@percayso-community/cayso-contracts 0.23.0

package/dist/restriction.d.ts

@@ -0,0 +1,262 @@
+/**
+ * `restriction` — what a restriction actually PERMITS, per kind of holding
+ * (CAY-0035).
+ *
+ * `wallet.ts` reports a balance split restricted and unrestricted. It says what
+ * the split IS and has never said what it MEANS, and until this file two
+ * definitions of "restricted" were in print across the programme describing
+ * materially different products:
+ *
+ *   - restricted from **cash-out**, with the cents otherwise usable; and
+ *   - **not yet spendable or giftable** at all.
+ *
+ * The difference is whether a citizen who joined today can pay for Community
+ * services with their reward, or must look at an unusable balance until it
+ * expires. **The first is right and the second is rejected** — this repository's
+ * own glossary already said so (`CONTEXT.md`, `Restricted / unrestricted`:
+ * "Restricted Cayso can still be spent — it is cash-out that is restricted"), and
+ * the canon's accounting rests on it: the backing ceiling binds on UNRESTRICTED
+ * Cayso only and a restriction expiry is a funding event, which is only coherent
+ * if restricted Cayso circulates meanwhile (CAY-0013). `@cayso/ledger`'s
+ * `HoldingFrozen` has said the same thing beside the code since it was written: a
+ * freeze is a refusal to move at all, and restriction is not that.
+ *
+ * ## The table, and why every cell is written out
+ *
+ * {@link CAPABILITY_POLICY} is four capabilities against four kinds of holding —
+ * sixteen cells, each `'permitted'`, `'refused'` or `'open'`, each carrying the
+ * reason it holds. Nothing is left to be inferred from a lot's expiry date: an
+ * inferred cell is a cell nobody decided, which is the state this file exists to
+ * end.
+ *
+ * It is a mapped type over both axes, so adding a kind or a capability is a
+ * COMPILE ERROR at every cell it does not yet have an answer for — the same
+ * mechanism `assurance.ts` uses to stop a new verification method silently
+ * widening what an operation accepts.
+ *
+ * ## No cell is open — and the question that held two open is answered
+ *
+ * Whether a carve moves the source's restriction with it was the one question
+ * this programme held open on purpose, and it held both transfer cells for a
+ * restricted lot open. **The pillar owner answered it on 23 September 2026
+ * (CAY-0074): a carve does not move restriction.** What arrives is decided by
+ * what the arrival is — *earned versus granted* (CAY-0001) — so a provider paid
+ * from a restricted lot earns those cents unrestricted.
+ *
+ * That answer makes a plain TRANSFER of a restricted lot the act that would
+ * launder the restriction off, through a second wallet, and convert
+ * no-liability cents into backed cents on nobody's schedule. So the same decision
+ * **refuses** it, for a promotional reward and a founder allocation alike.
+ * Restricted cents still pay for Community services from the day they land.
+ *
+ * `'open'` stays a member of {@link CapabilityStanding}, and
+ * {@link OPEN_CAPABILITIES} stays on the surface, now empty. An open cell is still
+ * a first-class answer the next undecided question can take, and removing either
+ * would be a breaking change to the published contract for no gain.
+ *
+ * There is therefore **no boolean helper on this surface**. A function returning
+ * `boolean` over a standing would have to fold `'open'` into `true` or `false`,
+ * and either fold would decide the next open question by accident — which is
+ * precisely what publishing a cell as open is meant to prevent. A consumer switches on `standing`
+ * exhaustively and renders any open cell as open.
+ *
+ * ## What this file is NOT
+ *
+ * **It is not enforcement.** Nothing here carves, transfers or cashes out, and
+ * nothing here is consulted by anything that does. The policy has to be published
+ * BEFORE code decides what a restricted holding may do, which is the whole
+ * sequencing argument of the record; the later slice that writes the checks reads
+ * this table rather than inventing a second copy of it. Holdings carry no `kind`
+ * column today, so nothing in this tree could join the table to a lot yet, and no
+ * migration belongs in a policy record.
