diff --git a/Anchor.toml b/Anchor.toml
new file mode 100644
index 0000000..4a30105
--- /dev/null
+++ b/Anchor.toml
@@ -0,0 +1,41 @@
+[toolchain]
+anchor_version = "0.31.1"
+solana_version = "2.1.0"
+
+[features]
+resolution = true
+skip-lint = false
+
+[programs.localnet]
+auth_capture_escrow = "AcESCRow1111111111111111111111111111111111"
+spl_token_collector = "SPLCo11ector1111111111111111111111111111111"
+
+[programs.devnet]
+# Filled in by `migrations/deploy-devnet.ts` after `anchor deploy --provider.cluster devnet`.
+# Pin the addresses produced there into this section + `packages/svm/.../constants.ts`.
+
+[programs.mainnet]
+# Filled in by `migrations/deploy-mainnet.ts` after `anchor deploy --provider.cluster mainnet`.
+
+[registry]
+url = "https://api.apr.dev"
+
+[provider]
+cluster = "Localnet"
+wallet = "~/.config/solana/id.json"
+
+[scripts]
+test = "pnpm vitest run --config tests/vitest.config.ts"
+
+[test]
+startup_wait = 10000
+shutdown_wait = 2000
+upgradeable = false
+
+[test.validator]
+url = "https://api.devnet.solana.com"
+
+# Clone USDC devnet mint into the test validator so SPL transfers work without
+# spinning up a fresh mint per test.
+[[test.validator.clone]]
+address = "4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..179e80f
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,17 @@
+[workspace]
+members = [
+    "programs/auth-capture-escrow",
+    "programs/spl-token-collector",
+    "fuzz",
+]
+resolver = "2"
+
+[profile.release]
+overflow-checks = true
+lto = "fat"
+codegen-units = 1
+
+[profile.release.build-override]
+opt-level = 3
+incremental = false
+codegen-units = 1
diff --git a/README.md b/README.md
index 6702ad0..0ce2601 100644
--- a/README.md
+++ b/README.md
@@ -1,49 +1,66 @@
 # x402r-contracts-svm
 
-Anchor programs for x402r on Solana — sibling to [`x402r-contracts`](https://github.com/BackTrackCo/x402r-contracts) (Solidity, Foundry).
+Anchor workspace for the x402r `authCapture` scheme on Solana.
 
-> **Status: Pilot, unaudited.** Mainnet usage is at users' own risk.
+> **Pilot. Unaudited.** Mainnet usage is at users' own risk. Pilot scope: `x402r-notes/plans/AUTHCAPTURE_SVM_PILOT.md`. Spec: `x402r-scheme/specs/schemes/authCapture/scheme_authCapture_svm.md`.
 
 ## Scope
 
-Faithful SVM port of the [`base/commerce-payments`](https://github.com/base/commerce-payments) authCapture primitives, plus x402r-specific extensions (operator factory, plugin slots, condition programs).
+This branch ships the base commerce-payments primitives only: the escrow and the SPL token collector. The x402r-specific extensions (payment-operator factory, condition plugins) ship in a follow-up PR that stacks on top of this one.
 
-The scheme spec lives at [`x402r-scheme/specs/schemes/authCapture/scheme_authCapture_svm.md`](https://github.com/BackTrackCo/x402r-scheme/blob/main/specs/schemes/authCapture/scheme_authCapture_svm.md).
+## Architectural symmetry with `base/commerce-payments`
+
+The base primitives are structured so each piece has a direct SVM counterpart of its EVM analog:
+
+| `base/commerce-payments` (EVM) | This workspace (SVM) |
+| :--- | :--- |
+| `AuthCaptureEscrow` | `auth-capture-escrow` |
+| `EIP3009TokenCollector` / `Permit2TokenCollector` | `spl-token-collector` (and future Token-2022 / bridge collectors slot in via the same `ITokenCollector` interface) |
+
+## Programs
+
+| Program | Role |
+| --- | --- |
+| `auth-capture-escrow` | Pure escrow primitive. Holds funds, enforces expiries, validates splits + protocol fee. CPIs into a token collector for fund movement. Knows nothing about plugins / arbitration. |
+| `spl-token-collector` | The pilot's only `ITokenCollector` impl. SPL Token transfers for both `collect_authorize` (payer ATA → vault) and `collect_refund` (treasury → payer). |
+
+`reclaim` lives on the escrow and is called by the payer directly: the payer's deadline-based escape hatch is intentionally not delegated, so it remains callable regardless of any wrappers later layered on top.
 
 ## Toolchain
 
 - Anchor 0.31+
 - Solana CLI 2.x
-- Rust stable (with `overflow-checks = true` in release)
+- Rust stable
 - pnpm 10
 - Codama (Kit-client generator)
-- Vitest (tests, via Codama-generated Solana Kit client — no `anchor-ts`)
+- Vitest (tests) — Codama-generated client only, no `anchor-ts`
 - Trident (fuzz)
 
-## Layout
+```bash
+anchor build
+anchor test --skip-deploy        # localnet, vitest under the hood
+pnpm codama:generate              # regenerates the @x402r/svm-client Kit clients
+pnpm fuzz                         # Trident fuzz on splits
+```
 
-To be filled in by the initial implementation PR. Planned shape:
+## Deploy
 
-```
-programs/                # Anchor programs
-  auth-capture-escrow    # AuthCaptureEscrow analog
-  spl-token-collector    # ITokenCollector for SPL Token
-  payment-operator       # x402r factory + slot dispatch
-  static-address-condition
-  receiver-condition
-  payer-condition
-tests/                   # Vitest + Codama Kit client
-fuzz/                    # Trident fuzz harnesses
-migrations/              # Deploy + program-ID pinning scripts
-codama/                  # Codama generator
-```
+Program IDs are keypair-derived per cluster. After `anchor deploy`, pin the resulting addresses into `Anchor.toml` and `x402r-scheme/packages/svm/src/authCapture/shared/constants.ts`.
 
-## License
+```bash
+pnpm deploy:devnet
+pnpm deploy:mainnet
+```
 
-[BUSL-1.1](./LICENSE). Same parameters as `x402r-contracts`. Change Date: 2029-12-09. Change License: MIT.
+The protocol-fee config (`protocolFeeBps`, `protocolFeeReceiver`) is **immutable** for this pilot. Both are baked into the escrow program at deploy via the `initialize_protocol_fee_config` one-shot ix; see `migrations/`.
 
-Every Rust source file in this repo MUST carry the SPDX header:
+## Layout
 
-```rust
-// SPDX-License-Identifier: BUSL-1.1
+```
+programs/auth-capture-escrow      # Escrow primitive
+programs/spl-token-collector      # ITokenCollector impl for SPL
+tests/                            # Vitest + Codama-generated Kit clients
+fuzz/                             # Trident fuzz harnesses
+migrations/                       # Deploy scripts (devnet + mainnet-beta)
+codama/                           # Codama Kit-client generation
 ```
diff --git a/codama/generate.ts b/codama/generate.ts
new file mode 100644
index 0000000..4136108
--- /dev/null
+++ b/codama/generate.ts
@@ -0,0 +1,55 @@
+/**
+ * Generate Solana Kit clients for `auth-capture-escrow` and `spl-token-collector`
+ * from their Anchor IDLs.
+ *
+ * Run after `anchor build`. Outputs land in
+ * `x402r-contracts-svm/codama/generated/<program>/` AND
+ * `x402r-scheme/packages/svm/src/codama-generated/<program>/` so both the
+ * test suite and the SDK consume the same Kit client.
+ */
+import { rootNodeFromAnchor } from "@codama/nodes-from-anchor";
+import { renderJavaScriptVisitor } from "@codama/renderers-js";
+import { createFromRoot } from "codama";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const PROGRAMS = ["auth_capture_escrow", "spl_token_collector"];
+
+const ROOT = join(import.meta.dirname, "..");
+
+for (const program of PROGRAMS) {
+  const idlPath = join(ROOT, "target", "idl", `${program}.json`);
+  let idl;
+  try {
+    idl = JSON.parse(readFileSync(idlPath, "utf8"));
+  } catch (err) {
+    console.error(
+      `[codama] could not read IDL ${idlPath}. Run \`anchor build\` first.`,
+      err,
+    );
+    process.exit(1);
+  }
+  const codama = createFromRoot(rootNodeFromAnchor(idl));
+
+  // Local copy for in-repo tests.
+  codama.accept(
+    renderJavaScriptVisitor(join(ROOT, "codama", "generated", program), {
+      formatCode: true,
+    }),
+  );
+
+  // SDK copy so `@x402r/svm` ships without re-deriving.
+  const sdkOut = join(
+    ROOT,
+    "..",
+    "x402r-scheme",
+    "packages",
+    "svm",
+    "src",
+    "codama-generated",
+    program,
+  );
+  codama.accept(renderJavaScriptVisitor(sdkOut, { formatCode: true }));
+
+  console.log(`[codama] generated ${program} -> ${sdkOut}`);
+}
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
new file mode 100644
index 0000000..dbbb61e
--- /dev/null
+++ b/fuzz/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "auth-capture-escrow-fuzz"
+version = "0.2.0"
+edition = "2021"
+description = "Trident fuzz harness for auth-capture-escrow"
+license = "BUSL-1.1"
+
+[lib]
+name = "auth_capture_escrow_fuzz"
+path = "src/lib.rs"
+
+[[bin]]
+name = "fuzz_splits"
+path = "fuzz_tests/fuzz_splits.rs"
+
+[dependencies]
+trident-client = "0.10"
+arbitrary = { version = "1.4", features = ["derive"] }
+auth-capture-escrow = { path = "../programs/auth-capture-escrow", features = ["no-entrypoint"] }
+
+[features]
+default = []
diff --git a/fuzz/fuzz_tests/fuzz_splits.rs b/fuzz/fuzz_tests/fuzz_splits.rs
new file mode 100644
index 0000000..cc8b451
--- /dev/null
+++ b/fuzz/fuzz_tests/fuzz_splits.rs
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! Fuzz target: `splits::validate_splits`. Generates random splits vectors
+//! and runs them through the validator. Asserts that **any** validator-accept
+//! satisfies the algebraic invariants:
+//!   - sum(splits) == amount
+//!   - exactly one receiver entry, amount > 0
+//!   - protocol fee entry exists iff protocol_fee_bps > 0
+//!   - protocol fee amount == floor(amount * protocol_fee_bps / 10_000)
+//!   - operator fee bps in [min_fee_bps, max_fee_bps]
+//!   - no recipient outside {receiver, protocol_fee_receiver, operator_fee_receiver}
+//!
+//! Validator-rejects don't need to be invariant-checked but the harness
+//! prints them periodically so we can sanity-check coverage.
+
+use anchor_lang::prelude::Pubkey;
+use auth_capture_escrow::{splits::validate_splits, state::SplitEntry};
+use auth_capture_escrow_fuzz::{FuzzSplit, FuzzSplitsInput};
+use trident_client::fuzzing::*;
+
+fuzz_target!(|input: FuzzSplitsInput| {
+    let receiver = Pubkey::new_unique();
+    let protocol_fee_receiver = Pubkey::new_unique();
+    let operator_fee_receiver = Pubkey::new_unique();
+    let random = Pubkey::new_unique();
+
+    let entries: Vec<SplitEntry> = input
+        .entries
+        .iter()
+        .map(|e: &FuzzSplit| SplitEntry {
+            recipient: match e.recipient_kind % 4 {
+                0 => receiver,
+                1 => protocol_fee_receiver,
+                2 => operator_fee_receiver,
+                _ => random,
+            },
+            amount: e.amount,
+        })
+        .collect();
+
+    let _ = validate_splits(
+        &entries,
+        input.amount,
+        &receiver,
+        input.protocol_fee_bps,
+        &protocol_fee_receiver,
+        &operator_fee_receiver,
+        input.min_fee_bps,
+        input.max_fee_bps,
+    );
+});
diff --git a/fuzz/src/lib.rs b/fuzz/src/lib.rs
new file mode 100644
index 0000000..7a4484f
--- /dev/null
+++ b/fuzz/src/lib.rs
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! Trident fuzz harness shared types. Each fuzz target binary in
+//! `fuzz_tests/` reuses these arbitrary-derived input shapes.
