@hyperscale0/hsx 1.0.265 → 1.0.284

package/std/booking.hsx

@@ -7,7 +7,8 @@ header booking
 // Expose create, pay_deposit and pay_balance for the booking path, and
 // cancel_early, cancel_middle and cancel_late for the customer. Create captures
 // subject departure, price, deposit and balance, and refuses a deposit and balance
-// that do not add up to the price. The balance is payable only after the deposit
+// that do not add up to the price. Both installments must be positive. Creation
+// and deposit payment close at the balance cutoff. The balance is payable only after the deposit
 // and before balance_due ahead of departure, so a cancelled booking never offers
 // it. cancel_early runs until early_until before departure and returns everything
 // held. cancel_middle runs from then until late_from; cancel_late runs from then
@@ -22,6 +23,7 @@ header booking
 // composed counts.
 
 instrument reservation(customer: party = party(person), operator: party = programOperator, early_until: duration = 30d, late_from: duration = 15d, balance_due: duration = 15d, middle_forfeit: percent = 0%, late_forfeit: percent = 0%) {
+  constraints { late_from: less_than(early_until) }
   revisioned: true
   summary: "Take a deposit and a balance for a dated booking, with cancellation windows before departure."
   fields {
@@ -38,11 +40,14 @@ instrument reservation(customer: party = party(person), operator: party = progra
   action create {
     subject { departure: date, price: money, deposit: money, balance: money }
     actor: { party: customer }
-    requires self.departure > self.now
+    requires self.balanceAt > self.now
+    requires self.departure > self.balanceAt
+    requires self.deposit > "0"
+    requires self.balance > "0"
     requires self.split == self.price
   }
   action pay_deposit {
-    from: reserved, to: deposit_paid, actor: { party: customer }
+    from: reserved, to: deposit_paid, actor: { party: customer }, deadline: { at: self.balanceAt }
     moves self.deposit from customer to self.held economics { purpose: principal, sourceParty: customer }
   }
   action pay_balance {

package/std/collections.hsx

@@ -30,7 +30,7 @@ instrument case(on: ref<financing.installments>[], agency: party, capital: party
     requires unique "overdue_referral" on [self.slice]
   }
   action assign { from: opened, to: assigned, actor: { party: capital } }
-  action recover { expansionLimit: 8192, from: assigned, to: recovered, actor: { party: agency }, requires self.payment.plan == self.plan, invoke: [{ reference: self.payment, action: pay, input: {} }, { reference: self.id, action: pay_fee, input: {} }] }
+  action recover { from: assigned, to: recovered, actor: { party: agency }, requires self.payment.plan == self.plan, invoke: [{ reference: self.payment, action: pay, input: {} }, { reference: self.id, action: pay_fee, input: {} }] }
   action pay_fee { allowZero: true, from: recovered, to: recovered, actor: { parent: current() }, moves self.agencyFee from self.plan.capital to agency economics { recipient: agency, company: { recipient: capital, company: { purpose: internal, sourceParty: capital }, participant: { purpose: earning, sourceParty: capital } }, participant: { recipient: capital, company: { purpose: participant_payout, sourceParty: capital }, participant: { purpose: pass_through, sourceParty: capital } } } }
   action recall { from: [opened, assigned], to: recalled, actor: { party: capital } }
   action return_uncollected { from: assigned, to: returned_uncollected, actor: { party: agency } }