+ *
+ * **It is not a sweep, a vest or a forfeiture.** A restriction expiry is a
+ * condition evaluated on read (CAY-0019), recorded twice with the promise
+ * governing (CAY-0020). There is no scheduled work here and time-based economic
+ * outcomes want block height rather than a local clock.
+ *
+ * **It carries no numbers.** No grant size, no restriction period, no founder
+ * share, no vesting length. Every amount, rate, tier, schedule and threshold
+ * lives in the canon PRD and reaches code as configuration (`CLAUDE.md`). This is
+ * a statement about CAPABILITIES, and it is written without a single figure.
+ *
+ * **It is data and types, and nothing runs on import** (`CLAUDE.md`: packages
+ * have no side effects).
+ *
+ * ## Why the policy is not in the generated contract schema
+ *
+ * `contract-schema.generated.ts` describes the DATA CROSSING THE BOUNDARY — the
+ * wire shapes a consumer decodes off a response. This table is not one: it is a
+ * static policy a consumer imports at compile time and renders beside the
+ * restricted/unrestricted split it already receives. Nothing on the wire changed,
+ * so the surface files the generator walks are unchanged — the same call
+ * `assurance.ts` documents for the acceptance policy.
+ */
+/** The restriction states a holding reads in. Matches the glossary exactly. */
+export type Restriction = 'restricted' | 'unrestricted';
+/**
+ * Where a holding's cents came from. The four kinds differ in what they may do
+ * and in whether they are restricted at all, so they are four kinds rather than
+ * one kind with a flag.
+ *
+ * `'promotional-reward'` is the sign-up grant and its siblings — granted Cayso a
+ * citizen did not pay for and did not earn. `'earned'` is a payment for
+ * verifiable work: a storage payout, a bounty, a settled invoice. The split
+ * between those two is the standing principle that decides restriction status
+ * (CAY-0001, *earned versus granted*).
+ */
+export type HoldingKind = 'purchased' | 'promotional-reward' | 'earned' | 'founder-allocation';
+/**
+ * What a holder may want to do with a holding's cents.
+ *
+ * `'sell-at-a-quoted-price'` is named for what it does rather than for the venue
+ * it would happen at: the venue's ordinary name is banned standing alone of Cayso
+ * for regulatory reasons (`scripts/banned-words.md`), and naming a capability
+ * after a trading venue is exactly the association the prohibition exists to
+ * avoid. It is a **quoted sale** in this repository's vocabulary (`CONTEXT.md`),
+ * and it is a different act from `'cash-out-through-the-treasury'` — one finds a
+ * counterparty at a quoted price, the other exercises the standing buyback
+ * against eligible sterling.
+ */
+export type HoldingCapability = 'spend-on-community-services' | 'transfer-to-another-holder' | 'sell-at-a-quoted-price' | 'cash-out-through-the-treasury';
+/** The capability holds. */
+export interface PermittedStanding {
+    readonly standing: 'permitted';
+    readonly because: string;
+}
+/** The capability does not hold, and the refusal is decided rather than pending. */
+export interface RefusedStanding {
+    readonly standing: 'refused';
+    readonly because: string;
+}
+/**
+ * Nobody has decided, and this surface will not decide by omission.
+ *
+ * An open standing is a first-class answer, not a missing one. It names the two
+ * canon rules that disagree and what turns on settling them, so a reader can see
+ * that the gap is known rather than overlooked — and so that a consumer rendering
+ * the table shows a citizen an honest "not decided" instead of a confident lie in
+ * either direction.
