memba_notes_v1 state

writer

canWrite

requireWrite

AddWriter

mutateAddWriter

RemoveWriter

mutateRemoveWriter

ProposeOwner

mutateProposeOwner

AcceptOwnership

mutateAcceptOwnership

SetListed

mutateSetListed

WritersJSON

ListSharedWithJSON

administrator

SetCreateFee

SetTreasury

Pause

TransferAdmin

AcceptAdmin

GetAdmin

MaxBackupBytes

backupRecord

backupLatest

backups

standardBackupKeys

A wallet-protected historical backup cannot become Vault-safe by relabelling.

backupKey

backupText

validateBackup

SetSeedBackup

backupJSON

SeedBackupJSON

SeedBackupAtJSON

SeedBackupsJSON

publicWriteGrants

Only explicit public grants are stored. Private notes keep their existing ACL.

publicWritesEnabled

resetPublicWrites

requireContentWrite

Community editing never grants ResolveComment or any owner/moderator action. Keep requireWrite unchanged for those existing permissions. While paused the grant is ignored, so only the existing ACL can edit.

SetPublicWrites

mutateSetPublicWrites

PublicCapabilitiesJSON

Separate schema: existing NoteJSON consumers retain their exact field set.

MaxBodyChunkBytes

NoteMetaJSON

NoteBodyChunkJSON

Each page is tied to the complete state revision, including access/mode and epoch changes. Clients concatenate binary chunks before decoding UTF8/AEAD.

MaxCommentBytes

MaxAnchorBytes

CommentCooldownBlocks

MaxCommentPage

comment

comments

commentIndex

cooldowns

commentKey

getComment

commentExpected

commentReceipt

mayComment

AddComment

Public comments carry UTF8 anchor/body separately. Encrypted comments will carry their combined authenticated payload in Body and an empty Anchor.

DeleteComment

ResolveComment

mutateResolveComment

HideComment

mutateHideComment

commentJSON

CommentJSON

CommentsJSON

Comments paginate in append order; editing or moderation never reorders them.

Purge

Purge never operates on a live note. Each call erases at most limit records (including cooldowns); a permanent note tombstone prevents ID reuse.

mutatePurge

purgePrefix

ManifestEntryBytes

MaxManifestBytes

MaxCipherCommentBytes

recipient

encrypted

contains

parseManifest

parseManifestFor

A self refresh checks the new caller identity while preserving every other already-stored envelope, including revoked or superseded identities.

validateCipher

validateCommitment

appendText

epochCommitment

manifestAddress

canonicalRecipient

wrapJSON

epochRecord

epochs

epochKey

getEpoch

privateWritable

setRecipients

initializeEncrypted

Rotate

Rotate installs the entire next epoch in one transaction. Historical epoch records stay available until Delete+boundedPurge; rotation never scans them.

mutateRotate

ApplyAccess

ApplyAccess grants access to the CURRENT epoch and its history. Removing a reader/writer or changing link scope requires Rotate, never this entrypoint.

mutateApplyAccess

Publish

mutatePublish

Reveal

mutateReveal

epochJSON

EpochJSON

EpochsJSON

ReadersJSON

manifestOwner

preserveTransferredWriters

Ownership changes do not silently revoke an existing manifest writer. Revocation requires the new owner to rotate; old key knowledge also remains.

WrapJSON

RefreshOwnWrap

RefreshOwnWrap changes only the caller's identity envelope. It cannot change roles, readers, modes or epochs, and never rewrites anybody else's recovery.

q

u

blob

noteJSON

NoteJSON

page

ListByOwnerJSON

ListPublicJSON

ConfigJSON

GovRealmPath

govAddress

govMember

SetGovWriters

mutateSetGovWriters

validGovAction

govDigest

The typed payload is bounded and hashed as bytes, including its version. Every precondition and opID is domain-bound; no raw large/Unicode content is put in daoauth's 1024-byte printable-ASCII argument envelope.

