@hyperscale0/udl 2.2.0 → 2.4.0

package/dist/validation.js

@@ -1,3 +1,5 @@
+import { referencePatternPrefix } from "./reference.js";
+import { validateVocabulary } from "./vocabulary.js";
 import { Validator, } from "@cfworker/json-schema";
 import { z } from "zod";
 import { udlClauseVocabulary, quoteExpiresAtRefKey, quoteFrozenRefKey, quoteSeededRefKeys, udlDocumentSchema, } from "./schema.js";
@@ -17,6 +19,12 @@ export class UdlError extends Error {
         this.issues = Object.freeze([...issues]);
     }
 }
+/**
+ * Validate a complete document. Clause references to instruments must resolve
+ * within this document, even when the reference field is optional. A catalogue
+ * slice must include its referenced instruments; an external catalogue cannot
+ * supply missing product laws. Reference fields use the sealed public ID grammar.
+ */
 export function validateUdl(value, options = {}) {
     const resourceIssue = structuralBudgetIssue(value);
     if (resourceIssue)
@@ -211,11 +219,21 @@ function semanticIssues(document, references, options) {
     validateDocumentSchemas(document, add);
     if (issues.length > 0)
         return issues;
+    // Vocabulary laws must accumulate with the existing semantic diagnostics.
+    validateVocabulary(document.instruments, (path, message) => add(path, message, path.some((part) => [
+        "attests",
+        "requiresInput",
+        "engineOwned",
+        "captureEngine",
+        "unique",
+        "port",
+    ].includes(String(part)))
+        ? "UDL5001"
+        : shapeIssueCode(path)));
     addDuplicateIssues(document.subjects.map((subject) => subject.kind), ["subjects"], "subject kind", add);
     addDuplicateIssues(document.instruments.map((instrument) => instrument.id), ["instruments"], "instrument id", add);
     addDuplicateIssues(document.instruments.map((instrument) => instrument.idPrefix), ["instruments"], "instrument idPrefix", add);
     validateCompositionDials(document, add);
-    validateInstrumentJourneys(document, add);
     const subjects = new Map(document.subjects.map((subject) => [subject.kind, subject]));
     const instruments = new Map(document.instruments.map((instrument) => [instrument.id, instrument]));
     for (const [subjectIndex, subject] of document.subjects.entries()) {
@@ -280,121 +298,6 @@ function semanticIssues(document, references, options) {
     }
     return issues;
 }
-const scopedIdPattern = /^\^([a-z]{2,8})_\(sandbox\|live\)_\[a-z0-9\]\{8,64\}\$$/;
-function camel(value) {
-    return value.replace(/_([a-z0-9])/g, (_match, character) => character.toUpperCase());
-}
-function journeyReferenceFields(instrument, actionName) {
-    const action = instrument.actions[actionName];
-    if (!action)
-        return new Map();
-    const fields = new Map();
-    const addSchema = (name, schema) => {
-        const pattern = recordValue(schema).pattern;
-        if (typeof pattern !== "string")
-            return;
-        const prefix = scopedIdPattern.exec(pattern)?.[1];
-        if (prefix)
-            fields.set(name, prefix);
-    };
-    if (actionName === "create") {
-        const derivedFields = new Set((action.requiresRefs ?? []).flatMap((gate) => Object.keys(gate.bind ?? {})));
-        for (const name of instrument.required) {
-            if (!derivedFields.has(name))
-                addSchema(name, instrument.fields[name]);
-        }
-    }
-    else {
-        fields.set(`${camel(instrument.id)}Id`, instrument.idPrefix);
-    }
-    const input = recordValue(action.input);
-    const required = Array.isArray(input.required)
-        ? input.required.filter((name) => typeof name === "string")
-        : [];
-    const properties = recordValue(input.properties);
-    for (const name of required)
-        addSchema(name, properties[name]);
-    return fields;
-}
-/**
- * Validate the part of authored journeys that canonical UDL can prove alone.
- * A caller with the operation catalog validates root-operation examples and
- * cross-kind bindings. UDL owns local examples, lifecycle order, and local
- * reference completeness so raw UDL cannot bypass those laws.