+ */
+export interface OpenStanding {
+    readonly standing: 'open';
+    readonly because: string;
+    /** The two canon rules that point opposite ways. Both, always — one rule is not a conflict. */
+    readonly conflictingRules: readonly [string, string];
+    /** What settling it changes, so the cost of leaving it open is visible. */
+    readonly whatTurnsOnIt: string;
+}
+/** One cell's answer. Switch on `standing`; there is no fourth member and no ordering. */
+export type CapabilityStanding = PermittedStanding | RefusedStanding | OpenStanding;
+/** One cell of the table, carrying its own coordinates so a rendered row is self-describing. */
+export interface CapabilityCell {
+    readonly kind: HoldingKind;
+    readonly capability: HoldingCapability;
+    /**
+     * What a lot of this kind may do **in the restriction state it lands in** —
+     * which is {@link RESTRICTION_ON_ARRIVAL}`[kind].onArrival`. What it may do once
+     * it reads unrestricted is {@link ONCE_UNRESTRICTED}, stated once because it is
+     * the same for every kind.
+     */
+    readonly standing: CapabilityStanding;
+}
+/** A cell's address, for naming one without carrying the whole of it. */
+export interface CapabilityCoordinate {
+    readonly kind: HoldingKind;
+    readonly capability: HoldingCapability;
+}
+/**
+ * A cell for EVERY (kind, capability) pair. The mapped type is the mechanism
+ * behind "a kind or a capability added later cannot leave a hole": add a member to
+ * either union and this table stops compiling until somebody has written a
+ * standing and a reason for each new cell.
+ */
+export type CapabilityPolicy = {
+    readonly [K in HoldingKind]: {
+        readonly [C in HoldingCapability]: CapabilityCell;
+    };
+};
+/**
+ * **The permissions table.** What a holding of each kind may do, in the
+ * restriction state that kind lands in.
+ *
+ * Read it with {@link RESTRICTION_ON_ARRIVAL}, which says which kinds land
+ * restricted, and with {@link ONCE_UNRESTRICTED}, which says what a lot may do
+ * after its restriction lapses. Each `because` is written for the kind it sits
+ * under rather than shared, because two cells that agree today can stop agreeing
+ * for reasons that were never the same.
+ */
+export declare const CAPABILITY_POLICY: CapabilityPolicy;
+/**
+ * Whether a lot of one kind lands restricted, and whether it ever stops being so.
+ *
+ * `'never-restricted'` is not the absence of an expiry date to be inferred from —
+ * it is the statement that this kind has no restricted phase at all, so there is
+ * nothing for an expiry to lift.
+ */
+export interface ArrivalAndExpiry {
+    readonly kind: HoldingKind;
+    /** The restriction a lot of this kind carries when it lands. */
+    readonly onArrival: Restriction;
+    /**
+     * `'never-restricted'` — lands unrestricted; there is no restriction to expire,
+     * now or later. `'expires'` — lands restricted and carries a promised date; the
+     * period is the canon's and reaches code as configuration, never a literal here.
+     */
+    readonly expiry: 'never-restricted' | 'expires';
+    readonly because: string;
+}
+/**
+ * What each kind arrives as, and what expiry means for it.
+ *
+ * **Expiry is not uniform across the four kinds, and the answer has three parts.**
+ * Two kinds have no expiry at all, because they never land restricted. The two
+ * that do run on their own clocks — a reward's and a founder allocation's are
+ * different periods, held in the canon. And the DESTINATION is uniform: whichever
+ * clock ran, a lapsed lot reads unrestricted and stands exactly at
+ * {@link ONCE_UNRESTRICTED}, which is why that table is stated once rather than
+ * four times.
+ *
+ * Expiry is a condition evaluated on READ (CAY-0019), recorded twice with the
+ * promise governing (CAY-0020). Nothing sweeps, nothing vests on a job, and no
+ * local clock decides it.
+ */
+export declare const RESTRICTION_ON_ARRIVAL: {
+    readonly [K in HoldingKind]: ArrivalAndExpiry;
+};
+/**
+ * What ANY lot may do once it reads unrestricted, whatever it arrived as.
+ *
+ * This is the answer to "what happens to a restricted lot's capabilities when the
+ * restriction expires", and it is stated once because it does not vary by kind: a
+ * lapsed reward and a vested founder allocation stand exactly where a purchase and
+ * an earned payment stood all along. The origin of the cents decided how long they
+ * were restricted; it does not go on deciding anything afterwards.
