@wowok/agent-mcp 3.4.4 → 3.4.5

package/dist/schemas/guard_rebind_replacement.schema.json

@@ -0,0 +1 @@
+{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://wowok.net/schemas/guard_rebind_replacement.json","title":"Guard Recreate + Rebind (one shot)","description":"ONE-SHOT guard replacement for the write-once-slot fix loop (VFY-6): create the corrected guard → run the binding semantics gate → run the production dry-run pre-check with the intended submissions → rebind the host ONLY on would_pass. A dry-run failure or a critical binding finding leaves the OLD binding untouched and returns the reason (the created guard stays on chain unbound and inert). On a machine_forward rebind whose re-add fails after the remove, the OLD forward is re-added (rollback) and the state is disclosed.","type":"object","properties":{"guard":{"type":"object","properties":{"name":{"description":"LocalMark name for the NEW guard object. Omit to use the default auto-name (<type>_<last-6-hex>).","type":"string","minLength":1},"description":{"description":"What the CORRECTED guard enforces — this description lands on the new guard object.","type":"string"},"root":{"anyOf":[{"description":"Guard computational tree root node. MUST be an operation that returns a Bool value (pass/fail). For 'query' type, the specific query must return Bool. For 'identifier' type, the referenced table item must have value_type=Bool.","oneOf":[{"type":"object","properties":{"type":{"type":"string","const":"identifier"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["type","identifier"],"additionalProperties":false,"description":"Returns the constant value stored at the specified identifier in the Guard table."},{"type":"object","properties":{"type":{"type":"string","const":"query"},"query":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}],"description":"ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive. STRONGLY PREFER the NAME form: a numeric ID is resolved VERBATIM at runtime, so a wrong-but-existing ID silently checks a DIFFERENT field and only fails at Guard trigger time (abort 7, no leg named) — a wrong name fails loudly at validation here instead (rndb58d8d 04-ROOTCAUSE-A A2). If you only know the field, list the catalog first via schema_query action='get_guard_queries'."},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}],"description":"When specified, the query retrieves data from the associated (witness) object instead of the queried object itself. This enables cross-object queries within Guard validation logic. Can be a numeric ID (100-109) or a string name (case-insensitive, with or without the 'Type' prefix). String format is recommended for readability.\n\nAvailable WitnessTypes:\n- OrderProgress / TypeOrderProgress (100): Query an Order's associated Progress object. Use case: Check if order has reached a specific workflow node (e.g., 'complete') before allowing reward claims.\n- OrderMachine / TypeOrderMachine (101): Query an Order's associated Machine (workflow definition). Use case: Verify the workflow structure or check node configurations.\n- OrderService / TypeOrderService (102): Query an Order's parent Service object. Use case: Validate the service offering details or check service-level configurations.\n- ProgressMachine / TypeProgressMachine (103): Query a Progress's associated Machine. Use case: Access workflow definition from a Progress context.\n- ArbOrder / TypeArbOrder (104): Query an Arb's associated Order. Use case: In arbitration voting guards, verify order details like payment amount or service ID.\n- ArbArbitration / TypeArbArbitration (105): Query an Arb's parent Arbitration service. Use case: Access arbitration configuration or fee settings from within an Arb case.\n- ArbProgress / TypeArbProgress (106): Query an Arb's associated Progress. Use case: Check order workflow state during arbitration validation.\n- ArbMachine / TypeArbMachine (107): Query an Arb's associated Machine. Use case: Access workflow definition for dispute context analysis.\n- ArbService / TypeArbService (108): Query an Arb's associated Service. Use case: Verify service terms or compensation fund status during arbitration.\n- OrderAllocation / TypeOrderAllocation (109): Query an Order's escrow Allocation. Use case: Fund gates — combine with the allocation.balance query (1051) to require balance >= a threshold before a forward advances (e.g., renewal loops).\n\nExample: To validate that an order has reached the 'complete' node, query the Order with convert_witness='OrderProgress' and check the Progress's current_node field."}},"required":["identifier"],"additionalProperties":false,"description":"The object to query from the Guard table."},"parameters":{"description":"Parameters required by the query. Optional — defaults to empty array []. Many queries (e.g. progress.current, order.service) take no parameters; for those, this field can be omitted.","type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","query","object"],"additionalProperties":false,"description":"Returns the result of executing a data query instruction on the specified object. The return type depends on the query being executed. SPECIAL NOTE for EntityLinker/EntityRegistrar queries: Use system addresses in the Guard table -0x0000000000000000000000000000000000000000000000000000000000000aaa for EntityLinker queries, 0x0000000000000000000000000000000000000000000000000000000000000aab for EntityRegistrar queries."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_greater_or_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first >= all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_lesser_or_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first <= all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_greater"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first > all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_lesser"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first < all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first equals all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 nodes of any type. Computed by comparing the first node with all subsequent nodes in both type and value. Returns true if type and value match for all, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_not"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns Bool. Computed by inverting the boolean value of the child node (true -> false, false -> true)."},{"type":"object","properties":{"type":{"type":"string","const":"logic_and"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 boolean nodes. Computed by performing logical AND on all child node values. Returns true if ALL are true, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_or"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 boolean nodes. Computed by performing logical OR on all child node values. Returns true if ANY is true, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-sensitive."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_nocase_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-insensitive."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_nocase_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. Computed by comparing the first node with all subsequent nodes as strings, ignoring case. Returns true if all are equal, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_add"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by adding the first node value with all subsequent node values in sequence (first + second + third + ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_multiply"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by multiplying the first node value with all subsequent node values in sequence (first * second * third * ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_subtract"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by subtracting the second node value from the first node value in sequence, then continuing with each subsequent node (first - second - third - ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_divide"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by dividing the first node value by the second node value in sequence, then continuing with each subsequent node ((first / second) / third / ...). Throws exception if any divisor is zero."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_mod"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by taking the remainder of dividing the first node value by the second node value in sequence, then continuing with each subsequent node ((first % second) % third % ...). Throws exception if any divisor is zero."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_length"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by getting the length (number of UTF-8 bytes) of the child node value."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-insensitive."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. Computed by comparing the first node with all subsequent nodes as strings, ignoring case. Returns true if all are equal, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-sensitive."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_indexof"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from start to end, 'backward' searches from end to start."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node (needle) in the first node (haystack). Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_indexof"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from start to end, 'backward' searches from end to start."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node (needle) in the first node (haystack), ignoring case. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_number_address"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns Address. Computed by converting the child node value from number type to Address type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_address_number"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by converting the child node value from Address type to number type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_number_string"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns String. Computed by converting the child node value from number type to string type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_string_number"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by parsing the child node value as a number. Throws exception if the string is not a valid number."},{"type":"object","properties":{"type":{"type":"string","const":"time_until"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Saturating time delta in milliseconds: computed as max(0, target - now), where the child node is the target timestamp and now is the on-chain clock at evaluation time. Saturating by design: a target already in the past yields 0 (deadline reached) instead of the GUARD_NUMBER_SUB_OVERFLOW underflow abort that calc_number_subtract raises. PREFERRED over calc_number_subtract for deadline checks like 'time until expiry >= review window'."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u8"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U8. Computed by converting the child node value to U8. Throws exception if value is out of U8 range (0-255)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u16"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U16. Computed by converting the child node value to U16. Throws exception if value is out of U16 range (0-65535)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u32"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U32. Computed by converting the child node value to U32. Throws exception if value is out of U32 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u64"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by converting the child node value to U64. Throws exception if value is out of U64 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u128"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U128. Computed by converting the child node value to U128. Throws exception if value is out of U128 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u256"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by converting the child node value to U256."},{"type":"object","properties":{"type":{"type":"string","const":"value_type"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U8. Computed by getting the type identifier (ValueType) of the child node value. Value type: can be specified as a string name (e.g., 'U64', 'Address', 'String') or a number (0-18). Supported types: Bool=0/'Bool', Address=1/'Address', String=2/'String', U8=3/'U8', U16=4/'U16', U32=5/'U32', U64=6/'U64', U128=7/'U128', U256=8/'U256', VecBool=9/'VecBool', VecAddress=10/'VecAddress', VecString=11/'VecString', VecU8=12/'VecU8', VecU16=13/'VecU16', VecU32=14/'VecU32', VecU64=15/'VecU64', VecU128=16/'VecU128', VecU256=17/'VecU256', VecVecU8=18/'VecVecU8'. Note: Value=19 is an INTERNAL type for wowok system use only and should NOT be used directly by users. String format is recommended for better readability."},{"type":"object","properties":{"type":{"type":"string","const":"vec_length"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by getting the length of the vector in the child node value. Child node must be one of Vec types: VecBool=9, VecAddress=10, VecString=11, VecU8=12, VecU16=13, VecU32=14, VecU64=15, VecU128=16, VecU256=17, VecVecU8=18, Value=19."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_bool"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecBool (ValueType=9) or Value (ValueType=19), remaining nodes must be Bool (ValueType=0) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL boolean values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_address"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecAddress (ValueType=10) or Value (ValueType=19), remaining nodes must be Address (ValueType=1) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL address values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_string"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecString (ValueType=11) or Value (ValueType=19), remaining nodes must be String (ValueType=2) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL string values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_string_nocase"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecString (ValueType=11) or Value (ValueType=19), remaining nodes must be String (ValueType=2) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL string values (subsequent nodes), using case-insensitive comparison."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_number"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecU8 (12), VecU16 (13), VecU32 (14), VecU64 (15), VecU128 (16), VecU256 (17) or Value (ValueType=19), remaining nodes must be U8 (3), U16 (4), U32 (5), U64 (6), U128 (7), U256 (8) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL number values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_bool"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecBool (ValueType=9) or Value (ValueType=19) type, nodeRight must be Bool (ValueType=0) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_address"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecAddress (ValueType=10) or Value (ValueType=19) type, nodeRight must be Address (ValueType=1) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_string"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecString (ValueType=11) or Value (ValueType=19) type, nodeRight must be String (ValueType=2) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_string_nocase"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node), using case-insensitive comparison. nodeLeft must be VecString (ValueType=11) or Value (ValueType=19) type, nodeRight must be String (ValueType=2) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_number"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecU8 (12), VecU16 (13), VecU32 (14), VecU64 (15), VecU128 (16), VecU256 (17) or Value (ValueType=19) type, nodeRight must be U8 (3), U16 (4), U32 (5), U64 (6), U128 (7), U256 (8) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"context"},"context":{"type":"string","enum":["Signer","Clock","Guard"],"description":"System context type: Signer returns transaction sender address (Address), Clock returns current on-chain timestamp (U64), Guard returns current Guard object ID (Address)."}},"required":["type","context"],"additionalProperties":false,"description":"Signer returns transaction sender address (Address), Clock returns current on-chain timestamp (U64), Guard returns current Guard object ID (Address)."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching record, 'last' finds the most recent matching record."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record query."}},"required":["type","object","find","where"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last reward record matching the specified recipient and filter conditions. Returns the record index (U64) if found. Throws error if no matching record is found (Guard validation fails). If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record count query."}},"required":["type","object","where"],"additionalProperties":false,"description":"Returns U64. Counts the number of reward records matching the specified recipient and filter conditions. If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_exists"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record existence query."}},"required":["type","object","where"],"additionalProperties":false,"description":"Returns Bool. Returns true if at least one reward record exists matching the specified recipient and filter conditions, otherwise false. If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last history entry matching the filter conditions. Returns the history index (U64) if found. Throws error if no matching entry is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_time"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match — the canonical time anchor is where:{nextNode:'<node>'}, find:'last' for SINGLE-ENTRY states, which returns the IMMUTABLE moment that node was entered (1280 history.time is written once on entry and never rewritten, unlike the 1272 current-time read which refreshes on re-entry). For a RE-ENTERABLE closing-window state (withdrawal/return request nodes the buyer can re-enter) the anchor MUST be find:'first' — find:'last' lets every re-entry re-arm the window (tbs7 O16/O17 live reset exploit). An empty where {} with find:'last' returns the entry time of the CURRENT node — safe for node-SET gates.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history time query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. Returns the TIMESTAMP (ms) of the first or last history entry matching the filter conditions — the immutable entry moment of a node (query 1280 progress.history.time). Preferred over query 1272 progress.current_time for time anchors: 1272 reads the node's CURRENT time and refreshes on re-entry (drift-prone), while 1280 is written once on entering next_node and never rewritten. Throws error if no matching entry is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_time_or_zero"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match — same anchor semantics as query_progress_history_time (where:{nextNode:'<node>'}, find:'last' = the IMMUTABLE moment that node was entered; find:'first' for RE-ENTERABLE states).","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history time query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. S17-D (F-RQD2-04): the NO-MATCH twin of query 1280 progress.history.time — identical conditions, identical wire shape; when NO history entry matches it returns the sentinel 0 (the 'anchor node never entered' state) instead of throwing the runtime error that 1280 throws. Purpose: goal-missed / never-entered rails that 1280's abort turns into stranded funds (rqd2 O2: a 'refund when target not reached' rail anchored on nextNode:'funded' crashes for an order that never reached funded — the exact state the rail exists to protect). Sentinel 0 is unambiguous: a matched entry's time is always a real validator-clock timestamp > 0. Polarity: lesser_or_equal[or_zero, T] PASSES on never-entered; greater_or_equal FAILS. 