+
+use arbitrary::Arbitrary;
+
+/// One fuzz-generated split entry. Recipient is sampled from a small set of
+/// fixtures (receiver / protocol-fee / operator-fee / random unrelated key).
+#[derive(Arbitrary, Debug, Clone)]
+pub struct FuzzSplit {
+    pub recipient_kind: u8, // 0=receiver 1=protocol_fee 2=operator_fee 3=random
+    pub amount: u64,
+}
+
+#[derive(Arbitrary, Debug, Clone)]
+pub struct FuzzSplitsInput {
+    pub amount: u64,
+    pub protocol_fee_bps: u16,
+    pub min_fee_bps: u16,
+    pub max_fee_bps: u16,
+    pub entries: Vec<FuzzSplit>,
+}
diff --git a/migrations/deploy.ts b/migrations/deploy.ts
new file mode 100644
index 0000000..fd61138
--- /dev/null
+++ b/migrations/deploy.ts
@@ -0,0 +1,83 @@
+/**
+ * Deploy + initialize the protocol-fee config in one shot.
+ *
+ * Usage:
+ *   pnpm tsx migrations/deploy.ts <devnet|mainnet-beta> <protocolFeeBps> <protocolFeeReceiver>
+ *
+ * Run AFTER `anchor deploy --provider.cluster <cluster>`. This script only
+ * invokes the `initialize_protocol_fee_config` instruction — `anchor deploy`
+ * is what actually loads the .so onto the cluster.
+ *
+ * The config is **immutable** once initialized; do not run twice on the same
+ * deployment.
+ */
+import {
+  createSolanaRpc,
+  createSolanaRpcSubscriptions,
+  devnet,
+  mainnet,
+  pipe,
+  appendTransactionMessageInstructions,
+  createTransactionMessage,
+  generateKeyPairSigner,
+  sendAndConfirmTransactionFactory,
+  setTransactionMessageFeePayerSigner,
+  setTransactionMessageLifetimeUsingBlockhash,
+  signTransactionMessageWithSigners,
+  type Address,
+  address,
+} from "@solana/kit";
+
+async function main() {
+  const [, , clusterArg, bpsArg, receiverArg] = process.argv;
+  if (!clusterArg || !bpsArg || !receiverArg) {
+    console.error(
+      "Usage: pnpm tsx migrations/deploy.ts <devnet|mainnet-beta> <protocolFeeBps> <protocolFeeReceiver>",
+    );
+    process.exit(1);
+  }
+  const protocolFeeBps = Number(bpsArg);
+  if (!Number.isInteger(protocolFeeBps) || protocolFeeBps < 0 || protocolFeeBps > 10_000) {
+    throw new Error("protocolFeeBps must be 0..10000");
+  }
+  const protocolFeeReceiver = address(receiverArg) as Address;
+
+  const cluster = clusterArg === "devnet" ? "devnet" : "mainnet-beta";
+  const rpcUrl =
+    cluster === "devnet"
+      ? "https://api.devnet.solana.com"
+      : "https://api.mainnet-beta.solana.com";
+  const wsUrl =
+    cluster === "devnet"
+      ? "wss://api.devnet.solana.com"
+      : "wss://api.mainnet-beta.solana.com";
+
+  const rpc = createSolanaRpc(cluster === "devnet" ? devnet(rpcUrl) : mainnet(rpcUrl));
+  const rpcSubs = createSolanaRpcSubscriptions(wsUrl);
+
+  // TODO: replace with the Codama-generated initialize_protocol_fee_config
+  // ix builder once the client lives at `../codama/generated/auth_capture_escrow/`.
+  console.log(
+    `[deploy] cluster=${cluster} protocolFeeBps=${protocolFeeBps} protocolFeeReceiver=${protocolFeeReceiver}`,
+  );
+  console.log(
+    "[deploy] TODO: invoke auth_capture_escrow.initialize_protocol_fee_config via Codama client",
+  );
+
+  // Suppress unused-vars warnings until the Codama wiring lands.
+  void rpc;
+  void rpcSubs;
+  void sendAndConfirmTransactionFactory;
+  void pipe;
+  void appendTransactionMessageInstructions;
+  void createTransactionMessage;
+  void generateKeyPairSigner;
+  void setTransactionMessageFeePayerSigner;
+  void setTransactionMessageLifetimeUsingBlockhash;
+  void signTransactionMessageWithSigners;
+}
+
+main().catch(err => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/migrations/pin-program-ids.ts b/migrations/pin-program-ids.ts
new file mode 100644
index 0000000..f6d0c75
--- /dev/null
+++ b/migrations/pin-program-ids.ts
@@ -0,0 +1,65 @@
+/**
+ * After `anchor deploy --provider.cluster <cluster>`, write the resulting
+ * program IDs into:
+ *   - Anchor.toml `[programs.<cluster>]`
+ *   - x402r-scheme/packages/svm/src/authCapture/shared/constants.ts
+ *
+ * Solana program IDs are keypair-derived per cluster; cross-cluster
+ * determinism is not pursued for the pilot (Phase A open question 2).
+ */
+import { execSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const PROGRAMS = [
+  { name: "auth_capture_escrow", keypairPath: "target/deploy/auth_capture_escrow-keypair.json" },
+  { name: "spl_token_collector", keypairPath: "target/deploy/spl_token_collector-keypair.json" },
+];
+
+function programId(keypairPath: string): string {
+  return execSync(`solana-keygen pubkey ${keypairPath}`, {
+    cwd: join(import.meta.dirname, ".."),
+  })
+    .toString()
+    .trim();
+}
+
+const cluster = process.argv[2];
+if (cluster !== "devnet" && cluster !== "mainnet-beta") {
+  console.error("Usage: pnpm tsx migrations/pin-program-ids.ts <devnet|mainnet-beta>");
+  process.exit(1);
+}
+
+const ids = PROGRAMS.map(p => ({ name: p.name, id: programId(p.keypairPath) }));
+console.log(`[pin] cluster=${cluster}`);
+ids.forEach(p => console.log(`  ${p.name}: ${p.id}`));
+
+// Write into Anchor.toml.
+const anchorTomlPath = join(import.meta.dirname, "..", "Anchor.toml");
+let anchor = readFileSync(anchorTomlPath, "utf8");
+const tomlSection = cluster === "devnet" ? "[programs.devnet]" : "[programs.mainnet]";
+const sectionLines = ids.map(p => `${p.name} = "${p.id}"`).join("\n");
+const sectionRegex = new RegExp(`(${tomlSection.replace(/[.[\]]/g, "\\$&")}\\n)([\\s\\S]*?)(?=\\n\\[)`, "m");
+if (sectionRegex.test(anchor)) {
+  anchor = anchor.replace(sectionRegex, `$1${sectionLines}\n`);
+} else {
+  anchor += `\n${tomlSection}\n${sectionLines}\n`;
+}
+writeFileSync(anchorTomlPath, anchor);
+console.log(`[pin] wrote ${tomlSection} -> Anchor.toml`);
+
+// Surface the addresses so a human can paste them into the SDK constants
+// file. Automating the constants edit is more brittle than helpful.
+console.log("\n[pin] paste the following into");
+console.log(
+  "      x402r-scheme/packages/svm/src/authCapture/shared/constants.ts",
+);
+console.log(`\n  ${cluster.toUpperCase().replace("-", "_")}: {`);
+ids.forEach(p =>
+  console.log(`    ${camel(p.name)}: '${p.id}' as Address,`),
+);
+console.log("  },");
+
+function camel(s: string): string {
+  return s.replace(/_(.)/g, (_, c) => c.toUpperCase());
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..57b202a
--- /dev/null
+++ b/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "x402r-contracts-svm",
+  "private": true,
+  "version": "0.2.0",
+  "description": "Anchor workspace for the x402r authCapture SVM pilot. Unaudited.",
+  "scripts": {
+    "build": "anchor build",
+    "test": "anchor test --skip-deploy",
+    "test:local": "vitest run --config tests/vitest.config.ts",
+    "deploy:devnet": "anchor deploy --provider.cluster devnet && pnpm tsx migrations/pin-program-ids.ts devnet",
+    "deploy:mainnet": "anchor deploy --provider.cluster mainnet && pnpm tsx migrations/pin-program-ids.ts mainnet-beta",
+    "codama:generate": "tsx codama/generate.ts",
+    "fuzz": "trident fuzz run-hfuzz fuzz_splits",
+    "lint": "cargo clippy --all-targets -- -D warnings",
+    "format": "cargo fmt --all"
+  },
+  "devDependencies": {
+    "@codama/nodes-from-anchor": "^1.1.0",
+    "@codama/renderers-js": "^1.2.0",
+    "@solana/kit": "^5.1.0",
+    "@solana-program/compute-budget": "^0.11.0",
+    "@solana-program/system": "^0.7.0",
+    "@solana-program/token": "^0.9.0",
+    "@types/node": "^22.0.0",
+    "codama": "^1.3.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "vitest": "^4.0.18"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..4f44747
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+packages:
+  - "."
+  - "tests"
diff --git a/programs/auth-capture-escrow/Cargo.toml b/programs/auth-capture-escrow/Cargo.toml
new file mode 100644
index 0000000..d114b4a
--- /dev/null
+++ b/programs/auth-capture-escrow/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "auth-capture-escrow"
+version = "0.2.0"
+description = "x402r authCapture escrow on Solana (pilot, unaudited)"
+license = "BUSL-1.1"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib", "lib"]
+name = "auth_capture_escrow"
+
+[features]
+default = []
+no-entrypoint = []
+no-idl = []
+no-log-ix-name = []
+cpi = ["no-entrypoint"]
+idl-build = ["anchor-lang/idl-build", "anchor-spl/idl-build"]
+
+[dependencies]
+anchor-lang = { version = "0.31.1", features = ["init-if-needed"] }
+anchor-spl = "0.31.1"
+solana-program = "~2.1"
+sha2 = { version = "0.10", default-features = false }
diff --git a/programs/auth-capture-escrow/Xargo.toml b/programs/auth-capture-escrow/Xargo.toml
new file mode 100644
index 0000000..475fb71
--- /dev/null
+++ b/programs/auth-capture-escrow/Xargo.toml
@@ -0,0 +1,2 @@
+[target.bpfel-unknown-unknown.dependencies.std]
+features = []
diff --git a/programs/auth-capture-escrow/src/collectors.rs b/programs/auth-capture-escrow/src/collectors.rs
new file mode 100644
index 0000000..362d358
--- /dev/null
+++ b/programs/auth-capture-escrow/src/collectors.rs
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `ITokenCollector` CPI helper.
+//!
+//! Token collectors are pluggable adapters that handle "external party →
+//! escrow vault" (authorize/charge) and "external party → payer" (refund).
+//! The escrow knows nothing about the asset-transfer method — it just CPIs
+//! into the collector with a well-known instruction shape.
+//!
