Separate pricing from payment

[hpmaxi]

Priority

High — must be addressed in current sprint

User story / Problem statement

fulfill_epoch refuses unless the vault covers the epoch's redemptions in full, so one large
redeemer blocks every small one in the same epoch, and an epoch stays unpriced until enough capital
has come back. The design pays claims as cash arrives, in order, without walking a queue.

Expected outcome

An epoch prices whether or not the cash is there. Claims pay in order of cumulative position as the
reserve covers them.

Acceptance criteria

• Fulfilment fixes the price and records the liability without requiring full coverage.
• A claim pays when the reserve covers that claim's own amount, and is refused otherwise with an
  error that says so.
• Claims are not ordered. A covered claim pays whatever else is outstanding, in any epoch, and a
  test asserts a small covered claim pays while a larger one waits.
• Paying a covered claim may leave a larger one waiting, and that is accepted. No claim is ever
  paid money the vault does not hold.
• The uncovered amount is exposed as a view, and nothing may leave for the custodian while it is
  above zero. A test asserts both.
• No entrypoint iterates over requests or epochs.

Technical notes

There is no queue. The architecture says an earlier unpaid claim never blocks a later one that is
already covered, so a claim is measured against its own amount and nothing else. The only running
total needed is committed, the priced and unclaimed liability, and the uncovered amount derives from
it.

Reserves are protected at the outbound edge rather than the claim edge: free reserve clamps at zero,
so the treasury cannot deploy money already owed to a holder.

The test that matters is an epoch that prices more than the vault holds: the small claim is paid, the
large one is refused with a reason, and no transfer is attempted against money that is not there.

Depends on #72, which is what makes committed liabilities legible.

Refs: ARCHITECTURE §4.3 · invariants: I11, I12, I13

[hpmaxi]

Design Decision: Epoch-Level FIFO (Storage-Efficient)

Following architectural review against the current async-vault implementation and PR #80 specs:

1. Scope: Implementation remains in Separate pricing from payment #73 (Phase 2), keeping the current full-coverage check in PR Build the async vault: epochs, claims, treasury and roles #70 as an interim guard until this issue lands.
2. Granularity: Ordering operates at Epoch-Level FIFO rather than individual request-level sequence offsets:
   • Earlier fulfilled epochs must be fully covered before redemptions in subsequent epochs can be claimed.
   • Within a fulfilled epoch that is covered by available reserves, claimants in that epoch can claim.
   • This eliminates the need for additional storage fields (such as monotonic sequence numbers or cumulative liability offsets) on each individual RedeemRequest, keeping per-request storage minimal while strictly enforcing FIFO priority across epochs.

[hpmaxi]

The claim rule is per claim, not per queue

Three acceptance criteria describe an ordering the architecture rules out. It says a priced claim is payable when the liquid reserve covers it, and that an earlier unpaid claim never blocks a later one that is already covered. So there is no queue, in either form. Not by request, and not by epoch either: shares redeemed in an earlier epoch buy no priority.

The rule. A priced claim is payable when the reserve covers that claim's own amount. Whoever is covered takes 100% of what their shares struck, in any order.

Reserves are protected at the outbound edge instead of the claim edge. Free reserve clamps at zero, and transfers to the custodian are allowed only while nothing is uncovered, so the treasury can never deploy money already committed to a holder.

Criteria to change.

• "covers everything ahead of it" becomes "covers its own amount"
• "a claim in a later epoch waits until earlier epochs are covered" should go, it contradicts the rule above
• "a claim is refused once the epoch's own share of cash is exhausted" should go, it partitions cash per epoch and races on who calls first

Keep the two about pricing without full coverage and about no entrypoint iterating.

Bookkeeping. Only committed, the total priced and unclaimed liability. The uncovered amount derives from it. No per-position counters.

Two words. FIFO describes a queue, and there is none, so it should go from the architecture and from this title. And shortfall becomes uncovered: covers is already the operative verb, and uncovered carries no suggestion of insolvency.