+ *
+ * The transfer refusal lifts here, and that is worth saying plainly: it refuses
+ * moving a RESTRICTED lot, because a carve does not move restriction and the
+ * transfer would launder it off (CAY-0074). Once there is no restriction, there is
+ * nothing to launder, and transferring is permitted.
+ */
+export declare const ONCE_UNRESTRICTED: {
+    readonly [C in HoldingCapability]: CapabilityStanding;
+};
+/**
+ * Every holding kind, as a value. Derived from {@link CAPABILITY_POLICY} rather
+ * than hand-listed: the table is a mapped type over the union, so its keys ARE the
+ * union and this list cannot drift from it.
+ */
+export declare const HOLDING_KINDS: readonly HoldingKind[];
+/** Every capability, derived from the table's own rows for the same reason. */
+export declare const HOLDING_CAPABILITIES: readonly HoldingCapability[];
+/**
+ * Every cell nobody has decided, as coordinates. EMPTY since CAY-0074 answered the
+ * question that held the two transfer cells open; kept so the next undecided cell
+ * has somewhere to be listed.
+ *
+ * Derived from the table, so it cannot list a cell the table has settled or miss
+ * one it has not. It exists so that "which cells are open" is a question with a
+ * runtime answer: a consumer rendering the table, or a later enforcement slice
+ * auditing its own coverage, reads this rather than remembering.
+ */
+export declare const OPEN_CAPABILITIES: readonly CapabilityCoordinate[];

package/dist/restriction.js

@@ -0,0 +1,316 @@
+/*
+ * Copyright 2026 Percayso Community
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// --- The table ---------------------------------------------------------------
+/**
+ * **The permissions table.** What a holding of each kind may do, in the
+ * restriction state that kind lands in.
+ *
+ * Read it with {@link RESTRICTION_ON_ARRIVAL}, which says which kinds land
+ * restricted, and with {@link ONCE_UNRESTRICTED}, which says what a lot may do
+ * after its restriction lapses. Each `because` is written for the kind it sits
+ * under rather than shared, because two cells that agree today can stop agreeing
+ * for reasons that were never the same.
+ */
+export const CAPABILITY_POLICY = {
+    // Bought with sterling, which arrived with the cents. Nothing is held back from
+    // somebody who paid the published value for it.
+    purchased: {
+        'spend-on-community-services': {
+            kind: 'purchased',
+            capability: 'spend-on-community-services',
+            standing: {
+                standing: 'permitted',
+                because: 'Purchased cents land unrestricted and are the holder’s own service credit. Buying ' +
+                    'Cayso in order to pay for Community services is what the purchase path exists for.',
+            },
+        },
+        'transfer-to-another-holder': {
+            kind: 'purchased',
+            capability: 'transfer-to-another-holder',
+            standing: {
+                standing: 'permitted',
+                because: 'An unrestricted lot carries no restriction, so the refusal that applies to a restricted ' +
+                    'lot does not arise (CAY-0074). Who may be on the other end is a separate question about ' +
+                    'counterparties, not about what a restriction permits.',
+            },
+        },
+        'sell-at-a-quoted-price': {
+            kind: 'purchased',
+            capability: 'sell-at-a-quoted-price',
+            standing: {
+                standing: 'permitted',
+                because: 'Unrestricted cents already carry a cash-out right, so selling them on at a quoted price ' +
+                    'realises nothing the holder could not realise through the Treasury. The venue’s own ' +
+                    'admission rules are a separate matter from this table.',
+            },
+        },
+        'cash-out-through-the-treasury': {
+            kind: 'purchased',
+            capability: 'cash-out-through-the-treasury',
+            standing: {
+                standing: 'permitted',
+                because: 'Purchases land unrestricted and bring their own sterling with them, so these are exactly ' +
+                    'the cents the backing ceiling is measured against and the cents eligible sterling is ' +
+                    'held for (CAY-0013).',
+            },
+        },
+    },
+    // Granted Cayso a citizen did not pay for and did not earn. It lands RESTRICTED
+    // and carries a promised expiry, and it consumes no backing while it does.