+//! The pilot ships a single `spl-token-collector`. Future Token-2022,
+//! cross-chain, or streaming collectors implement the same interface and
+//! slot in.
+//!
+//! Wire format (the bytes appended to the Anchor instruction discriminator):
+//!
+//! ```text
+//! collect_authorize: [disc(8) | payment_info_hash(32) | amount(u64 LE) | collector_data(Vec<u8>)]
+//! collect_refund:    [disc(8) | payment_info_hash(32) | amount(u64 LE) | collector_data(Vec<u8>)]
+//! ```
+//!
+//! The escrow forwards `remaining_accounts` to the collector unchanged so
+//! the collector can declare any account list it needs (payer ATA, vault
+//! ATA, signer accounts, mint, etc.).
+
+use anchor_lang::prelude::*;
+use anchor_lang::solana_program::{instruction::Instruction, program::invoke};
+
+use crate::errors::EscrowError;
+
+/// `sha256("global:collect_authorize")[..8]`. Hard-coded so the escrow
+/// doesn't need to parse the IDL at runtime; the collector MUST expose an
+/// instruction with this exact name.
+pub const COLLECT_AUTHORIZE_DISC: [u8; 8] = [187, 156, 174, 70, 195, 87, 21, 173];
+
+/// `sha256("global:collect_refund")[..8]`.
+pub const COLLECT_REFUND_DISC: [u8; 8] = [33, 122, 8, 154, 42, 119, 207, 44];
+
+/// CPI helper for `collect_authorize` and `collect_refund`. The caller picks
+/// the discriminator. `remaining` accounts (everything after the collector
+/// program account) are passed straight through to the collector.
+pub fn invoke_collector<'info>(
+    discriminator: [u8; 8],
+    collector_program: &AccountInfo<'info>,
+    payment_info_hash: &[u8; 32],
+    amount: u64,
+    collector_data: &[u8],
+    accounts: &[AccountInfo<'info>],
+) -> Result<()> {
+    let mut data = Vec::with_capacity(8 + 32 + 8 + 4 + collector_data.len());
+    data.extend_from_slice(&discriminator);
+    data.extend_from_slice(payment_info_hash);
+    data.extend_from_slice(&amount.to_le_bytes());
+    // Borsh `Vec<u8>` length prefix (u32 LE) + payload.
+    data.extend_from_slice(&(collector_data.len() as u32).to_le_bytes());
+    data.extend_from_slice(collector_data);
+
+    let metas: Vec<AccountMeta> = accounts
+        .iter()
+        .map(|a| AccountMeta {
+            pubkey: *a.key,
+            is_signer: a.is_signer,
+            is_writable: a.is_writable,
+        })
+        .collect();
+
+    let mut infos = Vec::with_capacity(accounts.len() + 1);
+    infos.extend(accounts.iter().cloned());
+    infos.push(collector_program.clone());
+
+    let ix = Instruction {
+        program_id: *collector_program.key,
+        accounts: metas,
+        data,
+    };
+    invoke(&ix, &infos).map_err(|_| error!(EscrowError::CollectorFailed))
+}
diff --git a/programs/auth-capture-escrow/src/errors.rs b/programs/auth-capture-escrow/src/errors.rs
new file mode 100644
index 0000000..43f4b3f
--- /dev/null
+++ b/programs/auth-capture-escrow/src/errors.rs
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! Error codes. Names mirror the EVM `AuthCaptureEscrow` custom errors so the
+//! SDK's `invalid_reason` mapping table stays parallel between EVM and SVM.
+
+use anchor_lang::prelude::*;
+
+#[error_code]
+pub enum EscrowError {
+    #[msg("zero amount")]
+    ZeroAmount,
+    #[msg("amount exceeds maxAmount")]
+    ExceedsMaxAmount,
+    #[msg("now > preApprovalExpiry")]
+    AfterPreApprovalExpiry,
+    #[msg("now > authorizationExpiry")]
+    AfterAuthorizationExpiry,
+    #[msg("now > refundExpiry")]
+    AfterRefundExpiry,
+    #[msg("invalid expiry ordering: preApprovalExpiry <= authorizationExpiry <= refundExpiry required")]
+    InvalidExpiries,
+    #[msg("payment already collected")]
+    PaymentAlreadyCollected,
+    #[msg("insufficient capturable amount")]
+    InsufficientAuthorization,
+    #[msg("zero authorization (already captured/voided/reclaimed)")]
+    ZeroAuthorization,
+    #[msg("insufficient refundable amount")]
+    InsufficientRefundable,
+    #[msg("operator mismatch")]
+    InvalidSender,
+    #[msg("payer mismatch")]
+    InvalidPayer,
+    #[msg("operator fee bps out of [minFeeBps, maxFeeBps] range")]
+    FeeBpsOutOfRange,
+    #[msg("fee bps > 10_000")]
+    FeeBpsOverflow,
+    #[msg("invalid fee bps range: minFeeBps > maxFeeBps")]
+    InvalidFeeBpsRange,
+    #[msg("splits do not sum to amount")]
+    SplitsSumMismatch,
+    #[msg("splits missing receiver entry")]
+    SplitsMissingReceiver,
+    #[msg("splits missing protocol fee entry")]
+    SplitsMissingProtocolFee,
+    #[msg("splits protocol fee amount mismatch")]
+    SplitsWrongProtocolFee,
+    #[msg("splits operator fee receiver mismatch")]
+    SplitsWrongOperatorFeeReceiver,
+    #[msg("splits include disallowed recipient")]
+    SplitsDisallowedRecipient,
+    #[msg("splits exceed MAX_SPLITS")]
+    SplitsTooMany,
+    #[msg("paymentInfo hash mismatches PDA")]
+    PaymentInfoHashMismatch,
+    #[msg("payment state mint does not match paymentInfo.mint")]
+    MintMismatch,
+    #[msg("payment state vault not the expected ATA")]
+    VaultMismatch,
+    #[msg("protocol fee config has not been initialized")]
+    ProtocolFeeConfigNotInitialized,
+    #[msg("protocol fee config already initialized")]
+    ProtocolFeeConfigAlreadyInitialized,
+    #[msg("protocol fee receiver passed in does not match config")]
+    ProtocolFeeReceiverMismatch,
+    #[msg("CPI to token collector failed")]
+    CollectorFailed,
+    #[msg("reclaim before capture deadline")]
+    ReclaimBeforeDeadline,
+    #[msg("token account owner mismatch")]
+    TokenAccountOwnerMismatch,
+}
diff --git a/programs/auth-capture-escrow/src/events.rs b/programs/auth-capture-escrow/src/events.rs
new file mode 100644
index 0000000..367a76e
--- /dev/null
+++ b/programs/auth-capture-escrow/src/events.rs
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! Anchor events. Names mirror EVM `AuthCaptureEscrow` so off-chain indexers
+//! can share field semantics across chains.
+
+use anchor_lang::prelude::*;
+
+#[event]
+pub struct PaymentAuthorized {
+    pub payment_info_hash: [u8; 32],
+    pub payer: Pubkey,
+    pub amount: u64,
+}
+
+#[event]
+pub struct PaymentCharged {
+    pub payment_info_hash: [u8; 32],
+    pub payer: Pubkey,
+    pub amount: u64,
+}
+
+#[event]
+pub struct PaymentCaptured {
+    pub payment_info_hash: [u8; 32],
+    pub amount: u64,
+}
+
+#[event]
+pub struct PaymentVoided {
+    pub payment_info_hash: [u8; 32],
+    pub amount: u64,
+}
+
+#[event]
+pub struct PaymentRefunded {
+    pub payment_info_hash: [u8; 32],
+    pub amount: u64,
+}
+
+#[event]
+pub struct PaymentReclaimed {
+    pub payment_info_hash: [u8; 32],
+    pub amount: u64,
+}
diff --git a/programs/auth-capture-escrow/src/instructions/authorize.rs b/programs/auth-capture-escrow/src/instructions/authorize.rs
new file mode 100644
index 0000000..4892b2e
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/authorize.rs
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `authorize` — collect funds via the token collector and lock them in the
+//! per-payment escrow vault. Two-phase entry point.
+//!
+//! Signers:
+//!   - `operator` — typically a `payment-operator` per-merchant PDA, signing
+//!     via `invoke_signed` from the parent CPI.
+//!   - Whatever signer the collector requires (typically the payer; passed
+//!     through via `remaining_accounts` to the collector).
+//!
+//! The collector is supplied per-tx; the escrow does not bake it in. This
+//! lets the same escrow back SPL Token (via `spl-token-collector`),
+//! Token-2022 with extensions (via a future `token2022-collector`), or any
+//! other asset-transfer mechanism.
+
+use anchor_lang::prelude::*;
+use anchor_spl::associated_token::AssociatedToken;
+use anchor_spl::token::{Mint, Token, TokenAccount};
+
+use crate::collectors::{invoke_collector, COLLECT_AUTHORIZE_DISC};
+use crate::errors::EscrowError;
+use crate::events::PaymentAuthorized;
+use crate::state::{PaymentInfo, PaymentState};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct Authorize<'info> {
+    /// Operator-as-signer. Validated against `paymentInfo.operator`.
+    #[account(address = payment_info.operator @ EscrowError::InvalidSender)]
+    pub operator: Signer<'info>,
+    /// Per-payment state PDA.
+    #[account(
+        init,
+        payer = rent_payer,
+        space = PaymentState::LEN,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    /// Escrow vault: associated token account owned by `payment_state`. The
+    /// collector will write into this account.
+    #[account(
+        init_if_needed,
+        payer = rent_payer,
+        associated_token::mint = mint,
+        associated_token::authority = payment_state,
+    )]
+    pub vault: Account<'info, TokenAccount>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, Mint>,
+    /// Funds rent for the new accounts. Typically the facilitator/feePayer.
+    #[account(mut)]
+    pub rent_payer: Signer<'info>,
+    /// CHECK: collector program; validated only by virtue of the CPI succeeding.
+    pub token_collector: UncheckedAccount<'info>,
+    pub token_program: Program<'info, Token>,
+    pub associated_token_program: Program<'info, AssociatedToken>,
+    pub system_program: Program<'info, System>,
+}
+
+pub fn handler(
+    ctx: Context<Authorize>,
+    payment_info: PaymentInfo,
+    amount: u64,
+    collector_data: Vec<u8>,
+) -> Result<()> {
+    require!(amount > 0, EscrowError::ZeroAmount);
+    require!(amount <= payment_info.max_amount, EscrowError::ExceedsMaxAmount);
+
+    let now = Clock::get()?.unix_timestamp;
+    require!(
+        now <= payment_info.pre_approval_expiry,
+        EscrowError::AfterPreApprovalExpiry
+    );
+    require!(
+        payment_info.pre_approval_expiry <= payment_info.authorization_expiry
+            && payment_info.authorization_expiry <= payment_info.refund_expiry,
+        EscrowError::InvalidExpiries
+    );
+    require!(
+        payment_info.min_fee_bps <= payment_info.max_fee_bps,
+        EscrowError::InvalidFeeBpsRange
+    );
+    require!(payment_info.max_fee_bps <= 10_000, EscrowError::FeeBpsOverflow);
+
+    let state = &mut ctx.accounts.payment_state;
+    require!(
+        !state.has_collected_payment,
+        EscrowError::PaymentAlreadyCollected
+    );
+
+    let payment_info_hash = payment_info.hash()?;
+
+    // CPI into the collector. Everything in `remaining_accounts` is forwarded
+    // unchanged so the collector can declare its own account list (e.g.
+    // payer ATA + payer signer + spl-token program for `spl-token-collector`).
