# Settled desk contract

This contract specifies the actual daily book, not the seventeen controlled financial report panels. It is a named synthetic desk convention supplementing the dated rulebook. The versions exported by `desk_contract.py` are `desk-state.v3`, `desk-envelope.v2` and `desk-policy.v3`, with no v1 aliases. Report labels remain `daily-book.v2` and `daily-grade.v1`; `worker-packet.v1` is unchanged. The active contract has nine report sections and twelve owners. Implementation and executed evidence are separate. The unchanged build-and-prove protocol records historical methodology, not a practitioner-first block on engineering or model execution.

## Authority and module ownership

The evaluator owns the family, market path, state, immutable receipts and grading. A protected worker receives the current packet, public conventions and a writable work directory. Calculations are bounded data, never executable artifacts, and cannot change the book. Current `counterparty_constraints`, mandate rules and relevant legal source objects belong in the packet. Generated `accepted_positions`, gold, future external events and private evaluator history do not. The canonical base case and `FUND_01` seed 1 are deliberately declassified public practice, a separate publication boundary.

`desk_ledger.py` owns economic state and accepted transitions. `desk_valuation.py` produces the independently valued book, including actual client outcome. `institutional.py` checks sourced legal findings, mandate decisions, client structure and recommendations for both report paths. `daily_grader.py` reads the submitted report and valued book. `desk_replay.py` independently folds receipt postings and state operations without calling the transition function. `desk_runtime.py` owns SQLite persistence, revisions, receipt chains, packets and CLI. `worker_boundary.py` owns worker launches, restart supervision and boundary probes. These are implementation boundaries, not claims that their acceptance runs passed.

## Public function boundaries

- `desk_ledger.initial_state(parameters, family) -> {state, receipts}`: generate explicit inception and pre-window contractual receipts, then the servicing-window state. Only this function interprets the disclosed opening endowment.
- `desk_ledger.quote_board(parameters, family, state) -> list[quote]`: current executable actions, terms, capacity and legal prerequisites; quote ID includes market/legal versions and effective date. No future path.
- `desk_ledger.settle_day(parameters, family, state, actions) -> {state, receipts, blockers}`: pure transition on a copy. An invalid action batch returns no economic mutation. A successfully settled day increments the calendar once and releases only events now available.
- `desk_valuation.value_book(parameters, family, state) -> book`: deterministic Decimal financial output. No candidate data, future events, gold or prior candidate ledger. State contains received event effects, not a supplied exposure path.
- `daily_grader.expected_daily_report(parameters, family, state, book, previous_book=None) -> report`: evaluator-only bounded daily assertions.
- `daily_grader.grade_daily(parameters, family, state, report, previous_book=None) -> grade`: grade the submitted parent checkpoint before applying its actions or revealing tomorrow. Qualification is separate from twelve fixed-denominator owners. No accepted worker action anywhere in the run means `not_scoreable`, with no score. A first accepted day may retain the opening report for later scoring without comparing it to the post-action book. Invalid candidates receive `candidate_error`; reference or verifier failures receive `UNSCORABLE`; neither has a score. An accurate report of an unsuccessful client outcome can lose O11.
- `desk_replay.replay_receipts(parameters, family, genesis, receipts) -> state`: independently recompute permitted amounts, paid-obligation identities, titles and capacity from immutable contract/quote/event terms before applying each receipt. Verify sequence, parent hash, balanced postings and unique IDs. It must not call `settle_day`, trust candidate assertions or accept a declared final balance. A balanced duplicate coupon with a fresh receipt ID must fail because its contract-period obligation is already paid.

Internal state and receipts use exact decimal strings at serialization boundaries. Python computation uses Decimal. Hashes cover canonical sorted-key JSON; omit only the hash field itself. State is an economic object, not a report log: submitting a different calculation, an invalid envelope or an atomic rejected action cannot alter its hash.

## Clock and settlement order

The family supplies `funding_start_date` and `window_start_date`. Event `day`/`available_at` is an integer calendar-day offset from the window start. Original funding and deployment coupons fall on calendar three-month anniversaries of funding inception, preserving end-of-month. Each whole coupon accrues 0.25 contractual years. Within a period, financial time is completed quarters times 0.25 plus 0.25 times elapsed actual days divided by the actual days in that period. This keeps twenty-year/five-year maturities and actual payment dates without treating every observation as a payment. Every later CDS, repo, facility, offset or reinvestment contract stores its own execution/effective date, payment schedule, maturity, accrued stub and business-day convention. Its age and premium dates are not the original funding clock; protection bought midquarter starts its five-year term and accrual at its own execution.

The evaluator derives opening accrual and any paid contractual history from inception; it does not move inception to the servicing window. Newly available dated news and the current day's ordered cash milestones are disclosed in the packet. Authored same-day order is preserved through explicit phases under `desk-event-bindings.md`; coupon-first and debit-first are different histories. A candidate action plan specifies a public phase. Envelope versions are checked once, but live cash, title, obligation balances, legal rights and quote capacity are checked against the staged state at every phase. A failed prior draw cannot fund a later action. A coupon announcement, invoice collection into a restricted correspondent account, licence, market opening or facility permission is not free cash. A missed earlier cutoff cannot be repaired by a later same-day coupon. Due obligations arise from contracts/events independently of candidate rejection; a rejected action cannot invent a payable. No future-day news is used to grade the current parent checkpoint.

The clock cannot be advanced by a worker request other than committing that day's accepted actions. `hold_capital` is an explicit risk decision; it changes no cash and carries the capital profile. An empty action list does not create an accepted worker action. The observation horizon is evaluator configuration, not a worker-visible completion signal. Restarted workers retain the same work volume and current authoritative packet.

