5.1 Physical quantities and title states

Fix a fine-gram unit and rational quantities in that unit. A physical lot has a permanent identity, refiner, serial number, gross weight, assay, and custody history. Its fine weight is gross weight times fineness, with both units recorded. Different names for the same lot are aliases, resolved before they supply allocation capacity. Custody location and assay revisions change evidence about the lot, not its identity.

To prevent two accounts from using the same recorded quantity, give every part of a lot an accounting coordinate. A half-open interval includes its left endpoint and excludes its right endpoint, so adjacent intervals do not overlap. Represent a lot’s recorded fine weight by a half-open interval. The interval is an accounting coordinate, not an assertion that particular atoms belong to particular co-owners. Intervals from different lots form a disjoint union W with fine-weight measure \mu. Authenticated intake evidence determines the currently supported subset V_t\subseteq W. The route specifies assay scope, evidence cutoff, freshness limits, and required custody confirmations. Expired assay evidence or a missing required transit confirmation removes the affected quantity from usable support until current evidence establishes it. The retained title and physical-support exposure remain visible during that interval. A title unit is one recorded holding. Its face quantity is the amount of the recorded entitlement, before any physical-support shortfall. Every title unit u has a holder, positive face quantity w_u, and a retained allocation history J_u^{\mathrm{hist}}. The transfer construction in section 7 refines the holder into registered owner and beneficiary without counting the quantity twice. That history records each slice assignment and its effective interval. Current supported allocations are disjoint; conflicting historical ownership claims remain in reconciliation holds. An undivided bulk share obtains its legal effect from the applicable property law. The slice map implements the quantity limit for that share.

Each supported slice is free, reserved, allocated, or held for reconciliation, exactly once. An allocation spans all customer accounts, lenders, bulks, and custody locations using that physical lot. A generation identifies the current version of a record. Admission compares the current lot and policy generations and commits every affected slice atomically. An atomic transaction records all its changes together or leaves them unapplied. This compare-and-commit rule prevents two requests from both consuming a version that only one may use. Two schedules bearing different identifiers cannot allocate overlapping slices. An incoming migration record refers to the existing lot and consumes its outgoing transit reservation. It cannot create another lot merely by naming another vault. A remelt retires its input coordinates and maps disjoint output coordinates to the retained owners in one transaction. Certified output fine weight cannot exceed certified input fine weight less recorded process loss. Loss remains a quantified exposure against the affected owners and the responsible obligation.

Let U_t contain the title-unit history. The five state labels describe the holding’s legal and operational stage. Supported quantity and impairment remain separate qualifiers of that state. The five states are:

• \mathrm{AP}, allocated and present: the holder has the recorded title and the custody evidence supports its current location.

• \mathrm{EN}, encumbered: the same title carries the recorded lender interest and any separately identified senior restriction.

• \mathrm{LO}, lent and outstanding: the holder elected conversion to a redelivery claim against the named direct borrower.

• \mathrm{IR}, in redemption: the record names source custody, carrier transit, receiving-vault intake, or cash sale.

• \mathrm{DV}, delivered: the completed title disposition remains terminal history.

Delivered closes the tracked disposition or delivery in this title-unit history. It does not assert that physical delivery extinguishes the recipient’s property. A custody migration within the register instead preserves the same active holding and lot. The customer view also records supported quantity, impaired quantity, actual external effects, and outstanding claims. An \mathrm{AP} label with impaired support is never displayed as fully backed available metal. An adverse external act remains recordable even when it violates an admitted program’s premises. Its physical consequences and legal consequences require separate evidence. Theft can remove custody support without transferring legal title.

Let C_t\subseteq U_t contain current physical claims: active units in \mathrm{AP}, \mathrm{EN}, or \mathrm{IR}. Released \mathrm{LO} claims, terminal \mathrm{DV} records, and retired split parents belong only to their applicable obligation or history projections. For u\in C_t, let J_u(t) be its current recorded slice assignment, with \mu(J_u(t))=w_u. Let H_t^p be the physical coordinates held for ownership reconciliation. Current supported allocation is I_u(t)= \begin{cases} (J_u(t)\cap V_t)\setminus H_t^p,&u\in C_t,\\ \varnothing,&u\notin C_t. \end{cases} For u\in C_t, its physical support deficit is d_u=w_u-\mu(I_u(t)). Historical slice assignments supply no current physical capacity. An outstanding \mathrm{LO} quantity instead measures the separate redelivery or permitted settlement obligation. If evidence reduces V_t, the retained entitlement remains attached to each affected slice. Restored support returns to that entitlement before free capacity is computed. Conflicting aliases preserve both histories and identify disputed ownership until a joint, authorised reconciliation changes the affected claims. Each conflicted canonical slice enters a reconciliation hold and contributes to no claim’s current supported allocation during that reconciliation. Resolving the conflict requires the corresponding adjustments to every affected claim before the slice can support its determined owner. No correction or cancellation releases a previously consumed ownership claim as unused inventory.

5.2 Cash occurrences, allocations, and obligations

Receiving cash and applying it to a claim answer different questions. One receipt can pay several claims through a partition of its amount. It cannot supply that complete amount to each claim. A command identifier binds the immutable instruction before dispatch. Retries keep that identifier. A cash occurrence identifies one authoritative account posting by recipient account, asset, namespace, record kind, and stable reference. Reporter names, legal origins, observed phases, and changing amount assertions do not create another posting. An interbank debit, recipient credit, and foreign-exchange leg are separate occurrences connected by causal links. Authenticated aliases identify the same posting and are resolved before attribution capacity is created.

For each occurrence e, retain stable quantity slices and the ownership of every consumed allocation. At time t, its supported slices partition as Q_e(t)=U_e(t)+R_e(t)+H_e(t)+\sum_\lambda S_{e,\lambda}(t). Here the left side is the occurrence’s total currently supported quantity. All terms use the occurrence’s asset and unit. U_e is unused support, R_e never-consumed reservation, H_e a reconciliation hold, and S_{e,\lambda} supported committed attribution. Unsupported historical slices remain separately attached to their consumed allocation identities. An allocation \lambda names one claim, purpose, beneficiary, and contributing command. Claim and command reports group these same rows. Other causal references consume nothing. Reassignment transfers an existing row and adjusts both claims atomically under the governing authority. Superseded rows remain history and contribute zero to the current projection.

Receipt attribution records which performance an observed payment supports. The current account balance instead determines whether another outgoing payment can be funded. The cash account is separate. Write a positive part as the larger of its argument and zero. For balance b, funding reservations r, and senior encumbrances z, define f=(b-r-z)_+,\qquad d=(r+z-b)_+, \qquad b+d=f+r+z. New payment commands reserve f before dispatch. Historical receipt attribution does not debit cash again. Ordinary spending does not restore a receipt’s attribution capacity. An actual return or chargeback is a new debit occurrence. An amount correction revises evidence about the original posting and is applied once to each accounting projection. It does not fabricate a physical debit. Each unsupported attribution becomes a quantified claim-support discrepancy while preserving its owner.

An obligation records its governing instrument or legal act, parties, asset, quantity, deadline, authority, and remaining performance. Its legal status distinguishes an asserted claim, an effective obligation, and a disputed obligation. Creating a record does not supply its legal basis. Calculation, reservation, and dispatch leave the outstanding quantity unchanged. Only allocated actual performance or a separately authorised legal discharge reduces it. A partial fill reduces only its supported performed quantity. The unresolved command retains its possible remainder and funding reservation. A replacement command requires conclusive remainder closure or a provider-enforced transfer of that execution capacity. Remainder closure establishes that the old command can perform no more of its unpaid remainder. A missing reply or elapsed deadline does not establish that fact.

The complete state contains title units, physical slices, assertions, cash allocations, funding domains, commands, obligations, gap reservations, policy generations, and receipts. Each receipt binds before-state, after-state, exact instruction, affected resources, authority, and evidence dependencies. Replay reconstructs this state and never dispatches an external action. Current-use authority is checked at the stage required by the governing instrument, including dispatch or provider acceptance where applicable.

