{
 "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.",
 "soma_version": "3.2.4",
 "count": 15,
 "domains": {
  "logistics": 15
 },
 "features": [
  "agent",
  "cost",
  "fail",
  "guard",
  "http",
  "invariant",
  "lambda",
  "match",
  "multi_cell",
  "native",
  "pipeline",
  "service",
  "skeleton",
  "state_machine",
  "sum_type",
  "think",
  "tools",
  "try"
 ],
 "programs": [
  {
   "id": "logistics/bonded_warehouse",
   "domain": "logistics",
   "title": "BONDED WAREHOUSE — no duty, no exit",
   "summary": "BONDED WAREHOUSE — no duty, no exit A customs bonded warehouse holds imported goods on which duty has NOT yet been paid. The whole institution rests on one rule: bonded goods leave for the domestic market only after duty is settled, or leave the country entirely (re-export, duty never owed). \"Bond leakage\" — goods slipping into commerce duty-unpaid — is a perennial fraud; the UK lost hundreds of millions of pounds a year to bonded alcohol diversion in the 1990s \"London City Bond\" scandal, where paperwork showed exports that never left the island. Structurally: `domestic_market` is reachable ONLY through `duty_paid`, `re_exported` is terminal, and the duty ledger refuses a release whose payment doesn't cover the assessment. The diversion has no path.",
   "url": "https://soma-lang.dev/corpus/logistics/bonded_warehouse.cell",
   "repo_path": "examples/corpus/logistics/bonded_warehouse.cell",
   "lines": 125,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "BondedWarehouse",
    "NoBondLeakage"
   ]
  },
  {
   "id": "logistics/cold_chain_custody",
   "domain": "logistics",
   "title": "COLD-CHAIN CUSTODY — a warm vaccine never gets cold again",
   "summary": "COLD-CHAIN CUSTODY — a warm vaccine never gets cold again In 2022 the WHO estimated half of all vaccines are wasted globally, much of it to cold-chain failure — and the dangerous half of that is the failure NOBODY LOGS: a pallet of mRNA doses sits on a hot tarmac during a handoff, the temperature recorder is reset, and the shipment continues as if nothing happened. The doses are inert; the syringes still go in. Two structural fixes. Every custody handoff is a recorded transition — no anonymous gaps. And `breached` is a TERMINAL state: the moment any custodian logs an excursion, there is no transition that puts the pallet back on the cold chain. You cannot \"re-chill\" the record. soma verify proves both: every path is named, and breached has no exit.",
   "url": "https://soma-lang.dev/corpus/logistics/cold_chain_custody.cell",
   "repo_path": "examples/corpus/logistics/cold_chain_custody.cell",
   "lines": 105,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ColdChain",
    "NoRechilledRecords"
   ]
  },
  {
   "id": "logistics/container_seal_custody",
   "domain": "logistics",
   "title": "CONTAINER SEAL — a broken seal cannot be quietly replaced",
   "summary": "CONTAINER SEAL — a broken seal cannot be quietly replaced Europol calls it \"rip-on / rip-off\": corrupted port workers crack a container's bolt seal, pull out a duffel of cocaine stashed among the bananas, and fit a cloned seal before the box hits the gate. The whole scheme depends on the custody record showing an unbroken seal chain — on a mismatch being something an insider can paper over. Antwerp and Rotterdam seize 100+ tonnes a year that DIDN'T get papered over. Here every checkpoint verifies the seal number against the manifest. A match is a recorded hop; a MISMATCH moves the box to `tampered` — a TERMINAL state. There is no transition out: no re-verification, no supervisor override, no quiet reseal. The box ends at inspection, every time, and soma verify proves no path leads back.",
   "url": "https://soma-lang.dev/corpus/logistics/container_seal_custody.cell",
   "repo_path": "examples/corpus/logistics/container_seal_custody.cell",
   "lines": 108,
   "features": [
    "state_machine",
    "invariant",
    "match",
    "try"
   ],
   "cells": [
    "SealCustody",
    "NoQuietReseal"
   ]
  },
  {
   "id": "logistics/container_weight",
   "domain": "logistics",
   "title": "CONTAINER WEIGHT — the misdeclared box that breaks the ship",
   "summary": "CONTAINER WEIGHT — the misdeclared box that breaks the ship When the MSC Napoli was beached off Devon in 2007, investigators weighed the containers coming off her deck: 137 of 660 were more than 3 tonnes heavier than their declared weight — one was 20 tonnes over. Misdeclared container weights overload stacks, snap lashings, and capsize feeder ships. The IMO's answer was SOLAS VGM (2016): no verified gross mass, no loading. Period. Here the rule is structural. A container's gross mass lives behind a memory invariant capped at the ISO max for a 40-foot box (30,480 kg): the write that would overload it is REFUSED by the memory itself, and a container only reaches the `laden_aboard` state through `vgm_certified` — there is no path from packing straight onto the ship.",