## State and receipts

State fields are closed and versioned: `schema_version`, `family_id`, `day`, `as_of`, `financial_time`, `revision`, `market_version`, `legal_version`, `market`, `legal`, `accounts`, `lots`, `contracts`, `pending`, `obligations`, `accepted_action_ids`, `accepted_action_count`, `applied_event_ids`, `last_receipt_hash`, `last_receipt_sequence`. A public view includes the current state hash. The protected event path and evaluator outputs never enter it.

Accounts are debit-positive trial-balance amounts with an explicit account-kind registry: unrestricted cash, restricted opening cash, restricted collections, retained U, deployment principal and accrued coupons, reinvestment principal, owned inventory, posted VM, unpaid receivables, repo debt, external unsecured debt, sale financing, legacy debt, received VM, return obligations, unpaid payables, claim allowances, contributed equity and named income/expense accounts. Total debits equal total credits. Each financial receipt identifies source/destination, contract, amount, asset/lot identity, economic purpose, available date and settled status.

The management ledger is a separate overlay journal with `funding_mark`, `hedge_asset`, `deferred_management_gain`, `management_XVA` and corresponding mark, deferral, reserve and hedge income accounts. It is posted at each valued checkpoint from old-market roll, current-market remeasurement and accepted-action effects. The statutory journal never acquires these management-only funding assets or liabilities. Independent overlay equity plus the explicit statutory bridge must reproduce statutory equity; no balancing plug is permitted.

Lots carry `id`, `instrument_id`, `quantity`, `owner`, `location`, `encumbrance`, `issued`, `return_obligation`, `reuse_permitted`, `enforceability`, `source_evidence`. Economic recognition does not imply legal title. U is statutorily retained but legally at the funding provider and cannot be sold or pledged again. A contingent issuance promise is not a security; a later issuance has a new identifier and no assumed liquidity.

The actual runtime starts with the source book's cash and paid opening trades, plus the separately disclosed allocation inventory as an owner contribution in kind. The contributed value equals the sum of those source lots' values. It is neither cash nor P&L. Every lot and the equity contribution appear in genesis receipts. This makes the allocation exercise an actual owned inventory rather than spending assets from an unrelated controlled panel. `initial_operating_cash` is a subset of total opening cash; the remainder is restricted under a named mandate. Neither a certificate nor a capital release adds cash.

Receipts contain `id`, `sequence`, `day`, `action_id`, `event_id`, `kind`, `source_evidence`, `terms`, `postings`, `operations`, `previous_receipt_hash`, `hash`. Both identity fields are present and nullable; an action receipt and an event receipt cannot claim each other's identity. `terms` preserves the authenticated immutable input record. `postings` are balanced account deltas. Operations are closed economic changes to lots, contractual states, current market/legal facts and obligations, never a wholesale replacement state. Historical fills, locked financing spread and previous receipts are immutable. Replay validates legal title and cash conservation independently of declared report totals.

`legal.decisions` and `legal.approvals` begin empty and retain accepted institutional history. A decision is `{id,kind,rule_id,subject_id,reason_code,submitted_at,status,source_evidence}`. Its ID is `decision:<action_id>`, kind is `escalate` or `decline`, and status is `escalated` or `declined`. An approval is `{id,rule_id,subject_id,approver_id,requested_at,effective_at,expires_at,status,used_by,source_evidence}`, with ID `approval:<action_id>` and status `pending`, `approved`, `declined`, `consumed` or `expired`. `used_by` is null except for the consuming accepted action ID. Dates are ISO strings and evidence retains the authored rule shape.

Decision records are immutable. Pending approvals can become approved, declined or expired; approved approvals can become consumed or expired, not declined. Later changes create new receipts rather than rewriting requests. A pending approval resolves in one of two ways: an authored `approval_response` event for the same rule, subject and approver dated on or after the request moves it to the authored outcome on that event's day under an `event:approval_response` receipt; the scheduled review keeps it pending until then even past `effective_at`, and only catches up, from the following day, a request accepted after that event's phase; with no such event the review applies the rule's constant `approval_outcome` once `effective_at` arrives. Either way `expires_at` is fixed by the request and expiry wins. Approvers are parties; a rule may name the bank or an `internal_function` party (role `credit_committee`, `legal`, `compliance` or `desk_head`), and a rule naming a party absent from the case is a reference error at load. Creating a decision or approval, or changing an approval's status, increments `legal_version`; an identical re-put is a no-op. Approval dates satisfy `requested_at <= effective_at < expires_at`. Source action IDs must be accepted, and replay verifies identities and transitions.

Genesis binds parameter, family, public-policy and event-binding hashes. Closed `accept_action` and `commit_day` operations record accepted IDs, increment revision/day once and derive `as_of`/financial time from the authenticated clock, including a zero-cash hold day. Replay recomputes those fields; it does not trust a replacement-state blob. A semantic receipt checker derives each expected amount/obligation from the bound sources independently of the live transition implementation. Balanced invented debt and repeat payment under a new receipt ID must fail that check.

`last_receipt_sequence` starts at zero in genesis. Each emitted receipt increments it by one and updates `last_receipt_hash`; only the journal may update these derived fields. No candidate operation can assign them. Replay verifies contiguous sequence independently, so pure transitions and persistence require no hidden mutable sequence counter.

## Envelope and atomicity

The `desk-envelope.v2` envelope contains `schema_version`, `parent_state_hash`, `revision`, `market_version`, `legal_version`, `actions`, `calculations`. Each action has a closed payload, unique `action_id`, public `phase` and bound `quote_id`; the version belongs to the outer envelope, not individual actions. Candidates cannot supply receipts or replace a quote's settlement price. Calculations retain the `daily-book.v2` label and require all nine sections; old five-section reports are invalid, not adapted.

The evaluator commits actions, generated receipts and the new state in one `BEGIN IMMEDIATE` transaction with unique action IDs. Stale parent/version/revision, unknown keys, nonfinite or malformed money, duplicate keys, oversize input, unknown quote and reused action ID reject before execution. A rejected economic batch is atomic; the run's rejection/blocker log is separate from economic state. Qualification can latch a fatal attempted legal/cash/title violation without pretending a rejected transfer occurred. No partial fill is manufactured.

