Forces the journal batch out (a durability point between settles).
This tier's pending-out total for the user, for display as balance - pending.
One in-world purchase, grant-now-settle-later: the entitlement grant is durable before the
movement is offered to the session, so ownership reads true everywhere immediately while
the money waits for epoch-end settle (the worst crash leaves one owned-but-unpaid item,
reconcilable by its sale:<orderId> source — never lost money). Idempotent per orderId: a
repeat replays the recorded outcome. Malformed input throws; the expected refusals come
back rejected — INSUFFICIENT_FUNDS against matured balance minus everything pending (or a
failed prefund), RISK_DENIED over perUserCapMinor — and a rejection leaves no grant
behind.
Settles the session once (see the epoch-rotation rule) and applies the backstops.
The buyer's accepted spend this epoch — the total perUserCapMinor screens against.
This epoch's accepted and rejected purchase counts; the manager's sweep reads accepted against its rotation bound.
One epoch's lane over one netting session.
purchasegrants now and defers the money;settlenets the epoch to the ledger and applies the backstops — grants whose movement the settle replay refused are revoked (the report'srevokedlist), immature holds release, and prefund escrows refund their remainder to spendable. Every entry point rides one internal writer queue, so concurrent calls from an HTTP edge serialize instead of forking the session chain. Construct through openInstanceEconomy, or InstanceEconomies.laneFor.