@hyperscale0/hsx 1.0.130 → 1.0.134

package/std/lending.hsx

@@ -5,12 +5,17 @@ header lending
 // principal/profit distributions and unbound source owners remain unclassified.
 
 // Round target is plan.principal from runtime subject.price, not its credit limit.
-// Expose round.create and close plus commitment.create and withdraw. A commitment
+// The operator opens the round and closes it before closesAt. Expose
+// round.create and close plus commitment.create and withdraw. A commitment
 // debits the bound investor's original active wallet before closesAt. Investor cap
-// aggregates by investor across wallets. Failure refunds those original wallets.
+// aggregates by investor across wallets. A round still open at closesAt fails,
+// even when fully committed, and refunds those original wallets.
 // Closing needs the exact target; it funds plan.capital and does not disburse the
 // loan. Expose plan.disburse separately after signing and limit approval.
-// Distribution.create needs a recorded, unconsumed settlement matching the plan.
+// Distribution.create needs a recorded settlement matching the plan. Only the
+// payout consumes it: distribute_cash or distribute_loss claims the settlement
+// and marks it distributed, so the plan's unwind_paid keeps that profit, while an
+// abandoned distribution leaves the settlement refundable.
 // Prepare cash or loss first, then create shares against funded commitments of
 // that round. Distribution needs pending share weights equal to the round target.
 // Cash fee is a percentage of retained profit, VAT a percentage of that fee.
@@ -30,7 +35,7 @@ instrument round(borrower: party, plan: ref<financing.installments> = object(fin
     held: account of self
   }
   lifecycle { states: [open, funded, failed], initial: open }
-  action create { requires unique "funding_plan" on [self.plan]; requires self.borrower == self.plan.borrower }
+  action create { actor: { party: operator }, requires unique "funding_plan" on [self.plan]; requires self.borrower == self.plan.borrower }
   action close {
     from: open, to: funded, actor: { party: operator }
     requires sum "amount" of { instrument: commitments, reference: "round", anchor: self.id, states: [committed], limit: 366 } == self.price
@@ -40,7 +45,6 @@ instrument round(borrower: party, plan: ref<financing.installments> = object(fin
   }
   action fail {
     from: open, to: failed, actor: clock, due: { at: self.closesAt }
-    requires self.held.balance < self.price
     invoke: [{ selection: { instrument: commitments, reference: "round", anchor: self.id, states: [committed], limit: 366 }, action: refund, input: {} }]
   }
 }
@@ -81,7 +85,9 @@ instrument distribution(round: ref<lending.round>, receipt: ref, commitments: re
     held: account of self, losses: account(self, claim), residualLoss: account(residual_to, claim, "loss")
   }
   lifecycle { states: [pending, cash_ready, loss_ready, distributed], initial: pending }
-  action create { requires self.round in [funded]; requires self.source in [recorded]; requires self.source.plan == self.round.plan; requires unique "settlement_consumption" on [self.source.plan, self.source.identity] }
+  action create {
+    requires self.round in [funded]; requires self.source in [recorded]; requires self.source.plan == self.round.plan
+  }
   action prepare_cash {
     from: pending, to: cash_ready
     requires self.mode == "cash"; requires self.source.kind == "cash"; requires self.source in [recorded]
@@ -101,9 +107,10 @@ instrument distribution(round: ref<lending.round>, receipt: ref, commitments: re
   }
   action distribute_cash { allowZero: true,
     from: cash_ready, to: distributed, actor: { party: operator }
+    requires self.source in [recorded]; requires unique "settlement_consumption" on [self.source.plan, self.source.identity]
     requires sum "weight" of { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 } == self.round.price
     moves self.principal from self.source.capital to self.held; moves self.profit from self.source.profitIncome to self.held; moves self.charge from self.held to programOperator economics { purpose: internal, sourceParty: programOperator }; moves self.vat from self.held to programTax economics { purpose: pass_through, sourceParty: programOperator }
-    invoke: [{ selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: cash, input: {} }, { reference: self.id, action: residual_cash, input: {} }]
+    invoke: [{ reference: self.source, action: distribute, input: {} }, { selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: cash, input: {} }, { reference: self.id, action: residual_cash, input: {} }]
   }
   action residual_cash { allowZero: true,
     from: distributed, to: distributed, actor: { parent: current() }
@@ -111,9 +118,10 @@ instrument distribution(round: ref<lending.round>, receipt: ref, commitments: re
   }
   action distribute_loss { allowZero: true,
     from: loss_ready, to: distributed, actor: { party: operator }
+    requires self.source in [recorded]; requires unique "settlement_consumption" on [self.source.plan, self.source.identity]
     requires sum "weight" of { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 } == self.round.price
     moves self.net from self.source.lossAccount to self.losses
-    invoke: [{ selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: loss, input: {} }, { reference: self.id, action: residual_loss, input: {} }]
+    invoke: [{ reference: self.source, action: distribute, input: {} }, { selection: { instrument: share, reference: "distribution", anchor: self.id, states: [pending], limit: 366 }, action: loss, input: {} }, { reference: self.id, action: residual_loss, input: {} }]
   }
   action residual_loss { allowZero: true,
     from: distributed, to: distributed, actor: { parent: current() }