## Executable action set

1. `hold_capital`: accept the current risk/capital cost without inventing a gain or cash.
2. `execute_csa`: pay the quoted legal/operational price and schedule activation after the quoted business-day delay. Only the evidenced two-way agreement changes margined treatment. Actual VM transfers have separate receipts; RC uses transferred cash, not an unexecuted CSA label. Negative marks require liquidity. VM principal is not P&L.
3. `substitute_collateral` and `reverse_substitution`: pay fees, meet custody/enforcement conditions and the effective date; swap actual rights. The quoted deployment yield concession starts only when substitution is effective. Original eligibility can return on reversal. Return obligation and existing reuse must be honoured before changing a lot.
4. `execute_offset` then `consolidate_netting`: execute the separately quoted offset trade with its real upfront and future obligations. Consolidation pays its legal fee and changes netting only after the named jurisdiction opinions and novation confirmations arrive at the quoted delay. A master-agreement assertion alone creates no netting.
5. `buy_protection` and `designate_protection`: execute the quoted CDS, accrue/pay its premium, preserve its own counterparty exposure and actual expiry. CCR maturity recognition and the economic tail are separate. Designation needs the stated eligible terms; it changes CVA-capital treatment, not premium history. An undesignated hedge retains the disclosed market-risk charge.
6. `repo_allocate`: submit an actual whole-lot assignment to the quoted lenders. Recompute issuer concentration, minimum names, pool limits, market haircut, supervisory haircut and capital. Accepted cash arrives with title transfer/encumbrance and repo debt. Duplicate or unavailable lots reject. Repo maturity creates a real repayment/return obligation. Actual cash expense is contractual repo interest and explicit fees only. The static allocation objective's haircut funding and equity-hurdle terms remain disclosed noncash opportunity/capital allocation metrics; owner-contributed lots do not imply haircut borrowing. Never book the objective total as a cash fee.
7. `repay_repo`, `sell_lot`, `buy_equivalent`, `return_collateral`: use current quoted prices, quantities and rights. An identical-return obligation forbids outright disposal; equivalent-return permission does not extinguish the obligation. Selling reusable received collateral creates a return liability, not sale profit. Buying an equivalent instrument uses cash and creates a newly identified lot. Returning a lot requires the secured debt's discharge and removes the matching obligation once.
8. `draw_facility` and `repay_facility`: only the named, currently committed branch facility, within available limit. Permission is not a draw. Actual cash and debt move together; costs use its quoted unsecured funding spread. Default or legal suspension can remove undrawn capacity without erasing already drawn debt.
9. `meet_margin_call`, `settle_payable`, `liquidate_collateral`, `reinvest`, `settle_claim`: act on identified existing obligations. No unknown payee, fabricated amount or unknown asset. Liquidation requires instrument existence, enforcement and an open realization market; default dependence and transfer controls are separate gates. Reinvestment spends actual matured principal at current quoted tenor/spread, not a precommitted year-five renewal.
10. `escalate` and `decline`: submit a scoped `rule_id`, permitted `reason_code`, typed `premises` and `rationale` with the normal action/quote/phase fields. Accepted decisions create immutable dated receipts and `legal.decisions` entries, without financial postings. Escalation creates a pending approval resolved under the disclosed rule's approver, outcome, delay and validity period, or by that approver's authored dated response when one exists. A request is not approval. A declined route cannot execute without a new valid mandate or approval; unrelated routes remain available.

Actions are priced by the public current quote board. Scheduled legal effects and payments survive worker restart. Only an obligation created by an already accepted contract or authenticated external event can become overdue and trigger a qualification blocker. A rejected proposed CSA, CDS, repo or sale leaves no fee, principal, return liability or other economic mutation. Cash never silently becomes negative. No risk remedy may manufacture equity.

Mandate rules are scoped by action kind and subject, with tier `permitted`, `requires_approval` or `prohibited` and any stated amount cap. Execution under an approval requires the correct subject/rule, effective date, validity and unused authority; acceptance records consumption. Permission does not override intrinsic title, enforcement, instrument existence, cash, size or capital constraints. `escalate` and `decline` are accepted institutional actions, not no-op stand-ins for a failed trade.

## Event effects and legal axes

Every authored event payload must map through an explicit, reviewed binding to closed effects, with its source ID. Unsupported `cash_rule`, right/status, settlement kind or contract is a reference failure. No keyword matching of prose. Effect categories are market curve/rating update; opening or closure of realization market; transfer restriction; named legal right status; current committed facility status; issued-instrument transition; contractual payment due; restricted collection receipt; final remittance; identified default; observability evidence; disputed claim recognition/payment; substitution request. News alone does not execute a trade.

At borrower/reference joint default, already-issued same-issuer collateral has the stated conditional liquidation value, including zero where specified. Independent paper does not inherit that zero. A contingent promise cannot be priced from a traded line and cannot be liquidated before issuance. A payment-rights collection can survive borrower default yet remain trapped by transfer controls. Market closure prevents realization even when credit and title are sound. These paths are separate machine facts, not a W-label switch.

A repo-form deployment supplies legal title subject to the stated return obligation; a pledge leaves title with the pledgor. Neither adds a second statutory asset when the repo is a secured lending accounting unit. Reuse requires explicit permission, effective enforcement and an unencumbered current right. Conditional or denied enforcement cannot be inferred effective from a document title.

## Valuation and accounting

Use the common Decimal primitives and dated rules. The daily legal funding mark uses the matching quote's beta and conversion rate, actual remaining financial tenor, last paid price reset, actual delay to the next price settlement and current unpaid coupon stub. Its clean off-quarter component uses the explicitly quoted fractional-annuity convention; do not claim exact original-date coupon repricing. Exposure is derived from that mark and actual collateral. Current provider CDS drives CVA; current own unsecured bond spread drives actual debt funding. Bond-CDS basis is separately reported and is not substituted for the all-in spread over OIS.