+    'promotional-reward': {
+        'spend-on-community-services': {
+            kind: 'promotional-reward',
+            capability: 'spend-on-community-services',
+            standing: {
+                standing: 'permitted',
+                because: 'This is the reconciliation, stated where it bites hardest: restricted means restricted ' +
+                    'from CASH-OUT, and a reward is spendable on Community services from the day it lands. A ' +
+                    'citizen who joined today can pay for storage and services with it. The rejected reading ' +
+                    'would hand a new citizen a balance they could only look at, and would break the ' +
+                    'accounting the ceiling rests on — no-liability cents that cannot circulate are not ' +
+                    'a service credit at all.',
+            },
+        },
+        'transfer-to-another-holder': {
+            kind: 'promotional-reward',
+            capability: 'transfer-to-another-holder',
+            standing: {
+                standing: 'refused',
+                because: 'A carve does not move restriction (CAY-0074): what arrives is decided by what the ' +
+                    'arrival is, earned or granted. A plain transfer of a restricted reward would therefore ' +
+                    'land unrestricted, laundering the restriction off through a second wallet and turning ' +
+                    'no-liability cents into backed cents on nobody’s schedule. So it is refused. The reward ' +
+                    'still pays for Community services, and the provider paid with it earns those cents ' +
+                    'unrestricted — that is the earning the rule exists for.',
+            },
+        },
+        'sell-at-a-quoted-price': {
+            kind: 'promotional-reward',
+            capability: 'sell-at-a-quoted-price',
+            standing: {
+                standing: 'refused',
+                because: 'Selling restricted cents at a quoted price is a cash-out by another route: the holder ' +
+                    'walks away with sterling for cents that carry no backing and no liability. That is the ' +
+                    'exact substance the restriction exists to prevent, so it is refused for as long as the ' +
+                    'lot reads restricted — whichever way the transfer cell above is eventually settled.',
+            },
+        },
+        'cash-out-through-the-treasury': {
+            kind: 'promotional-reward',
+            capability: 'cash-out-through-the-treasury',
+            standing: {
+                standing: 'refused',
+                because: 'This is what "restricted" means. A granted lot consumes no backing precisely because it ' +
+                    'cannot be cashed out yet, and the ceiling is measured against unrestricted cents only ' +
+                    '(CAY-0013). Permitting it would let a holder draw eligible sterling that was never held ' +
+                    'for these cents.',
+            },
+        },
+    },
+    // Paid for verifiable work — a storage payout, a bounty, a settled invoice.
+    // Earned income lands UNRESTRICTED, which is the half of CAY-0001 that survived
+    // its own supersession.
+    earned: {
+        'spend-on-community-services': {
+            kind: 'earned',
+            capability: 'spend-on-community-services',
+            standing: {
+                standing: 'permitted',
+                because: 'Earned cents land unrestricted (CAY-0001). A lock on earned income was considered and ' +
+                    'rejected when that record was written: it makes contributing feel unrewarding, and ' +
+                    'gaming is answered by payout eligibility rather than by vesting.',
+            },
+        },
+        'transfer-to-another-holder': {
+            kind: 'earned',
+            capability: 'transfer-to-another-holder',
+            standing: {
+                standing: 'permitted',
+                because: 'An unrestricted lot carries no restriction, so the refusal that applies to a restricted ' +
+                    'lot does not arise (CAY-0074). Who may be on the other end is a separate question about ' +
+                    'counterparties.',
+            },
+        },
+        'sell-at-a-quoted-price': {
+            kind: 'earned',
+            capability: 'sell-at-a-quoted-price',
+            standing: {
+                standing: 'permitted',
+                because: 'Earned cents already carry a cash-out right, so a quoted sale realises nothing the ' +
+                    'holder could not realise through the Treasury.',
+            },
+        },
+        'cash-out-through-the-treasury': {
+            kind: 'earned',
+            capability: 'cash-out-through-the-treasury',
+            standing: {
+                standing: 'permitted',
+                because: 'Earned cents are unrestricted, so they sit inside the figure the backing ceiling is ' +
+                    'measured against and eligible sterling is held for them from the moment they land.',
+            },
+        },
+    },
+    // The founder pool, allocated once at genesis to a fixed schedule (CAY-0002). It
+    // is granted rather than earned or purchased, so it lands RESTRICTED and vests on
+    // its own clock.
