundUntil: { field: self.refundWindow } }
     when disburse_to is borrower { requires true == false }
     when disburse_to is funds { requires self.funds in [return_verified] }
+    when returned_goods is refund_all {
+      requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
+      requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
+      requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
+    }
+    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed], limit: 366 } == 0
+    when disburse_to is funds { moves self.principalOutstanding from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is seller {
+      moves self.principalOutstanding from seller to self.capital economics { purpose: principal, sourceParty: seller }
+      moves self.principalRepaid from seller to self.borrower economics { purpose: principal, sourceParty: seller }
+    }
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
+  }
+  action unwind_undelivered { allowZero: true,
+    from: active, to: cancelled, actor: { party: programOperator }
+    calculate: [{ target: refundWindow, op: shift, date: { field: self.now }, milliseconds: { literal: refund_within }, direction: after }]
+    set: { refundUntil: { field: self.refundWindow } }
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
+    when disburse_to is funds { requires self.funds in [funded] }
     requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
-    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
-    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed, collected], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
+    requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
     when disburse_to is funds { moves self.principal from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
-    when disburse_to is seller { moves self.principal from seller to self.capital economics { purpose: principal, sourceParty: seller } }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
+    invoke: [{ selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }]
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: unwind_financed, input: {} }] }
+  }
+  action return_hold {
+    from: paid, to: paid, actor: { party: programOperator }
+    requires self.refundUntil < self.now
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
+    when returned_goods is refund_all { requires true == false }
+    when disburse_to is funds {
+      requires self.funds in [return_verified]
+      invoke: [{ reference: self.funds, action: unwind_financed, input: {} }]
+    }
+  }
+  action unwind_paid { expansionLimit: 8192,
+    from: paid, to: cancelled, actor: { party: programOperator }
+    when disburse_to is borrower { requires true == false }
+    when disburse_to is seller { requires true == false }
+    when disburse_to is funds {
+      when returned_goods is keep_profit { requires self.funds in [funded] }
+      when returned_goods is refund_all { requires self.funds in [funded, return_verified] }
+      requires self.funds.deliverBy < self.now
+    }
+    invoke: [{ selection: { instrument: settlement, reference: "plan", anchor: self.id, states: [recorded], limit: max_history }, action: unwind, input: {} }, { selection: { instrument: profit_piece, reference: "plan", anchor: self.id, states: [paid], limit: max_history, where: { payment.status: { literal: "refunded" } } }, action: refund, input: {} }, { selection: { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: unwind, input: {} }, { reference: self.id, action: unwind_payoff_profit, input: {} }]
+    invoke: [{ selection: { instrument: all(financing.late_charge.receipt), reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: refund, input: {} }, { selection: { instrument: all(financing.late_charge.cost.receipt), reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: refund, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: max_history }, action: unwind_payoff, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: max_history }, action: unwind_payoff, input: {} }]
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due, paid], limit: 366, order: [position] }, action: cancel, input: {} }]
+    invoke: [{ selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [proposed, assessed, collected], limit: max_history }, action: cancel_undelivered, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [proposed, assessed, collected], limit: max_history }, action: cancel_undelivered, input: {} }]
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: unwind_financed, input: {} }] }
+  }
+  action unwind_payoff_profit {
+    from: cancelled, to: cancelled, actor: { parent: current() }
+    calculate: [{ target: payoffRefunds, op: aggregate, selection: { instrument: settlement, reference: "plan", anchor: self.id, states: [refunded], limit: 1, where: { identity: { field: self.settlementIdentity } } }, measure: count }]