- */
-function validateInstrumentJourneys(document, add) {
-    const instruments = new Map(document.instruments.map((instrument) => [instrument.id, instrument]));
-    for (const [instrumentIndex, owner] of document.instruments.entries()) {
-        for (const [journeyIndex, journey] of (owner.journeys ?? []).entries()) {
-            const base = [
-                "instruments",
-                instrumentIndex,
-                "journeys",
-                journeyIndex,
-            ];
-            const seen = new Set();
-            const createdKindByStep = new Map();
-            const stateByStep = new Map();
-            for (const [stepIndex, step] of journey.steps.entries()) {
-                const stepBase = [...base, "steps", stepIndex];
-                if (step.id) {
-                    if (seen.has(step.id)) {
-                        add([...stepBase, "id"], `journey ${journey.id} declares step id ${step.id} more than once`, "journey_duplicate_step_id");
-                    }
-                }
-                const [instrumentId, actionName] = step.operation.split(".");
-                const instrument = instrumentId
-                    ? instruments.get(instrumentId)
-                    : undefined;
-                const action = instrument && actionName ? instrument.actions[actionName] : undefined;
-                if (!instrument) {
-                    if (step.id)
-                        seen.add(step.id);
-                    continue;
-                }
-                if (!action || !actionName) {
-                    add([...stepBase, "operation"], `journey ${journey.id} names unknown operation ${step.operation}`, "journey_unknown_operation");
-                    continue;
-                }
-                if (!action.examples?.some((example) => example.name === step.example)) {
-                    add([...stepBase, "example"], `journey ${journey.id} names unknown example ${step.example} on ${step.operation}`, "journey_unknown_example");
-                }
-                for (const [field, prefix] of journeyReferenceFields(instrument, actionName)) {
-                    const producer = step.bind[field];
-                    if (!producer || !seen.has(producer)) {
-                        add([...stepBase, "bind", field], `journey ${journey.id} must bind ${step.operation}.${field} to an earlier step`, "journey_unbound_reference");
-                        continue;
-                    }
-                    const producedPrefix = createdKindByStep.get(producer);
-                    if (producedPrefix && producedPrefix !== prefix) {
-                        add([...stepBase, "bind", field], `journey ${journey.id} binds ${step.operation}.${field} to ${producer}, which creates ${producedPrefix} instead of ${prefix}`, "journey_unbound_reference");
-                    }
-                }
-                if (actionName === "create") {
-                    if (step.id) {
-                        createdKindByStep.set(step.id, instrument.idPrefix);
-                        stateByStep.set(step.id, instrument.lifecycle.initial);
-                        seen.add(step.id);
-                    }
-                    continue;
-                }
-                const transition = instrument.lifecycle.transitions[actionName];
-                if (!transition)
-                    continue;
-                const ownProducer = step.bind[`${camel(instrument.id)}Id`];
-                const state = ownProducer ? stateByStep.get(ownProducer) : undefined;
-                if (state && !transition.from.includes(state)) {
-                    add([...stepBase, "operation"], `journey ${journey.id} runs ${step.operation} from ${state}; allowed states are ${transition.from.join(", ")}`, "journey_invalid_transition");
-                }
-                else if (ownProducer) {
-                    stateByStep.set(ownProducer, transition.to);
-                }
-                if (step.id)
-                    seen.add(step.id);
-            }
-        }
-    }
-}
 function structuralBudgetIssue(value) {
     let discovered = 1;
     let nodes = 0;
@@ -915,76 +818,272 @@ function validateInstrument(instrument, instrumentIndex, instruments, subjects,
             }
         }
     }
-    // Multi-variant finance oracle check across action plan combinations
-    const actionsWithPlans = Object.keys(instrument.actions).filter((aName) => planResolution.plans.some((p) => p.action === aName));
+    for (const finIssue of instrumentFinanceIssues(instrument, {
+        plans: planResolution.plans,
+    })) {
+        add([...base, ...finIssue.path], finIssue.message, finIssue.code);
+    }
+    validateAggregates(instrument, base, instruments, references, add);
+}
+/**
+ * The finance oracle over an instrument's resolved action plans, with paths
+ * rooted at the instrument. A piece-plan instrument is unfolded over the
+ * runtime's piece progress; any other instrument runs once per action plan
+ * combination. Contract-side callers pass the UDL projection of a blueprint
+ * definition so both boundaries prove the same machine.
