@wowok/agent-mcp 3.4.0 → 3.4.2

package/dist/knowledge/guard-design-patterns.js

@@ -1 +1 @@
-import{SV2_PRIMARY_FORM_CLAUSE,SV2_DELIBERATE_ALTERNATIVE_CLAUSE}from'./protocol-facts.js';export const GUARD_DESIGN_PATTERNS=[{'id':'pattern.identity_check_single','business_requirement':'Only\x20the\x20author\x20can\x20purchase\x20this\x20service\x20(strict\x20single-identity)','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level1_strict_single','logic_summary':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Maximally\x20secure\x20but\x20maximally\x20inconvenient','If\x20address\x20is\x20unavailable\x20(key\x20loss,\x20rotation),\x20Guard\x20permanently\x20blocks','Avoid\x20unless\x20role\x20is\x20permanently\x20tied\x20to\x20one\x20address']},{'id':'pattern.identity_check_allowlist','business_requirement':'Customer\x20must\x20be\x20in\x20an\x20allowlist\x20to\x20purchase','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'vec_contains_address[identifier[N](allowlist_vec),\x20context(Signer)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Allowlist\x20stored\x20as\x20Address\x20vector\x20in\x20table\x20constant']},{'id':'pattern.identity_check_order_holder','business_requirement':'Only\x20order\x20owner\x20or\x20agent\x20can\x20perform\x20operation','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_and[logic_equal[query(1563\x20order.service,\x20@id254),\x20identifier[N](service_address)],\x20logic_or[logic_equal[query(1562\x20order.owner,\x20@id254),\x20context(Signer)],\x20query(1567\x20order.agent\x20has,\x20@id254,\x20Signer)]]','key_queries':['order.service','order.owner','order.agent\x20has'],'mitigated_risks':['R-C4-04','R-C3-06','R-C3-05'],'notes':['1563\x20returns\x20Address\x20→\x20wrap\x20in\x20logic_equal\x20against\x20the\x20service\x20table\x20constant','1562\x20returns\x20Address\x20→\x20wrap\x20in\x20logic_equal','1567\x20returns\x20Bool\x20→\x20use\x20directly\x20as\x20logic_or\x20child','Recommended\x20Level\x202\x20alternative\x20to\x20Level\x201\x20strict\x20binding','MIG-04:\x20order.service\x20binding\x20prevents\x20cross-service\x20order\x20replay','T10\x20HIJACK\x20ANCHOR\x20(rex-mn-261021):\x20the\x20order.*\x20IDENTITY\x20LEGS\x20MUST\x20READ\x20THE\x20ORDER\x20AT\x20SLOT\x20254,\x20never\x20a\x20free\x20submission\x20slot\x20—\x20the\x20caller\x20fills\x20free\x20slots,\x20so\x20an\x20attacker\x20submits\x20their\x20OWN\x20order\x20there\x20(signer\x20==\x20order.owner\x20passes\x20against\x20their\x20own\x20order)\x20and\x20the\x20edge\x20advances\x20the\x20VICTIM\x27s\x20order\x20carried\x20by\x20254;\x20with\x20namedOperator\x20\x22\x22\x20the\x20permission\x20layer\x20passes\x20for\x20anyone\x20(the\x20on-chain\x20forward\x20entry\x20never\x20checks\x20the\x20caller),\x20so\x20this\x20guard\x20is\x20the\x20sole\x20identity\x20leg.\x20The\x20compile\x20blocker\x20GUARD_IDENTITY_SLOT_NOT_TASKBOUND\x20enforces\x20the\x20anchor\x20on\x20resolved\x20trees.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.']},{'id':'pattern.identity_check_service_provider_dynamic','business_requirement':'Verify\x20caller\x20is\x20service\x27s\x20current\x20permission\x20owner\x20(survives\x20permission\x20rotation)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_and[logic_equal[query(1488\x20service.permission),\x20identifier[N](submitted_perm)],\x20logic_or[logic_equal[query(1002\x20permission.owner),\x20context(Signer)],\x20query(1004\x20permission.admin\x20has,\x20Signer)]]','key_queries':['service.permission','permission.owner','permission.admin\x20has'],'mitigated_risks':['R-C4-04','R-C3-05'],'notes':['Dynamic\x20permission\x20address\x20(RECOMMENDED)\x20—\x20survives\x20Service\x20permission\x20rotation','Caller\x20submits\x20permission\x20address;\x20Guard\x20verifies\x20match\x20then\x20checks\x20identity','More\x20complex\x20than\x20static\x20but\x20far\x20more\x20robust']},{'id':'pattern.time_lock_progress','business_requirement':'Customer\x20must\x20wait\x20N\x20hours\x20before\x20completing\x20(time-lock)','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'logic_as_u256_greater_or_equal[{\x22type\x22:\x22context\x22,\x22context\x22:\x22Clock\x22},\x20calc_number_add[query(1280\x20progress.history.time,\x20next_node=<source-node>,\x20find=last,\x20witness=OrderProgress),\x20identifier[N](duration_ms)]]','key_queries':['progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Use\x20convert_witness=100\x20(OrderProgress)\x20to\x20derive\x20Progress\x20from\x20submitted\x20Order\x20ID','ANCHOR\x20SEMANTICS\x20(field\x20truth,\x20progress\x20History):\x20node\x20=\x20the\x20node\x20LEFT,\x20next_node\x20=\x20the\x20node\x20ENTERED,\x20time\x20=\x20the\x20moment\x20of\x20ENTERING\x20next_node.\x20Canonical\x20\x27wait\x20from\x20entering\x20<node>\x27\x20=\x20next_node=<node>\x20+\x20find=last;\x20node=<node>\x20reads\x20the\x20LEAVE\x20moment\x20(rare\x20—\x20state\x20it\x20explicitly).','GENERATION\x20NOTE:\x20query\x201280\x20requires\x20an\x20execution\x20layer\x20>=\x20its\x20release\x20binary;\x20on\x20an\x20OLDER\x20network\x20build,\x20fall\x20back\x20to\x20the\x20repository-oracle\x20time\x20source\x20(pattern.time_source_repository_oracle\x20—\x20the\x20arbitration-verifiable\x20interim),\x20never\x20to\x201272\x20progress.current_time,\x20which\x20is\x20REWRITTEN\x20at\x20every\x20node\x20migration\x20so\x20the\x20lock\x20drifts\x20to\x20the\x20last\x20forward\x20(ETS-C).','Duration\x20in\x20milliseconds\x20—\x20test\x20with\x20small\x20values\x20first','TIME\x20SOURCE\x20DUALITY:\x20chain\x20Clock\x20is\x20native\x20but\x20INDEPENDENT\x20of\x20wall\x20time\x20(block-driven,\x20coarse)\x20—\x20fine\x20for\x20relative\x20locks;\x20for\x20real-world\x20deadlines\x20use\x20pattern.time_source_repository_oracle\x20instead','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.','DIRECTION:\x20greater_or_equal\x20encodes\x20an\x20OPENING\x20gate\x20(blocked\x20until\x20entry+N).\x20For\x20a\x20CLOSING\x20window\x20(action\x20allowed\x20only\x20until\x20entry+N)\x20use\x20pattern.time_window_upper_bound\x20—\x20inverting\x20the\x20comparison\x20makes\x20every\x20window\x20permanently\x20open\x20(etm-mn-261013\x20A-06).']},{'id':'pattern.time_lock_absolute','business_requirement':'Operation\x20allowed\x20only\x20after\x20a\x20fixed\x20timestamp','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'none','logic_summary':'logic_as_u256_greater_or_equal[context(Clock),\x20identifier[N](release_timestamp)]','key_queries':[],'mitigated_risks':[],'notes':['Useful\x20for\x20pre-sale\x20windows,\x20embargo\x20periods','TIME\x20SOURCE\x20DUALITY:\x20comparing\x20a\x20fixed\x20timestamp\x20against\x20context(Clock)\x20uses\x20CHAIN\x20time,\x20not\x20wall\x20time\x20—\x20acceptable\x20when\x20block-rate\x20drift\x20is\x20tolerable;\x20bind\x20the\x20comparison\x20to\x20a\x20self-built\x20repository\x20time\x20oracle\x20(pattern.time_source_repository_oracle)\x20when\x20the\x20cutoff\x20is\x20a\x20real-world\x20date']},{'id':'pattern.time_window_upper_bound','business_requirement':'Action\x20allowed\x20only\x20WHILE\x20the\x20window\x20is\x20open\x20—\x20within\x20N\x20of\x20the\x20anchor\x20(return\x20window,\x20cancel\x20window,\x20review\x20window);\x20after\x20expiry\x20the\x20forward\x20aborts','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'logic_as_u256_lesser_or_equal[{\x22type\x22:\x22context\x22,\x22context\x22:\x22Clock\x22},\x20calc_number_add[query(1280\x20progress.history.time,\x20next_node=<source-node>,\x20find=last,\x20witness=OrderProgress),\x20identifier[N](duration_ms)]]','key_queries':['progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['DIRECTION\x20is\x20the\x20whole\x20point:\x20lesser_or_equal[CLOCK,\x20entry+N]\x20closes\x20the\x20window;\x20greater_or_equal\x20would\x20reopen\x20it\x20forever.\x20Opening\x20gate\x20(wait\x20N\x20before\x20acting)\x20=\x20pattern.time_lock_progress;\x20closing\x20window\x20(act\x20before\x20N\x20elapses)\x20=\x20THIS\x20pattern.','ANCHOR\x20SEMANTICS\x20(field\x20truth,\x20progress\x20History):\x20node\x20=\x20the\x20node\x20LEFT,\x20next_node\x20=\x20the\x20node\x20ENTERED,\x20time\x20=\x20the\x20moment\x20of\x20ENTERING\x20next_node.\x20Canonical\x20\x27return\x20window\x20from\x20entering\x20delivered\x27\x20=\x20next_node=\x27delivered\x27\x20+\x20find=last;\x20node=\x27delivered\x27\x20reads\x20the\x20LEAVE\x20moment\x20(drifts\x20past\x20the\x20delivery\x20itself\x20—\x20the\x20double-wrong\x20form\x20run-75747\x20F-17\x20called\x20out).','GENERATION\x20NOTE:\x20query\x201280\x20requires\x20an\x20execution\x20layer\x20>=\x20its\x20release\x20binary;\x20on\x20an\x20OLDER\x20network\x20build,\x20fall\x20back\x20to\x20the\x20repository-oracle\x20time\x20source\x20(pattern.time_source_repository_oracle\x20—\x20record\x20the\x20anchor\x20timestamp\x20at\x20the\x20entry\x20event,\x20arbitration-verifiable),\x20never\x20to\x201272\x20progress.current_time,\x20which\x20is\x20REWRITTEN\x20at\x20every\x20node\x20migration\x20so\x20the\x20window\x27s\x20base\x20drifts\x20to\x20the\x20last\x20forward\x20(ETS-C).','TIME-ANCHOR-01:\x20anchor\x20on\x20the\x20RIGHT\x20source\x20—\x20a\x20window\x20measured\x20from\x20node\x20entry\x20uses\x20the\x201280\x20node-entry\x20timestamp;\x20a\x20window\x20measured\x20from\x20purchase\x20(e.g.\x20\x27return\x20within\x2030\x20days\x20of\x20buying\x27)\x20anchors\x20on\x20order\x20time\x20via\x20the\x20order\x20witness\x20instead.\x20Declaring\x20the\x20anchor\x20in\x20the\x20business\x20brief\x20is\x20not\x20enough\x20—\x20the\x20recipe\x20must\x20read\x20it.','EXPIRY\x20SEMANTICS:\x20an\x20expired\x20window\x20only\x20fails\x20the\x20FORWARD\x20it\x20gates\x20—\x20it\x20does\x20not\x20refund\x20or\x20cancel\x20by\x20itself;\x20pair\x20with\x20a\x20machine\x20expiry\x20node\x20or\x20an\x20allocator\x20recover\x20rail\x20for\x20the\x20post-window\x20fund\x20path.','TIME\x20SOURCE\x20DUALITY:\x20chain\x20Clock\x20is\x20block-driven\x20—\x20use\x20pattern.time_source_repository_oracle\x20for\x20real-world\x20deadlines.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20required\x20when\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20—\x20see\x20pattern.time_lock_progress\x27s\x20TASK-BINDING\x20SLOT\x20note.']},{'id':'pattern.time_source_repository_oracle','business_requirement':'Guard\x20needs\x20accurate\x20real-world\x20time\x20(review\x20windows,\x20no-show\x20cutoffs,\x20staged-release\x20deadlines)\x20instead\x20of\x20coarse\x20chain\x20Clock','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'Self-built\x20time\x20oracle:\x20an\x20off-chain\x20keeper\x20pushes\x20wall-clock\x20timestamps\x20into\x20a\x20Repository\x20'+'(repository_write\x20gated\x20by\x20permission);\x20Guards\x20read\x20repository.data\x20(query\x201167)\x20and\x20compare\x20the\x20'+'oracle\x20timestamp\x20with\x20logic_as_u256_greater_or_equal\x20instead\x20of\x20context(Clock).','key_queries':['repository.data'],'mitigated_risks':[],'applicable_industries':['subscription','travel','rental','education'],'notes':['Chain\x20time\x20is\x20INDEPENDENT\x20of\x20real\x20time:\x20Clock\x20advances\x20with\x20blocks\x20—\x20usable\x20but\x20imprecise\x20for\x20business\x20deadlines;\x20both\x20tracks\x20are\x20first-class,\x20pick\x20per\x20requirement\x20and\x20DOCUMENT\x20which\x20one\x20a\x20published\x20Guard\x20relies\x20on\x20(IMMUT-001)','No\x20public\x20time\x20oracle\x20exists\x20on-chain\x20today\x20—\x20the\x20Repository\x20oracle\x20is\x20self-built\x20(owner\x20pushes,\x20users\x20verify)','Trust\x20trade-off:\x20the\x20oracle\x20publisher\x20can\x20skew\x20timestamps\x20—\x20pin\x20the\x20Repository\x20address\x20as\x20a\x20table\x20constant\x20and\x20gate\x20writes\x20with\x20a\x20permission\x20check','Freshness\x20bound:\x20add\x20a\x20second\x20clause\x20asserting\x20the\x20oracle\x20timestamp\x20is\x20itself\x20recent\x20(oracle_time\x20+\x20max_staleness\x20>=\x20context(Clock))\x20so\x20a\x20stalled\x20keeper\x20fails\x20the\x20Guard\x20loudly\x20instead\x20of\x20freezing\x20windows\x20silently']},{'id':'pattern.repository_data_check','business_requirement':'External\x20data\x20must\x20match\x20expected\x20value\x20(e.g.,\x20weather,\x20price\x20feed)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'logic_equal[query(1167\x20repository.data,\x20policy,\x20key),\x20identifier[N](expected_value)]','key_queries':['repository.data'],'mitigated_risks':[],'notes':['Repository\x20address\x20declared\x20as\x20table\x20constant','Timestamp\x20keys\x20may\x20need\x20convert_number_address','quote_guard\x20context:\x20fails\x20in\x20gen_passport\x20(impack_list\x20empty),\x20works\x20in\x20on-chain\x20business\x20operations\x20(see\x20R-X1-10)','EXISTENCE\x20IS\x20NOT\x20TRUST:\x20this\x20pattern\x20reads\x20a\x20row;\x20it\x20does\x20not\x20prove\x20who\x20wrote\x20it.\x20A\x20forward\x20gated\x20only\x20on\x20\x27the\x20row\x20exists\x27\x20(1166\x20has\x20/\x20a\x20non-empty\x201167)\x20is\x20satisfied\x20by\x20ANY\x20pre-written\x20row,\x20including\x20one\x20forged\x20by\x20a\x20counterparty\x20—\x20the\x20write\x20side\x20must\x20bind\x20the\x20writer\x20(pattern.repository_write_authorization;\x20R-X1-17\x20reports\x20a\x20write_guard\x20that\x20folds\x20true\x20or\x20names\x20no\x20identity).\x20Verified\x20on\x20testnet\x20(test-14\x20HIGH-04):\x20a\x20buyer\x20forged\x20the\x20merchant\x27s\x20shipping-tracking\x20row\x20and\x20the\x20ship/deliver\x20evidence\x20gates\x20passed\x20on\x20it\x20(tx\x20BLA7F62r).','PER-ORDER\x20TIER\x20GRID\x20(B-3):\x20query\x201167\x20accepts\x20the\x20ORDER\x20address\x20as\x20the\x20key\x20—\x20merchant\x20writes\x20a\x20per-order\x20tier\x20number\x20into\x20the\x20Repository,\x20allocator\x20Guards\x20select\x20with\x20logic_equal[repository.data(\x27tier\x27,\x20order),\x20N].\x20Allocator\x20amounts\x20are\x20FROZEN\x20at\x20publish\x20(the\x20allocation\x20entry\x20computes\x20shares\x20from\x20the\x20published\x20table;\x20the\x20submission\x20only\x20picks\x20RECIPIENTS,\x20never\x20amounts),\x20so\x20per-order\x20amount\x20differences\x20are\x20expressible\x20ONLY\x20as\x20a\x20tier\x20grid\x20(one\x20allocator\x20per\x20tier)\x20—\x20continuous/arbitrary\x20amounts\x20are\x20not.\x20Without\x20quote_guard/write_guard\x20binding\x20buyer\x20credentials,\x20the\x20tier\x20data\x20is\x20a\x20unilateral\x20merchant\x20declaration\x20(residual\x20risk;\x20enforce\x20the\x20binding\x20in\x20the\x20service\x20template).','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.']},{'id':'pattern.repository_write_authorization','business_requirement':'Evidence\x20rows\x20(tracking\x20number,\x20inspection\x20receipt,\x20return\x20receipt,\x20oracle\x20value,\x20roster\x20entry)\x20'+'may\x20only\x20be\x20written\x20by\x20designated\x20parties\x20—\x20and\x20the\x20guard\x20must\x20bind\x20WHO\x20writes,\x20not\x20merely\x20that\x20some\x20object\x20exists','data_source':'SystemContext','host':'repository_write','verifier_level':'level2_identity_set','logic_summary':'logic_and[\x20<identity\x20leaf\x20—\x20MANDATORY>,\x20<data-shape\x20leaf\x20—\x20optional>\x20]\x20where\x20the\x20identity\x20leaf\x20is\x20one\x20of:\x20'+'logic_equal[context(Signer),\x20identifier#N(Address)]\x20(single\x20writer)\x20|\x20'+'vec_contains_address[identifier#N(VecAddress),\x20context(Signer)]\x20(writer\x20set)\x20|\x20'+'logic_or[logic_equal[query(1562\x20order.owner),\x20context(Signer)],\x20query(1567\x20order.agent\x20has,\x20Signer)]\x20(writer\x20must\x20hold\x20the\x20Order\x20the\x20row\x20is\x20keyed\x20by)\x20|\x20'+'logic_or[<merchant\x20Signer>,\x20query(1008\x20permission.entity.perm\x20has,\x20merchant\x20Permission,\x20[context(Signer),\x20<custom\x20index>])]\x20(staff\x20via\x20Permission\x20entity\x20table).\x20'+'NEVER\x20a\x20bare\x20constant-true\x20identifier,\x20a\x20self-comparison,\x20or\x20an\x20unsigned\x20value\x20>=\x200\x20—\x20see\x20notes.','key_queries':['repository.data\x20has','repository.data','repository.policy.id_from','order.owner','order.agent\x20has','permission.entity.perm\x20has','proof.signer','proof.time'],'mitigated_risks':['R-X1-17','R-C1-03'],'applicable_industries':['retail','travel','education','rental','general'],'notes':['WHAT\x20THE\x20CHAIN\x20CHECKS\x20(the\x20blind\x20spot):\x20the\x20Repository\x20policy-creation\x20entry\x20(the\x20R-D-1\x20validation)\x20asserts\x20only\x20that\x20a\x20policy\x20with\x20id_from\x20NONE\x20has\x20a\x20NON-EMPTY\x20write_guard\x20LIST\x20'+'(E_POLICY_WRITE_GUARD_REQUIRED\x20=\x2022)\x20—\x20it\x20never\x20evaluates\x20what\x20any\x20listed\x20Guard\x20proves.\x20A\x20placeholder\x20guard\x20that\x20returns\x20true\x20for\x20everyone\x20therefore\x20publishes\x20cleanly\x20and\x20is\x20exactly\x20the\x20'+'open\x20door\x20an\x20empty\x20list\x20would\x20have\x20been,\x20with\x20no\x20warning.\x20'+'Verified\x20on\x20testnet\x20(test-14\x20HIGH-04):\x20a\x20NON-merchant\x20signer\x20wrote\x20a\x20forged\x20tracking\x20row\x20for\x20another\x20buyer\x27s\x20order\x20(tx\x20BLA7F62r…);\x20the\x20merchant\x27s\x20legitimate\x20write\x20simply\x20upserted\x20over\x20it\x20(tx\x20DaZaPn6o…).\x20'+'Rule\x20R-X1-17\x20now\x20folds\x20the\x20tree\x20and\x20rejects\x20constant-true\x20roots\x20/\x20write_guards\x20with\x20no\x20context(Signer)\x20leaf.','NO\x20AUTHOR\x20IS\x20RECORDED:\x20a\x20Repository\x20row\x20carries\x20no\x20writer\x20field\x20(data_id\x20→\x20data\x20value\x20only).\x20The\x20write_guard\x20is\x20the\x20sole\x20attribution\x20mechanism,\x20and\x20it\x20is\x20a\x20GATE,\x20not\x20a\x20signature.\x20'+'So\x20\x27the\x20merchant\x20wrote\x20it\x27\x20is\x20not\x20provable\x20on\x20chain\x20from\x20a\x20bare\x20string\x20—\x20which\x20is\x20what\x20downstream\x20trust\x20scoring\x20and\x20arbitration\x20evidence\x20silently\x20assume.','PROVENANCE-GRADE\x20EVIDENCE:\x20store\x20the\x20ADDRESS\x20OF\x20A\x20SIGNED\x20WTS\x20PROOF\x20as\x20the\x20row\x20value\x20instead\x20of\x20the\x20raw\x20string.\x20Proof\x20objects\x20carry\x20proof.signer\x20(3555),\x20proof.time\x20(3573)\x20and\x20are\x20immutable,\x20'+'so\x20the\x20consuming\x20forward\x20Guard\x20can\x20verify\x20Prover\x20+\x20Time\x20binding\x20(pattern.verifier_evidence_philosophy)\x20rather\x20than\x20mere\x20existence.\x20Existence-only\x20reads\x20(repository.data\x20has,\x201166)\x20are\x20satisfied\x20by\x20ANY\x20pre-written\x20row,\x20including\x20a\x20forged\x20one.\x20'+'ABOUT\x20CONTRACT\x20(K3\x202026-10-12,\x20amended\x20gf26\x20batch2\x202026-10-26\x20—\x20RECOMMENDED\x20NORM,\x20not\x20chain-enforced):\x20proof.about\x20is\x20bound\x20at\x20creation\x20to\x20the\x20conversation\x20PEER\x20ACCOUNT\x20address\x20(address\x20first\x20byte\x20=\x20account\x20type;\x20a\x20Proof\x20self-address\x20is\x20the\x20other\x20recommended\x20shape)\x20OR\x20to\x20the\x20ORDER\x20address\x20the\x20credential\x20is\x20about\x20(the\x20order-anchored\x20required_info\x20flow).\x20The\x20order-anchored\x20form\x27s\x20trust\x20does\x20NOT\x20come\x20from\x20reading\x20about\x20anywhere\x20—\x20the\x20owner-minted\x20Proof\x20is\x20pinned\x20on-chain\x20at\x20bind\x20time\x20(the\x20order-side\x20required-info\x20bind\x20entry\x20asserts\x20about\x20==\x20this\x20order\x20AND\x20creator\x20==\x20the\x20order\x20owner,\x20E_REQUIRED_INFO_PROOF_NOT_BOUND\x20otherwise,\x20and\x20the\x20Proof\x20object\x20is\x20frozen\x20on-chain),\x20so\x20the\x20enforcement\x20point\x20is\x20the\x20bind\x20entry,\x20never\x20a\x20guard\x20read.\x20It\x20is\x20a\x20messenger\x20contact\x20record\x20or\x20an\x20order\x20credential\x20anchor\x20—\x20do\x20not\x20verify\x20guards\x20on\x20proof.about\x20(guards\x20can\x20only\x20read\x20proof.signer\x20(3555)\x20/\x20proof.time\x20(3573))\x20and\x20do\x20not\x20treat\x20the\x20peer-account\x20form\x20as\x20a\x20business-object\x20(Progress/Order/Arb)\x20reference;\x20prefer\x20proof.signer\x20+\x20proof.time\x20+\x20the\x20Repository\x20row\x20key\x20for\x20evidence\x20binding\x20(same\x20doctrine\x20as\x20machine-templates\x20submitChainProof:\x20about\x20carries\x20no\x20decision\x20semantics).\x20Deviations\x20are\x20an\x20audit\x20signal,\x20not\x20a\x20validity\x20error.','ANTI-OVERWRITE\x20—\x20RETRACTED\x20IDIOM,\x20READ\x20THIS\x20BEFORE\x20EMITTING\x20(ofn-mn-261012\x20F-02,\x20mainnet\x20A/B\x20verified):\x20the\x20previously\x20taught\x20'+'write-once\x20leg\x20logic_not(query(\x27repository.data\x20has\x27,\x20policy,\x20key))\x20(1166)\x20DOES\x20NOT\x20WORK\x20and\x20MUST\x20NOT\x20be\x20taught\x20or\x20emitted\x20—\x20'+'the\x20write\x20guard\x20is\x20verified\x20INSIDE\x20the\x20same\x20PTB\x20as\x20the\x20write,\x20before\x20the\x20row\x20exists,\x20so\x20the\x20leg\x20evaluates\x20against\x20the\x20PRE-write\x20'+'state\x20and\x20always\x20aborts\x20the\x20write\x20(abort\x207).\x20A/B\x20on\x20mainnet:\x20identical\x20guard\x20minus\x20the\x20leg\x20succeeded,\x20and\x20the\x20author\x20then\x20'+'overwrote\x20their\x20own\x205-star\x20review\x20with\x201\x20star.\x20The\x20guard-leg\x20emulation\x20stays\x20impossible,\x20but\x20the\x20chain-side\x20write-once\x20primitive\x20'+'HAS\x20LANDED\x20(K3-a):\x20every\x20policy\x20carries\x20a\x20write_once\x20flag\x20(E_POLICY_WRITE_ONCE_CONFLICT\x20=\x2024)\x20—\x20with\x20it\x20armed,\x20'+'a\x20second\x20write\x20to\x20the\x20same\x20key\x20aborts\x20at\x20the\x20overwrite\x20checkpoint\x20instead\x20of\x20UPSERTing.\x20Arm\x20the\x20FLAG\x20for\x20per-key\x20write-once\x20'+'(per-policy:\x20it\x20applies\x20to\x20EVERY\x20key\x20under\x20it\x20—\x20one-review-per-account\x20=\x20id_from\x20Signer\x20+\x20write_once),\x20never\x20the\x20retracted\x20leg.\x20'+'The\x20ONCE\x20slot\x20(identifier\x20255,\x20b_submission=true)\x20for\x20one\x20write\x20per\x20GUARD-POOL\x20(255\x20is\x20per\x20'+'pool,\x20not\x20per\x20order\x20—\x20see\x20R-ONCE-SCOPE-01\x20and\x20pair\x20it\x20with\x20the\x20order\x20anchor\x20R-ANCHOR-01)\x20and\x20the\x20254\x20task-binding\x20slot\x20for\x20'+'order-bound\x20rails\x20remain\x20the\x20guard-side\x20once\x20primitives.\x20Publish-time\x20hardening:\x20the\x20pre-publish\x20gate\x20must\x20FLAG\x20any\x20repository\x20write\x20guard\x20containing\x20'+'logic_not(repository.data\x20has\x20...)\x20as\x20INEFFECTIVE,\x20not\x20accept\x20it\x20(a\x20defence\x20that\x20cannot\x20be\x20enforced\x20is\x20worse\x20than\x20none).','TASK-BINDING\x20SLOT\x20(identifier\x20254,\x20chain\x20N-1):\x20a\x20Guard\x20consumed\x20by\x20a\x20task-bound\x20Progress\x20guarded\x20forward\x20MUST\x20DECLARE\x20the\x20254\x20slot\x20in\x20its\x20table\x20(b_submission=true)\x20—\x20the\x20caller\x20then\x20fills\x20it\x20with\x20the\x20Order\x20address\x20the\x20Progress\x20is\x20bound\x20to,\x20and\x20the\x20chain-side\x20task-binding\x20check\x20compares\x20them\x20(progress\x2011/12\x20on\x20absent/mismatch).\x20Chain\x20truth:\x20the\x20passport-submission\x20builder\x20DROPS\x20caller-supplied\x20slots\x20the\x20table\x20does\x20not\x20declare,\x20so\x20an\x20undeclared\x20254\x20can\x20never\x20reach\x20the\x20passport\x20—\x20declare\x20it\x20at\x20Guard\x20build\x20time,\x20there\x20is\x20no\x20post-hoc\x20fix\x20(Guards\x20are\x20immutable).\x20255\x20stays\x20opt-in\x20caller-chosen-key;\x20254\x20is\x20mandatory-but-self-reported\x20for\x20order-bound\x20rails.','ID_ROUTING\x20INTERACTS\x20WITH\x20THIS\x20GUARD\x20(the\x20policy-creation\x20validation):\x20id_from\x20NONE\x20(caller-supplied\x20data\x20id)\x20REQUIRES\x20a\x20non-empty\x20write_guard\x20list\x20—\x20that\x20is\x20precisely\x20the\x20case\x20this\x20pattern\x20exists\x20for,\x20because\x20the\x20caller\x20also\x20chooses\x20the\x20key\x20and\x20can\x20overwrite\x20anyone\x27s\x20row.\x20'+'With\x20id_from\x20Signer/Clock\x20the\x20id\x20is\x20auto-generated;\x20the\x20list\x20MAY\x20still\x20be\x20non-empty\x20(the\x20guard\x20authorizes\x20the\x20write\x20and\x20may\x20extract\x20the\x20value\x20via\x20data_from_submission),\x20but\x20every\x20PolicyGuard\x27s\x20id_from_submission\x20MUST\x20be\x20None,\x20'+'since\x20a\x20submission-derived\x20id\x20would\x20conflict\x20with\x20the\x20routing\x20(E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN\x20=\x2023).\x20Choosing\x20id_from=Signer\x20with\x20no\x20guard\x20is\x20the\x20HONEST\x20way\x20to\x20say\x20\x27anyone\x20may\x20write\x20their\x20OWN\x20row\x27;\x20binding\x20an\x20always-true\x20guard\x20under\x20id_from=None\x20is\x20the\x20dishonest\x20way,\x20and\x20is\x20what\x20R-X1-17\x20reports.','Writers\x20that\x20are\x20services\x20rather\x20than\x20EOAs\x20(an\x20oracle,\x20a\x20partner\x20merchant)\x20still\x20need\x20the\x20identity\x20leaf:\x20the\x20Signer\x20of\x20the\x20write\x20transaction\x20IS\x20the\x20caller,\x20so\x20a\x20submitted-Address\x20comparison\x20alone\x20(Type3)\x20is\x20forgeable\x20—\x20compare\x20context(Signer)\x20against\x20the\x20allowlist,\x20or\x20require\x20the\x20writer\x27s\x20Passport/Proof\x20via\x20the\x20data-shape\x20leaf.']},{'id':'pattern.repository_quote_guard_subscription','business_requirement':'Repository\x20data\x20access\x20requires\x20payment\x20proof\x20(subscription\x20revenue\x20model)','data_source':'SubmittedObject','host':'repository_write','verifier_level':'level3_scene_combined','logic_summary':'Repository\x20policy\x20sets\x20quote_guard\x20(a\x20standalone\x20repository-backed\x20guard:\x20immutable\x20+\x20rep=true).\x20'+'When\x20a\x20Guard\x20queries\x20this\x20Repository\x27s\x20data\x20(query\x201167),\x20check_repository_quote_guard\x20verifies\x20'+'the\x20quote_guard\x20is\x20in\x20impack_list.\x20The\x20quote_guard\x20itself\x20verifies\x20a\x20submitted\x20Payment\x20'+'(payment.info.for\x20matches\x20Repository,\x20payment.amount\x20meets\x20subscription\x20price).\x20'+'User\x20submits\x20Payment\x20via\x20Passport\x20→\x20quote_guard\x20verified\x20→\x20added\x20to\x20impack_list\x20→\x20query\x201167\x20passes.','key_queries':['repository.data','payment.info.for','payment.amount'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['VERIFIED:\x20the\x20passport\x20quote-guard\x20verification\x20runs\x20on\x20every\x20query\x201167\x20read\x20(the\x20quote_guard\x20must\x20be\x20in\x20impack_list)','Repository.owner_receive<T>\x20accepts\x20Payment\x20as\x20subscription\x20revenue','quote_guard\x20must\x20be\x20a\x20standalone\x20repository-backed\x20guard:\x20immutable=true,\x20relies\x20empty,\x20rep=true','VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20valid\x20Payment,\x20quote_guard\x20verifies\x20Payment\x20fields\x20—\x20no\x20object-linker\x20binding\x20needed','gen_passport\x20context:\x20quote_guard\x20fails\x20(impack_list\x20empty)\x20—\x20only\x20use\x20for\x20on-chain\x20business\x20operations','Business\x20model:\x20data\x20provider\x20publishes\x20weather/market/oracle\x20data\x20to\x20Repository,\x20'+'users\x20pay\x20subscription\x20to\x20access\x20data\x20in\x20their\x20Machine\x20flows','MODE\x20A\x20(direct\x20payment\x20verify)\x20—\x20four\x20verifiable\x20elements\x20on\x20the\x20submitted\x20Payment:\x20'+'1)\x20amount:\x20logic_as_u256_greater_or_equal[payment.amount,\x20N]\x20(>=\x20subscription\x20price);\x20'+'2)\x20subscription\x20type:\x20payment.info.remark\x20/\x20payment.info.index\x20encodes\x20the\x20tier/plan;\x20'+'3)\x20fixed\x20recipient:\x20payment.record.recipient\x20must\x20equal\x20the\x20designated\x20payee\x20(Treasury/owner\x20address);\x20'+'4)\x20occurrence\x20time:\x20payment.time\x20within\x20the\x20validity\x20window\x20(logic_as_u256_greater_or_equal\x20/\x20logic_as_u256_lesser_or_equal\x20vs\x20context(Clock))','Payment\x20is\x20freeze_object\x20after\x20creation\x20—\x20all\x20four\x20elements\x20are\x20tamper-proof\x20evidence','For\x20a\x20LOWER\x20user-cost\x20variant\x20(no\x20per-user\x20payment\x20submission),\x20see\x20pattern.repository_whitelist_sync\x20(Mode\x20B)']},{'id':'pattern.repository_whitelist_sync','business_requirement':'Entitlement\x20check\x20via\x20a\x20synced\x20allowlist\x20Repository\x20instead\x20of\x20per-user\x20payment\x20submission\x20(low-friction\x20entitlements:\x20memberships,\x20authorizations,\x20paid-user\x20lists)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'Off-chain\x20collector\x20gathers\x20eligible\x20users\x20(transfers\x20/\x20Payments\x20to\x20the\x20designated\x20receiving\x20address\x20or\x20object,\x20'+'Service\x20orders,\x20or\x20any\x20off-chain\x20record)\x20and\x20syncs\x20the\x20list\x20into\x20a\x20dedicated\x20Repository\x20object\x20'+'(entries\x20may\x20carry\x20a\x20validity\x20window,\x20e.g.\x20authorized\x20time\x20period).\x20'+'The\x20consuming\x20Guard\x20checks\x20membership\x20via\x20query\x201166/1167\x20(repository.data)\x20keyed\x20by\x20the\x20caller:\x20'+'vec_contains_address-style\x20logic_or\x20over\x20[repository.data(key=Signer)]\x20or\x20logic_equal[repository.data(...),\x20identifier[N](expected)].\x20'+'Repository\x20writes\x20go\x20through\x20the\x20id-keyed\x20data\x20write\x20operations\x20(batch\x20up\x20to\x20100\x20entries\x20per\x20tx).','key_queries':['repository.data'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['MODE\x20B\x20(whitelist\x20sync)\x20—\x20user-cost\x20optimization\x20of\x20Mode\x20A\x20(pattern.repository_quote_guard_subscription):\x20'+'users\x20do\x20NOT\x20submit\x20a\x20Payment\x20at\x20verification\x20time;\x20the\x20operator\x20proves\x20eligibility\x20off-chain\x20and\x20syncs\x20the\x20roster','TRADE-OFF:\x20eventual\x20consistency\x20—\x20the\x20roster\x20updates\x20at\x20the\x20collector\x27s\x20sync\x20frequency\x20(slight\x20delay),\x20'+'vs\x20Mode\x20A\x27s\x20instant\x20per-payment\x20proof.\x20Choose\x20by\x20business:\x20high-frequency\x20low-value\x20→\x20Mode\x20B;\x20'+'high-value\x20instant\x20entitlement\x20→\x20Mode\x20A','Entry\x20shape:\x20key\x20=\x20user\x20address\x20(or\x20derived\x20id),\x20value\x20=\x20expiry\x20timestamp\x20/\x20tier\x20/\x20scope;\x20'+'time-window\x20enforcement\x20compares\x20entry\x20value\x20against\x20context(Clock)\x20in\x20the\x20Guard','VERIFIED:\x20id-keyed\x20data\x20writes\x20(batch\x20≤100),\x20query\x201166/1167\x20(repository.data\x20queries),\x20'+'standalone-guard\x20marking\x20(1167\x20marks\x20query-only\x20repositories)','The\x20collector\x20can\x20source\x20eligibility\x20from:\x20transfers\x20or\x20Payments\x20to\x20a\x20fixed\x20receiving\x20address/object,\x20'+'Service\x20orders\x20(order.service\x20==\x20designated\x20service),\x20or\x20external\x20off-chain\x20records','Repository\x20access\x20economics\x20stay\x20OUT\x20of\x20this\x20pattern\x20(K3\x2010\x20§5\x20D5\x20ruling:\x20reuse\x20Reward/Allocation\x20'+'outside\x20the\x20Repository\x20for\x20payment;\x20the\x20Repository\x20here\x20is\x20the\x20roster,\x20not\x20the\x20payment\x20rail)']},{'id':'pattern.supply_chain_suborder_verification','business_requirement':'Sub-service\x20purchase\x20requires\x20ownership\x20of\x20main\x20service\x20order\x20(supply\x20chain\x20milestone\x20unlock)','data_source':'SubmittedObject','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'Sub-service\x20buy_guard\x20verifies\x20submitted\x20main\x20Order:\x20'+'logic_and[logic_equal[query(order.owner),\x20context(Signer)],\x20logic_equal[query(order.service),\x20identifier[N](main_service_address)]].\x20'+'User\x20submits\x20main\x20Order\x20via\x20Passport\x20(b_submission=true),\x20buy_guard\x20verifies\x20ownership\x20+\x20service\x20match.','key_queries':['order.owner','order.service'],'mitigated_risks':['R-C3-05'],'applicable_industries':['travel','rental','education','freelance'],'notes':['VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20main\x20Order\x20as\x20evidence,\x20buy_guard\x20verifies\x20order.owner==Signer\x20AND\x20order.service==main_service','Each\x20milestone\x20=\x20one\x20sub-order\x20with\x20its\x20own\x20Service\x20+\x20buy_guard\x20referencing\x20the\x20main\x20order','Main\x20flow\x20can\x20branch\x20to\x20different\x20sub-services\x20based\x20on\x20Machine\x20node\x20progression','No\x20parent_order\x20field\x20needed\x20—\x20relationship\x20verified\x20via\x20buy_guard\x20querying\x20submitted\x20Order\x20fields','Enables\x20supply\x20chain\x20composition:\x20main\x20service\x20→\x20multiple\x20sub-services\x20with\x20conditional\x20access']},{'id':'pattern.payment_exception_compensation','business_requirement':'Exception\x20branch\x20triggers\x20compensation\x20Payment\x20(e.g.,\x20delivery\x20delay\x20>\x2030min\x20auto-compensates\x20customer)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Exception\x20forward\x20guard\x20verifies\x204-dimensional\x20anti-reuse\x20binding:\x20logic_and['+'logic_equal[query(payment.info.for),\x20identifier[N](order_address)],\x20'+'logic_equal[query(payment.info.guard),\x20identifier[N](this_guard_address)],\x20'+'logic_as_u256_greater_or_equal[query(payment.amount),\x20identifier[N](compensation_amount)],\x20'+'logic_as_u256_equal[query(payment.info.index),\x20query(progress.history\x20count)],\x20'+'logic_string_nocase_equal[query(payment.info.remark),\x20query(progress.current)]].\x20'+'Treasury\x20withdraws\x20to\x20customer\x20with\x20PaymentInfo(for_object=order,\x20for_guard=this,\x20index=history_count_at_creation,\x20remark=node_name).\x20'+'Customer\x20submits\x20Payment\x20via\x20Passport;\x20guard\x20verifies\x20index\x20matches\x20current\x20unique\x20step\x20(progress.history\x20count,\x20U64,\x20monotonically\x20increasing\x20—\x20unique\x20even\x20in\x20cycles)\x20AND\x20remark\x20matches\x20current\x20node\x20name\x20(progress.current,\x20String\x20—\x20may\x20repeat\x20across\x20cycles\x20but\x20bound\x20to\x20this\x20step\x20by\x20index).','key_queries':['payment.info.for','payment.info.guard','payment.info.index','payment.info.remark','payment.amount','progress.history\x20count','progress.current'],'mitigated_risks':[],'applicable_industries':['rental','travel','general','freelance'],'notes':['VERIFIED:\x20PaymentInfo\x20(for_object,\x20for_guard,\x20remark,\x20index),\x20payment_info_with_guard','VERIFIED:\x20withdraw\x20creates\x20the\x20Payment\x20as\x20a\x20fresh\x20singleton\x20object\x20from\x20the\x20withdrawn\x20object\x20set','Payment\x20is\x20freeze_object\x20(immutable)\x20—\x20cannot\x20be\x20modified\x20after\x20creation','VERIFIED\x20INDEX\x20QUERY:\x20progress.history\x20count\x20(id\x201273,\x20U64)\x20—\x20the\x20accomplish\x20transition\x20pushes\x20ONE\x20History\x20entry\x20per\x20completed\x20node\x20TRANSITION,\x20not\x20per\x20forward:\x20one\x20entry\x27s\x20session\x20snapshot\x20can\x20contain\x20several\x20accomplished\x20forwards,\x20and\x20sub-threshold\x20forwards\x20stay\x20in\x20the\x20live\x20progress.session\x20with\x20NO\x20history\x20entry.\x20After\x20the\x20push\x20the\x20entry\x20lands\x20(session\x20cleared,\x20current\x20=\x20next_node);\x20the\x20history\x20length\x20returns\x20the\x20current\x20session\x20id.\x20Strictly\x20monotonic:\x20the\x20vector\x20push\x20keys\x20by\x20length\x20with\x20no\x20removal\x20path\x20—\x20even\x20in\x20cycles,\x20each\x20entry\x20has\x20a\x20different\x20count.','VERIFIED\x20HISTORY\x20INDEXING\x20RULE\x20(the\x20on-chain\x20guard\x20checks\x20run\x20BEFORE\x20the\x20history\x20push\x20—\x20verification\x20precedes\x20the\x20accomplish\x20step):\x20during\x20a\x20guard\x20check\x20the\x20LAST\x20entry\x20is\x20the\x20transition\x20that\x20ENTERED\x20the\x20current\x20node\x20—\x20history[last].next_node\x20==\x20progress.current,\x20and\x20its\x20session\x20snapshot\x20holds\x20the\x20forwards\x20accomplished\x20to\x20get\x20there.\x20history[last].node\x20is\x20the\x20node\x20just\x20LEFT,\x20so\x20\x27last\x20entry\x20.node\x20==\x20current\x20node\x27\x20is\x20WRONG;\x20likewise\x20forwards\x20completed\x20on\x20the\x20current\x20node\x20after\x20arrival\x20live\x20in\x20the\x20live\x20session\x20(progress.session*\x20queries),\x20never\x20in\x20history.\x20hold/unhold\x20never\x20push\x20(the\x20hold\x20entry\x20never\x20records\x20history).','VERIFIED\x20NODE\x20NAME\x20QUERY:\x20progress.current\x20(id\x201253,\x20String).\x20Returns\x20the\x20current\x20node\x20name.