Admin is the initial authority: the only address that may write slots and accept, roll back or freeze a theme. It is a constant so a reviewer can read who controls the page without decoding chain state; TransferAuthority moves it afterwards.

The value here is the standard test1 account, so the gnodev walkthrough in the README works unedited. `make build ADMIN=g1...` rewrites it for a real deployment.

Accept makes the candidate at pkgPath the live theme. Authority only.

Append adds to the end of a slot, creating it when absent. It exists for a body too large for one transaction: Set the first chunk, Append the rest.

Authority returns a human-readable description of who may write and upgrade.

Delete removes a slot. Deleting the layout slot restores the theme's default layout.

Each visits every slot in name order until fn returns true.

Fallback is the built-in renderer. Render routes the operator views here directly, and themes delegate to it for every other path they do not draw themselves, so these views exist under any theme:

1""             the assembled page: the layout slot filled from the slots
2"slots"        the slot index: name, size, revision, height of last write
3"slots/<slug>" one slot's raw markdown, fenced
4"edit"         forms that write slots (they build the gnokey command)
5"edit/<slug>"  the same, prefilled with one slot
6"system"       who may write, which theme is live, pending, history
7"manifest"     Manifest() as plain text, for scripts

Forget drops the rollback history and the storage it holds. Authority only.

Freeze ends theme upgrades permanently. Slots stay editable. Authority only, and there is no way back.

Frozen reports whether theme upgrades have ended.

Get returns a slot body, or "" when the slot does not exist.

Has reports whether a slot exists, empty or not.

HistoryPaths returns the themes this realm has already served, oldest first, excluding the live one.

LastHeight returns the block height of the most recent write, or 0.

Layout returns the layout slot, or "" when none has been set. Themes substitute their own default in that case.

Link returns the gnoweb path of a render path on this realm: Link("") is "/r/g1lnkytfqcjwllws63gvf0mv9yt04aswy4y9amhm/home", Link("slots") is "/r/g1lnkytfqcjwllws63gvf0mv9yt04aswy4y9amhm/home:slots".

LivePath returns the realm path of the theme currently serving, or "".

Manifest returns one tab-separated line per slot:

1<slug>\t<rev>\t<bytes>\t<sha256 of body, hex>

It is the diff surface scripts/sync.sh reads: one query tells it exactly which local file is out of date, without downloading any body.

Path returns this realm's package path, e.g. "gno.land/r/g1lnkytfqcjwllws63gvf0mv9yt04aswy4y9amhm/home".

PendingPaths returns the candidate theme paths awaiting acceptance.

Register records the calling realm's theme as a candidate. The path filed is read off the crossing frame, never taken as an argument, so a candidate cannot claim to live somewhere it does not. Only realms nested under this one are admitted; a direct user call is refused.

Render is what gnoweb calls.

The operator views (system, slots, edit, manifest) are always served here, never through the theme: a panic inside a foreign realm's code aborts the whole call and cannot be recovered from this side, so a theme that panics takes the page down until it is rolled back. These views are what the rollback is done from, and the routing keeps them out of the theme's reach. Every other path, the page itself included, goes to the live theme, or to the built-in renderer when none is accepted.

Revision returns the total number of writes this realm has accepted. It changes on every mutation, so a client can cheaply tell "nothing moved".

Rollback restores the previous theme and returns the current one to the pending set. Authority only.

Set creates or replaces the slot named slug. This is the ordinary update: one slot, one transaction. An empty body keeps the slot but empties it; use Delete to remove it.

Slugs returns every slot name, sorted.

Style returns the style knob named key (the slot "style."+key), or fallback when it is absent or empty.

TransferAuthority hands both editing and upgrading to another address.

Withdraw drops a candidate. Authority only, except that a theme realm may always drop its own.

NewFiller returns a Filler with every slot and every computed placeholder registered. A theme adds its own widgets with Add before calling Fill.

Lookup returns a copy of a slot and whether it exists.

Filler substitutes :name: placeholders in a layout. It is lazy: a callback runs only when its placeholder occurs in the layout, so an unused slot is never even read. Substitution is single-pass and non-recursive, so a placeholder inside a slot body is left alone and no slot can expand into another. Names never contain ':', so no placeholder is a prefix of another and the result does not depend on registration order. A placeholder that nothing claims survives into the output verbatim: a missing section should be visible, not silently blank.

Slot is one named fragment of the page.

Theme is what a renderer realm promises. It is declared here, in the file that can never change, so every theme version agrees on one type identity.

Render receives the render path ("" is the profile page) and returns markdown. The operator views (system, slots, edit, manifest) never reach a theme; for any other path it does not draw itself, a theme should return Fallback(path). A panic here aborts the query: there is no recovering a foreign realm's panic, so a broken theme shows an error until Rollback.