+ */
+export function instrumentFinanceIssues(instrument, options = {}) {
+    const plans = options.plans ?? resolveUdlActionPlans(instrument).plans;
+    const financeOptions = options.penaltyMayBeNonzero === undefined
+        ? {}
+        : { penaltyMayBeNonzero: options.penaltyMayBeNonzero };
+    const issues = [];
+    const seen = new Set();
+    const add = (path, message, code) => {
+        const key = `${code}:${path.join(".")}:${message}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        issues.push({ code, message, path });
+    };
+    const expansion = instrument.piecePlan
+        ? expandPieceProgress(instrument, plans)
+        : undefined;
+    if (expansion === "bound") {
+        add(["actions"], `piece progress expansion exceeds reachable variant bound of ${UDL_LIMITS.maxActionExpansion}`, "UDL2010");
+        return issues;
+    }
+    if (expansion) {
+        for (const finIssue of analyzeInstrumentFinance(expansion.instrument, financeOptions)) {
+            const message = expansion.displayNames.reduce((text, [expanded, display]) => text.replaceAll(expanded, display), finIssue.message);
+            add(originFinancePath(expansion, finIssue.path), message, finIssue.code);
+        }
+        return issues;
+    }
+    const actionsWithPlans = Object.keys(instrument.actions).filter((aName) => plans.some((p) => p.action === aName));
     let totalCombinations = 1;
     const actionPlanMap = {};
     for (const aName of actionsWithPlans) {
-        const actionPlans = planResolution.plans.filter((p) => p.action === aName);
+        const actionPlans = plans.filter((p) => p.action === aName);
         actionPlanMap[aName] = actionPlans;
         totalCombinations *= actionPlans.length;
     }
     if (actionsWithPlans.length > 0 &&
         totalCombinations > UDL_LIMITS.maxActionExpansion) {
-        add([...base, "actions"], `variant expansion exceeds combination bound of ${UDL_LIMITS.maxActionExpansion} (${totalCombinations} combinations)`, "UDL2010");
+        add(["actions"], `variant expansion exceeds combination bound of ${UDL_LIMITS.maxActionExpansion} (${totalCombinations} combinations)`, "UDL2010");
+        return issues;
     }
-    else {
-        const generateCombos = (keys) => {
-            if (keys.length === 0)
-                return [{}];
-            const [first, ...rest] = keys;
-            const restCombos = generateCombos(rest);
-            const result = [];
-            for (const plan of actionPlanMap[first]) {
-                for (const combo of restCombos) {
-                    result.push({ ...combo, [first]: plan });
-                }
+    const generateCombos = (keys) => {
+        if (keys.length === 0)
+            return [{}];
+        const [first, ...rest] = keys;
+        const restCombos = generateCombos(rest);
+        const result = [];
+        for (const plan of actionPlanMap[first]) {
+            for (const combo of restCombos) {
+                result.push({ ...combo, [first]: plan });
             }
-            return result;
-        };
-        const combinations = actionsWithPlans.length > 0 ? generateCombos(actionsWithPlans) : [{}];
-        const seenFinanceIssues = new Set();
-        for (const combo of combinations) {
-            const expandedActions = {};
-            for (const [aName, aDef] of Object.entries(instrument.actions)) {
-                const plan = combo[aName];
-                // Only an action that moves money through calls is replaced by its
-                // expanded leaves. Authored moves and steps always reach the oracle.
-                if (plan && (aDef.calls?.length ?? 0) > 0) {
-                    const steps = [];
-                    const moves = [];
-                    for (const leaf of plan.leaves) {
-                        if ("key" in leaf.step) {
-                            moves.push(leaf.step);
-                        }
-                        else {
-                            steps.push(leaf.step);
-                        }
-                    }
-                    expandedActions[aName] = {
-                        ...aDef,
-                        moves,
-                        steps,
-                    };
-                }
-                else {
-                    expandedActions[aName] = aDef;
-                }
+        }
+        return result;
+    };
+    const combinations = actionsWithPlans.length > 0 ? generateCombos(actionsWithPlans) : [{}];
+    for (const combo of combinations) {
+        const expandedActions = {};
+        for (const [aName, aDef] of Object.entries(instrument.actions)) {
+            expandedActions[aName] = planExpandedAction(aDef, combo[aName]);
+        }
+        for (const finIssue of analyzeInstrumentFinance({ ...instrument, actions: expandedActions }, financeOptions)) {
+            add(finIssue.path, finIssue.message, finIssue.code);
+        }
+    }
+    return issues;
+}
+/**
+ * Only an action that moves money through calls is replaced by its expanded
+ * leaves. Authored moves and steps always reach the oracle.