   "url": "https://soma-lang.dev/corpus/logistics/container_weight.cell",
   "repo_path": "examples/corpus/logistics/container_weight.cell",
   "lines": 97,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ContainerYard",
    "SolasVgm"
   ]
  },
  {
   "id": "logistics/customs_clearance",
   "domain": "logistics",
   "title": "CUSTOMS CLEARANCE — no release without an examination verdict",
   "summary": "CUSTOMS CLEARANCE — no release without an examination verdict The 2019 Philadelphia seizure of 17.5 tonnes of cocaine aboard the MSC Gayane worked because the containers were HELD at the port until CBP finished examining them. The failure mode customs agencies fear is the opposite: a \"port runner\" — cargo that leaves the terminal while its entry is still under review, or after a seizure order. Once goods are on a truck, the border has already failed. This lifecycle makes the run impossible in the record system: `released` is reachable ONLY from `cleared`, an exam hold must return a verdict before anything moves, and `seized` is TERMINAL — a seizure order can never be walked back to circulation. soma verify proves all three.",
   "url": "https://soma-lang.dev/corpus/logistics/customs_clearance.cell",
   "repo_path": "examples/corpus/logistics/customs_clearance.cell",
   "lines": 112,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Customs",
    "NoPortRunners"
   ]
  },
  {
   "id": "logistics/dock_door_interlock",
   "domain": "logistics",
   "title": "DOCK DOOR INTERLOCK — the trailer that drives off with the forklift",
   "summary": "DOCK DOOR INTERLOCK — the trailer that drives off with the forklift OSHA logs several deaths a year from one warehouse scenario: a driver, thinking loading is done, pulls the trailer away from the dock while a forklift is still crossing the dock plate. The forklift drops through the gap — operators have been crushed under their own machines. The industry fix is a vehicle restraint (a hook that grabs the trailer's rear bar) interlocked with the dock door. In ladder logic that interlock is wiring you hope is right. Here it is a theorem: the door can only be open in the `loading` state, and `loading` is only reachable with the restraint LOCKED. The trailer can only depart from `trailer_at_door` — restraint off, door closed. The state \"door open, trailer free to move\" does not exist to race into.",
   "url": "https://soma-lang.dev/corpus/logistics/dock_door_interlock.cell",
   "repo_path": "examples/corpus/logistics/dock_door_interlock.cell",
   "lines": 86,
   "features": [
    "state_machine",
    "try"
   ],
   "cells": [
    "DockDoor",
    "RestraintInterlock"
   ]
  },
  {
   "id": "logistics/gate_appointment",
   "domain": "logistics",
   "title": "GATE APPOINTMENTS — a dock door cannot be double-booked",
   "summary": "GATE APPOINTMENTS — a dock door cannot be double-booked When the ports of LA and Long Beach gridlocked in 2021, a big share of the chaos was appointment churn: terminal systems double-booking gate slots, two trucks arriving for one window, one of them idling for hours and missing its next pickup. Inland, the same bug at a grocery DC means a reefer truck of frozen food waits in the yard burning diesel — detention fees run $50-100 an hour and the cold chain ticks. The scheduling rule here is not a uniqueness check in application code someone can bypass with a second code path. It is a memory invariant: each door-hour slot holds AT MOST ONE booking, and the second write to the same slot is refused by the memory itself.",
   "url": "https://soma-lang.dev/corpus/logistics/gate_appointment.cell",
   "repo_path": "examples/corpus/logistics/gate_appointment.cell",
   "lines": 100,
   "features": [
    "invariant"
   ],
   "cells": [
    "GateSchedule",
    "OneTruckPerWindow"
   ]
  },
  {
   "id": "logistics/hazmat_bay_segregation",
   "domain": "logistics",
   "title": "HAZMAT BAY SEGREGATION — Beirut, as a state that cannot exist",