+    'founder-allocation': {
+        'spend-on-community-services': {
+            kind: 'founder-allocation',
+            capability: 'spend-on-community-services',
+            standing: {
+                standing: 'permitted',
+                because: 'Restricted means restricted from cash-out for a founder allocation exactly as it does ' +
+                    'for a reward. A founder paying for Community services with an unvested allocation ' +
+                    'spends a service credit inside the economy; nothing leaves it.',
+            },
+        },
+        'transfer-to-another-holder': {
+            kind: 'founder-allocation',
+            capability: 'transfer-to-another-holder',
+            standing: {
+                standing: 'refused',
+                because: 'The same decision as the reward above (CAY-0074), and it matters more here: a carve does ' +
+                    'not move restriction, so a transfer out of an unvested allocation would land ' +
+                    'unrestricted and short-circuit the vesting schedule, against a pool whose whole point is ' +
+                    'that it vests slowly. Refused. The allocation still pays for Community services, and ' +
+                    'what the provider earns lands unrestricted.',
+            },
+        },
+        'sell-at-a-quoted-price': {
+            kind: 'founder-allocation',
+            capability: 'sell-at-a-quoted-price',
+            standing: {
+                standing: 'refused',
+                because: 'A quoted sale of unvested cents realises their value in sterling and empties the vesting ' +
+                    'schedule of meaning. Refused for as long as the lot reads restricted, on the same ' +
+                    'reasoning as the reward row and with more at stake.',
+            },
+        },
+        'cash-out-through-the-treasury': {
+            kind: 'founder-allocation',
+            capability: 'cash-out-through-the-treasury',
+            standing: {
+                standing: 'refused',
+                because: 'The allocation is restricted until it vests, and restricted cents cannot be cashed out. ' +
+                    'They consume no backing while they are restricted, so there is no eligible sterling held ' +
+                    'against them to draw.',
+            },
+        },
+    },
+};
+/**
+ * What each kind arrives as, and what expiry means for it.
+ *
+ * **Expiry is not uniform across the four kinds, and the answer has three parts.**
+ * Two kinds have no expiry at all, because they never land restricted. The two
+ * that do run on their own clocks — a reward's and a founder allocation's are
+ * different periods, held in the canon. And the DESTINATION is uniform: whichever
+ * clock ran, a lapsed lot reads unrestricted and stands exactly at
+ * {@link ONCE_UNRESTRICTED}, which is why that table is stated once rather than
+ * four times.
+ *
+ * Expiry is a condition evaluated on READ (CAY-0019), recorded twice with the
+ * promise governing (CAY-0020). Nothing sweeps, nothing vests on a job, and no
+ * local clock decides it.