'refund when never entered OR window elapsed' = logic_or[logic_equal(or_zero, 0), clock >= or_zero + window]. Choose 1280 when a missing anchor MUST fail the guard (delivery-window settlement legs); choose this when a missing anchor is a legitimate business state."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type) to search within. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"where":{"type":"object","properties":{"nextNode":{"description":"Optional filter: next node name string to match.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history session query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching session, 'last' finds the most recent matching session."}},"required":["type","object","historyIdx","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last session within the specified history entry matching the filter conditions. Returns the session index (U64) if found. Throws error if no matching session is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"where":{"type":"object","properties":{"who":{"description":"Optional filter: operator address string to match.","type":"string"},"operation":{"description":"Optional filter: operation name string to match.","type":"string"},"accomplished":{"description":"Optional filter: whether the forward operation was accomplished.","type":"boolean"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for forward operation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for forward operation time. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history session forward query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching forward operation, 'last' finds the most recent matching forward operation."}},"required":["type","object","historyIdx","sessionIdx","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last forward operation within the specified history session matching the filter conditions. Returns the forward index (U64) if found. Throws error if no matching forward operation is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type) to count sessions for. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of sessions within the specified history entry."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of forward operations within the specified history session."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_retained_submission_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"forwardIdx":{"description":"GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx","forwardIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of retained submissions within the specified forward operation."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_retained_submission_value"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"forwardIdx":{"description":"GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"identifier":{"description":"GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx","forwardIdx","identifier"],"additionalProperties":false,"description":"Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_count_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where_bound"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where_bound_all"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each row's data value."}},"required":["type","object","key","where"],"additionalProperties":false,"description":"Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_find_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns VecAddress. Lists the IDs of ALL matching candidates in candidate order. Compose: vec_length + logic_as_u256_greater_than_or_equal (existence/threshold), vec_indexof_address (first/last position), vec_contains_address (membership)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_keys_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the single candidate ID (Address type table entry) to probe across policies."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to the value stored under each policy key for this ID."}},"required":["type","object","id","where"],"additionalProperties":false,"description":"Returns VecString. Reverse lookup: all policy keys whose stored value for the given ID matches the predicate (scans the policy schema and probes each key). Compose: vec_length (how many keys match), vec_indexof_string + logic_as_u256_equal (does a specific key match), vec_contains_string (specific key membership)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_policies_keys"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."}},"required":["type","object"],"additionalProperties":false,"description":"Returns VecString. Lists ALL policy key names of the Repository (max 50). Use vec_length to bound per-key composite queries or vec_contains_string to assert a key exists."},{"type":"object","properties":{"type":{"type":"string","const":"query_order_named_operator_member"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Order object in the Guard table (must be Address type)."}},"required":["type","object"],"additionalProperties":false,"description":"Returns Bool. Whether the transaction signer is on the order's named-operator roster (DM-P1 rider-roster exclusive admission): reads the namedOperator roster of the order's Progress and checks tx-signer membership. Parameterless — the signer comes from the transaction context. Gated by protocol v138 (feature flag enable_order_named_operator_member); on a chain without the flag the guard evaluation aborts. Typical use: AND it into the forward-edge guard on courier handover edges (e.g. PickupOrder/DeliverOrder) so only roster members can advance — the on-chain namedOperator rail alone only AUTHORIZES, it never DENIES (R-19)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_has"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id the data was written under."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row to probe."}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns Bool. Whether the Repository holds a data row for (key, id) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation (e.g. a settlement keeper asserting the buyer acceptance row exists before executing a refund allocator). NOT protocol-gated (legacy query, works on every chain version)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id the data was written under."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row to read."},"conditions":{"description":"Optional equality conditions compared against the read row bytes; when non-empty the node emits ONE on-chain logic_equal over the read plus all conditions and returns Bool instead of VecU8.","type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to a VecU8-type table entry whose value must equal the read row — a b_submission slot (the submitted acceptance value) is the typical leg."}}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns VecU8 (the row bytes [type_byte, ...bcs_payload]) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation. With conditions, returns Bool: the kernel-enforced 'stored value == submitted value' check (b_submission condition entries make the comparison read the passport submission slot) — this turns a self-attested policy write into kernel-verified mutual consent. NOT protocol-gated (legacy query). Absent row: empty blob under the v136 sentinel flag (never equals a non-empty acceptance value — fail-closed), guard abort on older chains."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_author"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id whose author stamp is read."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row whose author is read."}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns Address. The kernel-stamped author of the single (key, id) data row — the v142 Author-P probe ('the person who wrote the row is the one who gets paid'): compare against context(Signer) or a pinned address with logic_equal. FAIL-CLOSED ZERO SENTINEL: an unstamped or missing row reads 0x0, so any author==signer comparison is false (a real signer is never 0x0) — absence means 'nobody authored this row', never a crash. Gated by protocol v142 (feature flag enable_repository_row_author); on a chain without the flag the guard evaluation aborts."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_owner_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"owner":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the owner filter (Address type table entry): the ZERO address selects the distinct-all headcount mode, any other address selects the per-owner row-count mode (a b_submission slot lets one guard template serve every prospective buyer)."},"key":{"type":"string","minLength":1,"description":"Policy key string whose per-key data roster is counted."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each roster row's data value BEFORE owner extraction (e.g. a NumericGt(0) predicate excludes withdrawn zeroed rows)."