+    invoke_collector(
+        COLLECT_AUTHORIZE_DISC,
+        &ctx.accounts.token_collector.to_account_info(),
+        &payment_info_hash,
+        amount,
+        &collector_data,
+        ctx.remaining_accounts,
+    )?;
+
+    state.has_collected_payment = true;
+    state.capturable_amount = amount;
+    state.refundable_amount = 0;
+    state.payment_info_hash = payment_info_hash;
+    state.bump = ctx.bumps.payment_state;
+
+    emit!(PaymentAuthorized {
+        payment_info_hash,
+        payer: payment_info.payer,
+        amount,
+    });
+
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/capture.rs b/programs/auth-capture-escrow/src/instructions/capture.rs
new file mode 100644
index 0000000..26ac98d
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/capture.rs
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `capture` — distribute previously-authorized escrow funds per `splits`.
+//! Signer: operator. Direct intra-program SPL transfers; no collector
+//! indirection because the vault is the source.
+
+use anchor_lang::prelude::*;
+use anchor_spl::token::{transfer, Token, TokenAccount, Transfer};
+
+use crate::errors::EscrowError;
+use crate::events::PaymentCaptured;
+use crate::splits::validate_splits;
+use crate::state::{PaymentInfo, PaymentState, ProtocolFeeConfig, SplitEntry};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct Capture<'info> {
+    #[account(address = payment_info.operator @ EscrowError::InvalidSender)]
+    pub operator: Signer<'info>,
+    #[account(
+        mut,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump = payment_state.bump,
+        constraint = payment_state.has_collected_payment @ EscrowError::ZeroAuthorization,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = payment_state,
+    )]
+    pub vault: Account<'info, TokenAccount>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = receiver,
+    )]
+    pub receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: must match `payment_info.receiver`.
+    #[account(address = payment_info.receiver)]
+    pub receiver: UncheckedAccount<'info>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = protocol_fee_receiver,
+    )]
+    pub protocol_fee_receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: validated against config.
+    #[account(address = protocol_fee_config.protocol_fee_receiver @ EscrowError::ProtocolFeeReceiverMismatch)]
+    pub protocol_fee_receiver: UncheckedAccount<'info>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = operator_fee_receiver,
+    )]
+    pub operator_fee_receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: validated against payment_info.fee_receiver.
+    #[account(address = payment_info.fee_receiver)]
+    pub operator_fee_receiver: UncheckedAccount<'info>,
+    #[account(
+        seeds = [ProtocolFeeConfig::SEED],
+        bump = protocol_fee_config.bump,
+        constraint = protocol_fee_config.initialized @ EscrowError::ProtocolFeeConfigNotInitialized,
+    )]
+    pub protocol_fee_config: Account<'info, ProtocolFeeConfig>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, anchor_spl::token::Mint>,
+    pub token_program: Program<'info, Token>,
+}
+
+pub fn handler(
+    ctx: Context<Capture>,
+    payment_info: PaymentInfo,
+    amount: u64,
+    splits: Vec<SplitEntry>,
+) -> Result<()> {
+    let now = Clock::get()?.unix_timestamp;
+    require!(amount > 0, EscrowError::ZeroAmount);
+    require!(
+        now <= payment_info.authorization_expiry,
+        EscrowError::AfterAuthorizationExpiry
+    );
+
+    let payment_info_hash = payment_info.hash()?;
+    require!(
+        ctx.accounts.payment_state.payment_info_hash == payment_info_hash,
+        EscrowError::PaymentInfoHashMismatch
+    );
+    require!(
+        ctx.accounts.payment_state.capturable_amount >= amount,
+        EscrowError::InsufficientAuthorization
+    );
+
+    let _validated = validate_splits(
+        &splits,
+        amount,
+        &payment_info.receiver,
+        ctx.accounts.protocol_fee_config.protocol_fee_bps,
+        &ctx.accounts.protocol_fee_config.protocol_fee_receiver,
+        &payment_info.fee_receiver,
+        payment_info.min_fee_bps,
+        payment_info.max_fee_bps,
+    )?;
+
+    let seeds: &[&[u8]] = &[
+        PaymentState::SEED,
+        ctx.accounts.payment_state.payment_info_hash.as_ref(),
+        std::slice::from_ref(&ctx.accounts.payment_state.bump),
+    ];
+    let signer_seeds = &[seeds];
+
+    for entry in splits.iter() {
+        let dest_info = if entry.recipient == payment_info.receiver {
+            ctx.accounts.receiver_ata.to_account_info()
+        } else if entry.recipient == ctx.accounts.protocol_fee_config.protocol_fee_receiver {
+            ctx.accounts.protocol_fee_receiver_ata.to_account_info()
+        } else if entry.recipient == payment_info.fee_receiver {
+            ctx.accounts.operator_fee_receiver_ata.to_account_info()
+        } else {
+            return err!(EscrowError::SplitsDisallowedRecipient);
+        };
+
+        transfer(
+            CpiContext::new_with_signer(
+                ctx.accounts.token_program.to_account_info(),
+                Transfer {
+                    from: ctx.accounts.vault.to_account_info(),
+                    to: dest_info,
+                    authority: ctx.accounts.payment_state.to_account_info(),
+                },
+                signer_seeds,
+            ),
+            entry.amount,
+        )?;
+    }
+
+    let state = &mut ctx.accounts.payment_state;
+    state.capturable_amount = state
+        .capturable_amount
+        .checked_sub(amount)
+        .ok_or(EscrowError::InsufficientAuthorization)?;
+    state.refundable_amount = state
+        .refundable_amount
+        .checked_add(amount)
+        .ok_or(EscrowError::ExceedsMaxAmount)?;
+
+    emit!(PaymentCaptured {
+        payment_info_hash,
+        amount,
+    });
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/charge.rs b/programs/auth-capture-escrow/src/instructions/charge.rs
new file mode 100644
index 0000000..bc6162d
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/charge.rs
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `charge` — single-shot path: collect funds via the token collector and
+//! distribute per `splits` directly to receivers in one tx. Funds never sit
+//! in the escrow vault; the collector deposits to vault and the same ix
+//! drains the vault per splits.
+//!
+//! Signers: operator (validated against `paymentInfo.operator`) plus whatever
+//! the collector requires (typically payer).
+
+use anchor_lang::prelude::*;
+use anchor_spl::associated_token::AssociatedToken;
+use anchor_spl::token::{transfer, Mint, Token, TokenAccount, Transfer};
+
+use crate::collectors::{invoke_collector, COLLECT_AUTHORIZE_DISC};
+use crate::errors::EscrowError;
+use crate::events::PaymentCharged;
+use crate::splits::validate_splits;
+use crate::state::{PaymentInfo, PaymentState, ProtocolFeeConfig, SplitEntry};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct Charge<'info> {
+    #[account(address = payment_info.operator @ EscrowError::InvalidSender)]
+    pub operator: Signer<'info>,
+    #[account(
+        init,
+        payer = rent_payer,
+        space = PaymentState::LEN,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    /// Vault — collector deposits here, then we redistribute. The vault must
+    /// exist as the SPL transfer destination but holds funds only briefly
+    /// within this ix.
+    #[account(
+        init_if_needed,
+        payer = rent_payer,
+        associated_token::mint = mint,
+        associated_token::authority = payment_state,
+    )]
+    pub vault: Account<'info, TokenAccount>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = receiver,
+    )]
+    pub receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: must match `payment_info.receiver`.
+    #[account(address = payment_info.receiver)]
+    pub receiver: UncheckedAccount<'info>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = protocol_fee_receiver,
+    )]
+    pub protocol_fee_receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: validated against config.
+    #[account(address = protocol_fee_config.protocol_fee_receiver @ EscrowError::ProtocolFeeReceiverMismatch)]
+    pub protocol_fee_receiver: UncheckedAccount<'info>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = operator_fee_receiver,
+    )]
+    pub operator_fee_receiver_ata: Account<'info, TokenAccount>,
+    /// CHECK: validated against payment_info.fee_receiver.
+    #[account(address = payment_info.fee_receiver)]
+    pub operator_fee_receiver: UncheckedAccount<'info>,
+    #[account(
+        seeds = [ProtocolFeeConfig::SEED],
+        bump = protocol_fee_config.bump,
+        constraint = protocol_fee_config.initialized @ EscrowError::ProtocolFeeConfigNotInitialized,
+    )]
+    pub protocol_fee_config: Account<'info, ProtocolFeeConfig>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, Mint>,
+    #[account(mut)]
+    pub rent_payer: Signer<'info>,
+    /// CHECK: collector program.
+    pub token_collector: UncheckedAccount<'info>,
+    pub token_program: Program<'info, Token>,
+    pub associated_token_program: Program<'info, AssociatedToken>,
+    pub system_program: Program<'info, System>,
+}
+
+pub fn handler(
+    ctx: Context<Charge>,
+    payment_info: PaymentInfo,
+    amount: u64,
+    splits: Vec<SplitEntry>,
+    collector_data: Vec<u8>,
+) -> Result<()> {
+    let now = Clock::get()?.unix_timestamp;
+    require!(amount > 0, EscrowError::ZeroAmount);
+    require!(amount <= payment_info.max_amount, EscrowError::ExceedsMaxAmount);
+    require!(
+        now <= payment_info.pre_approval_expiry,
+        EscrowError::AfterPreApprovalExpiry
+    );
+    require!(
+        now <= payment_info.authorization_expiry,
+        EscrowError::AfterAuthorizationExpiry
+    );
+    require!(
+        payment_info.pre_approval_expiry <= payment_info.authorization_expiry
+            && payment_info.authorization_expiry <= payment_info.refund_expiry,
+        EscrowError::InvalidExpiries
+    );
+
+    let state = &mut ctx.accounts.payment_state;
+    require!(
+        !state.has_collected_payment,
+        EscrowError::PaymentAlreadyCollected
+    );
+
+    let payment_info_hash = payment_info.hash()?;
+
+    let _validated = validate_splits(
+        &splits,
+        amount,
+        &payment_info.receiver,
+        ctx.accounts.protocol_fee_config.protocol_fee_bps,
+        &ctx.accounts.protocol_fee_config.protocol_fee_receiver,
+        &payment_info.fee_receiver,
+        payment_info.min_fee_bps,
+        payment_info.max_fee_bps,
+    )?;
+
+    // Collect funds into vault.
+    invoke_collector(
+        COLLECT_AUTHORIZE_DISC,
+        &ctx.accounts.token_collector.to_account_info(),
+        &payment_info_hash,
+        amount,
+        &collector_data,
+        ctx.remaining_accounts,
+    )?;
+
+    // Distribute per splits — vault → each recipient ATA, signed by the
+    // payment_state PDA.