GovDigest

GovApply

dispatchGov

MaxGovPayloadBytes

govReader

payloadReader

historyBlob

Bytes shares the note's committed array: fields are replaced, never mutated in place, so history stores each version once and a later commit frees nothing another account paid for. A moderator redaction clears Bytes and keeps Hash.

historyVersion

historyVersion is the public state recorded by one note-level event. It keeps only what the public history reads expose, never a copy of the live note: no private manifest, readers, commitment or receipts. Versions that leave a field unchanged share that field's blob.

historyInfo

historyInfo is kept on the public note itself (note.History); the note record is retained forever as a tombstone, so it needs no index of its own.

historyEntry

One record per event. Operation and Comment hold the raw 16-byte ids ("" for none). Version is set on note-level events only; comment and cleanup events reuse the current state revision and record no version.

historyComment

historyComment keeps the first public version of a comment (Parent to Body, Parent as a raw id or "") and its latest presentation. Anchor and Body share the live comment's arrays, so a comment's text is stored once.

historyCall

historyEntries

historyComments

historyGov

Only GovApply sets this while the existing busy guard excludes reentry.

historyKey

historyID

historyGet

historyEntryAt

historyVersionAt

historyVersionAt returns the version recorded by the event with this seq, or nil when there is no such event or it is a comment/cleanup event.

historyRevisionEntry

historyRevisionEntry finds the note-level event of a public state revision without an index. Entries are contiguous from seq 1 and their state revision never decreases; each state revision since publication is recorded by exactly one note-level event, the first entry carrying it.

historyBlobOf

rawID

historyNullableRaw

historyAppend

historyNote

historyWriters

historyNullableText

historyCommentDetail

historyCommentDetail renders a comment reference; cid is the hex id and parent the raw parent id ("" for a top-level comment).

historyCommentChange

historyCleanup

PublicHistoryInfoJSON

historyEntryFields

PublicHistoryJSON

PublicHistoryEntryJSON

PublicHistoryVersionJSON

PublicHistoryVersionJSON reads the public state recorded at a state revision. recorded\_seq is the event that recorded it; PublicHistoryBodyChunkJSON and RedactPublicContentAtSeq address that version by this seq.

PublicHistoryBodyChunkJSON

PublicHistoryBodyChunkJSON reads the body of the version recorded by the note-level event seq (a version's recorded\_seq). A later note-level event that kept the body returns the same body; comment and cleanup events, deletion versions, unknown seqs and redacted bodies return null.

PublicHistoryCommentJSON

MaxModerators

moderators

moderator

AddModerator

RemoveModerator

ModeratorsJSON

ModerateListing

Directory moderation is separate from owner discoverability. Owners cannot undo a moderation hide by toggling their own listing preference.

mutateModerateListing

RedactedTitle

RedactedTitle replaces a redacted current title, which must stay valid.

RedactPublicContentAtSeq

RedactPublicContentAtSeq removes one public title (field 1) or body (field 2) from realm storage: the one recorded by the note-level history event seq (a version's recorded\_seq). The name carries the addressing so a caller written for field revisions cannot act on the wrong version. History stores each field revision once, so every version that kept that title or body shows it redacted. Public history keeps its SHA-256 and a content-redact entry naming the moderator and the field revision. Redacting the current version also replaces it (placeholder title, empty body) under a new field revision. Gno refunds the freed storage to the moderator who frees it.

mutateRedactPublicContentAtSeq

RedactPublicComment

RedactPublicComment removes a public comment's anchor and body from both the live comment (which becomes hidden and cannot be shown again) and its public history. A purged comment keeps only its history record, which is redacted the same way; baseRevision is then ignored (pass 0).

mutateRedactPublicComment

CreateNote

CreateNote is the only payable entrypoint; encrypted creation is atomic.

Commit

fieldMask: 1 title, 2 body, 3 both. An unchanged field must be omitted (empty blob). The separate field revision advances only when that field changes.

mutateCommit

Rename

Delete

Delete retains the ID and last operation receipt forever. Large collections are purged by bounded follow-up calls, never by an unbounded delete loop.

mutateDelete

SetCommentMode

mutateSetCommentMode

init.183

assertNoCoins

assertCreatePayment

OpRead

OpWrite

OpComment

Policy

The realm parameter forces an explicit crossing: adapters run with their own realm identity. All mutators retain the busy guard throughout callbacks.

policies

RegisterPolicy

SetPolicy

mutateSetPolicy

policyAllows

PoliciesJSON

GrantAccess

A holder may grant a read-policy-approved recipient the current epoch. Every existing entry must remain byte-identical: a grantee cannot corrupt someone else's wrap, change writers, remove access or rotate the owner into new keys.

Render

gnoweb uses bounded pages. A revision in every continuation link prevents assembling a whitepaper from different edits; the app reads binary chunks.

renderBoundary

Advance at most three continuation bytes; adjacent pages use the same boundary, so no UTF8 byte is lost or repeated.

MaxAccessRequests

RequestTTLBlocks

accessRequest

requests

requestKey

RequestAccess