# Check the lowered company in UDL

UDL is the admitted Product definition. It contains business nouns, their
lifecycles and verbs, and the instructions that enact each verb. It excludes
provider transport, polling, statements, reconciliation, scheme names,
cutoffs, file formats, and bank-specific status vocabularies.

## What UDL admits

A document declares `udl: 1`, a positive `version`, a `snake_case` product id,
a title, subjects, and at least one noun. A subject has a kind, a declared-value
policy, and an object schema.

Each noun declares:

- a singular `snake_case` id and a 2 to 8 letter lowercase id prefix;
- title and summary text;
- `camelCase` JSON Schema fields and the fields required at create time;
- an initial state, all states, and verb-named transitions;
- `create` plus any later business verbs;
- optional parties, subjects, update policy, aggregate laws, partitions,
  derived amounts, and unwind policy.

The platform owns `id`, `status`, `createdAt`, `metadata`, and `refs`. A noun
cannot redeclare those fields. Every mutation takes an idempotency key. Event
names derive from `noun.verb` in past tense unless the noun declares an honest
irregular override.

## The sealed seven instructions

`steps` contain three account instructions:

- `account.escrow.provision`
- `account.freeze`
- `account.unfreeze`

`moves` contain four money instructions:

- `internal_transfer.create`
- `internal_transfer.reserve`
- `internal_transfer.post`
- `internal_transfer.void`

No noun adds an eighth instruction or a fifth money path. A binding reads from
exactly one source: `const` for a literal, `instance` for stored fields and
refs, or `input` for schema-checked non-create input. Each move has a unique
key. A verb can carry several moves when the phase must execute as one linked
batch.

An external `payout` is a separate intent. It captures the durable payout
reference and cannot share a verb with kernel steps or moves.

## Admission gates

UDL keeps prerequisites as data on the verb:

- `requiresRefs` checks the status of one referenced noun. It may also bind
  create fields, match local and referenced values, allow an absent reference,
  or enforce one dependent per referenced instance.
- `requiresAggregate` checks a child or sibling set in declared states. It can
  compare sums or counts, require every row to qualify, or lock a sum to an
  anchor-held value.
- `requiresDrainedAccount` blocks a non-create verb while the named account
  still has a balance.
- `requiresExposure` applies to create. It locks the referenced anchor and
  sums a child money field in the declared states. The cap comes from the new
  instance or, with `capOnAnchor: true`, from the anchor. An absent anchor cap
  means the measure is not configured. An exceeded cap refuses with
  `exposure_cap_exceeded`.
- `due` lets the machine principal fire at a stored instant. `deadline` blocks
  admission after an instant. A verb cannot declare both.
- `port` checks the asserted acting party against the noun's bound payer,
  beneficiary, or subject holder.
- `decision` admits one provider capability and one deadline. Timeout can only
  decline.

## Settlement evidence gate

A noun with a `payout` intent must declare exactly one verb with
`requiresSettlement`. The gate names the payout ref and captures the matched
settlement evidence ref. The payout must dominate the settlement verb in the
lifecycle.

The settlement verb is system-only. It cannot be `create`. It cannot declare a
port, public intent, caller input, due condition, deadline, kernel step, or
money move. It advances only after the execution core matches the payout to
durable settlement evidence. A tenant acknowledgement is not that evidence.

## Exposure rings

Keep each concept in one ring:

- Ring 0 is UDL. Tenants and agents see business nouns, verbs, events,
  requirements, statuses, and timestamps.
- Ring 1 is Hyperscale's internal work. It contains attribution,
  reconciliation, statement lines, cutoff calendars, polling workers, and
  trust reviews.
- Ring 2 is the adapter boundary. It contains wire codecs, auth and signing,
  statement formats, schemes, file drops, and provider references.

Facts move upward. Ring 2 normalizes provider facts into ring 1 records. Ring 1
updates ring 0 nouns and emits ring 0 events. Only execution intents move
downward. Never leak a ring 1 or ring 2 term into a Product noun because one
provider happens to expose it.

## Append-only evolution

Validate both documents before diffing them. Then increase the Product version
for every semantic change.

The additive set includes new nouns, subject kinds, states, transitions,
verbs, and optional fields. A live verb may gain its first input or a new
optional input field.

The evolution checker rejects:

- removal or rename of a live noun, subject, state, transition, verb, or field;
- an id-prefix or initial-state change;
- a required-field addition or field schema change;
- a narrower party, subject, or update policy;
- changed steps, moves, gates, event name, due condition, deadline, decision,
  distribution, derived amount, payout intent, earnable flag, or unwind policy;
- a new payout intent on a live noun;
- any semantic change without a higher Product version.

Use the published command on canonical UDL:

```bash
bunx @hyperscale0/udl validate product.udl
bunx @hyperscale0/udl fmt product.udl --write
bunx @hyperscale0/udl diff product.live.udl product.udl
```

Exit `0` means admitted or additive. Exit `1` means refused or evolution
breaking. Exit `2` means the invocation or file failed.

Canonical UDL is UTF-8 JSON with keys sorted by ECMAScript code-unit order,
two-space indentation, authored array order, and one final line feed.