+    invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [paid], limit: 366, where: { payoffIdentity: { field: self.settlementIdentity } } }, action: unwind_payoff, guard: { kind: compare, left: { field: self.payoffRefunds }, operator: "==", right: { literal: 1 } }, input: {} }]
   }
   records {
     write_off_request: {
@@ -243,7 +362,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         set: { acceptedAt: { field: self.now } }
         when assessed_fines is require_waiver { requires self.waiverPercent == 10000 }
         invoke: [{ selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.plan, states: [assessed, collected], limit: 366 }, action: waive_for_amendment, input: { amendment: { field: self.id } } }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.plan, states: [assessed, collected], limit: 366 }, action: waive_for_amendment, input: { amendment: { field: self.id } } }]
-        invoke: [{ selection: { instrument: all(collections.case), reference: "plan", anchor: self.plan, states: [opened, assigned], limit: 366 }, action: recall, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.plan, states: [proposed], limit: 366 }, action: cancel, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.plan, states: [proposed], limit: 366 }, action: cancel, input: {} }]
+        invoke: [{ selection: { instrument: all(collections.case), reference: "plan", anchor: self.plan, states: [opened, assigned], limit: 366 }, action: recall, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.plan, states: [proposed], limit: 366 }, action: cancel_for_amendment, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.plan, states: [proposed], limit: 366 }, action: cancel_for_amendment, input: {} }]
         invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.plan, states: [pending, due], limit: 366, order: [position] }, action: amend, input: { amendment: { field: self.id } } }]
         invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.plan, states: [paid], limit: 366 }, action: verify_fixed_date, input: { amendment: { field: self.id } } }]
       }
@@ -266,7 +385,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
     settlement: {
       fields { plan: ref<parent>, identity: text, principal: money, profit: money, loss: money, kind: enum(cash, loss), share: money?, retainedProfit: money?
         allocatedPayable: account(capital, cash, "allocatedProfitPayable"), capital: account(capital, cash, "capital"), profitIncome: account(capital, cash, "profitIncome"), lossAccount: account(capital, claim, "loss") }
-      lifecycle { states: [recorded, refunded], initial: recorded }
+      lifecycle { states: [recorded, distributed, refunded], initial: recorded }
       action create { allowZero: true,
         actor: { parent: parent }
         input { plan: ref<parent>, identity: text, principal: money, profit: money, loss: money, kind: enum(cash, loss) }
@@ -278,6 +397,16 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         from: recorded, to: refunded, actor: { parent: payment }
         moves self.share from self.allocatedPayable to self.profitIncome economics { purpose: internal, sourceParty: capital }
       }
+      action distribute { from: recorded, to: distributed, actor: { parent: all(lending.distribution) } }
+      // profitIncome is one account per capital party, so refunding profit a
+      // distribution already paid out would spend other plans' profit. unwind_paid
+      // unwinds only settlements still recorded; each marks its payment refunded,
+      // and the plan refunds the profit pieces and payoff profit behind them.
+      action unwind { allowZero: true,
+        from: recorded, to: refunded, actor: { parent: parent }
+        moves self.share from self.allocatedPayable to self.profitIncome economics { purpose: internal, sourceParty: capital }
+        invoke: [{ selection: { instrument: payment, reference: "plan", anchor: self.plan, states: [paid], limit: 1, where: { paymentIdentity: { field: self.identity } } }, action: unwind, input: {} }]
+      }
     }
     slice: {
       revisioned: true
@@ -289,7 +418,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         profitBase: money?, profitAllocated: money?, profitRemainder: money?, profitAdjustment: money?
         principal: money, profit: money, instalment: money
         principalReceivable: account(self, claim), profitReceivable: account(self, claim), profitEarned: account(self, claim)
-        payoffIdentity: text?, payoffRebate: money?, payoffProfitTotal: money?, payoffProfit: money?
+        payoffIdentity: text?, payoffRebate: money?, payoffProfitTotal: money?, payoffProfit: money?, payoffReceipt: text?
