service_market state

Denom

Denom is the only asset this realm accepts.

MaxFeeBps

MaxFeeBps is the hard protocol-fee cap: 1000 bps = 10%.

AcceptanceBlocks

AcceptanceBlocks is how long a customer has to accept a delivery before anyone may release it to the provider. It is a PROTOCOL constant on purpose — see the header. ~7 days at pearl's observed ~4.2s blocks.

ServiceActive

Service status values.

ServiceRetired

Service status values.

OrderPurchased

Order status values. Released and Refunded are terminal.

OrderDelivered

Order status values. Released and Refunded are terminal.

OrderReleased

Order status values. Released and Refunded are terminal.

OrderRefunded

Order status values. Released and Refunded are terminal.

MaxTitleLen

Input bounds.

MaxDescLen

Input bounds.

MaxURILen

Input bounds.

MinPrice

Input bounds.

MinDeliveryBlocks

Input bounds.

MaxDeliveryBlocks

Input bounds.

MaxServicesPerProvider

Input bounds.

RenderLimit

Input bounds.

service

order

admin

// may set fee, fee recipient, stage successor

pendingAdmin

// staged by TransferAdmin, completes via AcceptAdmin

feeRecipient

// may withdraw fees and sweep surplus

feeBps

// fee snapshotted into NEW services

self

// this realm's address, captured at deploy

nextService

nextOrder

escrowTotal

// == Σ amount over Purchased and Delivered orders

services

// padID(id) -> \*service

orders

// padID(id) -> \*order

providerNum

// address -> \*int64, services per provider

ledger

init.31

RegisterService

RegisterService publishes a standing offer and returns its id. No coins are accepted; the storage deposit the caller pays is the anti-spam. The current protocol fee is snapshotted into the service and must not exceed maxFeeBps, the ceiling the provider signed for — pass MaxFeeBps to accept any legal fee. Providers may be EOAs or realms, but a realm provider takes on three obligations that this realm cannot check for it. Realm bytes are immutable after addpkg, so a realm deployed without them cannot acquire them later: failing (1) means it never earns, failing (2) or (3) means what it earned is permanently stranded. 1. It must already expose a crossing entrypoint that calls MarkDelivered. That is the only transition to OrderDelivered, and both release paths require it, so a provider realm that cannot call it never earns a credit at all — every order against it runs to ClaimRefund instead. This obligation binds before the next one. 2. It must already expose a crossing entrypoint that calls Claim or ClaimAll on this realm. A credited balance is a pull, never a push; nothing here can reach into a provider realm to deliver it. 3. It must make both calls in transactions whose ORIGIN carried no -send, per the REALM-CALLER CAVEAT in the package header. The customer side is not symmetric: PurchaseService is payable and routes through coinio.Receive, which requires an EOA calling directly via MsgCall. A realm can therefore sell a service here but cannot buy one — and "can sell" is exactly as strong as the three obligations above, no stronger. A customer is structurally always an EOA, which is why the permissionless valves are always pullable.

RetireService

RetireService stops a service accepting NEW orders. Orders already in flight keep their own copies of provider, amount and fee, and run to their own terminal states unaffected. Provider only, and terminal — there is no un-retire, so a customer reading "active" cannot have it flicker underneath them.

PurchaseService

PurchaseService escrows EXACTLY the listed price and opens an order. The caller must be an EOA (coinio.Receive is the receipt-guaranteed shape) and must attach exactly the price in ugnot; any mismatch aborts and the coins revert with the transaction. Self-purchase is rejected.

MarkDelivered

MarkDelivered records that the work is done and starts the acceptance window. Provider only. The uri is an opaque reference to the deliverable; this realm neither fetches nor interprets it, and it is sanitized on the way out to Render. Delivering AFTER the delivery deadline is allowed as long as nobody has yet called ClaimRefund — late work the customer still wants should not be destroyed by a deadline that exists to protect the customer. The customer's remedy is unchanged: they simply do not accept, and the refund valve stays open right up until this transition lands.

AcceptDelivery

AcceptDelivery is THE RESOLUTION: the customer accepts the delivered work and the escrow becomes the provider's claimable balance, minus the fee snapshotted into the order at purchase. Customer only.