\x20A\x20node\x20CAN\x20be\x20entered\x20multiple\x20times\x20in\x20cycles,\x20so\x20node\x20name\x20alone\x20is\x20NOT\x20unique\x20—\x20it\x20MUST\x20be\x20paired\x20with\x20progress.history\x20count\x20for\x20uniqueness.','DESIGN\x20INTENT\x20(USER):\x20to\x20validate\x20index\x20(U64\x20type),\x20use\x20progress.history\x20count\x20(unique,\x20non-repeating);\x20to\x20validate\x20node\x20name\x20(may\x20repeat\x20in\x20cycles),\x20store\x20it\x20in\x20PaymentInfo.remark\x20and\x20do\x20string\x20comparison\x20with\x20progress.current.','ANTI-REUSE\x204-DIMENSIONAL\x20BINDING:\x20for_object\x20(Order)\x20+\x20for_guard\x20(Guard)\x20+\x20index\x20(unique\x20step\x20via\x20progress.history\x20count)\x20+\x20remark\x20(node\x20name\x20via\x20progress.current).\x20Same\x20Payment\x20cannot\x20be\x20reused\x20in\x20other\x20contexts\x20—\x20at\x20least\x20one\x20field\x20will\x20mismatch.','VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context','Enables\x20user-friendly\x20exception\x20handling:\x20delay\x20→\x20auto-compensation\x20→\x20friendly\x20branch\x20flow','No\x20object-linker\x20binding\x20registration\x20needed\x20—\x20guard\x20only\x20verifies\x20submitted\x20Payment\x27s\x20field\x20accuracy']},{'id':'pattern.goodwill_refund_rail','business_requirement':'A\x20GOODWILL\x20refund\x20(merchant\x20appeasement\x20—\x20not\x20a\x20ruling,\x20not\x20a\x20fulfillment\x20failure)\x20must\x20ride\x20an\x20independent\x20money\x20path\x20so\x20it\x20never\x20drains\x20the\x20order\x20escrow,\x20and\x20its\x20side\x20effect\x20on\x20the\x20order\x27s\x20own\x20refund\x20rail\x20must\x20be\x20declared\x20(gfm31\x20ruling\x202026-10-27,\x20user-approved)','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Two\x20independent\x20money\x20paths\x20on\x20one\x20order.\x20GOODWILL\x20PATH:\x20the\x20compensation-fund\x20payout\x20(order\x20compensate)\x20—\x20funds\x20leave\x20the\x20merchant-owned\x20compensation\x20fund,\x20NEVER\x20the\x20escrow;\x20the\x20payout\x20WRITES\x20order.claimed_by.\x20ESCROW\x20PATH:\x20the\x20order-anchored\x20refund\x20rail\x20gates\x20on\x20order.claimed_by\x20some\x20==\x20false\x20(query\x20id\x201570,\x20Bool),\x20so\x20the\x20first\x20payout\x20on\x20EITHER\x20path\x20polarity-seals\x20the\x20other\x20(D-BUG-2).\x20After\x20compensate,\x20the\x20escrow\x20principal\x20exits\x20only\x20via\x20the\x20recover\x20rail\x20(claimed_by\x20some\x20==\x20true,\x20NO\x20node-equality\x20leg\x20—\x20UPWC-K1).','key_queries':['order.claimed_by','order.amount','payment.info.for'],'mitigated_risks':['R-X1-17'],'applicable_industries':['general','freelance','retail','travel'],'notes':['INDEPENDENT\x20PLUMBING:\x20the\x20compensation\x20fund\x20is\x20the\x20goodwill-refund\x20rail\x20—\x20a\x20compensate\x20payout\x20draws\x20from\x20the\x20fund\x20the\x20merchant\x20topped\x20up,\x20never\x20from\x20the\x20buyer\x27s\x20escrowed\x20price.\x20Never\x20route\x20goodwill\x20through\x20the\x20order\x27s\x20refund\x20allocation:\x20that\x20drains\x20the\x20escrow\x20the\x20settlement/recover\x20rails\x20still\x20need\x20to\x20be\x20solvent\x20against.','THE\x20TRAP\x20(gfm31):\x20compensate\x20WRITES\x20order.claimed_by,\x20which\x20polarity-CLOSES\x20every\x20claimed_by-none\x20rail\x20on\x20the\x20order\x20—\x20including\x20the\x20buyer\x27s\x20own\x20refund\x20rail.\x20A\x20goodwill\x20payout\x20executed\x20mid-journey\x20re-seals\x20the\x20order\x20into\x20recover-only\x20shape:\x20if\x20the\x20buyer\x20then\x20legitimately\x20returns\x20the\x20goods,\x20the\x20refund\x20rail\x20can\x20no\x20longer\x20fire\x20(claimed_by\x20is\x20set)\x20and\x20the\x20escrow\x20principal\x20exits\x20to\x20the\x20MERCHANT\x20via\x20recover_gate.\x20The\x20buyer\x20is\x20then\x20made\x20whole\x20only\x20by\x20a\x20SECOND\x20compensate\x20or\x20off-chain\x20settlement.','THEREFORE\x20—\x20FINAL-REMEDY\x20DISCIPLINE:\x20execute\x20compensate\x20ONLY\x20when\x20the\x20dispute\x20is\x20truly\x20over\x20(terminal\x20state\x20reached,\x20or\x20the\x20merchant\x20explicitly\x20waives\x20return\x20rights\x20for\x20this\x20order).\x20A\x20premature\x20goodwill\x20refund\x20is\x20an\x20irreversible\x20polarity\x20switch,\x20not\x20a\x20courtesy\x20note.\x20Disclose\x20this\x20wherever\x20a\x20build\x20guide\x20offers\x20a\x20compensation_fund_topup\x20step.','PAIR\x20WITH\x20THE\x20ESCROW-EXIT\x20INVARIANT\x20(az-mn-261007,\x20D-BUG-2):\x20exactly\x20one\x20of\x20refund\x20(claimed_by\x20some\x20==\x20false)\x20/\x20recover\x20(some\x20==\x20true)\x20can\x20ever\x20pass;\x20compensate\x20flips\x20the\x20order\x20into\x20the\x20some==true\x20world,\x20recover_gate\x20sweeps\x20the\x20principal\x20to\x20the\x20merchant,\x20and\x20any\x20further\x20buyer\x20remedy\x20rides\x20the\x20fund\x20again.','FUND\x20SOLVENCY:\x20a\x20compensate\x20payout\x20fails\x20when\x20the\x20fund\x20is\x20empty\x20—\x20size\x20the\x20fund\x20against\x20the\x20expected\x20goodwill\x20volume\x20at\x20deploy\x20(the\x20fund-sizing\x20deploy-time\x20check)\x20and\x20re-top\x20via\x20the\x20fund\x27s\x20own\x20receive\x20path;\x20the\x20escrow\x20NEVER\x20silently\x20covers\x20the\x20shortfall.','NO-CHAIN-CHANGE:\x20this\x20pattern\x20uses\x20only\x20order.claimed_by\x20polarity\x20+\x20the\x20existing\x20compensate\x20op\x20—\x20no\x20new\x20chain\x20primitive\x20required.']},{'id':'pattern.partial_refund_pricing','business_requirement':'A\x20PARTIAL\x20refund\x20(missing/short\x20item,\x20late-delivery\x20or\x20quality\x20compensation\x20—\x20not\x20a\x20full\x20return,\x20not\x20the\x20kill\x20fee)\x20needs\x20a\x20PRICING\x20AUTHORITY:\x20the\x20amount\x20must\x20originate\x20from\x20a\x20source\x20both\x20parties\x20answered\x20to,\x20never\x20from\x20the\x20executing\x20keeper\x27s\x20judgement\x20(拍板④\x20mtw-261027,\x20user-approved)','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Amount\x20evidence\x20BEFORE\x20money\x20movement.\x20SANCTIONED\x20PRICING\x20SOURCES\x20(exactly\x20two):\x20(1)\x20an\x20arbitration\x20ruling\x20—\x20the\x20on-chain\x20Arb\x20indemnity\x20IS\x20the\x20priced\x20amount;\x20(2)\x20a\x20Messenger\x20quote\x20→\x20buyer\x20confirmation\x20→\x20WTS\x20evidence:\x20the\x20merchant\x20quotes\x20the\x20partial\x20amount\x20in\x20the\x20order\x27s\x20IM\x20thread,\x20the\x20buyer\x20confirms\x20IN\x20THE\x20SAME\x20THREAD,\x20and\x20the\x20thread\x27s\x20WTS\x20evidence\x20file\x20(verifiable,\x20tamper-evident)\x20is\x20the\x20pricing\x20record\x20—\x20its\x20Proof\x20address\x20rides\x20the\x20order-keyed\x20evidence\x20Repository\x20row\x20so\x20the\x20executing\x20guard\x20or\x20keeper\x20reads\x20the\x20amount\x20from\x20a\x20record,\x20not\x20from\x20memory.\x20The\x20Amount-track\x20allocator\x20leg\x20then\x20pays\x20exactly\x20the\x20evidenced\x20value;\x20the\x20remnant-settlement\x20leg\x20must\x20be\x20defined\x20in\x20the\x20same\x20build\x20(a\x20full-amount\x20settle\x20rail\x20would\x20pay\x20the\x20refunded\x20share\x20out\x20again).','key_queries':['order.amount','order.claimed_by','repository.data'],'mitigated_risks':[],'applicable_industries':['delivery','group_buy','retail','general'],'notes':['THE\x20GAP\x20(mtw\x20R-07):\x20shipped\x20templates\x20model\x20refund\x20as\x20two\x20states\x20(full\x20refund\x20/\x20kill\x20fee);\x20the\x20high-frequency\x20small\x20remedies\x20delivery\x20and\x20group-buy\x20orders\x20actually\x20need\x20(one\x20missing\x20item,\x20ten\x20minutes\x20late)\x20have\x20NO\x20shape.\x20The\x20Amount\x20track\x20fully\x20supports\x20partial\x20rails\x20on-chain\x20—\x20the\x20missing\x20piece\x20is\x20the\x20pricing\x20discipline,\x20not\x20the\x20mechanism.','KEEPER\x20DUTY\x20(拍板④):\x20the\x20executing\x20keeper\x20NEVER\x20invents\x20the\x20number.\x20A\x20partial\x20amount\x20without\x20a\x20ruling\x20or\x20a\x20WTS-evidenced\x20quote+confirmation\x20is\x20unauditable\x20self-dealing\x20—\x20refuse\x20it\x20and\x20route\x20the\x20counterparties\x20to\x20the\x20quote\x20flow.\x20The\x20delivery\x20and\x20group_buy\x20template\x20keeper_duty\x20rows\x20carry\x20this\x20duty\x20verbatim.','WTS\x20IS\x20THE\x20PRICING\x20RECORD:\x20the\x20Messenger\x20thread\x20gives\x20a\x20verifiable,\x20timestamped\x20quote→confirmation\x20pair\x20(WTS\x20evidence\x20file\x20+\x20message-authenticity\x20check);\x20parking\x20the\x20Proof\x20address\x20on\x20the\x20order-keyed\x20evidence\x20row\x20makes\x20the\x20amount\x20readable\x20by\x20the\x20same\x20guard\x20machinery\x20that\x20reads\x20handover\x20evidence\x20—\x20no\x20new\x20primitive\x20required\x20today.','DUAL-SIGN\x20IS\x20THE\x20LONG-TERM\x20CURE\x20(拍板④\x20option\x20C,\x20protocol\x20train):\x20buyer\x20co-signature\x20on\x20the\x20refund\x20allocation\x20itself\x20—\x20a\x20chain-native\x20two-party\x20pricing\x20primitive\x20—\x20is\x20filed\x20for\x20a\x20future\x20protocol\x20window;\x20until\x20then\x20the\x20WTS-evidenced\x20quote\x20is\x20the\x20sanctioned\x20stand-in,\x20disclosed\x20as\x20such.','REMNANT\x20SETTLEMENT:\x20define\x20what\x20happens\x20to\x20the\x20balance\x20AFTER\x20the\x20partial\x20refund\x20in\x20the\x20SAME\x20build\x20—\x20a\x20full-amount\x20settle\x20rail\x20would\x20pay\x20the\x20merchant\x20the\x20refunded\x20share\x20too;\x20either\x20subtract\x20the\x20partial\x20amount\x20from\x20the\x20settle\x20leg\x20(Amount\x20math)\x20or\x20route\x20the\x20remainder\x20through\x20the\x20existing\x20claimed_by-polarity\x20pair.','PAIR\x20WITH\x20GOODWILL\x20(pattern.goodwill_refund_rail):\x20a\x20goodwill\x20compensate\x20WRITES\x20order.claimed_by\x20and\x20polarity-seals\x20the\x20claimed_by-none\x20refund\x20rails\x20—\x20before\x20executing\x20ANY\x20partial\x20remedy,\x20check\x20which\x20rail\x20the\x20amount\x20will\x20travel:\x20the\x20polarity\x20cost\x20is\x20irreversible\x20(D-BUG-2).']},{'id':'pattern.verifier_evidence_philosophy','business_requirement':'Guard\x20design\x20philosophy:\x20verifier\x20provides\x20evidence,\x20guard\x20verifies\x20logic\x20+\x20data\x20accuracy\x20(NOT\x20data\x20discovery)','data_source':'SubmittedObject','host':'gen_passport','verifier_level':'none','logic_summary':'Guard\x20is\x20a\x20PURE\x20VERIFICATION\x20engine.\x20Participants\x20submit\x20evidence\x20(Payment,\x20Order,\x20Proof,\x20etc.)\x20'+'via\x20Passport\x20submissions\x20(b_submission=true).\x20Guard\x20verifies:\x20(1)\x20logic\x20completeness,\x20(2)\x20data\x20usage\x20accuracy.\x20'+'Guard\x20does\x20NOT\x20discover/fetch\x20objects\x20via\x20object-linker\x20binding.\x20object-linker\x20binding\x20is\x20for\x20object\x20lifecycle\x20bookkeeping,\x20'+'NOT\x20for\x20guard\x20data\x20discovery.','key_queries':[],'mitigated_risks':['R-C3-05','R-C3-06'],'notes':['CORE\x20PRINCIPLE:\x20Guard\x20only\x20validates\x20submitted\x20evidence\x20—\x20it\x20never\x20fetches\x20data\x20on\x20its\x20own','For\x20Payment\x20verification:\x20user\x20submits\x20valid\x20Payment\x20→\x20guard\x20checks\x20for_object/for_guard/index\x20match','For\x20multi-order\x20verification:\x20verifier\x20submits\x20Order\x20data\x20→\x20guard\x20checks\x20service/owner\x20relationships','For\x20Repository\x20access:\x20user\x20submits\x20Payment\x20→\x20quote_guard\x20verifies\x20→\x20impack_list\x20updated\x20→\x20data\x20query\x20passes','Type\x203\x20(SubmittedObject)\x20data\x20source\x20class\x20embodies\x20this\x20philosophy\x20—\x20b_submission=true\x20entries','This\x20pattern\x20is\x20foundational\x20for\x20all\x20guard\x20designs\x20—\x20always\x20prefer\x20verifier-evidence\x20over\x20complex\x20object\x20discovery']},{'id':'pattern.progress_state_check','business_requirement':'Specific\x20forward\x20has\x20been\x20accomplished\x20(customer\x20confirms\x20delivery)','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_progress_history_find(...).accomplished,\x20identifier[N](true)]','key_queries':['progress.current','progress.current_time','progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Chain\x20query_progress_history_find\x20→\x20query_progress_history_session_forward_find','SATISFIABILITY\x20DISCIPLINE\x20(Airbnb\x20§4:\x20an\x20unsatisfiable\x20claim\x20guard\x20sealed\x20all\x20five\x20fund\x20rails):\x20'+'bool\x20fields\x20compare\x20against\x20a\x20bool\x20constant\x20—\x20logic_equal[field,\x20identifier[N](true)]\x20—\x20never\x20against\x20'+'a\x20numeric/address\x20constant;\x20VECTOR\x20membership\x20is\x20existential\x20—\x20write\x20has\x20/\x20count>0\x20for\x20\x27a\x20claim\x20exists\x27\x20'+'and\x20NOT(has)\x20for\x20\x27no\x20claim\x20yet\x27\x20(e.g.\x20order.claimed_by),\x20never\x20an\x20element-wise\x20==false,\x20which\x20is\x20'+'vacuously\x20true\x20on\x20an\x20empty\x20vector\x20and\x20seals\x20the\x20rail\x20it\x20gates.\x20Static\x20folding\x20(R-X1-17\x20always_true/'+'always_false\x20+\x20guard-leaf-eval\x20GL\x20codes)\x20catches\x20literal\x20contradictions\x20at\x20publish\x20time,\x20but\x20it\x20CANNOT\x20'+'prove\x20a\x20dynamic\x20query\x20satisfiable\x20—\x20a\x20guard\x20that\x20is\x20satisfiable-in-theory\x20only\x20when\x20a\x20condition\x20no\x20'+'participant\x20can\x20ever\x20produce\x20is\x20still\x20a\x20dead\x20rail;\x20pair\x20every\x20state\x20check\x20with\x20the\x20business\x20flow\x20that\x20'+'reaches\x20it.','REWARD\x20REPLAY\x20GATE\x20(host\x20\x27reward\x27\x20claims\x20—\x20klk-ln-261011\x20F15/F16\x20+\x20ofn-mn-261012\x20F-01\x20+\x20klk-mn-261013\x20F-05\x20+\x20azx7-mn-261014\x20T8):\x20the\x20claim\x20guard\x20root\x20MUST\x20carry\x20a\x20record\x20gate\x20+\x20an\x20order.owner\x20identity\x20leg\x20+\x20the\x20BKN-P2\x20positive-amount\x20leg.\x20claim()\x20pays\x20the\x20recipient\x20for\x20Recipient::Signer\x20(tx_context::sender)\x20with\x20no\x20order\x20binding\x20of\x20its\x20own,\x20so\x20without\x20the\x20identity\x20leg\x20any\x20address\x20holding\x20any\x20order\x20at\x20the\x20required\x20node\x20drains\x20the\x20pool\x20(audit-261012\x20B5).\x20RECIPIENT\x20SEMANTICS\x20(crs-mn-261015\x20F-12,\x20live\x20mainnet):\x20the\x20reward.guard_add\x20ENTRY\x20recipient\x20MUST\x20be\x20{Signer:\x27signer\x27}\x20(or\x20an\x20{Entity}\x20—\x20the\x20SDK\x20replaces\x20it\x20with\x20the\x20claimant\x27s\x20local\x20account\x20at\x20claim\x20time);\x20a\x20{GuardIdentifier}\x20recipient\x20resolves\x20from\x20the\x20passport\x20submission\x20(conventionally\x20the\x20submitted\x20Order\x20address)\x20and\x20can\x20never\x20equal\x20the\x20tx\x20sender,\x20so\x20every\x20claim\x20aborts\x2014\x20(E_CLAIM_RECIPIENT_NOT_SIGNER)\x20—\x20the\x20order-anchor\x20GuardIdentifier(0)\x20idiom\x20is\x20an\x20Allocation\x20push\x20rail,\x20NEVER\x20a\x20reward\x20pull\x20rail\x20(the\x20MCP\x20guard_add\x20recipient\x20gate\x20rejects\x20it).\x20'+SV2_PRIMARY_FORM_CLAUSE+SV2_DELIBERATE_ALTERNATIVE_CLAUSE+'STAMP\x20ENFORCEMENT\x20LAYER:\x20the\x20MCP\x20guard_add\x20stamp\x20gate\x20(UPW-K7)\x20rejects\x20record-consuming\x20entries\x20that\x20omit\x20store_from_id;\x20the\x20chain\x20validates\x20compatibility\x20only\x20when\x20the\x20stamp\x20IS\x20provided\x20—\x20an\x20unstamped\x20entry\x20accepted\x20outside\x20the\x20tool\x20layer\x20never\x20keys\x20its\x20records\x20per\x20order.\x20Re-adding\x20the\x20same\x20guard\x20overwrites\x20its\x20slot\x20in\x20place\x20(live\x20pools\x20repairable).\x20'+'NEVER\x20hand-write\x20the\x20RAW\x20query\x20form\x20(query\x201629)\x20with\x20an\x20empty\x20VecU8\x20parameter:\x20empty\x20query\x20bytes\x20reach\x20the\x20native\x20untranslated\x20and\x20abort\x20with\x20an\x20uncoded\x20'+'MovePrimitiveRuntimeError\x20(\x27Query\x20bytes\x20is\x20empty\x27)\x20—\x20klook-mn-261013\x20probed\x20all\x20raw\x20shapes,\x20every\x20one\x20failed\x20(the\x20deployed\x20guard\x20entry\x20also\x20accepts\x20the\x20empty\x20'+'constant\x20at\x20creation,\x20so\x20the\x20failure\x20surfaces\x20only\x20at\x20first\x20verification).\x20A\x20bare\x20query\x20WITHOUT\x20logic_not\x20is\x20PSEUDO-protection\x20'+'(guard-risk\x20R-X1-14\x20flags\x20it);\x20template-scanner\x20R-REWARD-REPLAY\x20and\x20compile\x20REVIEW_REWARD_UNARMED\x20block\x20the\x20un-armed\x20forms.\x20'+'ABORT-PATH\x20DISAMBIGUATION\x20(klk-mn-261014):\x20a\x20replay\x20submitted\x20with\x20the\x20REGISTERED\x20guard\x20aborts\x20at\x20passport\x20verification\x20(E_VERIFY_FAILED=7)\x20BEFORE\x20the\x20claim\x20entry\x20—\x20observing\x20E_VERIFY_FAILED\x20does\x20NOT\x20tell\x20you\x20whether\x20the\x20native\x20once-slot\x20is\x20deployed;\x20E_GUARD_NOT_FOUND\x20is\x20also\x207\x20but\x20a\x20DIFFERENT\x20failure\x20(the\x20submitted\x20guard\x20object\x20is\x20not\x20the\x20registered\x20one).\x20The\x20native\x20once-slot\x20(MOV-PROTOCOL-1212:\x20per-(recipient,\x20guard,\x20bcs(store_from))\x20slot,\x20E_CLAIM_ALREADY_MADE=13,\x20plus\x20recipient==signer,\x20E_CLAIM_RECIPIENT_NOT_SIGNER=14)\x20is\x20the\x20second\x20line,\x20reached\x20only\x20by\x20guards\x20without\x20a\x20record\x20leg\x20—\x20check\x20its\x20deployment\x20freshness\x20via\x20wowok_buildin_info\x20upgrade_check\x20(build_stamp.chain_stamp,\x20DEPLOY-K1)\x20instead\x20of\x20assuming\x20lag.\x20'+'Do\x20NOT\x20reference\x20repository.data\x20record\x20counts\x20(F-02:\x20upsert\x20+\x20same-PTB\x20read).\x20The\x20query\x20where-filter\x20and\x20the\x20'+'reward.guard_add\x20store_from_id\x20STAMP\x20are\x20DIFFERENT\x20fields:\x20the\x20STAMP\x20is\x20mandatory\x20for\x20record-consuming\x20guards\x20(slot\x200\x20=\x20the\x20submitted\x20Order\x20address\x20is\x20the\x20conventional\x20per-order\x20stamp).','PER-ORDER\x20ENTITLEMENT\x20ROW\x20(WINDOW-1\x20tier-predicate\x20half):\x20tier-scoped\x20promises\x20(\x27tier\x20X\x20enjoys\x20Y\x27)\x20have\x20no\x20constructible\x20'+'leg\x20while\x20guards\x20read\x20only\x20Service-level\x20state\x20—\x20Reward\x20objects\x20are\x20Service-level\x20and\x20sales\x20rows\x20carry\x20no\x20reward\x20field.\x20The\x20'+'constructive\x20form:\x20write\x20a\x20per-order\x20entitlement\x20row\x20at\x20settle\x20time\x20(key\x20=\x20order\x20id,\x20value\x20=\x20U256\x20tier\x20id,\x20riding\x20the\x20SAME\x20'+'settle-evidence\x20write\x20as\x20the\x20PAID-state\x20leg)\x20and\x20arm\x20the\x20tier\x27s\x20claim\x20guard\x20with\x20a\x20keys_where\x20presence\x20leg\x20on\x20that\x20row.\x20The\x20'+'honor\x20guard\x27s\x20historical\x20period\x20count\x20is\x20tier-agnostic\x20by\x20construction;\x20the\x20row\x20is\x20the\x20ONLY\x20tier\x20evidence\x20a\x20guard\x20predicate\x20'+'can\x20read\x20—\x20upgrade\x20tier\x20wording\x20to\x20constructive\x20exactly\x20when\x20the\x20row\x20+\x20leg\x20exist,\x20else\x20drop\x20the\x20wording.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.','POSITIVE-AMOUNT\x20LEG\x20(host\x20\x27reward\x27\x20claims\x20—\x20BKN-P2,\x20v55):\x20a\x20reward\x20claim\x20root\x20MUST\x20carry\x20logic_as_u256_greater_or_equal['+'query(order.amount),\x20identifier[N](1)]\x20—\x20a\x20zero-total\x20order\x20(a\x20100%-off/zeroing\x20coupon\x20buy)\x20holds\x20an\x20EMPTY\x20escrow,\x20so\x20without\x20this\x20leg\x20a\x20'+'zero-cost\x20buy\x20clears\x20the\x20review\x20node\x20and\x20claims\x20the\x20bounty\x20(the\x20bkmn\x20F-M39/T6\x20arbitrage).\x20The\x20coupon\x20side\x20is\x20floored\x20at\x20issuance\x20(zeroing\x20'+'coupons\x20are\x20blocked\x20unless\x20the\x20free\x20tier\x20is\x20declared\x20via\x20allow_zero_total);\x20this\x20leg\x20is\x20the\x20second\x20half\x20of\x20the\x20pair\x20—\x20never\x20drop\x20it\x20when\x20'+'specializing\x20the\x20root.\x20template-scanner\x20R-REWARD-ZERO-ORDER\x20audits\x20the\x20template\x20face.','ARBITRATION\x20PAIRING\x20RAILS\x20(claimed_by\x20none/some\x20—\x20BKN-P1\x20decision\x20option\x20a,\x20RESTATED\x20post-BF-14,\x20esln-261023-iiv4):\x20the\x20pairing\x20keys\x20on\x20'+'\x27a\x20NON-ZERO\x20buyer-favored\x20award\x20was\x20claimed\x27,\x20not\x20on\x20\x27a\x20ruling\x20happened\x27.\x20Since\x20BF-14\x20(the\x20zero-indemnity\x20claim\x20gate\x20asserted\x20at\x20the\x20arbitration\x20finish\x20entry\x20BEFORE\x20any\x20state\x20change)\x20'+'a\x20zero-award\x20dismissal\x20claim\x20aborts\x20E_ZERO_INDEMNITY_CLAIM,\x20so\x20on\x20a\x20ruled-zero\x20claimed_by\x20stays\x20UNSET\x20'+'and\x20the\x20refund\x20leg\x20(claimed_by\x20none)\x20stays\x20LIVE\x20—\x20the\x20dismissed\x20buyer\x20keeps\x20the\x20normal\x20reject/cancel\x20refund\x20right;\x20the\x20old\x20\x27ruled-zero\x20'+'seal\x27\x20(a\x20zero\x20award\x20also\x20writing\x20claimed_by\x20and\x20sweeping\x20the\x20principal\x20to\x20the\x20merchant\x20Entity)\x20NO\x20LONGER\x20EXISTS\x20—\x20do\x20not\x20teach\x20it.\x20The\x20'+'live\x20trade-off\x20sits\x20on\x20the\x20BUYER-WIN\x20branch\x20instead:\x20once\x20the\x20fund\x20indemnity\x20is\x20claimed,\x20the\x20refund\x20leg\x20polarity-closes\x20and\x20the\x20paired\x20'+'merchant-recovery\x20leg\x20(claimed_by\x20some)\x20is\x20the\x20ONLY\x20escrow\x20exit\x20—\x20sweeping\x20the\x20principal\x20to\x20the\x20merchant\x20Entity\x20on\x20the\x20very\x20ruling\x20the\x20'+'buyer\x20won\x20(esln\x20F-ESL-11).\x20A\x20literal\x20award-amount\x20polarity\x20gate\x20is\x20still\x20NOT\x20expressible\x20on\x20the\x20refund\x20track\x20(the\x20refund\x20rail\x20cannot\x20'+'hold\x20an\x20Arb\x20slot\x20to\x20read\x20the\x20ruling\x20amount),\x20so\x20the\x20pairing\x20stays:\x20its\x20guarantee\x20is\x20NO-STRANDING\x20(every\x20escrow\x20keeps\x20exactly\x20one\x20exit),\x20'+'not\x20NO-MISALLOCATION\x20—\x20disclose\x20BOTH\x20branches\x20to\x20the\x20merchant\x20whenever\x20arming\x20tpl_allocator_node_gate_refund\x20/\x20'+'tpl_allocator_node_gate_recover.\x20Direction-split\x20machinery\x20(winner-aware\x20escrow\x20interlock)\x20is\x20PERMANENTLY\x20DECLINED\x20per\x20the\x20'+'ROLES.md\x20independent-commerce\x20ruling\x20(ofn5\x20F-05,\x202026-10-23):\x20the\x20pairing\x20stays\x20a\x20MERCHANT\x20choice;\x20the\x20MCP-side\x20dual-payout\x20'+'confirmation\x20gate\x20(amz9\x20A-1)\x20is\x20the\x20sanctioned\x20disclosure\x20half;\x20long-term:\x20N-9\x20order-authority\x20model\x20window.']},{'id':'pattern.required_info_evidence_gate','business_requirement':'Do\x20not\x20advance\x20the\x20order\x20until\x20the\x20buyer\x20has\x20recorded\x20the\x20private\x20information\x20the\x20shop\x20requires\x20(delivery\x20detail,\x20ID,\x20credentials)\x20—\x20recorded\x20either\x20as\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20(from\x20the\x20Service\x27s\x20Contact)\x20or\x20as\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'query(\x27order.required_info\x20some\x27,\x20object=<Order\x20identifier[N]>\x20convert_witness\x20OrderProgress)','key_queries':['order.required_info\x20some','order.required_info','service.customer_required\x20count','service.customer_required\x20has'],'witness_types':['OrderProgress'],'applicable_industries':['retail','travel','education','rental','general'],'notes':['WHY\x20A\x20GUARD\x20AT\x20ALL:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20Service.customer_required,\x20so\x20declaring\x20required\x20fields\x20is\x20DECLARATIVE\x20ONLY\x20—\x20an\x20order\x20that\x20supplies\x20none\x20is\x20still\x20created\x20on-chain.\x20A\x20Guard\x20on\x20the\x20fulfilment\x20forward\x20is\x20the\x20only\x20enforcement\x20point\x20(testnet\x20test-14\x20HIGH-05).','1572\x20measures\x20PRESENCE,\x20not\x20REQUIREMENT:\x20Order.required_info\x20is\x20Option<address>\x20holding\x20the\x20credential\x20address\x20the\x20ORDER\x20OWNER\x20recorded\x20via\x20the\x20required-info\x20update\x20entry\x20(param\x20im_or_proof)\x20—\x20either\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20(the\x20Im.at\x20entry\x20of\x20the\x20Service\x27s\x20Contact)\x20or\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20IM\x20address\x20+\x20last-message\x20timestamp).\x20The\x20list\x20of\x20demanded\x20fields\x20lives\x20on\x20the\x20Service\x20(1467\x20count\x20/\x201468\x20has)\x20—\x20a\x20different\x20object,\x20so\x20it\x20is\x20only\x20checkable\x20when\x20the\x20Service\x20is\x20also\x20a\x20table\x20item.','1573\x20ABORTS\x20when\x20the\x20Option\x20is\x20empty\x20(that\x20is\x20its\x20defined\x20failure\x20mode):\x20gate\x20on\x201572,\x20then\x20use\x201573\x20only\x20to\x20read\x20or\x20compare\x20the\x20recorded\x20address.','The\x20credential\x20is\x20buyer-writable\x20and\x20unvalidated:\x20the\x20required-info\x20update\x20entry\x20asserts\x20only\x20order\x20ownership,\x20so\x20the\x20Guard\x20proves\x20\x27something\x20was\x20recorded\x27,\x20not\x20that\x20the\x20content\x20is\x20correct.\x20The\x20recorded\x20value\x20has\x20NO\x20on-chain\x20meaning\x20the\x20chain\x20enforces\x20—\x20never\x20make\x20the\x20recorded\x20address\x20(or\x20proof.about)\x20a\x20guard\x20decision\x20condition.\x20Acceptance\x20is\x20established\x20by\x20the\x20MERCHANT\x27s\x20confirming\x20forward:\x20the\x20operator\x20who\x20ships/hands\x20over\x20after\x20eyeballing\x20the\x20recorded\x20contact\x20in\x20the\x20Messenger\x20conversation\x20is\x20the\x20acceptance\x20act.\x20Where\x20content-grade\x20evidence\x20is\x20needed,\x20route\x20the\x20check\x20through\x20a\x20Repository\x20with\x20a\x20quote_guard.','ENFORCEABLE\x20BINDING\x20(MOV-PROTOCOL-1212\x2011):\x20when\x20the\x20listing\x20promise\x20\x27never\x20send\x20to\x20an\x20address\x20you\x20were\x20not\x20given\x27\x20must\x20hold\x20on-chain,\x20use\x20the\x20CONTROLLED\x20binding\x20entry\x20(the\x20controlled\x20required-info\x20bind;\x20SDK\x20order_required_info_bind)\x20instead\x20of\x20the\x20legacy\x20update:\x20the\x20chain\x20rejects\x20the\x20write\x20unless\x20the\x20WTS\x20Proof\x20is\x20about\x20THIS\x20order\x20AND\x20was\x20created\x20by\x20the\x20order\x20owner\x20(E_REQUIRED_INFO_PROOF_NOT_BOUND,\x20nothing\x20written\x20on\x20rejection).\x20TRADE-OFF:\x20a\x20per-order\x20proof\x20publicly\x20links\x20the\x20buyer\x27s\x20orders\x20on\x20chain;\x20the\x20reuse\x20model\x20(one\x20contact\x20proof\x20across\x20orders)\x20stays\x20the\x20privacy-preserving\x20default\x20—\x20pick\x20per\x20listing\x20promise,\x20not\x20per\x20habit.','BOUNDARY\x20—\x20do\x20NOT\x20mirror\x20this\x20pattern\x20onto\x20review/reward\x20claims:\x20the\x20about+creator\x20assertions\x20prove\x20the\x20credential\x20AUTHOR\x20(identity),\x20never\x20its\x20content\x20or\x20any\x20rating\x20value\x20(a\x20one-star\x20reviewer\x27s\x20proof\x20satisfies\x20them\x20equally).\x20Public\x20reviews\x20live\x20in\x20Repository\x20rows;\x20enforce\x20their\x20values\x20guard-side\x20via\x20data-value\x20probes\x20(1167\x20row\x20reads\x20/\x201177\x20keys-where\x20Range-gte)\x20and\x20gate\x20the\x20claim\x20on\x20those,\x20not\x20on\x20a\x20Proof\x20object.','RULE:\x20required_info\x20is\x20attestation-only\x20(write-only\x20on-chain):\x20never\x20gate\x20a\x20guard\x20on\x20its\x20CONTENT\x20—\x20any\x20buyer-written\x20string\x20passes,\x20so\x20content\x20conditions\x20are\x20unenforceable.\x20Presence\x20gates\x20are\x20legitimate\x20fill-barriers\x20only;\x20label\x20them\x20attestation-only\x20in\x20build\x20notes.','Gate\x20the\x20forward\x20that\x20DEPENDS\x20on\x20the\x20information\x20(e.g.\x20before\x20ship/deliver),\x20not\x20the\x20buy:\x20a\x20buy_guard\x20cannot\x20query\x20the\x20Order\x20—\x20it\x20does\x20not\x20exist\x20yet\x20at\x20buy\x20time.']},{'id':'pattern.reward_one_time_claim','business_requirement':'User\x20can\x20only\x20claim\x20reward\x20once\x20(no\x20prior\x20claims)','data_source':'OnChainConstant','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_reward_record_count(object=<reward>,\x20recipient=Signer,\x20where={}),\x20identifier[N](0)]','key_queries':['reward.record_count'],'mitigated_risks':[],'notes':['Record\x20count\x20check\x20prevents\x20double-claim','SCHEMA:\x20\x27where\x27\x20is\x20REQUIRED\x20even\x20when\x20empty\x20—\x20pass\x20where:\x20{}\x20or\x20the\x20call\x20is\x20rejected\x20by\x20input\x20validation']},{'id':'pattern.reward_multi_condition','business_requirement':'Order\x20payment\x20>\x20threshold\x20AND\x20reached\x20\x27complete\x27\x20to\x20claim\x20reward','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_and[logic_as_u256_greater[query(order.amount),\x20threshold],\x20logic_equal[query(progress.current),\x20\x27complete\x27],\x20logic_equal[query(order.service),\x20identifier[N](expected_service)]]','key_queries':['order.amount','progress.current','order.service'],'witness_types':['OrderProgress'],'mitigated_risks':['R-C3-05'],'notes':['Multi-condition:\x20amount\x20+\x20progress\x20state\x20+\x20service\x20match','BKN-P2:\x20a\x20threshold\x20of\x200\x20does\x20NOT\x20exclude\x20zero-total\x20orders\x20on\x20its\x20own\x20in\x20a\x20claim\x20root\x20—\x20'+'reward\x20claim\x20guards\x20must\x20compare\x20order.amount\x20>=\x201\x20(see\x20the\x20POSITIVE-AMOUNT\x20LEG\x20note\x20on\x20'+'pattern.progress_state_check);\x20zeroing\x20coupons\x20are\x20blocked\x20at\x20issuance\x20unless\x20the\x20free\x20tier\x20is\x20declared.']},{'id':'pattern.reward_refund_mutual_exclusion','business_requirement':'A\x20bounty/reward\x20claim\x20rail\x20and\x20a\x20refund\x20rail\x20on\x20the\x20SAME\x20order\x20must\x20never\x20both\x20pay:\x20the\x20claim\x20window\x20must\x20OPEN\x20only\x20after\x20the\x20refund\x20window\x20CLOSED,\x20and\x20the\x20compensate-seals-refund\x20side\x20effect\x20must\x20be\x20disclosed\x20(rex3\x20ruling\x20③\x202026-10-27,\x20user-approved)','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'level3_scene_combined','logic_summary':'TIME\x20GATE\x20(mandatory):\x20the\x20reward\x20claim\x20root\x27s\x20time\x20leg\x20anchors\x20Clock\x20>=\x20progress.history.time(nextNode\x20=\x20<settlement\x20terminal>,\x20find=last)\x20+\x20claim_window,\x20where\x20claim_window\x20>=\x20the\x20refund\x20window\x20—\x20the\x20claim\x20door\x20opens\x20only\x20after\x20the\x20refund\x20door\x20has\x20shut.\x20POLARITY\x20LEGS:\x20the\x20refund\x20rail\x20gates\x20on\x20order.claimed_by\x20some\x20==\x20false;\x20compensate\x20(a\x20goodwill\x20payout)\x20WRITES\x20claimed_by\x20and\x20thus\x20seals\x20the\x20refund\x20rail.\x20Optionally\x20the\x20claim\x20root\x20ANDs\x20order.claimed_by\x20none\x20==\x20true\x20—\x20but\x20see\x20the\x20trap.','key_queries':['progress.history\x20time','progress.current','order.claimed_by','order.amount'],'witness_types':['OrderProgress'],'mitigated_risks':['R-X1-17'],'applicable_industries':['general','retail','licensing','freelance'],'notes':['THE\x20DOUBLE-DIP\x20(rex3\x20finding):\x20without\x20a\x20time\x20gate,\x20a\x20buyer\x20can\x20claim\x20the\x20bounty\x20first\x20and\x20refund\x20later,\x20or\x20refund\x20first\x20and\x20still\x20claim\x20—\x20both\x20rails\x20were\x20open\x20over\x20the\x20same\x20interval.\x20The\x20window\x20sequencing\x20(claim\x20opens\x20AFTER\x20refund\x20closes)\x20is\x20the\x20PRIMARY\x20exclusion\x20and\x20is\x20MANDATORY\x20on\x20every\x20bounty-backed\x20machine.','THE\x20COMPENSATE\x20TRAP\x20(disclose\x20wherever\x20a\x20bounty\x20is\x20advertised):\x20compensate\x20writes\x20order.claimed_by,\x20which\x20seals\x20the\x20claimed_by-none\x20refund\x20rail.\x20If\x20the\x20claim\x20root\x20ALSO\x20carries\x20a\x20claimed_by\x20none\x20leg,\x20one\x20goodwill\x20payout\x20simultaneously\x20kills\x20the\x20bounty\x20claim.\x20Decide\x20EXPLICITLY:\x20(a)\x20claim\x20WITHOUT\x20the\x20polarity\x20leg\x20—\x20the\x20time\x20gate\x20is\x20the\x20sole\x20exclusion\x20and\x20a\x20post-compensate\x20claim\x20still\x20pays;\x20or\x20(b)\x20claim\x20WITH\x20the\x20polarity\x20leg\x20—\x20compensate\x20is\x20a\x20terminal\x20remedy\x20that\x20takes\x20the\x20bounty\x20down\x20with\x20the\x20refund.\x20Never\x20leave\x20the\x20choice\x20implicit.','THE\x20REVERSE\x20TRAP:\x20a\x20refund\x20payout\x20also\x20writes\x20claimed_by\x20—\x20a\x20refunded\x20order\x20flips\x20to\x20claimed_by\x20some\x20==\x20true,\x20so\x20a\x20claim\x20root\x20WITHOUT\x20a\x20polarity\x20leg\x20and\x20WITHOUT\x20a\x20time\x20gate\x20still\x20pays\x20after\x20a\x20refund.\x20Time\x20gate\x20is\x20mandatory\x20precisely\x20because\x20polarity\x20legs\x20alone\x20cannot\x20cover\x20both\x20directions.','ANCHOR\x20DISCIPLINE:\x20the\x20claim\x20window\x20anchors\x20the\x20immutable\x201280\x20history\x20ENTRY\x20of\x20the\x20settlement\x20terminal\x20(find=last;\x201272\x20current_time\x20drifts\x20every\x20migration,\x20ETS-C),\x20never\x20order.time\x20and\x20never\x20a\x20live\x20side-stop\x20node.','COMPOSITION:\x20stack\x20with\x20pattern.reward_one_time_claim\x20(record-count\x20once\x20leg)\x20and\x20the\x20F-62\x20evidence/good-review\x20floor\x20legs\x20as\x20needed;\x20the\x20time\x20gate\x20is\x20orthogonal\x20and\x20always\x20required\x20when\x20a\x20refund\x20rail\x20exists\x20on\x20the\x20same\x20order.']},{'id':'pattern.arbitration_voting_weight','business_requirement':'Vote\x20weight\x20equals\x20reputation\x20score\x20(dynamic\x20weight\x20from\x20Passport)','data_source':'SubmittedObject','host':'arbitration_voting','verifier_level':'none','logic_summary':'GuardIdentifier\x20extracts\x20numeric\x20value\x20from\x20Passport\x20submission','key_queries':[],'mitigated_risks':['R-C3-02'],'notes':['Table\x20needs\x20numeric\x20submission\x20entry\x20at\x20referenced\x20index','Weight\x20must\x20come\x20from\x20on-chain\x20EntityRegistrar,\x20not\x20submission','BINDING_01:\x20voting_guard\x20GuardIdentifier\x20must\x20be\x20numeric\x20(U8-U256)','C-9\x20VERIFIED:\x20voting\x20is\x20OPTIONAL\x20—\x20voting_deadline\x20is\x20Option\x20'+'(None\x20=\x20open-ended\x20voting;\x20arbitration\x20can\x20proceed\x20whenever\x20the\x20arbiter\x20decides).\x20'+'The\x20only\x20on-chain\x20ballot\x20floor\x20is\x20ONE:\x20a\x20verdict\x20requires\x20at\x20least\x20one\x20cast\x20vote\x20'+'(zero-vote\x20verdicts\x20abort\x20E_NO_VOTE_CAST\x20—\x20the\x20BF-15\x20gate);\x20a\x20single\x20ballot\x20suffices,\x20'+'and\x20vote\x20WEIGHT\x20does\x20not\x20gate\x20verdicts\x20at\x20all\x20(M-F,\x20chain-verified:\x20weight\x20is\x20'+'record/display\x20only\x20—\x20one\x20voter\x20of\x20any\x20weight\x20can\x20produce\x20an\x20executable\x20verdict).\x20'+'MAX_ARBITRATOR_VOTING=520\x20is\x20only\x20an\x20upper\x20bound.\x20'+'Open\x20voting\x20(empty\x20voting_guard)\x20gives\x20every\x20vote\x20EQUAL\x20WEIGHT\x20(1\x20person\x201\x20vote),\x20'+'but\x20it\x20is\x20NOT\x20permissionless:\x20vote()\x20asserts\x20arbitration\x20permission\x20358\x20unconditionally,\x20'+'so\x20grant\x20358\x20to\x20every\x20intended\x20voter\x20(testnet-verified\x20UPW-14:\x20the\x20roster\x20arbiters\x20held\x20no\x20358\x20'+'grant,\x20so\x20voting\x20collapsed\x20to\x20the\x20admin\x20alone\x20and\x20every\x20dispute\x20dead-ended).']},{'id':'pattern.arb_status_escrow_holdback','business_requirement':'Prevent\x20double-payout:\x20an\x20order\x20must\x20not\x20settle\x20its\x20FULL\x20escrow\x20when\x20an\x20arbitration\x20ruling\x20already\x20awarded\x20the\x20buyer\x20compensation\x20from\x20the\x20compensation\x20fund\x20(testnet\x20UPW-21\x20dual-track\x20finding)','host':'service_allocator_guard','data_source':'SubmittedObject','verifier_level':'level3_scene_combined','logic_summary':'Add\x20a\x20payout-state\x20condition\x20to\x20the\x20settlement/refund\x20allocator\x27s\x20Guard\x20using\x20the\x20REAL\x20order-side\x20evidence\x20queries:\x20'+'logic_equal[query(order.claimed_by\x20some),\x20false]\x20(query\x201570\x20—\x20set\x20only\x20when\x20the\x20compensation\x20claim\x20ACTUALLY\x20paid\x20the\x20ruling\x20out\x20of\x20the\x20fund;\x20permanent)\x20'+'blocks\x20any\x20escrow\x20release\x20on\x20an\x20already-compensated\x20order.\x20Conservative\x20variant:\x20logic_equal[query(order.dispute\x20count),\x200]\x20(query\x201564)\x20also\x20blocks\x20release\x20once\x20ANY\x20case\x20was\x20ever\x20filed\x20(one-way\x20door,\x20see\x20notes).\x20'+'Targeted\x20variant:\x20query(order.dispute\x20has,\x20submitted\x20Arb)\x20(1565)\x20plus\x20arb.indemnity\x20some\x20on\x20the\x20submitted\x20Arb\x20—\x20ruling\x20signal\x20that\x20survives\x20arb_withdraw\x20(the\x20fee\x20sweep\x20pulls\x20only\x20from\x20the\x20fee\x20balance;\x20the\x20one\x20path\x20that\x20DOES\x20clear\x20it\x20is\x20the\x20objection-cycle\x20reset,\x20which\x20fails\x20the\x20gate\x20shut\x20until\x20a\x20fresh\x20ruling),\x20NEVER\x20arb.status\x20(transient,\x20R-X1-16).