}},"required":["type","object","owner","key","where"],"additionalProperties":false,"description":"Returns U64. Distinct row-owner counting over the per-key RowRosterKey roster (query 1183, UNEXPRESSIBLE U-25, flag enable_repository_owner_count, protocol v142 — the query ABORTS while the flag is off). Candidate set is DERIVED on-chain from the roster (query 1181 discipline — the caller cannot omit rows). The owner filter splits the two modes: owner = 0x0 counts DISTINCT kernel-stamped authors among the predicate-matching rows (the campaign headcount — one pledger with N pledges counts once); owner = an address counts the predicate-matching rows authored by that owner (the per-buyer accumulated purchase count). Honesty: a missing roster reads 0 (fail-closed); a roster over REPOSITORY_QUERY_MAX_CANDIDATES aborts; an unstamped row (pre-v142 write) is invisible — pre-142 rows carry no provenance. Compare with logic_as_u256_* nodes."}],"$ref":"#/definitions/__schema0"},{"type":"object","properties":{"type":{"type":"string","const":"file"},"file_path":{"type":"string","description":"ABSOLUTE path to JSON or Markdown file containing Guard definition. Field name is `file_path` (NOT `file`). File can define: namedNew, description, table, root, rely."},"format":{"default":"json","description":"File format: 'json' or 'markdown'. Default is 'json'.","type":"string","enum":["json","markdown"]}},"required":["type","file_path","format"],"additionalProperties":false}],"description":"Root logic of the NEW guard (the corrected definition)."},"table":{"description":"Table rows of the NEW guard — this is where the corrected 254/address literal goes.","type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"b_submission":{"type":"boolean","description":"Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."},"value_type":{"description":"Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.","anyOf":[{"type":"number","const":0,"description":"Bool (0)"},{"type":"number","const":1,"description":"Address (1)"},{"type":"number","const":2,"description":"String (2)"},{"type":"number","const":3,"description":"U8 (3)"},{"type":"number","const":4,"description":"U16 (4)"},{"type":"number","const":5,"description":"U32 (5)"},{"type":"number","const":6,"description":"U64 (6)"},{"type":"number","const":7,"description":"U128 (7)"},{"type":"number","const":8,"description":"U256 (8)"},{"type":"number","const":9,"description":"VecBool (9)"},{"type":"number","const":10,"description":"VecAddress (10)"},{"type":"number","const":11,"description":"VecString (11)"},{"type":"number","const":12,"description":"VecU8 (12)"},{"type":"number","const":13,"description":"VecU16 (13)"},{"type":"number","const":14,"description":"VecU32 (14)"},{"type":"number","const":15,"description":"VecU64 (15)"},{"type":"number","const":16,"description":"VecU128 (16)"},{"type":"number","const":17,"description":"VecU256 (17)"},{"type":"number","const":18,"description":"VecVecU8 (18)"},{"type":"string","const":"Bool","description":"Bool"},{"type":"string","const":"Address","description":"Address"},{"type":"string","const":"String","description":"String"},{"type":"string","const":"U8","description":"U8"},{"type":"string","const":"U16","description":"U16"},{"type":"string","const":"U32","description":"U32"},{"type":"string","const":"U64","description":"U64"},{"type":"string","const":"U128","description":"U128"},{"type":"string","const":"U256","description":"U256"},{"type":"string","const":"VecBool","description":"VecBool"},{"type":"string","const":"VecAddress","description":"VecAddress"},{"type":"string","const":"VecString","description":"VecString"},{"type":"string","const":"VecU8","description":"VecU8"},{"type":"string","const":"VecU16","description":"VecU16"},{"type":"string","const":"VecU32","description":"VecU32"},{"type":"string","const":"VecU64","description":"VecU64"},{"type":"string","const":"VecU128","description":"VecU128"},{"type":"string","const":"VecU256","description":"VecU256"},{"type":"string","const":"VecVecU8","description":"VecVecU8"},{"type":"string","const":"bool","description":"bool"},{"type":"string","const":"address","description":"address"},{"type":"string","const":"string","description":"string"},{"type":"string","const":"u8","description":"u8"},{"type":"string","const":"u16","description":"u16"},{"type":"string","const":"u32","description":"u32"},{"type":"string","const":"u64","description":"u64"},{"type":"string","const":"u128","description":"u128"},{"type":"string","const":"u256","description":"u256"},{"type":"string","const":"vecbool","description":"vecbool"},{"type":"string","const":"vecaddress","description":"vecaddress"},{"type":"string","const":"vecstring","description":"vecstring"},{"type":"string","const":"vecu8","description":"vecu8"},{"type":"string","const":"vecu16","description":"vecu16"},{"type":"string","const":"vecu32","description":"vecu32"},{"type":"string","const":"vecu64","description":"vecu64"},{"type":"string","const":"vecu128","description":"vecu128"},{"type":"string","const":"vecu256","description":"vecu256"},{"type":"string","const":"vecvecu8","description":"vecvecu8"}]},"value":{"description":"The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).","anyOf":[{"type":"boolean"},{"anyOf":[{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."},{"type":"string"}]},{"type":"string"},{"type":"number"},{"type":"array","items":{"type":"boolean"}},{"anyOf":[{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"},{"type":"array","items":{"type":"string"}}]},{"type":"array","items":{"type":"string"}},{"type":"array","items":{"type":"number"}},{"type":"array","items":{"type":"array","items":{"type":"number"}}}]},"name":{"default":"","description":"Data name identifier. MAX 64 BCS characters (Chinese chars count as 3-4 BCS bytes each). Use short identifiers like 'order_id', 'delivery_node'. Put longer descriptions in the Guard's 'description' field, NOT here.","type":"string"}},"required":["identifier","b_submission","value_type","name"],"additionalProperties":false,"description":"Guard table item (INPUT/CREATION form). DO NOT include `object_type` field — it is query-output only and will be rejected here."}},"rely":{"description":"Dependent guards for the NEW guard (same semantics as guard creation).","type":"object","properties":{"guards":{"type":"array","items":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"description":"List of dependent Guard object IDs or names."},"logic_or":{"description":"Whether to use logical OR operator.","type":"boolean"}},"required":["guards"],"additionalProperties":false}},"required":["root"],"additionalProperties":false,"description":"The REPLACEMENT guard definition. Guards are immutable on-chain: this tool creates a FRESH guard object from this definition — it never edits the old one."},"rebind":{"oneOf":[{"type":"object","properties":{"host":{"type":"string","const":"service_buy_guard","description":"Replace a Service's buy_guard slot (the live-service face — the old guard is unbound and the new one bound in one service update)."},"service":{"type":"string","description":"The Service whose buy_guard slot is replaced."}},"required":["host","service"],"additionalProperties":false},{"type":"object","properties":{"host":{"type":"string","const":"machine_forward","description":"Rebind the guard on one Machine forward (the pre-publish build face — published machines freeze their graph, so this host only exists on an UNPUBLISHED machine)."},"machine":{"type":"string","description":"The UNPUBLISHED Machine whose forward carries the guard being replaced."},"prior_node_name":{"type":"string","description":"Name of the pair's previous node (the edge source — the EMPTY string names the genesis entry edge)."},"node_name":{"type":"string","minLength":1,"description":"Name of the node the edge enters."},"forward_name":{"type":"string","minLength":1,"description":"Name of the forward being re-guarded."},"forward":{"description":"Optional forward overrides for the re-added forward. Omitted fields are carried over from the CURRENT on-chain forward definition; the guard field is always set to the NEW guard.","type":"object","properties":{"weight":{"description":"Forward weight override (omitted = carried over from the CURRENT on-chain forward).","type":"integer","minimum":0,"maximum":9007199254740991},"namedOperator":{"description":"Forward named-operator override (omitted = carried over from the CURRENT on-chain forward).","type":"string"},"permissionIndex":{"description":"Forward permission-index override (omitted = carried over from the CURRENT on-chain forward).","type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"additionalProperties":false}},"required":["host","machine","prior_node_name","node_name","forward_name"],"additionalProperties":false}],"description":"Where the new guard is bound. The rebind runs ONLY after the replacement guard passes both the binding semantics gate and the production dry-run pre-check — a failed dry-run leaves the old binding untouched."},"submission":{"description":"Submission entries for the dry-run pre-check of the NEW guard (same semantics as verify_guard_dry_run.submission).","type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Guard table identifier this entry fills."},"value":{"anyOf":[{"type":"boolean"},{"anyOf":[{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."},{"type":"string"}]},{"type":"string"},{"type":"number"},{"type":"array","items":{"type":"boolean"}},{"anyOf":[{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"},{"type":"array","items":{"type":"string"}}]},{"type":"array","items":{"type":"string"}},{"type":"array","items":{"type":"number"}},{"type":"array","items":{"type":"array","items":{"type":"number"}}}],"description":"The value the caller INTENDS to submit for this slot (typed against the guard's own table row)."