         paymentBudget: money?, principalPayment: money?, principalBasePayment: money?, principalRatio: money?, profitPayment: money?, profitBudget: money?, collectibleProfit: money?, collectibleTotal: money?, ratioDenominator: integer = sum(10000, profit_rate)
         debt: account(borrower, claim, contra, "debt"), loss: account(capital, claim, "loss")
       }
@@ -378,7 +507,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         when apply is principal_profit {
           invoke: [
             { instrument: principal_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.principalReceivable.balance } } }
-            { instrument: profit_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.collectibleProfit } } }
+            { instrument: profit_piece, action: create, input: { plan: { field: self.plan }, slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.collectibleProfit } } }
             { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [pending, due], limit: 1, where: { id: { field: self.id }, principalReceivable.balance: { literal: "0" }, profitReceivable.balance: { literal: "0" }, profitEarned.balance: { literal: "0" } } }, action: complete, input: {} }
           ]
         }
@@ -392,7 +521,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         invoke: [
           { selection: { instrument: all(financing.late_charge), reference: "slice", anchor: self.id, states: [assessed], limit: charge_limit, order: [overdueAt] }, action: collect, input: { payment: { field: input.payment } } }
           { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.plan, states: [assessed], limit: charge_limit, order: [overdueAt], where: { assessment.slice: { field: self.id } } }, action: collect, input: { payment: { field: input.payment } } }
-          { instrument: profit_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.collectibleProfit } } }
+          { instrument: profit_piece, action: create, input: { plan: { field: self.plan }, slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.collectibleProfit } } }
           { instrument: principal_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.principalReceivable.balance } } }
           { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [pending, due], limit: 1, where: { id: { field: self.id }, principalReceivable.balance: { literal: "0" }, profitReceivable.balance: { literal: "0" }, profitEarned.balance: { literal: "0" } } }, action: complete, input: {} }
         ]
@@ -417,7 +546,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         ]
         invoke: [
           { instrument: principal_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.principalPayment } } }
-          { instrument: profit_piece, action: create, input: { slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.profitPayment } } }
+          { instrument: profit_piece, action: create, input: { plan: { field: self.plan }, slice: { field: self.id }, payment: { field: input.payment }, limit: { field: self.profitPayment } } }
           { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [pending, due], limit: 1, where: { id: { field: self.id }, principalReceivable.balance: { literal: "0" }, profitReceivable.balance: { literal: "0" }, profitEarned.balance: { literal: "0" } } }, action: complete, input: {} }
         ]
       }
@@ -431,17 +560,21 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         set: { payoffIdentity: { field: input.identity } }
         calculate: [{ target: payoffRebate, op: rate, base: { field: self.profitReceivable.balance }, bps: { literal: payoff_rebate }, rounding: floor }, { target: payoffProfitTotal, op: sum, values: [{ field: self.profitReceivable.balance }, { field: self.profitEarned.balance }] }, { target: payoffProfit, op: subtract, base: { field: self.payoffProfitTotal }, subtract: [{ field: self.payoffRebate }] }]
         moves self.principalReceivable.balance from self.plan.borrower to self.plan.capital economics { purpose: principal, sourceParty: borrower }
-        moves self.payoffProfit from self.plan.borrower to self.plan.profitIncome economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
+        moves self.payoffProfit from self.plan.borrower to self.plan.profitIncome capture "payoffReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
         moves self.principalReceivable.balance from self.principalReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }
         moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }
         moves self.profitEarned.balance from self.profitEarned to self.debt economics { purpose: internal, sourceParty: programOperator }
       }
+      action unwind_payoff { allowZero: true,
+        from: paid, to: paid, actor: { parent: parent }
+        moves self.payoffProfit from self.plan.profitIncome to self.plan.borrower economics { recipient: capital, company: { purpose: earning, sourceParty: capital, reversalOf: self.payoffReceipt }, participant: unclassified }
+      }
       action write_off { allowZero: true,
         from: [pending, due], to: written_off, actor: { parent: parent }
         moves self.principalReceivable.balance from self.principalReceivable to self.loss economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.loss economics { purpose: internal, sourceParty: programOperator }