\x20'+'The\x20reverse\x20direction\x20is\x20NOT\x20Guard-expressible:\x20the\x20compensation\x20claim\x20path\x20has\x20no\x20guard/passport\x20slot\x20on-chain,\x20so\x20\x27no\x20claim\x20after\x20refund\x27\x20can\x20only\x20be\x20enforced\x20at\x20the\x20operator\x20layer\x20(the\x20operator\x20tooling\x20checks\x20escrow\x20state\x20before\x20driving\x20the\x20claim).','key_queries':['order.claimed_by\x20some','order.dispute\x20count','order.dispute\x20has','arb.indemnity\x20some'],'mitigated_risks':['R-X1-16'],'notes':['VERIFIED\x20(UPW-21):\x20claiming\x20compensation\x20does\x20NOT\x20freeze\x20or\x20adjust\x20the\x20order\x20workflow\x20—\x20the\x20merchant\x20can\x20still\x20drive\x20the\x20order\x20to\x20completed\x20and\x20settle\x20the\x20FULL\x20escrow\x20on\x20top\x20of\x20the\x20compensation\x20(DUAL-TRACK\x20NOTICE).\x20The\x20protocol\x20deliberately\x20keeps\x20the\x20two\x20money\x20paths\x20independent.\x20There\x20is\x20NO\x20on-chain\x20seal\x20between\x20the\x20tracks\x20(the\x20receive\x20entries\x20are\x20deliberately\x20ungated),\x20so\x20BOTH\x20directions\x20of\x20the\x20refund-vs-claim\x20exclusion\x20must\x20be\x20enforced\x20at\x20configuration/operator\x20time\x20—\x20see\x20ORDERING\x20MATRIX.','SYSTEM\x20BOUNDARY\x20(design\x20intent):\x20Arbitration\x20(compensation_fund\x20payouts)\x20and\x20Allocator\x20(escrow\x20distribution)\x20are\x20two\x20INDEPENDENT\x20systems\x20—\x20independent\x20fund\x20sources,\x20independent\x20lifecycles.\x20Reading\x20arb.*\x20/\x20order.claimed_by\x20from\x20an\x20allocator\x20Guard\x20is\x20a\x20legitimate\x20cross-system\x20READ-ONLY\x20evidence\x20reference\x20(the\x20query\x20catalog\x20exists\x20for\x20exactly\x20this).\x20Adding\x20arb-linked\x20fields\x20on\x20Order/Machine\x20or\x20protocol-level\x20state\x20sync\x20would\x20break\x20the\x20boundary\x20and\x20open\x20the\x20refund+compensation\x20double-payout\x20path\x20—\x20never\x20propose\x20it.','ONE-WAY\x20DOOR:\x20Order.dispute\x20is\x20an\x20append-only\x20vector\x20(filed\x20cases\x20are\x20never\x20pruned).\x20A\x20refund\x20Guard\x20keyed\x20on\x20dispute\x20count==0\x20stays\x20blocked\x20FOREVER\x20after\x20the\x20first\x20case\x20—\x20even\x20if\x20the\x20ruling\x20awards\x20nothing,\x20the\x20escrow\x20refund\x20route\x20is\x20dead\x20and\x20funds\x20strand\x20at\x20that\x20node\x20(Machine+Allocator\x20immutable,\x20IMMUT-001).\x20Prefer\x20order.claimed_by\x20some==false\x20(blocks\x20only\x20after\x20an\x20actual\x20payout)\x20unless\x20\x27any\x20dispute\x20permanently\x20voids\x20the\x20refund\x20route,\x20ruling\x20governs\x27\x20is\x20the\x20intended\x20policy.','N-3\x20RESIDUAL\x20(disclosed,\x20no\x20chain\x20fix):\x20the\x20objection-cycle\x20reset\x20clears\x20arb.indemnity\x20(the\x20gate\x20above\x20fails\x20SHUT\x20until\x20a\x20fresh\x20ruling\x20—\x20intended)\x20but\x20nothing\x20on-chain\x20ever\x20clears\x20arb.compensation_time.\x20The\x20combination\x20is\x20unreachable\x20rather\x20than\x20dangerous:\x20reset\x20only\x20runs\x20on\x20Objectionable/Arbitrator_confirming\x20(pre-finish),\x20compensation_time\x20is\x20only\x20ever\x20set\x20by\x20finish\x20(post-ruling\x20payout),\x20and\x20finish\x27s\x20Accepted\x20status\x20is\x20disjoint\x20from\x20reset\x27s\x20—\x20so\x20no\x20\x27cleared\x20ruling\x20after\x20payout\x27\x20state\x20exists.\x20Treat\x20compensation_time\x20strictly\x20as\x20a\x20permanent\x20payout\x20timestamp,\x20never\x20a\x20freshness/absence\x20signal:\x20key\x20payout-state\x20gates\x20on\x20order.claimed_by\x20(permanent,\x20set\x20only\x20when\x20the\x20claim\x20actually\x20paid),\x20which\x20every\x20variant\x20above\x20already\x20does.\x20A\x20chain\x20fix\x20(reset\x20also\x20clearing\x20compensation_time)\x20remains\x20a\x20protocol-window\x20candidate\x20only\x20if\x20a\x20future\x20status\x20graph\x20ever\x20allows\x20post-finish\x20resets.','ORDERING\x20MATRIX\x20(CORRECTED,\x20booking\x20P-08:\x20an\x20earlier\x20revision\x20claimed\x20\x27claim→refund\x20is\x20closed\x20ON-CHAIN,\x20the\x20order\x20seals\x20itself\x27\x20—\x20the\x20receive\x20entries\x20have\x20NO\x20seal;\x20both\x20are\x20ungated\x20by\x20design):\x20BOTH\x20directions\x20are\x20OPEN\x20on-chain.\x20claim→refund:\x20after\x20a\x20claim\x20pays,\x20the\x20escrow\x20can\x20still\x20be\x20fully\x20settled\x20on\x20top\x20(the\x20UPW-21\x20dual-track\x20itself)\x20—\x20block\x20it\x20only\x20by\x20gating\x20the\x20SETTLEMENT\x20allocator\x20on\x20order.claimed_by\x20none==true...\x20i.e.\x20logic_equal[query(order.claimed_by\x20some),\x20false];\x20gating\x20ONLY\x20the\x20refund\x20side\x20leaves\x20settlement\x20open.\x20refund→claim:\x20a\x20released\x20escrow\x20does\x20not\x20block\x20a\x20later\x20claim\x20either,\x20and\x20the\x20claim\x20path\x20has\x20no\x20guard/passport\x20slot\x20—\x20refusing\x20to\x20drive\x20arb_claim_compensation\x20against\x20an\x20already-released\x20escrow\x20stays\x20an\x20OPERATOR\x20rule\x20(operator-side\x20keeper\x20discipline).\x20To\x20enforce\x20\x27either\x20refund\x20or\x20compensation,\x20never\x20both\x27\x20on-chain,\x20pair\x20the\x20two\x20allocator\x20legs:\x20settlement\x20gated\x20on\x20claimed_by\x20none,\x20merchant-recovery\x20gated\x20on\x20claimed_by\x20some\x20—\x20every\x20escrow\x20path\x20keeps\x20an\x20exit.','DSL\x20CAPABILITY\x20BOUNDARY\x20(chain-verified\x202026-10-27,\x204R-03a\x20ruling):\x20arb.indemnity\x20legs\x20are\x20NOT\x20default-injectable\x20into\x20refund\x20rails.\x20The\x20native\x20query\x20evaluator\x20ABORTS\x20the\x20whole\x20passport\x20when\x20the\x20queried\x20object\x20does\x20not\x20exist\x20(W_OBJECT_NOT_FOUND)\x20or\x20is\x20not\x20an\x20Arb\x20(field-offset\x20read\x20fails,\x20W_FIELD_TYPE_ERROR);\x20arb.indemnity.amount\x20additionally\x20aborts\x20on\x20a\x20None\x20ruling\x20(\x27indemnity\x20field\x20is\x20None\x27).\x20logic_or\x20does\x20NOT\x20short-circuit\x20(all\x20operands\x20evaluate\x20before\x20the\x20disjunction\x20applies),\x20so\x20no\x20wrapper\x20escapes\x20the\x20abort,\x20and\x20a\x20no-case\x20refund\x20passport\x20has\x20NO\x20Arb\x20address\x20to\x20submit.\x20An\x20indemnity-exclusion\x20leg\x20is\x20therefore\x20buildable\x20ONLY\x20on\x20a\x20refund\x20rail\x20reachable\x20exclusively\x20from\x20DISPUTE-state\x20nodes,\x20where\x20the\x20passport\x20flow\x20can\x20submit\x20a\x20real\x20Arb\x20address\x20(slot\x201,\x20b_submission)\x20—\x20never\x20propose\x20a\x20kernel-wide\x20default\x20injection:\x20it\x20would\x20abort\x20every\x20no-case\x20refund\x20(W_OBJECT_NOT_FOUND\x20on\x20the\x20missing\x20Arb).','Dry-run\x20the\x20combined\x20condition\x20on\x20testnet\x20before\x20publish\x20(INFERENCE\x20per\x20pattern.allocation_staged_release).']},{'id':'pattern.deposit_arb_reimbursement','business_requirement':'Recover\x20an\x20arbitration\x20compensation\x20from\x20the\x20responsible\x20supplier\x20WITHOUT\x20touching\x20already-distributed\x20escrow\x20—\x20the\x20protocol\x20has\x20NO\x20clawback\x20(allocation\x20is\x20irreversible;\x20the\x20only\x20return\x20path\x20needs\x20the\x20recipient\x27s\x20voluntary\x20cooperation),\x20so\x20recovery\x20is\x20a\x20FORWARD\x20allocation\x20from\x20a\x20pre-funded\x20deposit\x20pool','host':'service_allocator_guard','data_source':'SubmittedObject','verifier_level':'level3_scene_combined','logic_summary':'Supplier\x20onboards\x20with\x20a\x20pre-funded\x20deposit\x20Allocation.\x20Its\x20allocator\x20Guard\x20requires\x20cross-system\x20evidence:\x20'+'(1)\x20order.claimed_by\x20(1571)\x20==\x20the\x20submitted\x20Arb\x20—\x20compensation\x20was\x20ACTUALLY\x20paid\x20out\x20of\x20the\x20Service\x20fund\x20(the\x20reimbursement\x20trigger;\x20claimed_by\x20is\x20permanent\x20and\x20names\x20the\x20case);\x20'+'(2)\x20arb.order\x20(1513)\x20on\x20the\x20submitted\x20Arb\x20==\x20the\x20paying\x20order\x20—\x20the\x20case\x20belongs\x20to\x20this\x20order;\x20'+'(3)\x20optional\x20amount\x20tier:\x20arb.indemnity.amount\x20(1641,\x20stable\x20once\x20ruled)\x20compared\x20against\x20a\x20Repository\x20tier\x20grid\x20(see\x20pattern.repository_data_check)\x20or\x20a\x20Surplus\x20drain\x20of\x20the\x20whole\x20pool.\x20'+'A\x20collaborator\x20or\x20keeper\x20drives\x20alloc_by_guard\x20on\x20the\x20deposit\x20Allocation\x20after\x20the\x20claim\x20settles\x20—\x20the\x20deduction\x20is\x20a\x20native\x20forward\x20allocation\x20(append-only,\x20auditable),\x20not\x20a\x20reversal.\x20NOTE:\x20the\x20deduction\x20is\x20NOT\x20self-idempotent\x20—\x20a\x20keeper\x20retry\x20deducts\x20twice;\x20dedupe\x20via\x20a\x20once-slot\x20scope\x20or\x20a\x20settled-state\x20guard\x20query.','key_queries':['order.claimed_by','arb.order','arb.indemnity.amount','repository.data'],'mitigated_risks':['R-X1-16'],'notes':['BOUNDARY\x20(design\x20intent):\x20this\x20is\x20a\x20READ-ONLY\x20evidence\x20reference\x20across\x20the\x20two\x20independent\x20systems\x20(Arbitration\x20fund\x20vs\x20escrow\x20Allocator)\x20—\x20exactly\x20what\x20the\x20arb.*\x20/\x20order.claimed_by\x20query\x20catalog\x20exists\x20for.\x20It\x20does\x20NOT\x20couple\x20the\x20systems:\x20no\x20arb\x20field\x20is\x20added\x20to\x20Order/Machine,\x20no\x20protocol\x20state\x20sync,\x20the\x20escrow\x20track\x20is\x20untouched.','Gate\x20on\x20order.claimed_by\x20(set\x20only\x20when\x20the\x20claim\x20actually\x20paid),\x20NOT\x20on\x20arb.status\x20(transient:\x20arb_withdraw\x20advances\x205→6,\x20R-X1-16)\x20and\x20not\x20on\x20arb.indemnity\x20alone\x20(a\x20ruling\x20without\x20a\x20claim\x20has\x20moved\x20no\x20money\x20—\x20nothing\x20to\x20reimburse\x20yet).','Deposit\x20must\x20cover\x20the\x20worst\x20case\x20(indemnity\x20capped\x20at\x203x\x20order\x20amount)\x20—\x20size\x20the\x20pool\x20at\x20onboarding;\x20a\x20drained\x20pool\x20blocks\x20reimbursement\x20until\x20topped\x20up\x20(alloc\x20aborts\x20EINSUFFICIENT_BALANCE,\x20code\x207).','No\x20Move\x20change\x20required\x20—\x20buildable\x20today\x20with\x20Allocation\x20+\x20Guard\x20+\x20Repository\x20tier\x20grid.\x20The\x20deposit\x20mode\x20is\x20the\x20immediate\x20configuration-layer\x20path;\x20a\x20true\x20clawback\x20protocol\x20primitive\x20stays\x20a\x20later\x20evaluation\x20pending\x20real-case\x20coverage.']},{'id':'pattern.arbitration_membership_check','business_requirement':'Only\x20premium\x20members\x20can\x20file\x20disputes','data_source':'OnChainConstant','host':'arbitration_usage','verifier_level':'none','logic_summary':'logic_and[query(entity\x20exists),\x20logic_as_u256_greater_or_equal[query(entity\x20tier),\x20identifier[N](premium_tier)]]','key_queries':['entity.registrar','entity.linker'],'mitigated_risks':[],'notes':['ENTITY_REGISTRAR_ADDRESS\x20(0xaab)\x20/\x20ENTITY_LINKER_ADDRESS\x20(0xaaa)\x20must\x20be\x20in\x20table\x20—\x20chain\x20truth\x20(fixed\x20at\x20chain\x20deployment):\x200xaab\x20is\x20the\x20Move-level\x20Entity\x20object,\x200xaaa\x20the\x20Registrar;\x20SDK\x20constant\x20names\x20are\x20legacy\x20aliases\x20(rex5\x20T-06)']},{'id':'pattern.scene_allocator_entity_recipient','business_requirement':'Service\x20allocator\x20with\x20sharing.who=Entity\x20—\x20no\x20Signer\x20binding\x20needed','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Scene\x20verifies\x20fund\x20flow\x20safety\x20—\x20Guard\x20only\x20validates\x20allocation\x20rules','key_queries':['service.permission','order.amount'],'mitigated_risks':['R-C3-06'],'notes':['Funds\x20flow\x20to\x20fixed\x20Treasury/address\x20regardless\x20of\x20caller','sharing.who=Entity\x20already\x20guarantees\x20recipient\x20safety','No\x20Signer\x20binding\x20required\x20—\x20R-C3-06\x20safe']},{'id':'pattern.scene_machine_forward_operator','business_requirement':'Machine\x20forward\x20with\x20permissionIndex/namedOperator\x20already\x20verifies\x20operator','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Forward\x27s\x20permissionIndex/namedOperator\x20verifies\x20operator\x20—\x20Guard\x20only\x20validates\x20submitted\x20data','key_queries':[],'mitigated_risks':[],'notes':['Scene\x20verifies\x20operator\x20permission\x20via\x20permissionIndex/namedOperator','Signer\x20binding\x20only\x20needed\x20if\x20submitted\x20data\x20must\x20belong\x20to\x20operator','Evaluate\x20scene\x20before\x20adding\x20Signer\x20binding']},{'id':'pattern.fund_flow_refund_freeform','business_requirement':'Refund\x20/\x20cancellation\x20fund-release\x20defined\x20purely\x20by\x20game\x20conditions\x20—\x20NOT\x20bound\x20to\x20any\x20Machine\x20node','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level2_identity_set','logic_summary':'An\x20allocator\x20Guard\x20whose\x20root\x20encodes\x20refund\x20conditions\x20ARBITRARILY:\x20'+'buyer\x20signature\x20(logic_equal[Signer,\x20buyer]),\x20timeout\x20(logic_as_u256_greater_or_equal[Clock,\x20deadline]),\x20'+'evidence\x20state\x20(query\x20any\x20on-chain\x20object:\x20order\x20fields,\x20repository\x20data,\x20payment\x20proofs),\x20'+'arbitration\x20outcome,\x20or\x20any\x20logic_and/or\x20combination.\x20No\x20progress/current-node\x20query\x20required.','key_queries':['order.owner','order.service','order.amount'],'mitigated_risks':['R-C3-06'],'notes':['C-2\x20RESOLUTION:\x20Machine-node-triggered\x20refund\x20(\x27at\x20cancelled\x20node\x20→\x20release\x27)\x20is\x20only\x20ONE\x20application\x20pattern.\x20'+'Guard+Allocator\x20is\x20a\x20GENERAL\x20game\x20primitive:\x20the\x20refund\x20condition\x20tree\x20is\x20fully\x20free-form.\x20'+'Move\x20layer\x20needs\x20NO\x20change\x20—\x20Guard\x20roots\x20accept\x20arbitrary\x20logic\x20over\x20any\x20queryable\x20state.','GAME-THEORETIC\x20READING:\x20both\x20parties\x20should\x20evaluate\x20the\x20refund\x20Guard\x20BEFORE\x20transacting\x20—\x20'+'who\x20can\x20trigger\x20it,\x20under\x20which\x20conditions,\x20with\x20what\x20evidence.\x20Use\x20the\x20analyze_guard_semantics\x20'+'query\x20action\x20to\x20render\x20+\x20lint\x20any\x20Guard\x20and\x20reason\x20about\x20each\x20party\x27s\x20leverage.','Condition\x20dimensions\x20freely\x20composable:\x20identity\x20(Signer/Entity),\x20time\x20(Clock),\x20'+'counterparty\x20evidence\x20(submitted\x20Payment/Order/Proof),\x20shared\x20data\x20(Repository),\x20'+'workflow\x20state\x20(Progress\x20—\x20optional,\x20only\x20when\x20a\x20Machine\x20exists)','Multi-tier\x20refund:\x20multiple\x20allocators\x20bound\x20to\x20DIFFERENT\x20guards\x20encode\x20graduated\x20policies\x20'+'(full\x20refund\x20pre-delivery,\x20partial\x20refund\x20post-milestone,\x20no\x20refund\x20post-acceptance)\x20—\x20the\x20caller\x27s\x20submitted\x20guard\x20selects\x20exactly\x20one\x20path']},{'id':'pattern.fund_flow_profit_share_freeform','business_requirement':'Revenue/profit\x20sharing\x20among\x20partners\x20triggered\x20by\x20verifiable\x20contribution\x20conditions\x20—\x20not\x20by\x20workflow\x20nodes','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Allocator\x20sharing\x20(who+ratio)\x20defines\x20the\x20SPLIT;\x20the\x20Guard\x20defines\x20WHEN\x20the\x20split\x20executes.\x20'+'The\x20WHEN\x20is\x20free-form:\x20period\x20boundary\x20(Clock\x20vs\x20interval),\x20contribution\x20proof\x20(submitted\x20evidence),\x20'+'performance\x20threshold\x20(Repository\x20metric),\x20or\x20counterparty\x20co-signature.','key_queries':['repository.data','payment.amount'],'mitigated_risks':['R-C3-06'],'applicable_industries':['freelance','subscription','education'],'notes':['C-2\x20RESOLUTION:\x20profit-sharing\x20is\x20an\x20application\x20pattern\x20of\x20the\x20same\x20Guard+Allocator\x20primitive\x20—\x20'+'the\x20trigger\x20condition\x20tree\x20is\x20arbitrary\x20game\x20logic,\x20not\x20a\x20workflow\x20artifact.','sharing.who=Entity\x20recipients\x20make\x20the\x20split\x20caller-safe\x20(funds\x20flow\x20to\x20fixed\x20addresses)\x20—\x20'+'Guard\x20then\x20only\x20gates\x20TIMING/CONDITIONS,\x20not\x20identity\x20(R-C3-06\x20safe\x20by\x20scene)','Periodic\x20settlement:\x20logic_as_u256_greater_or_equal[Clock,\x20identifier[N](period_start)]\x20+\x20'+'logic_as_u256_equal[calc_number_mod[Clock,\x20interval],\x200]-style\x20windows,\x20'+'or\x20a\x20Repository-held\x20settlement\x20cursor\x20updated\x20after\x20each\x20allocation\x20run']},{'id':'pattern.permission_guard_entity_time_window','business_requirement':'Delegate\x20a\x20permission\x20index\x20to\x20a\x20Guard\x20object\x20address\x20—\x20authorization\x20that\x20self-enforces\x20and\x20self-expires\x20(time-windowed\x20delegation)','data_source':'SystemContext','host':'machine_forward','verifier_level':'none','logic_summary':'The\x20entity\x20table\x20accepts\x20\x27user/guard\x20address\x20&\x20permission_index\x20list\x27\x20—\x20'+'a\x20Guard\x27s\x20OWN\x20ADDRESS\x20can\x20hold\x20a\x20permission\x20index.\x20The\x20delegated\x20Guard\x20then\x20encodes\x20'+'temporal\x20+\x20contextual\x20conditions:\x20logic_and[logic_as_u256_greater_or_equal[Clock,\x20valid_from],\x20'+'logic_as_u256_lesser_or_equal[Clock,\x20valid_until],\x20<scene\x20conditions>].\x20'+'Callers\x20satisfying\x20the\x20Guard\x20act\x20with\x20the\x20delegated\x20permission\x20index.','key_queries':[],'mitigated_risks':[],'notes':['C-8\x20VERIFIED:\x20entity\x20table\x20comment\x20—\x20\x27user/guard\x20address\x20&\x20permission_index\x20list\x27\x20'+'(guard\x20addresses\x20are\x20first-class\x20permission\x20entities,\x20same\x20as\x20user\x20addresses)','TIME\x20WINDOW:\x20Guard\x20roots\x20compose\x20context(Clock)\x20freely\x20—\x20valid_from/valid_until\x20bounds,\x20'+'recurring\x20windows\x20(mod\x20arithmetic),\x20or\x20deadline-before\x20(authorize\x20only\x20until\x20expiry)','SELF-EXPIRING\x20DELEGATION:\x20after\x20valid_until\x20the\x20Guard\x20fails\x20for\x20everyone\x20—\x20no\x20on-chain\x20'+'revocation\x20transaction\x20needed,\x20no\x20trust\x20in\x20the\x20delegate\x20to\x20stop\x20acting','SCENARIO\x20COMBINATION\x20(scenario\x20layer):\x20temporary\x20operator\x20(holiday\x20cover),\x20seasonal\x20service\x20window,\x20'+'trial-period\x20customer\x20privileges,\x20contractor\x20time-boxed\x20access,\x20emergency-break-glass\x20with\x20auto-expiry','Design\x20tip:\x20combine\x20with\x20scene\x20conditions\x20(order\x20state,\x20submitted\x20evidence)\x20—\x20'+'time\x20bounds\x20rarely\x20stand\x20alone']},{'id':'pattern.allocator_order_anchor','business_requirement':'Bind\x20an\x20allocator\x27s\x20Guard\x20to\x20the\x20paying\x20order\x20when\x20every\x20recipient\x20is\x20a\x20fixed\x20address\x20(Entity/Signer)\x20—\x20the\x20Guard\x20would\x20otherwise\x20read\x20no\x20order\x20at\x20all','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Entity/Signer\x20rows\x20are\x20not\x20resolved\x20from\x20submissions,\x20so\x20an\x20allocator\x20paying\x20only\x20them\x20gives\x20its\x20Guard\x20nothing\x20to\x20'+'constrain.\x20Add\x20a\x20{GuardIdentifier:\x200}\x20row\x20with\x20Rate\x200\x20(or\x20Surplus\x20when\x20the\x20allocator\x20has\x20no\x20other\x20Surplus\x20row):\x20'+'the\x20row\x20pays\x20nothing,\x20and\x20the\x20Guard\x27s\x20Identifier\x20slot\x20now\x20resolves\x20to\x20the\x20paying\x20order,\x20so\x20order.*\x20queries\x20bind.\x20'+'Applicability\x20(ZR-34):\x20Rate-bearing\x20or\x20mixed\x20(Amount+Rate)\x20allocators\x20ONLY\x20—\x20in\x20a\x20pure-Amount\x20allocator\x20the\x20'+'Rate-0\x20row\x20flips\x20the\x20allocator\x20to\x20Rate\x20mode,\x20whose\x20Rate\x20legs\x20must\x20then\x20sum\x20to\x20exactly\x2010000\x20when\x20no\x20Surplus\x20leg\x20'+'exists\x20(ERATE_NOT_10000,\x20R-A-1-02),\x20so\x20configuration\x20aborts;\x20a\x20pure-Amount\x20allocator\x20binds\x20through\x20its\x20pinned\x20'+'Amount\x20+\x20GuardIdentifier(0)\x20recipient\x20+\x20the\x20254/255\x20once\x20slot\x20instead.','key_queries':['order.service','order.owner'],'notes':['VERIFIED\x20on\x20a\x20standalone\x20Allocation:\x20the\x20zero-share\x20anchor\x20row\x20is\x20accepted\x20by\x20order_allocators\x20(Move\x20asserts\x20no\x20Rate>0\x20minimum).','Confirm\x20Rate\x200\x20on\x20the\x20real\x20Service\x20with\x20a\x20dry-run\x20before\x20publishing\x20—\x20published\x20allocators\x20cannot\x20change.','The\x20anchor\x20row\x20also\x20makes\x20recipient-constraint\x20audits\x20meaningful:\x20the\x20Guard\x27s\x20binding\x20target\x20exists.','C-9\x20SIDE\x20EFFECT:\x20a\x20Rate-0\x20anchor\x20row\x20still\x20materialises\x20a\x20ZERO-BALANCE\x20CoinWrapper\x20at\x20the\x20recipient\x20(observed\x20live:\x20the\x20Order\x20received\x20a\x20balance=0\x20wrapper\x20on\x20every\x20settlement).\x20It\x20carries\x20no\x20value\x20yet\x20shows\x20up\x20as\x20a\x200-amount\x20claimable\x20object,\x20which\x20reads\x20as\x20noise\x20in\x20onchain_received\x20and\x20in\x20buyer-facing\x20claim\x20lists.\x20This\x20is\x20the\x20accepted\x20cost\x20of\x20binding\x20the\x20Guard\x20to\x20an\x20order,\x20and\x20it\x20remains\x20strictly\x20safer\x20than\x20Signer.','SCOPE\x20(ZR-34,\x20ziroom-mn-261013):\x20Rate-bearing\x20or\x20mixed\x20groups\x20ONLY.\x20A\x20Rate-0\x20anchor\x20row\x20inside\x20a\x20pure-Amount\x20allocator\x20converts\x20that\x20allocator\x20to\x20Rate\x20mode\x20—\x20with\x20no\x20Surplus\x20leg\x20the\x20Rate\x20legs\x20must\x20then\x20sum\x20to\x20exactly\x2010000\x20and\x20the\x20configuration\x20aborts\x20(ERATE_NOT_10000\x20family,\x20R-A-1-02).\x20Pure-Amount\x20groups\x20(a\x20pinned\x20deposit\x20refund,\x20per-period\x20Amount\x20releases)\x20must\x20NOT\x20take\x20the\x20anchor:\x20they\x20bind\x20through\x20the\x20pinned\x20Amount,\x20a\x20GuardIdentifier(0)\x20recipient,\x20and\x20the\x20254/255\x20once\x20slot\x20instead.']},{'id':'pattern.allocation_staged_release','business_requirement':'Pay\x20an\x20order\x20out\x20in\x20stages\x20(milestones),\x20or\x20hold\x20a\x20share\x20back\x20(deposit,\x20warranty,\x20quality\x20reserve)\x20behind\x20a\x20time\x20window\x20/\x20dispute\x20state','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'An\x20Allocation\x20can\x20be\x20triggered\x20MANY\x20times\x20and\x20the\x20contract\x20keeps\x20no\x20\x27already\x20paid\x27\x20flag,\x20so\x20every\x20staged\x20allocator\x20'+'needs\x20its\x20own\x20not-yet-paid\x20condition:\x20escrow\x20balance\x20still\x20equals\x20the\x20order\x20amount,\x20or\x20a\x20state/time\x20only\x20one\x20stage\x20'+'satisfies.\x20A\x20holdback\x20is\x20an\x20allocator\x20whose\x20Guard\x20adds\x20a\x20time\x20window\x20(progress.history.time\x20+\x20duration)\x20and,\x20for\x20'+'dispute\x20awareness,\x20a\x20condition\x20on\x20order.dispute\x20count\x20or\x20on\x20arb.indemnity\x20some\x20of\x20a\x20submitted\x20Arb\x20—\x20NEVER\x20on\x20'+'arb.status\x20(transient,\x20see\x20notes).','key_queries':['progress.history.time','order.dispute','arb.indemnity\x20some'],'notes':['REPLAY\x20TEST\x20MANDATORY:\x20trigger\x20the\x20same\x20allocator\x20twice\x20and\x20expect\x20the\x20second\x20call\x20to\x20fail\x20—\x20abort\x2014\x20EZERO_DISTRIBUTION\x20when\x20the\x20first\x20run\x20drained\x20the\x20pool,','or\x20abort\x2016\x20E_ONCE_TRIGGERED\x20when\x20the\x20allocator\x27s\x20Guard\x20arms\x20a\x20once\x20slot\x20(identifier\x20255/254).','Abort\x207\x20EINSUFFICIENT_BALANCE\x20applies\x20only\x20to\x20fixed-Amount\x20rows\x20sized\x20against\x20a\x20shared\x20pool\x20that\x20a\x20prior\x20run\x20depleted.','ONE-SHOT\x20KEY\x20(E-2(b),\x20protocol\x20142):\x20identifier\x20254\x20is\x20the\x20ONCE-FOR-OBJECT\x20slot.\x20Arm\x20it\x20({\x20identifier:\x20254,\x20b_submission:\x20true\x20})\x20on\x20SETTLEMENT\x20/\x20incentive-claim\x20rails\x20—\x20the\x20chain\x20derives\x20the\x20once-key\x20from\x20payment_info.for_object,\x20so\x20the\x20submitted\x20bytes\x20are\x20IGNORED\x20and\x20no\x20caller\x20can\x20widen\x20the\x20slot;\x20a\x20replay\x20aborts\x20with\x20code\x2016\x20(unbound\x20allocation\x20aborts\x2021).\x20NEVER\x20arm\x20254\x20on\x20a\x20REFUND\x20rail:\x20a\x20refund\x20pays\x20the\x20submitted\x20Order\x20through\x20user\x20slot\x200\x20(extracted\x20by\x20the\x20Order\x27s\x20owner-claim\x20entry),\x20and\x20a\x20refund\x20node\x20re-entered\x20in\x20a\x20later\x20renewal\x20period\x20aborts\x20E_ONCE_TRIGGERED(16)\x20forever\x20(OFN\x20#P-04;\x20the\x20shipped\x20templates\x20were\x20swept\x20254\x20to\x200\x20in\x20v89).\x20Use\x20identifier\x20255\x20ONLY\x20for\x20rails\x20that\x20legitimately\x20repeat\x20once\x20per\x20period:\x20register\x20an\x20address-typed\x20{\x20identifier:\x20255,\x20b_submission:\x20true\x20}\x20row\x20AND\x20make\x20the\x20guard\x20EXPRESSION\x20actually\x20consume\x20identifier\x20255\x20(a\x20TYPE_CONSTANT\x20255\x20clause)\x20with\x20a\x20caller-period\x20key\x20like\x20\x27period-<N>\x27\x20—\x20a\x20TYPE_CONSTANT\x20255\x20declaration\x20WITHOUT\x20a\x20referencing\x20clause\x20verifies\x20nothing,\x20so\x20a\x20caller\x20can\x20submit\x20a\x20fresh\x20once-value\x20each\x20round\x20and\x20bypass\x20the\x20guard\x20entirely.\x20255\x20is\x20byte-keyed\x20(the\x20raw\x20submitted\x20bytes\x20ARE\x20the\x20key)\x20and\x20per-Allocation\x20(a\x20fresh\x20pool\x20starts\x20with\x20no\x20record\x20—\x20the\x20order\x20anchor,\x20not\x20255,\x20is\x20what\x20scopes\x20a\x20rail\x20to\x20its\x20own\x20order).','VERIFIED\x20on\x20testnet\x20(booking\x20o10):\x20time-window\x20holdbacks\x20AND\x20dispute-aware\x20conditions\x20via\x20arb.indemnity\x20some.','⚠️\x20TRANSIENT-STATE\x20TRAP:\x20never\x20gate\x20a\x20refund/release\x20on\x20arb.status\x20==\x205\x20(Finished)\x20—\x20arb_withdraw\x20legitimately\x20advances\x20the\x20case\x205→6\x20(Withdrawn)\x20and\x20the\x20edge\x20dies\x20forever;\x20Guard\x20+\x20Machine\x20are\x20immutable\x20after\x20publish\x20(IMMUT-001),\x20so\x20mistyping\x20arb.status\x20strands\x20funds\x20permanently\x20(o10:\x201.5\x20WOW\x20locked).\x20arb.indemnity\x20some\x20(Bool)\x20is\x20the\x20withdraw-stable\x20signal;\x20arb.indemnity.time\x20(U64)\x20adds\x20the\x20ruling\x20timestamp\x20for\x20time-bounded\x20gates.\x20See\x20template\x20tpl_forward_arb_ruling_won\x20and\x20rule\x20R-X1-16.','Never\x20pay\x20the\x20held\x20share\x20from\x20the\x20same\x20Guard\x20that\x20pays\x20the\x20main\x20share\x20—\x20a\x20Guard\x20that\x20also\x20fires\x20while\x20a\x20warranty\x20is\x20open\x20leaves\x20the\x20buyer\x20no\x20leverage.']},{'id':'pattern.fund_flow_stop_node_coverage','business_requirement':'No\x20order\x20may\x20ever\x20rest\x20at\x20a\x20node\x20whose\x20funds\x20have\x20no\x20defined\x20exit\x20—\x20every\x20stop\x20node\x20of\x20the\x20Machine\x20needs\x20BOTH\x20a\x20withdrawal\x20(release)\x20and\x20a\x20refund\x20allocation\x20rule,\x20evaluated\x20BEFORE\x20Service\x20publish','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Design-time\x20topology\x20review,\x20not\x20a\x20single\x20Guard\x20tree:\x20enumerate\x20every\x20node\x20where\x20an\x20order\x20can\x20rest\x20'+'(terminal\x20nodes\x20AND\x20waiting\x20states\x20—\x20review\x20windows,\x20open\x20disputes,\x20staged-release\x20holds)\x20and\x20map\x20each\x20'+'to\x20the\x20allocator\x20Guard(s)\x20that\x20move\x20money\x20out\x20of\x20it.\x20A\x20stop\x20node\x20with\x20no\x20release\x20rule\x20freezes\x20the\x20'+'merchant\x20share;\x20one\x20with\x20no\x20refund\x20rule\x20freezes\x20the\x20buyer\x27s\x20escrow.\x20Machine\x20+\x20Allocator\x20are\x20immutable\x20'+'after\x20publish\x20(IMMUT-001)\x20—\x20a\x20missed\x20node\x20is\x20a\x20permanent\x20fund\x20stranding,\x20not\x20a\x20fixable\x20typo.','key_queries':['order.service','progress.history.time','arb.indemnity\x20some'],'mitigated_risks':['R-X1-16'],'notes':['CHECKLIST\x20at\x20Service\x20publish:\x20(1)\x20list\x20stop\x20nodes\x20from\x20the\x20Machine\x20graph\x20—\x20nodes\x20with\x20no\x20outgoing\x20Pair\x20PLUS\x20every\x20node\x20where\x20a\x20human/external\x20action\x20is\x20awaited\x20(review,\x20handover,\x20dispute);\x20(2)\x20for\x20each,\x20name\x20the\x20release\x20allocator\x20AND\x20the\x20refund\x20allocator\x20(or\x20record\x20an\x20explicit\x20\x27no\x20refund\x20possible\x27\x20decision\x20with\x20its\x20rationale);\x20(3)\x20verify\x20each\x20mapping\x20Guard\x20is\x20satisfiable\x20in\x20BOTH\x20directions\x20(a\x20rule\x20that\x20can\x20never\x20become\x20true\x20strands\x20the\x20same\x20as\x20a\x20missing\x20rule).','REVIEW-GATED\x20RELEASE\x20is\x20a\x20TIME\x20VARIANT\x20of\x20the\x20same\x20exit\x20—\x20\x27reviewed\x27\x20OR\x20\x27unreviewed\x20after\x20T\x27\x20as\x20logic_or\x20inside\x20ONE\x20release\x20Guard;\x20never\x20model\x20reviewed/unreviewed\x20as\x20parallel\x20outgoing\x20edges\x20of\x20completed\x20(race\x20deadlock,\x20F-REVIEW-BLOCK)\x20and\x20never\x20as\x20a\x20node\x20without\x20its\x20own\x20exit.','DISPUTE\x20exits\x20gate\x20on\x20arb.indemnity\x20(stable\x20ruling\x20signal\x20—\x20arb_withdraw\x20sweeps\x20only\x20the\x20fee\x20balance\x20and\x20never\x20touches\x20it),\x20NEVER\x20arb.status==5\x20(transient\x20—\x20R-X1-16\x20/\x20tpl_forward_arb_ruling_won);\x20the\x20merchant-favor\x20dismissal\x20exit\x20pairs\x20tpl_forward_arb_ruling_dismissed\x20(arb.indemnity.amount\x20==\x200\x20—\x20fail-closed\x20on\x20the\x20None\x20field,\x20so\x20only\x20a\x20standing\x20merchant-favor\x20ruling\x20opens\x20the\x20edge)\x20instead\x20of\x20a\x20bare\x20permission\x20edge.','TIME\x20WINDOWS\x20on\x20these\x20exits\x20follow\x20the\x20dual-track\x20rule:\x20chain\x20Clock\x20(native,\x20coarse)\x20or\x20self-built\x20repository\x20oracle\x20(exact\x20wall\x20time)\x20—\x20see\x20pattern.time_source_repository_oracle.','GENERATIVE,\x20NOT\x20TEMPLATE-BOUND:\x20the\x20stop-node\x20list\x20comes\x20from\x20THIS\x20business\x27s\x20rest\x20states,\x20derived\x20from\x20Move-native\x20primitives\x20(nodes/pairs/forwards/guards/allocators).\x20wowok\x20grows\x20arbitrary\x20commerce\x20systems\x20—\x20do\x20not\x20copy\x20another\x20industry\x27s\x20node\x20vocabulary;\x20enumerate\x20your\x20own\x20rest\x20states\x20and\x20cover\x20every\x20one.','Engine\x20enforcement:\x20R-M5-03\x20fires\x20when\x20a\x20Machine\x20has\x20stop\x20nodes\x20but\x20no\x20Allocator\x20is\x20published;\x20R-M5-09\x20carries\x20this\x20checklist\x20as\x20the\x20design-time\x20review\x20obligation.']},{'id':'pattern.commission_holdback','business_requirement':'Commission\x20or\x20bonus\x20that\x20should\x20depend\x20on\x20the\x20order\x20staying\x20undisputed\x20—\x20there\x20is\x20NO\x20clawback\x20once\x20an\x20allocation\x20has\x20run','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Once\x20an\x20allocation\x20runs,\x20the\x20money\x20is\x20in\x20the\x20recipients\x27\x20wallets\x20—\x20Payments\x20are\x20final\x20and\x20only\x20the\x20merchant-funded\x20'+'compensation\x20fund\x20remains.\x20Pay\x20a\x20contested\x20commission\x20from\x20a\x20LATER\x20allocator\x20behind\x20a\x20time\x20window\x20and\x20a\x20dispute\x20'+'condition\x20(see\x20pattern.allocation_staged_release),\x20never\x20from\x20the\x20settlement\x20allocator.','key_queries':['order.dispute','progress.history.time'],'notes':['VERIFIED:\x20no\x20recall/clawback\x20path\x20exists\x20on\x20Payments.\x20INFERENCE:\x20the\x20holdback\x20variant\x20—\x20dry-run\x20before\x20publishing.']},{'id':'pattern.reward_rule_replacement','business_requirement':'Keep\x20the\x20option\x20to\x20replace\x20a\x20Reward\x20rule\x20later\x20(payout\x20is\x20fixed\x20when\x20its\x20Guard\x20is\x20added)','data_source':'OnChainConstant','host':'reward_claim','verifier_level':'none','logic_summary':'Give\x20every\x20reward\x20guard_add\x20an\x20expiration_time\x20if\x20the\x20rule\x20may\x20need\x20replacement\x20—\x20without\x20one\x20the\x20rule\x20is\x20permanent.\x20'+'Replace\x20later\x20via\x20guard_remove\x20\x27<guard-id>\x27,\x20then\x20guard_add\x20the\x20new\x20rule\x20(the\x20\x27expired\x27\x20sweep\x20—\x20guard_remove:\x20\x27expired\x27\x20—\x20only\x20drops\x20EXPIRED\x20guards,\x20never\x20a\x20permanent\x20one).','key_queries':[],'notes':['SCHEMA\x20READING:\x20confirm\x20the\x20guard_remove\x20+\x20guard_add\x20replacement\x20sequence\x20on\x20a\x20test\x20Reward\x20before\x20promising\x20it\x20to\x20users.','Do\x20not\x20set\x20the\x20top-level\x20guard_expiration_time\x20unless\x20you\x20promise\x20claimants\x20no\x20new\x20rules\x20before\x20that\x20time\x20(the\x20same\x20lock\x20also\x20fences\x20guard_remove).']},{'id':'pattern.buy_guard_blocklist','business_requirement':'Refuse\x20certain\x20buyers\x20at\x20purchase\x20time\x20via\x20a\x20mutable\x20list\x20—\x20without\x20redeploying\x20the\x20Guard\x20or\x20the\x20Service','data_source':'SubmittedObject','host':'service_buy_guard','verifier_level':'none','logic_summary':'buy_guard\x20reads\x20on-chain\x20state\x20at\x20purchase\x20time.\x20Bind\x20a\x20Guard\x20that\x20fails\x20when\x20the\x20signer\x20is\x20listed\x20in\x20a\x20Repository\x20'+'policy:\x20context_signer\x20as\x20the\x20key\x20+\x20repository.data\x20has\x20with\x20logic_not.\x20Editing\x20the\x20list\x20needs\x20no\x20new\x20Guard\x20and\x20no\x20new\x20Service.','key_queries':['repository.data'],'notes':['VERIFIED:\x20buy_guard\x20state-read.\x20INFERENCE:\x20the\x20Repository\x20blocklist\x20—\x20dry-run\x20before\x20publishing.','LIMITS:\x20stops\x20NEW\x20orders\x20only\x20—\x20existing\x20orders\x20and\x20their\x20allocations\x20are\x20untouched;\x20the\x20Messenger\x20blacklist\x20does\x20not\x20affect\x20the\x20chain;\x20restrict\x20who\x20can\x20write\x20the\x20Repository\x20policy.']},{'id':'pattern.referral_anti_self_purchase','business_requirement':'Referral\x20commissions\x20where\x20the\x20buyer\x20must\x20not\x20be\x20their\x20own\x20referrer\x20—\x20nothing\x20on-chain\x20checks\x20order.agents','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'agents\x20on\x20an\x20order\x20is\x20filled\x20by\x20the\x20buyer\x20at\x20purchase\x20time\x20and\x20anti_cheat\x20does\x20not\x20read\x20it.\x20Add\x20to\x20the\x20commission\x20'+'allocator\x27s\x20Guard:\x20the\x20referrer\x20is\x20an\x20agent\x20of\x20the\x20order\x20(order.agent\x20has)\x20AND\x20is\x20not\x20the\x20order\x27s\x20owner\x20(order.owner).','key_queries':['order.agent','order.owner'],'notes':['VERIFIED:\x20the\x20anti-cheat\x20gap.\x20INFERENCE:\x20the\x20Guard\x20condition\x20—\x20source-derived,\x20untested;\x20dry-run\x20before\x20publishing.','Blocks\x20the\x20same-address\x20case\x20only.\x20The\x20commission\x20recipient\x20must\x20be\x20an\x20Entity\x20(or\x20Signer)\x20—\x20a\x20GuardIdentifier\x20recipient\x20is\x20the\x20order\x20itself.']},{'id':'pattern.multi_party_recourse','business_requirement':'Multi-party\x20services\x20(hotels,\x20carriers,\x20subcontractors):\x20pay\x20a\x20third\x20party\x20from\x20the\x20order\x20without\x20losing\x20recourse\x20when\x20THEY\x20fail','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'none','logic_summary':'Only\x20the\x20paying\x20order\x20and\x20the\x20Service\x20it\x20bought\x20from\x20take\x20part\x20in\x20an\x20arbitration,\x20and\x20the\x20payout\x20comes\x20from\x20that\x20'+'Service\x27s\x20compensation\x20fund\x20(capped\x20at\x203x\x20the\x20order\x20amount).\x20A\x20third\x20party\x20who\x20is\x20only\x20an\x20allocation\x20recipient\x20cannot\x20'+'be\x20named,\x20notified\x20or\x20heard\x20in\x20a\x20dispute.\x20Cover\x20it\x20in\x20advance:\x20hold\x20their\x20share\x20behind\x20a\x20time\x20window\x20and\x20a\x20no-dispute\x20'+'condition\x20(see\x20pattern.allocation_staged_release),\x20or\x20buy\x20their\x20part\x20as\x20its\x20own\x20order\x20from\x20their\x20Service\x20so\x20you\x20hold\x20'+'the\x20customer\x20rights\x20against\x20them.','key_queries':['order.dispute','progress.history.time'],'notes':['VERIFIED:\x20two-tier\x20orders.\x20INFERENCE:\x20downstream\x20recourse\x20via\x20holdback\x20—\x20dry-run\x20before\x20publishing.']},{'id':'pattern.tiered_amount_ladder','business_requirement':'Dynamic\x20compensation\x20formula\x20(refund\x20proportional\x20to\x20nights\x20used,\x20tiered\x20cancellation\x20penalty)\x20—\x20Allocator\x20sharing\x20is\x20a\x20STATIC\x20configuration\x20value,\x20so\x20a\x20continuous\x20runtime\x20formula\x20cannot\x20be\x20expressed','data_source':'WitnessDerived','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Approximate\x20the\x20formula\x20with\x20a\x20LADDER:\x20one\x20allocator\x20branch\x20per\x20tier,\x20each\x20with\x20fixed\x20sharing,\x20selected\x20by\x20an\x20'+'interval\x20Guard\x20—\x20logic_as_u256_greater\x20/\x20greater_or_equal\x20/\x20lesser\x20/\x20lesser_or_equal\x20(opcodes\x2091-94,\x20'+'ON-CHAIN\x20VERIFIED\x20with\x20numeric\x20operands)\x20over\x20a\x20witness-derived\x20operand\x20(progress.history.time\x20or\x20order.time\x20+\x20duration).