Actual current SA-CCR uses `saccr` with the full legal mark and transferred VM amount, not `funding_capital`'s fully-collateralized clean projection shortcut. A signed CSA with delayed or partial VM does not set collateral equal to value. Future CVA/KVA projections disclose their assumed contractual settlement schedule separately from current exposure. Whole-book capital explicitly maps every new balance-sheet asset: contributed allocation inventory, restricted cash/collections, posted VM, accrued and overdue receivables, purchased equivalents and recognized return liabilities. Their risk weights and leverage inclusion are current worker-readable desk/authority inputs. `wholebook_capital`'s original four-asset mapping cannot silently treat new contributed inventory as free Tier1 equity without its matching asset exposure.

A reserve charge is not a borrowing receipt. Funding drag is accrued on actual outstanding debt. Any explicit exposure-prefunding transaction must show both borrowed cash and its funded asset before a quadratic funding charge is claimed. The actual base and that conditional transaction cannot be added as though both had executed.

Produce statutory and management books with a reconciled bridge. The retained-U funding unit has no second statutory derivative. Management clean gain, gross inception deferral and CVA/KVA reserves are shown separately. Deferral uses frozen inception inputs and a disclosed time/observability trigger; reserve theta is repricing at the old market after clock roll, reserve MTM is the difference from that rolled old-market value, and action release is separated from both. Hedge cash/premium/mark and actual cash funding drag have their own lines. Each attribution equals the independently posted journal's equity movement, with owner contributions excluded from P&L.

Prudent valuation applies only to identified recognised fair-value exposures and supplied uncertainty evidence. No mechanical AVA is invented merely because a management reserve grew. Show the separate CET1 deduction and the replacement-equity/KVA consequence where the actual identified exposure supports it. Scheduled maturity removes only paid/closed obligations. Unpaid claims, collateral returns and allowances survive the date until receipt-backed settlement or evidenced discharge.

## Daily score

There are twelve owners with weights 7, 7, 10, 7, 8, 7, 6, 8, 10, 10, 10 and 10, totalling 100. Required report sections are `rates`, `credit_xva`, `capital`, `liquidity`, `accounting`, `legal`, `compliance`, `structure` and `recommendation`. The daily report remains `daily-book.v2`, distinct from the controlled static report `back_to_back_funding_book.v1r2`. The historical eight-owner weights and matrices remain evidence for their original versions only.

O1 checks legal roles, current funding mark, source of cash, remaining tenors, contractual deployment spread and title. O2 checks independent CDS/bond drivers, CVA, debt-funded UFVA and noncash/debt distinction. O3 checks actual SA-CCR, collateral eligibility/haircut/maturity recognition and capital. O4 checks executed protection, regulatory recognition, designation and uncovered tail. O5 checks real quotes/capacity, current inventory allocation and action cost. O6 checks instrument existence, accessible cash and deadline shortfalls. O7 checks accounting unit, observability and deferral. O8 checks reserve attribution, independent journals, funding drag, AVA and outstanding terminal claims.

O9 checks sourced legal conclusions and conditions. O10 checks the scoped mandate decision and current approval status. O11 checks the actual client outcome, including delivery, deadline, executable legal form, classification, return duties, required approvals, borrowing ceiling, contractual spread and bank viability. O12 checks the selected recommendation, binding constraint and alternatives against conclusion-specific support. `institutional.report_properties()` supplies the four schema sections; `grade_sections()` checks the report independently of the reference answer from `expected_sections()`. Supported alternatives can pass without matching reference wording or a whole premise list.

Institutional premises identify `source`, RFC6901 `pointer`, `relation` and `value`. Relations are `eq`, `ne`, `gte`, `lte` or `contains`; source is `case`, `state`, `book` or `report`. Financial values are Decimal strings. Authenticated case/state/book facts provide authority. A report assertion cannot authenticate itself, and an unrelated true fact cannot support a conclusion. Rationales remain free explanation; neither length nor keywords determine the grade.

Fatal legal/cash/title/ineligible-mitigation/fabricated-capacity errors disqualify independently of dense score. An accurate report of a rejected proposal is not an executed violation, but accurately reporting an unsuccessful client outcome does not earn O11. Missing evidence cannot earn an owner. A no-action run is not scoreable. The run result retains the final replay-valued book and elapsed-day-weighted owner history; later recovery cannot erase earlier unsuccessful or missing checkpoints. The static controlled KEEP proposal is not used to declare the capital-deficient live base viable.

## Required execution evidence

After the family static gate: exercise all accepted action kinds, stale/duplicate/unknown quote refusals, atomic rejection, illegal reuse/double sale/double pledge/phantom cash refusals, no-action refusal, calculations-only state invariance, action-history dependence at the same final market, real restart with persistent work, independent receipt replay, every authored event binding and legal axis, deadline before later receipt, year-five reinvestment and year-twenty unresolved settlement. Grade each isolated daily-owner mutation and retain its matrix. Container canaries must exercise actual denied reads/network, not a Docker-argument inspection alone. Runtime and static financial audit receipts retain their distinct scopes.

## Implementation interfaces and ownership

The historical family static gate in `evidence/build-and-prove/families-03/evidence/family-audit.json` records 64 generated roots/golds/identity matrices and 32 reseeds under the earlier contract. It is not current twelve-owner, runtime or statistical-independence evidence. A generated root contains `family.json`, `fixtures/numerical-inputs.json` and the selected case. Bindings remain evaluator-owned under the source bundle's `fixtures/event-bindings/`.

