42. Auction, settlement, accounting, mandate, and transfer engine

Listing is a versioned disclosure and authority package
Listing {
  listingId, subjectAssetId, configurationSnapshotId,
  sellerPrincipalId, sellerAuthorityRecordId, beneficiaryIds[],
  titleAndLienAssertionRefs[], custodyAssertionRefs[],
  conditionDossierDigest, disclosureArtifactDigest,
  includedItems[], excludedItems[], includedRights[], excludedRights[],
  personaDispositionPolicy, jurisdiction, currency, termsDigest,
  inspectionPolicy, settlementProfileId, status
}

Listing state:
  DRAFT -> AUTHORITY_PENDING -> DISCLOSURE_PENDING -> READY -> SCHEDULED
  -> OPEN -> PAUSED -> CLOSE_FENCED -> CLOSED -> SETTLING
  -> SETTLED | NO_SALE | FAILED | CANCELLED | DISPUTED

Immutable bid and admission records
AuctionRuleSet {
  ruleSetId, auctionMode: DIRECT_ASCENDING|PROXY_MAXIMUM|SEALED,
  currency, openingAt, initialCloseAt, hardStopAt?,
  minimumIncrementFunction, tieRule, reservePolicy,
  bidderEligibilityPolicy, depositPolicy?, antiSnipingWindow?,
  extensionDuration?, maximumExtensions?, bidWithdrawalPolicy,
  pausePolicy, cancellationPolicy, visibilityPolicy,
  settlementProfileId, ruleSetDigest
}

BidIntent {
  bidId, auctionId, bidderPrincipalId, bidderAgentId?,
  amountMinor, maximumProxyMinor?, currency, termsDigest,
  confirmationArtifactId, depositHoldId?, clientCreatedAt,
  submittedAt, idempotencyKey, bidDigest
}

BidAdmissionReceipt {
  bidId, auctionId, auctionStreamSequence, trustedReceivedAt,
  eligibilityDecisionId, fundsDecisionId?, admittedAmountMinor,
  encryptedProxyMaximumRef?, ruleSetDigest, bidDigest,
  status: ADMITTED|REJECTED, reasonCode?
}

Deterministic extension rule
if trustedReceivedAt < currentCloseAt
   and trustedReceivedAt >= currentCloseAt - extensionWindow
   and bidAdmission == ADMITTED:
  newCloseAt = min(hardStopAt,
                   max(currentCloseAt, trustedReceivedAt + extensionDuration))
  append AuctionExtended(triggeringBidId, previousCloseAt, newCloseAt,
                         ruleSetDigest, auctionStreamSequence)

The close boundary is strict: trustedReceivedAt < currentCloseAt.
Client clocks, feed order, UI refresh and notification delivery do not rank bids.

Per-auction serialized close transaction
closeAuction(auctionId, expectedStreamHead):
  begin SERIALIZABLE transaction
  auction = lock auction stream
  require auction.streamHead == expectedStreamHead
  require auction.state in {OPEN, PAUSED_AS_CLOSEABLE}
  require trustedNow >= auction.currentCloseAt

  append CloseFence(fenceSequence=nextSequence,
                    trustedCloseTime, ruleSetDigest)
  bids = ADMITTED bids with admissionSequence < fenceSequence
  eligible = reevaluate locked close-eligibility policy over bids
  result = lockedAlgorithm(eligible, reserveCommitment,
                           incrementFunction, tieRule)
  append AuctionCloseReceipt(
    closeFenceSequence, exactEligibleBidIds, excludedBidFindings,
    winnerBidId?, closingPriceMinor?, reserveDisposition, noSaleReason?,
    algorithmDigest, resultDigest)
  transition to CLOSED or NO_SALE
  commit

Only AuctionCloseReceipt selects the winner. A later higher offer, payment order,
feed order, seller preference or appraisal cannot replace it.

Payment, escrow, inspection, custody, title, persona and rights do not collapse
SettlementSaga {
  settlementId, auctionCloseReceiptId, buyerPrincipalId, sellerPrincipalId,
  beneficiaryIds[], settlementProfileId, purchaseAgreementDigest,
  paymentIntentId?, escrowProviderId?, escrowOperationId?,
  titleAndLienCheckIds[], inspectionDecisionId?, taxAndFeeQuoteId?,
  documentExecutionIds[], custodyHandoffId?, titleTransferAssertionId?,
  personaDispositionId?, rightsDispositionIds[], milestoneStates[],
  compensationIds[], disputeId?, finalReceiptId?
}