\x20'+'Tier\x20Guards\x20partition\x20the\x20operand\x20range\x20so\x20exactly\x20one\x20branch\x20is\x20payable\x20per\x20order.','key_queries':['progress.history.time','order.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Rate\x20tiers\x20for\x20PROPORTIONAL\x20formulas\x20(penalty\x20=\x20share\x20of\x20order):\x20Rate\x20scales\x20with\x20the\x20order\x20amount\x20naturally.','Fixed\x20Amount\x20tiers\x20ONLY\x20for\x20absolute-value\x20formulas\x20(damage\x20repair\x20from\x20a\x20public\x20price\x20table)\x20—\x20and\x20every\x20fixed\x20Amount\x20must\x20stay\x20BELOW\x20the\x20smallest\x20expected\x20order\x20escrow:\x20a\x20larger\x20Amount\x20aborts\x20the\x20allocation\x20with\x20Insufficient\x20balance\x20and\x20PERMANENTLY\x20deadlocks\x20that\x20branch\x20(the\x20order\x20balance\x20is\x20unrecoverable\x20through\x20it).\x20See\x20the\x20on-chain\x20abort\x20when\x20the\x20fixed\x20amount\x20exceeds\x20the\x20pool\x20balance.','Keep\x20tiers\x20disjoint\x20and\x20exhaustive\x20over\x20the\x20expected\x20operand\x20range\x20—\x20an\x20uncovered\x20gap\x20means\x20NO\x20branch\x20is\x20payable\x20and\x20the\x20balance\x20waits\x20for\x20manual\x20resolution.','Each\x20tier\x20needs\x20its\x20own\x20not-yet-paid\x20condition\x20(see\x20pattern.allocation_staged_release)\x20—\x20an\x20Allocation\x20can\x20fire\x20repeatedly\x20and\x20the\x20contract\x20keeps\x20no\x20already-paid\x20flag.']},{'id':'pattern.deadline_window','business_requirement':'Time-boxed\x20eligibility\x20—\x20an\x20action\x20is\x20valid\x20only\x20within\x20N\x20after\x20an\x20anchor\x20(dispute\x20window,\x20claim\x20deadline,\x20delivery\x20SLA,\x20cancellation\x20cutoff,\x20review\x20period)','data_source':'SystemContext','host':'arbitration_usage','verifier_level':'none','logic_summary':'UPPER-BOUND\x20window\x20(deadline):\x20context(Clock)\x20+\x20logic_as_u256_lesser_or_equal(calc_number_add(anchor,\x20N))\x20—\x20Clock\x20<=\x20anchor+N.\x20'+'LOWER-BOUND\x20window\x20(opens\x20at):\x20context(Clock)\x20+\x20logic_as_u256_greater_or_equal(anchor).\x20'+'Bounded\x20both\x20ways:\x20logic_and(greater_or_equal(start),\x20lesser_or_equal(start\x20+\x20duration)).','key_queries':['context(Clock)','progress.history.time','order.time'],'witness_types':[],'mitigated_risks':[],'applicable_industries':['retail','rental','travel','freelance','education','subscription','general'],'notes':['DIRECTION\x20IS\x20THE\x20WHOLE\x20GAME.\x20A\x20deadline\x20window\x20needs\x20LESS_OR_EQUAL;\x20writing\x20greater_or_equal(end_time)\x20instead\x20INVERTS\x20it:\x20everything\x20inside\x20the\x20window\x20is\x20rejected\x20and\x20everything\x20after\x20it\x20is\x20admitted\x20forever\x20—\x20the\x20exact\x20opposite\x20of\x20the\x20intent.','Direction\x20test:\x20ask\x20\x27does\x20delay\x20favor\x20or\x20hurt\x20the\x20party\x20being\x20gated?\x27\x20If\x20the\x20gated\x20action\x20gets\x20LESS\x20attractive\x20over\x20time\x20(dispute,\x20claim,\x20cancellation),\x20it\x20is\x20a\x20deadline\x20window\x20→\x20lesser_or_equal(anchor\x20+\x20N).\x20If\x20it\x20gets\x20MORE\x20attractive\x20over\x20time\x20(early-bird\x20access,\x20vesting\x20release),\x20it\x20is\x20an\x20opening\x20window\x20→\x20greater_or_equal(anchor).','The\x20anchor+N\x20arithmetic\x20MUST\x20go\x20through\x20calc_number_add\x20inside\x20the\x20guard\x20tree;\x20Clock\x20compared\x20against\x20a\x20bare\x20anchor\x20only\x20expresses\x20\x27since\x20when\x27,\x20never\x20\x27until\x20when\x27.','NEVER\x20SUBTRACT\x20to\x20measure\x20elapsed\x20time.\x20`calc_number_subtract(Clock,\x20anchor)\x20>=\x20N`\x20underflows\x20the\x20moment\x20the\x20anchor\x20is\x20in\x20the\x20future\x20at\x20eval\x20time\x20(a\x20future-dated\x20stay_date,\x20an\x20early\x20call,\x20clock\x20skew):\x20current\x20binaries\x20abort\x20with\x20the\x20coded\x20GUARD_NUMBER_SUB_OVERFLOW;\x20pre-fix\x20wasm\x20crashed\x20with\x20an\x20opaque\x20VM-level\x20underflow\x20(klk15-ln-261023\x20§F).\x20Direction-safe\x20shape\x20—\x20keep\x20ALL\x20guard\x20arithmetic\x20to\x20ADDS\x20(u256\x20add\x20cannot\x20underflow)\x20and\x20let\x20the\x20comparison\x20carry\x20the\x20direction:\x20\x27at\x20least\x20N\x20after\x20the\x20anchor\x27\x20is\x20greater_or_equal(Clock,\x20calc_number_add(anchor,\x20N));\x20\x27within\x20N\x20of\x20the\x20anchor\x27\x20is\x20lesser_or_equal(Clock,\x20calc_number_add(anchor,\x20N)).\x20Same\x20algebra,\x20zero\x20underflow\x20surface.','ESLN\x20K4:\x20a\x20dedicated\x20non-underflowing\x20elapsed-time\x20primitive\x20now\x20EXISTS\x20on-chain\x20—\x20time_until(target)\x20returns\x20max(0,\x20target\x20-\x20now)\x20in\x20ms\x20(U64,\x20single\x20numeric\x20child;\x20saturated\x20by\x20design:\x20a\x20past\x20target\x20means\x20deadline-reached,\x20never\x20an\x20abort).\x20Use\x20it\x20when\x20the\x20NATURAL\x20expression\x20is\x20\x27remaining\x20time\x20from\x20now\x27\x20(e.g.\x20time_until(expiry)\x20>=\x20review_window)\x20and\x20the\x20target\x20may\x20already\x20be\x20in\x20the\x20past\x20at\x20eval\x20time.\x20Caveats:\x20it\x20reads\x20the\x20on-chain\x20clock\x20(never\x20compare\x20it\x20against\x20another\x20Clock\x20read\x20in\x20the\x20same\x20tree\x20for\x20drift),\x20and\x20guards\x20built\x20with\x20it\x20require\x20the\x20K4-train\x20binary\x20—\x20publish-time\x20scanners\x20reject\x20opcode\x20209\x20on\x20older\x20binaries.\x20The\x20add-only\x20shape\x20above\x20remains\x20the\x20default\x20for\x20anchor-relative\x20windows\x20where\x20both\x20endpoints\x20are\x20known\x20in\x20advance.','Anchors:\x20progress.history.time\x20(immutable\x20node-entry\x20timestamps,\x201280),\x20order.time\x20(order\x20creation),\x20context(Clock)\x20(now,\x20only\x20for\x20opening\x20windows).\x20For\x20arb\x20usage_guard\x20the\x20natural\x20anchor\x20is\x20order.time\x20—\x20\x27disputable\x20for\x20N\x20after\x20the\x20order\x27.','Window\x20guards\x20are\x20eligible-gates,\x20not\x20schedulers:\x20passing\x20does\x20not\x20fire\x20anything\x20at\x20expiry.\x20If\x20funds\x20must\x20MOVE\x20at\x20expiry,\x20pair\x20with\x20an\x20Allocator\x20or\x20a\x20Machine\x20timed\x20node,\x20not\x20the\x20guard\x20alone.','All\x20four\x20comparison\x20opcodes\x20exist\x20on-chain\x20(opcodes\x2091-94,\x20verified\x20with\x20numeric\x20operands)\x20—\x20the\x20direction\x20failure\x20is\x20a\x20design\x20mistake,\x20not\x20a\x20platform\x20limit.']},{'id':'pattern.enum_variant_branch','business_requirement':'Gate\x20on\x20WHICH\x20shape\x20a\x20stored\x20Move\x20enum\x20currently\x20has,\x20and\x20optionally\x20on\x20the\x20value\x20that\x20variant\x20carries\x20'+'(vote-weight\x20mode,\x20reward\x20recipient\x20mode,\x20allocator\x20recipient\x20mode)','data_source':'SubmittedObject','host':'arbitration_voting','verifier_level':'none','logic_summary':'Every\x20enum-typed\x20field\x20exposes\x20a\x20VARIANT\x20query\x20returning\x20the\x20U8\x20tag\x20(declaration\x20order,\x200-based)\x20plus\x20one\x20payload\x20query\x20per\x20variant:\x20'+'arbitration.voting_guard.vote_weight.variant\x20/\x20.identifier\x20/\x20.value\x20(1363/1364/1365\x20—\x200\x20GuardIdentifier(u8),\x201\x20FixedValue(u32));\x20'+'reward.guard.recipient.variant\x20/\x20.address\x20/\x20.identifier\x20(1603/1632/1633\x20—\x200\x20GuardIdentifier(u8),\x201\x20Entity(address),\x202\x20Signer);\x20'+'reward.guard.amount.variant\x20/\x20.identifier\x20/\x20.fixed\x20(1634/1635/1636\x20—\x200\x20GuardU64Identifier(u8),\x201\x20Fixed(u64));\x20'+'allocation.allocator.sharing.who.variant\x20/\x20.address\x20/\x20.identifier\x20(1071/1072/1073\x20on\x20an\x20Allocation,\x201491/1492/1493\x20on\x20a\x20Service\x27s\x20order\x20allocators\x20—\x20same\x20three\x20tags).\x20'+'Shape:\x20logic_as_u256_equal(query(variant),\x20<tag\x20literal>)\x20as\x20one\x20leg,\x20combined\x20via\x20logic_and\x20with\x20the\x20rest\x20of\x20the\x20gate.','key_queries':['arbitration.voting_guard.vote_weight.variant','arbitration.voting_guard.vote_weight.value','reward.guard.recipient.variant','reward.guard.amount.variant','allocation.allocator.sharing.who.variant','service.order_allocators.allocator.sharing.who.variant'],'witness_types':[],'mitigated_risks':[],'applicable_industries':['general','freelance','retail'],'notes':['NOT\x20BOOL.\x20Variant\x20queries\x20return\x20U8\x20and\x20payload\x20queries\x20return\x20U8/U32/U64/Address\x20—\x20none\x20of\x20them\x20may\x20be\x20a\x20Guard\x20root\x20(the\x20schema\x20rejects\x20non-Bool\x20query\x20roots)\x20and\x20none\x20may\x20be\x20a\x20direct\x20child\x20of\x20logic_and\x20/\x20logic_or.\x20Wrap\x20the\x20variant\x20test\x20in\x20logic_as_u256_equal(query,\x20tag)\x20and\x20read\x20payloads\x20through\x20a\x20comparison\x20as\x20well.','TAG\x20=\x20DECLARATION\x20ORDER\x20in\x20the\x20Move\x20source,\x200-based,\x20and\x20it\x20is\x20ABI:\x20inserting\x20or\x20reordering\x20variants\x20renumbers\x20every\x20later\x20tag.\x20The\x20literal\x20is\x20tied\x20to\x20the\x20deployed\x20package\x20—\x20re-check\x20the\x20enum\x20before\x20hard-coding\x20a\x20tag\x20against\x20a\x20new\x20package\x20version.','PAYLOAD\x20QUERIES\x20ARE\x20STRICT:\x20.identifier\x20/\x20.value\x20/\x20.address\x20/\x20.fixed\x20abort\x20with\x20W_FIELD_TYPE_ERROR\x20when\x20the\x20stored\x20variant\x20is\x20not\x20the\x20one\x20they\x20read\x20—\x20they\x20never\x20return\x200\x20or\x20None.\x20Guards\x20have\x20NO\x20short-circuit\x20(every\x20operand\x20of\x20logic_and\x20/\x20logic_or\x20is\x20evaluated\x20before\x20combining)\x20and\x20any\x20query\x20error\x20aborts\x20the\x20whole\x20verification,\x20so\x20\x27variant==1\x20AND\x20payload(value)>N\x27\x20is\x20NOT\x20safe:\x20it\x20fails\x20hard\x20on\x20every\x20object\x20whose\x20variant\x20is\x200,\x20and\x20logic_or\x20cannot\x20be\x20used\x20as\x20a\x20fallback\x20branch\x20either.\x20Read\x20the\x20payload\x20only\x20when\x20the\x20host\x20already\x20guarantees\x20the\x20variant;\x20otherwise\x20gate\x20on\x20the\x20variant\x20alone\x20and\x20let\x20the\x20contract\x20resolve\x20the\x20payload.','CONFIG\x20TIME\x20IS\x20THE\x20HONEST\x20PLACE\x20for\x20payload-dependent\x20policy:\x20a\x20Reward\x20guard\x27s\x20recipient/amount\x20mode\x20is\x20fixed\x20when\x20the\x20guard\x20is\x20added,\x20and\x20an\x20Arbitration\x20voting_guard\x27s\x20weight\x20mode\x20is\x20fixed\x20at\x20voting_guard_add.\x20When\x20two\x20modes\x20need\x20different\x20policy,\x20configure\x20one\x20guard\x20per\x20mode\x20instead\x20of\x20branching\x20at\x20runtime.','Query\x20ids\x20are\x20per-host-object:\x201071\x20reads\x20a\x20STANDALONE\x20Allocation,\x201491\x20reads\x20the\x20order\x20allocators\x20embedded\x20in\x20a\x20Service\x20—\x20same\x20enum,\x20different\x20object\x20type.\x20Pick\x20by\x20the\x20object\x20the\x20guard\x20actually\x20queries.','OPTIONAL\x20IS\x20NOT\x20READ\x20THROUGH\x20THE\x20VARIANT\x20CHANNEL:\x20Option<T>\x20materialises\x20as\x20a\x20variant\x20internally,\x20but\x20the\x20catalog\x20exposes\x20it\x20as\x20\x27<field>\x20some\x27\x20(Bool)\x20and\x20\x27<field>\x27\x20(payload,\x20aborts\x20when\x20None\x20—\x20e.g.\x201606).\x20Do\x20not\x20attempt\x20a\x20variant\x20query\x20on\x20an\x20Option\x20field.']},{'id':'pattern.named_operator_roster_admission','business_requirement':'Only\x20a\x20dispatched\x20rider\x20ON\x20the\x20order\x27s\x20named-operator\x20roster\x20may\x20advance\x20the\x20handover\x20forward\x20(exclusive\x20admission)','data_source':'SystemContext','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'logic_and[query_order_named_operator_member(object=Order@identifier254),\x20<evidence-presence\x20leg>,\x20logic_equal[query(1563\x20order.service),\x20identifier[N](service_address)]]','key_queries':['order.named_operator\x20member'],'mitigated_risks':['R-LOGISTICS-COURIER'],'applicable_industries':['delivery','retail'],'notes':['Kernel\x20query\x201575\x20returns\x20whether\x20the\x20tx\x20SIGNER\x20is\x20on\x20the\x20ORDER\x27s\x20Progress\x20namedOperator\x20roster\x20—\x20the\x20kernel\x20complement\x20to\x20the\x20namedOperator\x20rail,\x20which\x20only\x20AUTHORIZES\x20roster\x20members\x20and\x20never\x20DENIES\x20non-members\x20(testnet\x20T18b\x20let\x20a\x20non-roster\x20courier\x20pass).','The\x20Order\x20address\x20MUST\x20be\x20read\x20at\x20the\x20task-binding\x20slot\x20(identifier\x20254,\x20b_submission)\x20—\x20the\x20same\x20T10\x20hijack\x20face\x20as\x20the\x20order.*\x20identity\x20legs:\x20a\x20free\x20slot\x20is\x20attacker-fillable\x20with\x20the\x20attacker\x27s\x20own\x20order.','PROTOCOL\x20GATE:\x201575\x20is\x20gated\x20by\x20the\x20v138\x20feature\x20flag\x20(enable_order_named_operator_member)\x20—\x20check\x20upgrade_check\x20(DEPLOY-K1)\x20before\x20publishing\x20on\x20it.','Roster\x20membership\x20is\x20PER-ORDER\x20(written\x20by\x20the\x20dispatch\x20keeper\x20via\x20permission\x20index\x20221\x20at\x20dispatch\x20time)\x20—\x20this\x20admits\x20a\x20rider\x20to\x20ONE\x20order,\x20it\x20is\x20not\x20a\x20global\x20courier\x20allowlist.','Executable\x20form:\x20template\x20tpl_forward_roster_member_gate\x20mounts\x20the\x20roster\x20predicate\x20alongside\x20the\x20evidence-presence\x20and\x20order.service\x20binding\x20legs\x20on\x20the\x20pickup/drop-off\x20forwards.']},{'id':'pattern.mutual_consent_attestation','business_requirement':'N\x20parties\x20must\x20converge\x20on\x20a\x20deterministic\x20SHARED\x20STATE\x20—\x20a\x20negotiated\x20amount,\x20a\x20settlement\x20split,\x20an\x20order\x20'+'amendment,\x20a\x20delivery\x20acceptance,\x20batch\x20terms,\x20a\x20quorum\x20of\x20sign-offs\x20—\x20where\x20each\x20party\x27s\x20contribution\x20is\x20'+'signer-attributed\x20and\x20the\x20joint\x20state\x20is\x20verifiable\x20on\x20chain\x20at\x20execution\x20time,\x20not\x20only\x20in\x20a\x20Messenger\x20'+'thread\x20either\x20party\x20could\x20later\x20deny','data_source':'SubmittedObject','host':'repository_write','verifier_level':'level3_scene_combined','logic_summary':'General\x20multi-party\x20consent\x20ledger\x20on\x20ONE\x20Repository\x20(scenario-neutral;\x20keys\x20below\x20use\x20the\x20refund\x20instance):\x20'+'(1)\x20PROPOSAL\x20—\x20party\x20A\x20writes\x20key=\x27refund_offer\x27\x20under\x20a\x20policy\x20with\x20id_from=Signer\x20+\x20write_once=true\x20and\x20NO\x20'+'write_guard\x20(each\x20writer\x20owns\x20their\x20own\x20row;\x20the\x20flag\x20makes\x20the\x20proposal\x20immutable).\x20(2)\x20RESPONSE\x20—\x20party\x20B\x20writes\x20'+'key=\x27refund_accept\x27\x20under\x20id_from=Signer\x20with\x20data_from_submission=k:\x20the\x20written\x20bytes\x20are\x20passport\x20submission\x20'+'slot\x20k,\x20and\x20the\x20policy\x27s\x20PolicyGuard\x20table\x20entry\x20reads\x20the\x20PROPOSAL\x20row\x20via\x20query_repository_data\x20(1167);\x20'+'the\x20builder\x20appends\x20the\x20queried\x20bytes\x20and\x20each\x20submitted\x20VecU8\x20condition\x20as\x20operands\x20of\x20ONE\x20multi-operand\x20TypeLogicEqual(90)\x20'+'(N\x20operands\x20=\x20all-equal\x20BCS\x20byte\x20comparison),\x20so\x20the\x20kernel\x20ABORTS\x20the\x20response\x20write\x20unless\x20the\x20submitted\x20bytes\x20equal\x20'+'the\x20proposal\x20row\x20byte-for-byte.\x20(3)\x20EXECUTE\x20—\x20the\x20allocator-or-keeper\x20side\x20gates\x20on\x20response\x20EXISTENCE\x20with\x20'+'query_repository_data_has\x20(1166),\x20or\x20aggregates\x20the\x20row\x20set\x20via\x20count_where/find_where/sum_where\x20when\x20the\x20rail\x20needs\x20'+'quorum\x20or\x20weighted\x20totals.\x20Extra\x20parties\x20are\x20extra\x20signer-keyed\x20rows;\x20a\x20response\x20leg\x20may\x20fold\x20SEVERAL\x20proposal\x20rows\x20'+'into\x20the\x20same\x20multi-operand\x20equality.','key_queries':['repository.data\x20has','repository.data'],'mitigated_risks':[],'applicable_industries':['delivery','group_buy','retail','general'],'notes':['GENERAL\x20SOLUTION\x20FOR\x20MULTI-PARTY\x20NEGOTIATION\x20STATE:\x20this\x20is\x20the\x20kernel-anchored\x20primitive\x20for\x20ANY\x20scenario\x20where\x20parties\x20must\x20fix\x20shared\x20deterministic\x20state\x20—\x20scenario\x20adapters\x20only\x20rename\x20keys\x20and\x20swap\x20which\x20leg\x20enforces\x20what:\x20partial\x20refund\x20(\x27refund_offer\x27/\x27refund_accept\x27),\x20settlement\x20split,\x20order\x20amendment,\x20delivery\x20acceptance,\x20group-buy\x20batch\x20terms,\x20milestone\x20sign-offs,\x20dispute\x20quorum.\x20Quorum\x20=\x20count_where\x20over\x20response\x20rows;\x20weighted\x20totals\x20=\x20sum_where\x20(or\x201179\x20order-bound\x20for\x20escrow-real\x20values);\x20an\x20M-party\x20joint\x20value\x20=\x20one\x20response\x20guard\x20folding\x20M\x20proposal\x20rows\x20into\x20the\x20multi-operand\x20equality.','CHAIN-ENFORCED\x20vs\x20SELF-DISCIPLINED:\x20stage\x20(2)\x20is\x20the\x20only\x20link\x20with\x20ON-CHAIN\x20force\x20—\x20the\x20kernel\x20compares\x20bytes\x20at\x20the\x20write\x20site,\x20so\x20a\x20mismatched\x20\x27acceptance\x27\x20cannot\x20exist.\x20Stage\x20(1)\x20with\x20no\x20write_guard\x20merely\x20attributes\x20rows\x20to\x20their\x20writers\x20(id_from=Signer);\x20\x27an\x20offer\x20exists\x27\x20never\x20proves\x20the\x20offer\x20is\x20fair\x20—\x20pattern.partial_refund_pricing\x20still\x20governs\x20WHO\x20proposes\x20what.\x20A\x20policy\x20written\x20with\x20NO\x20guard\x20at\x20all\x20degrades\x20to\x20\x27each\x20side\x20writes\x20their\x20own\x20row\x27\x20—\x20pure\x20self-discipline.','LEGACY\x20QUERIES,\x20NO\x20PROTOCOL\x20GATE:\x201166/1167\x20predate\x20the\x20v136\x20sentinel\x20protocol\x20—\x20a\x20tombstoned\x20row\x20reads\x20back\x20as\x20false\x20(1166)\x20/\x20an\x20empty\x20blob\x20(1167)\x20instead\x20of\x20aborting,\x20and\x20they\x20carry\x20NO\x20quote_guard\x20impack\x20gate\x20(unlike\x201173-1177),\x20so\x20no\x20passport\x20bundling\x20is\x20required\x20for\x20them.','GUARD\x20VOCABULARY\x20IS\x20EQUALITY\x20+\x20AGGREGATES:\x20the\x20consent\x20check\x20is\x20full-byte\x20BCS\x20equality\x20(TypeLogicEqual\x2090,\x20multi-operand\x20all-equal).\x20Numeric\x20predicates\x20on\x20the\x20accept\x20leg\x20(buyer\x20accepts\x20an\x20amount\x20<=\x20X)\x20are\x20NOT\x20expressible\x20—\x20encode\x20the\x20negotiated\x20amounts\x20as\x20discrete\x20byte\x20values\x20(offers\x20are\x20enumerated\x20in\x20practice)\x20or\x20fall\x20back\x20to\x20arbitration.','PASSPORT-ISSUER\x20TRUST\x20BOUNDARY:\x20the\x20equality\x20is\x20enforced\x20against\x20the\x20passport\x20BUILDER\x27s\x20bytes\x20—\x20a\x20malicious\x20passport\x20issuer\x20could\x20substitute\x20the\x20slot-k\x20submission\x20bytes\x20before\x20signing.\x20The\x20issuer\x20is\x20normally\x20the\x20buyer\x27s\x20own\x20client;\x20delegating\x20issuance\x20to\x20a\x20third\x20party\x20reintroduces\x20trust.\x20State\x20this\x20boundary\x20in\x20build_notes.','EMPTY-BLOB\x20PITFALL:\x201167\x20on\x20a\x20MISSING\x20(id,\x20key)\x20returns\x20an\x20empty\x20blob\x20and\x20an\x20empty\x20blob\x20equals\x20an\x20empty\x20submission\x20—\x20stage\x20(2)\x20must\x20query\x20the\x20OFFER\x20row\x20(which\x20write_once\x20guarantees\x20exists\x20once\x20the\x20flow\x20reached\x20acceptance),\x20never\x20the\x20accept\x20row\x20itself.','EXECUTION-SIDE\x20ACCEPTANCE:\x20use\x20the\x20bare\x20query_repository_data_has\x20(Bool)\x20as\x20the\x20allocator-guard\x20leg\x20—\x20the\x20refund\x20pays\x20ONLY\x20when\x20the\x20acceptance\x20row\x20exists;\x20do\x20not\x20invert\x20it\x20(logic_not\x20asserts\x20ABSENCE,\x20the\x20retracted\x20write-guard\x20idiom),\x20and\x20reach\x20for\x20count_where/find_where\x20only\x20when\x20the\x20rail\x20must\x20aggregate\x20multiple\x20consents.','PAIR\x20WITH\x20pattern.partial_refund_pricing:\x20the\x20WTS-evidenced\x20Messenger\x20quote\x20is\x20the\x20self-disciplined\x20prescription;\x20mounting\x20the\x20quoted\x20amount\x20as\x20the\x20offer\x20row\x20and\x20gating\x20acceptance\x20through\x20the\x20PolicyGuard\x20equality\x20upgrades\x20the\x20SAME\x20flow\x20to\x20the\x20chain-enforced\x20path\x20—\x20pick\x20by\x20dispute\x20size\x20and\x20counterparty\x20trust.']}];export const VERIFIER_LEVEL_GUIDANCE=[{'level':'level1_strict_single','pattern':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','when_to_use':'Role\x20permanently\x20tied\x20to\x20one\x20address\x20AND\x20designer\x20accepts\x20lock-in\x20risk','risk_rules':['R-C4-04'],'recommendation':'avoid'},{'level':'level2_identity_set','pattern':'logic_or\x20of\x20multiple\x20identity\x20checks','when_to_use':'Role-based\x20access\x20—\x20multiple\x20authorized\x20identities','risk_rules':['R-C4-04\x20(suppressed)'],'recommendation':'recommended'},{'level':'level3_scene_combined','pattern':'Scene\x20itself\x20verifies\x20identity\x20—\x20no\x20Signer\x20binding\x20needed','when_to_use':'Scene\x27s\x20host\x20object\x20already\x20verifies\x20operator\x20(e.g.,\x20Machine\x20forward,\x20sharing.who=Entity)','risk_rules':[],'recommendation':'default'},{'level':'none','pattern':'No\x20Signer\x20binding\x20required','when_to_use':'Resource\x20flow\x20matters\x20more\x20than\x20caller\x20identity','risk_rules':[],'recommendation':'default'}];export const GUARD_SCHEMA_NOTES=['logic_not\x20takes\x20exactly\x20ONE\x20child\x20under\x20\x27node\x27\x20(not\x20\x27nodes\x27).','logic_and\x20/\x20logic_or\x20accept\x202-8\x20child\x20nodes\x20(MAX_MULTI_OPERANDS)\x20—\x20nest\x20extra\x20conditions\x20inside\x20another\x20logic_and/logic_or.\x20A\x20SINGLE-condition\x20set\x20must\x20NOT\x20be\x20wrapped:\x20logic_or\x20rejects\x20one\x20child\x20(\x27logic_or\x20requires\x20at\x20least\x202\x20child\x20nodes\x27),\x20so\x20a\x20one-node\x20rail\x20uses\x20the\x20bare\x20comparison\x20node\x20as\x20the\x20leg/root\x20(klook-mn-261019\x20KLM-FIND-02\x20—\x209\x20of\x2010\x20real\x20rails\x20are\x20single-node).','query_reward_record_count\x20/\x20query_reward_record_exists\x20/\x20query_reward_record_find\x20require\x20\x27where\x27\x20even\x20when\x20empty\x20—\x20pass\x20where:\x20{}\x20or\x20input\x20validation\x20rejects\x20the\x20call.\x20Use\x20the\x20structured\x20node\x20types;\x20a\x20RAW\x20query(1629)\x20with\x20an\x20empty\x20VecU8\x20parameter\x20is\x20an\x20uncoded\x20VM\x20error\x20(\x27Query\x20bytes\x20is\x20empty\x27),\x20not\x20an\x20all-None\x20condition\x20vector.','Node\x20type\x20names\x20have\x20no\x20abbreviations:\x20logic_as_u256_greater\x20/\x20logic_as_u256_lesser\x20/\x20logic_as_u256_greater_or_equal\x20/\x20logic_as_u256_lesser_or_equal\x20(never\x20gt/lt/ge/le).','context()\x20enum\x20values\x20are\x20exactly:\x20Signer,\x20Clock,\x20Guard.','repository.data\x20cannot\x20be\x20compared\x20with\x20an\x20Address\x20directly\x20—\x20Repository\x20values\x20are\x20stored\x20as\x20U256;\x20use\x20\x27repository.data\x20has\x27\x20for\x20membership\x20or\x20compare\x20the\x20value\x20as\x20a\x20NUMBER.','Whole-repository\x20\x27repository.data\x20count\x27\x20returns\x20the\x20table\x20size,\x20not\x20per-key\x20matches.\x20For\x20per-key\x20totals\x20the\x20Guard\x20CAN\x20count/sum\x20matches\x20itself\x20via\x20\x27repository.data\x20count\x20where\x27\x20/\x20\x27repository.data\x20sum\x20where\x27\x20(predicate-filtered,\x20candidate\x20list\x20max\x20100);\x20only\x20use\x20the\x20trusted-role-writes-total\x20fallback\x20when\x20candidates\x20cannot\x20be\x20enumerated.\x20WITNESS\x20BOUNDARY\x20(S12-③):\x20the\x20100-cap\x20is\x20the\x20guard-table\x20id\x20VECTOR\x20only\x20—\x20the\x20guard\x27s\x20inline\x20WITNESS\x20is\x20capped\x20at\x20256\x20BCS\x20bytes\x20total\x20(~7\x20addresses);\x20roster\x20enumeration\x20belongs\x20in\x20the\x20vector,\x20never\x20in\x20the\x20witness.','ESCROW-BOUND\x20AGGREGATES\x20(protocol\x20136\x20train):\x20\x27repository.data\x20sum\x20where\x20bound\x27\x20(1179,\x20query_repository_data_sum_where_bound)\x20clamps\x20every\x20row\x20to\x20min(row_value,\x20order.amount\x20of\x20the\x20Order\x20the\x20row\x20id\x20names)\x20—\x20a\x20row\x20cannot\x20claim\x20more\x20than\x20its\x20Order\x20actually\x20escrowed,\x20and\x20any\x20row\x20keyed\x20by\x20a\x20non-Order\x20(e.g.\x20a\x20wallet-keyed\x20signer\x20row)\x20contributes\x200\x20fail-closed.\x20Use\x20it\x20for\x20forgery-proof\x20threshold/pricing\x20aggregates,\x20but\x20ONLY\x20over\x20order-keyed\x20rows;\x20swapping\x20the\x20query\x20alone\x20onto\x20signer-keyed\x20rows\x20silently\x20zeroes\x20the\x20total.\x20The\x20Formula\x20pricing\x20surface\x20exposes\x20the\x20same\x20clamp\x20as\x20SUM_BOUND\x20selector\x202.','POST-STATE\x20READS\x20(MOV-PROTOCOL-1212):\x20in\x20the\x20HEAD\x20framework\x20source\x20a\x20guard\x20that\x20WRITES\x20a\x20repository\x20data\x20row\x20(or\x20a\x20reward-triggering\x20record)\x20and\x20then\x20queries\x20it\x20in\x20the\x20SAME\x20PTB\x20observes\x20its\x20own\x20write\x20—\x20the\x20query\x20resolves\x20post-state,\x20not\x20stale\x20pre-state\x20—\x20so\x20write-then-verify\x20legs\x20are\x20constructible\x20again;\x20the\x20upsert-overwrite\x20caveat\x20still\x20applies\x20(a\x20repeat\x20write\x20replaces\x20the\x20row,\x20it\x20does\x20not\x20grow\x20a\x20count).\x20DEPLOYMENT-GATED\x20(DEPLOY-K1):\x20not\x20yet\x20confirmed\x20on\x20the\x20deployed\x20binary\x20—\x20check\x20wowok_buildin_info\x20info=\x27upgrade_check\x27\x20(build_stamp.chain_stamp)\x20before\x20building\x20on\x20it.','QUOTE-GUARD\x20CARRY\x20(MOV-PROTOCOL-1212\x20C):\x20every\x20repository\x20data-row\x20read\x20enforces\x20the\x20quote-guard\x20reference\x20gate\x20—\x20the\x20fetch\x20(1167)\x20and\x20the\x20predicate\x20scans\x20count/sum/find\x20(1173/1174/1176)\x20abort\x20when\x20the\x20queried\x20key\x27s\x20quote_guard\x20is\x20not\x20in\x20the\x20passport\x20impack\x20list,\x20and\x20the\x20keys-where\x20scan\x20(1177)\x20aborts\x20when\x20ANY\x20protected\x20key\x20is\x20uncovered.\x20Design\x20pattern\x20roots\x20that\x20scan\x20protected\x20policies\x20must\x20bundle\x20the\x20quote_guard\x20into\x20every\x20passport\x20that\x20verifies\x20them\x20(fail-closed,\x20not\x20a\x20warning).','ADJUDICATED\x20DESIGN\x20—\x20DO\x20NOT\x20RE-REPORT\x20AS\x20A\x20GAP\x20(CTR-B2/B3\x20+\x20KL-C6\x20③,\x20REVIEW-COMPONENT-PLAN):\x20there\x20is\x20NO\x20Review/rating/comment/star\x20struct\x20on\x20chain\x20BY\x20DESIGN.\x20The\x20review\x20component\x20is\x20deliberately\x20zero-chain-change:\x20review\x20TEXT\x20rides\x20a\x20forward\x20message\x20into\x20Progress.history\x20(permanent\x20on-chain),\x20structured\x20reputation\x20rides\x20Repository\x20rows\x20(id_from=Signer,\x20write_guard\x20=\x20the\x20review-edge\x20credential),\x20incentives\x20ride\x20the\x20Reward\x20object\x20attached\x20to\x20the\x20service\x20through\x20the\x20service-side\x20reward\x20attachment\x20channel,\x20and\x20ServiceInfo.acceptance_score\x20is\x20the\x20buyer-to-supplier\x20Demand-side\x20score.\x20Grep-struct-absence\x20is\x20NOT\x20a\x20capability\x20inventory\x20—\x20before\x20reporting\x20\x27review\x20object\x20missing\x27,\x20check\x20the\x20adjudication\x20and\x20the\x20template\x20review_mode\x20field\x20(subscription/creator-membership\x20et\x20al).\x20Remaining\x20review-system\x20items\x20(multi-column\x20policies,\x20post-state\x20write-once)\x20live\x20in\x20the\x20protocol\x20window,\x20not\x20the\x20test-fix\x20loop.','ENUM\x20FIELDS\x20ARE\x20READ,\x20NOT\x20GUESSED:\x20an\x20enum-typed\x20field\x20has\x20a\x20\x27.variant\x27\x20query\x20(U8\x20tag,\x20declaration\x20order,\x200-based)\x20plus\x20one\x20payload\x20query\x20per\x20variant.\x20The\x20payload\x20queries\x20abort\x20with\x20W_FIELD_TYPE_ERROR\x20when\x20the\x20stored\x20variant\x20differs\x20—\x20they\x20never\x20return\x20a\x20default\x20—\x20and\x20a\x20Guard\x20has\x20no\x20short-circuit,\x20so\x20a\x20payload\x20read\x20may\x20only\x20be\x20combined\x20with\x20the\x20variant\x20test\x20when\x20the\x20host\x20GUARANTEES\x20that\x20variant\x20(e.g.\x20the\x20mode\x20was\x20fixed\x20when\x20the\x20guard\x20was\x20added).\x20Variant\x20results\x20are\x20U8,\x20never\x20Bool:\x20wrap\x20them\x20in\x20logic_as_u256_equal.\x20See\x20pattern.enum_variant_branch.','Verify\x20field\x20paths\x20against\x20the\x20live\x20schema\x20via\x20schema_query\x20(action=\x27get\x27,\x20name=\x27call_guard_*\x27)\x20instead\x20of\x20trusting\x20memory.'];export function getGuardDesignPattern(a){return GUARD_DESIGN_PATTERNS['find'](b=>b['id']===a);}export function searchGuardDesignPatterns(a){const b=a['toLowerCase']();return GUARD_DESIGN_PATTERNS['filter'](c=>{if(c['business_requirement']['toLowerCase']()['includes'](b))return!![];if(c['logic_summary']['toLowerCase']()['includes'](b))return!![];if(c['key_queries']['some'](d=>d['toLowerCase']()['includes'](b)))return!![];return![];});}export function getPatternsByHost(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['host']===a);}export function getPatternsByIndustry(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['applicable_industries']?.['includes'](a));}export function getPatternsByDataSourceClass(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['data_source']===a);}export function getVerifierLevelGuidance(a){return VERIFIER_LEVEL_GUIDANCE['find'](b=>b['level']===a);}export function suggestPatternForRequirement(a){const b=searchGuardDesignPatterns(a);if(b['length']===0x0){const e=GUARD_DESIGN_PATTERNS[0x0];return{'best':e,'alternatives':[]};}const [c,...d]=b;return{'best':c,'alternatives':d};}export const GUARD_DESIGN_PATTERNS_VERSION=0x11;
+import{SV2_PRIMARY_FORM_CLAUSE,SV2_DELIBERATE_ALTERNATIVE_CLAUSE}from'./protocol-facts.js';export const GUARD_DESIGN_PATTERNS=[{'id':'pattern.identity_check_single','business_requirement':'Only\x20the\x20author\x20can\x20purchase\x20this\x20service\x20(strict\x20single-identity)','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level1_strict_single','logic_summary':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Maximally\x20secure\x20but\x20maximally\x20inconvenient','If\x20address\x20is\x20unavailable\x20(key\x20loss,\x20rotation),\x20Guard\x20permanently\x20blocks','Avoid\x20unless\x20role\x20is\x20permanently\x20tied\x20to\x20one\x20address']},{'id':'antipattern.mutable_constant_hardcoded','business_requirement':'A\x20value\x20the\x20business\x20expects\x20to\x20CHANGE\x20over\x20time\x20(payee/payout\x20address,\x20allowlist,\x20deadline\x20window,\x20rate)\x20is\x20hard-coded\x20as\x20a\x20guard\x20table\x20constant','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level1_strict_single','logic_summary':'logic_equal[query(...),\x20identifier[N](value_that_will_need_rotation)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['GUARDS\x20ARE\x20IMMUTABLE\x20AFTER\x20PUBLISH\x20(create()\x20freezes\x20the\x20object;\x20IMMUT-001).\x20The\x20P155-09\x20post-publication\x20patch\x20surface\x20was\x20REVERSED\x20by\x20ruling\x202026-10-31:\x20published\x20guards\x20are\x20structurally\x20unreachable\x20for\x20mutation\x20(&mut\x20is\x20rejected\x20at\x20the\x20reference\x20layer),\x20so\x20a\x20hard-coded\x20mutable-by-design\x20value\x20is\x20PERMANENTLY\x20wrong\x20the\x20moment\x20it\x20needs\x20to\x20rotate\x20—\x20key\x20loss,\x20payee\x20change,\x20window\x20tightening.\x20The\x20only\x20fixes\x20are\x20rebuilding\x20the\x20whole\x20object\x20family\x20(in-flight\x20orders\x20stranded)\x20or\x20nothing.','DESIGN\x20RULE:\x20a\x20value\x20that\x20may\x20ever\x20change\x20MUST\x20live\x20in\x20a\x20permission-governed\x20mutable\x20object\x20—\x20a\x20Repository\x20data\x20row\x20(the\x20guard\x20reads\x20it\x20via\x20repository.data\x20queries),\x20a\x20Service\x20field,\x20or\x20a\x20Permission\x20index\x20—\x20and\x20the\x20guard\x20queries\x20it\x20at\x20evaluation\x20time.\x20Rotation\x20then\x20edits\x20the\x20governed\x20object;\x20the\x20guard\x20constant\x20never\x20moves.','Keep\x20ONLY\x20definitional\x20structure\x20in\x20guard\x20constants:\x20what\x20THIS\x20business\x20is\x20(its\x20escrow\x20shape,\x20its\x20arbitration\x20id,\x20its\x20identity\x20semantics).\x20Everything\x20operational\x20that\x20has\x20a\x20lifetime\x20shorter\x20than\x20the\x20object\x20itself\x20is\x20external\x20state.','Pre-publish\x20check:\x20scan\x20the\x20guard\x20table\x20for\x20Address\x20constants\x20and\x20long-horizon\x20u64\x20windows;\x20for\x20each,\x20answer\x20\x27will\x20this\x20value\x20outlive\x20the\x20business\x20decision\x20that\x20produced\x20it?\x27\x20If\x20no\x20—\x20externalize\x20it\x20now.']},{'id':'antipattern.host_semantic_mismatch','business_requirement':'One\x20guard\x20is\x20pasted\x20across\x20host\x20objects\x20(machine\x20forward\x20edge\x20→\x20allocator\x20rail\x20→\x20reward\x20claim)\x20without\x20re-auditing\x20the\x20per-host\x20evaluation\x20semantics','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'level2_identity_set','logic_summary':'same\x20tree\x20re-hosted:\x20identity\x20legs\x20read\x20the\x20WRONG\x20subject,\x20order-anchored\x20legs\x20lose\x20their\x20anchor,\x20submission\x20legs\x20lose\x20their\x20fill','key_queries':['order.owner','order.agent\x20has','progress.current'],'mitigated_risks':['R-C4-04','R-C3-06'],'notes':['GUARD\x20SEMANTICS\x20ARE\x20HOST-RELATIVE.\x20The\x20same\x20tree\x20evaluates\x20DIFFERENTLY\x20per\x20host\x20because\x20three\x20context\x20inputs\x20change:\x20WHO\x20the\x20tx\x20Signer\x20is\x20(forward\x20edge:\x20the\x20node\x20ADVANCER;\x20allocator\x20gate:\x20the\x20SETTLEMENT\x20TRIGGERER\x20—\x20possibly\x20any\x20bystander;\x20reward\x20claim:\x20the\x20CLAIMANT),\x20WHETHER\x20an\x20Order\x20anchor\x20exists\x20at\x20evaluation\x20time\x20(reward_claim\x20has\x20NO\x20order\x20context\x20—\x20order.*\x20legs\x20have\x20nothing\x20to\x20resolve\x20against\x20unless\x20an\x20order-slot\x20submission\x20fills\x20them),\x20and\x20WHEN\x20submission\x20slots\x20are\x20filled\x20(passport\x20carry-on\x20for\x20forward\x20edges;\x20passport\x20submission\x20for\x20reward\x20claims).','sahr\x20incident:\x20a\x20forward-edge\x20identity\x20guard\x20(signer==order.owner)\x20pasted\x20onto\x20an\x20allocator\x20rail\x20—\x20at\x20settlement\x20the\x20signer\x20is\x20whoever\x20TRIGGERED\x20the\x20payout,\x20so\x20the\x20leg\x20either\x20always\x20fails\x20(order\x20owner\x20never\x20triggers)\x20or\x20was\x20dropped,\x20leaving\x20the\x20rail\x20open-trigger\x20for\x20any\x20address.\x20The\x20verifier\x20now\x20emits\x20RAIL_NO_CALLER_IDENTITY\x20for\x20this\x20shape.','RULE:\x20re-audit\x20every\x20leg\x20against\x20guard-host-context.ts\x20when\x20re-hosting.\x20Identity\x20legs\x20must\x20bind\x20the\x20HOST\x27s\x20signer\x20subject;\x20order-anchored\x20legs\x20must\x20have\x20a\x20live\x20order\x20anchor\x20in\x20that\x20host;\x20submission-referencing\x20legs\x20must\x20match\x20that\x20host\x27s\x20slot-filling\x20channel.','The\x20opposite\x20error\x20is\x20also\x20real:\x20DUPLICATING\x20an\x20identity\x20leg\x20where\x20the\x20scene\x20already\x20authorizes\x20(level3_scene_combined)\x20turns\x20a\x20legitimate\x20open\x20venue\x20into\x20one\x20that\x20dead-locks\x20when\x20a\x20non-owner\x20legitimate\x20party\x20triggers.']},{'id':'pattern.identity_check_allowlist','business_requirement':'Customer\x20must\x20be\x20in\x20an\x20allowlist\x20to\x20purchase','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'vec_contains_address[identifier[N](allowlist_vec),\x20context(Signer)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Allowlist\x20stored\x20as\x20Address\x20vector\x20in\x20table\x20constant']},{'id':'pattern.identity_check_order_holder','business_requirement':'Only\x20order\x20owner\x20or\x20agent\x20can\x20perform\x20operation','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_and[logic_equal[query(1563\x20order.service,\x20@id254),\x20identifier[N](service_address)],\x20logic_or[logic_equal[query(1562\x20order.owner,\x20@id254),\x20context(Signer)],\x20query(1567\x20order.agent\x20has,\x20@id254,\x20Signer)]]','key_queries':['order.service','order.owner','order.agent\x20has'],'mitigated_risks':['R-C4-04','R-C3-06','R-C3-05'],'notes':['1563\x20returns\x20Address\x20→\x20wrap\x20in\x20logic_equal\x20against\x20the\x20service\x20table\x20constant','1562\x20returns\x20Address\x20→\x20wrap\x20in\x20logic_equal','1567\x20returns\x20Bool\x20→\x20use\x20directly\x20as\x20logic_or\x20child','Recommended\x20Level\x202\x20alternative\x20to\x20Level\x201\x20strict\x20binding','MIG-04:\x20order.service\x20binding\x20prevents\x20cross-service\x20order\x20replay','T10\x20HIJACK\x20ANCHOR\x20(rex-mn-261021):\x20the\x20order.