   "summary": "HAZMAT BAY SEGREGATION — Beirut, as a state that cannot exist On 4 August 2020, 2,750 tonnes of ammonium nitrate stored for six years in Beirut's Hangar 12 — alongside a cache of FIREWORKS — detonated and killed more than 200 people. Tianjin 2015 was the same story: oxidizers warehoused next to fuels, 173 dead. Every dangerous-goods code on earth (IMDG, NFPA 400) says the same thing: oxidizers and flammables never share a bay. And in both cities, the paperwork said they did anyway. Here the bay is a state machine with NO mixed state: a bay holds oxidizer, or flammables, or nothing. The state \"both\" is not refused — it is unrepresentable, and soma verify proves the reachable set. A tonnage invariant caps any single bay at 25 t of oxidizer: a 2,750-tonne Hangar 12 cannot be written into this ledger at all.",
   "url": "https://soma-lang.dev/corpus/logistics/hazmat_bay_segregation.cell",
   "repo_path": "examples/corpus/logistics/hazmat_bay_segregation.cell",
   "lines": 120,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "HazmatBay",
    "Hangar12CannotHappen"
   ]
  },
  {
   "id": "logistics/inventory_conservation",
   "domain": "logistics",
   "title": "INVENTORY CONSERVATION — stock never teleports, never goes negative",
   "summary": "INVENTORY CONSERVATION — stock never teleports, never goes negative \"Phantom inventory\" costs retail roughly a quarter of a trillion dollars a year: the system says 12 units, the shelf has none, and replenishment never triggers because the ghost stock looks fine. The classic cause is an unbalanced transfer — a warehouse decrements, the receiving store's increment is lost (crash, double-click, integration retry), and the books drift from the world one transaction at a time. Here a transfer is one handler that does BOTH sides or NEITHER, and the memory refuses any write that would drive a site negative — the units for an oversized transfer simply do not exist to send. Conservation (total units constant across any transfer) is pinned by the tests.",
   "url": "https://soma-lang.dev/corpus/logistics/inventory_conservation.cell",
   "repo_path": "examples/corpus/logistics/inventory_conservation.cell",
   "lines": 92,
   "features": [
    "invariant",
    "pipeline",
    "try",
    "lambda"
   ],
   "cells": [
    "StockLedger",
    "NothingTeleports"
   ]
  },
  {
   "id": "logistics/package_tracking",
   "domain": "logistics",
   "title": "PACKAGE TRACKING — delivered is FOREVER",
   "summary": "PACKAGE TRACKING — delivered is FOREVER Couriers under per-stop quotas have been caught marking parcels \"delivered\" early, then quietly reverting the scan and dropping the box a day later — or never. Amazon, FedEx and UPS all field thousands of \"marked delivered, never arrived\" claims a year, and every fraudulent rewrite depends on one thing: the tracking record being MUTABLE. Here the journey is a verified state machine and `delivered` is a TERMINAL state: no outgoing transitions exist, so no handler — and no \"corrected\" rescan — can ever pull a delivered parcel back into transit. A failed doorstep attempt legally loops back to the depot; history rewriting does not. `soma verify` proves it.",
   "url": "https://soma-lang.dev/corpus/logistics/package_tracking.cell",
   "repo_path": "examples/corpus/logistics/package_tracking.cell",
   "lines": 84,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "PackageTracker",
    "DeliveredIsForever"
   ]
  },
  {
   "id": "logistics/proof_of_delivery",
   "domain": "logistics",
   "title": "PROOF OF DELIVERY — no signature, no \"delivered\"",
   "summary": "PROOF OF DELIVERY — no signature, no \"delivered\" Last-mile drivers paid per stop, racing a routing app's countdown, have a known shortcut: scan \"delivered\" from the van and toss the parcel — or never deliver it at all. Carrier audits call these \"phantom deliveries\"; for high-value freight (pharma, electronics) the missing proof-of-delivery turns straight into chargebacks and theft claims that the shipper, not the courier, eats. The fix is sequencing made structural: `delivered` is reachable ONLY from `pod_captured`, and capturing a POD requires being physically at the stop (`at_door`). A driver still in `en_route` has no transition — not a forbidden one, a NONEXISTENT one — that marks the box delivered. `delivered` and `returned_undeliverable` are terminal; verify proves it.",
   "url": "https://soma-lang.dev/corpus/logistics/proof_of_delivery.cell",
   "repo_path": "examples/corpus/logistics/proof_of_delivery.cell",
   "lines": 105,
   "features": [
    "state_machine",
    "try"
   ],
   "cells": [
    "LastMile",
    "NoPhantomDeliveries"
   ]
  },
  {
   "id": "logistics/rack_slot_capacity",
   "domain": "logistics",
   "title": "RACK SLOT CAPACITY — the pallet that brings down the aisle",