Milestones:
  PREFLIGHT -> BUYER_IDENTITY_VERIFIED -> SELLER_AUTHORITY_VERIFIED
  -> TITLE_AND_LIEN_REVIEWED -> FUNDS_AUTHORIZED -> FUNDS_IN_ESCROW
  -> INSPECTION_PASSED|WAIVED|FAILED -> DOCUMENTS_EXECUTED
  -> CUSTODY_HANDOFF_CONFIRMED -> TITLE_TRANSFER_EXTERNALLY_ASSERTED
  -> ACCEPTANCE_CONFIRMED -> FUNDS_RELEASED -> COMPLETE

Incomplete milestone -> SUSPENDED -> COMPENSATING
  -> REFUNDED | PARTIALLY_COMPENSATED | DISPUTED | OPERATOR_REQUIRED

External legal authority remains external
The platform does not claim to provide regulated escrow unless the responsible entity is authorized to do so. Payment success does not transfer title. Custody does not transfer persona, voice, media, telemetry or profile rights. Registry output is an attributed assertion, not a fact manufactured by the platform.

Canonical accounting invariants
LedgerAccount {
  accountId, legalAccountHolderId,
  accountType: ASSET|LIABILITY|EQUITY|REVENUE|EXPENSE|MEMORANDUM,
  currency, providerRef?, restrictedPurpose?, status
}

JournalBatch {
  journalBatchId, economicEventId, journalPolicyDigest,
  status: DRAFT|VALIDATED|POSTED|REVERSED,
  bookedAt, effectiveAt, currencyGroups[], lines[], sourceReceiptIds[],
  reversalOf?, periodId, postingDigest
}

JournalLine {
  lineId, accountId, currency, debitMinor, creditMinor,
  vehicleId?, personaId?, missionId?, beneficiaryId?,
  providerRef?, taxCodeRef?, revenueShareRef?
}

For each currency group: sum(debitMinor) == sum(creditMinor).
Each line has exactly one positive side. Posted batches are immutable.
Corrections append a full/partial reversal and a replacement. One economic event
has at most one active posted batch under one journal policy.

Concurrent actions cannot overspend a mandate
EconomicMandate {
  mandateId, principalId, beneficiaryId, agentInstanceId,
  allowedActionKinds[], allowedCounterparties[], allowedMerchantCategories[],
  prohibitedCounterparties[], perActionLimitsByCurrency{},
  periodLimitsByCurrency{}, rollingWindowPolicy, confirmationThresholds{},
  maximumOpenReservations, validInterval, mandateEpoch
}

BudgetReservation {
  reservationId, mandateId, actionId, currency, amountMinor,
  status: HELD|CONSUMED|RELEASED|EXPIRED|DISPUTED,
  heldAt, expiresAt, consumedByEconomicEventId?
}

lock mandate counter
if postedUsage + activeReservations + requestedAmount > periodLimit: reject
else append HELD reservation and increment active reservation total atomically

Provider uncertainty remains explicit
reconcile(operationId):
  lock operation stream
  if state != UNKNOWN_EFFECT: return current state
  evidence = query provider by immutable providerOperationId or idempotencyKey
  verify provider identity, signature, schema and correlation

  if provider proves success:
    append EffectConfirmed
    create entitlement/payment/market records exactly once
    post journal exactly once; consume reservation; settle action
  elif provider proves no effect:
    append ProvenNotEffected; release reservation
    retry only if proposal, confirmation, grants and connector policy remain valid
  elif evidence conflicts or reconciliation deadline passes:
    append OperatorRequired; preserve reservation or book explicit exposure
    prohibit automatic retry

Webhook and poll races converge on one provider operation, economic event and
active journal batch. Timeout never means failure; ambiguous not-found never
authorizes blind retry for a non-idempotent provider.

Transfer is a coordinated revocation and succession transaction
TransferPlan {
  transferPlanId, assetId, transferorPrincipalIds[], transfereePrincipalIds[],
  titleDisposition, custodyDisposition, profileAdministrationDisposition,
  personaDisposition: TRANSFER|RETAIN|LICENSE|FORK|RETIRE,
  followerGraphDisposition, historicalContentDisposition,
  mediaRightsDisposition, telemetryAndPrivateDataDisposition,
  outstandingListingIds[], outstandingAuctionIds[], outstandingActionIds[],
  scheduledPublicationIds[], economicMandateIds[], providerCredentialRefs[],
  legalHoldRefs[], effectiveAt, approvalRequirements[], state
}

DRAFT -> COUNTERPARTIES_VERIFIED -> RIGHTS_RESOLVED
  -> OUTSTANDING_EFFECTS_RESOLVED -> QUIESCING -> HANDOVER_COMMITTED
  -> EPOCHS_ADVANCED -> CREDENTIALS_ROTATED
  -> PUBLIC_SUCCESSION_DISCLOSED -> COMPLETE

Any pre-commit state -> ABORTED
Any unresolved post-effect state -> OPERATOR_REQUIRED