package/std/escrow.hsx

@@ -8,30 +8,17 @@ header escrow
 // subject.price; acceptance pays payee less the configured fee, not payer.
 // Expose dispute, verify_return and refund separately for the return path.
 // Payer disputes delivered goods; payee verifies return evidence from disputed.
-// Payee refunds the whole held balance before delivery, or from return_verified
-// by default after a dispute. While a financing plan funds the hold in any state
-// but cancelled, both refunds refuse, so a written-off plan never hands lender
-// principal to the payer. Only unwind returns the principal to capital and
-// cancels the plan; after that, refund returns the rest. Before delivery the
-// Product operator runs the plan's unwind_undelivered instead, which invokes
-// unwind_financed here to return the rest to the payer and close the hold.
-// For a paid plan, the plan's unwind_paid runs unwind_financed from funded after
-// deliverBy, and return_hold or unwind_paid runs it from return_verified,
-// depending on the plan's returned_goods.
-// Only an installments plan can run confirm and unwind_financed. In a program
-// without financing neither action exists, so every hold reaches funded through
-// fund, which sets fundedAt. The plan's confirm leaves fundedAt unset, so
-// refund_undelivered never comes due on a financed hold and no schedule offers
-// it. Confirm sets deliverBy, deliver_within after confirmation, and the plan's
-// unwind_paid waits for it so the payee keeps the whole delivery window.
+// Refunds return the held balance to the payer. A composition can supply funding
+// controllers and the states in which they block direct refunds. Only those
+// controllers may confirm outside funding or finish its coordinated refund.
 // Expose refund_undelivered to let the payer take the whole held price back once
 // deliver_within has passed since funding without delivery. It is a payer action
 // that becomes available at that time; nothing runs it automatically.
 // The Product operator settles any disputed hold: settle_release pays the payee
 // as acceptance would, and settle_return moves it to return_verified. Without a
-// live plan, settle_return also runs settle_refund to return the whole balance
-// to the payer. A financed return continues on the plan's returned-goods path,
-// and once that plan is cancelled the operator's settle_refund returns the rest.
+// active funding controller, settle_return also runs settle_refund to return
+// the whole balance to the payer. Otherwise the controller coordinates the
+// return before the operator's settle_refund returns the rest.
 // Acceptance expiry enters disputed, never released. Neither verify_return nor
 // refund becomes public merely because dispute is exposed. Clock actions remain
 // internal. Expose cancel for a pending hold, including a checkout-funded hold;
@@ -42,12 +29,12 @@ header escrow
 // transfer; accept expands the configured fee and tax into moves. Run hsx cost
 // on the composed program for instruction counts. The executor supplies prices.
 
-instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, deliver_within: duration = 14d, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }) {
+instrument hold(payer: party = party(person), payee: party = programOperator, accept_within: duration = 48h, deliver_within: duration = 14d, fee: fee = { seller: 0%, tax: 0% }, dispute: policy = { refund_after: return_verified }, funding: policy = { controllers: [], reference: "funds", blocking_states: [active] }) {
   revisioned: true
   summary: "Hold the subject price through delivery, acceptance and verified return."
   fields {
     payer: account of payer, payee: account of payee
-    held: account of self, fundedAt: date?, deliverBy: date?, deliveredAt: date?, openPlans: integer?
+    held: account of self, fundedAt: date?, deliverBy: date?, deliveredAt: date?, blockingFunding: integer?
     price: money = subject.price
   }
   lifecycle { states: [pending, funded, delivered, disputed, return_verified, released, refunded, cancelled], initial: pending }
@@ -61,7 +48,7 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
     moves self.price from payer to self.held economics { purpose: principal, sourceParty: payer }
   }
   action confirm {
-    from: pending, to: funded, actor: { parent: all(financing.installments) }
+    from: pending, to: funded, actor: { parent: funding.controllers }
     requires self.held.balance == self.price
     calculate: [{ target: deliverBy, op: shift, date: { field: self.now }, milliseconds: { literal: deliver_within }, direction: after }]
   }
@@ -95,27 +82,27 @@ instrument hold(payer: party = party(person), payee: party = programOperator, ac
   action settle_return {
     from: disputed, to: return_verified, actor: { party: programOperator }
     input { ruling: text }
-    calculate: [{ target: openPlans, op: aggregate, selection: { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 }, measure: count }]
-    invoke: [{ reference: self.id, action: settle_refund, guard: { kind: compare, left: { field: self.openPlans }, operator: "==", right: { literal: 0 } }, input: {} }]
+    calculate: [{ target: blockingFunding, op: aggregate, selection: { instrument: funding.controllers, reference: funding.reference, anchor: self.id, states: funding.blocking_states, limit: 1 }, measure: count }]
+    invoke: [{ reference: self.id, action: settle_refund, guard: { kind: compare, left: { field: self.blockingFunding }, operator: "==", right: { literal: 0 } }, input: {} }]
   }
   action settle_refund { allowZero: true,
     from: return_verified, to: refunded, actor: { party: programOperator }
-    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 } == 0
+    requires count of { instrument: funding.controllers, reference: funding.reference, anchor: self.id, states: funding.blocking_states, limit: 1 } == 0
     moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
   action refund {
     from: [funded, dispute.refund_after], to: refunded, actor: { party: payee }
-    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 } == 0
+    requires count of { instrument: funding.controllers, reference: funding.reference, anchor: self.id, states: funding.blocking_states, limit: 1 } == 0
     moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
   action refund_undelivered {
     from: funded, to: refunded, actor: { party: payer }
     due: { at: self.fundedAt, offset: deliver_within }
-    requires count of { instrument: all(financing.installments), reference: "funds", anchor: self.id, states: [quoted, signed, active, paid, written_off], limit: 1 } == 0
+    requires count of { instrument: funding.controllers, reference: funding.reference, anchor: self.id, states: funding.blocking_states, limit: 1 } == 0
     moves self.price from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
-  action unwind_financed { allowZero: true,
-    from: [funded, return_verified], to: refunded, actor: { parent: all(financing.installments) }
+  action finish_refund { allowZero: true,
+    from: [funded, return_verified], to: refunded, actor: { parent: funding.controllers }
     moves self.held.balance from self.held to payer economics { purpose: principal, sourceParty: programOperator }
   }
   action cancel { allowZero: true,