5.3 Purchase capacity and unmatched receipts

A pooled purchase allowance is a contractual quantity awaiting allocation or refund. It creates no title unit. Let g_t be admitted unallocated grams and r_t^g all unresolved pre-dispatch reservations in grams. At a fixed cap \bar g, a command for n grams is admitted atomically only if g_t+r_t^g+n\leq\bar g. Receipt admission converts the same reservation into an allowance. Allocation or actual refund consumes the corresponding outstanding allowance quantity. Partial allocation and partial refund use disjoint quantity slices and preserve the remainder. Conclusive completion with no possible further effect releases unused reservation. A timeout alone releases nothing. An authoritative cap reduction is recorded even below existing commitments, exposing excess e_t^g=(g_t+r_t^g-\bar g_t)_+. Every subsequent increase must fit current headroom.

The provider journal records actual cash before purchase admission. Cash received without a matching reservation, after expiry, or beyond the instruction remains an observed balance. The unmatched amount creates one linked restitution or allocation obligation under the applicable contract or legal act. It enters the separate unmatched-cash exposure book, not the capped admitted gram book. Admission failure cannot erase it or certify that the gap cap bounded an unsolicited external receipt. Attribution later moves the same receipt slices into the admitted purchase or actual refund. Neither route creates another cash occurrence.

5.4 The title transitions

The customer can now change the holding through a specified operation. Each rule identifies the authority required and the quantity or obligation that survives. The following rules operate on exact weighted unit slices. An authorised split retires a parent identifier and creates children with the same holder and a disjoint partition of its quantity and obligations. The parent contributes only history after that split. This permits partial delivery without manufacturing another entitlement.

(R1)

Purchase. A signed instruction, allocated received cash, and current route authority support the purchase. Direct allocation additionally reserves disjoint supported physical slices and creates \mathrm{AP} units. A pooled purchase converts its existing gap reservation into a quantity-matched allowance.

(R2)

Allocate or refund. Allocation consumes allowance slices and assigns the same quantity of available physical slices to fresh \mathrm{AP} units. Refund consumes allocated actual repayment and the corresponding allowance slices. Residual quantity remains outstanding.

(R3)

Pledge. The holder’s instruction, applicable perfection evidence, lender acceptance, and custody acknowledgment identify the exact interest and its priority. The rule changes \mathrm{AP}\to\mathrm{EN} and reserves the existing physical slices. It supplies no additional physical capacity.

(R4)

Release. A signed lender release or an effective conditional release mandate identifies the units. Its payment conditions require allocated actual payoff, where applicable. The custodian records the interest’s termination. The rule changes \mathrm{EN}\to\mathrm{AP}. Pending payoff commands and senior restrictions remain until their own closure conditions hold.

(R5)

Enforcement. The recorded default, enforcement authority, custody disposition, and priority schedule control the disposition. A completed sale creates separate lender, fee, and surplus obligations against the same proceeds. Actual title disposition enters \mathrm{DV} while each unpaid beneficiary claim remains. The exchange is complete only when its required cash and title legs are complete.

(R6)

Lease. The holder elects a named direct borrower, term, quantity, fee, and collateral or guarantee. Current product authority, borrower acceptance, and custody release change \mathrm{AP}\to\mathrm{LO}. The physical allocation ends and an equal-quantity redelivery obligation begins. Its collateral is reserved in its own funded domain.

(R7)

Redelivery or cash settlement. Actual returned metal passes intake, assay, uniqueness, and physical-capacity checks before \mathrm{LO}\to\mathrm{AP}. Permitted cash settlement uses allocated actual payment before the corresponding slices enter \mathrm{DV}. Partial return leaves the remainder in \mathrm{LO}. Default preserves that remainder and its recovery claim.

(R8)

Redemption election. A holder instruction changes eligible \mathrm{AP}\to\mathrm{IR} under the current shortage and priority policy. Encumbered units first require (R4), or the separately authorised enforcement route (R5). An election alone releases no physical allocation.

(R9)

Delivery. Source release and carrier acceptance transfer exclusive physical control into a transit reservation. Receiving-vault intake consumes that reservation for the same lot. Destination acceptance closes physical delivery into \mathrm{DV}. A cash sale records actual title transfer and actual cash independently. A proven completed title transfer changes the unit to \mathrm{DV} even when its proceeds remain unpaid. Its completed-exchange status requires both under the selected coupling rule in section 6. A failed second leg leaves a partial exchange and its residual obligation.

5.5 Returns, reversals, and priority

A return, chargeback, refund, or legal unwind names its authoritative occurrence and the prior allocation slices it affects. The event is appended once under its canonical identity. A post-delivery chargeback creates the instrument’s new recovery or restitution obligation. The old \mathrm{DV} unit stays terminal. A physical return can create fresh title units only after a new effective title act and a fresh, nonoverlapping allocation of actual returned stock. An asserted reversal with unknown authority remains disputed evidence. The cash journal still records an actual bank debit and the resulting funding deficit. Repeated evidence for that debit creates neither another debit nor another obligation. The same economic claim can have several legal grounds. A satisfaction group identifies those claims as sharing one maximum recoverable amount, so their combined performance cannot exceed what is owed.

A shortage policy identifies its legal authority, affected bulk, measurement cutoff, senior rights, distribution basis, and revision procedure. It separates each holder’s current proprietary share from any compensatory claim against a liable party. Before an impaired bulk releases further metal, the operator computes the complete affected-holder allocation under that policy. Outstanding delivery reservations participate in that computation. The policy neither silently confiscates another holder’s share nor assumes a contractual restriction binds an insolvency officer. An unsupported restriction is recorded as a legal issue for the competent authority. Pending that decision, the runtime retains claims and reports the unavailable delivery route. Permitted distributions under an effective instruction remain executable.

For a single equal-priority class, suppose applicable law authorises proportional distribution. Let admitted face quantities be w_h, total W_0=\sum_h w_h>0, and distributable supported weight v\leq W_0. Senior restrictions have already been reserved, exactly once, before v is computed. Set a_h=vw_h/W_0 and d_h=w_h-a_h. The effective priority decision reassigns the physical slices and adjusts every affected claim to these quantities while retaining their histories. The arbitrary coordinate order supplies no legal redemption priority. The available property allotment is a_h. d_h records the support shortfall and refers to the separately established liability, if any. Every release for h consumes its remaining a_h quota and the same physical slices atomically. The holder’s pledge divides that holder’s quota under its priority rule and does not deduct the pledged weight from the bulk again. For several priority classes, allocate the available weight to each class in legal order, then apply its stated within-class rule. The sum of all class allotments never exceeds v.

New physical loss or a new legal priority order creates a new snapshot. Prior deliveries remain facts. The revised allocation must account for them and expose any resulting deficit rather than promise retroactive equality. Support restored to retained entitlements cannot become new free stock.

5.6 Conservation and evidence

The invariant concerns both the quantity and the authority for each use. A balanced total can conceal an unauthorized loan or two allocations of the same metal. For holder h, let P_h,L_h,R_h be the face quantities in present, lent, and redemption states. Present quantity includes unencumbered and encumbered title. Let B_h be their total and Q_h the separate purchase allowance. Support and deficit are displayed alongside these face quantities.

Every holder can query title, location, encumbrance, support, deficit, purchase allowance, redelivery claim, partial settlement, and recovery status. Each answer cites its authority and evidence cutoff. Independent replay verifies the disclosed records without repeating any external action.

7.1 Registered ownership, beneficial ownership, and assignment

A change of registered owner need not change the person entitled to the economic benefit. A change of beneficiary need not move the metal. Refine a unit’s holder field into registered owner r_u and beneficiary b_u. The title basis \beta_u states the legal relation between them. Direct ownership can have r_u=b_u. A custody or trust structure can name different persons under its governing instrument. These fields describe one holding and contribute its quantity once. The beneficiary determines its economic holding projection, while registered ownership remains a separate legal projection.