}},"required":["identifier","value"],"additionalProperties":false}},"task":{"description":"Task/order context for the dry-run pre-check (protocol slot 254 pre-check, same as verify_guard_dry_run.task).","type":"string"},"account":{"description":"Executing account for the creation and the rebind; also the dry-run context account. Omit to use the default account.","type":"string"},"network":{"description":"Network: 'localnet' | 'mainnet' | 'testnet'. Omit to use the current default network.","type":"string","enum":["localnet","testnet","mainnet"]}},"required":["guard","rebind"],"additionalProperties":false,"definitions":{"__schema0":{"description":"Guard node: represents an operation instruction in Guard. Each node returns a value of a specific type, computed from its child nodes or context.","allOf":[{"$ref":"#/definitions/__schema1"}]},"__schema1":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","const":"identifier"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["type","identifier"],"additionalProperties":false,"description":"Returns the constant value stored at the specified identifier in the Guard table."},{"type":"object","properties":{"type":{"type":"string","const":"query"},"query":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}],"description":"ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive. STRONGLY PREFER the NAME form: a numeric ID is resolved VERBATIM at runtime, so a wrong-but-existing ID silently checks a DIFFERENT field and only fails at Guard trigger time (abort 7, no leg named) — a wrong name fails loudly at validation here instead (rndb58d8d 04-ROOTCAUSE-A A2). If you only know the field, list the catalog first via schema_query action='get_guard_queries'."},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}],"description":"When specified, the query retrieves data from the associated (witness) object instead of the queried object itself. This enables cross-object queries within Guard validation logic. Can be a numeric ID (100-109) or a string name (case-insensitive, with or without the 'Type' prefix). String format is recommended for readability.\n\nAvailable WitnessTypes:\n- OrderProgress / TypeOrderProgress (100): Query an Order's associated Progress object. Use case: Check if order has reached a specific workflow node (e.g., 'complete') before allowing reward claims.\n- OrderMachine / TypeOrderMachine (101): Query an Order's associated Machine (workflow definition). Use case: Verify the workflow structure or check node configurations.\n- OrderService / TypeOrderService (102): Query an Order's parent Service object. Use case: Validate the service offering details or check service-level configurations.\n- ProgressMachine / TypeProgressMachine (103): Query a Progress's associated Machine. Use case: Access workflow definition from a Progress context.\n- ArbOrder / TypeArbOrder (104): Query an Arb's associated Order. Use case: In arbitration voting guards, verify order details like payment amount or service ID.\n- ArbArbitration / TypeArbArbitration (105): Query an Arb's parent Arbitration service. Use case: Access arbitration configuration or fee settings from within an Arb case.\n- ArbProgress / TypeArbProgress (106): Query an Arb's associated Progress. Use case: Check order workflow state during arbitration validation.\n- ArbMachine / TypeArbMachine (107): Query an Arb's associated Machine. Use case: Access workflow definition for dispute context analysis.\n- ArbService / TypeArbService (108): Query an Arb's associated Service. Use case: Verify service terms or compensation fund status during arbitration.\n- OrderAllocation / TypeOrderAllocation (109): Query an Order's escrow Allocation. Use case: Fund gates — combine with the allocation.balance query (1051) to require balance >= a threshold before a forward advances (e.g., renewal loops).\n\nExample: To validate that an order has reached the 'complete' node, query the Order with convert_witness='OrderProgress' and check the Progress's current_node field."}},"required":["identifier"],"additionalProperties":false,"description":"The object to query from the Guard table."},"parameters":{"description":"Parameters required by the query. Optional — defaults to empty array []. Many queries (e.g. progress.current, order.service) take no parameters; for those, this field can be omitted.","type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","query","object"],"additionalProperties":false,"description":"Returns the result of executing a data query instruction on the specified object. The return type depends on the query being executed. SPECIAL NOTE for EntityLinker/EntityRegistrar queries: Use system addresses in the Guard table -0x0000000000000000000000000000000000000000000000000000000000000aaa for EntityLinker queries, 0x0000000000000000000000000000000000000000000000000000000000000aab for EntityRegistrar queries."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_greater_or_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first >= all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_lesser_or_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first <= all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_greater"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first > all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_lesser"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first < all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_as_u256_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by comparing the first node value with all subsequent node values. Returns true if first equals all others, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 nodes of any type. Computed by comparing the first node with all subsequent nodes in both type and value. Returns true if type and value match for all, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_not"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns Bool. Computed by inverting the boolean value of the child node (true -> false, false -> true)."},{"type":"object","properties":{"type":{"type":"string","const":"logic_and"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 boolean nodes. Computed by performing logical AND on all child node values. Returns true if ALL are true, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_or"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 boolean nodes. Computed by performing logical OR on all child node values. Returns true if ANY is true, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-sensitive."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_nocase_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-insensitive."},{"type":"object","properties":{"type":{"type":"string","const":"logic_string_nocase_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. Computed by comparing the first node with all subsequent nodes as strings, ignoring case. Returns true if all are equal, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_add"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by adding the first node value with all subsequent node values in sequence (first + second + third + ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_multiply"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by multiplying the first node value with all subsequent node values in sequence (first * second * third * ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_subtract"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by subtracting the second node value from the first node value in sequence, then continuing with each subsequent node (first - second - third - ...)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_divide"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by dividing the first node value by the second node value in sequence, then continuing with each subsequent node ((first / second) / third / ...). Throws exception if any divisor is zero."},{"type":"object","properties":{"type":{"type":"string","const":"calc_number_mod"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns U256. Requires 2-8 numeric nodes (U8, U16, U32, U64, U128, U256). Computed by taking the remainder of dividing the first node value by the second node value in sequence, then continuing with each subsequent node ((first % second) % third % ...). Throws exception if any divisor is zero."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_length"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by getting the length (number of UTF-8 bytes) of the child node value."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-insensitive."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_equal"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. Computed by comparing the first node with all subsequent nodes as strings, ignoring case. Returns true if all are equal, otherwise false."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_contains"},"nodes":{"type":"array","items":{"$ref":"#/definitions/__schema0"}}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Requires 2-8 string nodes. The first node is the haystack, all subsequent nodes are needles. Returns true if all needles are substrings of the haystack, otherwise false. Case-sensitive."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_indexof"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from start to end, 'backward' searches from end to start."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node (needle) in the first node (haystack). Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"calc_string_nocase_indexof"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from start to end, 'backward' searches from end to start."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node (needle) in the first node (haystack), ignoring case. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_number_address"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns Address. Computed by converting the child node value from number type to Address type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_address_number"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by converting the child node value from Address type to number type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_number_string"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns String. Computed by converting the child node value from number type to string type."