package/std/financing.hsx

@@ -10,13 +10,9 @@ header financing
 // flat_total reads it as one charge on principal for the whole term (murabaha,
 // fixed-fee pay-later). 12,000 at 18% over 12 months costs 13,201.95 amortizing
 // and 14,160 flat_total.
-// Expose create and sign on installments, then collect_down_payment as checkout
-// for disburse_to: funds. Checkout requires a signed plan and pending escrow;
-// it tops up only the missing down payment, without advancing lender principal.
-// Disburse still collects any missing down payment, activates slices, and confirms
-// the fully funded hold. Existing escrow credit counts once toward the down payment.
-// Disburse first credits an active marketplace.reservation on the same hold,
-// so list the plan in its converters; the deposit then counts as escrow credit.
+// Expose create and sign on installments. A funding composition owns checkout,
+// destination funding and returns when disburse_to is funds. The repayment plan
+// owns principal, profit, limits and debt cancellation.
 // disburse_to: seller pays principal to the seller party at activation (pay later
 // with the merchant paid on day one). Capital may refund any paid payment to
 // the borrower. Payments stay refundable while the plan is active. The
@@ -70,9 +66,9 @@ header financing
 // settle returned goods too.
 // Borrower- and seller-directed disbursement exclude collect_down_payment. A down_payment
 // there reduces principal but does not collect cash. Price is subject metadata,
-// not the borrower limit. The escrow payer and price must match the plan.
-// Expose escrow cancel to return checkout cash if financing is abandoned; plan
-// void alone cancels the agreement and does not refund its separate escrow.
+// not the borrower limit. The funding composition checks its payer and price.
+// Cancelling a plan cancels its debt agreement. Its funding composition owns
+// returning any cash collected before activation.
 // Approve borrower and portfolio limits before disbursement. Create builds the
 // dated slice records from future, strictly increasing dates; disbursement
 // refuses once a slice is due. Payments need a separate payment record and pay action.
@@ -93,12 +89,12 @@ header financing
 // bounded invocations across slices and assessments. Month and charge limits affect
 // the bound. Run hsx cost on the selected policies; profit is not a platform tariff.
 