+ */
+function planExpandedAction(definition, plan) {
+    if (!plan || (definition.calls?.length ?? 0) === 0)
+        return definition;
+    const steps = [];
+    const moves = [];
+    for (const leaf of plan.leaves) {
+        if ("key" in leaf.step) {
+            moves.push(leaf.step);
+        }
+        else {
+            steps.push(leaf.step);
+        }
+    }
+    return { ...definition, moves, steps };
+}
+function progressKey(progress) {
+    return `${progress.funded.join(",")}|${progress.consumed.join(",")}`;
+}
+/** Mirrors eligiblePieces in the engine's piece-plan dispatcher. */
+function eligiblePieces(plan, stage, progress) {
+    return plan[`${stage}_order`].filter((id) => stage === "fund"
+        ? !progress.funded.includes(id)
+        : progress.funded.includes(id) && !progress.consumed.includes(id));
+}
+/**
+ * Unfolds a piece-plan instrument over the runtime's piece progress so the
+ * ordinary lifecycle oracle sees exactly the states the dispatcher admits: a
+ * piece-stage action moves the next eligible piece of its stage order, the
+ * lifecycle state is retained until the stage's last piece moves, funding
+ * cannot resume once a piece has left escrow, and an action gated on a drained
+ * account is closed while a funded piece is still held. Every expanded state is
+ * one (lifecycle state, progress) pair; expanded action names carry the piece
+ * and the source state so each has exactly one transition. A quote-commit pair
+ * is not carried through the expansion.
+ */
+function expandPieceProgress(instrument, plans) {
+    const plan = instrument.piecePlan;
+    if (!plan)
+        return undefined;
+    const stateName = (state, progress) => `${state}#${progressKey(progress)}`;
+    const initialProgress = { funded: [], consumed: [] };
+    const stateOrigins = new Map();
+    const actionOrigins = new Map();
+    const displayNames = [];
+    const actions = {};
+    const transitions = {};
+    const pending = [
+        { state: instrument.lifecycle.initial, progress: initialProgress },
+    ];
+    stateOrigins.set(stateName(instrument.lifecycle.initial, initialProgress), instrument.lifecycle.initial);
+    const visit = (state, progress) => {
+        const name = stateName(state, progress);
+        if (stateOrigins.has(name))
+            return;
+        stateOrigins.set(name, state);
+        pending.push({ state, progress });
+    };
+    while (pending.length > 0) {
+        const { state, progress } = pending.shift();
+        if (stateOrigins.size > UDL_LIMITS.maxActionExpansion)
+            return "bound";
+        const held = progress.funded.filter((id) => !progress.consumed.includes(id));
+        for (const [actionName, transition] of Object.entries(instrument.lifecycle.transitions)) {
+            if (!transition.from.includes(state))
+                continue;
+            const definition = instrument.actions[actionName];
+            if (!definition)
+                continue;
+            if (definition.requiresDrainedAccount && held.length > 0)
+                continue;
+            const stage = definition.pieceStage;
+            if (!stage) {
+                const expanded = `${actionName}#${state}#${progressKey(progress)}`;
+                const variant = plans.find((candidate) => candidate.action === actionName);
+                actions[expanded] = planExpandedAction(definition, variant);
+                transitions[expanded] = {
+                    from: [stateName(state, progress)],
+                    to: stateName(transition.to, progress),
+                };
+                actionOrigins.set(expanded, {
+                    action: actionName,
+                    ...(variant && (definition.calls?.length ?? 0) > 0
+                        ? { leafOrigins: variant.leaves.map((leaf) => leaf.originPath) }
+                        : {}),
+                });
+                displayNames.push([expanded, actionName]);
+                visit(transition.to, progress);
+                continue;
             }
-            const financeInstrument = {
-                ...instrument,
-                actions: expandedActions,
-            };
-            for (const finIssue of analyzeInstrumentFinance(financeInstrument)) {
-                const issueKey = `${finIssue.code}:${finIssue.path.join(".")}:${finIssue.message}`;
-                if (!seenFinanceIssues.has(issueKey)) {
-                    seenFinanceIssues.add(issueKey);
-                    add([...base, ...finIssue.path], finIssue.message, finIssue.code);