       }
       action cancel { allowZero: true,
-        from: [pending, due], to: cancelled, actor: { parent: parent }
+        from: [pending, due, paid], to: cancelled, actor: { parent: parent }
         moves self.principalReceivable.balance from self.principalReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitReceivable.balance from self.profitReceivable to self.debt economics { purpose: internal, sourceParty: programOperator }; moves self.profitEarned.balance from self.profitEarned to self.debt economics { purpose: internal, sourceParty: programOperator }
       }
     }
@@ -487,11 +620,16 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
       action record {
         from: paid, to: paid, actor: { parent: current() }
         requires self.held.balance == "0"
+        requires count of { instrument: current(), reference: "plan", anchor: self.plan, states: [paid], limit: 366 } <= self.plan.paymentLimit
+        requires count of { instrument: profit_piece, reference: "plan", anchor: self.plan, states: [paid], limit: 366 } <= self.plan.historyLimit
+        requires count of { instrument: all(financing.late_charge.receipt), reference: "plan", anchor: self.plan, states: [paid], limit: 366 } <= self.plan.historyLimit
+        requires count of { instrument: all(financing.late_charge.cost.receipt), reference: "plan", anchor: self.plan, states: [paid], limit: 366 } <= self.plan.historyLimit
         calculate: [{ target: principalReturned, op: aggregate, selection: { instrument: principal_piece, reference: "payment", anchor: self.id, states: [paid], limit: 366 }, measure: { sum: "amount" } }, { target: profitReturned, op: aggregate, selection: { instrument: profit_piece, reference: "payment", anchor: self.id, states: [paid], limit: 366 }, measure: { sum: "amount" } }]
         invoke: [{ reference: self.plan, action: record_payment, input: { identity: { field: self.paymentIdentity }, principal: { field: self.principalReturned }, profit: { field: self.profitReturned } } }]
       }
+      action unwind { from: paid, to: refunded, actor: { parent: [parent, settlement] } }
       action refund {
-        from: paid, to: refunded, actor: { party: capital }
+        from: paid, to: refunded, actor: { party: capital }, deadline: { at: self.plan.refundUntil }
         requires unique "settlement_consumption" on [self.plan, self.paymentIdentity]; requires self.plan in [active, paid]
         requires count of { instrument: settlement, reference: "plan", anchor: self.plan, states: [recorded], limit: 366, where: { identity: { field: self.paymentIdentity } } } == 1
         invoke: [{ selection: { instrument: settlement, reference: "plan", anchor: self.plan, states: [recorded], limit: 366, where: { identity: { field: self.paymentIdentity } } }, action: refund, input: {} }]
@@ -517,12 +655,12 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
       }
     }
     profit_piece: {
-      fields { cashReceipt: text?, slice: ref<slice>, payment: ref<payment>, limit: money, amount: money? }
+      fields { cashReceipt: text?, plan: ref<parent>, slice: ref<slice>, payment: ref<payment>, limit: money, amount: money? }
       lifecycle { states: [paid, refunded], initial: paid }
       action create { allowZero: true,
         calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.limit }] }]
         actor: { parent: slice }
-        input { slice: ref<slice>, payment: ref<payment>, limit: money }
+        input { plan: ref<parent>, slice: ref<slice>, payment: ref<payment>, limit: money }
         requires unique "profit_receipt" on [self.slice, self.payment]
         moves self.amount from self.payment.held to self.slice.plan.profitIncome capture "cashReceipt" economics { recipient: capital, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }
         when profit_earned is on_payment { moves self.amount from self.slice.profitReceivable to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
@@ -530,7 +668,7 @@ instrument installments(months: integer(1, 366), pricing: enum(amortizing, flat_
         when profit_earned is at_disbursement { moves self.amount from self.slice.profitEarned to self.slice.debt economics { purpose: internal, sourceParty: programOperator } }
       }
       action refund { allowZero: true,
-        from: paid, to: refunded, actor: { parent: payment }
+        from: paid, to: refunded, actor: { parent: [payment, parent] }
         moves self.amount from self.slice.plan.profitIncome to self.slice.plan.borrower economics { recipient: capital, company: { purpose: earning, sourceParty: capital, reversalOf: self.cashReceipt }, participant: unclassified }
         when profit_earned is on_payment { moves self.amount from self.slice.debt to self.slice.profitReceivable economics { purpose: internal, sourceParty: borrower } }
         when profit_earned is by_schedule { moves self.amount from self.slice.debt to self.slice.profitEarned economics { purpose: internal, sourceParty: borrower } }
@@ -552,11 +690,11 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
   familyRevision: 1
   summary: "Separate fine and evidenced recovery claims on an overdue installment."
   fields {
-    plan: ref<on>, slice: ref<on.slice>, borrower: account of borrower, fine: money = fine, overdueAt: date?