For \mathrm{LO}, set r_u=\bot and let b_u name the current creditor of the redelivery obligation. The bottom symbol here means that this redelivery claim has no registered owner of present metal. Its immutable obligation identifier retains the borrower, originating election, remaining quantity, maturity, and governing instrument. Collateral and guarantee records name the obligation they support and the legal rule under which their benefit follows an assignment. An interest encumbering that claim is a separate object from security supporting its payment. The physical projection of \mathrm{LO} remains empty. Its outstanding redelivery quantity is an obligation quantity, rather than a deficit in a present allocation.

For a partial transfer, the authorised split first partitions the entitlement and its quantity obligations. The complete interest schedule identifies which split children secure the same continuing debt. The split supplies neither a second debt nor a fresh recovery limit. Transfer then changes the selected child’s parties under definition 7.1. A change of title basis requires its own conversion and reconciliation of every affected right.

7.2 The exact admission contract

Let the state contain the complete current register and its dependent records. A transfer request x binds its immutable command, unit identity and generation, mode, existing parties, and complete successor state. It also binds the route’s classification, governing instruments, current policy generations, and evidence dependencies. The successor description includes supported quantity and every continuing restriction. A missing required fact leaves the request pending with the existing right intact.

In the following predicate, the first argument is that complete state and the second is the proposed transfer. The predicate states the checks required at the legally relevant stage.

The single-decision reference relation uses the first alternative in condition (vi). An independently completed external transfer enters the observation relation with its actual effective time and evidence. Later ineligibility cannot erase that observation or retrospectively undo the completed act. Any resulting ownership conflict remains in the joint reconciliation procedure of section 5.

The continuation condition concerns performance, as well as identifiers. Suppose a prepared redelivery still names Alice after assignment to Bob. The assignment must state whether performance to Alice discharges Bob’s claim and which forwarding or recovery obligations survive. A permitted replacement requires the existing command’s remainder closure or the provider’s effective reassignment of that execution capacity. Changing the payee field in a local projection supplies neither event. Completed cash allocations retain the beneficiary who actually received that performance.

The legal route can use transaction-specific consent or an effective standing permission covering the exact transfer. Consequently, an encumbrance creates a condition to satisfy, rather than a universal prohibition on transfer. The same admission relation enables clean and consented encumbered transfers. Transferring a claim whose support is impaired preserves its measured shortfall and the recipient’s acknowledgment of that state.

7.3 Preservation and useful completion

Let \Pi(s) retain the physical partition, funding reservations, historical cash allocations, face quantities, supported quantities, deficits, and outstanding performance. Its interest projection retains identities, priority, scope, and governing obligations. Party fields that the selected legal act changes belong to the separate ownership projection. Shortage allotments and consumed delivery quotas attach to the stable entitlement identity. Their account-level display follows its current beneficiary without resetting any remaining quota.

The first proposition preserves rights. The second establishes executable positive cases under the stated admission and scheduling premises. For example, transfer of five face grams with three supported grams gives the recipient those three supported grams and the same two-gram deficit. Restored support returns to that continuing entitlement before free inventory is computed. Registered transfer to a successor trustee preserves the beneficiary’s five-gram holding. Assignment of five outstanding grams creates a five-gram claim against the same borrower, with the same maturity and admitted supporting rights.

7.4 Consideration and settlement

A transfer for consideration selects one of the exchange contracts in section 6. In the conditional route, the common durable decision makes the transfer in definition 7.1 effective and creates the seller’s funded settlement entitlement. For present-title modes, the buyer’s active \mathrm{AP} or \mathrm{EN} unit retains the existing physical allocation. These present-title transfers differ from the completed redemption disposition in (R9). The sale records the seller’s disposition separately from the buyer’s continuing title. It therefore adds no second current claim on the metal. For redelivery assignment, replace the escrow’s metal leg by an exclusive conditional assignment of the exact obligation and its supporting rights. The obligor and each required security controller recognise that assignment under the same legally operative decision. Commit changes the creditor while preserving \mathrm{LO} and its empty physical projection. Abort preserves the assignor’s claim and the original cash owner’s rights. The two-decision proof of proposition 6.2 then applies to the assigned claim and the seller’s funded settlement entitlement. Its premises concern this assignment contract, rather than a reservation of present metal.

In the partial-settlement route, effective ownership and actual consideration remain separate observations. An effective transfer with unpaid consideration leaves the seller’s outstanding payment claim and its recovery continuation. A funded recovery guarantee additionally requires the reserved resources and execution assumptions in section 9.3. Final payment with incomplete transfer leaves the buyer’s transfer-or-restitution claim. The original payment and title histories remain intact through either recovery route. Gift and trustee-replacement routes instead name their own consideration terms and require the same applicable authority and continuity conditions.

7.5 Reference scope

The finite reference implementation represents the four transfer modes with exact rational quantities and immutable right descriptions. Its admitted-evidence boundary supplies role, scope, effective period, request binding, and current policy generations. The implementation checks those fields under sequential compare-and-commit semantics. It also retains provider acknowledgment for unresolved commands and supporting-right continuity for redelivery assignments. Its twenty tests include useful transfers, partial physical support, every missing required evidence role, conflicting recipients, authority changes, and deterministic replay. The composition test executes forty-eight successive transfers across the three eligible states and their support and continuation cases. These checks concern the reference relation. The durable extension in section 7.6 implements the serialized storage obligation. Authenticated evidence admission and executed provider and legal instruments retain their separate obligations.

7.6 Durable execution of transfers

Suppose Alice submits two transfers of the same five grams, one to Bob and one to Carol. Each request can satisfy its local evidence checks against Alice’s opening state. The register must resolve which request consumes that state before either successor becomes its current record. It must also retain that decision when the caller loses the reply.

The durable implementation stores the complete transfer state in a SQLite database. An immediate write transaction acquires the shared writer reservation before loading the unit, route, policy generations, and revoked evidence. The implementation then applies the same four-mode relation to that current state. It writes the successor, retained evidence, original command result, and transfer receipt in the same transaction. The database commits these records together. Authority changes use the same transaction order.

A checkpoint is a retained complete state from which the record can be checked or resumed. The journal head identifies the latest linked event. The checkpoint contains every reference-state field, including historical cash allocations, funding references, physical slices, and unresolved command descriptions. Exact rational serialization preserves noninteger quantities. The record identifies its transfer semantics and rejects an incompatible decoder or state shape. A keyed authentication code lets a verifier with the retained secret key check that those bytes have not changed. It binds the book identity, which identifies this register, together with its sequence, state, and journal head. Each journal entry binds the prior head and resulting state. A complete replay recomputes both through the admitted transition relation without executing an external action. These checks detect alterations under the retained key and checkpoint assumptions. A trusted external checkpoint is required to distinguish the current database from an authentic earlier copy.

An exact completed-command retry returns its stored original result before evaluating a new transition. Later ownership changes, evidence expiry, or revocation leave that result available for inspection. Reuse of the command with different terms is rejected. Two unrelated units can progress in successive database transactions without replacing each other’s changes. The serialized record is one authority domain. Several independent databases require an additional custody-handover protocol before they can claim exclusive authority over the same title.

Admission evaluates evidence after acquiring the writer reservation and checks its validity again immediately before commit. An expiry encountered while waiting or during the transaction prevents commitment. The instrument still determines the legally relevant action stage and required duration of its permission. The database’s sampled time and commit event remain distinct from an external provider’s effective legal act.

A title transfer can affect who should receive future performance under an existing obligation. The transfer receipt therefore records any stable economic-duty binding, which identifies that underlying obligation independently of its current beneficiary. That identity derives from the authoritative issuer namespace, constituting act, and occurrence index. Current beneficiary, rule labels, and provider reports do not enter it. Exact duty intervals and their quantity unit connect the title unit to that existing duty. A registered-owner change preserves the economic beneficiary. A beneficial assignment produces a distinct authorised economic-change record. Both preserve every pre-issued command’s original recipient and remaining performance rule. The durable outbox retains this record for delivery after the local transaction commits and gives it a stable delivery identifier. Its delivery to another authority requires that authority’s own admission and idempotent consumption: repeated delivery must create no second effect. The local outbox establishes neither cross-database atomicity nor a new external payment.