`desk_contract.py` owns exact-decimal serialization, canonical hashing, calendar functions, closed state/envelope/receipt shapes and the journal primitive. `desk_ledger.py` owns opening receipts, atomic orchestration and checkpoint postings. `desk_events.py` owns authored effects, dated approval transitions and scheduled obligations. `desk_actions.py` owns quotes, scoped mandate checks and accepted-action economics. `desk_valuation.py` owns valuations and management overlays; its `client_outcome` comes from the shared pure institutional helper. `desk_replay.py` owns independent semantic replay. `daily_grader.py` owns the nine-section daily report and financial owner checks, consuming shared O9-O12 semantics. `desk_runtime.py` owns persistence and CLI. Main integrates and runs verification after writers finish.

All of these files live under `src/`. Common helpers are `D(value)`, `serial(value)`, `canonical(value)`, `state_hash(state)`, `add_months(date, months)`, `financial_time(family, date)` and `as_of(family, day)`. `CandidateError` is a data/structural refusal; `ActionError` contains a stable refusal code and optional fatal blocker. Missing or inconsistent evaluator inputs raise `ReferenceError`. A complete validated source context is `context = {parameters, family, case, bindings, policy}`; the runtime obtains it with `load_context(family_root, source_root)`. Neither that object nor a source path supplied by a worker is a public worker capability.

The loader computes `policy.source_binding` from the raw public policy, generated input files and required rule-document bytes. This derived object contains relative source identities and hashes, never evaluator filesystem paths. An authored policy cannot supply that reserved field. The raw policy hash excludes this loader-generated binding to avoid recursive hashing. The context remains the five-key object above; candidate packets cannot override its source manifest.

Internal state is plain JSON-compatible data; monetary quantities remain decimal strings between modules. `accounts`, `lots`, `contracts` and `obligations` use stable identity keys. Accounts are signed debit-positive balances. Their closed prefixes identify statutory assets, liabilities, equity, income, expense or management-only overlay. `pending` is an ordered array of accepted dated effects. `legal.rights` is keyed by right, scope and collection identity; it cannot turn scoped permission into general permission. `legal` also holds decisions, approvals, transfer status, observability, facility status and irreversible default facts. `market` retains the authored curves, own CDS, role-specific rating labels and realization-market status. Opening incremental curve moves are explicitly zero by convention; required spreads and ratings still come from source inputs.

A journal is `Journal(state)` with mutable `.state` and generated `.receipts`. `emit(kind, postings, operations, source_evidence, *, action_id=None, event_id=None, terms=None)` verifies debit/credit conservation, applies closed operations, chains a canonical hash and appends one immutable receipt. `postings` is an account-to-signed-decimal dictionary. `terms` is an immutable quoted/contract/event input record, not candidate-declared settlement truth. Operations may change a named lot, contract, obligation, current market/legal fact or accepted/clock field; they cannot replace the entire state. The journal enforces structure and conservation, while action/event handlers enforce economic eligibility. The replay verifier derives permitted economics separately; calling the same handler to reproduce a receipt is prohibited.

Operations use the discriminator `op`. A journal may retain staging metadata `.parent_state`, `.parent_state_hash`, `.parent_revision`, `.parent_market_version`, `.parent_legal_version`, `.phase`, `.action_quotes` and `.blockers`. None is an additional economic state field or a candidate capability. Any `.sequence_start` is derived from `state.last_receipt_sequence`, never supplied as independent authority. The derived source binding may include `documents: {logical_id: {sha256, text}}` for exact reviewed citation spans. These documents must be hash-checked. Only spans actually made available to the worker can support a scored citation.

Events export `load_bindings(source_root, family)`, `visible_events(context, day)`, `day_phases(context, state)`, `apply_event(context, journal, event)` and `settle_scheduled(context, journal, phase)`. Actions export `quote_board(context, state)` and `apply_action(context, journal, action)`. Actions include `phase`, `action_id`, `kind`, and `quote_id` where priced; each kind has a closed payload. Ledger exports `initial_state(parameters, family, *, context)`, `quote_board(parameters, family, state, *, context)` and `settle_day(parameters, family, state, actions, *, context)`. These retain the financial signatures above while making source context explicit. A successful result includes `state`, `receipts`, `blockers` and `accepted`; an atomic refusal returns the unchanged economic state and no receipts. Empty actions are calculation-only and cannot advance the clock. A hold is an accepted action.

The current day's complete available event sequence and phase IDs are public. The action quote board binds the parent revision and each quoted phase's disclosed market/legal inputs. Cash, title and remaining capacity are checked again against the staged state when an action executes. Scheduled receipts respect authored ordering and period-specific overrides. Settlement processes only the current day's disclosed phases, then increments day once and publishes tomorrow's available packet. Publication alone does not receive cash. No future-day event may influence today's action eligibility or quoted capacity.

Valuation exports `value_book(parameters, family, state, *, context)` and `checkpoint_overlay(parameters, family, previous_state, state, *, context)`. The latter returns explicit target overlay balances and an attribution independently tied to those balances; ledger emits the checkpoint postings. Valuation must not import action/event/ledger transition handlers. Current statutory totals, management totals and their bridge remain separate. Replay may use common pricing primitives and the pure valuation module, but cannot import `desk_ledger`, `desk_actions` or `desk_events` transition handlers. It independently verifies receipt sources, amounts, unique economic obligations, legal gates, operations and chain before comparing the final valued book.

Daily grading exports `expected_daily_report(parameters, family, state, book, previous_book=None, *, context)` and `grade_daily(parameters, family, state, report, previous_book=None, *, context)`. Reports retain `schema_version="daily-book.v2"`, `parent_state_hash`, nine required sections and current source support. Grades retain `daily-grade.v1`. Financial fields are owned separately; O9-O12 check institutional conclusions through `institutional.py`. The runtime grades the parent checkpoint, not the returned next-day state. A provisional opening grade is not a scoreable run until an actual worker action is accepted. A rejected action may retain a truthful parent report without pretending execution. Missing/rejected checkpoint credit is not dropped from the fixed observation denominator.