+    plan: ref<on>, slice: ref<on.slice>, borrower: account of borrower, fine: money = fine, overdueAt: date?, payoffAmount: money?, payoffReceipt: text?
     receivable: account(self, claim), debt: account(borrower, claim, contra, "debt")
   }
   lifecycle { states: [proposed, assessed, collected, waived], initial: proposed }
-  action create { input { slice: ref<on.slice>? }, calculate: [{ target: overdueAt, op: shift, date: { field: self.slice.dueAt }, milliseconds: { literal: grace }, direction: after }], requires unique "late_assessment" on [self.slice, self.overdueAt]; requires self.borrower == self.slice.plan.borrower; requires self.plan == self.slice.plan }
+  action create { input { slice: ref<on.slice>? }, calculate: [{ target: overdueAt, op: shift, date: { field: self.slice.dueAt }, milliseconds: { literal: grace }, direction: after }, { target: payoffAmount, op: sum, values: [{ literal: "0" }] }], requires unique "late_assessment" on [self.slice, self.overdueAt]; requires self.borrower == self.slice.plan.borrower; requires self.plan == self.slice.plan; requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.plan, states: [proposed, assessed, collected], limit: 366 } < self.plan.historyLimit }
   action assess { allowZero: true,
     from: proposed, to: assessed, actor: clock, due: { at: self.overdueAt }
     requires self.slice.principalReceivable.balance > "0"
@@ -566,16 +704,23 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
     from: [assessed, collected], to: assessed, actor: { parent: child(on, slice) }, input { payment: ref<on.payment> }
     requires input.payment in [paid]
     requires input.payment.plan == self.plan
-    invoke: [{ instrument: receipt, action: create, input: { assessment: { field: self.id }, payment: { field: input.payment } } }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
+    invoke: [{ instrument: receipt, action: create, input: { plan: { field: self.plan }, assessment: { field: self.id }, payment: { field: input.payment } } }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
   }
   action payoff { allowZero: true,
     from: [assessed, collected], to: collected, actor: { parent: on }
     requires self.plan in [paid]
-    moves self.receivable.balance from self.plan.borrower to fines_to economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
-    moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator }
+    calculate: [{ target: payoffAmount, op: sum, values: [{ field: self.receivable.balance }] }]
+    moves self.payoffAmount from self.plan.borrower to fines_to capture "payoffReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
+    moves self.payoffAmount from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator }
+  }
+  action unwind_payoff { allowZero: true,
+    from: collected, to: collected, actor: { parent: on }
+    moves self.payoffAmount from fines_to to self.plan.borrower economics { recipient: fines_to, company: { purpose: earning, sourceParty: fines_to, reversalOf: self.payoffReceipt }, participant: unclassified }
   }
   action finish { from: assessed, to: collected, actor: { parent: current() }, requires self.receivable.balance == "0" }
-  action cancel { from: proposed, to: waived }
+  action cancel { from: proposed, to: waived, actor: { party: programOperator } }
+  action cancel_for_amendment { from: proposed, to: waived, actor: { parent: child(on, amendment) } }
+  action cancel_undelivered { allowZero: true, from: [proposed, assessed, collected], to: waived, actor: { parent: on }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
   action waive_for_amendment {
     from: [assessed, collected], to: assessed, actor: { parent: child(on, amendment) }, input { amendment: ref<on.amendment> }
     requires input.amendment.plan == self.plan; requires input.amendment in [applied]
@@ -583,7 +728,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
   }
   action waive { allowZero: true, from: [assessed, collected], to: waived, actor: { parent: waiver_request }, input { reason: text, evidence: text }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
   action refund {
-    from: [assessed, collected], to: assessed, actor: { party: fines_to }, input { payment: ref<on.payment> }
+    from: [assessed, collected], to: assessed, actor: { party: fines_to }, input { payment: ref<on.payment> }, deadline: { at: self.plan.refundUntil }
     requires input.payment in [paid, refunded]
     requires input.payment.plan == self.plan