+    let pi_hash = payment_info_hash;
+    let bump = ctx.bumps.payment_state;
+    let seeds: &[&[u8]] = &[PaymentState::SEED, pi_hash.as_ref(), std::slice::from_ref(&bump)];
+    let signer_seeds = &[seeds];
+
+    for entry in splits.iter() {
+        let dest_info = if entry.recipient == payment_info.receiver {
+            ctx.accounts.receiver_ata.to_account_info()
+        } else if entry.recipient == ctx.accounts.protocol_fee_config.protocol_fee_receiver {
+            ctx.accounts.protocol_fee_receiver_ata.to_account_info()
+        } else if entry.recipient == payment_info.fee_receiver {
+            ctx.accounts.operator_fee_receiver_ata.to_account_info()
+        } else {
+            return err!(EscrowError::SplitsDisallowedRecipient);
+        };
+
+        transfer(
+            CpiContext::new_with_signer(
+                ctx.accounts.token_program.to_account_info(),
+                Transfer {
+                    from: ctx.accounts.vault.to_account_info(),
+                    to: dest_info,
+                    authority: ctx.accounts.payment_state.to_account_info(),
+                },
+                signer_seeds,
+            ),
+            entry.amount,
+        )?;
+    }
+
+    let state = &mut ctx.accounts.payment_state;
+    state.has_collected_payment = true;
+    state.capturable_amount = 0;
+    state.refundable_amount = amount;
+    state.payment_info_hash = pi_hash;
+    state.bump = bump;
+
+    emit!(PaymentCharged {
+        payment_info_hash: pi_hash,
+        payer: payment_info.payer,
+        amount,
+    });
+
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/initialize_protocol_fee_config.rs b/programs/auth-capture-escrow/src/instructions/initialize_protocol_fee_config.rs
new file mode 100644
index 0000000..17c3d51
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/initialize_protocol_fee_config.rs
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! One-shot initializer for the immutable `ProtocolFeeConfig`. Once executed
+//! at deploy time, the config can never be changed (no upgrade path beyond
+//! redeploying the program with a fresh program-id and config PDA). This is
+//! the deliberate pilot trade-off — we punt on the EVM 7-day timelocked swap.
+
+use anchor_lang::prelude::*;
+
+use crate::errors::EscrowError;
+use crate::state::ProtocolFeeConfig;
+
+#[derive(Accounts)]
+pub struct InitializeProtocolFeeConfig<'info> {
+    #[account(mut)]
+    pub deployer: Signer<'info>,
+    #[account(
+        init,
+        payer = deployer,
+        space = ProtocolFeeConfig::LEN,
+        seeds = [ProtocolFeeConfig::SEED],
+        bump,
+    )]
+    pub config: Account<'info, ProtocolFeeConfig>,
+    pub system_program: Program<'info, System>,
+}
+
+pub fn handler(
+    ctx: Context<InitializeProtocolFeeConfig>,
+    protocol_fee_bps: u16,
+    protocol_fee_receiver: Pubkey,
+) -> Result<()> {
+    let config = &mut ctx.accounts.config;
+    require!(
+        !config.initialized,
+        EscrowError::ProtocolFeeConfigAlreadyInitialized
+    );
+    require!(protocol_fee_bps <= 10_000, EscrowError::FeeBpsOverflow);
+    config.initialized = true;
+    config.protocol_fee_bps = protocol_fee_bps;
+    config.protocol_fee_receiver = protocol_fee_receiver;
+    config.bump = ctx.bumps.config;
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/mod.rs b/programs/auth-capture-escrow/src/instructions/mod.rs
new file mode 100644
index 0000000..543c38e
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/mod.rs
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+pub mod authorize;
+pub mod capture;
+pub mod charge;
+pub mod initialize_protocol_fee_config;
+pub mod reclaim;
+pub mod refund;
+pub mod void;
+
+pub use authorize::*;
+pub use capture::*;
+pub use charge::*;
+pub use initialize_protocol_fee_config::*;
+pub use reclaim::*;
+pub use refund::*;
+pub use void::*;
diff --git a/programs/auth-capture-escrow/src/instructions/reclaim.rs b/programs/auth-capture-escrow/src/instructions/reclaim.rs
new file mode 100644
index 0000000..44714c0
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/reclaim.rs
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `reclaim` — payer recovers their authorized funds after the operator
+//! failed to capture before `authorization_expiry`. Direct intra-program
+//! transfer (vault → payer ATA), no collector indirection. Bypasses the
+//! operator entirely — the escape hatch must not be defeasible.
+
+use anchor_lang::prelude::*;
+use anchor_spl::token::{transfer, Mint, Token, TokenAccount, Transfer};
+
+use crate::errors::EscrowError;
+use crate::events::PaymentReclaimed;
+use crate::state::{PaymentInfo, PaymentState};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct Reclaim<'info> {
+    #[account(mut, address = payment_info.payer @ EscrowError::InvalidPayer)]
+    pub payer: Signer<'info>,
+    #[account(
+        mut,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump = payment_state.bump,
+        constraint = payment_state.has_collected_payment @ EscrowError::ZeroAuthorization,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = payment_state,
+    )]
+    pub vault: Account<'info, TokenAccount>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = payer,
+    )]
+    pub payer_ata: Account<'info, TokenAccount>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, Mint>,
+    pub token_program: Program<'info, Token>,
+}
+
+pub fn handler(ctx: Context<Reclaim>, payment_info: PaymentInfo) -> Result<()> {
+    let now = Clock::get()?.unix_timestamp;
+    require!(
+        now > payment_info.authorization_expiry,
+        EscrowError::ReclaimBeforeDeadline
+    );
+
+    let payment_info_hash = payment_info.hash()?;
+    require!(
+        ctx.accounts.payment_state.payment_info_hash == payment_info_hash,
+        EscrowError::PaymentInfoHashMismatch
+    );
+    let amount = ctx.accounts.payment_state.capturable_amount;
+    require!(amount > 0, EscrowError::ZeroAuthorization);
+
+    let seeds: &[&[u8]] = &[
+        PaymentState::SEED,
+        ctx.accounts.payment_state.payment_info_hash.as_ref(),
+        std::slice::from_ref(&ctx.accounts.payment_state.bump),
+    ];
+    let signer_seeds = &[seeds];
+    transfer(
+        CpiContext::new_with_signer(
+            ctx.accounts.token_program.to_account_info(),
+            Transfer {
+                from: ctx.accounts.vault.to_account_info(),
+                to: ctx.accounts.payer_ata.to_account_info(),
+                authority: ctx.accounts.payment_state.to_account_info(),
+            },
+            signer_seeds,
+        ),
+        amount,
+    )?;
+
+    ctx.accounts.payment_state.capturable_amount = 0;
+
+    emit!(PaymentReclaimed {
+        payment_info_hash,
+        amount,
+    });
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/refund.rs b/programs/auth-capture-escrow/src/instructions/refund.rs
new file mode 100644
index 0000000..ebca1ce
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/refund.rs
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `refund` — collector handles "external party → payer". For the pilot's
+//! `spl-token-collector`, "external party" is the operator's own treasury
+//! (an ATA the operator pre-funded). A future cross-chain or
+//! receiver-initiated refund collector would slot in here without escrow
+//! changes.
+//!
+//! Signer: operator (validated against `paymentInfo.operator`).
+
+use anchor_lang::prelude::*;
+use anchor_spl::token::{Mint, Token};
+
+use crate::collectors::{invoke_collector, COLLECT_REFUND_DISC};
+use crate::errors::EscrowError;
+use crate::events::PaymentRefunded;
+use crate::state::{PaymentInfo, PaymentState};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct Refund<'info> {
+    #[account(address = payment_info.operator @ EscrowError::InvalidSender)]
+    pub operator: Signer<'info>,
+    #[account(
+        mut,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump = payment_state.bump,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, Mint>,
+    /// CHECK: collector program.
+    pub token_collector: UncheckedAccount<'info>,
+    pub token_program: Program<'info, Token>,
+}
+
+pub fn handler(
+    ctx: Context<Refund>,
+    payment_info: PaymentInfo,
+    amount: u64,
+    collector_data: Vec<u8>,
+) -> Result<()> {
+    require!(amount > 0, EscrowError::ZeroAmount);
+    let now = Clock::get()?.unix_timestamp;
+    require!(
+        now <= payment_info.refund_expiry,
+        EscrowError::AfterRefundExpiry
+    );
+
+    let payment_info_hash = payment_info.hash()?;
+    require!(
+        ctx.accounts.payment_state.payment_info_hash == payment_info_hash,
+        EscrowError::PaymentInfoHashMismatch
+    );
+    require!(
+        ctx.accounts.payment_state.refundable_amount >= amount,
+        EscrowError::InsufficientRefundable
+    );
+
+    invoke_collector(
+        COLLECT_REFUND_DISC,
+        &ctx.accounts.token_collector.to_account_info(),
+        &payment_info_hash,
+        amount,
+        &collector_data,
+        ctx.remaining_accounts,
+    )?;
+
+    ctx.accounts.payment_state.refundable_amount = ctx
+        .accounts
+        .payment_state
+        .refundable_amount
+        .checked_sub(amount)
+        .ok_or(EscrowError::InsufficientRefundable)?;
+
+    emit!(PaymentRefunded {
+        payment_info_hash,
+        amount,
+    });
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/instructions/void.rs b/programs/auth-capture-escrow/src/instructions/void.rs
new file mode 100644
index 0000000..e7c9fe4
--- /dev/null
+++ b/programs/auth-capture-escrow/src/instructions/void.rs
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `void` — return the entire `capturable_amount` to the payer. Direct
+//! intra-program transfer (vault → payer ATA), no collector. Signer: operator.
+
+use anchor_lang::prelude::*;
+use anchor_spl::token::{transfer, Mint, Token, TokenAccount, Transfer};
+
+use crate::errors::EscrowError;
+use crate::events::PaymentVoided;
+use crate::state::{PaymentInfo, PaymentState};
+
+#[derive(Accounts)]
+#[instruction(payment_info: PaymentInfo)]
+pub struct VoidAuthorization<'info> {
+    #[account(address = payment_info.operator @ EscrowError::InvalidSender)]
+    pub operator: Signer<'info>,
+    #[account(
+        mut,
+        seeds = [PaymentState::SEED, &payment_info.hash()?],
+        bump = payment_state.bump,
+        constraint = payment_state.has_collected_payment @ EscrowError::ZeroAuthorization,
+    )]
+    pub payment_state: Account<'info, PaymentState>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = payment_state,
+    )]
+    pub vault: Account<'info, TokenAccount>,
+    #[account(
+        mut,
+        associated_token::mint = mint,
+        associated_token::authority = payer,
+    )]
+    pub payer_ata: Account<'info, TokenAccount>,
+    /// CHECK: must match payment_info.payer.
+    #[account(address = payment_info.payer @ EscrowError::InvalidPayer)]
+    pub payer: UncheckedAccount<'info>,
+    #[account(address = payment_info.mint @ EscrowError::MintMismatch)]
+    pub mint: Account<'info, Mint>,
+    pub token_program: Program<'info, Token>,
+}
+
+pub fn handler(ctx: Context<VoidAuthorization>, payment_info: PaymentInfo) -> Result<()> {
+    let payment_info_hash = payment_info.hash()?;
+    require!(
+        ctx.accounts.payment_state.payment_info_hash == payment_info_hash,
+        EscrowError::PaymentInfoHashMismatch
+    );
+    let amount = ctx.accounts.payment_state.capturable_amount;
+    require!(amount > 0, EscrowError::ZeroAuthorization);
+
+    let seeds: &[&[u8]] = &[
+        PaymentState::SEED,
+        ctx.accounts.payment_state.payment_info_hash.as_ref(),
+        std::slice::from_ref(&ctx.accounts.payment_state.bump),
+    ];
+    let signer_seeds = &[seeds];
+    transfer(
+        CpiContext::new_with_signer(
+            ctx.accounts.token_program.to_account_info(),
+            Transfer {
+                from: ctx.accounts.vault.to_account_info(),
+                to: ctx.accounts.payer_ata.to_account_info(),
+                authority: ctx.accounts.payment_state.to_account_info(),
+            },
+            signer_seeds,
+        ),
+        amount,
+    )?;
+
+    ctx.accounts.payment_state.capturable_amount = 0;
+
+    emit!(PaymentVoided {
+        payment_info_hash,
+        amount,
+    });
+    Ok(())
+}
diff --git a/programs/auth-capture-escrow/src/lib.rs b/programs/auth-capture-escrow/src/lib.rs
new file mode 100644
index 0000000..05bb0f2
--- /dev/null
+++ b/programs/auth-capture-escrow/src/lib.rs
@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! x402r authCapture escrow program (pilot, unaudited).