Eighteen durable tests exercise fresh processes, SQLite writer contention, and six process-exit points from lock acquisition through committed output. They cover both competing and disjoint transfers, exact retries, command equivocation, expiry, revocation, route renewal, and corrupted records. One trace assigns a redelivery claim from Alice to Bob and then Carol while retaining Alice as the prepared command’s original recipient. Another preserves face quantity 5/3, supported quantity 2/3, and their unit deficit through restart. Normal and optimised Python runs execute the subprocesses in the corresponding mode. These are process-crash and transaction-consistency results under SQLite’s storage contract. Power-loss behavior, key custody, hostile rollback protection, and external provider and legal performance require their separately stated operating conditions.

8.1 The performance right and its evidence

A performance right r identifies a constituting act, debtor, beneficiary, commodity, delivery point, and payment terms. Its quantity is Q_r>0 in a named unit, and its total consideration is B_r>0 in a named currency. The constituting act determines whether another contract name represents the same right or a separately earned fee. Two names for the same delivery right share one allocation domain. A sale price and a separately constituted handling fee can use the same delivery evidence. Each fee retains its own performance condition and entitled recipient.

An occurrence x identifies a measurement provider, its record book, and a stable event reference. The measured interval [0,Q_x) carries the reported quantity, unit, and delivery point. An assertion identifier names a report about this occurrence. Additional reports retain the same occurrence identity and cannot alter its admitted quantity by changing their names. An effective measurement correction requires its own transition and evidence.

For an interval I\subseteq[0,Q_x), let k_{r,x}>0 convert the reported unit to the unit of Q_r. The converted quantity is k_{r,x}\mu(I), where \mu is interval length. Units in one dimension use their exact scale factors. A conversion between volume and energy additionally binds its measured factor, occurrence, target unit, and contractual basis. The factor remains fixed within this occurrence’s allocation domain until an admitted correction changes that domain. Money supplies no conversion between physical dimensions.

The receiving party must decide whether the specified delivery satisfies the contract. Its reserved acceptance decision is the local decision that supplied evidence alone cannot replace. The acceptance record binds the complete evidence conjunction. It names the measurement, assay, title document, delivery record, interval, and reserved acceptance decision. The assay states its metric, measurement basis, value, and source sequence number. The contract supplies an admissible quality interval [\ell_r,u_r]. Each document identifies the same occurrence and interval. The receiving point must agree with the contract. An authority epoch identifies the admitted authority configuration for the assertion. Signatures, scope, authority epoch, and validity periods bind each assertion to its admitted source. An observed higher assay sequence prevents a lower sequence from supplying the current assessment. Evidence completeness and the clock remain declared inputs to this admission rule.

8.2 Acceptance, dispute, and conservation

Earned consideration below records the original amounts established by accepted performance. A later correction creates a separate adjustment obligation. It leaves those original earned amounts and their payment history visible. Let \mathcal A_t(r,x) be the accepted intervals of occurrence x for right r. These intervals are pairwise disjoint. Write q_t(r)=\sum_x\sum_{I\in\mathcal A_t(r,x)}k_{r,x}\mu(I), \qquad V_t(r)=\frac{B_r}{Q_r}q_t(r). \tag{1} The state requires q_t(r)\leq Q_r. An acceptance adds an interval only after the complete evidence conjunction passes and this quantity bound remains true. Its economic identity is (r,x,I). The resulting earned amount is B_r k_{r,x}\mu(I)/Q_r. The payoff evaluator is the rule that maps accepted performance to its original payment obligation. It resolves that amount into a directed entitlement with fixed parties, currency, terms, and program identity. Directed means that the record identifies who must pay whom. Program identity identifies the execution instance responsible for that original resolution. The entitlement remains unpaid until actual allocated cash or an effective legal discharge reduces it.

A failed conjunction records the offered interval and the failed condition. It creates no earned amount. The disputed offered quantity is the union of failed intervals after subtracting accepted intervals in the same domain. This union retains a partly cured dispute without counting overlapping failed reports twice. The contract’s remaining performance is Q_r-q_t(r). Several disputed offers can concern that remaining performance, so their aggregate offered quantity has its own field. A projected schedule determines neither current earned consideration nor a distribution from cash.

The proposition concerns consideration earned by a particular right. The physical allocation invariant in proposition 5.2 separately controls title to the commodity. Evidence reuse for a handling fee creates neither another title allocation nor another physical receipt. Actual payment of either obligation remains subject to the shared cash-allocation bound in section 5.2.

For example, a contract requires 100 kilograms for USD 1{,}000. A conforming 40-kilogram interval earns USD 400 and leaves 60 kilograms of performance outstanding. In an alternative branch, the initial offer fails its assay and earns zero. A later conforming acceptance of 10 kilograms leaves 30 kilograms of that offered interval disputed. In the fully accepted 40-kilogram case, a separate handling right paying USD 50 for the complete cargo can also earn USD 20. That fee follows from its own constituting act and performance rule.

8.3 Corrections and execution

Acceptance history and a current payment adjustment are separate records. Suppose an accepted interval originally earns v, and a subsequent effective decision sets its target consideration to v'. The correction appends a directed obligation for the change v'-v. If v'<v, the beneficiary owes the difference under the correction’s governing act. The original entitlement, every received payment, and every cash allocation remain recorded. Actual repayment discharges the correcting obligation. A legal setoff requires its own authority and discharge rule. Thus a corrected assay cannot present a completed payment as cash that never moved.

The reference family uses rational intervals and authenticated evidence envelopes. It executes each earned observation through the common payoff evaluator and retains the resulting original entitlement. New physical observations supply no cash credit.

8.4 Durable acceptance and handover

Consider the accepted delivery of 40 kilograms for USD 400. The buyer pays the full amount. A later effective decision reduces the consideration to USD 100, creating the seller’s separate USD 300 repayment obligation. Suppose the seller repays USD 150. A separate actual return of USD 100 reopens that amount of the original obligation under its governing rule. Reopening restores the corresponding payable amount under that rule. The cash already consumed by the earlier payment remains consumed. The current ledger then contains USD 100 due to the seller and USD 150 due to the buyer. A change of execution representation must preserve both directions, the original USD 400 entitlement, and every payment and return.

Here handover means a change in the representation used to execute payment obligations. It does not move the metal or transfer custody. The physical-event writer first records accepted performance and its earned dues. Handover lets a new payable representation continue servicing those dues while closing that writer to new events. The later continuation construction admits further physical work under a distinct execution schedule.

The durable construction keeps the physical event history and entitlement ledger under one database authority. An event contains the immutable request, its admitted evidence, and a commitment to the result. The command record retains the original result. Replaying these events reconstructs contracts, observations, accepted intervals, disputes, corrections, and their ledger effects. Replay computes the record state without repeating an external action. The complete ledger contains original entitlement bindings, directed correction obligations, cash occurrences, payment allocations, returns, reopenings, and cash reservations.

The source is the physical-event writer just described. Write H for the event history, L for that complete ledger, and c\in\{\mathrm{open},\mathrm{closed}\} for the source status. Let \mathcal R(H) be the ledger obtained by replaying H. While the source is open, the construction maintains L=\mathcal R(H). \tag{2} Each physical operation copies its request before entering an immediate SQLite write transaction. It loads the current source, reconstructs its history, and checks (2). Acceptance and correction then use the rules above with their supplied evidence and evaluation time. An earned acceptance invokes the common evaluator to produce its original entitlement. The operation requires the same complete successor ledger from event replay and durable evaluation before appending its event and command result. One commit makes these changes visible together.