     invoke: [{ selection: { instrument: receipt, reference: "payment", anchor: input.payment, states: [paid], limit: 1, where: { assessment: { field: self.id } } }, action: refund, input: {} }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
@@ -610,20 +755,20 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
       }
     }
     receipt: {
-      fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
+      fields { cashReceipt: text?, plan: ref<on>, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
       lifecycle { states: [paid, refunded], initial: paid }
-      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
-      action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from fines_to to self.payment.plan.borrower economics { recipient: fines_to, company: { purpose: earning, sourceParty: fines_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
+      action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { plan: ref<on>, assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "fine_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to fines_to capture "cashReceipt" economics { recipient: fines_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+      action refund { allowZero: true, from: paid, to: refunded, actor: { parent: [parent, on] }, moves self.amount from fines_to to self.payment.plan.borrower economics { recipient: fines_to, company: { purpose: earning, sourceParty: fines_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
     }
 
     cost: {
       revisioned: true
       fields {
-        plan: ref<on>, assessment: ref<parent>, overdueAt: date?, evidence: text, evidencedCost: money, amount: money = minimum(self.evidencedCost, cap)
+        plan: ref<on>, assessment: ref<parent>, overdueAt: date?, evidence: text, evidencedCost: money, amount: money = minimum(self.evidencedCost, cap), payoffAmount: money?, payoffReceipt: text?
         receivable: account(self, claim), debt: account(borrower, claim, contra, "debt")
       }
       lifecycle { states: [proposed, assessed, collected, waived], initial: proposed }
-      action create { calculate: [{ target: overdueAt, op: shift, date: { field: self.assessment.overdueAt }, milliseconds: { literal: 0 }, direction: after }], requires unique "recovery_assessment" on [self.assessment]; requires self.plan == self.assessment.plan }
+      action create { actor: { party: programOperator }, calculate: [{ target: overdueAt, op: shift, date: { field: self.assessment.overdueAt }, milliseconds: { literal: 0 }, direction: after }, { target: payoffAmount, op: sum, values: [{ literal: "0" }] }], requires unique "recovery_assessment" on [self.assessment]; requires self.plan == self.assessment.plan; requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.plan, states: [proposed, assessed, collected], limit: 366 } < self.plan.historyLimit }
       action assess { allowZero: true,
         from: proposed, to: assessed, actor: clock, due: { at: self.assessment.overdueAt }
         requires self.assessment.slice.principalReceivable.balance > "0"
@@ -633,16 +778,23 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
         from: [assessed, collected], to: assessed, actor: { parent: child(on, slice) }, input { payment: ref<on.payment> }
         requires input.payment in [paid]
         requires input.payment.plan == self.plan
-        invoke: [{ instrument: receipt, action: create, input: { assessment: { field: self.id }, payment: { field: input.payment } } }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
+        invoke: [{ instrument: receipt, action: create, input: { plan: { field: self.plan }, assessment: { field: self.id }, payment: { field: input.payment } } }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
       }
       action payoff { allowZero: true,
         from: [assessed, collected], to: collected, actor: { parent: on }
         requires self.plan in [paid]
-        moves self.receivable.balance from self.plan.borrower to costs_to economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
-        moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator }
+        calculate: [{ target: payoffAmount, op: sum, values: [{ field: self.receivable.balance }] }]
+        moves self.payoffAmount from self.plan.borrower to costs_to capture "payoffReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: borrower } }
+        moves self.payoffAmount from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator }
+      }