+//!
+//! Pure escrow primitive. Architectural shape mirrors `base/commerce-payments`
+//! `AuthCaptureEscrow`: the program holds funds, enforces expiries, validates
+//! splits, and gates state-mutating actions on `paymentInfo.operator`. It
+//! does NOT know about slot programs, condition/hook plugins, or operator
+//! policy — those live in a separate `payment-operator` program. New
+//! asset-transfer methods plug in as `ITokenCollector` programs (see
+//! `programs/spl-token-collector/`).
+//!
+//! Lifecycle:
+//!
+//! ```text
+//! authorize → capture → refund     (two-phase, default)
+//! authorize → void                 (two-phase, voided)
+//! charge    → refund               (single-shot)
+//! reclaim                          (payer escape hatch after capture deadline)
+//! ```
+//!
+//! Operator gating:
+//!   - `authorize` and `charge` require the operator to sign
+//!     (CPI'd from `payment-operator` signing as a per-merchant PDA).
+//!   - `capture`, `void`, `refund` require the operator to sign.
+//!   - `reclaim` requires the payer to sign (deadline-based escape hatch
+//!     must not be defeasible by the operator).
+//!
+//! Asset transfer:
+//!   - `authorize`, `charge`: CPI into `(token_collector, collector_data)`
+//!     so the collector handles "external party → escrow vault".
+//!   - `refund`: CPI into `(token_collector, collector_data)` so the collector
+//!     handles "external party (operator's treasury) → payer".
+//!   - `capture`, `void`, `reclaim`: direct intra-program SPL transfers from
+//!     the escrow vault — no collector indirection (the vault is the source).
+
+use anchor_lang::prelude::*;
+
+pub mod collectors;
+pub mod errors;
+pub mod events;
+pub mod instructions;
+pub mod splits;
+pub mod state;
+
+pub use collectors::*;
+pub use errors::*;
+pub use events::*;
+pub use instructions::*;
+pub use state::*;
+
+declare_id!("AcESCRow1111111111111111111111111111111111");
+
+/// Maximum number of `splits` entries on `charge` / `capture`. Pilot accepts
+/// up to 3: receiver + protocol fee + operator fee.
+pub const MAX_SPLITS: usize = 3;
+
+#[program]
+pub mod auth_capture_escrow {
+    use super::*;
+
+    /// One-shot initializer for the immutable `ProtocolFeeConfig`. Called once
+    /// at deploy time per cluster; cannot be re-invoked. Pilot does NOT support
+    /// the EVM-style 7-day timelocked swap.
+    pub fn initialize_protocol_fee_config(
+        ctx: Context<InitializeProtocolFeeConfig>,
+        protocol_fee_bps: u16,
+        protocol_fee_receiver: Pubkey,
+    ) -> Result<()> {
+        instructions::initialize_protocol_fee_config::handler(
+            ctx,
+            protocol_fee_bps,
+            protocol_fee_receiver,
+        )
+    }
+
+    /// Two-phase path: collect funds via the token collector and lock them
+    /// in the per-payment escrow vault. Signers required: operator (typically
+    /// CPI'd from `payment-operator` signing as the per-merchant PDA) AND
+    /// whatever signer the collector expects (typically the payer).
+    pub fn authorize(
+        ctx: Context<Authorize>,
+        payment_info: PaymentInfo,
+        amount: u64,
+        collector_data: Vec<u8>,
+    ) -> Result<()> {
+        instructions::authorize::handler(ctx, payment_info, amount, collector_data)
+    }
+
+    /// Single-shot path: collect funds and distribute per `splits` in one tx.
+    /// Same signer set as `authorize`, plus the operator co-authorizes splits.
+    pub fn charge(
+        ctx: Context<Charge>,
+        payment_info: PaymentInfo,
+        amount: u64,
+        splits: Vec<SplitEntry>,
+        collector_data: Vec<u8>,
+    ) -> Result<()> {
+        instructions::charge::handler(ctx, payment_info, amount, splits, collector_data)
+    }
+
+    /// Capture (settle) a previously authorized payment. Signer: operator.
+    pub fn capture(
+        ctx: Context<Capture>,
+        payment_info: PaymentInfo,
+        amount: u64,
+        splits: Vec<SplitEntry>,
+    ) -> Result<()> {
+        instructions::capture::handler(ctx, payment_info, amount, splits)
+    }
+
+    /// Void an authorization (return full capturable to payer). Signer: operator.
+    pub fn void(ctx: Context<VoidAuthorization>, payment_info: PaymentInfo) -> Result<()> {
+        instructions::void::handler(ctx, payment_info)
+    }
+
+    /// Refund a captured payment. The token collector handles "refunder ATA →
+    /// payer ATA" — for the pilot's `spl-token-collector`, the operator's
+    /// authority pre-funds the source ATA. Signer: operator.
+    pub fn refund(
+        ctx: Context<Refund>,
+        payment_info: PaymentInfo,
+        amount: u64,
+        collector_data: Vec<u8>,
+    ) -> Result<()> {
+        instructions::refund::handler(ctx, payment_info, amount, collector_data)
+    }
+
+    /// Payer reclaims an unspent authorization after the capture deadline.
+    /// Bypasses the operator entirely — the escape hatch must not be
+    /// defeasible by the operator. Signer: payer.
+    pub fn reclaim(ctx: Context<Reclaim>, payment_info: PaymentInfo) -> Result<()> {
+        instructions::reclaim::handler(ctx, payment_info)
+    }
+}
diff --git a/programs/auth-capture-escrow/src/splits.rs b/programs/auth-capture-escrow/src/splits.rs
new file mode 100644
index 0000000..11423c1
--- /dev/null
+++ b/programs/auth-capture-escrow/src/splits.rs
@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! Splits validation: enforce the additive `totalFee = protocolFee + operatorFee`
+//! model from EVM. The operator chooses the operator-fee bps within
+//! `[minFeeBps, maxFeeBps]`; the protocol-fee portion is always
+//! `floor(amount * protocolFeeBps / 10_000)` and goes to the immutable
+//! `protocol_fee_receiver`.
+//!
+//! Rules (also documented in the spec doc):
+//!   - `splits.len() <= MAX_SPLITS` (3)
+//!   - `sum(splits) == amount`
+//!   - exactly one entry to `payment_info.receiver`
+//!   - exactly one entry to `protocol_fee_receiver`, with amount =
+//!     `floor(amount * protocol_fee_bps / 10_000)`
+//!   - at most one entry to `payment_info.fee_receiver` (operator fee), with
+//!     `amount` such that `bps = amount * 10_000 / capture_amount` falls in
+//!     `[minFeeBps, maxFeeBps]`. Use `bps_from_amount` rounding-inclusive,
+//!     same as EVM.
+//!   - any other recipient is rejected.
+
+use anchor_lang::prelude::*;
+
+use crate::{errors::EscrowError, state::SplitEntry, MAX_SPLITS};
+
+/// Result of validating a `splits` vector. The values are recorded for
+/// event emission / debugging only.
+pub struct ValidatedSplits {
+    pub receiver_amount: u64,
+    pub protocol_fee_amount: u64,
+    pub operator_fee_amount: u64,
+}
+
+/// Validate splits. `amount` is the capture/charge amount (sum of all splits).
+pub fn validate_splits(
+    splits: &[SplitEntry],
+    amount: u64,
+    receiver: &Pubkey,
+    protocol_fee_bps: u16,
+    protocol_fee_receiver: &Pubkey,
+    operator_fee_receiver: &Pubkey,
+    min_fee_bps: u16,
+    max_fee_bps: u16,
+) -> Result<ValidatedSplits> {
+    require!(amount > 0, EscrowError::ZeroAmount);
+    require!(splits.len() <= MAX_SPLITS, EscrowError::SplitsTooMany);
+    require!(min_fee_bps <= max_fee_bps, EscrowError::InvalidFeeBpsRange);
+    require!(max_fee_bps <= 10_000, EscrowError::FeeBpsOverflow);
+    require!(protocol_fee_bps <= 10_000, EscrowError::FeeBpsOverflow);
+
+    // Use checked arithmetic everywhere — `overflow-checks = true` in release
+    // also catches it but explicit is better.
+    let expected_protocol_fee: u64 = ((amount as u128) * (protocol_fee_bps as u128) / 10_000u128)
+        .try_into()
+        .map_err(|_| error!(EscrowError::ExceedsMaxAmount))?;
+
+    let mut receiver_amount: Option<u64> = None;
+    let mut protocol_fee_amount: Option<u64> = None;
+    let mut operator_fee_amount: u64 = 0;
+    let mut sum: u64 = 0;
+
+    for entry in splits.iter() {
+        require!(entry.amount > 0, EscrowError::ZeroAmount);
+        sum = sum
+            .checked_add(entry.amount)
+            .ok_or(EscrowError::ExceedsMaxAmount)?;
+
+        if entry.recipient == *receiver {
+            require!(receiver_amount.is_none(), EscrowError::SplitsDisallowedRecipient);
+            receiver_amount = Some(entry.amount);
+        } else if entry.recipient == *protocol_fee_receiver {
+            require!(
+                protocol_fee_amount.is_none(),
+                EscrowError::SplitsDisallowedRecipient
+            );
+            protocol_fee_amount = Some(entry.amount);
+        } else if entry.recipient == *operator_fee_receiver {
+            // At most one operator-fee entry. `Some(0)` is impossible because
+            // entry.amount > 0 enforced above; a missing entry collapses to 0.
+            require!(operator_fee_amount == 0, EscrowError::SplitsDisallowedRecipient);
+            operator_fee_amount = entry.amount;
+        } else {
+            return err!(EscrowError::SplitsDisallowedRecipient);
+        }
+    }
+
+    require!(sum == amount, EscrowError::SplitsSumMismatch);
+    let receiver_amount = receiver_amount.ok_or(EscrowError::SplitsMissingReceiver)?;
+
+    // Protocol fee must always appear (even if bps == 0 the entry is required
+    // to be absent in that case — EVM enforces the same: empty config skips
+    // the receiver). Pilot rule: if protocol_fee_bps > 0, an entry MUST exist
+    // with the exact amount. If protocol_fee_bps == 0, NO entry to the
+    // protocol fee receiver is allowed.
+    let protocol_fee_amount = if protocol_fee_bps == 0 {
+        require!(
+            protocol_fee_amount.is_none(),
+            EscrowError::SplitsWrongProtocolFee
+        );
+        0u64
+    } else {
+        let actual = protocol_fee_amount.ok_or(EscrowError::SplitsMissingProtocolFee)?;
+        require!(
+            actual == expected_protocol_fee,
+            EscrowError::SplitsWrongProtocolFee
+        );
+        actual
+    };
+
+    // Operator fee bps must be within [min, max]. Compute round-down bps and
+    // require that `amount * 10_000 / capture_amount == bps_chosen`. Equivalent
+    // to "operator fee amount is exactly bps * capture_amount / 10_000" for
+    // some integer bps in the allowed range — which prevents the operator
+    // from claiming a non-integer-bps fee that would still pass the [min,max] check.