+            if (stage.plan !== plan.id)
+                continue;
+            if (stage.stage === "fund" && progress.consumed.length > 0)
+                continue;
+            const eligible = eligiblePieces(plan, stage.stage, progress);
+            const pieceId = eligible[0];
+            if (pieceId === undefined)
+                continue;
+            const variant = plans.find((candidate) => candidate.action === actionName && candidate.pieceId === pieceId);
+            if (!variant)
+                continue;
+            const next = stage.stage === "fund"
+                ? {
+                    funded: [...progress.funded, pieceId],
+                    consumed: progress.consumed,
                 }
-            }
+                : {
+                    funded: progress.funded,
+                    consumed: [...progress.consumed, pieceId],
+                };
+            const stageComplete = eligiblePieces(plan, stage.stage, next).length === 0;
+            const target = stageComplete ? transition.to : state;
+            const expanded = `${actionName}@${pieceId}#${state}#${progressKey(progress)}`;
+            actions[expanded] = planExpandedAction(definition, variant);
+            transitions[expanded] = {
+                from: [stateName(state, progress)],
+                to: stateName(target, next),
+            };
+            actionOrigins.set(expanded, {
+                action: actionName,
+                leafOrigins: variant.leaves.map((leaf) => leaf.originPath),
+            });
+            displayNames.push([expanded, `${actionName}[${pieceId}]`]);
+            visit(target, next);
         }
     }
-    validateAggregates(instrument, base, instruments, references, add);
+    for (const [actionName, definition] of Object.entries(instrument.actions)) {
+        if (Object.hasOwn(instrument.lifecycle.transitions, actionName))
+            continue;
+        actions[actionName] = planExpandedAction(definition, plans.find((candidate) => candidate.action === actionName));
+        actionOrigins.set(actionName, { action: actionName });
+    }
+    return {
+        instrument: {
+            ...instrument,
+            actions,
+            lifecycle: {
+                initial: stateName(instrument.lifecycle.initial, initialProgress),
+                states: [...stateOrigins.keys()],
+                transitions,
+            },
+        },
+        displayNames: [
+            ...displayNames,
+            ...[...stateOrigins.entries()].map(([expanded, origin]) => [expanded, origin]),
+        ].sort((left, right) => right[0].length - left[0].length),
+        actionOrigins,
+        stateOrigins,
+        originStates: instrument.lifecycle.states,
+    };
+}
+function originFinancePath(expansion, path) {
+    const [head, second, third, fourth, ...rest] = path;
+    if (head === "lifecycle" &&
+        second === "states" &&
+        typeof third === "number") {
+        const expandedState = expansion.instrument.lifecycle.states[third];
+        const origin = expandedState === undefined
+            ? undefined
+            : expansion.stateOrigins.get(expandedState);
+        const index = origin === undefined ? -1 : expansion.originStates.indexOf(origin);
+        return index >= 0
+            ? ["lifecycle", "states", index]
+            : ["lifecycle", "states"];
+    }
+    if (head === "actions" && typeof second === "string") {
+        const origin = expansion.actionOrigins.get(second);
+        if (!origin)
+            return path;
+        if (third === "moves" &&
+            typeof fourth === "number" &&
+            origin.leafOrigins?.[fourth]) {
+            return ["actions", ...origin.leafOrigins[fourth], ...rest];
+        }
+        return [
+            "actions",
+            origin.action,
+            ...(third === undefined ? [] : [third]),
+            ...(fourth === undefined ? [] : [fourth]),
+            ...rest,
+        ];
+    }
+    return path;
 }
 function validatePiecePlan(instrument, base, references, add) {
     const plan = instrument.piecePlan;
@@ -1633,7 +1732,9 @@ function validateActionUpdates(instrument, action, definition, actionBase, add)
             add(fieldPath, `updated field ${field} is an aggregate cap`, "UDL5008");
         }
     });
-    if (definition.moves.length > 0) {
+    if (definition.moves.length > 0 ||
+        definition.allocate ||
+        definition.contributionStage) {
         add([...actionBase, "updates"], "an action cannot update fields while moving money", "UDL5008");