+      action unwind_payoff { allowZero: true,
+        from: collected, to: collected, actor: { parent: on }
+        moves self.payoffAmount from costs_to to self.plan.borrower economics { recipient: costs_to, company: { purpose: earning, sourceParty: costs_to, reversalOf: self.payoffReceipt }, participant: unclassified }
       }
       action finish { from: assessed, to: collected, actor: { parent: current() }, requires self.receivable.balance == "0" }
-      action cancel { from: proposed, to: waived }
+      action cancel { from: proposed, to: waived, actor: { party: programOperator } }
+      action cancel_for_amendment { from: proposed, to: waived, actor: { parent: child(on, amendment) } }
+      action cancel_undelivered { allowZero: true, from: [proposed, assessed, collected], to: waived, actor: { parent: on }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
       action waive_for_amendment {
         from: [assessed, collected], to: assessed, actor: { parent: child(on, amendment) }, input { amendment: ref<on.amendment> }
         requires input.amendment.plan == self.plan; requires input.amendment in [applied]
@@ -650,7 +802,7 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
       }
       action waive { allowZero: true, from: [assessed, collected], to: waived, actor: { parent: waiver_request }, input { reason: text, evidence: text }, moves self.receivable.balance from self.receivable to self.debt economics { purpose: internal, sourceParty: programOperator } }
       action refund {
-        from: [assessed, collected], to: assessed, actor: { party: costs_to }, input { payment: ref<on.payment> }
+        from: [assessed, collected], to: assessed, actor: { party: costs_to }, input { payment: ref<on.payment> }, deadline: { at: self.plan.refundUntil }
         requires input.payment in [paid, refunded]
         requires input.payment.plan == self.plan
         invoke: [{ selection: { instrument: receipt, reference: "payment", anchor: input.payment, states: [paid], limit: 1, where: { assessment: { field: self.id } } }, action: refund, input: {} }, { selection: { instrument: current(), reference: "plan", anchor: self.plan, states: [assessed], limit: 1, where: { id: { field: self.id }, receivable.balance: { literal: "0" } } }, action: finish, input: {} }]
@@ -677,10 +829,10 @@ instrument late_charge(on: ref<financing.installments>[], grace: duration = 3d,
           }
         }
         receipt: {
-          fields { cashReceipt: text?, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
+          fields { cashReceipt: text?, plan: ref<on>, assessment: ref<parent>, payment: ref<on.payment>, amount: money? }
           lifecycle { states: [paid, refunded], initial: paid }
-          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
-          action refund { allowZero: true, from: paid, to: refunded, actor: { parent: parent }, moves self.amount from costs_to to self.payment.plan.borrower economics { recipient: costs_to, company: { purpose: earning, sourceParty: costs_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
+          action create { allowZero: true, calculate: [{ target: amount, op: minimum, values: [{ field: self.payment.held.balance }, { field: self.assessment.receivable.balance }] }], actor: { parent: parent }, input { plan: ref<on>, assessment: ref<parent>, payment: ref<on.payment> }, requires input.payment.plan == self.assessment.plan; requires unique "cost_receipt" on [self.assessment, self.payment]; moves self.amount from self.payment.held to costs_to capture "cashReceipt" economics { recipient: costs_to, company: { purpose: earning, sourceParty: borrower }, participant: { purpose: pass_through, sourceParty: programOperator } }; moves self.amount from self.assessment.receivable to self.assessment.debt economics { purpose: internal, sourceParty: programOperator } }
+          action refund { allowZero: true, from: paid, to: refunded, actor: { parent: [parent, on] }, moves self.amount from costs_to to self.payment.plan.borrower economics { recipient: costs_to, company: { purpose: earning, sourceParty: costs_to, reversalOf: self.cashReceipt }, participant: unclassified }; moves self.amount from self.assessment.debt to self.assessment.receivable economics { purpose: internal, sourceParty: borrower } }
         }
       }
     }
@@ -693,8 +845,8 @@ instrument limits(per_borrower: money, borrower: party = party(person), active_p
   summary: "One outstanding balance ceiling per borrower."