},{"type":"object","properties":{"type":{"type":"string","const":"convert_string_number"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by parsing the child node value as a number. Throws exception if the string is not a valid number."},{"type":"object","properties":{"type":{"type":"string","const":"time_until"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Saturating time delta in milliseconds: computed as max(0, target - now), where the child node is the target timestamp and now is the on-chain clock at evaluation time. Saturating by design: a target already in the past yields 0 (deadline reached) instead of the GUARD_NUMBER_SUB_OVERFLOW underflow abort that calc_number_subtract raises. PREFERRED over calc_number_subtract for deadline checks like 'time until expiry >= review window'."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u8"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U8. Computed by converting the child node value to U8. Throws exception if value is out of U8 range (0-255)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u16"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U16. Computed by converting the child node value to U16. Throws exception if value is out of U16 range (0-65535)."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u32"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U32. Computed by converting the child node value to U32. Throws exception if value is out of U32 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u64"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by converting the child node value to U64. Throws exception if value is out of U64 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u128"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U128. Computed by converting the child node value to U128. Throws exception if value is out of U128 range."},{"type":"object","properties":{"type":{"type":"string","const":"convert_safe_u256"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U256. Computed by converting the child node value to U256."},{"type":"object","properties":{"type":{"type":"string","const":"value_type"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U8. Computed by getting the type identifier (ValueType) of the child node value. Value type: can be specified as a string name (e.g., 'U64', 'Address', 'String') or a number (0-18). Supported types: Bool=0/'Bool', Address=1/'Address', String=2/'String', U8=3/'U8', U16=4/'U16', U32=5/'U32', U64=6/'U64', U128=7/'U128', U256=8/'U256', VecBool=9/'VecBool', VecAddress=10/'VecAddress', VecString=11/'VecString', VecU8=12/'VecU8', VecU16=13/'VecU16', VecU32=14/'VecU32', VecU64=15/'VecU64', VecU128=16/'VecU128', VecU256=17/'VecU256', VecVecU8=18/'VecVecU8'. Note: Value=19 is an INTERNAL type for wowok system use only and should NOT be used directly by users. String format is recommended for better readability."},{"type":"object","properties":{"type":{"type":"string","const":"vec_length"},"node":{"$ref":"#/definitions/__schema0"}},"required":["type","node"],"additionalProperties":false,"description":"Returns U64. Computed by getting the length of the vector in the child node value. Child node must be one of Vec types: VecBool=9, VecAddress=10, VecString=11, VecU8=12, VecU16=13, VecU32=14, VecU64=15, VecU128=16, VecU256=17, VecVecU8=18, Value=19."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_bool"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecBool (ValueType=9) or Value (ValueType=19), remaining nodes must be Bool (ValueType=0) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL boolean values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_address"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecAddress (ValueType=10) or Value (ValueType=19), remaining nodes must be Address (ValueType=1) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL address values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_string"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecString (ValueType=11) or Value (ValueType=19), remaining nodes must be String (ValueType=2) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL string values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_string_nocase"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecString (ValueType=11) or Value (ValueType=19), remaining nodes must be String (ValueType=2) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL string values (subsequent nodes), using case-insensitive comparison."},{"type":"object","properties":{"type":{"type":"string","const":"vec_contains_number"},"nodes":{"minItems":2,"maxItems":8,"type":"array","items":{"$ref":"#/definitions/__schema0"},"description":"First node must be VecU8 (12), VecU16 (13), VecU32 (14), VecU64 (15), VecU128 (16), VecU256 (17) or Value (ValueType=19), remaining nodes must be U8 (3), U16 (4), U32 (5), U64 (6), U128 (7), U256 (8) or Value (ValueType=19)."}},"required":["type","nodes"],"additionalProperties":false,"description":"Returns Bool. Computed by checking if the vector (first node) contains ALL number values (subsequent nodes)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_bool"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecBool (ValueType=9) or Value (ValueType=19) type, nodeRight must be Bool (ValueType=0) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_address"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecAddress (ValueType=10) or Value (ValueType=19) type, nodeRight must be Address (ValueType=1) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_string"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecString (ValueType=11) or Value (ValueType=19) type, nodeRight must be String (ValueType=2) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_string_nocase"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node), using case-insensitive comparison. nodeLeft must be VecString (ValueType=11) or Value (ValueType=19) type, nodeRight must be String (ValueType=2) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"vec_indexof_number"},"nodeLeft":{"$ref":"#/definitions/__schema0"},"nodeRight":{"$ref":"#/definitions/__schema0"},"order":{"type":"string","enum":["forward","backward"],"description":"'forward' searches from index 0, 'backward' searches from last index."}},"required":["type","nodeLeft","nodeRight","order"],"additionalProperties":false,"description":"Returns U64. Computed by searching for the second node value in the vector (first node). nodeLeft must be VecU8 (12), VecU16 (13), VecU32 (14), VecU64 (15), VecU128 (16), VecU256 (17) or Value (ValueType=19) type, nodeRight must be U8 (3), U16 (4), U32 (5), U64 (6), U128 (7), U256 (8) or Value (ValueType=19) type. Returns index of first occurrence in the specified direction. If not found, returns u64::MAX (18446744073709551615)."},{"type":"object","properties":{"type":{"type":"string","const":"context"},"context":{"type":"string","enum":["Signer","Clock","Guard"],"description":"System context type: Signer returns transaction sender address (Address), Clock returns current on-chain timestamp (U64), Guard returns current Guard object ID (Address)."}},"required":["type","context"],"additionalProperties":false,"description":"Signer returns transaction sender address (Address), Clock returns current on-chain timestamp (U64), Guard returns current Guard object ID (Address)."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching record, 'last' finds the most recent matching record."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record query."}},"required":["type","object","find","where"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last reward record matching the specified recipient and filter conditions. Returns the record index (U64) if found. Throws error if no matching record is found (Guard validation fails). If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record count query."}},"required":["type","object","where"],"additionalProperties":false,"description":"Returns U64. Counts the number of reward records matching the specified recipient and filter conditions. If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_reward_record_exists"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Reward object in the Guard table (must be Address type)."},"recipient":{"description":"Optional: Identifier reference to the recipient address in the Guard table (must be Address type). If not specified, uses the transaction signer address.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false},"where":{"type":"object","properties":{"guard":{"description":"Optional filter: Guard object address constant to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for record creation time. Use string to represent U64 value.","type":"string"},"amountMin":{"description":"Optional filter: minimum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"amountMax":{"description":"Optional filter: maximum reward amount (inclusive). Use string to represent U64 value.","type":"string"},"storeFromId":{"description":"Optional filter: identifier reference to the store_from_id address in the Guard table (must be Address type). If not specified, the store_from_id field is ignored during matching. The server resolves this identifier to the actual address from the Guard table constants.","type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false}},"additionalProperties":false,"description":"Filter conditions for the reward record existence query."