Runtime commands are `init`, `packet`, `submit`, `replay` and `result`, with explicit family/source roots, database path and bounded input/output paths. The database stores source hashes, genesis, state, receipts, accepted-action uniqueness, rejected attempts, parent-checkpoint grades and actual client-outcome history. A single SQLite transaction covers an accepted envelope. Protected packets contain current state, quotes, available events/bindings, prior accepted receipts, public constraints, mandate and conventions/calculator. They exclude generated reference positions, gold, grade diagnostics, future external events, evaluator paths and the observation-stop horizon. The Modal bridge copies only the curated packet and bounded candidate output.

### Snapshot builder

`desk_snapshot.py` is the one seam above `init` and `submit` that turns a desk path into a static case (ADR-0001). `build(family_root=, source_root=, script_path=, day=, output=, engine_root=None, node="node")` and the CLI `build --family-root R --source-root S --script script.json --day N --output DIR [--engine-root E]` open a `DeskRuntime` in a temporary database, submit one envelope per scripted day, and freeze the day-N result under `DIR`. The frozen root is never appended to; `DIR` must not exist.

The script is `{"schema_version": "desk-snapshot-script.v1", "days": [batch, ...]}` with exactly N batches. A batch is `{"actions": [...], "calculations": object|null}`; `actions` is nonempty because an empty action list is calculation-only and never advances the clock, so a pure prefix uses `hold_capital`. A scripted action carries `kind`, `action_id`, its closed payload, and optionally `phase` and `quote_terms` (a subset of the quote's `terms`); `quote_id` is never scripted because quote ids embed the parent revision and versions. The builder resolves each action against the current quote board by kind, then phase, then term subset, taking the earliest phase. Every batch must settle as `accepted` and advance exactly one day; a refusal, `settled_prefix` or `calculations_recorded` aborts the build with `SnapshotError` and no output.

The frozen root is the `export_practice` layout plus the snapshot artifacts: byte copies of the static schemas, rule documents, `docs/exhibit-fields.md`, `fixtures/numerical-inputs.json`, `worker/legal-terms.txt` and `worker/docs/desk-runtime-contract.md` from the family root and `fixtures/desk-policy.json` from the source root; `worker/packet.json`, the day-N packet with every receipt page concatenated (`receipt_window.after_sequence` 0, `has_more` false; this file is not bounded by `max_packet_bytes`); `fixtures/case-exhibits.json`, one case whose `episode_id` is the family branch (one of the five static case ids, which is how the static grader selects it), whose public keys are verified identical to the packet's `public_inputs.case`, carrying the static-schema tables the family case already carries, plus the `RECEIPT_LOG` document and `snapshot: {day, parent_state_hash, run_prefix_hash}` where `run_prefix_hash` is `state.last_receipt_hash`; `docs/receipt-log.md`, one anchored section per receipt id whose summary line is the locator quote and whose body is the canonical receipt; and `snapshot-manifest.json` with the script digest and content hashes. `family.json`, `binding-manifest.json`, `fixtures/expected-reports.json` and `fixtures/mutation-fixtures.json` are excluded. The static validator requires `snapshot` and `RECEIPT_LOG` to appear together; cases without either validate unchanged.

Determinism: two builds of the same roots, script and day are byte-identical. The packet's `run_id` (a UUID minted at `init`) is replaced by the first 32 hex digits of SHA-256(canonical script, parent_state_hash); attempt and run timestamps stay in the discarded temporary database; receipts carry no wall-clock fields; all generated JSON is written with sorted keys.

Grader-only refusal: before any path is created, the builder scans the family's public surface (the case's public keys and `worker/*.json`) and every JSON value it would write for the union of the worker boundary's forbidden keys, the probe suite's private packet fields, `accepted_positions`, `expected_report` and the static recipe vocabulary (`expected_reports`, `mutations`, `supplemental_mutations`, `expected_failure_matrix` and their row fields). Any hit raises `GraderOnlyContent` (CLI exit 3) and nothing is written. Rating labels named `grade` beside a `scope` or `instrument` field are source data, not a leak. The single exemption is the static schema's required `accepted_positions` table at the top level of the case in `fixtures/case-exhibits.json`, which is evaluator-side; it is refused anywhere else, including under `worker/`. Schema files are byte copies and are not content-scanned. Acceptance is `src/test_desk_snapshot.py`; a worked script is `fixtures/snapshot-scripts/FUND_01-hold-day3.json`.

`public_inputs.case` contains `as_of`, `base_currency`, `bank`, `book`, `parties`, `instruments`, `agreements`, `opinions`, `collateral`, `netting_sets`, `counterparty_constraints` and `mandate` from the current case. It excludes `accepted_positions`, future/scenario cash-event arrays and the documents annex. Reviewed legal source material is supplied through the authenticated public-document mechanism, not by exposing the evaluator's case file wholesale.

### Exact state vocabulary

Top-level state keys are the closed list in State and receipts; no evaluator context, grade or future event path is stored in it. Genesis `last_receipt_hash` is 64 zeroes and all counters start at zero. `accounts` uses these exact debit-positive names: `cash`, `restricted_cash`, `restricted_collections`, `retained_U`, `deployment_principal`, `deployment_accrued`, `reinvestment_principal`, `inventory`, `posted_vm`, `unpaid_receivable`, `statutory_derivative_asset`, `statutory_derivative_liability`, `repo_debt`, `facility_debt`, `sale_financing`, `legacy_debt`, `received_vm`, `return_liability`, `unpaid_payable`, `claim_allowance`, `contributed_equity`, `income_carry`, `income_mark`, `income_hedge`, `expense_fees`, `expense_funding`, `expense_loss`, `management_funding_mark`, `management_hedge_asset`, `management_deferral`, `management_xva`, `management_income_mark`, `management_income_deferral`, `management_income_reserve`, `management_income_hedge`. The eight `management_` accounts form a separate balanced overlay. All accounts exist from genesis, even if zero. A liability/equity/income credit is negative. Core account balances are never inferred from candidate totals.