An original due is the payment obligation first created for an accepted delivery. A currency quantum is the smallest rational accounting increment admitted by the representation. Handover adds a canonical representation of the original earned dues under the signed adoption policy. Adoption authorizes this representation to carry the existing obligations under their retained identities. The adoption binds the exact predecessor state, source programs, entitlement identities, currency units, and quantity quanta. It retains the entire ledger L unchanged. For each adopted original due d, the representation assigns payable and discharged portions so that \epsilon_d\,N_d^{\mathrm{payable}}=\operatorname{Outstanding}_L(d), \tag{3} where \epsilon_d>0 is its currency quantum and N_d^{\mathrm{payable}} counts its payable portions. Historical payments and reopenings determine this assignment. Directed correction obligations retain their own original ledger identities and remain available for payment there. They do not become additional portions of the original earned due.

The same transaction closes the physical source and activates the adopted representation. The source closure and the new ledger schema form the persistent fence: the stored condition that prevents a later process from writing through the closed source. Every subsequent source operation reloads these records before admitting a new event. After handover, the source history supplies the accepted physical facts and historical target decisions. The live entitlement ledger supplies current payment balances. Their post-handover relationship therefore retains the fixed source history while payment and recovery continue in the ledger.

In the example, handover retains the two outstanding amounts of USD 100 and USD 150. Fresh, separately identified cash receipts can pay each amount to its entitled recipient through the existing ledger operations. The original USD 400 earned due and USD 300 correcting due retain their original amounts after both balances reach zero. Another report about either cash occurrence adds evidence to that occurrence while preserving its single available cash quantity.

8.5 Exact intervals for monetary performance

Handover must remain practical when a large payment amount contains many small currency increments. A fine currency quantum need not require a separate record for every quantum. The whole unpaid consideration can occupy one interval, however large its finite amount. The order of partial payments still matters. For example, the ordered intervals ([2,4),[0,2)) select portion 2 first, while their sorted union selects portion 0. These representations have equal support and value, but they prescribe different partial performance.

Choose a positive rational quantum \epsilon for each currency. Every adopted original amount and affected cash occurrence must be an exact integer multiple of that currency’s quantum. The same requirement applies to its recorded allocations and reopenings. A quantity outside this lattice fails admission without rounding or closing the physical source. The physical measurement unit remains unchanged: kilograms describe accepted goods, while \epsilon describes portions of their earned consideration.

An adopted original due d of amount \epsilon N_d, with N_d a positive integer, has the domain [0,N_d). A run (d,a,b) denotes its ordered portions (d,a),\ldots,(d,b-1). For an ordered run list R, write E(R) for the concatenated sequence and S(R) for its support. Its measure is \mu(R)=\sum_{(d,a,b)\in R}(b-a) when its runs are disjoint within each root. For a finite support S, write \mu(S)=|S|. Each due has a complete partition into payable and discharged intervals. A due root is the portion domain of one original obligation. An alias row gives a named ordered view of those portions. Alias rows retain their ordered runs, original terms, and complete disjoint coverage of the adopted dues.

A support mask identifies the portions to include or exclude, without prescribing their performance order. The algorithms process endpoints rather than enumerating the represented portions. Intersection and difference split each source run at the membership mask’s endpoints while retaining the source order. A prefix operation consumes whole runs until the requested count lies within a run, then takes the required initial part. Only consecutive runs (d,a,b),(d,b,c) can coalesce without changing their sequence. Sorting is permitted for a membership mask after rejecting prohibited overlap.

Payment selects a prefix of the alias’s current payable intervals. Each allocation a retains this ordered selection A_a and its own already restored support R_a. The current discharged support is the disjoint union D_d=\bigsqcup_{a:\,\operatorname{due}(a)=d}\bigl(S(A_a)\setminus R_a\bigr), \qquad P_d=[0,N_d)\setminus D_d. \tag{4} A reopening under its governing rule selects within A_a after subtracting R_a. It preserves every other allocation’s history. This distinction matters when a restored portion has already received a replacement payment. The next reopening against the earlier allocation must select that allocation’s next unrestored portion.

Cash occurrences use separate portion identities. Their consumed intervals remain consumed after a duty reopens. An explicit cash selection retains its supplied order and must avoid all previously consumed portions of that occurrence. When a payment spans several duty roots, the allocator groups them in their first-occurrence order and preserves each group’s internal order. Successive groups receive successive portions of the selected cash sequence. These rules retain the original cash occurrence and allocation identities through changes of alias.

The interval construction removes the monetary-quantum count limit of the individual-portion profile. It does not enumerate each quantum when adopting or processing a newly represented amount. Refinement of an existing individual-portion store reads its already stored entries once to form the runs. Operation costs depend on endpoint bit lengths, interval fragmentation, retained history, and snapshot serialization. For k source runs and m mask runs, nested filtering uses O(m\log(m+1)+k(m+1)) endpoint operations. Exact arithmetic and snapshot bounds continue to apply.

The finite physical program permits at most 128 acceptances for one contract within a cohort, meaning one bounded execution schedule. Section 8.6 extends the construction to later cohorts and corrections while retaining the same right. The handover remains within one database and does not transfer exclusive authority to an independently writable copy. A trusted checkpoint is required to detect rollback of the complete database to an authentic earlier state. The admitted keys, clock, physical evidence, title documents, constituting acts, and acceptance authority retain their stated external premises.

8.6 Continuation of a constituted right

A finite program can finish while the right it serves continues. The next program must inherit the current obligations of that right, including the consequences of intervening payments. After intervening payments and returns, the ledger snapshot from the first handover no longer describes those current obligations.

Consider an accepted delivery that earns USD 10. After initial handover, a payment of 6, a return of 2, and a fresh payment of 6 leave its outstanding amount zero. The return reopens the obligation under its admitted rule. After an admitted continuation, a further accepted delivery earns another 10, which is paid in full. A later authorized correction reduces the first delivery’s consideration to 3. It creates a refund obligation of 7 to the buyer. A fresh payment of that refund completes the correction. Both accepted deliveries and their original earned amounts remain in the history. Restarting from the first handover’s ledger would lose some of these payments; issuing the first consideration again would create another claim for the same delivery.

Call a bounded execution schedule a cohort. The constituting right retains its identity, quantity, parties, price rule, and governing evidence across cohorts. The execution identity must nevertheless distinguish successive schedules. The evaluator must give each original payment obligation an identity that is stable under replay but different for a new earned obligation. Its identity has four coordinates. Issuance identifies the constituting right. Position lot identifies the execution schedule within that right. Schedule height identifies the step within that schedule, and leg identifies the payment output of that step. In the evaluator of section 8, an original resolution is identified by issuance, position lot, schedule height, and leg. Changing the program context alone leaves that identity unchanged. The continuation therefore retains the original right as its issuance and assigns a distinct position lot to each admitted cohort. Here the position lot identifies an execution schedule; it supplies no further goods or contractual quantity.

Write the current state as (H,L,I,G,J). The physical history H retains measurements, accepted intervals, unit conversions, and corrections. The ledger L retains original bindings, directed correcting dues, payments, returns, and reopenings. The ordered interval representation I records current payable portions of adopted original dues and consumed cash portions. Directed correcting dues remain separate liabilities in L. The generation record G binds the admitted cohorts and their scope. The command record J binds completed requests to their original results.

A successor proposal identifies the exact current state and its predecessor generation. It binds the contracts in its scope, their unchanged constituting rights, the derived cohort identities, and each currency’s existing quantum. The physical authority governs acceptance of the delivery evidence. The carriage authority governs adoption of the continuing payable representation. Both authenticate the same proposal under their admitted policies. Admission checks that proposal again after acquiring the write transaction. It retains the original source closure and appends the new generation. The signatures have the institutional meaning supplied by their governing admissions; this step does not establish a new rule of authority at wall-clock commit time.

For a right r, let Q_r be its contractual quantity and let \mathcal A_r(H) contain its accepted allocations across all cohorts. Each allocation a has converted quantity q(a) in the right’s unit. Continuation retains \sum_{a\in\mathcal A_r(H)}q(a)\leq Q_r. \tag{6} Allocations with the same physical occurrence and right have disjoint intervals. The monetary correction of an acceptance changes neither its interval nor the sum in (6).