}},"required":["type","object","where"],"additionalProperties":false,"description":"Returns Bool. Returns true if at least one reward record exists matching the specified recipient and filter conditions, otherwise false. If recipient is not specified, uses the transaction signer address."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last history entry matching the filter conditions. Returns the history index (U64) if found. Throws error if no matching entry is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_time"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match — the canonical time anchor is where:{nextNode:'<node>'}, find:'last' for SINGLE-ENTRY states, which returns the IMMUTABLE moment that node was entered (1280 history.time is written once on entry and never rewritten, unlike the 1272 current-time read which refreshes on re-entry). For a RE-ENTERABLE closing-window state (withdrawal/return request nodes the buyer can re-enter) the anchor MUST be find:'first' — find:'last' lets every re-entry re-arm the window (tbs7 O16/O17 live reset exploit). An empty where {} with find:'last' returns the entry time of the CURRENT node — safe for node-SET gates.","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history time query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. Returns the TIMESTAMP (ms) of the first or last history entry matching the filter conditions — the immutable entry moment of a node (query 1280 progress.history.time). Preferred over query 1272 progress.current_time for time anchors: 1272 reads the node's CURRENT time and refreshes on re-entry (drift-prone), while 1280 is written once on entering next_node and never rewritten. Throws error if no matching entry is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_time_or_zero"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"convert_witness":{"description":"Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.","anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"string"}]}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."},"where":{"type":"object","properties":{"node":{"description":"Optional filter: node name string to match.","type":"string"},"nextNode":{"description":"Optional filter: next node name string to match — same anchor semantics as query_progress_history_time (where:{nextNode:'<node>'}, find:'last' = the IMMUTABLE moment that node was entered; find:'first' for RE-ENTERABLE states).","type":"string"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.","type":"string"},"indexMin":{"description":"Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"},"indexMax":{"description":"Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history time query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."}},"required":["type","object","where","find"],"additionalProperties":false,"description":"Returns U64. S17-D (F-RQD2-04): the NO-MATCH twin of query 1280 progress.history.time — identical conditions, identical wire shape; when NO history entry matches it returns the sentinel 0 (the 'anchor node never entered' state) instead of throwing the runtime error that 1280 throws. Purpose: goal-missed / never-entered rails that 1280's abort turns into stranded funds (rqd2 O2: a 'refund when target not reached' rail anchored on nextNode:'funded' crashes for an order that never reached funded — the exact state the rail exists to protect). Sentinel 0 is unambiguous: a matched entry's time is always a real validator-clock timestamp > 0. Polarity: lesser_or_equal[or_zero, T] PASSES on never-entered; greater_or_equal FAILS. 'refund when never entered OR window elapsed' = logic_or[logic_equal(or_zero, 0), clock >= or_zero + window]. Choose 1280 when a missing anchor MUST fail the guard (delivery-window settlement legs); choose this when a missing anchor is a legitimate business state."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type) to search within. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"where":{"type":"object","properties":{"nextNode":{"description":"Optional filter: next node name string to match.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history session query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching session, 'last' finds the most recent matching session."}},"required":["type","object","historyIdx","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last session within the specified history entry matching the filter conditions. Returns the session index (U64) if found. Throws error if no matching session is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_find"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"where":{"type":"object","properties":{"who":{"description":"Optional filter: operator address string to match.","type":"string"},"operation":{"description":"Optional filter: operation name string to match.","type":"string"},"accomplished":{"description":"Optional filter: whether the forward operation was accomplished.","type":"boolean"},"timeMin":{"description":"Optional filter: minimum timestamp (inclusive) for forward operation time. Use string to represent U64 value.","type":"string"},"timeMax":{"description":"Optional filter: maximum timestamp (inclusive) for forward operation time. Use string to represent U64 value.","type":"string"}},"additionalProperties":false,"description":"Filter conditions for the progress history session forward query."},"find":{"type":"string","enum":["first","last"],"description":"'first' finds the earliest matching forward operation, 'last' finds the most recent matching forward operation."}},"required":["type","object","historyIdx","sessionIdx","where","find"],"additionalProperties":false,"description":"Returns U64. Finds the index of the first or last forward operation within the specified history session matching the filter conditions. Returns the forward index (U64) if found. Throws error if no matching forward operation is found (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type) to count sessions for. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of sessions within the specified history entry."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of forward operations within the specified history session."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_retained_submission_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"forwardIdx":{"description":"GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx","forwardIdx"],"additionalProperties":false,"description":"Returns U64. Counts the number of retained submissions within the specified forward operation."},{"type":"object","properties":{"type":{"type":"string","const":"query_progress_history_session_forward_retained_submission_value"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Progress object in the Guard table (must be Address type)."},"historyIdx":{"description":"GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"sessionIdx":{"description":"GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"forwardIdx":{"description":"GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"},"identifier":{"description":"GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.","allOf":[{"$ref":"#/definitions/__schema1"}],"$ref":"#/definitions/__schema0"}},"required":["type","object","historyIdx","sessionIdx","forwardIdx","identifier"],"additionalProperties":false,"description":"Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_count_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U64. Counts candidates whose stored value matches the predicate. Numeric predicates: U256 semantics (pass plain number strings). Range is closed interval per side (minInclusive/maxInclusive default true); a missing side is unbounded. numEq/gt/gte/lt/lte are sugar over range. Entries whose value type does not match the predicate kind are skipped (never error), so the count only reflects matching entries."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U256. Sums the numeric payloads of candidates whose stored value matches the predicate (on-chain checked add, overflow aborts). Non-numeric or mismatching entries contribute 0. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where_bound"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Each id should be an ORDER address (e.g. order-keyed contribution rows). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns U256. ESCROW-BOUND sum (query 1179, live cap v140): per-row min(row_value, order.amount, LIVE allocation.balance of the Order the row id names) — only funds still in escrow right now count, so a refunded or already-disbursed order contributes 0 naturally; a row whose Order has no allocation link also contributes 0, while an unreadable allocation object aborts the query (corruption is never a silent 0). A row keyed by anything that is not an Order contributes 0 (fail-closed). Unlike query_repository_data_sum_where (self-reported row values), a record cannot claim more than the escrow actually bound to it — the forgery-proof aggregate for threshold gates and Formula pricing. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_sum_where_bound_all"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each row's data value."}},"required":["type","object","key","where"],"additionalProperties":false,"description":"Returns U256. ALL-MODE escrow-bound sum (query 1181, flag enable_repository_data_sum_bound_all, protocol v141 — the query ABORTS while the flag is off): the 1179 per-row clamp min(row_value, order.amount, LIVE allocation.balance) over a DERIVED candidate set — the per-key RowRosterKey dynamic-field roster the framework maintains on every data write — instead of a caller-supplied ids list, so the aggregate no longer depends on the caller submitting an honest, complete candidate list (the ks13/HKS-04 ROSTER-01 face). No ids parameter. The roster is bounded by REPOSITORY_QUERY_MAX_CANDIDATES: a key with more rows aborts the query (fail-closed, never a silent truncation). Pre-flag rows (written before the roster was maintained, or under a disabled flag on an older binary) are NOT in the roster and contribute 0 — rebuild or re-touch rows after enabling. Use logic_as_u256_* to compare the sum."