-instrument installments(months: integer(1, 366), max_history: integer(2, 366) = 366, pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, refund_within: duration = 30d, returned_goods: enum(keep_profit, refund_all) = keep_profit, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref<escrow.hold>?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
+instrument installments(months: integer(1, 366), max_history: integer(2, 366) = 366, pricing: enum(amortizing, flat_total), profit_rate: percent, charge_limit: integer(1, 3) = 3, disburse_to: enum(funds, borrower, seller) = funds, seller: party?, profit_earned: enum(on_payment, by_schedule, at_disbursement) = on_payment, apply: enum(fines_profit_principal, principal_profit, pro_rata) = fines_profit_principal, payoff_rebate: percent = 100%, write_off_after: duration = 90d, max_extension: duration = 90d, max_amendments: integer(0, 366) = 2, waiver_limit: percent = 100%, amendment_expiry: duration = 7d, payoff_quote_expiry: duration = 1h, refund_within: duration = 30d, returned_goods: enum(keep_profit, refund_all) = keep_profit, allow_overdue: enum(allowed, blocked) = allowed, assessed_fines: enum(carry, require_waiver) = carry, down_payment: percent = 0%, funds: ref?, borrower: party = party(person), capital: party = programOperator, share: percent = 0%, limits: ref<financing.limits> = object(financing.limits), portfolio: ref<financing.portfolio_limit> = object(financing.portfolio_limit)) {
   dependencies {
     funds {
       selector: disburse_to, is: funds
       message: "Attachment `{attachment}` disburses into a hold, but `funds` is not bound."
-      fix: "Bind `funds: sale` to an escrow attachment. Choose `disburse_to: seller` to pay a seller on activation, or `disburse_to: borrower` only if the borrower should receive the money directly."
+      fix: "Bind `funds: checkout` to a funding composition. Choose `disburse_to: seller` to pay a seller on activation, or `disburse_to: borrower` only if the borrower should receive the money directly."
     }
     seller {
       selector: disburse_to, is: seller
@@ -113,7 +109,7 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     funds: ref<funds>?, borrower: account of borrower, settlementIdentity: text, borrowerLimit: ref<limits>, portfolioLimit: ref<portfolio>
     months: integer = months, dates: list(date, months), historyLimit: integer = max_history, paymentLimit: integer = subtract(max_history, 1)
     allocatedPayable: account(capital, cash, "allocatedProfitPayable"), capital: account(capital, cash, "capital"), profitIncome: account(capital, cash, "profitIncome"), loss: account(capital, claim, "loss")
-    downPaymentRemaining: money?, downPaymentCredit: money?, principalOutstanding: money?, principalRepaid: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?, refundWindow: date?, refundUntil: date?
+    principalOutstanding: money?, principalRepaid: money?, principalReturned: money?, profitReturned: money?, lossRecorded: money?, refundWindow: date?, refundUntil: date?
     openSlices: integer?, openCharges: money?, openCosts: money?, payoffRefunds: integer?
     price: money = subject.price
     downPayment: money = rate(self.price, down_payment)
@@ -129,7 +125,7 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     actor: { party: borrower }
     requires self.borrowerLimit.borrower == self.borrower
     when pricing is flat_total { calculate: [{ target: flatProfit, op: rate, base: { field: self.principal }, bps: { literal: profit_rate }, rounding: floor }] }
-    when disburse_to is funds { requires self.borrower == self.funds.payer; requires self.price == self.funds.price }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: check, input: { plan: { field: self.id } } }] }
     invoke: [{ range: { count: { literal: months }, maximum: months, bind: position }, instrument: slice, action: create, input: { plan: { field: self.id }, borrowerLimit: { field: self.borrowerLimit }, portfolioLimit: { field: self.portfolioLimit }, position: { field: position } } }, { selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: months, where: { first: { literal: 0 } } }, action: check_order, input: {} }]
   }
   action sign {
@@ -140,32 +136,16 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     from: signed, to: signed, actor: { party: borrower }
     when disburse_to is borrower { requires true == false }
     when disburse_to is seller { requires true == false }
-    when disburse_to is funds {
-      requires self.funds in [pending]
-      calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: self.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: self.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
-      moves self.downPaymentRemaining from self.borrower to self.funds.held economics { purpose: principal, sourceParty: borrower }
