Chapter Δʹ · the operating model

Transaction lifecycle

Ten operations cover a vault's whole life. This chapter maps them onto the collateral-ratio ladder and gives the exact input / output layout of each transaction - the layouts are consensus-relevant, because covenants read siblings at fixed and relative indices.

1The op ladder

Which operation applies depends on the vault's collateral ratio (CR), always evaluated at the MAX quote of a fresh oracle tick unless noted. Descending the ladder:

CR >= 130%

REFRESHany keeper

advance the vault's freshness ratchet; debt and collateral unchanged. The anti-replay defense for dormant positions.

115% < CR <= 130%

LIQUIDATEany keeper · partial

keeper repays dd, heals the residual into CR [132%, 137%], extracts at most 1.15 x dd; the 15% penalty splits keeper 10% / reserve 5% of dd.

100% <= CR <= 115%

FULL-LIQany keeper

keeper repays the full debt and seizes the collateral; the vault closes; the excess above par splits 2:1 keeper : reserve.

CR < 100%

BAD-DEBTany keeper · issuer-attested

keeper repays the full debt; the reserve covers min(shortfall + 5% bounty, 20% of debt, balance); the vault closes even if the reserve is empty.

any CR (owner)

CLOSE / REPAYowner signature

repay the full debt and free the collateral, or lower the debt. Both only improve health, so neither is gated - an owner can always close or repay a vault at any CR, including underwater, which competes with liquidation.

post-op CR >= 150% (owner)

DRAWowner signature · MIN

borrow more. The covenant re-proves 150% at the MIN quote on the resulting debt, so a vault below 150% cannot draw at all - it is unavailable well before the 130% liquidation band.

any

REDEEMany OBOL holder

swap x OBOL for collateral valued at min(par, backing_k) minus the 0.5% fee - the peg floor.

n/a

OPENborrower + issuer

mint principal OBOL against a new vault at >= 150% (MIN quote); a 0.5% L-BTC fee goes to the reserve; debt = principal.

n/a

POKEanyone

advance the issuer's global mint anchor toward the tip; no value moves.

Band sources: trigger and REFRESH gate vault.simf:332,458, heal band vault.simf:346-347, extraction cap vault.simf:353, full-liq band vault.simf:377-379, bad-debt gate vault.simf:402, open/draw health issuer.simf:309-311, vault.simf:305.

2Transaction layouts

Conventions that hold across all layouts: the vault, when present, is always input 0 (its own index pin); the pot moves between input 1 and output 1; the reserve occupies slot 3 when present; every oracle-carrying transaction sets nLockTime to the tick height. The layouts below are normative: each one was validated on-node against the frozen covenants, and a conforming builder must produce exactly these shapes.

OPEN

in  0 pot (OBOL)          1 issuer (token)      2 collateral (L-BTC)  3 reserve (L-BTC)
out 0 new vault (coll)    1 pot - principal     2 borrower (principal OBOL)
    3 reserve + 0.5% fee  4 issuer successor    5 network fee

The issuer's OPEN arm reads the pot at current_index - 1 (input 0, since the issuer sits at input 1), reconstructs the new vault at output 0, and pins the fee into the reserve. The pot spends through its outflow leaf, gated on the token at input 1.

DRAW

in  0 vault               1 pot (OBOL)          2 issuer (token)
out 0 vault successor     1 pot - d             2 borrower (d OBOL)
    3 issuer successor    4 network fee

The vault's DRAW arm verifies the quorum and the 150% MIN-quote health; the issuer inherits the height by reconstructing the same successor address at output 0 and pins the pot delta.

REPAY / CLOSE

in  0 vault               1 pot (OBOL)          2 payer OBOL          [3 fee coin - REPAY]
out 0 successor (REPAY, collateral intact) or freed collateral (CLOSE)
    1 pot + r or pot + debt                  [payer OBOL change]  [fee-coin change]  fee

No oracle. REPAY funds the network fee from a separate coin because the covenant forbids the collateral from shrinking; CLOSE pays it from the freed collateral.

REFRESH

in  0 vault               1 fee coin
out 0 vault successor (same debt and collateral, new last_height)   1 change   2 fee

LIQUIDATE (partial)

in  0 vault               1 pot (OBOL)          2 keeper OBOL         3 reserve (L-BTC)
out 0 residual vault      1 pot + dd            2 keeper collateral
    3 reserve + 5% of dd  [4 keeper OBOL change]                      fee

FULL-LIQ

in  0 vault               1 pot (OBOL)          2 keeper OBOL         3 reserve (L-BTC)
out 0 keeper collateral   1 pot + debt          2 keeper OBOL change
    3 reserve + excess/3  4 fee

The keeper's OBOL change output is deliberately always present: it is the anchor the keeper's own SIGHASH_ALL signature commits to, binding the otherwise-unpinned payout (finding E-5, see chapter Ιʹ).

BAD-DEBT (with ATTEST)

in  0 vault               1 pot (OBOL)          2 keeper OBOL
    3 reserve (L-BTC)     4 issuer (token)      5 fee coin
out 0 keeper: coll + reserve_pay              1 pot + debt
    2 reserve - reserve_pay                    3 issuer successor
    [4 keeper OBOL change]  [fee-coin change]  fee

Three covenants and the issuer arm run at once: the vault's BAD-DEBT branch proves CR < 100%, the reserve's arm gates on the token at input 4 and strict pot growth, and the issuer's ATTEST reconstructs the genuine vault at input 0 and authors every amount.

REDEEM

in  0 vault               1 pot (OBOL)          2 redeemer OBOL       3 reserve (L-BTC)
out 0 vault successor     1 pot + x             2 redeemer collateral
    3 reserve + 0.5% fee  [4 redeemer OBOL change]                    fee

POKE

in  0 issuer (token)      1 fee coin
out 0 issuer successor    1 change              2 fee

The POKE arm is pinned to current_index() == 0, so an issuer poke can never be embedded in another transaction to satisfy a token gate while pinning nothing.

3The reference run

The full ladder was exercised in one on-node run against a regtest Simplicity elementsd: OPEN (fee to reserve), REPAY, DRAW, REFRESH, CLOSE, a price dip, partial LIQUIDATE, FULL-LIQ, a crash, BAD-DEBT, POKE, and REDEEM at the backing floor - plus 27 negative transactions, each rejected by a single identified covenant gate. Every accept and reject in this spec corresponds to a real node verdict from that run.