Realm auction is an ascending (English) auction settled in ugnot, holding real coins. A SELLER lists a lot with a reserve price and a duration; BIDDERS raise each other by attaching coins; the standing high bid is escrowed by the realm and every OUTBID bid becomes a pull-claimable refund; at close the winner's payment is credited to the seller, the protocol fee splitting off at the ledger. A bid landing inside the anti-snipe window extends the end, so the auction closes only when bidding actually stops.
It is the one market shape this portfolio never had: COMPETITIVE PRICE DISCOVERY with escrowed settlement. The routing realms move a known amount to known parties (r/fee_split, r/revshare), the disbursement realms pay a known total out on a schedule (r/vesting, r/payroll, r/budgets), the credit realm lends principal out and takes a larger total back (r/loans), and r/crowdfund POOLS many contributions toward one shared goal. An auction is none of those: N rival bidders, one escrowed winner, automatic refunds for the rest, and a price nobody knows in advance. See [DISCOVERY.md].
Custody — the conservation invariant is the product
A custodial realm, so the monetary invariant governs it exactly as it does r/loans and r/subscriptions, with one extra bucket for the escrowed bids:
Example
1Held == locked + feeledger.Liabilities()
where `locked` is the sum of the CURRENT high bids across all open auctions (coins the realm holds but that are not yet claimable by anyone), and the ledger holds the two claimable kinds — OUTBID refunds and, after close, SELLER proceeds — plus the fee pot. Every value transition preserves the equality; see the DELTA-form conservation test.
Refunds are PULL, never push: an outbid bid is credited to the bidder's claimable balance (fee 0 — a refund is a full return, not a fee event) and the bidder withdraws it with Claim. Nothing is sent to a third party during someone else's Bid, so a bid cannot be griefed by a hostile previous bidder and there is no cross-call reentrancy surface in the bid path.
What the realm settles, and what it does NOT
The realm settles PAYMENT and records the WINNER; it does not custody or deliver the lot, which is identified by a free-text description and changes hands off-chain (or by a downstream realm reading [Winner]). This is the scope decision, stated rather than discovered: an on-chain-asset auction (grc20/grc721 custody) is a v2, and it is exactly the escrow-of-the-asset surface this v1 deliberately omits. A winner pays and is recorded; delivery is the parties' concern, as it is for r/loans' off-chain use of principal.
REALM-CALLER CAVEAT, inherited from the siblings: coinio's receipt guard admits only EOA payers, so every BIDDER is an EOA. The SELLER is whoever calls CreateAuction; a realm may create an auction, but like revshare's members a realm seller must expose its own crossing path to Claim or its proceeds strand — the seller's concern, not a realm or third-party hazard. assertNoSend reads the ORIGIN envelope, so every non-payable function refuses any transaction that attached coins anywhere.