*\x20IDENTITY\x20LEGS\x20MUST\x20READ\x20THE\x20ORDER\x20AT\x20SLOT\x20254,\x20never\x20a\x20free\x20submission\x20slot\x20—\x20the\x20caller\x20fills\x20free\x20slots,\x20so\x20an\x20attacker\x20submits\x20their\x20OWN\x20order\x20there\x20(signer\x20==\x20order.owner\x20passes\x20against\x20their\x20own\x20order)\x20and\x20the\x20edge\x20advances\x20the\x20VICTIM\x27s\x20order\x20carried\x20by\x20254;\x20with\x20namedOperator\x20\x22\x22\x20the\x20permission\x20layer\x20passes\x20for\x20anyone\x20(the\x20on-chain\x20forward\x20entry\x20never\x20checks\x20the\x20caller),\x20so\x20this\x20guard\x20is\x20the\x20sole\x20identity\x20leg.\x20The\x20compile\x20blocker\x20GUARD_IDENTITY_SLOT_NOT_TASKBOUND\x20enforces\x20the\x20anchor\x20on\x20resolved\x20trees.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.']},{'id':'pattern.identity_check_service_provider_dynamic','business_requirement':'Verify\x20caller\x20is\x20service\x27s\x20current\x20permission\x20owner\x20(survives\x20permission\x20rotation)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_and[logic_equal[query(1488\x20service.permission),\x20identifier[N](submitted_perm)],\x20logic_or[logic_equal[query(1002\x20permission.owner),\x20context(Signer)],\x20query(1004\x20permission.admin\x20has,\x20Signer)]]','key_queries':['service.permission','permission.owner','permission.admin\x20has'],'mitigated_risks':['R-C4-04','R-C3-05'],'notes':['Dynamic\x20permission\x20address\x20(RECOMMENDED)\x20—\x20survives\x20Service\x20permission\x20rotation','Caller\x20submits\x20permission\x20address;\x20Guard\x20verifies\x20match\x20then\x20checks\x20identity','More\x20complex\x20than\x20static\x20but\x20far\x20more\x20robust']},{'id':'pattern.time_lock_progress','business_requirement':'Customer\x20must\x20wait\x20N\x20hours\x20before\x20completing\x20(time-lock)','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'logic_as_u256_greater_or_equal[{\x22type\x22:\x22context\x22,\x22context\x22:\x22Clock\x22},\x20calc_number_add[query(1280\x20progress.history.time,\x20next_node=<source-node>,\x20find=last,\x20witness=OrderProgress),\x20identifier[N](duration_ms)]]','key_queries':['progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Use\x20convert_witness=100\x20(OrderProgress)\x20to\x20derive\x20Progress\x20from\x20submitted\x20Order\x20ID','ANCHOR\x20SEMANTICS\x20(field\x20truth,\x20progress\x20History):\x20node\x20=\x20the\x20node\x20LEFT,\x20next_node\x20=\x20the\x20node\x20ENTERED,\x20time\x20=\x20the\x20moment\x20of\x20ENTERING\x20next_node.\x20Canonical\x20\x27wait\x20from\x20entering\x20<node>\x27\x20=\x20next_node=<node>\x20+\x20find=last;\x20node=<node>\x20reads\x20the\x20LEAVE\x20moment\x20(rare\x20—\x20state\x20it\x20explicitly).','GENERATION\x20NOTE:\x20query\x201280\x20requires\x20an\x20execution\x20layer\x20>=\x20its\x20release\x20binary;\x20on\x20an\x20OLDER\x20network\x20build,\x20fall\x20back\x20to\x20the\x20repository-oracle\x20time\x20source\x20(pattern.time_source_repository_oracle\x20—\x20the\x20arbitration-verifiable\x20interim),\x20never\x20to\x201272\x20progress.current_time,\x20which\x20is\x20REWRITTEN\x20at\x20every\x20node\x20migration\x20so\x20the\x20lock\x20drifts\x20to\x20the\x20last\x20forward\x20(ETS-C).','Duration\x20in\x20milliseconds\x20—\x20test\x20with\x20small\x20values\x20first','TIME\x20SOURCE\x20DUALITY:\x20chain\x20Clock\x20is\x20native\x20but\x20INDEPENDENT\x20of\x20wall\x20time\x20(block-driven,\x20coarse)\x20—\x20fine\x20for\x20relative\x20locks;\x20for\x20real-world\x20deadlines\x20use\x20pattern.time_source_repository_oracle\x20instead','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.','DIRECTION:\x20greater_or_equal\x20encodes\x20an\x20OPENING\x20gate\x20(blocked\x20until\x20entry+N).\x20For\x20a\x20CLOSING\x20window\x20(action\x20allowed\x20only\x20until\x20entry+N)\x20use\x20pattern.time_window_upper_bound\x20—\x20inverting\x20the\x20comparison\x20makes\x20every\x20window\x20permanently\x20open\x20(etm-mn-261013\x20A-06).']},{'id':'pattern.time_lock_absolute','business_requirement':'Operation\x20allowed\x20only\x20after\x20a\x20fixed\x20timestamp','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'none','logic_summary':'logic_as_u256_greater_or_equal[context(Clock),\x20identifier[N](release_timestamp)]','key_queries':[],'mitigated_risks':[],'notes':['Useful\x20for\x20pre-sale\x20windows,\x20embargo\x20periods','TIME\x20SOURCE\x20DUALITY:\x20comparing\x20a\x20fixed\x20timestamp\x20against\x20context(Clock)\x20uses\x20CHAIN\x20time,\x20not\x20wall\x20time\x20—\x20acceptable\x20when\x20block-rate\x20drift\x20is\x20tolerable;\x20bind\x20the\x20comparison\x20to\x20a\x20self-built\x20repository\x20time\x20oracle\x20(pattern.time_source_repository_oracle)\x20when\x20the\x20cutoff\x20is\x20a\x20real-world\x20date']},{'id':'pattern.time_window_upper_bound','business_requirement':'Action\x20allowed\x20only\x20WHILE\x20the\x20window\x20is\x20open\x20—\x20within\x20N\x20of\x20the\x20anchor\x20(return\x20window,\x20cancel\x20window,\x20review\x20window);\x20after\x20expiry\x20the\x20forward\x20aborts','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'logic_as_u256_lesser_or_equal[{\x22type\x22:\x22context\x22,\x22context\x22:\x22Clock\x22},\x20calc_number_add[query(1280\x20progress.history.time,\x20next_node=<source-node>,\x20find=last,\x20witness=OrderProgress),\x20identifier[N](duration_ms)]]','key_queries':['progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['DIRECTION\x20is\x20the\x20whole\x20point:\x20lesser_or_equal[CLOCK,\x20entry+N]\x20closes\x20the\x20window;\x20greater_or_equal\x20would\x20reopen\x20it\x20forever.\x20Opening\x20gate\x20(wait\x20N\x20before\x20acting)\x20=\x20pattern.time_lock_progress;\x20closing\x20window\x20(act\x20before\x20N\x20elapses)\x20=\x20THIS\x20pattern.','ANCHOR\x20SEMANTICS\x20(field\x20truth,\x20progress\x20History):\x20node\x20=\x20the\x20node\x20LEFT,\x20next_node\x20=\x20the\x20node\x20ENTERED,\x20time\x20=\x20the\x20moment\x20of\x20ENTERING\x20next_node.\x20Canonical\x20\x27return\x20window\x20from\x20entering\x20delivered\x27\x20=\x20next_node=\x27delivered\x27\x20+\x20find=last;\x20node=\x27delivered\x27\x20reads\x20the\x20LEAVE\x20moment\x20(drifts\x20past\x20the\x20delivery\x20itself\x20—\x20the\x20double-wrong\x20form\x20run-75747\x20F-17\x20called\x20out).','GENERATION\x20NOTE:\x20query\x201280\x20requires\x20an\x20execution\x20layer\x20>=\x20its\x20release\x20binary;\x20on\x20an\x20OLDER\x20network\x20build,\x20fall\x20back\x20to\x20the\x20repository-oracle\x20time\x20source\x20(pattern.time_source_repository_oracle\x20—\x20record\x20the\x20anchor\x20timestamp\x20at\x20the\x20entry\x20event,\x20arbitration-verifiable),\x20never\x20to\x201272\x20progress.current_time,\x20which\x20is\x20REWRITTEN\x20at\x20every\x20node\x20migration\x20so\x20the\x20window\x27s\x20base\x20drifts\x20to\x20the\x20last\x20forward\x20(ETS-C).','TIME-ANCHOR-01:\x20anchor\x20on\x20the\x20RIGHT\x20source\x20—\x20a\x20window\x20measured\x20from\x20node\x20entry\x20uses\x20the\x201280\x20node-entry\x20timestamp;\x20a\x20window\x20measured\x20from\x20purchase\x20(e.g.\x20\x27return\x20within\x2030\x20days\x20of\x20buying\x27)\x20anchors\x20on\x20order\x20time\x20via\x20the\x20order\x20witness\x20instead.\x20Declaring\x20the\x20anchor\x20in\x20the\x20business\x20brief\x20is\x20not\x20enough\x20—\x20the\x20recipe\x20must\x20read\x20it.','EXPIRY\x20SEMANTICS:\x20an\x20expired\x20window\x20only\x20fails\x20the\x20FORWARD\x20it\x20gates\x20—\x20it\x20does\x20not\x20refund\x20or\x20cancel\x20by\x20itself;\x20pair\x20with\x20a\x20machine\x20expiry\x20node\x20or\x20an\x20allocator\x20recover\x20rail\x20for\x20the\x20post-window\x20fund\x20path.','TIME\x20SOURCE\x20DUALITY:\x20chain\x20Clock\x20is\x20block-driven\x20—\x20use\x20pattern.time_source_repository_oracle\x20for\x20real-world\x20deadlines.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20required\x20when\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20—\x20see\x20pattern.time_lock_progress\x27s\x20TASK-BINDING\x20SLOT\x20note.']},{'id':'pattern.time_source_repository_oracle','business_requirement':'Guard\x20needs\x20accurate\x20real-world\x20time\x20(review\x20windows,\x20no-show\x20cutoffs,\x20staged-release\x20deadlines)\x20instead\x20of\x20coarse\x20chain\x20Clock','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'Self-built\x20time\x20oracle:\x20an\x20off-chain\x20keeper\x20pushes\x20wall-clock\x20timestamps\x20into\x20a\x20Repository\x20'+'(repository_write\x20gated\x20by\x20permission);\x20Guards\x20read\x20repository.data\x20(query\x201167)\x20and\x20compare\x20the\x20'+'oracle\x20timestamp\x20with\x20logic_as_u256_greater_or_equal\x20instead\x20of\x20context(Clock).','key_queries':['repository.data'],'mitigated_risks':[],'applicable_industries':['subscription','travel','rental','education'],'notes':['Chain\x20time\x20is\x20INDEPENDENT\x20of\x20real\x20time:\x20Clock\x20advances\x20with\x20blocks\x20—\x20usable\x20but\x20imprecise\x20for\x20business\x20deadlines;\x20both\x20tracks\x20are\x20first-class,\x20pick\x20per\x20requirement\x20and\x20DOCUMENT\x20which\x20one\x20a\x20published\x20Guard\x20relies\x20on\x20(IMMUT-001)','No\x20public\x20time\x20oracle\x20exists\x20on-chain\x20today\x20—\x20the\x20Repository\x20oracle\x20is\x20self-built\x20(owner\x20pushes,\x20users\x20verify)','Trust\x20trade-off:\x20the\x20oracle\x20publisher\x20can\x20skew\x20timestamps\x20—\x20pin\x20the\x20Repository\x20address\x20as\x20a\x20table\x20constant\x20and\x20gate\x20writes\x20with\x20a\x20permission\x20check','Freshness\x20bound:\x20add\x20a\x20second\x20clause\x20asserting\x20the\x20oracle\x20timestamp\x20is\x20itself\x20recent\x20(oracle_time\x20+\x20max_staleness\x20>=\x20context(Clock))\x20so\x20a\x20stalled\x20keeper\x20fails\x20the\x20Guard\x20loudly\x20instead\x20of\x20freezing\x20windows\x20silently']},{'id':'pattern.repository_data_check','business_requirement':'External\x20data\x20must\x20match\x20expected\x20value\x20(e.g.,\x20weather,\x20price\x20feed)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'logic_equal[query(1167\x20repository.data,\x20policy,\x20key),\x20identifier[N](expected_value)]','key_queries':['repository.data'],'mitigated_risks':[],'notes':['Repository\x20address\x20declared\x20as\x20table\x20constant','Timestamp\x20keys\x20may\x20need\x20convert_number_address','quote_guard\x20context:\x20fails\x20in\x20gen_passport\x20(impack_list\x20empty),\x20works\x20in\x20on-chain\x20business\x20operations\x20(see\x20R-X1-10)','EXISTENCE\x20IS\x20NOT\x20TRUST:\x20this\x20pattern\x20reads\x20a\x20row;\x20it\x20does\x20not\x20prove\x20who\x20wrote\x20it.\x20A\x20forward\x20gated\x20only\x20on\x20\x27the\x20row\x20exists\x27\x20(1166\x20has\x20/\x20a\x20non-empty\x201167)\x20is\x20satisfied\x20by\x20ANY\x20pre-written\x20row,\x20including\x20one\x20forged\x20by\x20a\x20counterparty\x20—\x20the\x20write\x20side\x20must\x20bind\x20the\x20writer\x20(pattern.repository_write_authorization;\x20R-X1-17\x20reports\x20a\x20write_guard\x20that\x20folds\x20true\x20or\x20names\x20no\x20identity).\x20Verified\x20on\x20testnet\x20(test-14\x20HIGH-04):\x20a\x20buyer\x20forged\x20the\x20merchant\x27s\x20shipping-tracking\x20row\x20and\x20the\x20ship/deliver\x20evidence\x20gates\x20passed\x20on\x20it\x20(tx\x20BLA7F62r).','PER-ORDER\x20TIER\x20GRID\x20(B-3):\x20query\x201167\x20accepts\x20the\x20ORDER\x20address\x20as\x20the\x20key\x20—\x20merchant\x20writes\x20a\x20per-order\x20tier\x20number\x20into\x20the\x20Repository,\x20allocator\x20Guards\x20select\x20with\x20logic_equal[repository.data(\x27tier\x27,\x20order),\x20N].\x20Allocator\x20amounts\x20are\x20FROZEN\x20at\x20publish\x20(the\x20allocation\x20entry\x20computes\x20shares\x20from\x20the\x20published\x20table;\x20the\x20submission\x20only\x20picks\x20RECIPIENTS,\x20never\x20amounts),\x20so\x20per-order\x20amount\x20differences\x20are\x20expressible\x20ONLY\x20as\x20a\x20tier\x20grid\x20(one\x20allocator\x20per\x20tier)\x20—\x20continuous/arbitrary\x20amounts\x20are\x20not.\x20Without\x20quote_guard/write_guard\x20binding\x20buyer\x20credentials,\x20the\x20tier\x20data\x20is\x20a\x20unilateral\x20merchant\x20declaration\x20(residual\x20risk;\x20enforce\x20the\x20binding\x20in\x20the\x20service\x20template).','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.']},{'id':'pattern.repository_write_authorization','business_requirement':'Evidence\x20rows\x20(tracking\x20number,\x20inspection\x20receipt,\x20return\x20receipt,\x20oracle\x20value,\x20roster\x20entry)\x20'+'may\x20only\x20be\x20written\x20by\x20designated\x20parties\x20—\x20and\x20the\x20guard\x20must\x20bind\x20WHO\x20writes,\x20not\x20merely\x20that\x20some\x20object\x20exists','data_source':'SystemContext','host':'repository_write','verifier_level':'level2_identity_set','logic_summary':'logic_and[\x20<identity\x20leaf\x20—\x20MANDATORY>,\x20<data-shape\x20leaf\x20—\x20optional>\x20]\x20where\x20the\x20identity\x20leaf\x20is\x20one\x20of:\x20'+'logic_equal[context(Signer),\x20identifier#N(Address)]\x20(single\x20writer)\x20|\x20'+'vec_contains_address[identifier#N(VecAddress),\x20context(Signer)]\x20(writer\x20set)\x20|\x20'+'logic_or[logic_equal[query(1562\x20order.owner),\x20context(Signer)],\x20query(1567\x20order.agent\x20has,\x20Signer)]\x20(writer\x20must\x20hold\x20the\x20Order\x20the\x20row\x20is\x20keyed\x20by)\x20|\x20'+'logic_or[<merchant\x20Signer>,\x20query(1008\x20permission.entity.perm\x20has,\x20merchant\x20Permission,\x20[context(Signer),\x20<custom\x20index>])]\x20(staff\x20via\x20Permission\x20entity\x20table).\x20'+'NEVER\x20a\x20bare\x20constant-true\x20identifier,\x20a\x20self-comparison,\x20or\x20an\x20unsigned\x20value\x20>=\x200\x20—\x20see\x20notes.','key_queries':['repository.data\x20has','repository.data','repository.policy.id_from','order.owner','order.agent\x20has','permission.entity.perm\x20has','proof.signer','proof.time'],'mitigated_risks':['R-X1-17','R-C1-03'],'applicable_industries':['retail','travel','education','rental','general'],'notes':['WHAT\x20THE\x20CHAIN\x20CHECKS\x20(the\x20blind\x20spot):\x20the\x20Repository\x20policy-creation\x20entry\x20(the\x20R-D-1\x20validation)\x20asserts\x20only\x20that\x20a\x20policy\x20with\x20id_from\x20NONE\x20has\x20a\x20NON-EMPTY\x20write_guard\x20LIST\x20'+'(E_POLICY_WRITE_GUARD_REQUIRED\x20=\x2022)\x20—\x20it\x20never\x20evaluates\x20what\x20any\x20listed\x20Guard\x20proves.\x20A\x20placeholder\x20guard\x20that\x20returns\x20true\x20for\x20everyone\x20therefore\x20publishes\x20cleanly\x20and\x20is\x20exactly\x20the\x20'+'open\x20door\x20an\x20empty\x20list\x20would\x20have\x20been,\x20with\x20no\x20warning.\x20'+'Verified\x20on\x20testnet\x20(test-14\x20HIGH-04):\x20a\x20NON-merchant\x20signer\x20wrote\x20a\x20forged\x20tracking\x20row\x20for\x20another\x20buyer\x27s\x20order\x20(tx\x20BLA7F62r…);\x20the\x20merchant\x27s\x20legitimate\x20write\x20simply\x20upserted\x20over\x20it\x20(tx\x20DaZaPn6o…).\x20'+'Rule\x20R-X1-17\x20now\x20folds\x20the\x20tree\x20and\x20rejects\x20constant-true\x20roots\x20/\x20write_guards\x20with\x20no\x20context(Signer)\x20leaf.','NO\x20AUTHOR\x20IS\x20RECORDED:\x20a\x20Repository\x20row\x20carries\x20no\x20writer\x20field\x20(data_id\x20→\x20data\x20value\x20only).\x20The\x20write_guard\x20is\x20the\x20sole\x20attribution\x20mechanism,\x20and\x20it\x20is\x20a\x20GATE,\x20not\x20a\x20signature.\x20'+'So\x20\x27the\x20merchant\x20wrote\x20it\x27\x20is\x20not\x20provable\x20on\x20chain\x20from\x20a\x20bare\x20string\x20—\x20which\x20is\x20what\x20downstream\x20trust\x20scoring\x20and\x20arbitration\x20evidence\x20silently\x20assume.','PROVENANCE-GRADE\x20EVIDENCE:\x20store\x20the\x20ADDRESS\x20OF\x20A\x20SIGNED\x20WTS\x20PROOF\x20as\x20the\x20row\x20value\x20instead\x20of\x20the\x20raw\x20string.\x20Proof\x20objects\x20carry\x20proof.signer\x20(3555),\x20proof.time\x20(3573)\x20and\x20are\x20immutable,\x20'+'so\x20the\x20consuming\x20forward\x20Guard\x20can\x20verify\x20Prover\x20+\x20Time\x20binding\x20(pattern.verifier_evidence_philosophy)\x20rather\x20than\x20mere\x20existence.\x20Existence-only\x20reads\x20(repository.data\x20has,\x201166)\x20are\x20satisfied\x20by\x20ANY\x20pre-written\x20row,\x20including\x20a\x20forged\x20one.\x20'+'ABOUT\x20CONTRACT\x20(K3\x202026-10-12,\x20amended\x20gf26\x20batch2\x202026-10-26\x20—\x20RECOMMENDED\x20NORM,\x20not\x20chain-enforced):\x20proof.about\x20is\x20bound\x20at\x20creation\x20to\x20the\x20conversation\x20PEER\x20ACCOUNT\x20address\x20(address\x20first\x20byte\x20=\x20account\x20type;\x20a\x20Proof\x20self-address\x20is\x20the\x20other\x20recommended\x20shape)\x20OR\x20to\x20the\x20ORDER\x20address\x20the\x20credential\x20is\x20about\x20(the\x20order-anchored\x20required_info\x20flow).\x20The\x20order-anchored\x20form\x27s\x20trust\x20does\x20NOT\x20come\x20from\x20reading\x20about\x20anywhere\x20—\x20the\x20owner-minted\x20Proof\x20is\x20pinned\x20on-chain\x20at\x20bind\x20time\x20(the\x20order-side\x20required-info\x20bind\x20entry\x20asserts\x20about\x20==\x20this\x20order\x20AND\x20creator\x20==\x20the\x20order\x20owner,\x20E_REQUIRED_INFO_PROOF_NOT_BOUND\x20otherwise,\x20and\x20the\x20Proof\x20object\x20is\x20frozen\x20on-chain),\x20so\x20the\x20enforcement\x20point\x20is\x20the\x20bind\x20entry,\x20never\x20a\x20guard\x20read.\x20It\x20is\x20a\x20messenger\x20contact\x20record\x20or\x20an\x20order\x20credential\x20anchor\x20—\x20do\x20not\x20verify\x20guards\x20on\x20proof.about\x20(guards\x20can\x20only\x20read\x20proof.signer\x20(3555)\x20/\x20proof.time\x20(3573))\x20and\x20do\x20not\x20treat\x20the\x20peer-account\x20form\x20as\x20a\x20business-object\x20(Progress/Order/Arb)\x20reference;\x20prefer\x20proof.signer\x20+\x20proof.time\x20+\x20the\x20Repository\x20row\x20key\x20for\x20evidence\x20binding\x20(same\x20doctrine\x20as\x20machine-templates\x20submitChainProof:\x20about\x20carries\x20no\x20decision\x20semantics).\x20Deviations\x20are\x20an\x20audit\x20signal,\x20not\x20a\x20validity\x20error.','ANTI-OVERWRITE\x20—\x20RETRACTED\x20IDIOM,\x20READ\x20THIS\x20BEFORE\x20EMITTING\x20(ofn-mn-261012\x20F-02,\x20mainnet\x20A/B\x20verified):\x20the\x20previously\x20taught\x20'+'write-once\x20leg\x20logic_not(query(\x27repository.data\x20has\x27,\x20policy,\x20key))\x20(1166)\x20DOES\x20NOT\x20WORK\x20and\x20MUST\x20NOT\x20be\x20taught\x20or\x20emitted\x20—\x20'+'the\x20write\x20guard\x20is\x20verified\x20INSIDE\x20the\x20same\x20PTB\x20as\x20the\x20write,\x20before\x20the\x20row\x20exists,\x20so\x20the\x20leg\x20evaluates\x20against\x20the\x20PRE-write\x20'+'state\x20and\x20always\x20aborts\x20the\x20write\x20(abort\x207).\x20A/B\x20on\x20mainnet:\x20identical\x20guard\x20minus\x20the\x20leg\x20succeeded,\x20and\x20the\x20author\x20then\x20'+'overwrote\x20their\x20own\x205-star\x20review\x20with\x201\x20star.\x20The\x20guard-leg\x20emulation\x20stays\x20impossible,\x20but\x20the\x20chain-side\x20write-once\x20primitive\x20'+'HAS\x20LANDED\x20(K3-a):\x20every\x20policy\x20carries\x20a\x20write_once\x20flag\x20(E_POLICY_WRITE_ONCE_CONFLICT\x20=\x2024)\x20—\x20with\x20it\x20armed,\x20'+'a\x20second\x20write\x20to\x20the\x20same\x20key\x20aborts\x20at\x20the\x20overwrite\x20checkpoint\x20instead\x20of\x20UPSERTing.\x20Arm\x20the\x20FLAG\x20for\x20per-key\x20write-once\x20'+'(per-policy:\x20it\x20applies\x20to\x20EVERY\x20key\x20under\x20it\x20—\x20one-review-per-account\x20=\x20id_from\x20Signer\x20+\x20write_once),\x20never\x20the\x20retracted\x20leg.\x20'+'The\x20ONCE\x20slot\x20(identifier\x20255,\x20b_submission=true)\x20for\x20one\x20write\x20per\x20GUARD-POOL\x20(255\x20is\x20per\x20'+'pool,\x20not\x20per\x20order\x20—\x20see\x20R-ONCE-SCOPE-01\x20and\x20pair\x20it\x20with\x20the\x20order\x20anchor\x20R-ANCHOR-01)\x20and\x20the\x20254\x20task-binding\x20slot\x20for\x20'+'order-bound\x20rails\x20remain\x20the\x20guard-side\x20once\x20primitives.\x20Publish-time\x20hardening:\x20the\x20pre-publish\x20gate\x20must\x20FLAG\x20any\x20repository\x20write\x20guard\x20containing\x20'+'logic_not(repository.data\x20has\x20...)\x20as\x20INEFFECTIVE,\x20not\x20accept\x20it\x20(a\x20defence\x20that\x20cannot\x20be\x20enforced\x20is\x20worse\x20than\x20none).','TASK-BINDING\x20SLOT\x20(identifier\x20254,\x20chain\x20N-1):\x20a\x20Guard\x20consumed\x20by\x20a\x20task-bound\x20Progress\x20guarded\x20forward\x20MUST\x20DECLARE\x20the\x20254\x20slot\x20in\x20its\x20table\x20(b_submission=true)\x20—\x20the\x20caller\x20then\x20fills\x20it\x20with\x20the\x20Order\x20address\x20the\x20Progress\x20is\x20bound\x20to,\x20and\x20the\x20chain-side\x20task-binding\x20check\x20compares\x20them\x20(progress\x2011/12\x20on\x20absent/mismatch).\x20Chain\x20truth:\x20the\x20passport-submission\x20builder\x20DROPS\x20caller-supplied\x20slots\x20the\x20table\x20does\x20not\x20declare,\x20so\x20an\x20undeclared\x20254\x20can\x20never\x20reach\x20the\x20passport\x20—\x20declare\x20it\x20at\x20Guard\x20build\x20time,\x20there\x20is\x20no\x20post-hoc\x20fix\x20(Guards\x20are\x20immutable).\x20255\x20stays\x20opt-in\x20caller-chosen-key;\x20254\x20is\x20mandatory-but-self-reported\x20for\x20order-bound\x20rails.','ID_ROUTING\x20INTERACTS\x20WITH\x20THIS\x20GUARD\x20(the\x20policy-creation\x20validation):\x20id_from\x20NONE\x20(caller-supplied\x20data\x20id)\x20REQUIRES\x20a\x20non-empty\x20write_guard\x20list\x20—\x20that\x20is\x20precisely\x20the\x20case\x20this\x20pattern\x20exists\x20for,\x20because\x20the\x20caller\x20also\x20chooses\x20the\x20key\x20and\x20can\x20overwrite\x20anyone\x27s\x20row.\x20'+'With\x20id_from\x20Signer/Clock\x20the\x20id\x20is\x20auto-generated;\x20the\x20list\x20MAY\x20still\x20be\x20non-empty\x20(the\x20guard\x20authorizes\x20the\x20write\x20and\x20may\x20extract\x20the\x20value\x20via\x20data_from_submission),\x20but\x20every\x20PolicyGuard\x27s\x20id_from_submission\x20MUST\x20be\x20None,\x20'+'since\x20a\x20submission-derived\x20id\x20would\x20conflict\x20with\x20the\x20routing\x20(E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN\x20=\x2023).\x20Choosing\x20id_from=Signer\x20with\x20no\x20guard\x20is\x20the\x20HONEST\x20way\x20to\x20say\x20\x27anyone\x20may\x20write\x20their\x20OWN\x20row\x27;\x20binding\x20an\x20always-true\x20guard\x20under\x20id_from=None\x20is\x20the\x20dishonest\x20way,\x20and\x20is\x20what\x20R-X1-17\x20reports.','Writers\x20that\x20are\x20services\x20rather\x20than\x20EOAs\x20(an\x20oracle,\x20a\x20partner\x20merchant)\x20still\x20need\x20the\x20identity\x20leaf:\x20the\x20Signer\x20of\x20the\x20write\x20transaction\x20IS\x20the\x20caller,\x20so\x20a\x20submitted-Address\x20comparison\x20alone\x20(Type3)\x20is\x20forgeable\x20—\x20compare\x20context(Signer)\x20against\x20the\x20allowlist,\x20or\x20require\x20the\x20writer\x27s\x20Passport/Proof\x20via\x20the\x20data-shape\x20leaf.']},{'id':'pattern.repository_quote_guard_subscription','business_requirement':'Repository\x20data\x20access\x20requires\x20payment\x20proof\x20(subscription\x20revenue\x20model)','data_source':'SubmittedObject','host':'repository_write','verifier_level':'level3_scene_combined','logic_summary':'Repository\x20policy\x20sets\x20quote_guard\x20(a\x20standalone\x20repository-backed\x20guard:\x20immutable\x20+\x20rep=true).\x20'+'When\x20a\x20Guard\x20queries\x20this\x20Repository\x27s\x20data\x20(query\x201167),\x20check_repository_quote_guard\x20verifies\x20'+'the\x20quote_guard\x20is\x20in\x20impack_list.\x20The\x20quote_guard\x20itself\x20verifies\x20a\x20submitted\x20Payment\x20'+'(payment.info.for\x20matches\x20Repository,\x20payment.amount\x20meets\x20subscription\x20price).\x20'+'User\x20submits\x20Payment\x20via\x20Passport\x20→\x20quote_guard\x20verified\x20→\x20added\x20to\x20impack_list\x20→\x20query\x201167\x20passes.','key_queries':['repository.data','payment.info.for','payment.amount'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['VERIFIED:\x20the\x20passport\x20quote-guard\x20verification\x20runs\x20on\x20every\x20query\x201167\x20read\x20(the\x20quote_guard\x20must\x20be\x20in\x20impack_list)','Repository.owner_receive<T>\x20accepts\x20Payment\x20as\x20subscription\x20revenue','quote_guard\x20must\x20be\x20a\x20standalone\x20repository-backed\x20guard:\x20immutable=true,\x20relies\x20empty,\x20rep=true','VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20valid\x20Payment,\x20quote_guard\x20verifies\x20Payment\x20fields\x20—\x20no\x20object-linker\x20binding\x20needed','gen_passport\x20context:\x20quote_guard\x20fails\x20(impack_list\x20empty)\x20—\x20only\x20use\x20for\x20on-chain\x20business\x20operations','Business\x20model:\x20data\x20provider\x20publishes\x20weather/market/oracle\x20data\x20to\x20Repository,\x20'+'users\x20pay\x20subscription\x20to\x20access\x20data\x20in\x20their\x20Machine\x20flows','MODE\x20A\x20(direct\x20payment\x20verify)\x20—\x20four\x20verifiable\x20elements\x20on\x20the\x20submitted\x20Payment:\x20'+'1)\x20amount:\x20logic_as_u256_greater_or_equal[payment.amount,\x20N]\x20(>=\x20subscription\x20price);\x20'+'2)\x20subscription\x20type:\x20payment.info.remark\x20/\x20payment.info.index\x20encodes\x20the\x20tier/plan;\x20'+'3)\x20fixed\x20recipient:\x20payment.record.recipient\x20must\x20equal\x20the\x20designated\x20payee\x20(Treasury/owner\x20address);\x20'+'4)\x20occurrence\x20time:\x20payment.time\x20within\x20the\x20validity\x20window\x20(logic_as_u256_greater_or_equal\x20/\x20logic_as_u256_lesser_or_equal\x20vs\x20context(Clock))','Payment\x20is\x20freeze_object\x20after\x20creation\x20—\x20all\x20four\x20elements\x20are\x20tamper-proof\x20evidence','For\x20a\x20LOWER\x20user-cost\x20variant\x20(no\x20per-user\x20payment\x20submission),\x20see\x20pattern.repository_whitelist_sync\x20(Mode\x20B)']},{'id':'pattern.repository_whitelist_sync','business_requirement':'Entitlement\x20check\x20via\x20a\x20synced\x20allowlist\x20Repository\x20instead\x20of\x20per-user\x20payment\x20submission\x20(low-friction\x20entitlements:\x20memberships,\x20authorizations,\x20paid-user\x20lists)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'Off-chain\x20collector\x20gathers\x20eligible\x20users\x20(transfers\x20/\x20Payments\x20to\x20the\x20designated\x20receiving\x20address\x20or\x20object,\x20'+'Service\x20orders,\x20or\x20any\x20off-chain\x20record)\x20and\x20syncs\x20the\x20list\x20into\x20a\x20dedicated\x20Repository\x20object\x20'+'(entries\x20may\x20carry\x20a\x20validity\x20window,\x20e.g.\x20authorized\x20time\x20period).\x20'+'The\x20consuming\x20Guard\x20checks\x20membership\x20via\x20query\x201166/1167\x20(repository.data)\x20keyed\x20by\x20the\x20caller:\x20'+'vec_contains_address-style\x20logic_or\x20over\x20[repository.data(key=Signer)]\x20or\x20logic_equal[repository.data(...),\x20identifier[N](expected)].\x20'+'Repository\x20writes\x20go\x20through\x20the\x20id-keyed\x20data\x20write\x20operations\x20(batch\x20up\x20to\x20100\x20entries\x20per\x20tx).','key_queries':['repository.data'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['MODE\x20B\x20(whitelist\x20sync)\x20—\x20user-cost\x20optimization\x20of\x20Mode\x20A\x20(pattern.repository_quote_guard_subscription):\x20'+'users\x20do\x20NOT\x20submit\x20a\x20Payment\x20at\x20verification\x20time;\x20the\x20operator\x20proves\x20eligibility\x20off-chain\x20and\x20syncs\x20the\x20roster','TRADE-OFF:\x20eventual\x20consistency\x20—\x20the\x20roster\x20updates\x20at\x20the\x20collector\x27s\x20sync\x20frequency\x20(slight\x20delay),\x20'+'vs\x20Mode\x20A\x27s\x20instant\x20per-payment\x20proof.\x20Choose\x20by\x20business:\x20high-frequency\x20low-value\x20→\x20Mode\x20B;\x20'+'high-value\x20instant\x20entitlement\x20→\x20Mode\x20A','Entry\x20shape:\x20key\x20=\x20user\x20address\x20(or\x20derived\x20id),\x20value\x20=\x20expiry\x20timestamp\x20/\x20tier\x20/\x20scope;\x20'+'time-window\x20enforcement\x20compares\x20entry\x20value\x20against\x20context(Clock)\x20in\x20the\x20Guard','VERIFIED:\x20id-keyed\x20data\x20writes\x20(batch\x20≤100),\x20query\x201166/1167\x20(repository.data\x20queries),\x20'+'standalone-guard\x20marking\x20(1167\x20marks\x20query-only\x20repositories)','The\x20collector\x20can\x20source\x20eligibility\x20from:\x20transfers\x20or\x20Payments\x20to\x20a\x20fixed\x20receiving\x20address/object,\x20'+'Service\x20orders\x20(order.service\x20==\x20designated\x20service),\x20or\x20external\x20off-chain\x20records','Repository\x20access\x20economics\x20stay\x20OUT\x20of\x20this\x20pattern\x20(K3\x2010\x20§5\x20D5\x20ruling:\x20reuse\x20Reward/Allocation\x20'+'outside\x20the\x20Repository\x20for\x20payment;\x20the\x20Repository\x20here\x20is\x20the\x20roster,\x20not\x20the\x20payment\x20rail)']},{'id':'pattern.supply_chain_suborder_verification','business_requirement':'Sub-service\x20purchase\x20requires\x20ownership\x20of\x20main\x20service\x20order\x20(supply\x20chain\x20milestone\x20unlock)','data_source':'SubmittedObject','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'Sub-service\x20buy_guard\x20verifies\x20submitted\x20main\x20Order:\x20'+'logic_and[logic_equal[query(order.owner),\x20context(Signer)],\x20logic_equal[query(order.service),\x20identifier[N](main_service_address)]].\x20'+'User\x20submits\x20main\x20Order\x20via\x20Passport\x20(b_submission=true),\x20buy_guard\x20verifies\x20ownership\x20+\x20service\x20match.','key_queries':['order.owner','order.service'],'mitigated_risks':['R-C3-05'],'applicable_industries':['travel','rental','education','freelance'],'notes':['VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20main\x20Order\x20as\x20evidence,\x20buy_guard\x20verifies\x20order.owner==Signer\x20AND\x20order.service==main_service','Each\x20milestone\x20=\x20one\x20sub-order\x20with\x20its\x20own\x20Service\x20+\x20buy_guard\x20referencing\x20the\x20main\x20order','Main\x20flow\x20can\x20branch\x20to\x20different\x20sub-services\x20based\x20on\x20Machine\x20node\x20progression','No\x20parent_order\x20field\x20needed\x20—\x20relationship\x20verified\x20via\x20buy_guard\x20querying\x20submitted\x20Order\x20fields','Enables\x20supply\x20chain\x20composition:\x20main\x20service\x20→\x20multiple\x20sub-services\x20with\x20conditional\x20access']},{'id':'pattern.payment_exception_compensation','business_requirement':'Exception\x20branch\x20triggers\x20compensation\x20Payment\x20(e.g.,\x20delivery\x20delay\x20>\x2030min\x20auto-compensates\x20customer)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Exception\x20forward\x20guard\x20verifies\x204-dimensional\x20anti-reuse\x20binding:\x20logic_and['+'logic_equal[query(payment.info.for),\x20identifier[N](order_address)],\x20'+'logic_equal[query(payment.info.guard),\x20identifier[N](this_guard_address)],\x20'+'logic_as_u256_greater_or_equal[query(payment.amount),\x20identifier[N](compensation_amount)],\x20'+'logic_as_u256_equal[query(payment.info.index),\x20query(progress.history\x20count)],\x20'+'logic_string_nocase_equal[query(payment.info.remark),\x20query(progress.current)]].\x20'+'Treasury\x20withdraws\x20to\x20customer\x20with\x20PaymentInfo(for_object=order,\x20for_guard=this,\x20index=history_count_at_creation,\x20remark=node_name).\x20'+'Customer\x20submits\x20Payment\x20via\x20Passport;\x20guard\x20verifies\x20index\x20matches\x20current\x20unique\x20step\x20(progress.history\x20count,\x20U64,\x20monotonically\x20increasing\x20—\x20unique\x20even\x20in\x20cycles)\x20AND\x20remark\x20matches\x20current\x20node\x20name\x20(progress.current,\x20String\x20—\x20may\x20repeat\x20across\x20cycles\x20but\x20bound\x20to\x20this\x20step\x20by\x20index).','key_queries':['payment.info.for','payment.info.guard','payment.info.index','payment.info.remark','payment.amount','progress.history\x20count','progress.current'],'mitigated_risks':[],'applicable_industries':['rental','travel','general','freelance'],'notes':['VERIFIED:\x20PaymentInfo\x20(for_object,\x20for_guard,\x20remark,\x20index),\x20payment_info_with_guard','VERIFIED:\x20withdraw\x20creates\x20the\x20Payment\x20as\x20a\x20fresh\x20singleton\x20object\x20from\x20the\x20withdrawn\x20object\x20set','Payment\x20is\x20freeze_object\x20(immutable)\x20—\x20cannot\x20be\x20modified\x20after\x20creation','VERIFIED\x20INDEX\x20QUERY:\x20progress.history\x20count\x20(id\x201273,\x20U64)\x20—\x20the\x20accomplish\x20transition\x20pushes\x20ONE\x20History\x20entry\x20per\x20completed\x20node\x20TRANSITION,\x20not\x20per\x20forward:\x20one\x20entry\x27s\x20session\x20snapshot\x20can\x20contain\x20several\x20accomplished\x20forwards,\x20and\x20sub-threshold\x20forwards\x20stay\x20in\x20the\x20live\x20progress.session\x20with\x20NO\x20history\x20entry.\x20After\x20the\x20push\x20the\x20entry\x20lands\x20(session\x20cleared,\x20current\x20=\x20next_node);\x20the\x20history\x20length\x20returns\x20the\x20current\x20session\x20id.\x20Strictly\x20monotonic:\x20the\x20vector\x20push\x20keys\x20by\x20length\x20with\x20no\x20removal\x20path\x20—\x20even\x20in\x20cycles,\x20each\x20entry\x20has\x20a\x20different\x20count.','VERIFIED\x20HISTORY\x20INDEXING\x20RULE\x20(the\x20on-chain\x20guard\x20checks\x20run\x20BEFORE\x20the\x20history\x20push\x20—\x20verification\x20precedes\x20the\x20accomplish\x20step):\x20during\x20a\x20guard\x20check\x20the\x20LAST\x20entry\x20is\x20the\x20transition\x20that\x20ENTERED\x20the\x20current\x20node\x20—\x20history[last].next_node\x20==\x20progress.current,\x20and\x20its\x20session\x20snapshot\x20holds\x20the\x20forwards\x20accomplished\x20to\x20get\x20there.\x20history[last].node\x20is\x20the\x20node\x20just\x20LEFT,\x20so\x20\x27last\x20entry\x20.node\x20==\x20current\x20node\x27\x20is\x20WRONG;\x20likewise\x20forwards\x20completed\x20on\x20the\x20current\x20node\x20after\x20arrival\x20live\x20in\x20the\x20live\x20session\x20(progress.session*\x20queries),\x20never\x20in\x20history.\x20hold/unhold\x20never\x20push\x20(the\x20hold\x20entry\x20never\x20records\x20history).','VERIFIED\x20NODE\x20NAME\x20QUERY:\x20progress.current\x20(id\x201253,\x20String).\x20Returns\x20the\x20current\x20node\x20name.\x20A\x20node\x20CAN\x20be\x20entered\x20multiple\x20times\x20in\x20cycles,\x20so\x20node\x20name\x20alone\x20is\x20NOT\x20unique\x20—\x20it\x20MUST\x20be\x20paired\x20with\x20progress.history\x20count\x20for\x20uniqueness.','DESIGN\x20INTENT\x20(USER):\x20to\x20validate\x20index\x20(U64\x20type),\x20use\x20progress.history\x20count\x20(unique,\x20non-repeating);\x20to\x20validate\x20node\x20name\x20(may\x20repeat\x20in\x20cycles),\x20store\x20it\x20in\x20PaymentInfo.remark\x20and\x20do\x20string\x20comparison\x20with\x20progress.current.','ANTI-REUSE\x204-DIMENSIONAL\x20BINDING:\x20for_object\x20(Order)\x20+\x20for_guard\x20(Guard)\x20+\x20index\x20(unique\x20step\x20via\x20progress.history\x20count)\x20+\x20remark\x20(node\x20name\x20via\x20progress.current).\x20Same\x20Payment\x20cannot\x20be\x20reused\x20in\x20other\x20contexts\x20—\x20at\x20least\x20one\x20field\x20will\x20mismatch.','VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context','Enables\x20user-friendly\x20exception\x20handling:\x20delay\x20→\x20auto-compensation\x20→\x20friendly\x20branch\x20flow','No\x20object-linker\x20binding\x20registration\x20needed\x20—\x20guard\x20only\x20verifies\x20submitted\x20Payment\x27s\x20field\x20accuracy']},{'id':'pattern.goodwill_refund_rail','business_requirement':'A\x20GOODWILL\x20refund\x20(merchant\x20appeasement\x20—\x20not\x20a\x20ruling,\x20not\x20a\x20fulfillment\x20failure)\x20must\x20ride\x20an\x20independent\x20money\x20path\x20so\x20it\x20never\x20drains\x20the\x20order\x20escrow,\x20and\x20its\x20side\x20effect\x20on\x20the\x20order\x27s\x20own\x20refund\x20rail\x20must\x20be\x20declared\x20(gfm31\x20ruling\x202026-10-27,\x20user-approved)','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Two\x20independent\x20money\x20paths\x20on\x20one\x20order.\x20GOODWILL\x20PATH:\x20the\x20compensation-fund\x20payout\x20(order\x20compensate)\x20—\x20funds\x20leave\x20the\x20merchant-owned\x20compensation\x20fund,\x20NEVER\x20the\x20escrow;\x20the\x20payout\x20WRITES\x20order.claimed_by\x20(protocol\x20fact,\x20the\x20arbitration\x20track\x27s\x20stamp).\x20ESCROW\x20PATH:\x20the\x20order-anchored\x20refund\x20rail\x20is\x20NODE-GATED\x20only\x20—\x20decision\x2011\x20two-rail\x20independence:\x20NO\x20fund\x20rail\x20reads\x20order.claimed_by,\x20so\x20a\x20goodwill\x20payout\x20does\x20NOT\x20seal\x20the\x20escrow\x20refund\x20rail.