-    }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: collect, input: { plan: { field: self.id } } }] }
   }
   action disburse { allowZero: true,
     from: signed, to: active, actor: { party: capital }
     requires self.borrowerLimit in [approved]
     requires self.portfolioLimit in [approved]
-    when disburse_to is funds {
-      requires self.funds in [pending]
-      invoke: [{ selection: { instrument: all(marketplace.reservation), reference: "funds", anchor: self.funds, states: [active], limit: 1 }, action: credit, input: { funds: { field: self.funds }, contribution: { field: self.downPayment } } }, { reference: self.id, action: fund_down_payment, input: {} }]
-    }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: disburse, input: { plan: { field: self.id } } }] }
     when disburse_to is borrower { moves self.principal from self.capital to self.borrower economics { purpose: principal, sourceParty: capital } }
     when disburse_to is seller { moves self.principal from self.capital to seller economics { purpose: principal, sourceParty: capital } }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [draft], limit: 366, order: [position] }, action: activate, input: {} }]
-    when disburse_to is funds { invoke: [{ reference: self.funds, action: confirm, input: {} }] }
-  }
-  action fund_down_payment { allowZero: true,
-    from: active, to: active, actor: { parent: current() }
-    when disburse_to is funds {
-      calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: self.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: self.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
-      moves self.downPaymentRemaining from self.funds.payer to self.funds.held economics { purpose: principal, sourceParty: borrower }
-      moves self.principal from self.capital to self.funds.held economics { purpose: principal, sourceParty: capital }
-    }
   }
   action complete {
     from: active, to: paid
@@ -201,7 +181,7 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     set: { refundUntil: { field: self.refundWindow } }
     due: { at: input.overdueSlice.lossEligibleAt }
     requires input.overdueSlice.plan == self.id; requires input.overdueSlice.principalReceivable.balance > "0"
-    when disburse_to is funds { requires self.funds in [released] }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: write_off, input: { plan: { field: self.id } } }] }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: write_off, input: {} }, { instrument: settlement, action: create, input: { plan: { field: self.id }, identity: { field: self.settlementIdentity }, principal: { literal: "0" }, profit: { literal: "0" }, loss: { field: self.lossRecorded }, kind: { literal: "loss" } } }]
   }
   action record_payment {
@@ -226,7 +206,6 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     ]
     set: { refundUntil: { field: self.refundWindow } }
     when disburse_to is borrower { requires true == false }
-    when disburse_to is funds { requires self.funds in [return_verified] }
     when returned_goods is refund_all {
       requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
       requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
@@ -234,7 +213,7 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     }
     requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [assessed], limit: 366 } == 0
     requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [assessed], limit: 366 } == 0
-    when disburse_to is funds { moves self.principalOutstanding from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: refund, input: { plan: { field: self.id }, principal: { field: self.principalOutstanding } } }] }
     when disburse_to is seller {
       moves self.principalOutstanding from seller to self.capital economics { purpose: principal, sourceParty: seller }
       moves self.principalRepaid from seller to self.borrower economics { purpose: principal, sourceParty: seller }
@@ -247,14 +226,12 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     set: { refundUntil: { field: self.refundWindow } }
     when disburse_to is borrower { requires true == false }
     when disburse_to is seller { requires true == false }
-    when disburse_to is funds { requires self.funds in [funded] }
     requires count of { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: 366 } == 0
     requires count of { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
     requires count of { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: 366 } == 0
-    when disburse_to is funds { moves self.principal from self.funds.held to self.capital economics { purpose: principal, sourceParty: capital } }
