One machine, five assets — the state machine tested against real asset classes

The previous article ended on a claim: one machine holds a coupon-paying bond, an insurance policy, a decaying grain lot, a gram of vaulted gold and a flat — without a new state for any of them. A claim like that is either earned class by class or it is marketing. This article is the earning: five real asset classes, each with its own killer problem, each walked event-by-event through the same states — and no class needing a new one. The reader is invited to try to break it.

How the test works

The previous article specified the machine: eight compliance states, S0 Pre-Issuance through S7 Settlement/Wind-down (plus the S2a observation state), each with a named authority; typed transitions; two further planes — physical/custody and economic/valuation — that never move the asset but fire the triggers the compliance machine responds to. The question now is whether that specification survives contact with real assets, and the test has three parts per class. First, name the class's killer problem — the specific dysfunction that keeps it unfinanceable, unpledgeable or untrusted today. Second, map its actual lifecycle, event by event, onto the states — every event the class produces must land in an existing state, by an existing transition, fired by an authority the machine already names. Third, identify its signature trigger — the one piece of wiring that makes this class this class.

A useful way to hold the whole article in your head: the machine is a kernel and each asset class is a device driver. The kernel — states, authorities, transitions, the freeze, the audit trail — is written once and never forked. A driver tells the kernel what this particular device does: what events it emits, who is licensed to report on it, what it owes its holders. Nobody rewrites an operating system to plug in a new printer. The claim under test is that nobody should rewrite a depository to admit a new asset class.

1 · The corporate bond — covenants upgraded from filings to triggers

The killer problem today: a bond's covenants — the asset-cover ratios and undertakings that protect its holders — are checked at reporting dates and discovered at default. Between filings, cover can erode for months with the instrument trading as if nothing has happened; the covenant exists on paper precisely so that someone reads it too late. Meanwhile coupon payment remains a multi-day, multi-intermediary reconciliation, and the cash and security legs of settlement still move separately.

The mapping. Issuance runs S0 → S1: the asset registered, its terms attested, verification completed before any unit can move — at least one major market already requires pre-issuance recording of covenants on a depository-run ledger, so this is formalising a step that exists. Allotment brings the bond to S2 Active, where coupons accrue as entitlement events rather than reconciliation projects. Now the signature trigger: the cover ratio is live economic-plane state, and the moment it breaches the covenant threshold the bond moves to S3 Restricted — automatically, by trigger, not by a trustee's letter some weeks later. Cure the breach and it returns to S2, automatically again. Default or restructuring is S4 Suspended — reached via the uncured-breach path — where entitlements continue to accrue while the workout runs. A supervisor's intervention is S5, on the record. Maturity or call is S7: redemption settles against the cash leg atomically and the units are extinguished.

What the test shows: the bond needed no new state — and, just as important, it needed no physical plane at all. The profile simply switches Plane 2 off. That is the first piece of evidence that the planes are configuration rather than baggage: the machine does not force a grain inspector onto a debenture.

2 · The insurance policy — from a record nobody uses to an asset that can be pledged

The killer problem today: in most markets a policy's economic state — is it in force, what has it accrued, what is its surrender value — is visible only to the insurer. The law in many jurisdictions has allowed policies to be assigned as loan collateral for over a century, but a right that cannot be verified cannot be priced, so the right goes unused: households sit on policies with real surrender value and borrow unsecured instead. Lapse is silent — families discover at claim time that the policy died years earlier — and in at least one large market, a policy repository run as a pure record-keeper has stayed marginal after more than a decade, for exactly the reason this series keeps finding: a copy of the document adds nothing when the state lives elsewhere.

The mapping. Issuance runs S0 → S1 → S2, with the premium schedule and surrender value accruing as live economic-plane state that the holder — and any prospective lender — can read. Assignment for a loan is the legal right made executable: a lien recorded as state of the policy, with transfer whitelisted to the lender, priced against a surrender value that is no longer a phone call to the insurer. The signature trigger is the class's famous failure mode, made visible: a missed premium drops the policy to S3 Restricted automatically, the grace period is its cure window, and if the grace period expires uncured it falls to S4 Suspended — lapsed, in this class's vocabulary — seen the same instant by holder, nominee and lender. Revival within the window returns it to S2. A fraud investigation is S5, held by the supervisor. Claim, maturity or surrender is S7: settlement against verified state rather than re-collected documents, and the policy token is extinguished.

What the test shows: the policy is a unique item, not a fungible unit — a different shape of holding — and its life is dominated by a lapse⇄revival cycle no bond has. Both differences fit in the profile. The states did not move: "lapsed" is not a new state, it is what S4 is called when an insurance profile reaches it.

3 · The warehouse receipt — the showcase, where state matters most

The killer problem today: this series has already told it twice, through Qingdao's duplicated receipts in Article 1 and Kwame's unreadable cargo in Article 2. Quality is attested once, at deposit; the commodity then deteriorates invisibly while the record stays fresh, and record and reality drift apart until the loss surfaces. Too often the party issuing the receipt, storing the goods and attesting the quality is the same party, or a colluding one. Banks respond rationally: they discount the collateral toward zero — in at least one large market, the state had to stand up a public guarantee fund to induce banks to lend against warehouse receipts at all, which is a government paying to compensate for a missing state layer.