\x20The\x20two\x20paths\x20are\x20independent\x20channels;\x20a\x20goodwill\x20payout\x20plus\x20a\x20later\x20node-gated\x20refund\x20is\x20a\x20double\x20remedy\x20—\x20a\x20legal\x20commercial\x20outcome\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate.\x20The\x20escrow\x20principal\x20exits\x20via\x20the\x20node-partitioned\x20refund/recover\x20rails\x20(tpl_allocator_node_gate_recover\x20is\x20terminal-node-gated,\x20no\x20polarity\x20leg).','key_queries':['order.claimed_by','order.amount','payment.info.for'],'mitigated_risks':['R-X1-17'],'applicable_industries':['general','freelance','retail','travel'],'notes':['INDEPENDENT\x20PLUMBING:\x20the\x20compensation\x20fund\x20is\x20the\x20goodwill-refund\x20rail\x20—\x20a\x20compensate\x20payout\x20draws\x20from\x20the\x20fund\x20the\x20merchant\x20topped\x20up,\x20never\x20from\x20the\x20buyer\x27s\x20escrowed\x20price.\x20Never\x20route\x20goodwill\x20through\x20the\x20order\x27s\x20refund\x20allocation:\x20that\x20drains\x20the\x20escrow\x20the\x20settlement/recover\x20rails\x20still\x20need\x20to\x20be\x20solvent\x20against.','THE\x20OLD\x20TRAP,\x20RETIRED\x20(gfm31,\x20superseded\x20by\x20decision\x2011\x20two-rail\x20independence\x202026-10-31):\x20compensate\x20WRITES\x20order.claimed_by,\x20and\x20the\x20refund\x20rails\x20ONCE\x20carried\x20claimed_by-none\x20legs\x20—\x20a\x20goodwill\x20payout\x20then\x20polarity-sealed\x20the\x20buyer\x27s\x20own\x20refund\x20rail\x20and\x20forced\x20the\x20escrow\x20out\x20through\x20recover_gate.\x20Decision\x2011\x20removed\x20the\x20polarity\x20legs\x20from\x20every\x20fund\x20rail,\x20so\x20a\x20goodwill\x20payout\x20no\x20longer\x20welds\x20the\x20escrow\x20track\x20shut.\x20What\x20REMAINS\x20is\x20the\x20sizing/disclosure\x20discipline:\x20goodwill\x20plus\x20a\x20node-gated\x20refund\x20is\x20a\x20double\x20remedy\x20—\x20legal,\x20but\x20both\x20parties\x20must\x20see\x20it\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate.','THEREFORE\x20—\x20FINAL-REMEDY\x20DISCIPLINE:\x20execute\x20compensate\x20ONLY\x20when\x20the\x20dispute\x20is\x20truly\x20over\x20(terminal\x20state\x20reached,\x20or\x20the\x20merchant\x20explicitly\x20waives\x20return\x20rights\x20for\x20this\x20order).\x20A\x20premature\x20goodwill\x20refund\x20no\x20longer\x20seals\x20anything\x20on-chain,\x20but\x20it\x20commits\x20real\x20fund\x20money\x20ahead\x20of\x20the\x20ruling\x20—\x20the\x20arbitrator\x20weighs\x20the\x20order\x27s\x20payout\x20history\x20(order.claimed_by)\x20when\x20ruling,\x20and\x20a\x20double-drained\x20merchant\x20fund\x20is\x20the\x20merchant\x27s\x20own\x20loss.\x20Disclose\x20this\x20wherever\x20a\x20build\x20guide\x20offers\x20a\x20compensation_fund_topup\x20step.','PAIR\x20WITH\x20THE\x20ESCROW-EXIT\x20INVARIANT\x20(az-mn-261007,\x20decision\x2011):\x20every\x20terminal\x20keeps\x20a\x20node-gated\x20fund\x20exit\x20—\x20the\x20refund\x20rails\x20and\x20the\x20terminal-node-gated\x20recover\x20sweep\x20PARTITION\x20THE\x20TERMINALS;\x20no\x20fund\x20rail\x20reads\x20order.claimed_by\x20(a\x20claimed_by\x20gate\x20is\x20the\x20R-FUND-RAIL-CLAIMED-BY\x20/\x20RAIL_CLAIMED_BY_LEG\x20critical).\x20The\x20award\x20rides\x20the\x20arbitration\x20track;\x20any\x20further\x20buyer\x20remedy\x20after\x20a\x20goodwill\x20payout\x20is\x20a\x20commercial\x20matter\x20disclosed\x20at\x20the\x20MCP\x20gate.','FUND\x20SOLVENCY:\x20a\x20compensate\x20payout\x20fails\x20when\x20the\x20fund\x20is\x20empty\x20—\x20size\x20the\x20fund\x20against\x20the\x20expected\x20goodwill\x20volume\x20at\x20deploy\x20(the\x20fund-sizing\x20deploy-time\x20check)\x20and\x20re-top\x20via\x20the\x20fund\x27s\x20own\x20receive\x20path;\x20the\x20escrow\x20NEVER\x20silently\x20covers\x20the\x20shortfall.','NO-CHAIN-CHANGE:\x20this\x20pattern\x20uses\x20only\x20the\x20existing\x20compensate\x20op\x20and\x20node-gated\x20rails\x20—\x20no\x20new\x20chain\x20primitive\x20required.']},{'id':'pattern.partial_refund_pricing','business_requirement':'A\x20PARTIAL\x20refund\x20(missing/short\x20item,\x20late-delivery\x20or\x20quality\x20compensation\x20—\x20not\x20a\x20full\x20return,\x20not\x20the\x20kill\x20fee)\x20needs\x20a\x20PRICING\x20AUTHORITY:\x20the\x20amount\x20must\x20originate\x20from\x20a\x20source\x20both\x20parties\x20answered\x20to,\x20never\x20from\x20the\x20executing\x20keeper\x27s\x20judgement\x20(拍板④\x20mtw-261027,\x20user-approved)','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Amount\x20evidence\x20BEFORE\x20money\x20movement.\x20SANCTIONED\x20PRICING\x20SOURCES\x20(exactly\x20two):\x20(1)\x20an\x20arbitration\x20ruling\x20—\x20the\x20on-chain\x20Arb\x20indemnity\x20IS\x20the\x20priced\x20amount;\x20(2)\x20a\x20Messenger\x20quote\x20→\x20buyer\x20confirmation\x20→\x20WTS\x20evidence:\x20the\x20merchant\x20quotes\x20the\x20partial\x20amount\x20in\x20the\x20order\x27s\x20IM\x20thread,\x20the\x20buyer\x20confirms\x20IN\x20THE\x20SAME\x20THREAD,\x20and\x20the\x20thread\x27s\x20WTS\x20evidence\x20file\x20(verifiable,\x20tamper-evident)\x20is\x20the\x20pricing\x20record\x20—\x20its\x20Proof\x20address\x20rides\x20the\x20order-keyed\x20evidence\x20Repository\x20row\x20so\x20the\x20executing\x20guard\x20or\x20keeper\x20reads\x20the\x20amount\x20from\x20a\x20record,\x20not\x20from\x20memory.\x20The\x20Amount-track\x20allocator\x20leg\x20then\x20pays\x20exactly\x20the\x20evidenced\x20value;\x20the\x20remnant-settlement\x20leg\x20must\x20be\x20defined\x20in\x20the\x20same\x20build\x20(a\x20full-amount\x20settle\x20rail\x20would\x20pay\x20the\x20refunded\x20share\x20out\x20again).','key_queries':['order.amount','order.claimed_by','repository.data'],'mitigated_risks':[],'applicable_industries':['delivery','group_buy','retail','general'],'notes':['THE\x20GAP\x20(mtw\x20R-07):\x20shipped\x20templates\x20model\x20refund\x20as\x20two\x20states\x20(full\x20refund\x20/\x20kill\x20fee);\x20the\x20high-frequency\x20small\x20remedies\x20delivery\x20and\x20group-buy\x20orders\x20actually\x20need\x20(one\x20missing\x20item,\x20ten\x20minutes\x20late)\x20have\x20NO\x20shape.\x20The\x20Amount\x20track\x20fully\x20supports\x20partial\x20rails\x20on-chain\x20—\x20the\x20missing\x20piece\x20is\x20the\x20pricing\x20discipline,\x20not\x20the\x20mechanism.','KEEPER\x20DUTY\x20(拍板④):\x20the\x20executing\x20keeper\x20NEVER\x20invents\x20the\x20number.\x20A\x20partial\x20amount\x20without\x20a\x20ruling\x20or\x20a\x20WTS-evidenced\x20quote+confirmation\x20is\x20unauditable\x20self-dealing\x20—\x20refuse\x20it\x20and\x20route\x20the\x20counterparties\x20to\x20the\x20quote\x20flow.\x20The\x20delivery\x20and\x20group_buy\x20template\x20keeper_duty\x20rows\x20carry\x20this\x20duty\x20verbatim.','WTS\x20IS\x20THE\x20PRICING\x20RECORD:\x20the\x20Messenger\x20thread\x20gives\x20a\x20verifiable,\x20timestamped\x20quote→confirmation\x20pair\x20(WTS\x20evidence\x20file\x20+\x20message-authenticity\x20check);\x20parking\x20the\x20Proof\x20address\x20on\x20the\x20order-keyed\x20evidence\x20row\x20makes\x20the\x20amount\x20readable\x20by\x20the\x20same\x20guard\x20machinery\x20that\x20reads\x20handover\x20evidence\x20—\x20no\x20new\x20primitive\x20required\x20today.','DUAL-SIGN\x20IS\x20THE\x20LONG-TERM\x20CURE\x20(拍板④\x20option\x20C,\x20protocol\x20train):\x20buyer\x20co-signature\x20on\x20the\x20refund\x20allocation\x20itself\x20—\x20a\x20chain-native\x20two-party\x20pricing\x20primitive\x20—\x20is\x20filed\x20for\x20a\x20future\x20protocol\x20window;\x20until\x20then\x20the\x20WTS-evidenced\x20quote\x20is\x20the\x20sanctioned\x20stand-in,\x20disclosed\x20as\x20such.','REMNANT\x20SETTLEMENT:\x20define\x20what\x20happens\x20to\x20the\x20balance\x20AFTER\x20the\x20partial\x20refund\x20in\x20the\x20SAME\x20build\x20—\x20a\x20full-amount\x20settle\x20rail\x20would\x20pay\x20the\x20merchant\x20the\x20refunded\x20share\x20too;\x20either\x20subtract\x20the\x20partial\x20amount\x20from\x20the\x20settle\x20leg\x20(Amount\x20math)\x20or\x20route\x20the\x20remainder\x20through\x20the\x20node-partitioned\x20refund/recover\x20rails\x20(decision\x2011:\x20exits\x20are\x20node-gated,\x20no\x20polarity\x20pair).','PAIR\x20WITH\x20GOODWILL\x20(pattern.goodwill_refund_rail):\x20a\x20goodwill\x20compensate\x20is\x20an\x20independent-channel\x20payout\x20—\x20it\x20writes\x20order.claimed_by\x20(arbitration-track\x20stamp)\x20but\x20does\x20NOT\x20seal\x20the\x20node-gated\x20refund\x20rails\x20(decision\x2011).\x20Before\x20executing\x20ANY\x20partial\x20remedy,\x20check\x20which\x20rail\x20the\x20amount\x20will\x20travel:\x20a\x20partial\x20remedy\x20plus\x20a\x20later\x20node-gated\x20refund\x20is\x20a\x20double\x20remedy,\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate.']},{'id':'pattern.verifier_evidence_philosophy','business_requirement':'Guard\x20design\x20philosophy:\x20verifier\x20provides\x20evidence,\x20guard\x20verifies\x20logic\x20+\x20data\x20accuracy\x20(NOT\x20data\x20discovery)','data_source':'SubmittedObject','host':'gen_passport','verifier_level':'none','logic_summary':'Guard\x20is\x20a\x20PURE\x20VERIFICATION\x20engine.\x20Participants\x20submit\x20evidence\x20(Payment,\x20Order,\x20Proof,\x20etc.)\x20'+'via\x20Passport\x20submissions\x20(b_submission=true).\x20Guard\x20verifies:\x20(1)\x20logic\x20completeness,\x20(2)\x20data\x20usage\x20accuracy.\x20'+'Guard\x20does\x20NOT\x20discover/fetch\x20objects\x20via\x20object-linker\x20binding.\x20object-linker\x20binding\x20is\x20for\x20object\x20lifecycle\x20bookkeeping,\x20'+'NOT\x20for\x20guard\x20data\x20discovery.','key_queries':[],'mitigated_risks':['R-C3-05','R-C3-06'],'notes':['CORE\x20PRINCIPLE:\x20Guard\x20only\x20validates\x20submitted\x20evidence\x20—\x20it\x20never\x20fetches\x20data\x20on\x20its\x20own','For\x20Payment\x20verification:\x20user\x20submits\x20valid\x20Payment\x20→\x20guard\x20checks\x20for_object/for_guard/index\x20match','For\x20multi-order\x20verification:\x20verifier\x20submits\x20Order\x20data\x20→\x20guard\x20checks\x20service/owner\x20relationships','For\x20Repository\x20access:\x20user\x20submits\x20Payment\x20→\x20quote_guard\x20verifies\x20→\x20impack_list\x20updated\x20→\x20data\x20query\x20passes','Type\x203\x20(SubmittedObject)\x20data\x20source\x20class\x20embodies\x20this\x20philosophy\x20—\x20b_submission=true\x20entries','This\x20pattern\x20is\x20foundational\x20for\x20all\x20guard\x20designs\x20—\x20always\x20prefer\x20verifier-evidence\x20over\x20complex\x20object\x20discovery']},{'id':'pattern.progress_state_check','business_requirement':'Specific\x20forward\x20has\x20been\x20accomplished\x20(customer\x20confirms\x20delivery)','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_progress_history_find(...).accomplished,\x20identifier[N](true)]','key_queries':['progress.current','progress.current_time','progress.history.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Chain\x20query_progress_history_find\x20→\x20query_progress_history_session_forward_find','SATISFIABILITY\x20DISCIPLINE\x20(Airbnb\x20§4:\x20an\x20unsatisfiable\x20claim\x20guard\x20sealed\x20all\x20five\x20fund\x20rails):\x20'+'bool\x20fields\x20compare\x20against\x20a\x20bool\x20constant\x20—\x20logic_equal[field,\x20identifier[N](true)]\x20—\x20never\x20against\x20'+'a\x20numeric/address\x20constant;\x20VECTOR\x20membership\x20is\x20existential\x20—\x20write\x20has\x20/\x20count>0\x20for\x20\x27a\x20claim\x20exists\x27\x20'+'and\x20NOT(has)\x20for\x20\x27no\x20claim\x20yet\x27\x20(e.g.\x20order.claimed_by),\x20never\x20an\x20element-wise\x20==false,\x20which\x20is\x20'+'vacuously\x20true\x20on\x20an\x20empty\x20vector\x20and\x20seals\x20the\x20rail\x20it\x20gates.\x20Static\x20folding\x20(R-X1-17\x20always_true/'+'always_false\x20+\x20guard-leaf-eval\x20GL\x20codes)\x20catches\x20literal\x20contradictions\x20at\x20publish\x20time,\x20but\x20it\x20CANNOT\x20'+'prove\x20a\x20dynamic\x20query\x20satisfiable\x20—\x20a\x20guard\x20that\x20is\x20satisfiable-in-theory\x20only\x20when\x20a\x20condition\x20no\x20'+'participant\x20can\x20ever\x20produce\x20is\x20still\x20a\x20dead\x20rail;\x20pair\x20every\x20state\x20check\x20with\x20the\x20business\x20flow\x20that\x20'+'reaches\x20it.','REWARD\x20REPLAY\x20GATE\x20(host\x20\x27reward\x27\x20claims\x20—\x20klk-ln-261011\x20F15/F16\x20+\x20ofn-mn-261012\x20F-01\x20+\x20klk-mn-261013\x20F-05\x20+\x20azx7-mn-261014\x20T8):\x20the\x20claim\x20guard\x20root\x20MUST\x20carry\x20a\x20record\x20gate\x20+\x20an\x20order.owner\x20identity\x20leg\x20+\x20the\x20BKN-P2\x20positive-amount\x20leg.\x20claim()\x20pays\x20the\x20recipient\x20for\x20Recipient::Signer\x20(tx_context::sender)\x20with\x20no\x20order\x20binding\x20of\x20its\x20own,\x20so\x20without\x20the\x20identity\x20leg\x20any\x20address\x20holding\x20any\x20order\x20at\x20the\x20required\x20node\x20drains\x20the\x20pool\x20(audit-261012\x20B5).\x20RECIPIENT\x20SEMANTICS\x20(crs-mn-261015\x20F-12,\x20live\x20mainnet):\x20the\x20reward.guard_add\x20ENTRY\x20recipient\x20MUST\x20be\x20{Signer:\x27signer\x27}\x20(or\x20an\x20{Entity}\x20—\x20the\x20SDK\x20replaces\x20it\x20with\x20the\x20claimant\x27s\x20local\x20account\x20at\x20claim\x20time);\x20a\x20{GuardIdentifier}\x20recipient\x20resolves\x20from\x20the\x20passport\x20submission\x20(conventionally\x20the\x20submitted\x20Order\x20address)\x20and\x20can\x20never\x20equal\x20the\x20tx\x20sender,\x20so\x20every\x20claim\x20aborts\x2014\x20(E_CLAIM_RECIPIENT_NOT_SIGNER)\x20—\x20the\x20order-anchor\x20GuardIdentifier(0)\x20idiom\x20is\x20an\x20Allocation\x20push\x20rail,\x20NEVER\x20a\x20reward\x20pull\x20rail\x20(the\x20MCP\x20guard_add\x20recipient\x20gate\x20rejects\x20it).\x20'+SV2_PRIMARY_FORM_CLAUSE+SV2_DELIBERATE_ALTERNATIVE_CLAUSE+'STAMP\x20ENFORCEMENT\x20LAYER:\x20the\x20MCP\x20guard_add\x20stamp\x20gate\x20(UPW-K7)\x20rejects\x20record-consuming\x20entries\x20that\x20omit\x20store_from_id;\x20the\x20chain\x20validates\x20compatibility\x20only\x20when\x20the\x20stamp\x20IS\x20provided\x20—\x20an\x20unstamped\x20entry\x20accepted\x20outside\x20the\x20tool\x20layer\x20never\x20keys\x20its\x20records\x20per\x20order.\x20Re-adding\x20the\x20same\x20guard\x20overwrites\x20its\x20slot\x20in\x20place\x20(live\x20pools\x20repairable).\x20'+'NEVER\x20hand-write\x20the\x20RAW\x20query\x20form\x20(query\x201629)\x20with\x20an\x20empty\x20VecU8\x20parameter:\x20empty\x20query\x20bytes\x20reach\x20the\x20native\x20untranslated\x20and\x20abort\x20with\x20an\x20uncoded\x20'+'MovePrimitiveRuntimeError\x20(\x27Query\x20bytes\x20is\x20empty\x27)\x20—\x20klook-mn-261013\x20probed\x20all\x20raw\x20shapes,\x20every\x20one\x20failed\x20(the\x20deployed\x20guard\x20entry\x20also\x20accepts\x20the\x20empty\x20'+'constant\x20at\x20creation,\x20so\x20the\x20failure\x20surfaces\x20only\x20at\x20first\x20verification).\x20A\x20bare\x20query\x20WITHOUT\x20logic_not\x20is\x20PSEUDO-protection\x20'+'(guard-risk\x20R-X1-14\x20flags\x20it);\x20template-scanner\x20R-REWARD-REPLAY\x20and\x20compile\x20REVIEW_REWARD_UNARMED\x20block\x20the\x20un-armed\x20forms.\x20'+'ABORT-PATH\x20DISAMBIGUATION\x20(klk-mn-261014):\x20a\x20replay\x20submitted\x20with\x20the\x20REGISTERED\x20guard\x20aborts\x20at\x20passport\x20verification\x20(E_VERIFY_FAILED=7)\x20BEFORE\x20the\x20claim\x20entry\x20—\x20observing\x20E_VERIFY_FAILED\x20does\x20NOT\x20tell\x20you\x20whether\x20the\x20native\x20once-slot\x20is\x20deployed;\x20E_GUARD_NOT_FOUND\x20is\x20also\x207\x20but\x20a\x20DIFFERENT\x20failure\x20(the\x20submitted\x20guard\x20object\x20is\x20not\x20the\x20registered\x20one).\x20The\x20native\x20once-slot\x20(MOV-PROTOCOL-1212:\x20per-(recipient,\x20guard,\x20bcs(store_from))\x20slot,\x20E_CLAIM_ALREADY_MADE=13,\x20plus\x20recipient==signer,\x20E_CLAIM_RECIPIENT_NOT_SIGNER=14)\x20is\x20the\x20second\x20line,\x20reached\x20only\x20by\x20guards\x20without\x20a\x20record\x20leg\x20—\x20check\x20its\x20deployment\x20freshness\x20via\x20wowok_buildin_info\x20upgrade_check\x20(build_stamp.chain_stamp,\x20DEPLOY-K1)\x20instead\x20of\x20assuming\x20lag.\x20'+'Do\x20NOT\x20reference\x20repository.data\x20record\x20counts\x20(F-02:\x20upsert\x20+\x20same-PTB\x20read).\x20The\x20query\x20where-filter\x20and\x20the\x20'+'reward.guard_add\x20store_from_id\x20STAMP\x20are\x20DIFFERENT\x20fields:\x20the\x20STAMP\x20is\x20mandatory\x20for\x20record-consuming\x20guards\x20(slot\x200\x20=\x20the\x20submitted\x20Order\x20address\x20is\x20the\x20conventional\x20per-order\x20stamp).','PER-ORDER\x20ENTITLEMENT\x20ROW\x20(WINDOW-1\x20tier-predicate\x20half):\x20tier-scoped\x20promises\x20(\x27tier\x20X\x20enjoys\x20Y\x27)\x20have\x20no\x20constructible\x20'+'leg\x20while\x20guards\x20read\x20only\x20Service-level\x20state\x20—\x20Reward\x20objects\x20are\x20Service-level\x20and\x20sales\x20rows\x20carry\x20no\x20reward\x20field.\x20The\x20'+'constructive\x20form:\x20write\x20a\x20per-order\x20entitlement\x20row\x20at\x20settle\x20time\x20(key\x20=\x20order\x20id,\x20value\x20=\x20U256\x20tier\x20id,\x20riding\x20the\x20SAME\x20'+'settle-evidence\x20write\x20as\x20the\x20PAID-state\x20leg)\x20and\x20arm\x20the\x20tier\x27s\x20claim\x20guard\x20with\x20a\x20keys_where\x20presence\x20leg\x20on\x20that\x20row.\x20The\x20'+'honor\x20guard\x27s\x20historical\x20period\x20count\x20is\x20tier-agnostic\x20by\x20construction;\x20the\x20row\x20is\x20the\x20ONLY\x20tier\x20evidence\x20a\x20guard\x20predicate\x20'+'can\x20read\x20—\x20upgrade\x20tier\x20wording\x20to\x20constructive\x20exactly\x20when\x20the\x20row\x20+\x20leg\x20exist,\x20else\x20drop\x20the\x20wording.','TASK-BINDING\x20SLOT\x20(identifier\x20254):\x20when\x20this\x20guard\x20is\x20bound\x20to\x20a\x20task-guarded\x20machine\x20forward\x20(guard_key\x20on\x20an\x20edge),\x20its\x20table\x20MUST\x20declare\x20{\x20identifier:\x20254,\x20b_submission:\x20true\x20}\x20—\x20the\x20passport\x20builder\x20drops\x20undeclared\x20slots,\x20Guards\x20are\x20immutable,\x20so\x20an\x20undeclared\x20254\x20makes\x20every\x20advance\x20of\x20that\x20edge\x20abort\x20and\x20bricks\x20the\x20published\x20Machine\x20with\x20no\x20post-hoc\x20fix\x20(mainnet\x20261010).\x20See\x20pattern.repository_write_authorization\x27s\x20TASK-BINDING\x20SLOT\x20note\x20and\x20audit\x20rule\x20TASKBIND-01.','POSITIVE-AMOUNT\x20LEG\x20(host\x20\x27reward\x27\x20claims\x20—\x20BKN-P2,\x20v55):\x20a\x20reward\x20claim\x20root\x20MUST\x20carry\x20logic_as_u256_greater_or_equal['+'query(order.amount),\x20identifier[N](1)]\x20—\x20a\x20zero-total\x20order\x20(a\x20100%-off/zeroing\x20coupon\x20buy)\x20holds\x20an\x20EMPTY\x20escrow,\x20so\x20without\x20this\x20leg\x20a\x20'+'zero-cost\x20buy\x20clears\x20the\x20review\x20node\x20and\x20claims\x20the\x20bounty\x20(the\x20bkmn\x20F-M39/T6\x20arbitrage).\x20The\x20coupon\x20side\x20is\x20floored\x20at\x20issuance\x20(zeroing\x20'+'coupons\x20are\x20blocked\x20unless\x20the\x20free\x20tier\x20is\x20declared\x20via\x20allow_zero_total);\x20this\x20leg\x20is\x20the\x20second\x20half\x20of\x20the\x20pair\x20—\x20never\x20drop\x20it\x20when\x20'+'specializing\x20the\x20root.\x20template-scanner\x20R-REWARD-ZERO-ORDER\x20audits\x20the\x20template\x20face.','ARBITRATION\x20PAIRING\x20RAILS\x20—\x20RETIRED\x20(decision\x2011\x20two-rail\x20independence,\x202026-10-31;\x20formerly\x20BKN-P1\x20option\x20a,\x20BF-14,\x20esln-261023-iiv4):\x20the\x20'+'claimed_by\x20none/some\x20polarity\x20pairing\x20between\x20tpl_allocator_node_gate_refund\x20and\x20tpl_allocator_node_gate_recover\x20is\x20RETIRED\x20—\x20both\x20'+'polarity\x20legs\x20were\x20removed\x20template-wide,\x20and\x20a\x20fund\x20rail\x20whose\x20satisfiability\x20flips\x20on\x20the\x20claimed\x20axis\x20is\x20now\x20the\x20R-FUND-RAIL-CLAIMED-BY\x20'+'scanner\x20critical\x20(mirrored\x20by\x20the\x20compile-side\x20RAIL_CLAIMED_BY_LEG\x20verifier).\x20The\x20order\x20fund\x20track\x20completes\x20by\x20NODE\x20state\x20alone:\x20a\x20refund\x20'+'node\x20pays\x20the\x20buyer,\x20a\x20settle\x20node\x20pays\x20the\x20merchant,\x20regardless\x20of\x20any\x20arbitration\x20claim\x20stamp.\x20BF-14\x20(E_ZERO_INDEMNITY_CLAIM\x20asserted\x20at\x20'+'the\x20arbitration\x20finish\x20entry\x20BEFORE\x20any\x20state\x20change)\x20is\x20unaffected\x20—\x20it\x20is\x20arbitration-track\x20discipline;\x20the\x20dismissed\x20buyer\x20keeps\x20the\x20'+'normal\x20node-gated\x20refund\x20right,\x20and\x20the\x20old\x20\x27ruled-zero\x20seal\x27\x20(a\x20zero\x20award\x20sweeping\x20the\x20principal\x20to\x20the\x20merchant\x20Entity)\x20no\x20longer\x20exists\x20'+'as\x20a\x20fund-rail\x20behavior\x20at\x20all.\x20The\x20buyer-win\x20sweep\x20(esln\x20F-ESL-11\x20—\x20the\x20principal\x20swept\x20to\x20the\x20merchant\x20Entity\x20on\x20the\x20very\x20ruling\x20the\x20buyer\x20'+'won)\x20described\x20the\x20OLD\x20recover\x20rail:\x20the\x20award\x20is\x20now\x20solely\x20the\x20indemnity\x20track\x27s\x20separate\x20commercial\x20payout,\x20and\x20a\x20buyer\x20who\x20both\x20refunds\x20'+'by\x20node\x20state\x20and\x20collects\x20the\x20claimed\x20indemnity\x20is\x20a\x20LEGAL\x20double-collection\x20outcome\x20—\x20disclosed\x20at\x20the\x20MCP\x20dual-payout\x20confirmation\x20gate\x20'+'(amz9\x20A-1),\x20never\x20encoded\x20as\x20a\x20polarity\x20condition.\x20NO-STRANDING\x20survives\x20on\x20the\x20node\x20axis\x20alone:\x20every\x20terminal\x20keeps\x20exactly\x20one\x20fund\x20exit\x20'+'(the\x20rail\x20verifier\x27s\x20coverage\x20checks\x20are\x20node-keyed).\x20Direction-split\x20machinery\x20(winner-aware\x20escrow\x20interlock)\x20stays\x20PERMANENTLY\x20DECLINED\x20'+'per\x20the\x20ROLES.md\x20independent-commerce\x20ruling\x20(ofn5\x20F-05,\x202026-10-23);\x20long-term:\x20N-9\x20order-authority\x20model\x20window.']},{'id':'pattern.required_info_evidence_gate','business_requirement':'Do\x20not\x20advance\x20the\x20order\x20until\x20the\x20buyer\x20has\x20recorded\x20the\x20private\x20information\x20the\x20shop\x20requires\x20(delivery\x20detail,\x20ID,\x20credentials)\x20—\x20recorded\x20either\x20as\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20(from\x20the\x20Service\x27s\x20Contact)\x20or\x20as\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'query(\x27order.required_info\x20some\x27,\x20object=<Order\x20identifier[N]>\x20convert_witness\x20OrderProgress)','key_queries':['order.required_info\x20some','order.required_info','service.customer_required\x20count','service.customer_required\x20has'],'witness_types':['OrderProgress'],'applicable_industries':['retail','travel','education','rental','general'],'notes':['WHY\x20A\x20GUARD\x20AT\x20ALL:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20Service.customer_required,\x20so\x20declaring\x20required\x20fields\x20is\x20DECLARATIVE\x20ONLY\x20—\x20an\x20order\x20that\x20supplies\x20none\x20is\x20still\x20created\x20on-chain.\x20A\x20Guard\x20on\x20the\x20fulfilment\x20forward\x20is\x20the\x20only\x20enforcement\x20point\x20(testnet\x20test-14\x20HIGH-05).','1572\x20measures\x20PRESENCE,\x20not\x20REQUIREMENT:\x20Order.required_info\x20is\x20Option<address>\x20holding\x20the\x20credential\x20address\x20the\x20ORDER\x20OWNER\x20recorded\x20via\x20the\x20required-info\x20update\x20entry\x20(param\x20im_or_proof)\x20—\x20either\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20(the\x20Im.at\x20entry\x20of\x20the\x20Service\x27s\x20Contact)\x20or\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20IM\x20address\x20+\x20last-message\x20timestamp).\x20The\x20list\x20of\x20demanded\x20fields\x20lives\x20on\x20the\x20Service\x20(1467\x20count\x20/\x201468\x20has)\x20—\x20a\x20different\x20object,\x20so\x20it\x20is\x20only\x20checkable\x20when\x20the\x20Service\x20is\x20also\x20a\x20table\x20item.','1573\x20ABORTS\x20when\x20the\x20Option\x20is\x20empty\x20(that\x20is\x20its\x20defined\x20failure\x20mode):\x20gate\x20on\x201572,\x20then\x20use\x201573\x20only\x20to\x20read\x20or\x20compare\x20the\x20recorded\x20address.','The\x20credential\x20is\x20buyer-writable\x20and\x20unvalidated:\x20the\x20required-info\x20update\x20entry\x20asserts\x20only\x20order\x20ownership,\x20so\x20the\x20Guard\x20proves\x20\x27something\x20was\x20recorded\x27,\x20not\x20that\x20the\x20content\x20is\x20correct.\x20The\x20recorded\x20value\x20has\x20NO\x20on-chain\x20meaning\x20the\x20chain\x20enforces\x20—\x20never\x20make\x20the\x20recorded\x20address\x20(or\x20proof.about)\x20a\x20guard\x20decision\x20condition.\x20Acceptance\x20is\x20established\x20by\x20the\x20MERCHANT\x27s\x20confirming\x20forward:\x20the\x20operator\x20who\x20ships/hands\x20over\x20after\x20eyeballing\x20the\x20recorded\x20contact\x20in\x20the\x20Messenger\x20conversation\x20is\x20the\x20acceptance\x20act.\x20Where\x20content-grade\x20evidence\x20is\x20needed,\x20route\x20the\x20check\x20through\x20a\x20Repository\x20with\x20a\x20quote_guard.','ENFORCEABLE\x20BINDING\x20(MOV-PROTOCOL-1212\x2011):\x20when\x20the\x20listing\x20promise\x20\x27never\x20send\x20to\x20an\x20address\x20you\x20were\x20not\x20given\x27\x20must\x20hold\x20on-chain,\x20use\x20the\x20CONTROLLED\x20binding\x20entry\x20(the\x20controlled\x20required-info\x20bind;\x20SDK\x20order_required_info_bind)\x20instead\x20of\x20the\x20legacy\x20update:\x20the\x20chain\x20rejects\x20the\x20write\x20unless\x20the\x20WTS\x20Proof\x20is\x20about\x20THIS\x20order\x20AND\x20was\x20created\x20by\x20the\x20order\x20owner\x20(E_REQUIRED_INFO_PROOF_NOT_BOUND,\x20nothing\x20written\x20on\x20rejection).\x20TRADE-OFF:\x20a\x20per-order\x20proof\x20publicly\x20links\x20the\x20buyer\x27s\x20orders\x20on\x20chain;\x20the\x20reuse\x20model\x20(one\x20contact\x20proof\x20across\x20orders)\x20stays\x20the\x20privacy-preserving\x20default\x20—\x20pick\x20per\x20listing\x20promise,\x20not\x20per\x20habit.','BOUNDARY\x20—\x20do\x20NOT\x20mirror\x20this\x20pattern\x20onto\x20review/reward\x20claims:\x20the\x20about+creator\x20assertions\x20prove\x20the\x20credential\x20AUTHOR\x20(identity),\x20never\x20its\x20content\x20or\x20any\x20rating\x20value\x20(a\x20one-star\x20reviewer\x27s\x20proof\x20satisfies\x20them\x20equally).\x20Public\x20reviews\x20live\x20in\x20Repository\x20rows;\x20enforce\x20their\x20values\x20guard-side\x20via\x20data-value\x20probes\x20(1167\x20row\x20reads\x20/\x201177\x20keys-where\x20Range-gte)\x20and\x20gate\x20the\x20claim\x20on\x20those,\x20not\x20on\x20a\x20Proof\x20object.','RULE:\x20required_info\x20is\x20attestation-only\x20(write-only\x20on-chain):\x20never\x20gate\x20a\x20guard\x20on\x20its\x20CONTENT\x20—\x20any\x20buyer-written\x20string\x20passes,\x20so\x20content\x20conditions\x20are\x20unenforceable.\x20Presence\x20gates\x20are\x20legitimate\x20fill-barriers\x20only;\x20label\x20them\x20attestation-only\x20in\x20build\x20notes.','Gate\x20the\x20forward\x20that\x20DEPENDS\x20on\x20the\x20information\x20(e.g.\x20before\x20ship/deliver),\x20not\x20the\x20buy:\x20a\x20buy_guard\x20cannot\x20query\x20the\x20Order\x20—\x20it\x20does\x20not\x20exist\x20yet\x20at\x20buy\x20time.']},{'id':'pattern.reward_one_time_claim','business_requirement':'User\x20can\x20only\x20claim\x20reward\x20once\x20(no\x20prior\x20claims)','data_source':'OnChainConstant','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_reward_record_count(object=<reward>,\x20recipient=Signer,\x20where={}),\x20identifier[N](0)]','key_queries':['reward.record_count'],'mitigated_risks':[],'notes':['Record\x20count\x20check\x20prevents\x20double-claim','SCHEMA:\x20\x27where\x27\x20is\x20REQUIRED\x20even\x20when\x20empty\x20—\x20pass\x20where:\x20{}\x20or\x20the\x20call\x20is\x20rejected\x20by\x20input\x20validation']},{'id':'pattern.reward_multi_condition','business_requirement':'Order\x20payment\x20>\x20threshold\x20AND\x20reached\x20\x27complete\x27\x20to\x20claim\x20reward','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_and[logic_as_u256_greater[query(order.amount),\x20threshold],\x20logic_equal[query(progress.current),\x20\x27complete\x27],\x20logic_equal[query(order.service),\x20identifier[N](expected_service)]]','key_queries':['order.amount','progress.current','order.service'],'witness_types':['OrderProgress'],'mitigated_risks':['R-C3-05'],'notes':['Multi-condition:\x20amount\x20+\x20progress\x20state\x20+\x20service\x20match','BKN-P2:\x20a\x20threshold\x20of\x200\x20does\x20NOT\x20exclude\x20zero-total\x20orders\x20on\x20its\x20own\x20in\x20a\x20claim\x20root\x20—\x20'+'reward\x20claim\x20guards\x20must\x20compare\x20order.amount\x20>=\x201\x20(see\x20the\x20POSITIVE-AMOUNT\x20LEG\x20note\x20on\x20'+'pattern.progress_state_check);\x20zeroing\x20coupons\x20are\x20blocked\x20at\x20issuance\x20unless\x20the\x20free\x20tier\x20is\x20declared.']},{'id':'pattern.reward_refund_mutual_exclusion','business_requirement':'A\x20bounty/reward\x20claim\x20rail\x20and\x20a\x20refund\x20rail\x20on\x20the\x20SAME\x20order\x20must\x20be\x20sequenced:\x20the\x20claim\x20window\x20opens\x20only\x20AFTER\x20the\x20refund\x20window\x20closed\x20(rex3\x20ruling\x20③\x202026-10-27,\x20user-approved;\x20recast\x20under\x20decision\x2011\x20two-rail\x20independence\x202026-10-31\x20—\x20the\x20time\x20gate\x20is\x20the\x20SOLE\x20structural\x20exclusion,\x20no\x20polarity\x20legs)','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'level3_scene_combined','logic_summary':'TIME\x20GATE\x20(mandatory):\x20the\x20reward\x20claim\x20root\x27s\x20time\x20leg\x20anchors\x20Clock\x20>=\x20progress.history.time(nextNode\x20=\x20<settlement\x20terminal>,\x20find=last)\x20+\x20claim_window,\x20where\x20claim_window\x20>=\x20the\x20refund\x20window\x20—\x20the\x20claim\x20door\x20opens\x20only\x20after\x20the\x20refund\x20door\x20has\x20shut.\x20NO\x20POLARITY\x20LEGS\x20(decision\x2011\x20two-rail\x20independence):\x20the\x20refund\x20rail\x20and\x20the\x20claim\x20rail\x20are\x20both\x20node/time-gated\x20and\x20NEVER\x20read\x20order.claimed_by;\x20a\x20compensation\x20payout\x20(goodwill\x20or\x20award)\x20no\x20longer\x20seals\x20either\x20rail\x20—\x20sequencing\x20is\x20what\x20keeps\x20the\x20windows\x20disjoint,\x20and\x20any\x20residual\x20overlap\x20(e.g.\x20a\x20compensate-then-claim\x20walk)\x20is\x20a\x20commercial\x20outcome\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate.','key_queries':['progress.history\x20time','progress.current','order.claimed_by','order.amount'],'witness_types':['OrderProgress'],'mitigated_risks':['R-X1-17'],'applicable_industries':['general','retail','licensing','freelance'],'notes':['THE\x20DOUBLE-DIP\x20(rex3\x20finding):\x20without\x20a\x20time\x20gate,\x20a\x20buyer\x20can\x20claim\x20the\x20bounty\x20first\x20and\x20refund\x20later,\x20or\x20refund\x20first\x20and\x20still\x20claim\x20—\x20both\x20rails\x20were\x20open\x20over\x20the\x20same\x20interval.\x20The\x20window\x20sequencing\x20(claim\x20opens\x20AFTER\x20refund\x20closes)\x20is\x20the\x20PRIMARY\x20exclusion\x20and\x20is\x20MANDATORY\x20on\x20every\x20bounty-backed\x20machine.','THE\x20COMPENSATE\x20TRAP,\x20RETIRED\x20(rex3\x20finding,\x20superseded\x20by\x20decision\x2011):\x20compensate\x20writes\x20order.claimed_by,\x20and\x20the\x20refund\x20rails\x20ONCE\x20carried\x20claimed_by-none\x20legs\x20—\x20one\x20goodwill\x20payout\x20then\x20killed\x20both\x20the\x20refund\x20rail\x20AND\x20a\x20polarity-legged\x20claim\x20root.\x20Decision\x2011\x20removed\x20the\x20polarity\x20legs\x20from\x20every\x20fund\x20rail\x20(including\x20reward\x20claims\x20—\x20tpl_reward_one_time_claim\x27s\x20former\x20UNDISPUTED-ORDER\x20leg),\x20so\x20nothing\x20seals\x20on\x20a\x20compensate\x20anymore.\x20The\x20choice\x20is\x20no\x20longer\x20(a)/(b)\x20polarity\x20variants:\x20NEVER\x20ship\x20a\x20claimed_by\x20leg\x20on\x20either\x20rail\x20—\x20the\x20time\x20gate\x20is\x20the\x20sole\x20exclusion,\x20and\x20a\x20compensate-then-claim\x20walk\x20is\x20a\x20commercial\x20outcome\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate.','THE\x20REVERSE\x20TRAP,\x20RECAST:\x20a\x20refund\x20payout\x20also\x20writes\x20order.claimed_by\x20—\x20under\x20the\x20polarity\x20era\x20a\x20legless\x20claim\x20root\x20kept\x20paying\x20after\x20a\x20refund.\x20With\x20polarity\x20legs\x20banned\x20(decision\x2011)\x20the\x20TIME\x20GATE\x20is\x20the\x20only\x20structural\x20exclusion\x20left:\x20without\x20it,\x20a\x20buyer\x20can\x20claim\x20the\x20bounty\x20after\x20refunding\x20(both\x20windows\x20open\x20over\x20the\x20same\x20interval).\x20The\x20gate\x20is\x20mandatory\x20on\x20every\x20bounty-backed\x20machine\x20precisely\x20because\x20no\x20claimed_by\x20leg\x20exists\x20anymore\x20to\x20seal\x20either\x20direction.','ANCHOR\x20DISCIPLINE:\x20the\x20claim\x20window\x20anchors\x20the\x20immutable\x201280\x20history\x20ENTRY\x20of\x20the\x20settlement\x20terminal\x20(find=last;\x201272\x20current_time\x20drifts\x20every\x20migration,\x20ETS-C),\x20never\x20order.time\x20and\x20never\x20a\x20live\x20side-stop\x20node.','COMPOSITION:\x20stack\x20with\x20pattern.reward_one_time_claim\x20(record-count\x20once\x20leg)\x20and\x20the\x20F-62\x20evidence/good-review\x20floor\x20legs\x20as\x20needed;\x20the\x20time\x20gate\x20is\x20orthogonal\x20and\x20always\x20required\x20when\x20a\x20refund\x20rail\x20exists\x20on\x20the\x20same\x20order.']},{'id':'pattern.arbitration_voting_weight','business_requirement':'Vote\x20weight\x20equals\x20reputation\x20score\x20(dynamic\x20weight\x20from\x20Passport)','data_source':'SubmittedObject','host':'arbitration_voting','verifier_level':'none','logic_summary':'GuardIdentifier\x20extracts\x20numeric\x20value\x20from\x20Passport\x20submission','key_queries':[],'mitigated_risks':['R-C3-02'],'notes':['Table\x20needs\x20numeric\x20submission\x20entry\x20at\x20referenced\x20index','Weight\x20must\x20come\x20from\x20on-chain\x20EntityRegistrar,\x20not\x20submission','BINDING_01:\x20voting_guard\x20GuardIdentifier\x20must\x20be\x20numeric\x20(U8-U256)','C-9\x20VERIFIED:\x20voting\x20is\x20OPTIONAL\x20—\x20voting_deadline\x20is\x20Option\x20'+'(None\x20=\x20open-ended\x20voting;\x20arbitration\x20can\x20proceed\x20whenever\x20the\x20arbiter\x20decides).\x20'+'The\x20only\x20on-chain\x20ballot\x20floor\x20is\x20ONE:\x20a\x20verdict\x20requires\x20at\x20least\x20one\x20cast\x20vote\x20'+'(zero-vote\x20verdicts\x20abort\x20E_NO_VOTE_CAST\x20—\x20the\x20BF-15\x20gate);\x20a\x20single\x20ballot\x20suffices,\x20'+'and\x20vote\x20WEIGHT\x20does\x20not\x20gate\x20verdicts\x20at\x20all\x20(M-F,\x20chain-verified:\x20weight\x20is\x20'+'record/display\x20only\x20—\x20one\x20voter\x20of\x20any\x20weight\x20can\x20produce\x20an\x20executable\x20verdict).\x20'+'MAX_ARBITRATOR_VOTING=520\x20is\x20only\x20an\x20upper\x20bound.\x20'+'Open\x20voting\x20(empty\x20voting_guard)\x20gives\x20every\x20vote\x20EQUAL\x20WEIGHT\x20(1\x20person\x201\x20vote),\x20'+'but\x20it\x20is\x20NOT\x20permissionless:\x20vote()\x20asserts\x20arbitration\x20permission\x20358\x20unconditionally,\x20'+'so\x20grant\x20358\x20to\x20every\x20intended\x20voter\x20(testnet-verified\x20UPW-14:\x20the\x20roster\x20arbiters\x20held\x20no\x20358\x20'+'grant,\x20so\x20voting\x20collapsed\x20to\x20the\x20admin\x20alone\x20and\x20every\x20dispute\x20dead-ended).']},{'id':'pattern.arb_status_escrow_holdback','business_requirement':'Document\x20the\x20TWO-TRACK\x20INDEPENDENCE\x20between\x20an\x20order\x27s\x20escrow\x20distribution\x20and\x20an\x20arbitration\x20compensation\x20payout,\x20and\x20where\x20the\x20\x27hold\x20back\x20settlement\x20while\x20a\x20claim\x20is\x20live\x27\x20discipline\x20actually\x20lives\x20(recast\x20under\x20decision\x2011\x20two-rail\x20independence,\x202026-10-31\x20—\x20the\x20original\x20UPW-21\x20double-payout\x20finding\x20predates\x20it)','host':'service_allocator_guard','data_source':'SubmittedObject','verifier_level':'level3_scene_combined','logic_summary':'DECISION\x2011\x20(user\x20ruling\x202026-10-31):\x20the\x20order\x20fund\x20track\x20and\x20the\x20arbitration\x20indemnity\x20track\x20are\x20INDEPENDENT\x20—\x20refund/settle/recover\x20rails\x20complete\x20by\x20ORDER-LEVEL\x20NODE\x20STATE\x20and\x20NEVER\x20read\x20order.claimed_by\x20(a\x20claimed_by\x20leg\x20on\x20an\x20allocator\x20rail\x20is\x20the\x20R-FUND-RAIL-CLAIMED-BY\x20/\x20RAIL_CLAIMED_BY_LEG\x20critical,\x20blocked\x20at\x20scan\x20and\x20compile).\x20A\x20double\x20collection\x20(escrow\x20settled\x20AND\x20compensation\x20paid)\x20is\x20a\x20LEGAL\x20commercial\x20outcome\x20—\x20the\x20arbitrator\x20rules\x20on\x20the\x20order\x27s\x20current\x20state\x20and\x20fund\x20destinations,\x20and\x20the\x20MCP\x20confirmation\x20gate\x20discloses\x20the\x20overlap\x20to\x20both\x20parties.