escrow_v4 state

laneService

laneService is this engine's lane key into the DAO fee spine (memba\_market\_config), seeded there at 200 bps.

PlatformFeePct

CancelFeePct

AutoRefundBlks

AutoResolveBlks

UnfundedExpiryBlks

MaxTitleLen

// bytes, after sanitising (also bounds the input)

MaxDescLen

// bytes, after sanitising (also bounds the input)

MaxMilestones

MinMilestoneAmount

// 0.001 GNOT: below ~50 ugnot a 2% fee truncates to 0

maxMilestonesArgLen

MaxActivePerClient

ContractStatus

StatusActive

StatusCompleted

StatusDisputed

StatusCancelled

MilestoneStatus

MsPending

MsFunded

MsCompleted

MsReleased

MsDisputed

MsRefunded

Contract

Milestone

contracts

// id -> \*Contract; live (not archived) contracts only

clientSlots

// client address -> int open contracts (removed on archive once 0); "c/\<client>/\<id>" -> nil client index

nextID

// monotonic, never reused

activeCount

// open contracts

archivedCount

totalLiable

// NF-2: ugnot owed to funded, completed and disputed milestones

init.32

resolveFee

callerOf

CreateContract

CreateContract creates a new escrow contract with milestones, as the caller's client. Milestones format: "title1:amount1,title2:amount2". The caller must be a user (a direct call or the user's own run script), so a realm cannot mint client identities with cur.Sub to hold slots.

FundMilestone

FundMilestone deposits exactly the milestone amount. Client only, and only as a direct user call: the tx-level send lands on the message's target realm, so from an intermediary realm the coins would never reach escrow while the milestone was marked funded.

CompleteMilestone

CompleteMilestone marks a funded milestone delivered. Freelancer only.

ReleaseFunds

ReleaseFunds pays a completed milestone to the freelancer, minus the fee. Client, or admin as the trusted arbiter (v3 behaviour).

RaiseDispute

RaiseDispute escalates a funded or completed milestone to the admin. Client or freelancer.

ResolveDispute

ResolveDispute settles a disputed milestone. Admin only. refundClient=true refunds the client in full; false pays the freelancer minus the fee. The contract then returns to active, stays disputed if another milestone still is, or settles: completed if every milestone is released, cancelled if every milestone is released or refunded.

CancelContract

CancelContract cancels an active contract. Client only. Funded milestones are refunded minus CancelFeePct, which goes to the freelancer; completed milestones are paid to the freelancer minus the service fee.

ExpireUnfunded

ExpireUnfunded cancels a contract none of whose milestones was ever funded, once UnfundedExpiryBlks have passed since creation (blocking-window blocks excluded). Anyone may call. It frees the client's slot and moves no coins; it does not delete, so the storage deposit stays for the client's ArchiveContract.

ClaimRefund

ClaimRefund refunds a funded milestone nobody completed within AutoRefundBlks (blocking-window blocks excluded). Anyone may call; the client receives the funds. If no milestone then holds funds the contract is cancelled, pending milestones included (v3 behaviour).

ClaimDisputeTimeout

ClaimDisputeTimeout resolves a dispute the admin has not acted on within AutoResolveBlks (blocking-window blocks excluded), following the pre-dispute status: a delivered milestone (MsCompleted) pays the freelancer minus the fee, an undelivered one (MsFunded) refunds the client. Anyone may call.

ArchiveContract

ArchiveContract deletes a settled contract (completed or cancelled, with nothing escrowed). Client only. The freed bytes shrink the realm's storage, and the chain refunds their storage deposit to the signer of this message (see DESIGN.md), so the client, who paid for the contract when creating it, gets that deposit back. The id is never reused. The ContractArchived event is the permanent record; nothing of the contract stays in realm state.

isOpen

isOpen reports whether c still holds an active slot.

clientActive

takeSlot

settle

settle moves an open contract to a terminal status and releases its slot. Terminal statuses are absorbing, so this runs at most once per contract.

settleIfFinished

settleIfFinished settles an open contract whose milestones are all released (completed) or all released or refunded (cancelled). A pending, funded, completed or disputed milestone keeps it open.

payout

send

payFreelancer

payFreelancer pays amount to the freelancer minus the service fee read live from the fee spine, which goes to the treasury.

getContract

milestoneAt

allMilestonesReleased

anyMilestoneDisputed

allMilestonesTerminal

allMilestonesTerminal reports whether no milestone holds funds (pending with no funds counts as terminal).

parseMilestones

parseMilestones parses "title1:amount1,title2:amount2". Blank entries are skipped; any other malformed entry panics.

MaxPauseBlks

PauseCooldownBlks

paused

pausedAt

// height of the current pause; 0 when not paused

pauseCooldownUntil

// first height at which Pause is accepted again

pausedBlocksDone

// blocking-window blocks of finished pauses

PauseInfo

PauseInfo is the read-back of the pause state.

PauseState

PauseState returns the pause state at the current height.

IsPaused

IsPaused reports whether the pause flag is set. Exits may already have reopened: see PauseState().ExitsOpen.

Pause

Pause stops new money and, for MaxPauseBlks, every other state change. Admin only. Refused while paused and during the cooldown after an Unpause.