+    if operator_fee_amount > 0 {
+        // Reverse-derive bps from amount: bps = floor(opfee * 10_000 / amount)
+        let derived_bps_u128 = (operator_fee_amount as u128) * 10_000u128 / (amount as u128);
+        let derived_bps: u16 = derived_bps_u128
+            .try_into()
+            .map_err(|_| error!(EscrowError::FeeBpsOverflow))?;
+
+        // Equality check: opfee == bps * amount / 10_000. Round-trip detects
+        // operator trying to slip in a non-integer-bps amount.
+        let round_trip_amount: u64 = ((derived_bps as u128) * (amount as u128) / 10_000u128)
+            .try_into()
+            .map_err(|_| error!(EscrowError::ExceedsMaxAmount))?;
+        require!(
+            round_trip_amount == operator_fee_amount,
+            EscrowError::FeeBpsOutOfRange
+        );
+
+        require!(
+            derived_bps >= min_fee_bps && derived_bps <= max_fee_bps,
+            EscrowError::FeeBpsOutOfRange
+        );
+    } else {
+        // operator_fee_amount == 0 is allowed only if min_fee_bps == 0.
+        require!(min_fee_bps == 0, EscrowError::FeeBpsOutOfRange);
+    }
+
+    Ok(ValidatedSplits {
+        receiver_amount,
+        protocol_fee_amount,
+        operator_fee_amount,
+    })
+}
diff --git a/programs/auth-capture-escrow/src/state.rs b/programs/auth-capture-escrow/src/state.rs
new file mode 100644
index 0000000..6e6e24a
--- /dev/null
+++ b/programs/auth-capture-escrow/src/state.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! On-chain state and `PaymentInfo` definition.
+//!
+//! `PaymentInfo` is the canonical wire-format struct the SDK encodes via Borsh
+//! to derive `payment_info_hash` (sha256 of canonical Borsh bytes). The hash
+//! is the seed for the per-payment PDA and the binding between client signature,
+//! authorization, and every subsequent operator action.
+
+use anchor_lang::prelude::*;
+use sha2::{Digest, Sha256};
+
+/// Canonical `PaymentInfo` for the escrow primitive. Field names mirror the
+/// `base/commerce-payments` Solidity struct; the escrow is intentionally
+/// scheme-agnostic. Spec-level renames (`captureAuthorizer` ↔ `operator`,
+/// `captureDeadline` ↔ `authorizationExpiry`, `refundDeadline` ↔
+/// `refundExpiry`) live at the SDK/extra layer.
+///
+/// Slot dispatch (condition/hook plugins) is NOT in `PaymentInfo`. That's
+/// the operator program's concern — `paymentInfo.operator` is a
+/// `payment-operator` per-merchant `OperatorState` PDA, and that PDA's
+/// account holds the slot config.
+///
+/// Field order, types, and sizes are part of the wire format and affect
+/// the canonical hash; do not reorder.
+#[derive(AnchorSerialize, AnchorDeserialize, Clone, PartialEq, Eq, Debug)]
+pub struct PaymentInfo {
+    /// Single signer permitted to call `capture`/`void`/`refund`/`charge`.
+    /// Typically the per-merchant `OperatorState` PDA from the
+    /// `payment-operator` factory; may also be a wallet for ad-hoc use.
+    pub operator: Pubkey,
+    /// Funder of the authorization.
+    pub payer: Pubkey,
+    /// Final recipient of `payTo` portion of `splits`.
+    pub receiver: Pubkey,
+    /// SPL token mint. Pilot supports SPL Token only (Token-2022 deferred).
+    pub mint: Pubkey,
+    /// Maximum amount that can be authorized — capture amount must be ≤ this.
+    pub max_amount: u64,
+    /// Tx must include `authorize`/`charge` before this.
+    pub pre_approval_expiry: i64,
+    /// `capture`/`charge` must occur before this.
+    pub authorization_expiry: i64,
+    /// Refunds allowed until this.
+    pub refund_expiry: i64,
+    /// Floor on operator-fee bps the operator may select on capture.
+    pub min_fee_bps: u16,
+    /// Cap on operator-fee bps.
+    pub max_fee_bps: u16,
+    /// Operator-fee recipient. Independent of the immutable protocol-fee
+    /// receiver in `ProtocolFeeConfig`.
+    pub fee_receiver: Pubkey,
+    /// 32-byte client-supplied salt for uniqueness. EVM uses uint256 — we
+    /// accept the raw bytes here and document the cross-SDK invariant in
+    /// `scheme_authCapture_svm.md`.
+    pub salt: [u8; 32],
+}
+
+impl PaymentInfo {
+    /// Compute the canonical `payment_info_hash` used as the PDA seed and
+    /// the cross-SDK binding. SHA-256 of the Borsh-serialized struct.
+    pub fn hash(&self) -> Result<[u8; 32]> {
+        let bytes = self.try_to_vec()?;
+        let mut hasher = Sha256::new();
+        hasher.update(&bytes);
+        Ok(hasher.finalize().into())
+    }
+}
+
+/// Per-payment state PDA. Mirrors EVM `PaymentState`.
+#[account]
+#[derive(Default)]
+pub struct PaymentState {
+    pub has_collected_payment: bool,
+    pub capturable_amount: u64,
+    pub refundable_amount: u64,
+    pub payment_info_hash: [u8; 32],
+    pub bump: u8,
+}
+
+impl PaymentState {
+    pub const SEED: &'static [u8] = b"payment";
+    /// Discriminator (8) + bool + u64 + u64 + [u8;32] + u8.
+    pub const LEN: usize = 8 + 1 + 8 + 8 + 32 + 1;
+}
+
+/// Immutable protocol-fee config. Initialized once at deploy time; cannot be
+/// changed thereafter.
+#[account]
+#[derive(Default)]
+pub struct ProtocolFeeConfig {
+    pub initialized: bool,
+    pub protocol_fee_bps: u16,
+    pub protocol_fee_receiver: Pubkey,
+    pub bump: u8,
+}
+
+impl ProtocolFeeConfig {
+    pub const SEED: &'static [u8] = b"protocol-fee-config";
+    /// Discriminator (8) + bool + u16 + Pubkey + u8.
+    pub const LEN: usize = 8 + 1 + 2 + 32 + 1;
+}
+
+/// One entry in the splits vector — a recipient and the token amount they get.
+#[derive(AnchorSerialize, AnchorDeserialize, Clone, PartialEq, Eq, Debug)]
+pub struct SplitEntry {
+    pub recipient: Pubkey,
+    pub amount: u64,
+}
diff --git a/programs/spl-token-collector/Cargo.toml b/programs/spl-token-collector/Cargo.toml
new file mode 100644
index 0000000..23f6737
--- /dev/null
+++ b/programs/spl-token-collector/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "spl-token-collector"
+version = "0.2.0"
+description = "ITokenCollector implementation for SPL Token (the pilot's only collector)"
+license = "BUSL-1.1"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib", "lib"]
+name = "spl_token_collector"
+
+[features]
+default = []
+no-entrypoint = []
+no-idl = []
+no-log-ix-name = []
+cpi = ["no-entrypoint"]
+idl-build = ["anchor-lang/idl-build", "anchor-spl/idl-build"]
+
+[dependencies]
+anchor-lang = "0.31.1"
+anchor-spl = "0.31.1"
+solana-program = "~2.1"
diff --git a/programs/spl-token-collector/src/lib.rs b/programs/spl-token-collector/src/lib.rs
new file mode 100644
index 0000000..9403f2e
--- /dev/null
+++ b/programs/spl-token-collector/src/lib.rs
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: BUSL-1.1
+// CONTRACTS UNAUDITED: USE AT YOUR OWN RISK
+//! `spl-token-collector` — `ITokenCollector` implementation for SPL Token.
+//!
+//! Two instructions, both invoked via CPI from `auth-capture-escrow`:
+//!
+//!   - `collect_authorize(payment_info_hash, amount, _data)`
+//!     SPL transfer payer ATA → vault ATA. Authority: payer (signer of the
+//!     outer tx; signer status propagates through CPI).
+//!
+//!   - `collect_refund(payment_info_hash, amount, _data)`
+//!     SPL transfer source ATA → payer ATA. Authority: source ATA's authority
+//!     (typically the operator's treasury, signed via `invoke_signed` from
+//!     `payment-operator`).
+//!
+//! `collector_data` is unused for the pilot — kept on the wire so future
+//! collectors that need extra parameters (Token-2022 transfer hooks,
+//! pre-signed authorization receipts, bridge attestations) can use it
+//! without breaking the escrow's CPI shape.
+//!
+//! This is the reference impl. Future Token-2022 / cross-chain collectors
+//! can fork this file as a starting point.
+
+use anchor_lang::prelude::*;
+use anchor_spl::token::{transfer, Mint, Token, TokenAccount, Transfer};
+
+declare_id!("SPLCo11ector1111111111111111111111111111111");
+
+#[program]
+pub mod spl_token_collector {
+    use super::*;
+
+    /// Collect funds from payer into vault. Called by escrow on
+    /// `authorize` / `charge`.
+    ///
+    /// `_payment_info_hash` is provided by the escrow so collectors that
+    /// want to enforce per-payment policies (rate limits, allowlists) can
+    /// inspect it. The pilot's SPL collector ignores it.
+    pub fn collect_authorize(
+        ctx: Context<CollectAuthorize>,
+        _payment_info_hash: [u8; 32],
+        amount: u64,
+        _data: Vec<u8>,
+    ) -> Result<()> {
+        require!(amount > 0, CollectorError::ZeroAmount);
+        transfer(
+            CpiContext::new(
+                ctx.accounts.token_program.to_account_info(),
+                Transfer {
+                    from: ctx.accounts.source_ata.to_account_info(),
+                    to: ctx.accounts.dest_ata.to_account_info(),
+                    authority: ctx.accounts.authority.to_account_info(),
+                },
+            ),
+            amount,
+        )?;
+        Ok(())
+    }
+
+    /// Refund funds from source (operator treasury) to payer ATA. Called by
+    /// escrow on `refund`.
+    pub fn collect_refund(
+        ctx: Context<CollectRefund>,
+        _payment_info_hash: [u8; 32],
+        amount: u64,
+        _data: Vec<u8>,
+    ) -> Result<()> {
+        require!(amount > 0, CollectorError::ZeroAmount);
+        transfer(
+            CpiContext::new(
+                ctx.accounts.token_program.to_account_info(),
+                Transfer {
+                    from: ctx.accounts.source_ata.to_account_info(),
+                    to: ctx.accounts.dest_ata.to_account_info(),
+                    authority: ctx.accounts.authority.to_account_info(),
+                },
+            ),
+            amount,
+        )?;
+        Ok(())
+    }
+}
+
+/// `collect_authorize` accounts. Called via CPI from escrow; the escrow
+/// passes its `remaining_accounts` straight through, so the layout here
+/// determines what the escrow's caller must include.
+#[derive(Accounts)]
+pub struct CollectAuthorize<'info> {
+    /// Payer's ATA (source).
+    #[account(mut)]
+    pub source_ata: Account<'info, TokenAccount>,
+    /// Vault ATA (destination, owned by escrow's payment_state PDA).
+    #[account(mut)]
+    pub dest_ata: Account<'info, TokenAccount>,
+    /// Source authority — for SPL: the payer themselves.
+    pub authority: Signer<'info>,
+    pub mint: Account<'info, Mint>,
+    pub token_program: Program<'info, Token>,
+}
+
+/// `collect_refund` accounts. The source authority is whoever owns the
+/// refund treasury — typically the `payment-operator`'s per-merchant
+/// `OperatorState` PDA, signed via `invoke_signed`.