A later acceptance applies the original physical and evidence rules against H. If it earns positive consideration \epsilon N, it must lie on the currency’s existing quantum, with N a positive integer. The actual evaluator resolves that consideration under the new cohort identity. The same transaction adds its original binding and a fresh interval root [0,N) to the current ledger representation. This root represents payable consideration for the new acceptance, not another quantity of goods. Existing roots, original allocations, correcting dues, and consumed cash remain intact. The active representation records this extension. A request prepared against the preceding representation may need fresh preparation; this does not erase its underlying obligation or alter a completed result.

A correction may refer to an acceptance from any earlier cohort whose contract is included in the current continuation scope. It binds that acceptance’s original resolution and current correction predecessor. Its adjustment uses the current ledger, after intervening performance and reopenings. A downward target change can create a refund; a later upward change within the admitted original amount can create a payment in the opposite direction. The governing correction rule determines the directed liability. An original acceptance is never reissued to express that adjustment.

The example now follows the same execution rules before and after the first handover. Further disjoint deliveries can use later cohorts while the original right has remaining quantity. The finite schedule bound applies to each cohort rather than to the lifetime of the right. Retained history and storage still grow, and each state remains subject to its arithmetic and storage budgets. Changes of contractual terms, authority policy, or currency quantum require their own admission construction. Independent database copies require a mechanism for exclusive write authority, and a complete rollback requires an independent trusted checkpoint. Physical existence, legal authority, and provider performance retain their external premises.

9.1 Balance sheet

Under the custody premises above, customer-owned metal is bailed property and remains outside the institution’s own assets. The institution’s own balance sheet carries its cash, its inventory of metal bought and not yet sold, its receivables from the providers it coordinates, each purchase allowance awaiting allocation or refund, and its own capital. Its revenue is the custody charge, the spread between its buying and selling prices around the reference price, an arrangement fee from the licensed lender on the loans and leases it introduces, a share of the card issuer’s interchange, and delivery charges. None of these is a return on the customers’ metal, and none requires the institution to hold it.

Three structures allocate risk differently. A fractional pool owes demandable metal claims against a smaller stock and earns the return on metal it can use. A narrow bank in Fisher’s sense holds safe assets against demand deposits and earns fees rather than the return on maturity transformation. In the allocated institution, title-bearing customer metal is not an asset and the corresponding balance is not its liability. A purchase allowance is its liability until allocation or refund. The customer with title relies on property rights, custody evidence and the register rather than a reserve ratio. The prudential difference is material. Under the Basel III net stable funding ratio, unencumbered physical traded commodities including gold carry an 85 per cent required-stable-funding factor (Basel Committee on Banking Supervision, October 2014, paragraph 42(d)). The standard permits national supervisors to assign zero factors to identified interdependent assets and liabilities (paragraph 45). The United Kingdom’s Prudential Regulation Authority used that discretion in 2021 for a bank’s physical stock matched to customer precious-metal deposits, effective from January 2022. The allocated institution holds neither side of that matched book.

9.2 Whose balance sheet absorbs each loss

The capital question is who pays for each thing that can go wrong. Table 1 answers it, and the rest of this section explains each row.

The institution remains principal obligor for each pooled purchase until its allocation or refund obligations are performed. The gram cap controls admitted quantity. The separate funding construction below evaluates supplier failure, price movement, costs, and payment deadlines. Unmatched receipts and authoritative limit reductions remain explicit exposures. The customer retains the applicable claim if the institution fails. In the direct-allocation design, the admitted allowance gap is zero. Operating, custody, and contractual risks retain their own liable parties and recovery routes.

9.3 Scenario funding for purchase and recovery obligations

The gap cap has fine-gram units. Capital and liquidity use currency units and require separate tests. Fix a scenario set, a time horizon, and the exact obligations included in each scenario. For currency c, let O_c(\omega,h) be cumulative cash due by time h under scenario \omega. Include supplier failure, replacement prices, refund rights, execution fees, transport costs, and applicable recovery payments. An alternative obligation to allocate or refund is evaluated under its actual election rule, rather than counting both alternatives as independently due. Let I_c(\omega,h) contain only independently available receipts under the same scenario and deadline. A receivable from the failing supplier is not an available receipt. Let F_c be owned available cash after prior reservations and encumbrances. An additional funded buffer K_c meets the scenario liquidity test when F_c+K_c+I_c(\omega,h)\geq O_c(\omega,h) \quad\hbox{for every }(\omega,h). Equivalently, K_c\geq\sup_{\omega,h}(O_c-I_c-F_c)_+. The ledger allocates each supporting cash quantity once across simultaneous obligations. Foreign-exchange conversion requires its own executable currency legs, costs, deadlines, and funding reservations. A positive net-worth figure alone does not supply a currency payment before its deadline.

For example, ten grams at a reference price of 100 pounds per gram require 1,000 pounds. If the contract still requires ten grams after supplier failure and replacement costs 150 pounds per gram, replacement needs 1,500 pounds before fees. A 1,000-pound buffer leaves a 500-pound deficit. A contract permitting an effective 1,000-pound refund instead has a different obligation and scenario cost. Both cases are executable policies with different customer rights. Neither is a universal consequence of the gram cap.

9.4 Proceeds allocation and service

A sale produces an actual cash occurrence before its legal distributions are computed. Let p be its supported proceeds in one currency. The recorded priority instrument supplies senior lender amount l, admitted fees f, and holder surplus s. The allocation uses the common occurrence slices and satisfies l+f+s\leq p. Any unallocated remainder stays visible. Each beneficiary’s outgoing payment reserves actual account funding separately. Allocating the receipt establishes the source of a claim’s performance only when the instrument makes that receipt performance for that beneficiary. An intermediary’s receipt otherwise funds an obligation to pay the beneficiary. It does not falsely discharge that outgoing obligation. An unpaid lender balance, unpaid fee, or missing surplus remains an obligation after the sale. For sterling proceeds of 120 pounds, an authorised split of 80 pounds principal, 10 pounds fees, and 30 pounds surplus consumes exactly 120 pounds. Three beneficiary records each claiming 120 pounds fail the common partition.

Let q_t be eligible redemption demand waiting at the start of service period t, in fine grams. Let D_t be newly eligible demand and s_t actual completed service. The same physical, funding, priority, provider, and legal guards determine s_t. In particular 0\leq s_t\leq q_t+D_t, and q_{t+1}=q_t+D_t-s_t. An outage supplies zero service, not the advertised capacity. Failed or partial execution leaves its remaining claim and reservation in the queue. Physical shortages use the priority allocation in proposition 5.1 before a request becomes eligible for release.

The theorem applies only when the recorded route supports the stated strict service guarantee. Unbounded outage permits unbounded delay while preserving the obligation. For arrivals (4,4,0) and actual services (0,3,5), the end-period queues are (4,5,0) grams. The first period retains all four grams through the outage and later service completes all eight.

9.5 Runs

Diamond and Dybvig’s model derives a run from demandable claims on illiquid assets. Under A1–A3, an \mathrm{AP} unit is title to present metal. An \mathrm{LO} unit is a fixed-term redelivery claim with no issuer-funded early redemption. The model’s maturity-transformation mechanism is therefore absent from both states on these premises. Custody doubts can still produce simultaneous redemption requests and operational congestion. The cash-out leg also creates a liquidity queue because the institution must sell metal to pay cash redemptions. The lent pool would create the same risk if the institution promised early exit. Three stated bounds separate these risks.

Actual service and outstanding claims determine the queue in section 9.4. A holder waiting for a sale retains its applicable title, price exposure, and priority until the actual disposition. A completed title transfer with unpaid proceeds instead retains a cash claim. The finite delay bound requires the stated demand and strict service certificates. An advertised daily capacity alone establishes neither certificate.

A unit in \mathrm{LO} retains its contractual maturity. The assignment rule in section 7 permits an eligible acquirer to take its outstanding redelivery claim. The acquisition carries the same borrower, remaining quantity, maturity, and admitted supporting rights. Any purchase price comes from the acquiring party under the selected settlement route. The original lending election and subsequent assignment chain determine each holder’s exposure. The institution’s aggregate lent fraction enters no promise it makes.