package/std/marketplace.hsx

@@ -4,7 +4,8 @@ header marketplace
 // earning for the company or passes the buyer's cash through to a bound outside recipient.
 
 // Listing, order and reservation are separate agreements. Expose their create
-// and decision actions individually. Order fulfillment does not move escrow cash.
+// and decision actions individually. Order fulfillment does not move escrow cash;
+// only the fulfiller marks it, the Product operator unless the seller is bound.
 // Pair an order with escrow.hold and expose its fund, deliver, accept, dispute,
 // verify_return and refund aliases. Refund needs disputed -> return_verified,
 // with payee evidence, then returns the full price to payer; accept pays payee.
@@ -34,7 +35,7 @@ instrument listing(seller: party) {
   action sell { from: active, to: sold, actor: { party: seller }, requires count of { instrument: all(marketplace.reservation), reference: "listing", anchor: self.id, states: [active], limit: 366 } == 0 }
 }
 
-instrument order(listing: ref<marketplace.listing>, buyer: party) {
+instrument order(listing: ref<marketplace.listing>, buyer: party, fulfiller: party = programOperator) {
   revisioned: true
   summary: "A buyer's order for one listing at its declared price."
   fields { listing: ref<listing>, buyer: account of buyer, price: money, reservations: integer?, ownReservations: integer?, blockingQuotes: integer?, ownBlockingQuotes: integer? }
@@ -60,7 +61,7 @@ instrument order(listing: ref<marketplace.listing>, buyer: party) {
     requires count of { instrument: current(), reference: "listing", anchor: self.listing, states: [placed, fulfilled], limit: 366 } <= 1
   }
   invariants count of { instrument: current(), reference: "listing", anchor: self.listing, states: [placed, fulfilled], limit: 366 } <= 1
-  action fulfill { from: placed, to: fulfilled }
+  action fulfill { from: placed, to: fulfilled, actor: { party: fulfiller } }
   action cancel { from: [quoted, placed], to: cancelled, actor: { party: buyer } }
 }
 

package/std/money.hsx

@@ -7,15 +7,20 @@ header money
 // Expose each attachment's create and caller actions explicitly. A transfer or
 // split pays once; a hold exposes fund, release and refund separately. Release
 // pays payee and refund returns payer. A hold has no dispute or damage decision.
-// A schedule needs count unique occurrence records before activation; each due
-// occurrence pays only while the schedule is active. A due time promises no retry.
+// The payee proposes a schedule, which creates its count occurrences, and only
+// the payer activates or cancels it. Each due occurrence pays only while the
+// schedule is active. A due time promises no retry.
 // A pool accepts whole contributions only up to its remaining target and at most
 // 366 paid records. Expose pay to release the exact target. Clock failure refunds
 // original contributors; excess acceptance and partial contribution are absent.
 // A swap reserves both legs before exchange or voids reservations on expiry.
 // Payout instruct reserves across the selected adapter; confirm/reject require
 // matching terminal instruction evidence. An acknowledgement cannot settle it.
-// Metered bill charges a unique usage identity at the fixed unit price.
+// Metered bill charges a unique usage identity at the fixed unit price, only
+// under an active mandate the payer created: bills stop at its expiresAt, and at
+// most 366 billed events across every metered attachment on the mandate may sum
+// their payer debit, buyer fee and tax included, to its limit. The payer revokes
+// it to stop billing. Only the payee cancels its own unbilled usage.
 