+#[derive(Accounts)]
+pub struct CollectRefund<'info> {
+    /// Treasury ATA (source, typically operator's PDA-owned ATA).
+    #[account(mut)]
+    pub source_ata: Account<'info, TokenAccount>,
+    /// Payer ATA (destination).
+    #[account(mut)]
+    pub dest_ata: Account<'info, TokenAccount>,
+    /// Source authority. May be a wallet or a PDA passed via `invoke_signed`.
+    /// CHECK: signer status validated by the SPL transfer CPI itself.
+    pub authority: AccountInfo<'info>,
+    pub mint: Account<'info, Mint>,
+    pub token_program: Program<'info, Token>,
+}
+
+#[error_code]
+pub enum CollectorError {
+    #[msg("zero amount")]
+    ZeroAmount,
+}
diff --git a/tests/auth-capture-escrow.test.ts b/tests/auth-capture-escrow.test.ts
new file mode 100644
index 0000000..20e9458
--- /dev/null
+++ b/tests/auth-capture-escrow.test.ts
@@ -0,0 +1,102 @@
+/**
+ * Integration tests for `auth-capture-escrow`. Runs against the local
+ * validator started by `anchor test`.
+ *
+ * IMPORTANT: tests consume the **Codama-generated Kit client**. Generate it
+ * with `pnpm codama:generate` after `anchor build` so the IDL is up to date.
+ * Replace the `// @ts-expect-error` stubs below with the real generated
+ * imports once the client lives at `../codama/generated/`.
+ */
+import { describe, it, expect, beforeAll } from "vitest";
+import { setupEnv, type TestEnv } from "./utils/setup";
+
+describe("auth-capture-escrow", () => {
+  let env: TestEnv;
+
+  beforeAll(async () => {
+    env = await setupEnv();
+  });
+
+  // ---------------------------------------------------------------- happy paths
+
+  it("authorize -> capture -> refund", async () => {
+    // 1. authorize amount = 1_000_000 (1 USDC)
+    // 2. capture amount = 1_000_000 with splits [{receiver: 990_000}, {protocolFee: 1_000}, {operatorFee: 9_000}]
+    //    given protocolFeeBps=10, minFeeBps=0, maxFeeBps=100, operator picks 90 bps
+    // 3. assert receiver_ata, protocol_fee_receiver_ata, operator_fee_receiver_ata balances
+    // 4. refund 200_000
+    // 5. assert payer_ata up by 200_000, operator_ata down by 200_000
+    expect(env.payer).toBeDefined();
+    expect.fail("TODO: wire Codama client and finish implementation");
+  });
+
+  it("authorize -> void", async () => {
+    expect.fail("TODO");
+  });
+
+  it("charge (single-shot) -> refund", async () => {
+    expect.fail("TODO");
+  });
+
+  // ---------------------------------------------------------------- splits failures
+
+  it("rejects splits that don't sum to amount", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects missing protocol fee entry when protocolFeeBps > 0", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects wrong protocol fee amount", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects operator fee above maxFeeBps", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects operator fee below minFeeBps when minFeeBps > 0", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects splits with disallowed recipient", async () => {
+    expect.fail("TODO");
+  });
+
+  // ---------------------------------------------------------------- timing failures
+
+  it("rejects authorize after preApprovalExpiry", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects double-authorize", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects capture after authorizationExpiry", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects refund after refundExpiry", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects reclaim before authorizationExpiry", async () => {
+    expect.fail("TODO");
+  });
+
+  it("allows reclaim after authorizationExpiry", async () => {
+    expect.fail("TODO");
+  });
+
+  // ---------------------------------------------------------------- auth failures
+
+  it("rejects capture from non-operator signer", async () => {
+    expect.fail("TODO");
+  });
+
+  it("rejects authorize when payer != payment_info.payer", async () => {
+    expect.fail("TODO");
+  });
+});
diff --git a/tests/package.json b/tests/package.json
new file mode 100644
index 0000000..3f11386
--- /dev/null
+++ b/tests/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "x402r-contracts-svm-tests",
+  "private": true,
+  "version": "0.2.0",
+  "scripts": {
+    "test": "vitest run --config vitest.config.ts"
+  },
+  "dependencies": {
+    "@solana/kit": "^5.1.0",
+    "@solana-program/compute-budget": "^0.11.0",
+    "@solana-program/system": "^0.7.0",
+    "@solana-program/token": "^0.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "vitest": "^4.0.18"
+  }
+}
diff --git a/tests/utils/setup.ts b/tests/utils/setup.ts
new file mode 100644
index 0000000..545a9b3
--- /dev/null
+++ b/tests/utils/setup.ts
@@ -0,0 +1,162 @@
+/**
+ * Test fixture helpers. Spins up actors against the local validator started
+ * by `anchor test`, mints USDC-equivalent SPL tokens, and exposes the
+ * Codama-generated Kit client (regenerated by `pnpm codama:generate`).
+ */
+import {
+  airdropFactory,
+  appendTransactionMessageInstructions,
+  createSolanaRpc,
+  createSolanaRpcSubscriptions,
+  createTransactionMessage,
+  generateKeyPairSigner,
+  lamports,
+  pipe,
+  sendAndConfirmTransactionFactory,
+  setTransactionMessageFeePayerSigner,
+  setTransactionMessageLifetimeUsingBlockhash,
+  signTransactionMessageWithSigners,
+  type KeyPairSigner,
+  type Rpc,
+  type RpcSubscriptions,
+  type SolanaRpcApi,
+  type SolanaRpcSubscriptionsApi,
+} from "@solana/kit";
+import {
+  getCreateAssociatedTokenIdempotentInstruction,
+  getInitializeMintInstruction,
+  getMintToInstruction,
+  TOKEN_PROGRAM_ADDRESS,
+} from "@solana-program/token";
+import { getCreateAccountInstruction, SYSTEM_PROGRAM_ADDRESS } from "@solana-program/system";
+
+export const RPC_URL = "http://127.0.0.1:8899";
+export const RPC_WS_URL = "ws://127.0.0.1:8900";
+
+export type TestEnv = {
+  rpc: Rpc<SolanaRpcApi>;
+  rpcSubs: RpcSubscriptions<SolanaRpcSubscriptionsApi>;
+  payer: KeyPairSigner;
+  operator: KeyPairSigner;
+  receiver: KeyPairSigner;
+  mintAuthority: KeyPairSigner;
+  mint: KeyPairSigner;
+  protocolFeeReceiver: KeyPairSigner;
+  feePayer: KeyPairSigner;
+};
+
+export async function setupEnv(): Promise<TestEnv> {
+  const rpc = createSolanaRpc(RPC_URL);
+  const rpcSubs = createSolanaRpcSubscriptions(RPC_WS_URL);
+  const airdrop = airdropFactory({ rpc, rpcSubscriptions: rpcSubs });
+  const sendAndConfirm = sendAndConfirmTransactionFactory({ rpc, rpcSubscriptions: rpcSubs });
+
+  const [payer, operator, receiver, mintAuthority, mint, protocolFeeReceiver, feePayer] =
+    await Promise.all(Array.from({ length: 7 }, () => generateKeyPairSigner()));
+
+  await Promise.all(
+    [payer, operator, receiver, mintAuthority, protocolFeeReceiver, feePayer].map(s =>
+      airdrop({
+        recipientAddress: s.address,
+        lamports: lamports(2_000_000_000n),
+        commitment: "confirmed",
+      }),
+    ),
+  );
+
+  // Create + initialize mint.
+  const rentLamports = await rpc.getMinimumBalanceForRentExemption(82n).send();
+  const { value: latestBlockhash } = await rpc.getLatestBlockhash().send();
+  const message = pipe(
+    createTransactionMessage({ version: 0 }),
+    tx => setTransactionMessageFeePayerSigner(feePayer, tx),
+    tx => setTransactionMessageLifetimeUsingBlockhash(latestBlockhash, tx),
+    tx =>
+      appendTransactionMessageInstructions(
+        [
+          getCreateAccountInstruction({
+            payer: feePayer,
+            newAccount: mint,
+            lamports: rentLamports,
+            space: 82n,
+            programAddress: TOKEN_PROGRAM_ADDRESS,
+          }),
+          getInitializeMintInstruction({
+            mint: mint.address,
+            decimals: 6,
+            mintAuthority: mintAuthority.address,
+            freezeAuthority: null,
+          }),
+        ],
+        tx,
+      ),
+  );
+  const signed = await signTransactionMessageWithSigners(message);
+  await sendAndConfirm(signed, { commitment: "confirmed" });
+
+  // Mint test funds to payer + operator (operator funds refunds).
+  await mintTo(rpc, rpcSubs, feePayer, mintAuthority, mint.address, payer.address, 1_000_000_000n);
+  await mintTo(rpc, rpcSubs, feePayer, mintAuthority, mint.address, operator.address, 100_000_000n);
+
+  return {
+    rpc,
+    rpcSubs,
+    payer,
+    operator,
+    receiver,
+    mintAuthority,
+    mint,
+    protocolFeeReceiver,
+    feePayer,
+  };
+}
+
+async function mintTo(
+  rpc: Rpc<SolanaRpcApi>,
+  rpcSubs: RpcSubscriptions<SolanaRpcSubscriptionsApi>,
+  feePayer: KeyPairSigner,
+  mintAuthority: KeyPairSigner,
+  mint: string,
+  owner: string,
+  amount: bigint,
+) {
+  const sendAndConfirm = sendAndConfirmTransactionFactory({ rpc, rpcSubscriptions: rpcSubs });
+  const { value: latestBlockhash } = await rpc.getLatestBlockhash().send();
+  // Codama-generated client gives us the right ATA derivation; for this
+  // scaffold we lean on the spl-token program's idempotent create + mintTo.
+  const message = pipe(
+    createTransactionMessage({ version: 0 }),
+    tx => setTransactionMessageFeePayerSigner(feePayer, tx),
+    tx => setTransactionMessageLifetimeUsingBlockhash(latestBlockhash, tx),
+    tx =>
+      appendTransactionMessageInstructions(
+        [
+          getCreateAssociatedTokenIdempotentInstruction({
+            payer: feePayer,
+            ata: getAssociatedTokenAddress(mint, owner),
+            owner,
+            mint,
+            tokenProgram: TOKEN_PROGRAM_ADDRESS,
+            systemProgram: SYSTEM_PROGRAM_ADDRESS,
+          } as never),
+          getMintToInstruction({
+            mint,
+            token: getAssociatedTokenAddress(mint, owner),
+            mintAuthority,
+            amount,
+          } as never),
+        ],
+        tx,
+      ),
+  );
+  const signed = await signTransactionMessageWithSigners(message);
+  await sendAndConfirm(signed, { commitment: "confirmed" });
+}
+
+export function getAssociatedTokenAddress(_mint: string, _owner: string): string {
+  // Filled in via the Codama-generated `findAssociatedTokenPda` once the
+  // client exists. Placeholder so this scaffold compiles standalone.
+  throw new Error(
+    "stub: regenerate Codama clients (`pnpm codama:generate`) and replace with findAssociatedTokenPda",
+  );
+}
diff --git a/tests/vitest.config.ts b/tests/vitest.config.ts
new file mode 100644
index 0000000..ebd6ed5
--- /dev/null
+++ b/tests/vitest.config.ts
@@ -0,0 +1,15 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    testTimeout: 60_000,
+    hookTimeout: 60_000,
+    include: ["./**/*.test.ts"],
+    pool: "threads",
+    poolOptions: {
+      threads: {
+        singleThread: true,
+      },
+    },
+  },
+});