Field note

Logic as Owner: The Offer Predicate Is the Escrow

Vault Architecture

Most escrow designs introduce a special container: value enters a contract, the contract stores a status, and code later decides which party may withdraw. The resource vault already has a more general mechanism. Every resource names an owner_kind, and consuming it requires that owner's validation predicate.

PayMoney uses that indirection directly. The escrowed object's value logic remains its selected FungibleV1, so ordinary fungible conservation still applies. Its owner_kind is the particular FiatOfferV1 instance. Only that offer's predicate can authorize the asset consumption.

Two meanings, one resource

The two fields answer different questions:

logic      = what value is this, and how must it conserve?
owner_kind = what rule may authorize consuming it?

For an ordinary wallet-owned asset note, logic is its FungibleV1 kind and owner_kind is an AccountV1 instance. For the escrowed note, logic is unchanged, but owner_kind is the offer. No wrapped escrow asset and no second balance system is needed.

The offer is self-owned

The offer resource itself has owner_kind = logic = its own kind_id. This is not an infinite regress. Validation executes a finite predicate over the action witness; it does not recursively look up another owner.

That predicate admits only the closed transitions:

Claim from Open, creating Claimed and binding the taker;
Cancel from Open, authorized by the maker;
Solve from Claimed, authorized by the bound taker plus valid bank evidence;
Expire from Claimed, after the absolute epoch budget.

Claim passes its own guard without touching escrow; it only replaces the live offer. When a terminal guard passes, the offer emits the authorization signal that lets the selected asset move to the prescribed outputs. If no guard passes, no valid witness exists.

Why the completeness bus matters

The escrow resource participates in two domain-separated obligations. Its value appears in the selected asset's partition, while its authority appears in the offer's validation lane. The completeness argument requires both. Equality of owner_kind and logic for the self-owned offer does not collapse the lanes because their domain tags differ.

This pattern makes escrow a consequence of ownership, not another protocol primitive. Timelock semantics, conditional release, and maker/taker authority all live in the offer predicate, while the vault remains unaware of fiat and the fungible asset kind remains unaware of offers.

Follow the five Actions → · Read about the completeness bus →