The statutory derivative accounts record only actual separately recognized OFFSET or CDS contracts. They do not create a second derivative for the retained-U funding accounting unit. The public runtime offset quote treats the quoted value as signed legal fair value: fair consideration received by the desk is its negative. The original quoted upfront fixes the running spread; the current remaining-tenor quote determines today's fair consideration. Cash plus the newly recognized signed derivative balance has zero inception P&L before real fees. The static netting comparison already contains both trades and is not evidence that either fill occurred in the daily book. An outstanding derivative liability is not an overdue cash payable; only a dated contractual payment creates that obligation.

`market` has exactly `funding_move`, `reference_move`, `own_bond_spread`, `own_cds_spread`, `provider_cds`, `em_move`, `ratings`, `market_open`. `ratings` maps `funding_reference`, `deployment_collateral`, `provider`, `borrower` to source labels. `legal` has `rights`, `transfer_blocks`, `observable`, `facility_status`, `defaults`, `substitution_requests`, `disputes`, `decisions`, `approvals`. `transfer_blocks` has exactly two booleans, `custody_delivery` and `cash_remittance`, initialized by the explicit policy map and changed only by an authenticated event's required `scopes`. No scalar or missing-scope fallback exists. Securities delivery, substitution and realizability use the custody rail and retain their separate title/delivery rights; borrower distributions and matured redemption use actual cash and the cash-remittance rail. A release changes only its named rail. Collection remittance still requires its own named-batch licence, and the independent funding contract is unchanged. The liquidity report exposes the same complete map. `rights` keys are `right|scope|collection_id`, with the last part empty unless collection-scoped; values are `effective`, `conditional` or `denied`. `defaults` keys are `borrower`, `provider`, `reference_issuer`; true cannot revert. Requests/disputes retain their originating IDs and source obligations/batches. Decisions and approvals use the closed records above, not unstructured permission prose.

Every `lots[id]` contains `id`, `instrument_id`, `quantity`, `owner`, `location`, `encumbrance`, `issued`, `return_obligation`, `reuse_permitted`, `enforceability`, `source_evidence`, `book_value`, `issuer_id`, `issuer_kind`, `rating`, `maturity_date`, `coupon_spread`, `correlation`, `class`. Values for `class` are `funding_reference`, `deployment_collateral`, `allocation_inventory`, `replacement`, `equivalent`, `payment_rights`. `encumbrance` is null or an accepted contract ID. An unissued promise is not a lot. Source received security ownership remains the borrower for a pledge and the desk with a return obligation for a repo/title transfer; statutory loan exposure is never doubled by that legal form.

Every `contracts[id]` has `id`, `kind`, `status`, `execution_date`, `effective_date`, `maturity_date`, `payment_dates`, `terms`, `state`, `source_evidence`. Immutable `terms` are copied from the authenticated source/quote. Contract `state` contains only the per-kind consumed balances/reset/paid-period fields specified by its handler. Live IDs begin `FUND_TRS`, `DEP_LOAN`, `DEP_SECURITY`, `LEGACY`, `FACILITY`; later IDs are `kind:action_id`. New contract states cannot amend locked historical terms. Each `obligations[id]` has `id`, `kind`, `contract_id`, `period_id`, `amount`, `remaining`, `paid_amount`, `side`, `due_day`, `status`, `source_evidence`, `metadata`; side is `payable` or `receivable`, status is `open`, `paid`, `written_off` or `disputed`. Identity is contractual period or authenticated event, not a fresh settlement receipt. `metadata` records the exact batch, account or deposit purpose needed by the specific obligation kind.

`pending` items have `id`, `kind`, `due_date`, `contract_id`, `action_id`, `terms`, `source_evidence`. A source due date is public once its originating action/contract/event is known. It is not a hidden future external event. `accepted_action_ids` and `applied_event_ids` are arrays with uniqueness enforced. Source numeric policies required beyond the inherited inputs belong in worker-readable `fixtures/desk-policy.json`, owned by CoreLedger. That file must explicitly map the new account classes' capital and leverage treatment, business-day/weekend convention, repo and reinvestment conventions, default/claim assumptions and supported finite resource limits. A policy value cannot silently substitute for a missing source price, instrument, legal gate or quote.

Operations are a closed union: `put_lot`, `put_contract`, `put_obligation`, `put_decision`, `put_approval` with `id,value`; `remove_lot` with `id`; `set_market`, `set_legal` with `key,value`; `put_right` with `key,value`; `put_dispute`, `put_request` with `id,value`; `add_pending` with `value`; `remove_pending` with `id`; `accept_action`, `mark_event` with `id`; and `commit_day` with `day,as_of,financial_time,revision`. No arbitrary JSON-pointer or account-mutation operation is accepted. Accounts change through balanced postings. Replay independently checks each operation, including decision/approval identity, dates, mandate scope and consumption.

Quotes have `id`, `kind`, `parent_state_hash`, `revision`, `market_version`, `legal_version`, `phase`, `as_of`, `valid_until`, `terms`, `source_evidence`. Phase IDs are integer gaps `0..n` around the current day's authored events, with scheduled milestones included by `day_phases`. Common action fields are `kind,action_id,phase,quote_id`. Additional fields: `amount` for facility draw/repayment; `assignments` for repo allocation; `contract_id` for repo repayment/designation/reversal; `lot_id` for sale/return/liquidation; `instrument_id,quantity` for buying equivalent; `obligation_id,amount` for margin/payable/claim settlement; `amount,tenor_years` for reinvestment; `rule_id,reason_code,premises,rationale` for escalation/decline. Other kinds have no extra payload. All per-kind fields are required; unknown fields reject.

Decision payload limits are 16 premises, 2,000 rationale characters and 32 scalar items in a premise value list. `rule_id` and `reason_code` are nonempty identifiers of at most 128 characters. Action-premise pointers start with `/` and follow RFC6901. Floats and nested value objects are not accepted. State retains at most 256 decisions and 256 approvals under the disclosed policy limits.