Physical redemption above the stated threshold carries a stated notice period, set by logistics and customs and not by liquidity. Cash redemption settles in the provider’s cycle. Both are disclosed on the face of the product.

10.1 Form one: the lease

Lending the metal converts the holding. The metal loan modeled here permits the borrower to use the metal and requires equivalent redelivery. The holder therefore exchanges the allocated bailment for a contractual claim to an equivalent quantity. For the term of the lease the analysis of section 2 applies: the holder is an unsecured creditor of the named licensed lender, which is the direct borrower and redelivery obligor, unless collateral was posted. The metal is gone while the loan is out. The London account guide describes this metal-lending market. The lease rate is a price, though since the London market stopped publishing its forward rate on 30 January 2015 it is quoted bilaterally by each dealer. Refiners, fabricators and market makers borrow metal to finance inventory, and the risk is credit risk.

Because lending converts the holding, the register must show whether each gram is allocated and present or lent and outstanding. A lent unit names the licensed lender as direct borrower and redelivery obligor and states its term. It enters that state only on the holder’s signed election. That is clause (i) of proposition 5.2. The election states the lender, term, lease fee, collateral or guarantee, and the conversion of title into a redelivery claim.

A full-reserve institution and a yield on the same gram are incompatible. A gram is allocated and present, or it is lent and outstanding, and never both. The institution pays a lease fee only on balances the holder elected to lend, in a separately labelled pool whose state is queryable, and every supported non-lent balance carries an exclusive allocation, with any impaired support and remaining claim displayed separately. A bonus funded from the spread, or from new customers, is a marketing expense and is typed as one on the face of the product.

10.2 Form two: credit secured on metal

A loan secured on metal does not convert the holder’s title into a redelivery claim. A holder pledges allocated units to a licensed lender and receives cash at a stated advance rate. The lender relies on the collateral, its perfection and its liquidity. In the direct-custody case, the custodian’s written acknowledgment can make the pledge possessory. Proposition 13.1 shows that three stated choice-of-law rules then refer the stated proprietary questions to the place where the metal sits. The election names the advance rate, valuation source and fallback, margin rule, liquidation rule and law governing perfection. Gold is fungible and graded, and the London market clears it in size: the London clearing banks recorded a daily average of 16.7 million ounces, worth USD 70.9 billion, in June 2026. The advance rate and margin rule address price risk. Custody evidence and perfection address whether the metal exists and whether the lender’s interest binds third parties.

10.3 What the conversions are

The fully supported allocated gram is title to present metal. The lease converts that title into a redelivery claim on the named licensed lender. A pledge leaves title with the holder and records a lender’s security interest against it. A sale converts title into a cash claim until payment is final. The register therefore keeps three objects apart: a unit in \mathrm{LO} is a claim on the licensed lender as direct redelivery obligor and not present metal, a unit in \mathrm{EN} is present metal subject to a recorded interest, and a unit in \mathrm{AP} is unencumbered present metal. The Claim as Primitive gives the valuation semantics of the redelivery and cash claims. Admissible Obligation Transitions gives the general admission rule for their external effects.

11.1 Sell-at-tap

At the tap the holder sells, to the institution as principal, the units whose value at the reference price covers the purchase. The institution instructs a fiat payment through the licensed card issuer that carries the card. The register records the actual title disposition separately from the issuer’s payment. A legally completed sale enters \mathrm{DV} while any unpaid proceeds remain an obligation. The exchange is complete only when the allocated payment also satisfies the stated legal-finality rule. The rail is the card scheme’s authorisation and settlement rail between the issuer and the merchant’s acquirer, and it carries a chargeback window under the scheme’s rules. Each tap is a disposal whose tax result depends on the holder and jurisdiction. For a United States taxpayer holding bullion as a capital asset, gain on a holding of more than one year enters the collectibles rate group; shorter holdings and other taxpayers can receive different treatment. The United Kingdom charges capital gains tax on a bar while exempting sterling legal-tender coin. The European Union exempts investment gold from value added tax, while each member state determines the holder’s income-tax result.

11.2 The credit line

At the tap the holder draws on the secured facility of section 10. The licensed lender that holds the facility funds the issuer’s payment, the units stay in \mathrm{EN}, and nothing is sold. The rail is the same card rail, funded by the lender rather than by a sale. Whether the draw avoids the disposal in each major tax regime is open problem O6 in section 18. The lender’s margin rule applies to the drawn balance against the reference price, and a margin call is a demand for cash or for further units pledged under (R3), never a transfer of metal without the holder’s instruction.

11.3 The cash leg

Every cash leg uses the occurrence and allocation contract of section 5.2. The command exists before dispatch. The canonical posting, assertions about it, and legal allocations remain distinct. Complete provider-log reconciliation checks received cash, actual debits, unmatched money, and outstanding beneficiary obligations. The same proceeds can satisfy several claims only through disjoint supported allocations. A return or reversal appends its own event and obligation under section 5.5. Op, Admissible Obligation Transitions, and Recourse use the same separation of commands, occurrences, allocations, and live funding.

The rail is named for each instance. Sell-at-tap and the credit line run on the card scheme’s rail through the issuer. Cash redemption runs on the domestic payment system where the holder’s bank account sits: a real-time gross settlement system, whose transfers are final on processing where a rule of law gives the system’s rules that effect, or a retail instant-payment system with the finality its own rules and statute provide. Delivery of bars against payment across a vault and a bank runs on the bank’s domestic large-value system for the money and on the custodian’s release instruction for the metal, and section 13 states when those two legs are final together and when they are not.

11.4 Shari’ah

AAOIFI Shari’ah Standard No. 57, Gold and its Trading Controls, adopted in 2016 with the World Gold Council, treats gold as a ribawi item. An exchange of gold for currency requires possession by both parties in the contract session, actual or constructive. Constructive possession of stored gold requires full allocation through same-day settlement or a confirmation specifying the owned bars; an undivided share in a qualifying bulk is permitted. Deferred delivery is not. The co-ownership design can meet this condition when its allocation schedule and legal structure establish constructive possession at sale. The pooled design has a hand-over gap and therefore does not meet the condition during that interval. Of the two designs in this paper, a product offered under the standard must use the first and obtain certification from its Shari’ah board. A pledge structured as rahn is permitted by the standard. Whether a fee-bearing lease of gold conforms requires the product-specific determination in section 14.1. Standard No. 57 is a compliance condition on the product. It does not determine the market’s institutional structure or replace any licence.

12.1 The bailee’s duties

The custodian holds the bars as bailee under a written custody agreement with no right of use, no substitution without consent, and a lien limited to unpaid charges (A1).

Where the custodian holds through a sub-custodian, the bailment runs through another bailee. The owner’s proprietary claim reaches that level only if the bars remain identified to the owner there, and a sub-bailee owes the owner a bailee’s duties only where it knows of the owner’s interest (The Pioneer Container [1994] 2 AC 324). The record therefore follows the metal to the actual vault. It names every custodian and sub-custodian, every custody agreement, the governing law of each agreement, each vault and its situs, and the acknowledgment that binds each bailee to the recorded interest.

12.2 The chain of integrity

A wholesale bar carries a refiner’s mark, a serial number, a weight and an assay, and several markets define those attributes precisely. They do not define them identically. London Good Delivery admits bars of 350 to 430 fine troy ounces at a minimum fineness of 995 parts per thousand. The Shanghai Gold Exchange settles a one-kilogram bar at 999.9 parts per thousand. India’s standard IS 17278:2019, notified on 15 January 2020, specifies its own good-delivery bars. Each market accredits its own refiners, and accreditation is revocable: on 7 March 2022 the London list suspended six Russian refiners, so bars from one refiner differ in standing by the date they were cast. Origin and casting date are legal attributes of a bar as much as weight and assay are. Bars are standardised to within the differences listed. Claims on them are standardised nowhere.