     }
 }
@@ -1666,6 +1767,19 @@ function validateRemainder(instrument, action, definition, actionBase, instrumen
         remainder.accumulateRef === remainder.amountRef) {
         add([...remainderBase, "accumulateRef"], "remainder accumulateRef must differ from amountRef", "UDL4001");
     }
+    addDuplicateIssues(remainder.subtractPaths ?? [], [...remainderBase, "subtractPaths"], "remainder operand", add);
+    for (const path of remainder.subtractPaths ?? []) {
+        const [root, key] = path.split(".");
+        const declared = root === "fields" &&
+            key !== undefined &&
+            isMoneySchema(instrument.fields[key] ?? {}) &&
+            !instrument.update?.fields.includes(key) &&
+            !Object.values(instrument.actions).some((action) => action.updates?.includes(key));
+        if (!declared ||
+            path === remainder.totalPath ||
+            path === `refs.${remainder.amountRef}`)
+            add([...remainderBase, "subtractPaths"], `remainder subtraction ${path} must name distinct immutable money`, "UDL4001");
+    }
     const [totalRoot, totalKey] = remainder.totalPath.split(".");
     const totalDeclared = (totalRoot === "fields" &&
         totalKey !== undefined &&
@@ -1750,7 +1864,17 @@ function validateActions(instrument, base, instruments, references, add) {
         definition.steps.forEach((step, stepIndex) => validateStep(instrument, definition, step, [...actionBase, "steps", stepIndex], add));
         definition.moves.forEach((move, moveIndex) => validateStep(instrument, definition, move, [...actionBase, "moves", moveIndex], add));
         if (definition.requiresRefs) {
-            addDuplicateIssues(definition.requiresRefs.map((gate) => gate.field), [...actionBase, "requiresRefs"], "gate field", add);
+            const boundFields = new Map();
+            for (const gate of definition.requiresRefs) {
+                for (const [field, path] of Object.entries(gate.bind ?? {})) {
+                    const source = `${gate.field}:${path}`;
+                    const previous = boundFields.get(field);
+                    if (previous !== undefined && previous !== source)
+                        add([...actionBase, "requiresRefs"], `reference gates bind ${field} from conflicting sources`, "UDL5001");
+                    boundFields.set(field, source);
+                }
+            }
+            addDuplicateIssues(definition.requiresRefs.map((gate) => JSON.stringify(sortObject(gate))), [...actionBase, "requiresRefs"], "gate", add);
             definition.requiresRefs.forEach((gate, gateIndex) => {
                 addDuplicateIssues(gate.statuses, [...actionBase, "requiresRefs", gateIndex, "statuses"], "gate status", add);
                 const schema = instrument.fields[gate.field];
@@ -1811,6 +1935,7 @@ function validateActions(instrument, base, instruments, references, add) {
             const existingRefs = new Set([
                 ...Object.entries(instrument.actions).flatMap(([candidateAction, candidate]) => [
                     ...Object.keys(candidate.captureInput ?? {}),
+                    ...Object.keys(candidate.captureEngine ?? {}),
                     ...[...candidate.steps, ...candidate.moves].flatMap((step) => Object.keys(step.capture ?? {})),
                     ...(candidateAction !== action && candidate.signedSum
                         ? [
@@ -1914,7 +2039,7 @@ function validateActions(instrument, base, instruments, references, add) {
             else if (!isDateTimeFormat(schema.format)) {
                 add([...actionBase, "due", "field"], "due field must be a date-time field", "UDL5008");
             }
-            if (definition.due.offset &&
+            if (typeof definition.due.offset === "string" &&
                 fixedIsoDurationMs(definition.due.offset) === null) {
                 add([...actionBase, "due", "offset"], "due.offset must be a fixed ISO-8601 duration using weeks, days, hours, minutes, or seconds", "UDL3001");
             }
@@ -1931,7 +2056,7 @@ function validateActions(instrument, base, instruments, references, add) {
             else if (!isDateTimeFormat(schema.format)) {
                 add([...actionBase, "deadline", "field"], "deadline field must be a date-time field", "UDL5008");
             }
-            if (definition.deadline.offset &&
+            if (typeof definition.deadline.offset === "string" &&
                 fixedIsoDurationMs(definition.deadline.offset) === null) {
