nx_escrow_hold.nx
buildroot/runtime/nx_escrow_hold.nx
about
nx_escrow_hold.nx -- multi-party escrow primitive composing nx_ledger.
module: nishi-core.finance.escrow_hold
depends: nishi-core.finance.ledger, nishi-core.io.syscalls,
nishi-core.io.iso8601
disk_kb: 6
capability: MARKETPLACE
license_tier: PUBLIC_DOMAIN_FINANCE
genealogy_id: ucc_article_2_sale_of_goods +
escrow_hold_pattern_software_engineering +
nishi_pillar_4_sealed_swap_sale_separation_2026
Multi-party escrow: buyer funds → platform-held escrow account →
released to seller on confirmed-delivery OR refunded to buyer on
dispute-tribunal favor. Composes against nx_ledger primitive
shipped same arc.
Per Pillar 4 sealed-separation: this primitive references
nx_marketplace_listing (sale-class) ONLY. nx_swap_ledger (gift)
has no escrow concept — gifts don't escrow. Compile-time
guarantee: no codepath from nx_swap_ledger → escrow.
===== State machine ==============================================
FUNDED buyer's payment processed; funds in buyer_escrow account
SHIP_PENDING waiting for seller to ship
SHIPPED seller marked shipped; tracking number received
DELIVERED carrier confirmed delivery
CONFIRMED buyer marked received-as-described
RELEASING release in progress (1-step write of release tx)
RELEASED funds settled to seller_payable account
DISPUTED buyer raised dispute; tribunal selecting jurors
REFUND_PENDING tribunal favored buyer; refund posting
REFUNDED funds settled back to buyer's source account
FROZEN regulatory hold (sanctions / fraud investigation);
no release in either direction
TIMED_OUT_TO_SELLER buyer never confirmed but delivery confirmed
+ 14-day window passed; auto-release to seller
dependencies 2 imports · 0 importers
imports: nx_syscalls.nxnx_ledger.nx
imported by: nobody (leaf or entry point)
structs
| 113 | struct EscrowHold |
consts
| 52 | const NX_ESCROW_FUNDED: i64 = 1 |
| 53 | const NX_ESCROW_SHIP_PENDING: i64 = 2 |
| 54 | const NX_ESCROW_SHIPPED: i64 = 3 |
| 55 | const NX_ESCROW_DELIVERED: i64 = 4 |
| 56 | const NX_ESCROW_CONFIRMED: i64 = 5 |
| 57 | const NX_ESCROW_RELEASING: i64 = 6 |
| 58 | const NX_ESCROW_RELEASED: i64 = 7 |
| 59 | const NX_ESCROW_DISPUTED: i64 = 8 |
| 60 | const NX_ESCROW_REFUND_PENDING: i64 = 9 |
| 61 | const NX_ESCROW_REFUNDED: i64 = 10 |
| 62 | const NX_ESCROW_FROZEN: i64 = 11 |
| 63 | const NX_ESCROW_TIMED_OUT_TO_SELLER: i64 = 12 |
| 83 | const NX_ESCROW_OK: i64 = 1 |
| 84 | const NX_ESCROW_NOT_FOUND: i64 = 2 |
| 85 | const NX_ESCROW_INVALID_TRANSITION: i64 = 3 |
| 86 | const NX_ESCROW_INSUFFICIENT_FUNDS: i64 = 4 |
| 87 | const NX_ESCROW_LEDGER_POST_FAIL: i64 = 5 |
| 88 | const NX_ESCROW_TIMEOUT_NOT_REACHED: i64 = 6 |
| 89 | const NX_ESCROW_FROZEN_NO_OP: i64 = 7 |
| 90 | const NX_ESCROW_DISPUTE_TRIBUNAL_REQUIRED: i64 = 8 |
| 106 | const NX_ESCROW_SHIP_DEADLINE_DAYS: i64 = 7 // seller must ship within 7d of FUNDED |
| 107 | const NX_ESCROW_AUTO_RELEASE_DAYS: i64 = 14 // post-DELIVERED auto-release window |
| 108 | const NX_ESCROW_DISPUTE_WINDOW_DAYS: i64 = 30 // buyer can raise dispute within 30d |
| 109 | const NX_ESCROW_FROZEN_REVIEW_DAYS: i64 = 60 // regulatory freeze max before manual review |
| 151 | const NX_ESCROW_HOLD_BYTES: i64 = 232 // 29 fields * 8 bytes |
functions
| 65 | func nx_escrow_state_name(s: i64) -> *u8 |
| 92 | func nx_escrow_verdict_name(v: i64) -> *u8 |
| 159 | func nx_escrow_hold_new( calls 1: sys_mmap |
| 213 | func nx_escrow_can_transition(current: i64, target: i64) -> i64 called by 1: nx_escrow_advance |
| 255 | func nx_escrow_advance(h: *EscrowHold, target: i64, now_unix: i64) -> i64 |
| 282 | func nx_escrow_release_to_seller(h: *EscrowHold, now_unix: i64) -> i64 |
| 300 | func nx_escrow_refund_to_buyer(h: *EscrowHold, now_unix: i64) -> i64 calls 1: nx_escrow_advance |
| 331 | func nx_escrow_check_auto_release(h: *EscrowHold, now_unix: i64) -> i64 |
| 346 | func nx_escrow_initiate_dispute( calls 1: nx_escrow_advance |
| 362 | func nx_escrow_freeze(h: *EscrowHold, now_unix: i64) -> i64 calls 1: nx_escrow_advance |