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due], limit: 366, order: [position] }, action: cancel, input: {} }]
     invoke: [{ selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [proposed, assessed], limit: 366 }, action: cancel_undelivered, input: {} }]
-    when disburse_to is funds { invoke: [{ reference: self.funds, action: unwind_financed, input: {} }] }
+    when disburse_to is funds { invoke: [{ reference: self.funds, action: cancel_undelivered, input: { plan: { field: self.id } } }] }
   }
   action return_hold {
     from: paid, to: paid, actor: { party: programOperator }
@@ -263,24 +240,21 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
     when disburse_to is seller { requires true == false }
     when returned_goods is refund_all { requires true == false }
     when disburse_to is funds {
-      requires self.funds in [return_verified]
-      invoke: [{ reference: self.funds, action: unwind_financed, input: {} }]
+      invoke: [{ reference: self.funds, action: return_paid, input: { plan: { field: self.id } } }]
     }
   }
-  action unwind_paid { expansionLimit: 8192,
+  action unwind_paid {
     from: paid, to: cancelled, actor: { party: programOperator }
     when disburse_to is borrower { requires true == false }
     when disburse_to is seller { requires true == false }
-    when disburse_to is funds {
-      when returned_goods is keep_profit { requires self.funds in [funded] }
-      when returned_goods is refund_all { requires self.funds in [funded, return_verified] }
-      requires self.funds.deliverBy < self.now
-    }
     invoke: [{ selection: { instrument: settlement, reference: "plan", anchor: self.id, states: [recorded], limit: max_history }, action: unwind, input: {} }, { selection: { instrument: profit_piece, reference: "plan", anchor: self.id, states: [paid], limit: max_history, where: { payment.status: { literal: "refunded" } } }, action: refund, input: {} }, { selection: { instrument: payment, reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: unwind, input: {} }, { reference: self.id, action: unwind_payoff_profit, input: {} }]
     invoke: [{ selection: { instrument: all(financing.late_charge.receipt), reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: refund, input: {} }, { selection: { instrument: all(financing.late_charge.cost.receipt), reference: "plan", anchor: self.id, states: [paid], limit: max_history }, action: refund, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [collected], limit: max_history }, action: unwind_payoff, input: {} }, { selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [collected], limit: max_history }, action: unwind_payoff, input: {} }]
     invoke: [{ selection: { instrument: slice, reference: "plan", anchor: self.id, states: [pending, due, paid], limit: 366, order: [position] }, action: cancel, input: {} }]
     invoke: [{ selection: { instrument: all(financing.late_charge.cost), reference: "plan", anchor: self.id, states: [proposed, assessed, collected], limit: max_history }, action: cancel_undelivered, input: {} }, { selection: { instrument: all(financing.late_charge), reference: "plan", anchor: self.id, states: [proposed, assessed, collected], limit: max_history }, action: cancel_undelivered, input: {} }]
-    when disburse_to is funds { invoke: [{ reference: self.funds, action: unwind_financed, input: {} }] }
+    when disburse_to is funds {
+      when returned_goods is keep_profit { invoke: [{ reference: self.funds, action: unwind_paid_undelivered, input: { plan: { field: self.id } } }] }
+      when returned_goods is refund_all { invoke: [{ reference: self.funds, action: unwind_paid, input: { plan: { field: self.id } } }] }
+    }
   }
   action unwind_payoff_profit {
     from: cancelled, to: cancelled, actor: { parent: current() }
@@ -593,7 +567,6 @@ instrument installments(months: integer(1, 366), max_history: integer(2, 366) =
       lifecycle { states: [pending, paid, refunded], initial: pending }
       action create { input { plan: ref<parent>, amount: money, paymentIdentity: text } requires self.plan in [active]; requires unique "payment_identity" on [self.plan, self.paymentIdentity] }
       action pay {
-        expansionLimit: 8192
         from: pending, to: paid, actor: { party: borrower }
         calculate: [{ target: outstandingPrincipal, op: aggregate, selection: { instrument: slice, reference: "plan", anchor: self.plan, states: [pending, due, paid], limit: 366, order: [position] }, measure: { sum: "principalReceivable.balance" } }]
         when profit_earned is on_payment { calculate: [{ target: outstandingProfit, op: aggregate, selection: { instrument: slice, reference: "plan", anchor: self.plan, states: [pending, due, paid], limit: 366, order: [position] }, measure: { sum: "profitReceivable.balance" } }] }