+ */
+export const RESTRICTION_ON_ARRIVAL = {
+    purchased: {
+        kind: 'purchased',
+        onArrival: 'unrestricted',
+        expiry: 'never-restricted',
+        because: 'Purchases land unrestricted and bring their own sterling with them (CAY-0013). There is no ' +
+            'restricted phase, so there is nothing to expire and no promised date to record.',
+    },
+    'promotional-reward': {
+        kind: 'promotional-reward',
+        onArrival: 'restricted',
+        expiry: 'expires',
+        because: 'Granted Cayso lands restricted and carries an expiry (CAY-0031). Its lapse is a FUNDING ' +
+            'EVENT: the cents move from consuming no backing to consuming headroom, so the Treasury must ' +
+            'hold the sterling before the lapse rather than after it (CAY-0013).',
+    },
+    earned: {
+        kind: 'earned',
+        onArrival: 'unrestricted',
+        expiry: 'never-restricted',
+        because: 'Earned versus granted decides restriction status, and earned income lands unrestricted ' +
+            '(CAY-0001). There is no restricted phase and nothing to expire.',
+    },
+    'founder-allocation': {
+        kind: 'founder-allocation',
+        onArrival: 'restricted',
+        expiry: 'expires',
+        because: 'The founder pool is allocated at genesis to a fixed schedule and vests on its own clock, ' +
+            'which is not the reward clock (CAY-0002). Its lapse is a funding event on the same ' +
+            'reasoning as a reward’s, at the scale of the pool.',
+    },
+};
+/**
+ * What ANY lot may do once it reads unrestricted, whatever it arrived as.
+ *
+ * This is the answer to "what happens to a restricted lot's capabilities when the
+ * restriction expires", and it is stated once because it does not vary by kind: a
+ * lapsed reward and a vested founder allocation stand exactly where a purchase and
+ * an earned payment stood all along. The origin of the cents decided how long they
+ * were restricted; it does not go on deciding anything afterwards.
+ *
+ * The transfer refusal lifts here, and that is worth saying plainly: it refuses
+ * moving a RESTRICTED lot, because a carve does not move restriction and the
+ * transfer would launder it off (CAY-0074). Once there is no restriction, there is
+ * nothing to launder, and transferring is permitted.
+ */
+export const ONCE_UNRESTRICTED = {
+    'spend-on-community-services': {
+        standing: 'permitted',
+        because: 'Unchanged by expiry: restricted cents were already spendable on Community services.',
+    },
+    'transfer-to-another-holder': {
+        standing: 'permitted',
+        because: 'The refusal while restricted is that a transfer would launder the restriction off, because ' +
+            'a carve does not move it (CAY-0074). An unrestricted lot has none to launder, so ' +
+            'transferring is permitted.',
+    },
+    'sell-at-a-quoted-price': {
+        standing: 'permitted',
+        because: 'The refusal while restricted was that a quoted sale is a cash-out by another route. Once ' +
+            'the lot may be cashed out, that reasoning is spent.',
+    },
+    'cash-out-through-the-treasury': {
+        standing: 'permitted',
+        because: 'The lapse is exactly the event that makes these cents cashable, and it is the moment they ' +
+            'begin consuming headroom (CAY-0013).',
+    },
+};
+// --- Derived views -----------------------------------------------------------
+/**
+ * Every holding kind, as a value. Derived from {@link CAPABILITY_POLICY} rather
+ * than hand-listed: the table is a mapped type over the union, so its keys ARE the
+ * union and this list cannot drift from it.
+ */
+export const HOLDING_KINDS = Object.keys(CAPABILITY_POLICY);
+/** Every capability, derived from the table's own rows for the same reason. */
+export const HOLDING_CAPABILITIES = Object.keys(CAPABILITY_POLICY.purchased);
+/**
+ * Every cell nobody has decided, as coordinates. EMPTY since CAY-0074 answered the
+ * question that held the two transfer cells open; kept so the next undecided cell
+ * has somewhere to be listed.
+ *
+ * Derived from the table, so it cannot list a cell the table has settled or miss
+ * one it has not. It exists so that "which cells are open" is a question with a
+ * runtime answer: a consumer rendering the table, or a later enforcement slice
+ * auditing its own coverage, reads this rather than remembering.
+ */
+export const OPEN_CAPABILITIES = HOLDING_KINDS.flatMap((kind) => HOLDING_CAPABILITIES.filter((capability) => CAPABILITY_POLICY[kind][capability].standing.standing === 'open').map((capability) => ({ kind, capability })));