Base contract state keys are closed. `FUND_TRS` has `principal`, `last_reset_price`, `last_reset_date`, `last_accrual_date`, `paid_periods`, `reset_periods`, `observability_history`, `vm_balance`, `unsettled_stub`, `netting_id`, `checkpoint_attribution`. `DEP_LOAN` has `outstanding_principal`, `paid_periods`, `prefunding`, `concession_spread`, `concession_start_date`, `last_accrual_date`. `DEP_SECURITY` has `active_lot_id`, `collection_batches`, `rights_chain`, `liquidated_quantity`, `returned`. `LEGACY` and `FACILITY` have `outstanding_principal`, `interest_accrued`, `interest_paid`, `last_accrual_date`, `paid_periods`. Later contract kinds use the initiating action kind and the handler's reviewed, closed state shape.

The evaluator freezes an optional `observation_end_day` at initialization outside economic state and outside the worker packet. Final normalized scoring uses that fixed observation span; any unobserved remainder after stalling or a fatal blocker contributes zero without fabricating a clock advance or receipt. Live results expose a provisional raw score integral and elapsed coverage, not a final normalized score. No configured span means no final percentage. A fatal blocker ends observation and prevents further accepted actions. Missing or invalid calculations contribute zero on an otherwise valid accepted day; malformed envelopes still reject before any action. A later accepted envelope uses its own exact-parent report, never the best score from rejected attempts.

A fatal assertion in otherwise well-formed parent calculations does not cancel valid actions in the same envelope. The evaluator grades the parent, settles independently valid actions, then latches report and settlement blockers before another day can execute. Thus changing calculations alone cannot change that envelope's cash or title. A reference failure prevents execution; a structurally invalid envelope or economically invalid action batch remains an atomic refusal.

Book output retains `schema_version="daily-book-value.v2"`, `parent_state_hash`, `as_of`, `financial_time`, `rates`, `credit_xva`, `capital`, `liquidity`, `accounting`, `source_evidence` and adds `client_outcome`. `accounting` retains separate `statutory`, `management`, `bridge`, `attribution`, `terminal` sections. Valuation sends computed values directly to DailyGrade. `rates.deployment_coupon_spread` follows the executed loan and effective substitution concessions, not an inference from annual expense. `checkpoint_overlay` returns `postings`, `attribution`, `targets`, `source_evidence`; no unexplained residual account may force reconciliation.

`client_outcome(case, parameters, *, family, state, book)` in `institutional.py` derives the outcome from authenticated inputs without calling valuation. Identity fields are `party_id`, `legal_form`, `classification`, `currency`, `funding_deadline`; amounts are `cash_required`, `cash_delivered`, `contractual_spread`, `capital_shortfall`, `deadline_shortfall`. `delivered_at` is a date or null. Predicates are `deadline_met`, `legal_form_allowed`, `classification_consistent`, `return_obligation_met`, `approvals_satisfied`, `client_executable`, `bank_viable`, `successful`, `borrowing_ceiling_satisfied`, `maximum_spread_satisfied`, `inherited_delivery`. `failures` retains the reasons. Missing or invalid source facts are reference errors; unmet client goals are unsuccessful outcomes.

Original borrower delivery comes from the settled `CF_DEPLOY` source cash flow and its `opening_deployment` receipt, not current outstanding principal or a new worker action. Its original settlement date determines deadline performance. A setup payment to P is not a borrower fee. Later action costs and effective contractual terms remain in their own receipts and valuations. Final outcomes do not replace the stored history of earlier failed owner-days.

The run result's `institutional` object contains `client_outcome_owner="O11"`, `checkpoint_outcomes`, `final_client_outcome`, `decisions` and `approvals`. `checkpoint_outcomes` reports `observed_days`, `successful_days`, `unsuccessful_days`, `inherited_successful_days` and `latest`. A latest row identifies `attempt_id`, `parent_state_hash`, `day`, `revision`, `elapsed_days` and `client_outcome`. `history().attempts[i].checkpoint.client_outcome` retains the immutable parent outcome independently of report validity. Outcome days are not summed cash flows.

Each owner's score integral uses its exact-parent grade weight times checkpoint `elapsed_days`. O11 requires successful actual outcome plus accurate source-supported reporting. Inherited success may earn current O11 credit but stays tagged as inherited. A fixed evaluator observation span includes any unobserved remainder at zero; without a configured span there is no final percentage. `final_client_outcome` cannot overwrite history or award retroactive points.

## Explicit scenario windows

`family_generator.generate_scenario_windows(root, output_root, seeds=(1,))` materializes the selected windows into a fresh output directory and writes `manifest.json` with `schema_version="scenario_windows.v1"`, `source_file`, `source_sha256`, `windows`, `independence_established` and `actual_axis_consequences`. Window rows retain the generated-family identity and root, purpose, observation end day, funding/window/anchor dates and scenario-definition hash. Generation records `independence_established=false` and `actual_axis_consequences="pending_runtime"`; it does not claim execution.

Pass the materialized manifest to `desk_probes.audit_desk(..., scenario_windows_manifest=...)` or its `--window-manifest` CLI option. Omission produces a missing-window proof, not a pass. There is no fallback to an older directory or automatic selection of the newest run. The supplied manifest must bind current `fixtures/scenario-windows.json` bytes and seed-1 roots for all six definitions, each with its declared 20-day horizon. The original four windows are unchanged; `FUND_04_Q20_EQUIVALENT_RETURN` and `DPR_05_Q1_PARTIAL_PRICE_RETURN` are expressly related lifecycle regression windows, not additional independent families. A scored window is not extended to 24 days to obtain a later favorable result. The manifest and generated roots accompany the run's evidence; this evaluator configuration does not expose tomorrow's events to a protected worker.