                 add([...actionBase, "deadline", "offset"], "deadline.offset must be a fixed ISO-8601 duration using weeks, days, hours, minutes, or seconds", "UDL3001");
             }
@@ -2235,7 +2360,10 @@ function validatePayoutsAndSettlement(instrument, base, instruments, references,
         }
     }
     const reservedRefs = new Set([
-        ...Object.values(instrument.actions).flatMap((action) => Object.keys(action.captureInput ?? {})),
+        ...Object.values(instrument.actions).flatMap((action) => [
+            ...Object.keys(action.captureInput ?? {}),
+            ...Object.keys(action.captureEngine ?? {}),
+        ]),
         ...Object.values(instrument.actions).flatMap((action) => [...action.steps, ...action.moves].flatMap((step) => Object.keys(step.capture ?? {}))),
         ...Object.values(instrument.actions).flatMap((action) => action.signedSum
             ? [
@@ -2252,6 +2380,7 @@ function validatePayoutsAndSettlement(instrument, base, instruments, references,
                     : []),
             ]
             : []),
+        ...Object.values(instrument.actions).flatMap((action) => action.allocate ? [action.allocate.capture] : []),
         ...quoteRefKeys(instrument),
         ...(instrument.subject ? ["subject"] : []),
     ]);
@@ -2552,7 +2681,10 @@ function declaredRefKeys(instrument) {
     return new Set([
         ...Object.values(instrument.actions).flatMap((action) => action.payout ? [action.payout.capture] : []),
         ...Object.values(instrument.actions).flatMap((action) => (action.reconcile ?? []).map((reconcile) => reconcile.capture)),
-        ...Object.values(instrument.actions).flatMap((action) => Object.keys(action.captureInput ?? {})),
+        ...Object.values(instrument.actions).flatMap((action) => [
+            ...Object.keys(action.captureInput ?? {}),
+            ...Object.keys(action.captureEngine ?? {}),
+        ]),
         ...Object.values(instrument.actions).flatMap((action) => [...action.steps, ...action.moves].flatMap((step) => Object.keys(step.capture ?? {}))),
         ...Object.values(instrument.actions).flatMap((action) => action.signedSum
             ? [
@@ -2560,6 +2692,7 @@ function declaredRefKeys(instrument) {
                 ...action.signedSum.sources.map((source) => source.subtotalRef),
             ]
             : []),
+        ...Object.values(instrument.actions).flatMap((action) => action.allocate ? [action.allocate.capture] : []),
         ...quoteRefKeys(instrument),
         ...(instrument.subject ? ["subject"] : []),
     ]);
@@ -3034,25 +3167,23 @@ function reconcileExceptionProblemMessage(code, parent, child, exception) {
  * are written once. The value is disposable: no document ever carries it, and
  * a host's real id grammar stays the host's business.
  */
-const probeIdFor = (prefix) => `${prefix}_sandbox_0123456789abcdef`;
-/** A prefix no host mints, so a schema that accepts it accepts anything. */
-const UNCLAIMED_PREFIX = "zzzz";
+/** Classify the sealed ID pattern without compiling document-authored regexes. */
 export function openReferenceShapeBudget() {
     const answers = new WeakMap();
     let probes = 0;
+    let exhausted = false;
     return {
         accepts(schema, prefix) {
             const seen = answers.get(schema);
             const cached = seen?.get(prefix);
             if (cached !== undefined)
                 return cached;
-            if (probes >= UDL_LIMITS.maxSchemaProbes)
+            if (probes >= UDL_LIMITS.maxSchemaProbes) {
+                exhausted = true;
                 return false;
+            }
             probes += 1;
-            const answer = validateUdlSchemaValue(schema, probeIdFor(prefix)).errors.length ===
-                0 &&
-                validateUdlSchemaValue(schema, probeIdFor(UNCLAIMED_PREFIX)).errors
-                    .length > 0;
+            const answer = referencePatternPrefix(schema) === prefix;
             if (seen)
                 seen.set(prefix, answer);
             else
@@ -3060,7 +3191,7 @@ export function openReferenceShapeBudget() {
             return answer;
         },
         get exhausted() {
-            return probes >= UDL_LIMITS.maxSchemaProbes;
+            return exhausted;
         },
     };
 }
@@ -3155,4 +3286,13 @@ function jsonPath(path) {
     }
     return result;
 }
+function sortObject(value) {
+    if (Array.isArray(value))
+        return value.map(sortObject);
+    if (value !== null && typeof value === "object")
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, sortObject(item)]));
+    return value;
+}
 //# sourceMappingURL=validation.js.map