The mapping. Deposit is S0, where a licensed assayer — separated by role from both warehouse and issuer — signs the genesis grade. The receipt is issued at S1 and trades and pledges at S2, at attested value — a pledge is a lien created on the record in S2, with transfer whitelisted to the lender while it stands. The signature trigger is the machine's sharpest single idea, met in the previous article: attestation is a state, not an event. Miss a re-attestation window, or breach a monitored condition — moisture, temperature, quantity — and the receipt drops to S3 automatically. Unattested stock goes illiquid instead of fraudulently liquid. Re-attestation cures it back to S2; a failed re-grade or missed revalidation is S4. A warehouse-to-warehouse transfer is S6, with mandatory re-attestation at handover — the custody seam, where receipt fraud has historically lived, becomes a supervised state rather than a gap between two record systems. Delivery is S7; and because the receipt is a lot divisible into fractions, partial withdrawal is a burn of fractions rather than a manual re-issuance.

What the test shows: this is the class that uses everything — full physical plane, decay curve on the economic plane, the densest trigger wiring of the five. On the decay curve, one honest sentence from the machine's specification is worth restating: attested physical state feeds a published valuation-adjustment function, so a lender reads live grade and a stated haircut instead of pricing blind fear. Lenders do not need certainty; they need a number. That — not a guarantee fund — is the mechanism that would make this collateral bankable.

4 · Vaulted gold — the framework that exists, and why it goes unused

The killer problem today: at least one large market has launched an exchange-traded registry for vaulted gold, and volumes have stayed negligible. The reason is not demand for gold — household gold holdings in such markets are vast, almost all of them outside any registry, which is Fatima's story from Article 2. The reason is that vault trust is administrative: purity and bar lineage are attested once at deposit, fungibility across vaults is an accounting convention rather than a verifiable state, and moving between registries, where more than one exists, means redeeming in one and re-depositing in the other.

The mapping. Vault deposit and assay run S0 → S1, with purity and bar lineage signed at genesis. The registered grams trade, pledge and fractionalise at S2. The signature trigger is custodial: a vault attestation lapse or an audit exception drops the metal to S3 until re-attested — the same illiquid-not-fraudulently-liquid inversion as the warehouse receipt, applied to the vault rather than the grain. A vault-to-vault or registry-to-registry move is S6 Custody Transition with re-attestation at handover — a state transition, not a redemption-and-reissue. Physical withdrawal is S7: grams burned against bar release.

What the test shows: gold is the machine's most elegant negative result. Gold does not decay — so the profile simply sets the decay curve flat, and the same Plane-3 machinery that prices a grain lot's deterioration prices gold's storage state without modification. A design that needed a special case here would have flunked its own universality claim; a profile that turns a curve off is not a special case, it is a parameter.

5 · The property title — from evidence of a transaction to proof of ownership

The killer problem today: in much of the world, property registration is deeds-based and presumptive — the registry records that a transaction happened, not that the seller owned what was sold. Encumbrances, liens and litigation live scattered across registries no buyer can reliably search, which is why every serious purchase re-runs a title investigation from scratch. Fractional ownership of property, where legal wrappers for it exist, lacks a trusted register for the fractions. The asset is illiquid for the reason this series gave it in Article 1: not because nobody wants it, but because its state is illegible.

The mapping. Title verification and registrar attestation run S0 → S1 — the expensive step, done once, at the record. The tokenized title, and any fractions issued against it, are S2 Active, with rent flowing to fraction-holders as entitlement events. A mortgage is a lien created on the record: the encumbrance is a state of the asset, visible to any prospective buyer or lender, rather than a filing in a registry they may not think to search. Litigation or a court attachment is S4 or S5 — executed by the regulator or administrator on the court's order, as a typed transition with a full audit trail, exactly the supervised power the previous article described. Sale or redevelopment exit is S7: fractions consolidated, title token retired against the new registration.

What the test shows: two shapes compose — a unique title token with fungible fractions above it — and the fractions inherit the title's state automatically. A lien on the title restricts every fraction in the same instant; no fraction can be cleaner than the asset it is a fraction of. This is the property version of the series' propagation answer: nothing propagates because nothing is a copy. And this class is where the machine has actually run at sovereign grade — the title-and-encumbrance core of this profile underpins a national land registry we have built, which is why that part of the profile reads less like a proposal and more like a description; the fractional layer above it is design.

What the test found

Line the five sections up and two findings fall out. The first is architectural: no class needed a new state. A covenant breach, a lapsed premium, a moisture reading, a vault audit exception and a court attachment — events with nothing in common — all resolved into the same S3/S4/S5 grammar, fired by triggers wired per class. Three shapes of holding covered all five classes, and the enforcement surface above them — who may hold, freeze, force-transfer — never varied. The differences between a bond and a warehouse receipt turned out to live entirely in the profile: triggers, attesters, planes, entitlements. Configuration, not code.

The second finding is the one that matters commercially: every class's killer problem was a state problem. The bond's covenants are invisible between filings — a state problem. The policy cannot be pledged because its value cannot be read — a state problem. The warehouse receipt needs a sovereign guarantee because its condition is attested once and then drifts — a state problem. The gold registry goes unused because vault trust is administrative — a state problem. The title is evidence rather than proof — a state problem. Five classes, five regulators, five industries; one disease. A diagnosis that survives five such different patients is the strongest evidence this series can offer that the cure is general.

What the test did not prove

Honesty about the test's limits, before the series moves on. This article demonstrates a mapping, not five production deployments: the title-and-encumbrance core of the property profile runs at sovereign grade in our land-registry work, and individual mechanisms — covenant recording on depository ledgers, tokenized collateral with encumbrance state, policy assignment law — exist in production or in regulation across several markets, but no single institution yet runs all five profiles on one live core. That is the build this series is arguing for, not a thing to pretend already exists. And the whole test leans on one load-bearing assumption: that the attested state is true. Every profile above trusts its attesters — the assayer's grade, the vault's audit, the registrar's verification, the insurer's premium feed. What attestation actually is, how it decays, who may sign it and what happens when it is wrong — the three planes in full — is the next article, and it is the deepest layer of the design.