package/std/money.hsx

@@ -147,24 +147,22 @@ instrument swap(first: party, second: party, first_amount: money, second_amount:
   action expire_both { from: both_ready, to: cancelled, actor: clock, due: { at: self.expiresAt }, moves void self.firstReceipt; moves void self.secondReceipt }
 }
 
-instrument payout(payer: party, payee: party, adapter: text, max_age: duration, amount: money = runtime) {
-  summary: "Reserve funds until matching terminal boundary evidence permits posting."
-  fields { amount: money = amount, receipt: text? }
+instrument payout(payer: party, payee: party, adapter: text, amount: money = runtime) {
+  summary: "Pay the recipient when the provider confirms settlement."
+  fields { amount: money = amount }
   lifecycle { states: [pending, instructed, settled, rejected], initial: pending }
   action create {}
   action instruct {
     from: pending, to: instructed, actor: { party: payer }
-    moves reserve self.amount from payer to payee capture "receipt" boundary adapter
+    moves reserve self.amount from payer to payee boundary adapter
   }
   action confirm {
     from: instructed, to: settled
-    requires evidence self.id family boundary check outcome result confirmed maxAge max_age instruction self.receipt
-    moves post self.receipt
+    moves post instruct
   }
   action reject {
     from: instructed, to: rejected
-    requires evidence self.id family boundary check outcome result rejected maxAge max_age instruction self.receipt
-    moves void self.receipt
+    moves void instruct
   }
 }
 

package/std/purchase.hsx

@@ -0,0 +1,89 @@
+header purchase
+
+// A financed purchase connects a repayment plan, a delivery hold and optional
+// marketplace reservations. The hold blocks refunds while checkout is active.
+// Debt cancellation returns outstanding capital before the buyer's own cash.
+instrument checkout(plans: ref<financing.installments>[], funds: ref<escrow.hold>, borrower: party, capital: party = programOperator) {
+  summary: "Fund a purchase and return lender capital before refunding the buyer."
+  fields {
+    funds: ref<funds>, borrower: account of borrower
+    downPaymentCredit: money?, downPaymentRemaining: money?
+  }
+  lifecycle { states: [pending, active, closed], initial: pending }
+  action create { actor: { party: borrower } }
+  action check {
+    from: pending, to: pending, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires input.plan.borrower == self.borrower
+    requires input.plan.borrower == self.funds.payer
+    requires input.plan.price == self.funds.price
+  }
+  action collect { allowZero: true,
+    from: pending, to: pending, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [pending]
+    calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: input.plan.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: input.plan.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
+    moves self.downPaymentRemaining from self.borrower to self.funds.held economics { purpose: principal, sourceParty: borrower }
+  }
+  action disburse {
+    from: pending, to: active, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [pending]
+    invoke: [{ selection: { instrument: all(marketplace.reservation), reference: "funds", anchor: self.funds, states: [active], limit: 1 }, action: credit, input: { funds: { field: self.funds }, contribution: { field: input.plan.downPayment } } }, { reference: self.id, action: fund, input: { plan: { field: input.plan } } }]
+  }
+  action fund { allowZero: true,
+    from: active, to: active, actor: { parent: current() }
+    input { plan: ref<plans> }
+    calculate: [{ target: downPaymentCredit, op: minimum, values: [{ field: self.funds.held.balance }, { field: input.plan.downPayment }] }, { target: downPaymentRemaining, op: subtract, base: { field: input.plan.downPayment }, subtract: [{ field: self.downPaymentCredit }] }]
+    moves self.downPaymentRemaining from self.borrower to self.funds.held economics { purpose: principal, sourceParty: borrower }
+    moves input.plan.principal from input.plan.capital to self.funds.held economics { purpose: principal, sourceParty: capital }
+    invoke: [{ reference: self.funds, action: confirm, input: {} }]
+  }
+  action write_off {
+    from: active, to: active, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [released]
+  }
+  action refund { allowZero: true,
+    from: active, to: closed, actor: { parent: plans }
+    input { plan: ref<plans>, principal: money }
+    requires input.plan.funds == self.id
+    requires self.funds in [return_verified]
+    moves input.principal from self.funds.held to input.plan.capital economics { purpose: principal, sourceParty: capital }
+  }
+  action cancel_undelivered { allowZero: true,
+    from: active, to: closed, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [funded]
+    moves input.plan.principal from self.funds.held to input.plan.capital economics { purpose: principal, sourceParty: capital }
+    invoke: [{ reference: self.funds, action: finish_refund, input: {} }]
+  }
+  action return_paid {
+    from: active, to: closed, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [return_verified]
+    invoke: [{ reference: self.funds, action: finish_refund, input: {} }]
+  }
+  action unwind_paid_undelivered {
+    from: active, to: closed, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [funded]
+    requires self.funds.deliverBy < self.now
+    invoke: [{ reference: self.funds, action: finish_refund, input: {} }]
+  }
+  action unwind_paid {
+    from: active, to: closed, actor: { parent: plans }
+    input { plan: ref<plans> }
+    requires input.plan.funds == self.id
+    requires self.funds in [funded, return_verified]
+    requires self.funds.deliverBy < self.now
+    invoke: [{ reference: self.funds, action: finish_refund, input: {} }]
+  }
+}

