v1 state

maxSeats

maxTerm

// seconds

StatusSubmitted

StatusChangesRequested

StatusRecommended

StatusDeclined

seat

A seat is active strictly before until. Lead is a public label and grants nothing.

Application

An Application is a founder's request for review and the latest decision on it. Earlier revisions and decisions stay in the event log.

admin

pendingAdmin

seats

// manager address -> seat; at most maxSeats entries

conflicts

// "\<collection>/\<address>" -> true; never removed

applications

// collection -> \*Application

lastFiling

filings

// seqid key -> collection, in order of first filing

init.15

now

caller

direct

requireAdmin

zeroHash

commitment

commitment checks a pointer to public text: the SHA-256 of its exact bytes as 64 lowercase hex digits, not all zero, and a bounded IPFS CID it can be fetched from (CIDv1 "bafy..." or "bafk..." in base32, or CIDv0 "Qm..." in base58). Clients must hash what they fetch before showing it. Private prose never goes on chain. Byte ranges, not alphabet lookups: this is most of the cost of a call that takes a pointer.

ProposeAdmin

ProposeAdmin starts a handoff to any account or realm. Nothing changes until that exact address accepts.

CancelAdminProposal

AcceptAdmin

AcceptAdmin completes the handoff. No caller has the empty address, so nobody accepts while nothing is proposed. The admin holds no seat: a manager who accepts gives its seat up.

GetAdmin

GetPendingAdmin

checkAccount

checkAccount refuses an address the chain never gives a caller: another spelling of an account would read as a stranger.

active

ActiveManager

ActiveManagerCount

AppointManager

AppointManager seats a manager until a time at most 90 days ahead, or replaces the term of one already seated. Expired seats are dropped first, so the tree never holds more than maxSeats entries.

RemoveManager

conflictKey

recorded

HasConflict

HasConflict reports a recorded conflict only: a filing, a recusal or an admin's mark. Conflicted is the full rule.

Conflicted

Conflicted reports whether an account may not act as a manager on a collection: it created the collection, holds or is proposed for its creator role now, or has a recorded conflict. It aborts on an unknown collection.

conflicted

seated

manager

Resign

Resign gives up the calling manager's own seat at once.

reopen

reopen voids the decision of a manager found conflicted after making it: the application awaits review again, so a conflict cannot be dodged by deciding first and disclosing later.

Recuse

Recuse records the calling manager's own conflict on a collection and voids its decision there, if it made the latest one. A recorded conflict is permanent: nobody, the admin included, can clear it, and recusing again records and emits nothing.

MarkConflict

MarkConflict records a conflict the admin knows of, on a manager or on an account that may become one, and voids that account's latest decision on the collection as Recuse does. Marking a recorded conflict again records and emits nothing.

founder

applicationOf

GetApplication

GetApplication returns a copy of a collection's application, the zero value (revision 0) when nobody applied, as ApplicationJSON answers null.

Apply

Apply files the founder's application for a collection. The founder may file again at any time before a recommendation, to correct a pointer or after a manager asked for changes or declined. Each filing is a new revision awaiting review. Filing records the filer's conflict on the collection for good. A realm that holds the creator role never applies: the founder calls in person.

Review

Review records one manager's decision on the revision it read, which must still be the latest. Any unconflicted manager may decide again, whatever the latest decision. A recommendation is advice to the admin and gives the collection nothing by itself.

Render

maxFeature

// seconds

holdSpan

maxHold

subjects

What a founder may appeal: the decision on its application, a hold, the collection's verification, or a feature decision.

feature

A feature slot exists only when one manager proposed it and another approved it. The admin can clear a slot and can never create one.

hold

A hold hides a collection from curated views until a time. It changes presentation only: nothing about the collection's tokens is frozen.

verification

appeal

features

// collection -> \*feature

holds

// collection -> \*hold

verifications

// collection -> verification

appeals

// "\<collection>/\<subject>" -> \*appeal, the latest

lastAppeal

openAppeals

// seqid key -> appeals key, in filing order

featureOf

holdOf

appealOf

standing

standing reports whether who could act on the collection as a manager now. An unapproved slot's empty approver holds no seat.

pair

pair enforces the two-manager rule when second completes what first began: two different managers, the first still seated and unconflicted. The second was checked as the caller.

running

running reports a slot that runs, approved by two managers that both keep their standing: whether hidden or not, it is the collection's slot.

ProposeFeature

ProposeFeature opens a slot of at most 14 days. It features nothing until a second manager approves. It replaces a slot that is not running: one still unapproved, or one whose proposer or approver lost its standing.

ApproveFeature

IsFeatured

IsFeatured holds only while the slot runs, both of its managers keep their standing and the collection is not hidden.

ClearFeature

HideTemporarily

HideTemporarily hides a collection for 24 hours on one manager's word. The record outlives the hold: no manager can start another until the admin clears it.

ConfirmHide

ConfirmHide lets a second manager keep a running hold for 24 hours from now, once. After that, or once the admin has set the term, only the admin changes it.

ExtendHide

ExtendHide sets the term of a recorded hold, running or over, to a time at most 30 days ahead, and replaces its public reason.

ClearHide

IsHidden

IsHidden holds while the hold runs and the manager whose word set its term keeps its standing: the starter, or the confirmer once it confirmed. A term the admin set rests on the admin alone.

SetVerified

SetVerified is the admin's statement that a collection is what it claims to be. It says nothing about price or future value.

IsVerified

Appeal

Appeal files the founder's objection on one subject. A collection has at most one open appeal per subject; a resolved one can be followed by another.

ResolveAppeal

ResolveAppeal records the admin's answer and its public reason. It changes nothing else: the admin acts on an upheld appeal with the ordinary calls.

jsonInt

int64 values are decimal strings so a JSON client cannot round them.

StateJSON

ManagersJSON

ManagersJSON lists the active seats, ordered by account.

ApplicationJSON

ApplicationJSON returns null for a collection nobody applied for.

pageJSON

pageJSON renders a zero-based page of a tree in key order; the page size is 1..50.

ApplicationsJSON

ApplicationsJSON pages through the applications in order of first filing.

AccessJSON

AccessJSON tells a private inbox what an account is to a collection right now: whether it holds the creator role ("founder"), an active manager, and whether Conflicted bars it from acting as one. It is public data to be read on every request, not a token. The answer also says where and when it was evaluated: the chain ID, the block height and the block time. The answer is not signed: checking them exposes an honest node on the wrong chain or behind it, and proves nothing against a node that lies. Its eight fields are a contract with that reader.

featureJSON

holdJSON

verificationJSON

appealJSON

CollectionJSON

CollectionJSON is a collection's editorial record: what a client may show now, then the records behind it and the latest appeal on each subject. A part with no record is null.

AppealsJSON

AppealsJSON pages through the open appeals in filing order.

FeaturesJSON

FeaturesJSON pages through every collection that has a feature slot on record, in ID text order, saying whether it is featured right now.