\x20The\x20\x27hold\x20back\x20while\x20a\x20claim\x20is\x20live\x27\x20discipline\x20therefore\x20lives\x20in\x20exactly\x20two\x20places:\x20(1)\x20edge\x20sequencing\x20on\x20the\x20ARBITRATION\x20track\x20—\x20tpl_forward_arb_ruling_won/dismissed\x20carry\x20the\x20order.claimed_by\x20some\x20==\x20true\x20sequence\x20leg\x20(4R-03b:\x20the\x20ruling\x20must\x20be\x20enforced\x20before\x20the\x20movement\x20edge\x20opens;\x20machine\x20forwards,\x20not\x20fund\x20rails);\x20(2)\x20the\x20OPERATOR/KEEPER\x20layer\x20—\x20refusing\x20to\x20drive\x20a\x20settlement\x20against\x20an\x20order\x20whose\x20compensation\x20already\x20paid\x20is\x20keeper\x20discipline,\x20not\x20a\x20guard\x20leg.','key_queries':['progress.current','order.dispute\x20count','arb.indemnity\x20some'],'mitigated_risks':['R-X1-16'],'notes':['VERIFIED\x20(UPW-21):\x20claiming\x20compensation\x20does\x20NOT\x20freeze\x20or\x20adjust\x20the\x20order\x20workflow\x20—\x20the\x20merchant\x20can\x20still\x20drive\x20the\x20order\x20to\x20completed\x20and\x20settle\x20the\x20FULL\x20escrow\x20on\x20top\x20of\x20the\x20compensation.\x20The\x20protocol\x20deliberately\x20keeps\x20the\x20two\x20money\x20paths\x20independent\x20(no\x20receive-gate\x20on\x20either\x20entry);\x20decision\x2011\x20made\x20that\x20independence\x20the\x20DOCTRINE\x20instead\x20of\x20a\x20defect:\x20the\x20overlap\x20is\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate,\x20never\x20welded\x20shut\x20with\x20a\x20guard\x20leg.','SYSTEM\x20BOUNDARY\x20(design\x20intent):\x20Arbitration\x20(compensation_fund\x20payouts)\x20and\x20Allocator\x20(escrow\x20distribution)\x20are\x20two\x20INDEPENDENT\x20systems.\x20order.claimed_by\x20is\x20the\x20ARBITRATION\x20track\x27s\x20payout\x20stamp:\x20the\x20arbitrator\x20reads\x20it\x20as\x20ruling\x20input\x20and\x20the\x20arb_ruling\x20forward\x20guards\x20sequence\x20on\x20it\x20(4R-03b)\x20—\x20but\x20an\x20ALLOCATOR\x20(fund)\x20rail\x20reading\x20it\x20is\x20the\x20banned\x20direction-blind\x20shape\x20(W5-01:\x20the\x20bare\x20stamp\x20cannot\x20tell\x20WHO\x20won;\x20a\x20dismissal\x20stamped\x20a\x20recover\x20rail\x20toward\x20the\x20LOSING\x20party,\x20O11).\x20Reading\x20arb.*\x20evidence\x20on\x20a\x20refund\x20rail\x20reachable\x20exclusively\x20from\x20dispute-state\x20nodes\x20remains\x20expressible\x20(see\x20the\x20DSL\x20boundary\x20below)\x20—\x20order.claimed_by\x20legs\x20on\x20fund\x20rails\x20are\x20not.\x20Adding\x20arb-linked\x20fields\x20on\x20Order/Machine\x20or\x20protocol-level\x20state\x20sync\x20would\x20break\x20the\x20boundary\x20—\x20never\x20propose\x20it.','ONE-WAY\x20DOOR:\x20Order.dispute\x20is\x20an\x20append-only\x20vector\x20(filed\x20cases\x20are\x20never\x20pruned).\x20A\x20refund\x20rail\x20keyed\x20on\x20dispute\x20count==0\x20stays\x20blocked\x20FOREVER\x20after\x20the\x20first\x20case\x20—\x20even\x20if\x20the\x20ruling\x20awards\x20nothing,\x20the\x20escrow\x20refund\x20route\x20is\x20dead\x20and\x20funds\x20strand\x20at\x20that\x20node\x20(Machine+Allocator\x20immutable,\x20IMMUT-001).\x20The\x20polarity-era\x20advice\x20\x27prefer\x20claimed_by\x20some==false\x20instead\x27\x20is\x20RETIRED\x20—\x20decision\x2011\x20bans\x20that\x20leg\x20too;\x20the\x20node-gated\x20rail\x20fires\x20at\x20its\x20nodes\x20regardless\x20of\x20dispute\x20history,\x20and\x20payout-aware\x20leniency\x20is\x20a\x20keeper/operator\x20judgment\x20informed\x20by\x20the\x20order\x27s\x20state\x20and\x20fund\x20destinations.','N-3\x20RESIDUAL\x20(disclosed,\x20no\x20chain\x20fix):\x20the\x20objection-cycle\x20reset\x20clears\x20arb.indemnity\x20but\x20nothing\x20on-chain\x20ever\x20clears\x20arb.compensation_time.\x20Treat\x20compensation_time\x20strictly\x20as\x20a\x20permanent\x20payout\x20timestamp,\x20never\x20a\x20freshness/absence\x20signal\x20—\x20the\x20ARBITRATION\x20side\x20reads\x20it\x20(alongside\x20order.claimed_by)\x20when\x20ruling\x20on\x20an\x20order\x27s\x20fund\x20destinations;\x20no\x20allocator\x20gate\x20keys\x20on\x20either.','ORDERING\x20MATRIX\x20(decision\x2011\x20form;\x20the\x20earlier\x20polarity-pairing\x20recipe\x20—\x20\x27settlement\x20gated\x20on\x20claimed_by\x20none,\x20merchant-recovery\x20gated\x20on\x20claimed_by\x20some\x27\x20—\x20is\x20BANNED:\x20it\x20was\x20the\x20W5-01\x20direction-blind\x20bug\x27s\x20root,\x20not\x20a\x20cure):\x20BOTH\x20directions\x20stay\x20OPEN\x20on-chain.\x20claim→refund:\x20after\x20a\x20claim\x20pays,\x20the\x20node-gated\x20escrow\x20rails\x20keep\x20firing\x20at\x20their\x20nodes\x20—\x20a\x20settlement\x20on\x20top\x20of\x20a\x20paid\x20compensation\x20is\x20the\x20dual-track\x20overlap\x20itself,\x20LEGAL\x20and\x20disclosed\x20at\x20the\x20MCP\x20confirmation\x20gate;\x20discourage\x20it\x20only\x20by\x20OPERATOR\x20discipline\x20(the\x20keeper\x20refuses\x20the\x20double\x20drive).\x20refund→claim:\x20a\x20released\x20escrow\x20does\x20not\x20block\x20a\x20later\x20claim\x20either,\x20and\x20the\x20claim\x20path\x20has\x20no\x20guard/passport\x20slot\x20—\x20refusing\x20to\x20drive\x20arb_claim_compensation\x20against\x20an\x20already-released\x20escrow\x20stays\x20an\x20OPERATOR\x20rule.\x20On-chain\x20sequencing\x20exists\x20ONLY\x20on\x20the\x20arbitration\x20track\x27s\x20own\x20forwards\x20(tpl_forward_arb_ruling_won/dismissed,\x204R-03b).','DSL\x20CAPABILITY\x20BOUNDARY\x20(chain-verified\x202026-10-27,\x204R-03a\x20ruling):\x20arb.indemnity\x20legs\x20are\x20NOT\x20default-injectable\x20into\x20refund\x20rails.\x20The\x20native\x20query\x20evaluator\x20ABORTS\x20the\x20whole\x20passport\x20when\x20the\x20queried\x20object\x20does\x20not\x20exist\x20(W_OBJECT_NOT_FOUND)\x20or\x20is\x20not\x20an\x20Arb\x20(field-offset\x20read\x20fails,\x20W_FIELD_TYPE_ERROR);\x20arb.indemnity.amount\x20additionally\x20aborts\x20on\x20a\x20None\x20ruling\x20(\x27indemnity\x20field\x20is\x20None\x27).\x20logic_or\x20does\x20NOT\x20short-circuit\x20(all\x20operands\x20evaluate\x20before\x20the\x20disjunction\x20applies),\x20so\x20no\x20wrapper\x20escapes\x20the\x20abort,\x20and\x20a\x20no-case\x20refund\x20passport\x20has\x20NO\x20Arb\x20address\x20to\x20submit.\x20An\x20indemnity-exclusion\x20leg\x20is\x20therefore\x20buildable\x20ONLY\x20on\x20a\x20refund\x20rail\x20reachable\x20exclusively\x20from\x20DISPUTE-state\x20nodes,\x20where\x20the\x20passport\x20flow\x20can\x20submit\x20a\x20real\x20Arb\x20address\x20(slot\x201,\x20b_submission)\x20—\x20never\x20propose\x20a\x20kernel-wide\x20default\x20injection:\x20it\x20would\x20abort\x20every\x20no-case\x20refund\x20(W_OBJECT_NOT_FOUND\x20on\x20the\x20missing\x20Arb).','Dry-run\x20the\x20combined\x20condition\x20on\x20testnet\x20before\x20publish\x20(INFERENCE\x20per\x20pattern.allocation_staged_release).']},{'id':'pattern.deposit_arb_reimbursement','business_requirement':'Recover\x20an\x20arbitration\x20compensation\x20from\x20the\x20responsible\x20supplier\x20WITHOUT\x20touching\x20already-distributed\x20escrow\x20—\x20the\x20protocol\x20has\x20NO\x20clawback\x20(allocation\x20is\x20irreversible;\x20the\x20only\x20return\x20path\x20needs\x20the\x20recipient\x27s\x20voluntary\x20cooperation),\x20so\x20recovery\x20is\x20a\x20FORWARD\x20allocation\x20from\x20a\x20pre-funded\x20deposit\x20pool','host':'service_allocator_guard','data_source':'SubmittedObject','verifier_level':'level3_scene_combined','logic_summary':'Supplier\x20onboards\x20with\x20a\x20pre-funded\x20deposit\x20Allocation.\x20Its\x20allocator\x20Guard\x20requires\x20cross-system\x20evidence:\x20'+'(1)\x20order.claimed_by\x20(1571)\x20==\x20the\x20submitted\x20Arb\x20—\x20compensation\x20was\x20ACTUALLY\x20paid\x20out\x20of\x20the\x20Service\x20fund\x20(the\x20reimbursement\x20trigger;\x20claimed_by\x20is\x20permanent\x20and\x20names\x20the\x20case);\x20'+'(2)\x20arb.order\x20(1513)\x20on\x20the\x20submitted\x20Arb\x20==\x20the\x20paying\x20order\x20—\x20the\x20case\x20belongs\x20to\x20this\x20order;\x20'+'(3)\x20optional\x20amount\x20tier:\x20arb.indemnity.amount\x20(1641,\x20stable\x20once\x20ruled)\x20compared\x20against\x20a\x20Repository\x20tier\x20grid\x20(see\x20pattern.repository_data_check)\x20or\x20a\x20Surplus\x20drain\x20of\x20the\x20whole\x20pool.\x20'+'A\x20collaborator\x20or\x20keeper\x20drives\x20alloc_by_guard\x20on\x20the\x20deposit\x20Allocation\x20after\x20the\x20claim\x20settles\x20—\x20the\x20deduction\x20is\x20a\x20native\x20forward\x20allocation\x20(append-only,\x20auditable),\x20not\x20a\x20reversal.\x20NOTE:\x20the\x20deduction\x20is\x20NOT\x20self-idempotent\x20—\x20a\x20keeper\x20retry\x20deducts\x20twice;\x20dedupe\x20via\x20a\x20once-slot\x20scope\x20or\x20a\x20settled-state\x20guard\x20query.','key_queries':['order.claimed_by','arb.order','arb.indemnity.amount','repository.data'],'mitigated_risks':['R-X1-16'],'notes':['BOUNDARY\x20(design\x20intent):\x20this\x20is\x20a\x20READ-ONLY\x20evidence\x20reference\x20across\x20the\x20two\x20independent\x20systems\x20(Arbitration\x20fund\x20vs\x20escrow\x20Allocator)\x20—\x20exactly\x20what\x20the\x20arb.*\x20/\x20order.claimed_by\x20query\x20catalog\x20exists\x20for.\x20It\x20does\x20NOT\x20couple\x20the\x20systems:\x20no\x20arb\x20field\x20is\x20added\x20to\x20Order/Machine,\x20no\x20protocol\x20state\x20sync,\x20the\x20escrow\x20track\x20is\x20untouched.','Gate\x20on\x20order.claimed_by\x20(set\x20only\x20when\x20the\x20claim\x20actually\x20paid),\x20NOT\x20on\x20arb.status\x20(transient:\x20arb_withdraw\x20advances\x205→6,\x20R-X1-16)\x20and\x20not\x20on\x20arb.indemnity\x20alone\x20(a\x20ruling\x20without\x20a\x20claim\x20has\x20moved\x20no\x20money\x20—\x20nothing\x20to\x20reimburse\x20yet).','Deposit\x20must\x20cover\x20the\x20worst\x20case\x20(indemnity\x20capped\x20at\x203x\x20order\x20amount)\x20—\x20size\x20the\x20pool\x20at\x20onboarding;\x20a\x20drained\x20pool\x20blocks\x20reimbursement\x20until\x20topped\x20up\x20(alloc\x20aborts\x20EINSUFFICIENT_BALANCE,\x20code\x207).','No\x20Move\x20change\x20required\x20—\x20buildable\x20today\x20with\x20Allocation\x20+\x20Guard\x20+\x20Repository\x20tier\x20grid.\x20The\x20deposit\x20mode\x20is\x20the\x20immediate\x20configuration-layer\x20path;\x20a\x20true\x20clawback\x20protocol\x20primitive\x20stays\x20a\x20later\x20evaluation\x20pending\x20real-case\x20coverage.']},{'id':'pattern.arbitration_membership_check','business_requirement':'Only\x20premium\x20members\x20can\x20file\x20disputes','data_source':'OnChainConstant','host':'arbitration_usage','verifier_level':'none','logic_summary':'logic_and[query(entity\x20exists),\x20logic_as_u256_greater_or_equal[query(entity\x20tier),\x20identifier[N](premium_tier)]]','key_queries':['entity.registrar','entity.linker'],'mitigated_risks':[],'notes':['ENTITY_REGISTRAR_ADDRESS\x20(0xaab)\x20/\x20ENTITY_LINKER_ADDRESS\x20(0xaaa)\x20must\x20be\x20in\x20table\x20—\x20chain\x20truth\x20(fixed\x20at\x20chain\x20deployment):\x200xaab\x20is\x20the\x20Move-level\x20Entity\x20object,\x200xaaa\x20the\x20Registrar;\x20SDK\x20constant\x20names\x20are\x20legacy\x20aliases\x20(rex5\x20T-06)']},{'id':'pattern.scene_allocator_entity_recipient','business_requirement':'Service\x20allocator\x20with\x20sharing.who=Entity\x20—\x20no\x20Signer\x20binding\x20needed','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Scene\x20verifies\x20fund\x20flow\x20safety\x20—\x20Guard\x20only\x20validates\x20allocation\x20rules','key_queries':['service.permission','order.amount'],'mitigated_risks':['R-C3-06'],'notes':['Funds\x20flow\x20to\x20fixed\x20Treasury/address\x20regardless\x20of\x20caller','sharing.who=Entity\x20already\x20guarantees\x20recipient\x20safety','No\x20Signer\x20binding\x20required\x20—\x20R-C3-06\x20safe']},{'id':'pattern.scene_machine_forward_operator','business_requirement':'Machine\x20forward\x20with\x20permissionIndex/namedOperator\x20already\x20verifies\x20operator','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Forward\x27s\x20permissionIndex/namedOperator\x20verifies\x20operator\x20—\x20Guard\x20only\x20validates\x20submitted\x20data','key_queries':[],'mitigated_risks':[],'notes':['Scene\x20verifies\x20operator\x20permission\x20via\x20permissionIndex/namedOperator','Signer\x20binding\x20only\x20needed\x20if\x20submitted\x20data\x20must\x20belong\x20to\x20operator','Evaluate\x20scene\x20before\x20adding\x20Signer\x20binding']},{'id':'pattern.fund_flow_refund_freeform','business_requirement':'Refund\x20/\x20cancellation\x20fund-release\x20defined\x20purely\x20by\x20game\x20conditions\x20—\x20NOT\x20bound\x20to\x20any\x20Machine\x20node','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level2_identity_set','logic_summary':'An\x20allocator\x20Guard\x20whose\x20root\x20encodes\x20refund\x20conditions\x20ARBITRARILY:\x20'+'buyer\x20signature\x20(logic_equal[Signer,\x20buyer]),\x20timeout\x20(logic_as_u256_greater_or_equal[Clock,\x20deadline]),\x20'+'evidence\x20state\x20(query\x20any\x20on-chain\x20object:\x20order\x20fields,\x20repository\x20data,\x20payment\x20proofs),\x20'+'arbitration\x20outcome,\x20or\x20any\x20logic_and/or\x20combination.\x20No\x20progress/current-node\x20query\x20required.','key_queries':['order.owner','order.service','order.amount'],'mitigated_risks':['R-C3-06'],'notes':['C-2\x20RESOLUTION:\x20Machine-node-triggered\x20refund\x20(\x27at\x20cancelled\x20node\x20→\x20release\x27)\x20is\x20only\x20ONE\x20application\x20pattern.\x20'+'Guard+Allocator\x20is\x20a\x20GENERAL\x20game\x20primitive:\x20the\x20refund\x20condition\x20tree\x20is\x20fully\x20free-form.\x20'+'Move\x20layer\x20needs\x20NO\x20change\x20—\x20Guard\x20roots\x20accept\x20arbitrary\x20logic\x20over\x20any\x20queryable\x20state.','GAME-THEORETIC\x20READING:\x20both\x20parties\x20should\x20evaluate\x20the\x20refund\x20Guard\x20BEFORE\x20transacting\x20—\x20'+'who\x20can\x20trigger\x20it,\x20under\x20which\x20conditions,\x20with\x20what\x20evidence.\x20Use\x20the\x20analyze_guard_semantics\x20'+'query\x20action\x20to\x20render\x20+\x20lint\x20any\x20Guard\x20and\x20reason\x20about\x20each\x20party\x27s\x20leverage.','Condition\x20dimensions\x20freely\x20composable:\x20identity\x20(Signer/Entity),\x20time\x20(Clock),\x20'+'counterparty\x20evidence\x20(submitted\x20Payment/Order/Proof),\x20shared\x20data\x20(Repository),\x20'+'workflow\x20state\x20(Progress\x20—\x20optional,\x20only\x20when\x20a\x20Machine\x20exists)','Multi-tier\x20refund:\x20multiple\x20allocators\x20bound\x20to\x20DIFFERENT\x20guards\x20encode\x20graduated\x20policies\x20'+'(full\x20refund\x20pre-delivery,\x20partial\x20refund\x20post-milestone,\x20no\x20refund\x20post-acceptance)\x20—\x20the\x20caller\x27s\x20submitted\x20guard\x20selects\x20exactly\x20one\x20path']},{'id':'pattern.fund_flow_profit_share_freeform','business_requirement':'Revenue/profit\x20sharing\x20among\x20partners\x20triggered\x20by\x20verifiable\x20contribution\x20conditions\x20—\x20not\x20by\x20workflow\x20nodes','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Allocator\x20sharing\x20(who+ratio)\x20defines\x20the\x20SPLIT;\x20the\x20Guard\x20defines\x20WHEN\x20the\x20split\x20executes.\x20'+'The\x20WHEN\x20is\x20free-form:\x20period\x20boundary\x20(Clock\x20vs\x20interval),\x20contribution\x20proof\x20(submitted\x20evidence),\x20'+'performance\x20threshold\x20(Repository\x20metric),\x20or\x20counterparty\x20co-signature.','key_queries':['repository.data','payment.amount'],'mitigated_risks':['R-C3-06'],'applicable_industries':['freelance','subscription','education'],'notes':['C-2\x20RESOLUTION:\x20profit-sharing\x20is\x20an\x20application\x20pattern\x20of\x20the\x20same\x20Guard+Allocator\x20primitive\x20—\x20'+'the\x20trigger\x20condition\x20tree\x20is\x20arbitrary\x20game\x20logic,\x20not\x20a\x20workflow\x20artifact.','sharing.who=Entity\x20recipients\x20make\x20the\x20split\x20caller-safe\x20(funds\x20flow\x20to\x20fixed\x20addresses)\x20—\x20'+'Guard\x20then\x20only\x20gates\x20TIMING/CONDITIONS,\x20not\x20identity\x20(R-C3-06\x20safe\x20by\x20scene)','Periodic\x20settlement:\x20logic_as_u256_greater_or_equal[Clock,\x20identifier[N](period_start)]\x20+\x20'+'logic_as_u256_equal[calc_number_mod[Clock,\x20interval],\x200]-style\x20windows,\x20'+'or\x20a\x20Repository-held\x20settlement\x20cursor\x20updated\x20after\x20each\x20allocation\x20run']},{'id':'pattern.permission_guard_entity_time_window','business_requirement':'Delegate\x20a\x20permission\x20index\x20to\x20a\x20Guard\x20object\x20address\x20—\x20authorization\x20that\x20self-enforces\x20and\x20self-expires\x20(time-windowed\x20delegation)','data_source':'SystemContext','host':'machine_forward','verifier_level':'none','logic_summary':'The\x20entity\x20table\x20accepts\x20\x27user/guard\x20address\x20&\x20permission_index\x20list\x27\x20—\x20'+'a\x20Guard\x27s\x20OWN\x20ADDRESS\x20can\x20hold\x20a\x20permission\x20index.\x20The\x20delegated\x20Guard\x20then\x20encodes\x20'+'temporal\x20+\x20contextual\x20conditions:\x20logic_and[logic_as_u256_greater_or_equal[Clock,\x20valid_from],\x20'+'logic_as_u256_lesser_or_equal[Clock,\x20valid_until],\x20<scene\x20conditions>].\x20'+'Callers\x20satisfying\x20the\x20Guard\x20act\x20with\x20the\x20delegated\x20permission\x20index.','key_queries':[],'mitigated_risks':[],'notes':['C-8\x20VERIFIED:\x20entity\x20table\x20comment\x20—\x20\x27user/guard\x20address\x20&\x20permission_index\x20list\x27\x20'+'(guard\x20addresses\x20are\x20first-class\x20permission\x20entities,\x20same\x20as\x20user\x20addresses)','TIME\x20WINDOW:\x20Guard\x20roots\x20compose\x20context(Clock)\x20freely\x20—\x20valid_from/valid_until\x20bounds,\x20'+'recurring\x20windows\x20(mod\x20arithmetic),\x20or\x20deadline-before\x20(authorize\x20only\x20until\x20expiry)','SELF-EXPIRING\x20DELEGATION:\x20after\x20valid_until\x20the\x20Guard\x20fails\x20for\x20everyone\x20—\x20no\x20on-chain\x20'+'revocation\x20transaction\x20needed,\x20no\x20trust\x20in\x20the\x20delegate\x20to\x20stop\x20acting','SCENARIO\x20COMBINATION\x20(scenario\x20layer):\x20temporary\x20operator\x20(holiday\x20cover),\x20seasonal\x20service\x20window,\x20'+'trial-period\x20customer\x20privileges,\x20contractor\x20time-boxed\x20access,\x20emergency-break-glass\x20with\x20auto-expiry','Design\x20tip:\x20combine\x20with\x20scene\x20conditions\x20(order\x20state,\x20submitted\x20evidence)\x20—\x20'+'time\x20bounds\x20rarely\x20stand\x20alone']},{'id':'pattern.allocator_order_anchor','business_requirement':'Bind\x20an\x20allocator\x27s\x20Guard\x20to\x20the\x20paying\x20order\x20when\x20every\x20recipient\x20is\x20a\x20fixed\x20address\x20(Entity/Signer)\x20—\x20the\x20Guard\x20would\x20otherwise\x20read\x20no\x20order\x20at\x20all','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Entity/Signer\x20rows\x20are\x20not\x20resolved\x20from\x20submissions,\x20so\x20an\x20allocator\x20paying\x20only\x20them\x20gives\x20its\x20Guard\x20nothing\x20to\x20'+'constrain.\x20Add\x20a\x20{GuardIdentifier:\x200}\x20row\x20with\x20Rate\x200\x20(or\x20Surplus\x20when\x20the\x20allocator\x20has\x20no\x20other\x20Surplus\x20row):\x20'+'the\x20row\x20pays\x20nothing,\x20and\x20the\x20Guard\x27s\x20Identifier\x20slot\x20now\x20resolves\x20to\x20the\x20paying\x20order,\x20so\x20order.*\x20queries\x20bind.\x20'+'Applicability\x20(ZR-34):\x20Rate-bearing\x20or\x20mixed\x20(Amount+Rate)\x20allocators\x20ONLY\x20—\x20in\x20a\x20pure-Amount\x20allocator\x20the\x20'+'Rate-0\x20row\x20flips\x20the\x20allocator\x20to\x20Rate\x20mode,\x20whose\x20Rate\x20legs\x20must\x20then\x20sum\x20to\x20exactly\x2010000\x20when\x20no\x20Surplus\x20leg\x20'+'exists\x20(ERATE_NOT_10000,\x20R-A-1-02),\x20so\x20configuration\x20aborts;\x20a\x20pure-Amount\x20allocator\x20binds\x20through\x20its\x20pinned\x20'+'Amount\x20+\x20GuardIdentifier(0)\x20recipient\x20+\x20the\x20254/255\x20once\x20slot\x20instead.','key_queries':['order.service','order.owner'],'notes':['VERIFIED\x20on\x20a\x20standalone\x20Allocation:\x20the\x20zero-share\x20anchor\x20row\x20is\x20accepted\x20by\x20order_allocators\x20(Move\x20asserts\x20no\x20Rate>0\x20minimum).','Confirm\x20Rate\x200\x20on\x20the\x20real\x20Service\x20with\x20a\x20dry-run\x20before\x20publishing\x20—\x20published\x20allocators\x20cannot\x20change.','The\x20anchor\x20row\x20also\x20makes\x20recipient-constraint\x20audits\x20meaningful:\x20the\x20Guard\x27s\x20binding\x20target\x20exists.','C-9\x20SIDE\x20EFFECT:\x20a\x20Rate-0\x20anchor\x20row\x20still\x20materialises\x20a\x20ZERO-BALANCE\x20CoinWrapper\x20at\x20the\x20recipient\x20(observed\x20live:\x20the\x20Order\x20received\x20a\x20balance=0\x20wrapper\x20on\x20every\x20settlement).\x20It\x20carries\x20no\x20value\x20yet\x20shows\x20up\x20as\x20a\x200-amount\x20claimable\x20object,\x20which\x20reads\x20as\x20noise\x20in\x20onchain_received\x20and\x20in\x20buyer-facing\x20claim\x20lists.\x20This\x20is\x20the\x20accepted\x20cost\x20of\x20binding\x20the\x20Guard\x20to\x20an\x20order,\x20and\x20it\x20remains\x20strictly\x20safer\x20than\x20Signer.','SCOPE\x20(ZR-34,\x20ziroom-mn-261013):\x20Rate-bearing\x20or\x20mixed\x20groups\x20ONLY.\x20A\x20Rate-0\x20anchor\x20row\x20inside\x20a\x20pure-Amount\x20allocator\x20converts\x20that\x20allocator\x20to\x20Rate\x20mode\x20—\x20with\x20no\x20Surplus\x20leg\x20the\x20Rate\x20legs\x20must\x20then\x20sum\x20to\x20exactly\x2010000\x20and\x20the\x20configuration\x20aborts\x20(ERATE_NOT_10000\x20family,\x20R-A-1-02).\x20Pure-Amount\x20groups\x20(a\x20pinned\x20deposit\x20refund,\x20per-period\x20Amount\x20releases)\x20must\x20NOT\x20take\x20the\x20anchor:\x20they\x20bind\x20through\x20the\x20pinned\x20Amount,\x20a\x20GuardIdentifier(0)\x20recipient,\x20and\x20the\x20254/255\x20once\x20slot\x20instead.']},{'id':'pattern.allocation_staged_release','business_requirement':'Pay\x20an\x20order\x20out\x20in\x20stages\x20(milestones),\x20or\x20hold\x20a\x20share\x20back\x20(deposit,\x20warranty,\x20quality\x20reserve)\x20behind\x20a\x20time\x20window\x20/\x20dispute\x20state','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'An\x20Allocation\x20can\x20be\x20triggered\x20MANY\x20times\x20and\x20the\x20contract\x20keeps\x20no\x20\x27already\x20paid\x27\x20flag,\x20so\x20every\x20staged\x20allocator\x20'+'needs\x20its\x20own\x20not-yet-paid\x20condition:\x20escrow\x20balance\x20still\x20equals\x20the\x20order\x20amount,\x20or\x20a\x20state/time\x20only\x20one\x20stage\x20'+'satisfies.\x20A\x20holdback\x20is\x20an\x20allocator\x20whose\x20Guard\x20adds\x20a\x20time\x20window\x20(progress.history.time\x20+\x20duration)\x20and,\x20for\x20'+'dispute\x20awareness,\x20a\x20condition\x20on\x20order.dispute\x20count\x20or\x20on\x20arb.indemnity\x20some\x20of\x20a\x20submitted\x20Arb\x20—\x20NEVER\x20on\x20'+'arb.status\x20(transient,\x20see\x20notes).','key_queries':['progress.history.time','order.dispute','arb.indemnity\x20some'],'notes':['REPLAY\x20TEST\x20MANDATORY:\x20trigger\x20the\x20same\x20allocator\x20twice\x20and\x20expect\x20the\x20second\x20call\x20to\x20fail\x20—\x20abort\x2014\x20EZERO_DISTRIBUTION\x20when\x20the\x20first\x20run\x20drained\x20the\x20pool,','or\x20abort\x2016\x20E_ONCE_TRIGGERED\x20when\x20the\x20allocator\x27s\x20Guard\x20arms\x20a\x20once\x20slot\x20(identifier\x20255/254).','Abort\x207\x20EINSUFFICIENT_BALANCE\x20applies\x20only\x20to\x20fixed-Amount\x20rows\x20sized\x20against\x20a\x20shared\x20pool\x20that\x20a\x20prior\x20run\x20depleted.','ONE-SHOT\x20KEY\x20(E-2(b),\x20protocol\x20142):\x20identifier\x20254\x20is\x20the\x20ONCE-FOR-OBJECT\x20slot.\x20Arm\x20it\x20({\x20identifier:\x20254,\x20b_submission:\x20true\x20})\x20on\x20SETTLEMENT\x20/\x20incentive-claim\x20rails\x20—\x20the\x20chain\x20derives\x20the\x20once-key\x20from\x20payment_info.for_object,\x20so\x20the\x20submitted\x20bytes\x20are\x20IGNORED\x20and\x20no\x20caller\x20can\x20widen\x20the\x20slot;\x20a\x20replay\x20aborts\x20with\x20code\x2016\x20(unbound\x20allocation\x20aborts\x2021).\x20NEVER\x20arm\x20254\x20on\x20a\x20REFUND\x20rail:\x20a\x20refund\x20pays\x20the\x20submitted\x20Order\x20through\x20user\x20slot\x200\x20(extracted\x20by\x20the\x20Order\x27s\x20owner-claim\x20entry),\x20and\x20a\x20refund\x20node\x20re-entered\x20in\x20a\x20later\x20renewal\x20period\x20aborts\x20E_ONCE_TRIGGERED(16)\x20forever\x20(OFN\x20#P-04;\x20the\x20shipped\x20templates\x20were\x20swept\x20254\x20to\x200\x20in\x20v89).\x20Use\x20identifier\x20255\x20ONLY\x20for\x20rails\x20that\x20legitimately\x20repeat\x20once\x20per\x20period:\x20register\x20an\x20address-typed\x20{\x20identifier:\x20255,\x20b_submission:\x20true\x20}\x20row\x20AND\x20make\x20the\x20guard\x20EXPRESSION\x20actually\x20consume\x20identifier\x20255\x20(a\x20TYPE_CONSTANT\x20255\x20clause)\x20with\x20a\x20caller-period\x20key\x20like\x20\x27period-<N>\x27\x20—\x20a\x20TYPE_CONSTANT\x20255\x20declaration\x20WITHOUT\x20a\x20referencing\x20clause\x20verifies\x20nothing,\x20so\x20a\x20caller\x20can\x20submit\x20a\x20fresh\x20once-value\x20each\x20round\x20and\x20bypass\x20the\x20guard\x20entirely.\x20255\x20is\x20byte-keyed\x20(the\x20raw\x20submitted\x20bytes\x20ARE\x20the\x20key)\x20and\x20per-Allocation\x20(a\x20fresh\x20pool\x20starts\x20with\x20no\x20record\x20—\x20the\x20order\x20anchor,\x20not\x20255,\x20is\x20what\x20scopes\x20a\x20rail\x20to\x20its\x20own\x20order).','VERIFIED\x20on\x20testnet\x20(booking\x20o10):\x20time-window\x20holdbacks\x20AND\x20dispute-aware\x20conditions\x20via\x20arb.indemnity\x20some.','⚠️\x20TRANSIENT-STATE\x20TRAP:\x20never\x20gate\x20a\x20refund/release\x20on\x20arb.status\x20==\x205\x20(Finished)\x20—\x20arb_withdraw\x20legitimately\x20advances\x20the\x20case\x205→6\x20(Withdrawn)\x20and\x20the\x20edge\x20dies\x20forever;\x20Guard\x20+\x20Machine\x20are\x20immutable\x20after\x20publish\x20(IMMUT-001),\x20so\x20mistyping\x20arb.status\x20strands\x20funds\x20permanently\x20(o10:\x201.5\x20WOW\x20locked).\x20arb.indemnity\x20some\x20(Bool)\x20is\x20the\x20withdraw-stable\x20signal;\x20arb.indemnity.time\x20(U64)\x20adds\x20the\x20ruling\x20timestamp\x20for\x20time-bounded\x20gates.\x20See\x20template\x20tpl_forward_arb_ruling_won\x20and\x20rule\x20R-X1-16.','Never\x20pay\x20the\x20held\x20share\x20from\x20the\x20same\x20Guard\x20that\x20pays\x20the\x20main\x20share\x20—\x20a\x20Guard\x20that\x20also\x20fires\x20while\x20a\x20warranty\x20is\x20open\x20leaves\x20the\x20buyer\x20no\x20leverage.']},{'id':'pattern.fund_flow_stop_node_coverage','business_requirement':'No\x20order\x20may\x20ever\x20rest\x20at\x20a\x20node\x20whose\x20funds\x20have\x20no\x20defined\x20exit\x20—\x20every\x20stop\x20node\x20of\x20the\x20Machine\x20needs\x20BOTH\x20a\x20withdrawal\x20(release)\x20and\x20a\x20refund\x20allocation\x20rule,\x20evaluated\x20BEFORE\x20Service\x20publish','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Design-time\x20topology\x20review,\x20not\x20a\x20single\x20Guard\x20tree:\x20enumerate\x20every\x20node\x20where\x20an\x20order\x20can\x20rest\x20'+'(terminal\x20nodes\x20AND\x20waiting\x20states\x20—\x20review\x20windows,\x20open\x20disputes,\x20staged-release\x20holds)\x20and\x20map\x20each\x20'+'to\x20the\x20allocator\x20Guard(s)\x20that\x20move\x20money\x20out\x20of\x20it.\x20A\x20stop\x20node\x20with\x20no\x20release\x20rule\x20freezes\x20the\x20'+'merchant\x20share;\x20one\x20with\x20no\x20refund\x20rule\x20freezes\x20the\x20buyer\x27s\x20escrow.\x20Machine\x20+\x20Allocator\x20are\x20immutable\x20'+'after\x20publish\x20(IMMUT-001)\x20—\x20a\x20missed\x20node\x20is\x20a\x20permanent\x20fund\x20stranding,\x20not\x20a\x20fixable\x20typo.','key_queries':['order.service','progress.history.time','arb.indemnity\x20some'],'mitigated_risks':['R-X1-16'],'notes':['CHECKLIST\x20at\x20Service\x20publish:\x20(1)\x20list\x20stop\x20nodes\x20from\x20the\x20Machine\x20graph\x20—\x20nodes\x20with\x20no\x20outgoing\x20Pair\x20PLUS\x20every\x20node\x20where\x20a\x20human/external\x20action\x20is\x20awaited\x20(review,\x20handover,\x20dispute);\x20(2)\x20for\x20each,\x20name\x20the\x20release\x20allocator\x20AND\x20the\x20refund\x20allocator\x20(or\x20record\x20an\x20explicit\x20\x27no\x20refund\x20possible\x27\x20decision\x20with\x20its\x20rationale);\x20(3)\x20verify\x20each\x20mapping\x20Guard\x20is\x20satisfiable\x20in\x20BOTH\x20directions\x20(a\x20rule\x20that\x20can\x20never\x20become\x20true\x20strands\x20the\x20same\x20as\x20a\x20missing\x20rule).','REVIEW-GATED\x20RELEASE\x20is\x20a\x20TIME\x20VARIANT\x20of\x20the\x20same\x20exit\x20—\x20\x27reviewed\x27\x20OR\x20\x27unreviewed\x20after\x20T\x27\x20as\x20logic_or\x20inside\x20ONE\x20release\x20Guard;\x20never\x20model\x20reviewed/unreviewed\x20as\x20parallel\x20outgoing\x20edges\x20of\x20completed\x20(race\x20deadlock,\x20F-REVIEW-BLOCK)\x20and\x20never\x20as\x20a\x20node\x20without\x20its\x20own\x20exit.','DISPUTE\x20exits\x20gate\x20on\x20arb.indemnity\x20(stable\x20ruling\x20signal\x20—\x20arb_withdraw\x20sweeps\x20only\x20the\x20fee\x20balance\x20and\x20never\x20touches\x20it),\x20NEVER\x20arb.status==5\x20(transient\x20—\x20R-X1-16\x20/\x20tpl_forward_arb_ruling_won);\x20the\x20merchant-favor\x20dismissal\x20exit\x20pairs\x20tpl_forward_arb_ruling_dismissed\x20(arb.indemnity.amount\x20==\x200\x20—\x20fail-closed\x20on\x20the\x20None\x20field,\x20so\x20only\x20a\x20standing\x20merchant-favor\x20ruling\x20opens\x20the\x20edge)\x20instead\x20of\x20a\x20bare\x20permission\x20edge.','TIME\x20WINDOWS\x20on\x20these\x20exits\x20follow\x20the\x20dual-track\x20rule:\x20chain\x20Clock\x20(native,\x20coarse)\x20or\x20self-built\x20repository\x20oracle\x20(exact\x20wall\x20time)\x20—\x20see\x20pattern.time_source_repository_oracle.','GENERATIVE,\x20NOT\x20TEMPLATE-BOUND:\x20the\x20stop-node\x20list\x20comes\x20from\x20THIS\x20business\x27s\x20rest\x20states,\x20derived\x20from\x20Move-native\x20primitives\x20(nodes/pairs/forwards/guards/allocators).\x20wowok\x20grows\x20arbitrary\x20commerce\x20systems\x20—\x20do\x20not\x20copy\x20another\x20industry\x27s\x20node\x20vocabulary;\x20enumerate\x20your\x20own\x20rest\x20states\x20and\x20cover\x20every\x20one.','Engine\x20enforcement:\x20R-M5-03\x20fires\x20when\x20a\x20Machine\x20has\x20stop\x20nodes\x20but\x20no\x20Allocator\x20is\x20published;\x20R-M5-09\x20carries\x20this\x20checklist\x20as\x20the\x20design-time\x20review\x20obligation.']},{'id':'pattern.commission_holdback','business_requirement':'Commission\x20or\x20bonus\x20that\x20should\x20depend\x20on\x20the\x20order\x20staying\x20undisputed\x20—\x20there\x20is\x20NO\x20clawback\x20once\x20an\x20allocation\x20has\x20run','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Once\x20an\x20allocation\x20runs,\x20the\x20money\x20is\x20in\x20the\x20recipients\x27\x20wallets\x20—\x20Payments\x20are\x20final\x20and\x20only\x20the\x20merchant-funded\x20'+'compensation\x20fund\x20remains.\x20Pay\x20a\x20contested\x20commission\x20from\x20a\x20LATER\x20allocator\x20behind\x20a\x20time\x20window\x20and\x20a\x20dispute\x20'+'condition\x20(see\x20pattern.allocation_staged_release),\x20never\x20from\x20the\x20settlement\x20allocator.','key_queries':['order.dispute','progress.history.time'],'notes':['VERIFIED:\x20no\x20recall/clawback\x20path\x20exists\x20on\x20Payments.\x20INFERENCE:\x20the\x20holdback\x20variant\x20—\x20dry-run\x20before\x20publishing.']},{'id':'pattern.reward_rule_replacement','business_requirement':'Keep\x20the\x20option\x20to\x20replace\x20a\x20Reward\x20rule\x20later\x20(payout\x20is\x20fixed\x20when\x20its\x20Guard\x20is\x20added)','data_source':'OnChainConstant','host':'reward_claim','verifier_level':'none','logic_summary':'Give\x20every\x20reward\x20guard_add\x20an\x20expiration_time\x20if\x20the\x20rule\x20may\x20need\x20replacement\x20—\x20without\x20one\x20the\x20rule\x20is\x20permanent.\x20'+'Replace\x20later\x20via\x20guard_remove\x20\x27<guard-id>\x27,\x20then\x20guard_add\x20the\x20new\x20rule\x20(the\x20\x27expired\x27\x20sweep\x20—\x20guard_remove:\x20\x27expired\x27\x20—\x20only\x20drops\x20EXPIRED\x20guards,\x20never\x20a\x20permanent\x20one).','key_queries':[],'notes':['SCHEMA\x20READING:\x20confirm\x20the\x20guard_remove\x20+\x20guard_add\x20replacement\x20sequence\x20on\x20a\x20test\x20Reward\x20before\x20promising\x20it\x20to\x20users.','Do\x20not\x20set\x20the\x20top-level\x20guard_expiration_time\x20unless\x20you\x20promise\x20claimants\x20no\x20new\x20rules\x20before\x20that\x20time\x20(the\x20same\x20lock\x20also\x20fences\x20guard_remove).']},{'id':'pattern.buy_guard_blocklist','business_requirement':'Refuse\x20certain\x20buyers\x20at\x20purchase\x20time\x20via\x20a\x20mutable\x20list\x20—\x20without\x20redeploying\x20the\x20Guard\x20or\x20the\x20Service','data_source':'SubmittedObject','host':'service_buy_guard','verifier_level':'none','logic_summary':'buy_guard\x20reads\x20on-chain\x20state\x20at\x20purchase\x20time.\x20Bind\x20a\x20Guard\x20that\x20fails\x20when\x20the\x20signer\x20is\x20listed\x20in\x20a\x20Repository\x20'+'policy:\x20context_signer\x20as\x20the\x20key\x20+\x20repository.data\x20has\x20with\x20logic_not.\x20Editing\x20the\x20list\x20needs\x20no\x20new\x20Guard\x20and\x20no\x20new\x20Service.','key_queries':['repository.data'],'notes':['VERIFIED:\x20buy_guard\x20state-read.\x20INFERENCE:\x20the\x20Repository\x20blocklist\x20—\x20dry-run\x20before\x20publishing.','LIMITS:\x20stops\x20NEW\x20orders\x20only\x20—\x20existing\x20orders\x20and\x20their\x20allocations\x20are\x20untouched;\x20the\x20Messenger\x20blacklist\x20does\x20not\x20affect\x20the\x20chain;\x20restrict\x20who\x20can\x20write\x20the\x20Repository\x20policy.']},{'id':'pattern.referral_anti_self_purchase','business_requirement':'Referral\x20commissions\x20where\x20the\x20buyer\x20must\x20not\x20be\x20their\x20own\x20referrer\x20—\x20nothing\x20on-chain\x20checks\x20order.agents','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'agents\x20on\x20an\x20order\x20is\x20filled\x20by\x20the\x20buyer\x20at\x20purchase\x20time\x20and\x20anti_cheat\x20does\x20not\x20read\x20it.\x20Add\x20to\x20the\x20commission\x20'+'allocator\x27s\x20Guard:\x20the\x20referrer\x20is\x20an\x20agent\x20of\x20the\x20order\x20(order.agent\x20has)\x20AND\x20is\x20not\x20the\x20order\x27s\x20owner\x20(order.owner).','key_queries':['order.agent','order.owner'],'notes':['VERIFIED:\x20the\x20anti-cheat\x20gap.\x20INFERENCE:\x20the\x20Guard\x20condition\x20—\x20source-derived,\x20untested;\x20dry-run\x20before\x20publishing.','Blocks\x20the\x20same-address\x20case\x20only.\x20The\x20commission\x20recipient\x20must\x20be\x20an\x20Entity\x20(or\x20Signer)\x20—\x20a\x20GuardIdentifier\x20recipient\x20is\x20the\x20order\x20itself.']},{'id':'pattern.multi_party_recourse','business_requirement':'Multi-party\x20services\x20(hotels,\x20carriers,\x20subcontractors):\x20pay\x20a\x20third\x20party\x20from\x20the\x20order\x20without\x20losing\x20recourse\x20when\x20THEY\x20fail','data_source':'SystemContext','host':'service_allocator_guard','verifier_level':'none','logic_summary':'Only\x20the\x20paying\x20order\x20and\x20the\x20Service\x20it\x20bought\x20from\x20take\x20part\x20in\x20an\x20arbitration,\x20and\x20the\x20payout\x20comes\x20from\x20that\x20'+'Service\x27s\x20compensation\x20fund\x20(capped\x20at\x203x\x20the\x20order\x20amount).\x20A\x20third\x20party\x20who\x20is\x20only\x20an\x20allocation\x20recipient\x20cannot\x20'+'be\x20named,\x20notified\x20or\x20heard\x20in\x20a\x20dispute.\x20Cover\x20it\x20in\x20advance:\x20hold\x20their\x20share\x20behind\x20a\x20time\x20window\x20and\x20a\x20no-dispute\x20'+'condition\x20(see\x20pattern.allocation_staged_release),\x20or\x20buy\x20their\x20part\x20as\x20its\x20own\x20order\x20from\x20their\x20Service\x20so\x20you\x20hold\x20'+'the\x20customer\x20rights\x20against\x20them.','key_queries':['order.dispute','progress.history.time'],'notes':['VERIFIED:\x20two-tier\x20orders.\x20INFERENCE:\x20downstream\x20recourse\x20via\x20holdback\x20—\x20dry-run\x20before\x20publishing.']},{'id':'pattern.tiered_amount_ladder','business_requirement':'Dynamic\x20compensation\x20formula\x20(refund\x20proportional\x20to\x20nights\x20used,\x20tiered\x20cancellation\x20penalty)\x20—\x20Allocator\x20sharing\x20is\x20a\x20STATIC\x20configuration\x20value,\x20so\x20a\x20continuous\x20runtime\x20formula\x20cannot\x20be\x20expressed','data_source':'WitnessDerived','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Approximate\x20the\x20formula\x20with\x20a\x20LADDER:\x20one\x20allocator\x20branch\x20per\x20tier,\x20each\x20with\x20fixed\x20sharing,\x20selected\x20by\x20an\x20'+'interval\x20Guard\x20—\x20logic_as_u256_greater\x20/\x20greater_or_equal\x20/\x20lesser\x20/\x20lesser_or_equal\x20(opcodes\x2091-94,\x20'+'ON-CHAIN\x20VERIFIED\x20with\x20numeric\x20operands)\x20over\x20a\x20witness-derived\x20operand\x20(progress.history.time\x20or\x20order.time\x20+\x20duration).