 // Cost: transfer.pay declares one transfer. Hold.create declares one owned account;
 // fund, release and refund each declare one transfer. Schedules and pools add bounded
@@ -70,16 +75,16 @@ instrument schedule(payer: party, payee: party, amount: money = runtime, count:
   summary: "A finite schedule whose dated pieces sum exactly to the declared total."
   fields { amount: money = amount, count: integer = count, dates: list(date, count) }
   lifecycle { states: [draft, active, complete, cancelled], initial: draft }
-  action create {}
-  action activate {
-    from: draft, to: active
-    requires count of { instrument: occurrence, reference: "schedule", anchor: self.id, states: [pending], limit: 366 } == self.count
+  action create {
+    actor: { party: payee }
+    invoke: [{ range: { count: { literal: count }, maximum: count, bind: position }, instrument: occurrence, action: create, input: { schedule: { field: self.id }, position: { field: position } } }]
   }
+  action activate { from: draft, to: active, actor: { party: payer } }
   action complete {
     from: active, to: complete
     requires count of { instrument: occurrence, reference: "schedule", anchor: self.id, states: [pending], limit: 366 } == 0
   }
-  action cancel { from: [draft, active], to: cancelled }
+  action cancel { from: [draft, active], to: cancelled, actor: { party: payer } }
   records {
     occurrence: {
       fields {
@@ -92,7 +97,7 @@ instrument schedule(payer: party, payee: party, amount: money = runtime, count:
         amount: money = sum(self.base, self.adjustment)
       }
       lifecycle { states: [pending, paid, cancelled], initial: pending }
-      action create { requires self.schedule in [draft]; requires unique "scheduled_position" on [self.schedule, self.position] }
+      action create { actor: { parent: parent }, input { schedule: ref<parent>, position: integer(1, count) }, requires unique "scheduled_position" on [self.schedule, self.position] }
       action pay { allowZero: true, from: pending, to: paid, actor: clock, due: { at: self.dueAt }, requires self.schedule in [active], moves self.amount from payer to payee }
       action cancel { from: pending, to: cancelled, requires self.schedule in [cancelled] }
     }
@@ -163,11 +168,20 @@ instrument payout(payer: party, payee: party, adapter: text, max_age: duration,
   }
 }
 
-instrument metered(payer: party, payee: party, unit_price: money, units: integer = 1, fee: fee = { seller: 0% }) {
+instrument mandate(payer: party, payee: party) {
+  summary: "A payer's permission for one payee to charge up to a total until it expires."
+  fields { payer: account of payer, payee: account of payee, limit: money, expiresAt: date }
+  lifecycle { states: [active, revoked], initial: active }
+  action create { actor: { party: payer }, requires self.limit > "0" }
+  action revoke { from: active, to: revoked, actor: { party: payer } }
+}
+
+instrument metered(payer: party, payee: party, unit_price: money, units: integer = 1, fee: fee = { seller: 0% }, mandate: ref<money.mandate> = object(money.mandate)) {
   summary: "A unique usage event priced once at the fixed unit price."
-  fields { usageIdentity: text, unitPrice: money = unit_price, units: integer = units, amount: money = multiply(self.unitPrice, self.units) }
+  fields { usageIdentity: text, mandate: ref<mandate>, payer: account of payer, payee: account of payee, unitPrice: money = unit_price, units: integer = units, amount: money = multiply(self.unitPrice, self.units) }
   lifecycle { states: [recorded, billed, cancelled], initial: recorded }
-  action create { requires unique "usage_event" on [self.usageIdentity] }
-  action bill { allowZero: true, requires self.amount > "0"; from: recorded, to: billed, actor: { party: payee }, moves self.amount from payer to payee fee fee }
-  action cancel { from: recorded, to: cancelled }
+  invariants sum "bill_move1_debit" of { instrument: all(money.metered), reference: "mandate", anchor: self.mandate, states: [billed], limit: 366 } <= self.mandate.limit
+  action create { requires unique "usage_event" on [self.usageIdentity]; requires self.mandate.payer == self.payer; requires self.mandate.payee == self.payee }
+  action bill { allowZero: true, requires self.amount > "0"; from: recorded, to: billed, actor: { party: payee }, deadline: { at: self.mandate.expiresAt }, requires self.mandate in [active], moves self.amount from payer to payee fee fee }
+  action cancel { from: recorded, to: cancelled, actor: { party: payee } }
 }

package/std/savings.hsx

@@ -17,6 +17,7 @@ header savings
 // Late and out-of-order collection is admitted while membership is active or
 // received and circle is active. Clock admission does not promise scheduler retry.
 // Circle.close needs every membership received and an empty held account.
+// Only the Product operator disbands a forming circle.
 // Circle creation collects circleDates, one date per member for contributions and payouts.
 