The custodian tests metal at intake against the accredited refiner’s documents, and the register records the refiner’s standing on the casting date. A register can prove that a bar with a given serial number was recorded, encumbered and released. It cannot prove that the bar exists or that its assay is correct. The vault, physical inspection, assay evidence and provenance records establish those facts within their stated scope. A record cannot verify a physical fact it never observed.

12.3 Reconciliation

An independent party reconciles the register to the vault’s bar list at a stated cadence, and that party is independent of the institution and of the custodian (A3). The reconciliation is the check of corollary 5.3 and the detection result of proposition 5.6. Its cadence and evidence-completeness contract bound detection delay for observable mismatches. Unobserved physical loss requires physical evidence. The shortage procedure in section 5.5 applies before further affected deliveries.

12.4 The failure modes are custodial

The instructive disasters in commodity finance are about the same tonnage pledged more than once, about collateral that was not what the documents said, and about receipts that were fiction. At Qingdao and Penglai in 2014 a single trader pledged one stock of alumina, aluminium and copper three times over for more than 2.7 billion yuan of loans, and a company connected to the borrower ran the warehousing, so no independent party kept the record. Between 2015 and 2020 Wuhan Kingold pledged 83 tonnes of purported gold, insured, to more than a dozen lenders for 20 billion yuan, and the bars were gilded copper. In 1963 the field-warehoused inventory of Allied Crude Vegetable Oil Refining Corporation at Bayonne, certified by an independent field-warehousing company, exceeded the whole United States supply of the oil, and the tanks held seawater under a film of oil.

Only the first is a pure record failure. A register answers it, when its keeper is independent of the borrower, by recording every encumbrance against the bar rather than against the account. It narrows the third only in that the total it certifies is a number anyone can compare with the public supply figures. It does not answer the second. The properties that matter are: one record per bar; every encumbrance recorded against the bar; entries that cannot be altered after the fact without the alteration being detectable; and independent verifiability, so that a lender can check the state of the collateral without trusting the institution or the custodian.

12.5 Redemption and the delivery leg

Physical redemption is available above a stated threshold and cash redemption at the reference price less a stated spread below it (A7). Physical delivery is a customs, transport and insurance problem. The exporting state’s trade authority signs the export clearance. The source custodian identifies the units and releases them to the carrier. The carrier authenticates acceptance and delivery. The importing state’s customs authority signs the import clearance. The receiving vault authenticates intake, identifies the same metal and states that it holds the metal for the holder. The insurer’s binder states its conditions. These records form the phase chain in (R9): source custody, carrier transit and receiving-vault intake. Possession risk, diversion in transit and detention at discharge are separate from payment risk and follow the binder and transport terms. A designation of a party in the custody chain marks every affected bar for re-evaluation before another transfer. The unit remains in \mathrm{IR} until the holder or destination custodian accepts delivery, and title remains with the holder throughout transit.

13.1 Five legal facts

An allocated-title position is a bundle of five legal facts. Each is answered by a law chosen by its own rule, and the rules need not select the same jurisdiction. A forum may already give the required effect under its choice-of-law rules. Otherwise, an additional applicable instrument must supply that effect. The following analysis keeps these questions separate.

13.2 What fails at the border

The five facts do not travel under one choice-of-law rule. The forum selects the property law that governs the bailment and title. Tax follows the taxpayer, transaction and asset through the applicable tax rules. Trade control follows the metal’s origin, classification and physical route. A destination may decline to treat the source register as conclusive of title. It may select a different law for perfection, or decline to give the source settlement rule effect in insolvency. For the direct-custody possessory pledge, the perfection conflict does not arise when the forum applies one of the three rules in proposition 13.1 and the situs-law premise is satisfied.

13.3 What the legal structure requires

The route must supply the evidence and legal basis for all five questions together. The register carries custody and title. A composed compliance state records the applicable evaluations and required local decisions for the customer, custodian, and lender. It covers identity, source of funds, sanctions, reporting, and the tax and trade rules attaching to the bar and transfer. The security interest and settlement leg are the third and fourth facts. The enforcement route is not a sixth fact; it applies when a party refuses to perform any of the five.

13.4 The sovereign case

Central banks have been net buyers of gold every year since 2010, and bought more than 1,000 tonnes in each of 2022, 2023 and 2024 (World Gold Council, Gold Demand Trends, full year 2024: 1,044.6 tonnes in 2024 and 1,050.8 tonnes in 2023, the third consecutive year above 1,000 tonnes). Gold has no private issuer and creates no claim on a private counterparty. Its custody can still depend on another state’s law and institutions.

Since the freezing of the Russian central bank’s foreign reserves in February 2022, reserve managers have changed where they store gold. In the World Gold Council’s 2026 survey of 76 reserve managers, 9 per cent reported increasing domestic storage in the preceding twelve months, against 5 per cent a year earlier, and 7 per cent planned to increase it in the year ahead.

A reserve manager may choose gold to reduce issuer and counterparty exposure. Foreign custody adds dependence on foreign law and institutions. Domestic vaulting, assay capacity and clearing therefore affect the state’s legal control over the reserve.

The sovereign-custody construction described here requires five things: a vault accredited to a wholesale-market standard; accredited refining and assay capacity; a register whose entries its law gives the intended effect; instruments under which other jurisdictions recognise those entries; and an arbitral seat whose awards qualify for recognition under the 1958 Convention, subject to its reservations and grounds for refusal. The first two are physical capacities and the other three are legal institutions. A domestic venue can settle its cash leg in the state’s money through its payment system, keeping both sides of a domestic trade within its law.

14.1 A product route and its authority contract

The reference route uses identified gold in an English vault, an internal register of paid bulk shares, and sterling settlement. The seller acts as principal, a separate custodian holds the metal, and separately permitted providers perform lending and payment functions. The route supports purchase, fractional holding, admitted ownership transfer, custody transfer, pledge, release, redemption, and recovery through the same records. Its legal contract has the following explicit fields. The mathematical examples instantiate those fields as assumptions. They do not identify an executed custody agreement, product approval, or provider commitment.

The institution’s own arranging, marketing, custody-control, payment, lending, and collective-structure activities receive separate classifications. A partner’s licence does not supply permission for the institution’s different activity. The authority record names the responsible legal person, jurisdiction, role, instrument, effective period, and action stage. Current admission requires the relevant fields and their dependencies to remain valid. Amendment, revocation, and insolvency orders change the current policy through their competent authority. They leave earlier performance and outstanding rights recorded.

The direct-custody pledge proposition does not decide perfection over a fractional bulk share. The route must supply that additional legal result before its corresponding pledge is exercised. Likewise, a fee-bearing metal loan requires its own determination where the product is represented as Shari’ah compliant. AAOIFI Standard No. 57 addresses spot possession, allocation, and gold transactions. Its treatment of gold as pledge collateral does not approve every credit arrangement or lending fee. An unanswered product question is an unresolved authority obligation with its responsible owner and admissible continuation. It is not completed by a passing software test. The runtime retains each feature’s full transition and evidence contract while its external premises are obtained.

Proof and executable scope

Proposition 5.2, Corollary 5.3, Proposition 5.4, Proposition 5.1, Proposition 6.2 and Proposition 9.1 are paper proofs over their displayed transition and environment premises. The accompanying verify_allocated_title.py implements exact rational quantity ledgers and finite lifecycle fixtures. Its checks cover disjoint physical allocation, custody migration, support correction and restoration, purchase reservations, unmatched cash, partial performance, release before redemption, conditional exchange, post-delivery reversal, priority distribution, beneficiary allocation, funding deficits, and service outages. Positive traces complete purchase, pledge, release, sale, and distribution. Adverse traces retain their unsupported quantities, claims, and pending commands. The finite checks do not establish a compiler or deployed-provider refinement theorem. Custody truth, legal authority, product approval, and service commitments require the external records identified in section 14.1 and section 4.

The accompanying allocated-title-supplement.zip supplies the reference programs and reproduction commands. Its SHA-256 digest is:

0cba926fd0159b6127704f7b5095f164d62e1d2cd634429c63f8d170ab7422d2.