ReleaseTimeout

ReleaseTimeout releases a delivered order to the provider once the acceptance window has lapsed. Permissionless: a customer who stops responding must not be able to strand a provider's completed work. This is deemed acceptance, and it is the only path by which escrow reaches a provider without the customer's explicit act.

DeclineOrder

DeclineOrder returns the escrow to the customer before delivery. Provider only, fee-free — a provider who cannot fulfil should be able to hand the money straight back rather than wait out a deadline. Safe to allow unilaterally because it only ever moves value AWAY from the caller.

ClaimRefund

ClaimRefund returns the escrow to the customer once the provider has missed the delivery deadline. Permissionless: a provider who abandons an order must not be able to strand the customer's money. It is fee-free. Charging a protocol fee on a refund would mean the marketplace profits from provider non-performance.

Claim

Claim sends amount ugnot of the caller's claimable balance back to the caller.

ClaimAll

ClaimAll sends the caller's entire claimable balance back to the caller. Fails if there is nothing to claim.

WithdrawFees

WithdrawFees sends the accrued fee pot to the fee recipient. Only the fee recipient may call it.

SweepDenom

SweepDenom sends the surplus of a single denomination to the fee recipient. For ugnot only the excess over Liabilities() moves — which reserves live escrow as well as claimable balances and the fee pot — and other denoms move wholly. Only the fee recipient may call it.

SetFeeBps

SetFeeBps sets the protocol fee snapshotted into FUTURE services. Existing services, and every order already placed against them, keep the fee they were created under. Admin only; bounded by \[0, MaxFeeBps].

SetFeeRecipient

SetFeeRecipient sets the address that may withdraw fees and sweep surplus. Admin only.

TransferAdmin

TransferAdmin stages a successor. Two-step: the successor must call AcceptAdmin, so a typo cannot orphan the realm. Admin only. Passing the zero address cancels a pending nomination; any other value must be a well-formed address, for parity with SetFeeRecipient. The two-step handover already made a malformed nominee harmless — it could never call AcceptAdmin — so this check rejects the typo at the point it is made rather than leaving it staged and readable as a real nomination.

AcceptAdmin

AcceptAdmin completes a staged handover. Only the nominee may call it.

ServiceInfo

ServiceDescription

OrderInfo

OrderDeadlines

OrderDeadlines returns the two absolute heights that govern an order. acceptanceDeadline is 0 until the order is delivered.

OrderURI

Quote

Quote reports what a purchase of this service would cost and what the provider would receive on resolution, at the service's snapshotted fee.

Admin

PendingAdmin

FeeRecipient

FeeBps

NumServices

NumOrders

ServicesOf

BalanceOf

UsersTotal

FeesAccrued

EscrowTotal

EscrowTotal is the live escrow pool E: the sum of every order still in Purchased or Delivered.

Liabilities

Liabilities is everything this realm owes: live escrow, claimable balances and the fee pot. SweepDenom reserves exactly this.

Held

Surplus

Address

Height

Render

renderService

renderOrder

realmPath

release

release moves an order's escrow into the provider's claimable balance at the order's snapshotted fee, and drives the order terminal. The status write and the escrow decrement happen together with the credit, so no order can be released twice and E stays exactly Σ open amounts.

refund

refund moves an order's escrow into the customer's claimable balance at ZERO fee and drives the order terminal.

assertNoSend

assertNoSend refuses coins on non-payable entrypoints: an accidental -send would otherwise strand at the realm as sweep-only surplus. PurchaseService is the only payable function. NOTE: this reads the ORIGIN envelope — see the realm-provider caveat in the header.

assertAdmin

mustGetService

mustGetOrder

countFor

countFor reports how many ACTIVE services an address holds.

bumpFor

bumpFor adjusts the active-service counter, removing the entry at zero so a provider who retires everything stops paying for the slot.

assertValidTitle

assertValidTitle bounds length and restricts the charset so titles are list-safe in Render without escaping.

padID

padID renders an id as a fixed-width key so avl iteration order is numeric order.

checkedAdd

itoa