 // Cost: circle.create declares one owned account. Each contribution payment
@@ -37,14 +38,14 @@ instrument circle(contribution: money, members: integer(1, 60), starts: date, me
     requires count of { instrument: memberships, reference: "circle", anchor: self.id, states: [received], limit: 60 } == self.members
     requires self.held.balance == "0"
   }
-  action disband { from: forming, to: disbanded }
+  action disband { from: forming, to: disbanded, actor: { party: programOperator } }
 }
 
 instrument membership(circle: ref<savings.circle>, member: party) {
   summary: "A member contributes on the circle calendar and receives the pot in the assigned seat."
   fields { circle: ref<circle>, member: account of member, seat: integer(1, 60), preceding: integer = subtract(self.seat, 1), receivesAt: date = at(self.circle.circleDates, self.seat), contribution: money = self.circle.contribution, total: money = self.circle.pot }
   lifecycle { states: [joined, active, received, withdrawn], initial: joined }
-  action create { requires self.seat <= self.circle.members; requires self.circle in [forming]; requires unique "circle_seat" on [self.circle, self.seat]; requires unique "circle_member" on [self.circle, self.member] }
+  action create { actor: { party: member }, requires self.seat <= self.circle.members; requires self.circle in [forming]; requires unique "circle_seat" on [self.circle, self.seat]; requires unique "circle_member" on [self.circle, self.member] }
   action activate {
     from: joined, to: active
     requires self.circle in [active]

package/std/wallet.hsx

@@ -7,7 +7,9 @@ header wallet
 // Expose balance.create, activate, topup and withdraw as needed. Holder moves
 // cash only while active. Freeze blocks new topups, withdrawals and spend reserves;
 // close requires no held cash. Only the Product operator freezes or unfreezes.
-// A separate spend record checks its amount against spendLimit at creation.
+// The holder closes the wallet, or the Product operator with operator_close.
+// Only the wallet holder creates a spend record, which checks its amount against
+// spendLimit; bind the spend holder to the balance holder.
 // Expose reserve, pay and cancel for the bound payee. Reserve requires an active
 // wallet before expiresAt; pay posts the whole reservation, cancel/expiry void it.
 // Existing reservations may still post after the wallet freezes. There is no
@@ -25,7 +27,7 @@ instrument balance(holder: party, spend_limit: money = 100000 SAR, topup_fee: pe
   summary: "A holder's reusable balance with an immutable per-spend ceiling."
   fields { holder: account of holder, held: account of self, spendLimit: money = spend_limit, topupFee: money?, topupCredit: money? }
   lifecycle { states: [pending, active, frozen, closed], initial: pending }
-  action create { }
+  action create { actor: { party: holder } }
   action activate { from: pending, to: active, actor: { party: holder } }
   action topup {
     allowZero: true, requires input.amount > "0"
@@ -45,15 +47,18 @@ instrument balance(holder: party, spend_limit: money = 100000 SAR, topup_fee: pe
   }
   action freeze { from: active, to: frozen, actor: { party: programOperator } }
   action unfreeze { from: frozen, to: active, actor: { party: programOperator } }
-  action close { from: [pending, active], to: closed, requires self.held.balance == "0" }
+  action close { from: [pending, active], to: closed, actor: { party: holder }, requires self.held.balance == "0" }
+  action operator_close { from: [pending, active], to: closed, actor: { party: programOperator }, requires self.held.balance == "0" }
 }
 
-instrument spend(wallet: ref<wallet.balance>, payee: party) {
+instrument spend(wallet: ref<wallet.balance>, payee: party, holder: party = party(person)) {
   summary: "Reserve one wallet spend, then post or void the same reservation."
-  fields { wallet: ref<wallet>, amount: money, expiresAt: date, reservation: text? }
+  fields { wallet: ref<wallet>, holder: account of holder, amount: money, expiresAt: date, reservation: text? }
   lifecycle { states: [pending, reserved, paid, cancelled, expired], initial: pending }
   action create {
+    actor: { party: holder }
     requires self.wallet in [active]
+    requires self.wallet.holder == self.holder
     requires self.amount <= self.wallet.spendLimit
   }
   action reserve {