meters state

Denom

Denom is the only asset this realm accepts.

MaxFeeBps

MaxFeeBps is the hard protocol-fee cap: 1000 bps = 10%.

MeterActive

Meter status values.

MeterRetired

Meter status values.

EnrollActive

Enrollment status values. Exited is terminal.

EnrollExited

Enrollment status values. Exited is terminal.

MaxTitleLen

Input bounds.

MaxUnitLen

Input bounds.

MinUnitPrice

Input bounds.

MaxUnitPrice

// 1000 GNOT per unit

MinPeriodBlocks

Input bounds.

MaxPeriodBlocks

Input bounds.

MaxMetersPerProvider

Input bounds.

MaxEnrollmentsPerConsumer

Input bounds.

RenderLimit

Input bounds.

meter

enrollment

admin

// may set fee, fee recipient, stage successor

pendingAdmin

// staged by TransferAdmin, completes via AcceptAdmin

feeRecipient

// may withdraw fees and sweep surplus

feeBps

// fee snapshotted into NEW meters

self

// this realm's address, captured at deploy

nextMeter

nextEnr

metersT

// padID(id) -> \*meter

enrollments

// padID(id) -> \*enrollment

activeByKey

// padID(meterID)|consumer -> int64 enroll id, while Active

providerNum

// address -> \*int64, live meters per provider

consumerNum

// address -> \*int64, Active enrollments per consumer

ledger

init.30

CreateMeter

CreateMeter publishes a meter and returns its id. No coins are accepted; the storage deposit the caller pays is the anti-spam. edges and rates are comma-separated int64 lists building the tiers.Schedule over the ugnot BASE (units × unitPrice): len(rates) == len(edges)+1, each rate in \[0, 10000] ten-thousandths of list price. "" edges with rates "10000" is a flat meter. The current protocol fee is snapshotted in and must not exceed maxFeeBps, the ceiling the provider signed for — pass MaxFeeBps to accept any legal fee. Meters are immutable once created: price, period or schedule changes are a new meter, so nothing a consumer agreed to can move underneath them.

RetireMeter

RetireMeter stops NEW enrollments and NEW usage on the caller's own meter. Existing enrollments keep their funds paths whole: pending usage still settles, deposits stay withdrawable, Exit still refunds. The provider's meter slot frees. Terminal.

Record

Record asserts that the enrollment's consumer used units more units of the meter's service in the CURRENT period. Provider only. Fail-closed on the deposit bound: if charging the period's new total at the enrollment's schedule would exceed the deposited balance, the whole posting is refused — never clipped, because a clipped assertion is a wrong assertion with the same signature as a right one. Any elapsed period settles first, so the bound is always measured against the balance that will actually back this period.

Enroll

Enroll opens an enrollment on a meter for the caller, with any attached coins credited as the initial deposit. One active enrollment per (meter, consumer); Exit frees the slot. Terms (price, schedule, period, fee) are copied in at this moment and never re-read.

Deposit

Deposit adds the attached coins to the caller's own enrollment deposit. Elapsed usage settles first, so a top-up lands on a current balance.

WithdrawDeposit

WithdrawDeposit returns amount of the caller's own enrollment deposit. The current period's pending charge stays covered: withdrawable is balance − Charge(current usage), so a provider's already-recorded usage can never be defunded. Elapsed usage settles first.

Exit

Exit closes the caller's own enrollment: elapsed periods settle, the CURRENT period's recorded usage settles immediately (the provider served it; exiting is not an escape from it), the remaining deposit refunds in full, and the slot frees. Terminal.

Settle

Settle settles any fully-elapsed period of an enrollment. Permissionless by design — like the sibling realms' valves, no settlement's liveness may depend on either party showing up. No coins may ride on it, and calling it on an enrollment with nothing elapsed is a refused no-op so the event stream never carries empty settlements.

Claim

Claim sends amount ugnot of the caller's claimable balance back to the caller. Providers earn into this balance at every settlement.

ClaimAll

ClaimAll sends the caller's entire claimable balance back to the caller. Fails if there is nothing to claim.