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_find_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"key":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the policy key (String type table entry) whose data table is scanned."},"ids":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the candidate ID list (VecAddress type table entry). Duplicates are deduped; max 100 candidates."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each candidate's data value."}},"required":["type","object","key","ids","where"],"additionalProperties":false,"description":"Returns VecAddress. Lists the IDs of ALL matching candidates in candidate order. Compose: vec_length + logic_as_u256_greater_than_or_equal (existence/threshold), vec_indexof_address (first/last position), vec_contains_address (membership)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_keys_where"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the single candidate ID (Address type table entry) to probe across policies."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to the value stored under each policy key for this ID."}},"required":["type","object","id","where"],"additionalProperties":false,"description":"Returns VecString. Reverse lookup: all policy keys whose stored value for the given ID matches the predicate (scans the policy schema and probes each key). Compose: vec_length (how many keys match), vec_indexof_string + logic_as_u256_equal (does a specific key match), vec_contains_string (specific key membership)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_policies_keys"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."}},"required":["type","object"],"additionalProperties":false,"description":"Returns VecString. Lists ALL policy key names of the Repository (max 50). Use vec_length to bound per-key composite queries or vec_contains_string to assert a key exists."},{"type":"object","properties":{"type":{"type":"string","const":"query_order_named_operator_member"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Order object in the Guard table (must be Address type)."}},"required":["type","object"],"additionalProperties":false,"description":"Returns Bool. Whether the transaction signer is on the order's named-operator roster (DM-P1 rider-roster exclusive admission): reads the namedOperator roster of the order's Progress and checks tx-signer membership. Parameterless — the signer comes from the transaction context. Gated by protocol v138 (feature flag enable_order_named_operator_member); on a chain without the flag the guard evaluation aborts. Typical use: AND it into the forward-edge guard on courier handover edges (e.g. PickupOrder/DeliverOrder) so only roster members can advance — the on-chain namedOperator rail alone only AUTHORIZES, it never DENIES (R-19)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_has"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id the data was written under."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row to probe."}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns Bool. Whether the Repository holds a data row for (key, id) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation (e.g. a settlement keeper asserting the buyer acceptance row exists before executing a refund allocator). NOT protocol-gated (legacy query, works on every chain version)."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id the data was written under."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row to read."},"conditions":{"description":"Optional equality conditions compared against the read row bytes; when non-empty the node emits ONE on-chain logic_equal over the read plus all conditions and returns Bool instead of VecU8.","type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to a VecU8-type table entry whose value must equal the read row — a b_submission slot (the submitted acceptance value) is the typical leg."}}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns VecU8 (the row bytes [type_byte, ...bcs_payload]) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation. With conditions, returns Bool: the kernel-enforced 'stored value == submitted value' check (b_submission condition entries make the comparison read the passport submission slot) — this turns a self-attested policy write into kernel-verified mutual consent. NOT protocol-gated (legacy query). Absent row: empty blob under the v136 sentinel flag (never equals a non-empty acceptance value — fail-closed), guard abort on older chains."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_author"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"id":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the row's principal address (Address type table entry) — the row id whose author stamp is read."},"key":{"type":"string","minLength":1,"description":"Row name — the policy key string of the data row whose author is read."}},"required":["type","object","id","key"],"additionalProperties":false,"description":"Returns Address. The kernel-stamped author of the single (key, id) data row — the v142 Author-P probe ('the person who wrote the row is the one who gets paid'): compare against context(Signer) or a pinned address with logic_equal. FAIL-CLOSED ZERO SENTINEL: an unstamped or missing row reads 0x0, so any author==signer comparison is false (a real signer is never 0x0) — absence means 'nobody authored this row', never a crash. Gated by protocol v142 (feature flag enable_repository_row_author); on a chain without the flag the guard evaluation aborts."},{"type":"object","properties":{"type":{"type":"string","const":"query_repository_data_owner_count"},"object":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the Repository object in the Guard table (must be Address type)."},"owner":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."}},"required":["identifier"],"additionalProperties":false,"description":"Reference to the owner filter (Address type table entry): the ZERO address selects the distinct-all headcount mode, any other address selects the per-owner row-count mode (a b_submission slot lets one guard template serve every prospective buyer)."},"key":{"type":"string","minLength":1,"description":"Policy key string whose per-key data roster is counted."},"where":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","const":"range"},"valueMin":{"description":"Optional lower bound (inclusive unless minInclusive=false). Plain number string (U256 semantics).","type":"string"},"valueMax":{"description":"Optional upper bound (inclusive unless maxInclusive=false). Plain number string (U256 semantics).","type":"string"},"minInclusive":{"description":"Default true. false makes the lower bound exclusive.","type":"boolean"},"maxInclusive":{"description":"Default true. false makes the upper bound exclusive.","type":"boolean"}},"required":["kind"],"additionalProperties":false,"description":"Numeric closed/open range. min=max inclusive is an equality match. At least one bound required."},{"type":"object","properties":{"kind":{"type":"string","const":"numEq"},"value":{"type":"string","description":"Exact numeric match. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gt"},"value":{"type":"string","description":"Greater than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"gte"},"value":{"type":"string","description":"Greater than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lt"},"value":{"type":"string","description":"Less than. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"lte"},"value":{"type":"string","description":"Less than or equal. Plain number string (U256 semantics)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"addressEq"},"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier of the Address-type table entry to compare against."}},"required":["kind","identifier"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringEq"},"value":{"type":"string","description":"Exact string match (byte equality, UTF-8)."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringContains"},"value":{"type":"string","description":"Substring match, case-sensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"stringNoCaseContains"},"value":{"type":"string","description":"Substring match, case-insensitive."}},"required":["kind","value"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","const":"boolEq"},"value":{"type":"boolean","description":"Boolean equality."}},"required":["kind","value"],"additionalProperties":false}],"description":"Predicate filter applied to each roster row's data value BEFORE owner extraction (e.g. a NumericGt(0) predicate excludes withdrawn zeroed rows)."}},"required":["type","object","owner","key","where"],"additionalProperties":false,"description":"Returns U64. Distinct row-owner counting over the per-key RowRosterKey roster (query 1183, UNEXPRESSIBLE U-25, flag enable_repository_owner_count, protocol v142 — the query ABORTS while the flag is off). Candidate set is DERIVED on-chain from the roster (query 1181 discipline — the caller cannot omit rows). The owner filter splits the two modes: owner = 0x0 counts DISTINCT kernel-stamped authors among the predicate-matching rows (the campaign headcount — one pledger with N pledges counts once); owner = an address counts the predicate-matching rows authored by that owner (the per-buyer accumulated purchase count). Honesty: a missing roster reads 0 (fail-closed); a roster over REPOSITORY_QUERY_MAX_CANDIDATES aborts; an unstamped row (pre-v142 write) is invisible — pre-142 rows carry no provenance. Compare with logic_as_u256_* nodes."}]}}}