\x20'+'Tier\x20Guards\x20partition\x20the\x20operand\x20range\x20so\x20exactly\x20one\x20branch\x20is\x20payable\x20per\x20order.','key_queries':['progress.history.time','order.time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Rate\x20tiers\x20for\x20PROPORTIONAL\x20formulas\x20(penalty\x20=\x20share\x20of\x20order):\x20Rate\x20scales\x20with\x20the\x20order\x20amount\x20naturally.','Fixed\x20Amount\x20tiers\x20ONLY\x20for\x20absolute-value\x20formulas\x20(damage\x20repair\x20from\x20a\x20public\x20price\x20table)\x20—\x20and\x20every\x20fixed\x20Amount\x20must\x20stay\x20BELOW\x20the\x20smallest\x20expected\x20order\x20escrow:\x20a\x20larger\x20Amount\x20aborts\x20the\x20allocation\x20with\x20Insufficient\x20balance\x20and\x20PERMANENTLY\x20deadlocks\x20that\x20branch\x20(the\x20order\x20balance\x20is\x20unrecoverable\x20through\x20it).\x20See\x20the\x20on-chain\x20abort\x20when\x20the\x20fixed\x20amount\x20exceeds\x20the\x20pool\x20balance.','Keep\x20tiers\x20disjoint\x20and\x20exhaustive\x20over\x20the\x20expected\x20operand\x20range\x20—\x20an\x20uncovered\x20gap\x20means\x20NO\x20branch\x20is\x20payable\x20and\x20the\x20balance\x20waits\x20for\x20manual\x20resolution.','Each\x20tier\x20needs\x20its\x20own\x20not-yet-paid\x20condition\x20(see\x20pattern.allocation_staged_release)\x20—\x20an\x20Allocation\x20can\x20fire\x20repeatedly\x20and\x20the\x20contract\x20keeps\x20no\x20already-paid\x20flag.']},{'id':'pattern.deadline_window','business_requirement':'Time-boxed\x20eligibility\x20—\x20an\x20action\x20is\x20valid\x20only\x20within\x20N\x20after\x20an\x20anchor\x20(dispute\x20window,\x20claim\x20deadline,\x20delivery\x20SLA,\x20cancellation\x20cutoff,\x20review\x20period)','data_source':'SystemContext','host':'arbitration_usage','verifier_level':'none','logic_summary':'UPPER-BOUND\x20window\x20(deadline):\x20context(Clock)\x20+\x20logic_as_u256_lesser_or_equal(calc_number_add(anchor,\x20N))\x20—\x20Clock\x20<=\x20anchor+N.\x20'+'LOWER-BOUND\x20window\x20(opens\x20at):\x20context(Clock)\x20+\x20logic_as_u256_greater_or_equal(anchor).\x20'+'Bounded\x20both\x20ways:\x20logic_and(greater_or_equal(start),\x20lesser_or_equal(start\x20+\x20duration)).','key_queries':['context(Clock)','progress.history.time','order.time'],'witness_types':[],'mitigated_risks':[],'applicable_industries':['retail','rental','travel','freelance','education','subscription','general'],'notes':['DIRECTION\x20IS\x20THE\x20WHOLE\x20GAME.\x20A\x20deadline\x20window\x20needs\x20LESS_OR_EQUAL;\x20writing\x20greater_or_equal(end_time)\x20instead\x20INVERTS\x20it:\x20everything\x20inside\x20the\x20window\x20is\x20rejected\x20and\x20everything\x20after\x20it\x20is\x20admitted\x20forever\x20—\x20the\x20exact\x20opposite\x20of\x20the\x20intent.','Direction\x20test:\x20ask\x20\x27does\x20delay\x20favor\x20or\x20hurt\x20the\x20party\x20being\x20gated?\x27\x20If\x20the\x20gated\x20action\x20gets\x20LESS\x20attractive\x20over\x20time\x20(dispute,\x20claim,\x20cancellation),\x20it\x20is\x20a\x20deadline\x20window\x20→\x20lesser_or_equal(anchor\x20+\x20N).\x20If\x20it\x20gets\x20MORE\x20attractive\x20over\x20time\x20(early-bird\x20access,\x20vesting\x20release),\x20it\x20is\x20an\x20opening\x20window\x20→\x20greater_or_equal(anchor).','The\x20anchor+N\x20arithmetic\x20MUST\x20go\x20through\x20calc_number_add\x20inside\x20the\x20guard\x20tree;\x20Clock\x20compared\x20against\x20a\x20bare\x20anchor\x20only\x20expresses\x20\x27since\x20when\x27,\x20never\x20\x27until\x20when\x27.','NEVER\x20SUBTRACT\x20to\x20measure\x20elapsed\x20time.\x20`calc_number_subtract(Clock,\x20anchor)\x20>=\x20N`\x20underflows\x20the\x20moment\x20the\x20anchor\x20is\x20in\x20the\x20future\x20at\x20eval\x20time\x20(a\x20future-dated\x20stay_date,\x20an\x20early\x20call,\x20clock\x20skew):\x20current\x20binaries\x20abort\x20with\x20the\x20coded\x20GUARD_NUMBER_SUB_OVERFLOW;\x20pre-fix\x20wasm\x20crashed\x20with\x20an\x20opaque\x20VM-level\x20underflow\x20(klk15-ln-261023\x20§F).\x20Direction-safe\x20shape\x20—\x20keep\x20ALL\x20guard\x20arithmetic\x20to\x20ADDS\x20(u256\x20add\x20cannot\x20underflow)\x20and\x20let\x20the\x20comparison\x20carry\x20the\x20direction:\x20\x27at\x20least\x20N\x20after\x20the\x20anchor\x27\x20is\x20greater_or_equal(Clock,\x20calc_number_add(anchor,\x20N));\x20\x27within\x20N\x20of\x20the\x20anchor\x27\x20is\x20lesser_or_equal(Clock,\x20calc_number_add(anchor,\x20N)).\x20Same\x20algebra,\x20zero\x20underflow\x20surface.','ESLN\x20K4:\x20a\x20dedicated\x20non-underflowing\x20elapsed-time\x20primitive\x20now\x20EXISTS\x20on-chain\x20—\x20time_until(target)\x20returns\x20max(0,\x20target\x20-\x20now)\x20in\x20ms\x20(U64,\x20single\x20numeric\x20child;\x20saturated\x20by\x20design:\x20a\x20past\x20target\x20means\x20deadline-reached,\x20never\x20an\x20abort).\x20Use\x20it\x20when\x20the\x20NATURAL\x20expression\x20is\x20\x27remaining\x20time\x20from\x20now\x27\x20(e.g.\x20time_until(expiry)\x20>=\x20review_window)\x20and\x20the\x20target\x20may\x20already\x20be\x20in\x20the\x20past\x20at\x20eval\x20time.\x20Caveats:\x20it\x20reads\x20the\x20on-chain\x20clock\x20(never\x20compare\x20it\x20against\x20another\x20Clock\x20read\x20in\x20the\x20same\x20tree\x20for\x20drift),\x20and\x20guards\x20built\x20with\x20it\x20require\x20the\x20K4-train\x20binary\x20—\x20publish-time\x20scanners\x20reject\x20opcode\x20209\x20on\x20older\x20binaries.\x20The\x20add-only\x20shape\x20above\x20remains\x20the\x20default\x20for\x20anchor-relative\x20windows\x20where\x20both\x20endpoints\x20are\x20known\x20in\x20advance.','Anchors:\x20progress.history.time\x20(immutable\x20node-entry\x20timestamps,\x201280),\x20order.time\x20(order\x20creation),\x20context(Clock)\x20(now,\x20only\x20for\x20opening\x20windows).\x20For\x20arb\x20usage_guard\x20the\x20natural\x20anchor\x20is\x20order.time\x20—\x20\x27disputable\x20for\x20N\x20after\x20the\x20order\x27.','Window\x20guards\x20are\x20eligible-gates,\x20not\x20schedulers:\x20passing\x20does\x20not\x20fire\x20anything\x20at\x20expiry.\x20If\x20funds\x20must\x20MOVE\x20at\x20expiry,\x20pair\x20with\x20an\x20Allocator\x20or\x20a\x20Machine\x20timed\x20node,\x20not\x20the\x20guard\x20alone.','All\x20four\x20comparison\x20opcodes\x20exist\x20on-chain\x20(opcodes\x2091-94,\x20verified\x20with\x20numeric\x20operands)\x20—\x20the\x20direction\x20failure\x20is\x20a\x20design\x20mistake,\x20not\x20a\x20platform\x20limit.']},{'id':'pattern.enum_variant_branch','business_requirement':'Gate\x20on\x20WHICH\x20shape\x20a\x20stored\x20Move\x20enum\x20currently\x20has,\x20and\x20optionally\x20on\x20the\x20value\x20that\x20variant\x20carries\x20'+'(vote-weight\x20mode,\x20reward\x20recipient\x20mode,\x20allocator\x20recipient\x20mode)','data_source':'SubmittedObject','host':'arbitration_voting','verifier_level':'none','logic_summary':'Every\x20enum-typed\x20field\x20exposes\x20a\x20VARIANT\x20query\x20returning\x20the\x20U8\x20tag\x20(declaration\x20order,\x200-based)\x20plus\x20one\x20payload\x20query\x20per\x20variant:\x20'+'arbitration.voting_guard.vote_weight.variant\x20/\x20.identifier\x20/\x20.value\x20(1363/1364/1365\x20—\x200\x20GuardIdentifier(u8),\x201\x20FixedValue(u32));\x20'+'reward.guard.recipient.variant\x20/\x20.address\x20/\x20.identifier\x20(1603/1632/1633\x20—\x200\x20GuardIdentifier(u8),\x201\x20Entity(address),\x202\x20Signer);\x20'+'reward.guard.amount.variant\x20/\x20.identifier\x20/\x20.fixed\x20(1634/1635/1636\x20—\x200\x20GuardU64Identifier(u8),\x201\x20Fixed(u64));\x20'+'allocation.allocator.sharing.who.variant\x20/\x20.address\x20/\x20.identifier\x20(1071/1072/1073\x20on\x20an\x20Allocation,\x201491/1492/1493\x20on\x20a\x20Service\x27s\x20order\x20allocators\x20—\x20same\x20three\x20tags).\x20'+'Shape:\x20logic_as_u256_equal(query(variant),\x20<tag\x20literal>)\x20as\x20one\x20leg,\x20combined\x20via\x20logic_and\x20with\x20the\x20rest\x20of\x20the\x20gate.','key_queries':['arbitration.voting_guard.vote_weight.variant','arbitration.voting_guard.vote_weight.value','reward.guard.recipient.variant','reward.guard.amount.variant','allocation.allocator.sharing.who.variant','service.order_allocators.allocator.sharing.who.variant'],'witness_types':[],'mitigated_risks':[],'applicable_industries':['general','freelance','retail'],'notes':['NOT\x20BOOL.\x20Variant\x20queries\x20return\x20U8\x20and\x20payload\x20queries\x20return\x20U8/U32/U64/Address\x20—\x20none\x20of\x20them\x20may\x20be\x20a\x20Guard\x20root\x20(the\x20schema\x20rejects\x20non-Bool\x20query\x20roots)\x20and\x20none\x20may\x20be\x20a\x20direct\x20child\x20of\x20logic_and\x20/\x20logic_or.\x20Wrap\x20the\x20variant\x20test\x20in\x20logic_as_u256_equal(query,\x20tag)\x20and\x20read\x20payloads\x20through\x20a\x20comparison\x20as\x20well.','TAG\x20=\x20DECLARATION\x20ORDER\x20in\x20the\x20Move\x20source,\x200-based,\x20and\x20it\x20is\x20ABI:\x20inserting\x20or\x20reordering\x20variants\x20renumbers\x20every\x20later\x20tag.\x20The\x20literal\x20is\x20tied\x20to\x20the\x20deployed\x20package\x20—\x20re-check\x20the\x20enum\x20before\x20hard-coding\x20a\x20tag\x20against\x20a\x20new\x20package\x20version.','PAYLOAD\x20QUERIES\x20ARE\x20STRICT:\x20.identifier\x20/\x20.value\x20/\x20.address\x20/\x20.fixed\x20abort\x20with\x20W_FIELD_TYPE_ERROR\x20when\x20the\x20stored\x20variant\x20is\x20not\x20the\x20one\x20they\x20read\x20—\x20they\x20never\x20return\x200\x20or\x20None.\x20Guards\x20have\x20NO\x20short-circuit\x20(every\x20operand\x20of\x20logic_and\x20/\x20logic_or\x20is\x20evaluated\x20before\x20combining)\x20and\x20any\x20query\x20error\x20aborts\x20the\x20whole\x20verification,\x20so\x20\x27variant==1\x20AND\x20payload(value)>N\x27\x20is\x20NOT\x20safe:\x20it\x20fails\x20hard\x20on\x20every\x20object\x20whose\x20variant\x20is\x200,\x20and\x20logic_or\x20cannot\x20be\x20used\x20as\x20a\x20fallback\x20branch\x20either.\x20Read\x20the\x20payload\x20only\x20when\x20the\x20host\x20already\x20guarantees\x20the\x20variant;\x20otherwise\x20gate\x20on\x20the\x20variant\x20alone\x20and\x20let\x20the\x20contract\x20resolve\x20the\x20payload.','CONFIG\x20TIME\x20IS\x20THE\x20HONEST\x20PLACE\x20for\x20payload-dependent\x20policy:\x20a\x20Reward\x20guard\x27s\x20recipient/amount\x20mode\x20is\x20fixed\x20when\x20the\x20guard\x20is\x20added,\x20and\x20an\x20Arbitration\x20voting_guard\x27s\x20weight\x20mode\x20is\x20fixed\x20at\x20voting_guard_add.\x20When\x20two\x20modes\x20need\x20different\x20policy,\x20configure\x20one\x20guard\x20per\x20mode\x20instead\x20of\x20branching\x20at\x20runtime.','Query\x20ids\x20are\x20per-host-object:\x201071\x20reads\x20a\x20STANDALONE\x20Allocation,\x201491\x20reads\x20the\x20order\x20allocators\x20embedded\x20in\x20a\x20Service\x20—\x20same\x20enum,\x20different\x20object\x20type.\x20Pick\x20by\x20the\x20object\x20the\x20guard\x20actually\x20queries.','OPTIONAL\x20IS\x20NOT\x20READ\x20THROUGH\x20THE\x20VARIANT\x20CHANNEL:\x20Option<T>\x20materialises\x20as\x20a\x20variant\x20internally,\x20but\x20the\x20catalog\x20exposes\x20it\x20as\x20\x27<field>\x20some\x27\x20(Bool)\x20and\x20\x27<field>\x27\x20(payload,\x20aborts\x20when\x20None\x20—\x20e.g.\x201606).\x20Do\x20not\x20attempt\x20a\x20variant\x20query\x20on\x20an\x20Option\x20field.']},{'id':'pattern.named_operator_roster_admission','business_requirement':'Only\x20a\x20dispatched\x20rider\x20ON\x20the\x20order\x27s\x20named-operator\x20roster\x20may\x20advance\x20the\x20handover\x20forward\x20(exclusive\x20admission)','data_source':'SystemContext','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'logic_and[query_order_named_operator_member(object=Order@identifier254),\x20<evidence-presence\x20leg>,\x20logic_equal[query(1563\x20order.service),\x20identifier[N](service_address)]]','key_queries':['order.named_operator\x20member'],'mitigated_risks':['R-LOGISTICS-COURIER'],'applicable_industries':['delivery','retail'],'notes':['Kernel\x20query\x201575\x20returns\x20whether\x20the\x20tx\x20SIGNER\x20is\x20on\x20the\x20ORDER\x27s\x20Progress\x20namedOperator\x20roster\x20—\x20the\x20kernel\x20complement\x20to\x20the\x20namedOperator\x20rail,\x20which\x20only\x20AUTHORIZES\x20roster\x20members\x20and\x20never\x20DENIES\x20non-members\x20(testnet\x20T18b\x20let\x20a\x20non-roster\x20courier\x20pass).','The\x20Order\x20address\x20MUST\x20be\x20read\x20at\x20the\x20task-binding\x20slot\x20(identifier\x20254,\x20b_submission)\x20—\x20the\x20same\x20T10\x20hijack\x20face\x20as\x20the\x20order.*\x20identity\x20legs:\x20a\x20free\x20slot\x20is\x20attacker-fillable\x20with\x20the\x20attacker\x27s\x20own\x20order.','PROTOCOL\x20GATE:\x201575\x20is\x20gated\x20by\x20the\x20v138\x20feature\x20flag\x20(enable_order_named_operator_member)\x20—\x20check\x20upgrade_check\x20(DEPLOY-K1)\x20before\x20publishing\x20on\x20it.','Roster\x20membership\x20is\x20PER-ORDER\x20(written\x20by\x20the\x20dispatch\x20keeper\x20via\x20permission\x20index\x20221\x20at\x20dispatch\x20time)\x20—\x20this\x20admits\x20a\x20rider\x20to\x20ONE\x20order,\x20it\x20is\x20not\x20a\x20global\x20courier\x20allowlist.','Executable\x20form:\x20template\x20tpl_forward_roster_member_gate\x20mounts\x20the\x20roster\x20predicate\x20alongside\x20the\x20evidence-presence\x20and\x20order.service\x20binding\x20legs\x20on\x20the\x20pickup/drop-off\x20forwards.']},{'id':'pattern.dispute_state_settle_freeze','business_requirement':'Settlement\x20and\x20refund\x20rails\x20must\x20not\x20fire\x20while\x20a\x20dispute\x20case\x20is\x20ON\x20FILE\x20and\x20undigested\x20—\x20covering\x20both\x20the\x20live\x20case\x20(voting/objection)\x20and\x20the\x20decided-but-unstamped\x20window\x20that\x20no\x20claimed_by\x20read\x20can\x20see\x20(P155-01\x20+\x20P155-11)','data_source':'SubmittedObject','host':'service_allocator_guard','verifier_level':'none','logic_summary':'conservative\x20settle/refund\x20leg:\x20logic_not[query(1576\x20order.dispute.open)]\x20—\x20blocks\x20while\x20a\x20case\x20is\x20on\x20file\x20with\x20the\x20claim\x20slot\x20unspent\x20(LIVE\x20and\x20resolved-unstamped\x20ALIKE).\x20Keeper\x20advisories:\x20query(1578\x20order.dispute.unstamped)\x20separates\x20\x27dispute\x20in\x20flight\x27\x20from\x20\x27decided,\x20stamp\x20missing\x27;\x20query(1577\x20order.arb.concluded\x20has,\x20arb)\x20reads\x20one\x20case\x27s\x20terminal\x20status\x20atomically','key_queries':['order.dispute.open','order.arb.concluded\x20has','order.dispute.unstamped'],'witness_types':[],'mitigated_risks':[],'applicable_industries':['general','retail','rental','freelance','group_buy'],'notes':['SETTLE-FREEZE\x20IS\x20ONE\x20LEG\x20(P155-01):\x201576\x20mirrors\x20order::has_open_dispute\x20—\x20dispute\x20vector\x20non-empty\x20AND\x20claimed_by\x20none;\x20the\x20claimed_by\x20half\x20is\x20the\x20CHAIN-side\x20query\x27s\x20internal\x20semantics,\x20NOT\x20a\x20guard\x20leg\x20you\x20mount.\x20The\x20settle-freeze\x20leg\x20and\x20the\x20refund-tightening\x20leg\x20are\x20the\x20SAME\x20leg\x20(logic_not[1576]):\x20while\x20the\x20claim\x20slot\x20is\x20unspent,\x20BOTH\x20a\x20live\x20case\x20and\x20a\x20decided-unstamped\x20case\x20must\x20block\x20—\x20releasing\x20the\x20latter\x20IS\x20the\x20F-aj\x20hole.\x20The\x20former\x20advice\x20to\x20ALSO\x20mount\x20an\x20explicit\x20claimed_by\x20none\x20leg\x20(\x27blocks\x20already\x20paid\x20out\x27,\x20F-AOF-1)\x20is\x20RETIRED\x20by\x20decision\x2011\x20(two-rail\x20independence):\x20fund\x20rails\x20are\x20node-gated\x20and\x20never\x20read\x20order.claimed_by\x20—\x20a\x20claimed-axis-sensitive\x20rail\x20is\x20the\x20R-FUND-RAIL-CLAIMED-BY\x20/\x20RAIL_CLAIMED_BY_LEG\x20critical.','claimed_by\x20IS\x20DIRECTION-BLIND\x20AND\x20PULL-STAMPED\x20(P155-11):\x20it\x20records\x20THAT\x20a\x20compensation\x20was\x20claimed,\x20never\x20WHO\x20won,\x20and\x20nothing\x20writes\x20it\x20until\x20a\x20keeper\x20drives\x20the\x20case\x20conclusion\x20/\x20compensation.\x20Under\x20decision\x2011\x20this\x20is\x20no\x20longer\x20a\x20FUND-rail\x20hazard\x20—\x20fund\x20rails\x20never\x20read\x20the\x20stamp,\x20so\x20\x27who\x20won\x27\x20cannot\x20gate\x20a\x20payout\x20either\x20way;\x20the\x20historical\x20csai\x20F-aj\x20P0\x20(losing\x20buyer\x20refunded\x20in\x20full\x20while\x20the\x20stamp\x20sat\x20unpulled)\x20is\x20now\x20framed\x20as\x20the\x20disclosed\x20double-collection\x20outcome,\x20not\x20a\x20rail\x20bug.\x20What\x20the\x20stamp\x20still\x20gates\x20is\x20the\x20FREEZE\x20leg:\x201576\x20stays\x20true\x20while\x20the\x20claim\x20slot\x20is\x20unspent,\x20so\x20the\x20rails\x20stay\x20frozen\x20after\x20a\x20ruling\x20until\x20a\x20keeper\x20drives\x20the\x20conclusion\x20—\x20keeper\x20duty\x20stands;\x20the\x20former\x20R-DIR-03\x20\x27direction\x20blindness\x27\x20advisory\x20is\x20repurposed\x20as\x20recover-payee\x20disclosure\x20(no\x20claimed_by\x20dependency).','PROTOCOL\x20GATE\x20(v139):\x201576/1577/1578\x20are\x20gated\x20by\x20the\x20feature\x20flag\x20`enable_order_dispute_state`\x20—\x20on\x20older\x20protocol\x20versions\x20they\x20resolve\x20to\x20FALSE\x20(indistinguishable\x20from\x20unknown,\x201575\x20discipline).\x20Consequence\x20for\x20the\x20freeze\x20leg:\x20logic_not[false]\x20=\x20true,\x20so\x20on\x20an\x20old\x20binary\x20the\x20conservative\x20leg\x20ADMITS\x20(the\x20freeze\x20silently\x20degrades\x20to\x20open).\x20Check\x20upgrade_check\x20(DEPLOY-K1)\x20before\x20relying\x20on\x20it;\x20mixed\x20fleets\x20evaluate\x20the\x20leg\x20open.','1577\x20IS\x20AN\x20ADVISORY\x20READ,\x20NOT\x20A\x20STATIC\x20GUARD\x20LEG:\x20the\x20arb\x20address\x20is\x20discovered\x20at\x20runtime,\x20guard\x20table\x20data\x20is\x20static\x20—\x20feed\x20a\x20known\x20arb\x20address\x20only\x20in\x20the\x20rare\x20pre-known\x20shape.\x20The\x20honest\x20consumers\x20are\x20MCP\x20keeper\x20tooling\x20(\x27this\x20case\x20has\x20concluded\x20—\x20drive\x20the\x20stamp\x20to\x20release\x20the\x20rails\x27)\x20and\x20post-hoc\x20audits.\x20fail-closed:\x20missing/non-framework/non-Arb\x20targets\x20read\x20false\x20(unproven-concluded\x20=\x20treated\x20as\x20open).','1578\x20DRIVES\x20KEEPER\x20DUTY\x20PRECISION:\x20\x27resolved-awaiting-stamp\x27\x20advisory\x20separates\x20the\x20two\x20block\x20reasons\x20—\x20an\x20in-flight\x20case\x20needs\x20waiting,\x20a\x20resolved\x20case\x20needs\x20ONE\x20conclude\x20tx.\x20Bounded\x20iteration\x20(≤\x20MAX_DISPUTE_COUNT=10);\x20unreadable\x20case\x20entries\x20skip\x20(fail-closed:\x20cannot\x20prove\x20resolved).','TASK-BINDING\x20PER\x20HOST:\x20the\x20Order\x20anchor\x20follows\x20the\x20host\x27s\x20order-slot\x20discipline\x20—\x20forward\x20edges\x20bind\x20at\x20slot\x20254\x20(b_submission),\x20allocator\x20rails\x20at\x20the\x20slot-0\x20order\x20anchor\x20(b_submission=false).\x20A\x20free\x20slot\x20is\x20the\x20T10\x20hijack\x20face.','SHIPPED\x20BY\x20DEFAULT\x20ON\x20THE\x20RAIL\x20TWINS\x20(W5-14\x20/\x20h1w9\x20F-02,\x202026-11-01\x20—\x20supersedes\x20the\x20former\x20decision-7\x20opt-in\x20note):\x20the\x20four\x20canonical\x20rail\x20twins\x20tpl_allocator_node_gate_settle_once\x20/\x20_settle_band_once\x20/\x20_node_gate_refund\x20/\x20_node_gate_recover\x20now\x20ship\x20the\x20freeze\x20leg\x20IN\x20example_root,\x20and\x20catalog\x20fund\x20rails\x20resolved\x20from\x20them\x20inherit\x20it.\x20The\x20decision-7\x20opt-in\x20posture\x20remains\x20for\x20every\x20OTHER\x20rail\x20shape\x20(custom\x20inline\x20roots,\x20renewal/serial-window\x20twins):\x20the\x20capability\x20ships,\x20the\x20merchant\x20chooses\x20there.']},{'id':'pattern.mutual_consent_attestation','business_requirement':'N\x20parties\x20must\x20converge\x20on\x20a\x20deterministic\x20SHARED\x20STATE\x20—\x20a\x20negotiated\x20amount,\x20a\x20settlement\x20split,\x20an\x20order\x20'+'amendment,\x20a\x20delivery\x20acceptance,\x20batch\x20terms,\x20a\x20quorum\x20of\x20sign-offs\x20—\x20where\x20each\x20party\x27s\x20contribution\x20is\x20'+'signer-attributed\x20and\x20the\x20joint\x20state\x20is\x20verifiable\x20on\x20chain\x20at\x20execution\x20time,\x20not\x20only\x20in\x20a\x20Messenger\x20'+'thread\x20either\x20party\x20could\x20later\x20deny','data_source':'SubmittedObject','host':'repository_write','verifier_level':'level3_scene_combined','logic_summary':'General\x20multi-party\x20consent\x20ledger\x20on\x20ONE\x20Repository\x20(scenario-neutral;\x20keys\x20below\x20use\x20the\x20refund\x20instance):\x20'+'(1)\x20PROPOSAL\x20—\x20party\x20A\x20writes\x20key=\x27refund_offer\x27\x20under\x20a\x20policy\x20with\x20id_from=Signer\x20+\x20write_once=true\x20and\x20NO\x20'+'write_guard\x20(each\x20writer\x20owns\x20their\x20own\x20row;\x20the\x20flag\x20makes\x20the\x20proposal\x20immutable).\x20(2)\x20RESPONSE\x20—\x20party\x20B\x20writes\x20'+'key=\x27refund_accept\x27\x20under\x20id_from=Signer\x20with\x20data_from_submission=k:\x20the\x20written\x20bytes\x20are\x20passport\x20submission\x20'+'slot\x20k,\x20and\x20the\x20policy\x27s\x20PolicyGuard\x20table\x20entry\x20reads\x20the\x20PROPOSAL\x20row\x20via\x20query_repository_data\x20(1167);\x20'+'the\x20builder\x20appends\x20the\x20queried\x20bytes\x20and\x20each\x20submitted\x20VecU8\x20condition\x20as\x20operands\x20of\x20ONE\x20multi-operand\x20TypeLogicEqual(90)\x20'+'(N\x20operands\x20=\x20all-equal\x20BCS\x20byte\x20comparison),\x20so\x20the\x20kernel\x20ABORTS\x20the\x20response\x20write\x20unless\x20the\x20submitted\x20bytes\x20equal\x20'+'the\x20proposal\x20row\x20byte-for-byte.\x20(3)\x20EXECUTE\x20—\x20the\x20allocator-or-keeper\x20side\x20gates\x20on\x20response\x20EXISTENCE\x20with\x20'+'query_repository_data_has\x20(1166),\x20or\x20aggregates\x20the\x20row\x20set\x20via\x20count_where/find_where/sum_where\x20when\x20the\x20rail\x20needs\x20'+'quorum\x20or\x20weighted\x20totals.\x20Extra\x20parties\x20are\x20extra\x20signer-keyed\x20rows;\x20a\x20response\x20leg\x20may\x20fold\x20SEVERAL\x20proposal\x20rows\x20'+'into\x20the\x20same\x20multi-operand\x20equality.','key_queries':['repository.data\x20has','repository.data'],'mitigated_risks':[],'applicable_industries':['delivery','group_buy','retail','general'],'notes':['GENERAL\x20SOLUTION\x20FOR\x20MULTI-PARTY\x20NEGOTIATION\x20STATE:\x20this\x20is\x20the\x20kernel-anchored\x20primitive\x20for\x20ANY\x20scenario\x20where\x20parties\x20must\x20fix\x20shared\x20deterministic\x20state\x20—\x20scenario\x20adapters\x20only\x20rename\x20keys\x20and\x20swap\x20which\x20leg\x20enforces\x20what:\x20partial\x20refund\x20(\x27refund_offer\x27/\x27refund_accept\x27),\x20settlement\x20split,\x20order\x20amendment,\x20delivery\x20acceptance,\x20group-buy\x20batch\x20terms,\x20milestone\x20sign-offs,\x20dispute\x20quorum.\x20Quorum\x20=\x20count_where\x20over\x20response\x20rows;\x20weighted\x20totals\x20=\x20sum_where\x20(or\x201179\x20order-bound\x20for\x20escrow-real\x20values);\x20an\x20M-party\x20joint\x20value\x20=\x20one\x20response\x20guard\x20folding\x20M\x20proposal\x20rows\x20into\x20the\x20multi-operand\x20equality.','CHAIN-ENFORCED\x20vs\x20SELF-DISCIPLINED:\x20stage\x20(2)\x20is\x20the\x20only\x20link\x20with\x20ON-CHAIN\x20force\x20—\x20the\x20kernel\x20compares\x20bytes\x20at\x20the\x20write\x20site,\x20so\x20a\x20mismatched\x20\x27acceptance\x27\x20cannot\x20exist.\x20Stage\x20(1)\x20with\x20no\x20write_guard\x20merely\x20attributes\x20rows\x20to\x20their\x20writers\x20(id_from=Signer);\x20\x27an\x20offer\x20exists\x27\x20never\x20proves\x20the\x20offer\x20is\x20fair\x20—\x20pattern.partial_refund_pricing\x20still\x20governs\x20WHO\x20proposes\x20what.\x20A\x20policy\x20written\x20with\x20NO\x20guard\x20at\x20all\x20degrades\x20to\x20\x27each\x20side\x20writes\x20their\x20own\x20row\x27\x20—\x20pure\x20self-discipline.','LEGACY\x20QUERIES,\x20NO\x20PROTOCOL\x20GATE:\x201166/1167\x20predate\x20the\x20v136\x20sentinel\x20protocol\x20—\x20a\x20tombstoned\x20row\x20reads\x20back\x20as\x20false\x20(1166)\x20/\x20an\x20empty\x20blob\x20(1167)\x20instead\x20of\x20aborting,\x20and\x20they\x20carry\x20NO\x20quote_guard\x20impack\x20gate\x20(unlike\x201173-1177),\x20so\x20no\x20passport\x20bundling\x20is\x20required\x20for\x20them.','GUARD\x20VOCABULARY\x20IS\x20EQUALITY\x20+\x20AGGREGATES:\x20the\x20consent\x20check\x20is\x20full-byte\x20BCS\x20equality\x20(TypeLogicEqual\x2090,\x20multi-operand\x20all-equal).\x20Numeric\x20predicates\x20on\x20the\x20accept\x20leg\x20(buyer\x20accepts\x20an\x20amount\x20<=\x20X)\x20are\x20NOT\x20expressible\x20—\x20encode\x20the\x20negotiated\x20amounts\x20as\x20discrete\x20byte\x20values\x20(offers\x20are\x20enumerated\x20in\x20practice)\x20or\x20fall\x20back\x20to\x20arbitration.','PASSPORT-ISSUER\x20TRUST\x20BOUNDARY:\x20the\x20equality\x20is\x20enforced\x20against\x20the\x20passport\x20BUILDER\x27s\x20bytes\x20—\x20a\x20malicious\x20passport\x20issuer\x20could\x20substitute\x20the\x20slot-k\x20submission\x20bytes\x20before\x20signing.\x20The\x20issuer\x20is\x20normally\x20the\x20buyer\x27s\x20own\x20client;\x20delegating\x20issuance\x20to\x20a\x20third\x20party\x20reintroduces\x20trust.\x20State\x20this\x20boundary\x20in\x20build_notes.','EMPTY-BLOB\x20PITFALL:\x201167\x20on\x20a\x20MISSING\x20(id,\x20key)\x20returns\x20an\x20empty\x20blob\x20and\x20an\x20empty\x20blob\x20equals\x20an\x20empty\x20submission\x20—\x20stage\x20(2)\x20must\x20query\x20the\x20OFFER\x20row\x20(which\x20write_once\x20guarantees\x20exists\x20once\x20the\x20flow\x20reached\x20acceptance),\x20never\x20the\x20accept\x20row\x20itself.','EXECUTION-SIDE\x20ACCEPTANCE:\x20use\x20the\x20bare\x20query_repository_data_has\x20(Bool)\x20as\x20the\x20allocator-guard\x20leg\x20—\x20the\x20refund\x20pays\x20ONLY\x20when\x20the\x20acceptance\x20row\x20exists;\x20do\x20not\x20invert\x20it\x20(logic_not\x20asserts\x20ABSENCE,\x20the\x20retracted\x20write-guard\x20idiom),\x20and\x20reach\x20for\x20count_where/find_where\x20only\x20when\x20the\x20rail\x20must\x20aggregate\x20multiple\x20consents.','PAIR\x20WITH\x20pattern.partial_refund_pricing:\x20the\x20WTS-evidenced\x20Messenger\x20quote\x20is\x20the\x20self-disciplined\x20prescription;\x20mounting\x20the\x20quoted\x20amount\x20as\x20the\x20offer\x20row\x20and\x20gating\x20acceptance\x20through\x20the\x20PolicyGuard\x20equality\x20upgrades\x20the\x20SAME\x20flow\x20to\x20the\x20chain-enforced\x20path\x20—\x20pick\x20by\x20dispute\x20size\x20and\x20counterparty\x20trust.']}];export const VERIFIER_LEVEL_GUIDANCE=[{'level':'level1_strict_single','pattern':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','when_to_use':'Role\x20permanently\x20tied\x20to\x20one\x20address\x20AND\x20designer\x20accepts\x20lock-in\x20risk','risk_rules':['R-C4-04'],'recommendation':'avoid'},{'level':'level2_identity_set','pattern':'logic_or\x20of\x20multiple\x20identity\x20checks','when_to_use':'Role-based\x20access\x20—\x20multiple\x20authorized\x20identities','risk_rules':['R-C4-04\x20(suppressed)'],'recommendation':'recommended'},{'level':'level3_scene_combined','pattern':'Scene\x20itself\x20verifies\x20identity\x20—\x20no\x20Signer\x20binding\x20needed','when_to_use':'Scene\x27s\x20host\x20object\x20already\x20verifies\x20operator\x20(e.g.,\x20Machine\x20forward,\x20sharing.who=Entity)','risk_rules':[],'recommendation':'default'},{'level':'none','pattern':'No\x20Signer\x20binding\x20required','when_to_use':'Resource\x20flow\x20matters\x20more\x20than\x20caller\x20identity','risk_rules':[],'recommendation':'default'}];export const GUARD_SCHEMA_NOTES=['logic_not\x20takes\x20exactly\x20ONE\x20child\x20under\x20\x27node\x27\x20(not\x20\x27nodes\x27).','logic_and\x20/\x20logic_or\x20accept\x202-8\x20child\x20nodes\x20(MAX_MULTI_OPERANDS)\x20—\x20nest\x20extra\x20conditions\x20inside\x20another\x20logic_and/logic_or.\x20A\x20SINGLE-condition\x20set\x20must\x20NOT\x20be\x20wrapped:\x20logic_or\x20rejects\x20one\x20child\x20(\x27logic_or\x20requires\x20at\x20least\x202\x20child\x20nodes\x27),\x20so\x20a\x20one-node\x20rail\x20uses\x20the\x20bare\x20comparison\x20node\x20as\x20the\x20leg/root\x20(klook-mn-261019\x20KLM-FIND-02\x20—\x209\x20of\x2010\x20real\x20rails\x20are\x20single-node).','query_reward_record_count\x20/\x20query_reward_record_exists\x20/\x20query_reward_record_find\x20require\x20\x27where\x27\x20even\x20when\x20empty\x20—\x20pass\x20where:\x20{}\x20or\x20input\x20validation\x20rejects\x20the\x20call.\x20Use\x20the\x20structured\x20node\x20types;\x20a\x20RAW\x20query(1629)\x20with\x20an\x20empty\x20VecU8\x20parameter\x20is\x20an\x20uncoded\x20VM\x20error\x20(\x27Query\x20bytes\x20is\x20empty\x27),\x20not\x20an\x20all-None\x20condition\x20vector.','Node\x20type\x20names\x20have\x20no\x20abbreviations:\x20logic_as_u256_greater\x20/\x20logic_as_u256_lesser\x20/\x20logic_as_u256_greater_or_equal\x20/\x20logic_as_u256_lesser_or_equal\x20(never\x20gt/lt/ge/le).','context()\x20enum\x20values\x20are\x20exactly:\x20Signer,\x20Clock,\x20Guard.','repository.data\x20cannot\x20be\x20compared\x20with\x20an\x20Address\x20directly\x20—\x20Repository\x20values\x20are\x20stored\x20as\x20U256;\x20use\x20\x27repository.data\x20has\x27\x20for\x20membership\x20or\x20compare\x20the\x20value\x20as\x20a\x20NUMBER.','Whole-repository\x20\x27repository.data\x20count\x27\x20returns\x20the\x20table\x20size,\x20not\x20per-key\x20matches.\x20For\x20per-key\x20totals\x20the\x20Guard\x20CAN\x20count/sum\x20matches\x20itself\x20via\x20\x27repository.data\x20count\x20where\x27\x20/\x20\x27repository.data\x20sum\x20where\x27\x20(predicate-filtered,\x20candidate\x20list\x20max\x20100);\x20only\x20use\x20the\x20trusted-role-writes-total\x20fallback\x20when\x20candidates\x20cannot\x20be\x20enumerated.\x20WITNESS\x20BOUNDARY\x20(S12-③,\x20v139):\x20the\x20inline\x20WITNESS\x20ceiling\x20is\x204096\x20BCS\x20bytes\x20—\x20a\x20100-address\x20roster\x20now\x20fits\x20inline;\x20roster\x20enumeration\x20still\x20belongs\x20in\x20the\x20guard-table\x20id\x20VECTOR\x20(cap\x20100),\x20keeping\x20the\x20witness\x20to\x20per-call\x20attestation.','ESCROW-BOUND\x20AGGREGATES\x20(protocol\x20136\x20train,\x20live\x20cap\x20v139):\x20\x27repository.data\x20sum\x20where\x20bound\x27\x20(1179,\x20query_repository_data_sum_where_bound)\x20clamps\x20every\x20row\x20to\x20min(row_value,\x20order.amount,\x20LIVE\x20allocation.balance\x20of\x20the\x20Order\x20the\x20row\x20id\x20names)\x20—\x20a\x20row\x20cannot\x20claim\x20more\x20than\x20its\x20Order\x20escrowed,\x20and\x20only\x20funds\x20still\x20in\x20escrow\x20right\x20now\x20count:\x20a\x20refunded\x20or\x20already-disbursed\x20order\x20contributes\x200\x20naturally\x20(a\x20missing\x20allocation\x20link\x20also\x20contributes\x200;\x20an\x20unreadable\x20allocation\x20object\x20aborts\x20the\x20query).\x20Any\x20row\x20keyed\x20by\x20a\x20non-Order\x20(e.g.\x20a\x20wallet-keyed\x20signer\x20row)\x20contributes\x200\x20fail-closed.\x20Use\x20it\x20for\x20forgery-proof\x20threshold/pricing\x20aggregates,\x20but\x20ONLY\x20over\x20order-keyed\x20rows;\x20swapping\x20the\x20query\x20alone\x20onto\x20signer-keyed\x20rows\x20silently\x20zeroes\x20the\x20total.\x20The\x20Formula\x20pricing\x20surface\x20exposes\x20the\x20same\x20clamp\x20as\x20SUM_BOUND\x20selector\x202.','POST-STATE\x20READS\x20(MOV-PROTOCOL-1212):\x20in\x20the\x20HEAD\x20framework\x20source\x20a\x20guard\x20that\x20WRITES\x20a\x20repository\x20data\x20row\x20(or\x20a\x20reward-triggering\x20record)\x20and\x20then\x20queries\x20it\x20in\x20the\x20SAME\x20PTB\x20observes\x20its\x20own\x20write\x20—\x20the\x20query\x20resolves\x20post-state,\x20not\x20stale\x20pre-state\x20—\x20so\x20write-then-verify\x20legs\x20are\x20constructible\x20again;\x20the\x20upsert-overwrite\x20caveat\x20still\x20applies\x20(a\x20repeat\x20write\x20replaces\x20the\x20row,\x20it\x20does\x20not\x20grow\x20a\x20count).\x20DEPLOYMENT-GATED\x20(DEPLOY-K1):\x20not\x20yet\x20confirmed\x20on\x20the\x20deployed\x20binary\x20—\x20check\x20wowok_buildin_info\x20info=\x27upgrade_check\x27\x20(build_stamp.chain_stamp)\x20before\x20building\x20on\x20it.','QUOTE-GUARD\x20CARRY\x20(MOV-PROTOCOL-1212\x20C):\x20every\x20repository\x20data-row\x20read\x20enforces\x20the\x20quote-guard\x20reference\x20gate\x20—\x20the\x20fetch\x20(1167)\x20and\x20the\x20predicate\x20scans\x20count/sum/find\x20(1173/1174/1176)\x20abort\x20when\x20the\x20queried\x20key\x27s\x20quote_guard\x20is\x20not\x20in\x20the\x20passport\x20impack\x20list,\x20and\x20the\x20keys-where\x20scan\x20(1177)\x20aborts\x20when\x20ANY\x20protected\x20key\x20is\x20uncovered.\x20Design\x20pattern\x20roots\x20that\x20scan\x20protected\x20policies\x20must\x20bundle\x20the\x20quote_guard\x20into\x20every\x20passport\x20that\x20verifies\x20them\x20(fail-closed,\x20not\x20a\x20warning).','ADJUDICATED\x20DESIGN\x20—\x20DO\x20NOT\x20RE-REPORT\x20AS\x20A\x20GAP\x20(CTR-B2/B3\x20+\x20KL-C6\x20③,\x20REVIEW-COMPONENT-PLAN):\x20there\x20is\x20NO\x20Review/rating/comment/star\x20struct\x20on\x20chain\x20BY\x20DESIGN.\x20The\x20review\x20component\x20is\x20deliberately\x20zero-chain-change:\x20review\x20TEXT\x20rides\x20a\x20forward\x20message\x20into\x20Progress.history\x20(permanent\x20on-chain),\x20structured\x20reputation\x20rides\x20Repository\x20rows\x20(id_from=Signer,\x20write_guard\x20=\x20the\x20review-edge\x20credential),\x20incentives\x20ride\x20the\x20Reward\x20object\x20attached\x20to\x20the\x20service\x20through\x20the\x20service-side\x20reward\x20attachment\x20channel,\x20and\x20ServiceInfo.acceptance_score\x20is\x20the\x20buyer-to-supplier\x20Demand-side\x20score.\x20Grep-struct-absence\x20is\x20NOT\x20a\x20capability\x20inventory\x20—\x20before\x20reporting\x20\x27review\x20object\x20missing\x27,\x20check\x20the\x20adjudication\x20and\x20the\x20template\x20review_mode\x20field\x20(subscription/creator-membership\x20et\x20al).\x20Remaining\x20review-system\x20items\x20(multi-column\x20policies,\x20post-state\x20write-once)\x20live\x20in\x20the\x20protocol\x20window,\x20not\x20the\x20test-fix\x20loop.','ENUM\x20FIELDS\x20ARE\x20READ,\x20NOT\x20GUESSED:\x20an\x20enum-typed\x20field\x20has\x20a\x20\x27.variant\x27\x20query\x20(U8\x20tag,\x20declaration\x20order,\x200-based)\x20plus\x20one\x20payload\x20query\x20per\x20variant.\x20The\x20payload\x20queries\x20abort\x20with\x20W_FIELD_TYPE_ERROR\x20when\x20the\x20stored\x20variant\x20differs\x20—\x20they\x20never\x20return\x20a\x20default\x20—\x20and\x20a\x20Guard\x20has\x20no\x20short-circuit,\x20so\x20a\x20payload\x20read\x20may\x20only\x20be\x20combined\x20with\x20the\x20variant\x20test\x20when\x20the\x20host\x20GUARANTEES\x20that\x20variant\x20(e.g.\x20the\x20mode\x20was\x20fixed\x20when\x20the\x20guard\x20was\x20added).\x20Variant\x20results\x20are\x20U8,\x20never\x20Bool:\x20wrap\x20them\x20in\x20logic_as_u256_equal.\x20See\x20pattern.enum_variant_branch.','Verify\x20field\x20paths\x20against\x20the\x20live\x20schema\x20via\x20schema_query\x20(action=\x27get\x27,\x20name=\x27call_guard_*\x27)\x20instead\x20of\x20trusting\x20memory.'];export function getGuardDesignPattern(a){return GUARD_DESIGN_PATTERNS['find'](b=>b['id']===a);}export function searchGuardDesignPatterns(a){const b=a['toLowerCase']();return GUARD_DESIGN_PATTERNS['filter'](c=>{if(c['business_requirement']['toLowerCase']()['includes'](b))return!![];if(c['logic_summary']['toLowerCase']()['includes'](b))return!![];if(c['key_queries']['some'](d=>d['toLowerCase']()['includes'](b)))return!![];return![];});}export function getPatternsByHost(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['host']===a);}export function getPatternsByIndustry(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['applicable_industries']?.['includes'](a));}export function getPatternsByDataSourceClass(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['data_source']===a);}export function getVerifierLevelGuidance(a){return VERIFIER_LEVEL_GUIDANCE['find'](b=>b['level']===a);}export function suggestPatternForRequirement(a){const b=searchGuardDesignPatterns(a);if(b['length']===0x0){const e=GUARD_DESIGN_PATTERNS[0x0];return{'best':e,'alternatives':[]};}const [c,...d]=b;return{'best':c,'alternatives':d};}export const GUARD_DESIGN_PATTERNS_VERSION=0x13;