WithdrawFees

WithdrawFees sends the accrued fee pot to the fee recipient. Only the fee recipient may call it, and only the pot moves.

SweepDenom

SweepDenom recovers out-of-band coins (sent by raw bank transfer, outside any entrypoint) to the fee recipient. For the ledger denom the reserve is Liabilities() — user balances and the fee pot are structurally unreachable. Fee recipient only.

SetFeeBps

SetFeeBps sets the protocol fee snapshotted into NEW meters. Admin only. No existing meter or enrollment moves.

SetFeeRecipient

SetFeeRecipient points fee withdrawal and sweeps at recipient. Admin only.

TransferAdmin

TransferAdmin stages successor as the next admin; AcceptAdmin completes it. Two-step with consent — a one-step transfer bricked resources in two prior audits (service\_registry Y4, permission\_registry Y4).

AcceptAdmin

AcceptAdmin completes a staged admin transfer. Pending admin only.

PriceOf

PriceOf prices units of meter meterID at its schedule: the charge a period closing at exactly that usage would settle. The quote every consumer can take before enrolling and every provider can show beside an invoice.

PendingChargeOf

PendingChargeOf is the charge the enrollment's current recorded usage would settle at — what WithdrawDeposit holds back.

BalanceOf

BalanceOf is an enrollment's deposited balance as the LEDGER holds it — including a not-yet-settled elapsed period's charge; net view: subtract PendingChargeOf.

ChargeHeadroomOf

ChargeHeadroomOf is how much MORE charge the current period could absorb before Record's deposit bound refuses: balance − pending charge.

MeterInfo

ScheduleOf

ScheduleOf returns a meter's schedule as its edge and rate slices.

EnrollInfo

ActiveEnrollID

ActiveEnrollID resolves the caller-free (meter, consumer) index.

CurrentPeriodOf

CurrentPeriodOf is the period index now open for an enrollment.

Admin

PendingAdmin

FeeRecipient

FeeBps

NumMeters

NumEnrollments

UsersTotal

FeesAccrued

Liabilities

ClaimableOf

Held

Address

Height

currentPeriod

currentPeriod is the index of the period open at the chain head.

chargeFor

chargeFor prices usage units at the enrollment's copied terms.

settleElapsed

settleElapsed settles the usage accumulator if its period has closed, then re-anchors the accumulator on the current period. Exact because usage can only ever belong to one period: periods between usagePeriod and now had no recorded usage and so owe zero.

settleUsage

settleUsage charges the accumulator where it stands and moves the funds: enrollment deposit -> provider claimable, protocol fee split at the enrollment's snapshotted bps. Record's deposit bound is what guarantees the withdrawal cannot fail; if that invariant were ever broken the ledger's own refusal aborts the whole transaction rather than under-settling.

mustGetMeter

mustGetEnrollment

enrollKey

enrollKey is the ledger account an enrollment's deposit lives under. It cannot collide with a provider's claimable account: addresses never start with '#'.

assertNoSend

assertNoSend refuses coins on every non-payable entrypoint. Reads the ORIGIN envelope, so a transaction that attached coins anywhere is refused even if an intermediary consumed them.

counter

counter returns the live-count cell for a, creating it at zero.

decCounter

decCounter decrements a's live count and removes the cell at zero — the index must not accumulate dead keys (service\_registry's lesson).

parseInt64List

parseInt64List parses a comma-separated int64 list, bounding the element count BEFORE materialising values so a thousand-element string dies on count, not memory (r/receivables' bounding argument). "" is the empty list.

trimSpaces

addChecked

addChecked / mulChecked are int64 overflow-checked arithmetic. Written here rather than imported because they are two lines each and the house keeps its payment arithmetic visible at the call site.

mulChecked

padID

itoa

Render

Render shows the catalog at "", a meter at "meter/\<id>", an enrollment at "enroll/\<id>". Every user string is sanitized; every list is bounded by RenderLimit with the bound stated.

renderHome

renderMeter

renderEnrollment

hasPrefix