   fields { borrower: account of borrower, limit: money = per_borrower, activePlans: integer = active_plans }
   lifecycle { states: [pending, approved], initial: pending }
-  action create { requires unique "borrower_limit" on [self.borrower] }
-  action approve { from: pending, to: approved }
+  action create { actor: { party: borrower }, requires unique "borrower_limit" on [self.borrower] }
+  action approve { from: pending, to: approved, actor: { party: programOperator } }
 }
 
 instrument portfolio_limit(limit: money) {
@@ -703,8 +855,8 @@ instrument portfolio_limit(limit: money) {
   summary: "One shared ceiling on the principal the product may hold."
   fields { key: text = "portfolio", limit: money = limit }
   lifecycle { states: [pending, approved], initial: pending }
-  action create { requires unique "portfolio_limit" on [self.key] }
-  action approve { from: pending, to: approved }
+  action create { actor: { party: programOperator }, requires unique "portfolio_limit" on [self.key] }
+  action approve { from: pending, to: approved, actor: { party: programOperator } }
 }
 
 instrument credit_line(borrower: party = programOperator, adapter: text, limit: money, expires: date) {
@@ -712,29 +864,29 @@ instrument credit_line(borrower: party = programOperator, adapter: text, limit:
   summary: "A revolving facility from an outside lender; each draw is a separate immutable advance."
   fields { borrower: account of borrower, facility: account(borrower, cash, "facility"), debt: account(borrower, claim, contra, "debt"), limit: money = limit, expiresAt: date = expires }
   lifecycle { states: [pending, active, suspended, closed], initial: pending }
-  action create {}
+  action create { actor: { party: borrower } }
   action activate {
     from: pending, to: active, actor: { party: borrower }
     subject { adapter: adapter }
   }
   action suspend { from: active, to: suspended, actor: { party: borrower } }
   action resume { from: suspended, to: active, actor: { party: borrower } }
-  action close { from: [active, suspended], to: closed, due: { at: self.expiresAt }, requires count of { instrument: all(financing.advance), reference: "line", anchor: self.id, states: [drawn], limit: 366 } == 0 }
+  action close { from: [active, suspended], to: closed, actor: { party: borrower }, due: { at: self.expiresAt }, requires count of { instrument: all(financing.advance), reference: "line", anchor: self.id, states: [drawn], limit: 366 } == 0 }
 }
 
-instrument advance(line: ref<financing.credit_line>, amount: money = runtime) {
+instrument advance(line: ref<financing.credit_line>, amount: money = runtime, borrower: party = programOperator) {
   familyRevision: 1
   summary: "A single facility draw with an immutable principal and full repayment."
-  fields { line: ref<line>, amount: money = amount, principalReceivable: account(self, claim) }
+  fields { line: ref<line>, borrower: account of borrower, amount: money = amount, principalReceivable: account(self, claim) }
   lifecycle { states: [pending, drawn, repaid, cancelled], initial: pending }
-  action create { requires self.amount <= self.line.limit }
+  action create { actor: { party: borrower }, requires self.borrower == self.line.borrower; requires self.amount <= self.line.limit }
   invariants sum "principalReceivable.balance" of { instrument: all(financing.advance), reference: "line", anchor: self.line, states: [drawn], limit: 366 } <= self.line.limit
   action draw {
-    from: pending, to: drawn
+    from: pending, to: drawn, actor: { party: borrower }
     requires self.line in [active]
     deadline: { at: self.line.expiresAt }
     moves self.amount from self.line.facility to self.line.borrower; moves self.amount from self.line.debt to self.principalReceivable
   }
-  action repay { from: drawn, to: repaid, moves self.amount from self.line.borrower to self.line.facility; moves self.amount from self.principalReceivable to self.line.debt }
-  action cancel { from: pending, to: cancelled }
+  action repay { from: drawn, to: repaid, actor: { party: borrower }, moves self.amount from self.line.borrower to self.line.facility; moves self.amount from self.principalReceivable to self.line.debt }
+  action cancel { from: pending, to: cancelled, actor: { party: borrower } }
 }