package/std/reporting.hsx

@@ -12,7 +12,7 @@ header reporting
 // That zero instruction count does not price report capture, rendering, storage or
 // release. The host owns those charges and their execution.
 
-instrument portfolio(on: ref<financing.installments>[], default_days: integer(1, 3650) = 90, retention_years: integer(1, 100) = 10, aging_first_days: integer(1, 3650) = 30, aging_second_days: integer(1, 3650) = 60, aging_third_days: integer(1, 3650) = 90, ratio_scale: integer(1, 1000000) = 10000, ratio_rounding: enum(floor, halfUp) = floor, lock_wait_ms: integer(1, 2000) = 2000, capture_ms: integer(1, 10000) = 10000, max_rows: integer(1, 100000) = 10000, max_join_rows: integer(1, 1000000) = 100000, max_bytes: integer(1024, 16777216) = 8388608) {
+instrument portfolio(on: ref<financing.installments>[], default_days: integer(1, 3650) = 90, retention_years: integer(1, 100) = 10, aging_first_days: integer(1, 3650) = 30, aging_second_days: integer(1, 3650) = 60, aging_third_days: integer(1, 3650) = 90, ratio_scale: integer(1, 1000000) = 10000, ratio_rounding: enum(floor, halfUp) = floor) {
   summary: "Declared financing reports evaluated over frozen Product facts."
   fields {}
   lifecycle { states: [declared], initial: declared }
@@ -333,11 +333,6 @@ instrument portfolio(on: ref<financing.installments>[], default_days: integer(1,
           { left: "scheduleCount", right: "capturedScheduleCount" }
         ],
         unavailableFacts: [  ],
-        lockTimeoutMs: lock_wait_ms,
-        captureTimeoutMs: capture_ms,
-        maxRows: max_rows,
-        maxJoinRows: max_join_rows,
-        maxBytes: max_bytes
       },
       output: {
         profile: "internal.v1",
@@ -679,11 +674,6 @@ instrument portfolio(on: ref<financing.installments>[], default_days: integer(1,
           { left: "scheduleCount", right: "capturedScheduleCount" }
         ],
         unavailableFacts: [  ],
-        lockTimeoutMs: lock_wait_ms,
-        captureTimeoutMs: capture_ms,
-        maxRows: max_rows,
-        maxJoinRows: max_join_rows,
-        maxBytes: max_bytes
       },
       output: {
         profile: "internal.v1",