Unpause

Unpause resumes normal operation and starts the cooldown. Admin only.

inBlockingWindow

inBlockingWindow reports whether now falls in the first MaxPauseBlks blocks of the current pause.

pausedBlocksAt

pausedBlocksAt returns the blocking-window blocks up to now, finished pauses included. Timeout clocks subtract the growth of this value.

assertAcceptsNewMoney

assertAcceptsNewMoney guards CreateContract and FundMilestone.

assertOpen

assertOpen guards every other state-changing user and admin entrypoint.

elapsedOpen

elapsedOpen returns the blocks since \`since\` that fell outside any blocking window, given pausedBlocksAt(since) recorded as mark.

admin

pendingAdmin

feeRecipient

pendingFeeRecipient

assertAdmin

assertAdmin rejects a stale or sibling \`cur\`, then checks the caller.

TransferOwnership

TransferOwnership stages a handoff to newAdmin. Admin only. Calling it again replaces the staged address.

AcceptOwnership

AcceptOwnership completes the handoff. Only the staged address may call it, so the outgoing admin cannot collapse the two steps into one.

CancelOwnershipTransfer

CancelOwnershipTransfer clears a staged handoff. Admin only.

GetAdmin

GetAdmin returns the address that holds admin.

GetPendingAdmin

GetPendingAdmin returns the staged successor ("" when none).

ProposeFeeRecipient

ProposeFeeRecipient stages a new fallback fee recipient. Admin only.

AcceptFeeRecipient

AcceptFeeRecipient completes the rotation. Only the staged address may call it, which proves it can transact.

CancelFeeRecipientProposal

CancelFeeRecipientProposal clears a staged fee recipient. Admin only.

GetFeeRecipient

GetFeeRecipient returns the fallback fee recipient.

GetPendingFeeRecipient

GetPendingFeeRecipient returns the staged fee recipient ("" when none).

basisPointsFee

basisPointsFee computes floor(amount\*bps/10000) without overflowing the intermediate product. For nonnegative amount and bps \<= 10000, the quotient product and final sum are \<= amount; the remainder product is \< 100000000. Callers retain their existing configured rates, recipients and rounding.

cleanText

cleanText validates and sanitises user text before it is stored and rendered. It refuses input longer than max bytes, input that is not valid UTF-8 (the sanitiser would otherwise turn each bad byte into a 3-byte U+FFFD, storing up to three times the limit), and control or format characters (\\p{Cc}, \\p{Cf}: bidi overrides, zero-width characters), which could hide or reorder text. It then strips markdown-sensitive characters and line breaks and tabs, as v3 did. Stripping only removes bytes, so the result is within max; that is checked again because storage is bounded by it.

isStripped

isStripped reports the markdown-sensitive characters and line breaks and tabs removed from stored text, as in v3.

mayBeFormat

mayBeFormat is a cheap superset test for \\p{Cf} (every format character is U+00AD, in U+0600..U+206F, or at or above U+FEFF), so common text skips the table lookup.

publisherAtLoad

requireExactSend

requireExactSend panics unless caller (the entrypoint's cur.Previous()) is a direct user call and the transaction's send envelope holds exactly amount ugnot and no other denom. Only for a direct user call is the envelope credited to this realm, the message target; any other denom would be stranded here. The guard sits in this function, before the read, so the deployer's per-function fund-safety scan (lib/deploy.sh) sees it.

realmAddress

TotalLiabilities

TotalLiabilities returns the ugnot the realm owes across funded, completed and disputed milestones.

RealmAddress

RealmAddress is the NF-2 canonical name for the realm's own address.

GetActiveCount

GetActiveCount returns the number of open contracts (not completed or cancelled).

GetClientActiveCount

GetClientActiveCount returns the open contracts created by client, bounded by MaxActivePerClient.

GetLiveCount

GetLiveCount returns the contracts still stored: open ones plus settled ones their client has not archived.

GetArchivedCount

GetArchivedCount returns the contracts deleted by ArchiveContract.

GetCreatedCount

GetCreatedCount returns every contract ever created; ids run from 0 to GetCreatedCount()-1 and are never reused.

GovernanceMilestone

GovernanceContract

GetGovernanceContract

contentHash

contentHash digests the immutable metadata of a contract (parties, texts, creation height, milestone titles and amounts), not its state.

GovernanceFeeTerms

GetGovernanceFeeTerms

escrowMetadataField

maxPageSize

indexPrefix

indexPrefix keys the client index inside clientSlots (the per-client slot counters are keyed by the bare address, which never starts with "c/"): one tree instead of two keeps the package smaller.

GetContractJSON

GetContractJSON returns one contract as JSON.

GetClientContractsJSON

GetClientContractsJSON pages the live contracts a client created, newest first: {"items":\[{"id","status","createdAtHeight"}...],"next":cursor|null}. before is "" for the first page or the previous page's next cursor; limit is clamped to 1..50.

GetPauseStateJSON

GetPauseStateJSON returns PauseState() as JSON.

contractsPage

indexKey

indexKey orders a party's contracts by id: 10-digit zero padding.

deadline

deadline is the height at which a clock started at since (pause mark taken then) reaches span unpaused blocks, assuming no pause after the current one.

minHeight

jint

jheight

jheight encodes 0 (not set) as null.

jstr

jstr quotes s as a JSON string. Stored text is valid UTF-8 without control characters; ids passed by callers are escaped the same way.

RenderPageSize

RenderPageSize is the number of contracts listed per home page.

Render

renderHome

renderContract

renderStats

contractTotal

contractTotal cannot overflow: CreateContract refuses totals above int64.

truncAddr