   "summary": "RACK SLOT CAPACITY — the pallet that brings down the aisle Warehouse racking collapses kill. When a beam rated for 1,000 kg takes a 1,400 kg pallet, it doesn't fail politely — it buckles, sheds its load into the next bay, and entire aisles domino (the 2018 collapse at an English cold store buried a worker under hundreds of pallets; SEMA logs dozens of such collapses a year). The root cause is almost always the same: the WMS happily recorded a put-away the steel could not hold. Here the beam rating is a memory invariant. The put-away that would overload bay steel is not logged-and-regretted; the write itself is REFUSED, so the WMS record can never describe an overloaded beam.",
   "url": "https://soma-lang.dev/corpus/logistics/rack_slot_capacity.cell",
   "repo_path": "examples/corpus/logistics/rack_slot_capacity.cell",
   "lines": 85,
   "features": [
    "invariant",
    "try"
   ],
   "cells": [
    "RackBay",
    "BeamRatingIsLaw"
   ]
  },
  {
   "id": "logistics/recall_quarantine",
   "domain": "logistics",
   "title": "RECALL QUARANTINE — the recalled lot that ships anyway",
   "summary": "RECALL QUARANTINE — the recalled lot that ships anyway The 2008-09 Peanut Corporation of America scandal: lots that TESTED POSITIVE for salmonella were re-tested until a lab said yes, then shipped. Nine people died, 714 fell ill, and the CEO went to prison for 28 years. The enabling failure was procedural: \"on hold\" was a status field someone could flip back. Here a lot's lifecycle is a verified machine. A recall moves the lot to `quarantined`, and from quarantine the ONLY exits are `destroyed` or `returned_to_supplier` — both TERMINAL. There is no edge back to `sellable`, so no re-test, no override, and no commercial pressure can put a recalled lot back on a truck. soma verify proves the absence.",
   "url": "https://soma-lang.dev/corpus/logistics/recall_quarantine.cell",
   "repo_path": "examples/corpus/logistics/recall_quarantine.cell",
   "lines": 110,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "RecallControl",
    "PcaCannotHappen"
   ]
  },
  {
   "id": "logistics/reefer_setpoint",
   "domain": "logistics",
   "title": "REEFER SETPOINT — the typo that thaws forty tonnes of tuna",
   "summary": "REEFER SETPOINT — the typo that thaws forty tonnes of tuna Refrigerated containers are programmed by hand at the terminal: a tech keys the setpoint from the booking sheet. The classic, expensive typo is sign and unit confusion — +18 instead of -18 (cargo claims files are full of them), or a Fahrenheit value keyed into a Celsius controller. Frozen tuna, ice cream, plasma: one transposed character and the claim runs to hundreds of thousands of dollars, discovered three weeks later at the destination port. This controller's setpoint memory carries the frozen-cargo envelope as an invariant: nothing outside [-30, -10] C can ever BE the setpoint. The +18 typo isn't caught by a validator someone forgot to call on one code path — the memory itself refuses, and the reefer keeps its last safe value. Power state is a verified machine: you cannot program a unit that isn't on, and a tripped unit must be inspected before reuse.",
   "url": "https://soma-lang.dev/corpus/logistics/reefer_setpoint.cell",
   "repo_path": "examples/corpus/logistics/reefer_setpoint.cell",
   "lines": 111,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ReeferController",
    "FrozenEnvelope"
   ]
  },
  {
   "id": "logistics/uld_loadmaster",
   "domain": "logistics",
   "title": "ULD LOADMASTER — National Airlines 102, refused at the manifest",
   "summary": "ULD LOADMASTER — National Airlines 102, refused at the manifest On 29 April 2013, National Airlines Flight 102 lifted off from Bagram with five armored vehicles strapped to its main deck. At rotation, at least one 12-tonne MRAP broke loose, slid aft, smashed the jackscrew of the horizontal stabilizer — and the 747 stalled onto the runway, killing all seven crew. The NTSB found the cargo was restrained by a scheme the operator had invented, far below the required tie-down strength, and the load was never properly verified. This loadmaster makes both failures structural: a unit load device's weight ledger refuses any write past the position's certified limit, and the pallet lifecycle has no path onto the aircraft that skips `restraints_verified`. An unverified pallet cannot board — the edge does not exist.",
   "url": "https://soma-lang.dev/corpus/logistics/uld_loadmaster.cell",
   "repo_path": "examples/corpus/logistics/uld_loadmaster.cell",
   "lines": 111,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "UldLoadmaster",
    "Bagram102"
   ]
  }
 ]
}