v1 state

keyFee

The house fee, expressed the same way the pricing rules are so there is one convention on this project and not two: "1000000" a flat amount in ugnot — 1 GNOT "%3" three percent of the sale "%2.5" two and a half percent; one decimal place is honoured Stored in the vault as a global so it can be changed without redeploying anything, read fresh on every sale so a change takes effect immediately rather than at the next deploy.

defaultFee

// 1 GNOT

maxFeeBps

// 50%

bpsDenom

The house fee, expressed the same way the pricing rules are so there is one convention on this project and not two: "1000000" a flat amount in ugnot — 1 GNOT "%3" three percent of the sale "%2.5" two and a half percent; one decimal place is honoured Stored in the vault as a global so it can be changed without redeploying anything, read fresh on every sale so a change takes effect immediately rather than at the next deploy.

FeeSpec

SetFee

SetFee changes it. Admin only, and validated here rather than trusted, because a malformed spec would otherwise be read on every sale and silently resolve to zero. SetFee CANNOT WORK FROM HERE, and saying so is the fix. nsdata.SetGlobalRecord opens with assertIsTrustedLogic, and this realm is deliberately outside the trusted set — types.gno says so in capitals, and the deploy panel actively revokes anything but nslogic. So every call here passed its own admin check and its own validation and then panicked inside the vault, for everybody, including the correct admin. A dead control that reads as live is worse than no control: it fails at signing time, during the incident that prompted reaching for it. Granting nsmarket vault trust to fix this would surrender the property the whole realm is built around. So the setter moved to nslogic, which already has the grant, and runs the same parseFee validation there.

parseFee

parseFee returns (flat ugnot, basis points, error). Exactly one of the first two is non-zero.

FeeFor

FeeFor is what the house takes on a sale at this price, and what the seller is left with. Exported so the listing screen can show both before anybody signs — a fee somebody discovers afterwards is a fee they were not told about.

assertIsAdmin

List

List puts a name up for sale at a price in ugnot. It does NOT take the name. The seller keeps it, keeps using it, and keeps the right to change their mind — revoking the approval stops the listing from completing without needing this realm's cooperation. (It does not DELETE the listing: this realm is not told. Unlist, or anyone's Prune, clears it. See staleReason.) The approval is required BEFORE listing rather than checked only at sale time, so a listing that could never complete cannot exist. A buyer finding out at the checkout that the seller never approved anything is the worst moment to find out.

Unlist

Unlist withdraws a listing. The seller, or the admin for a name that should not be on sale at all — the same manual lever the takedown process already relies on elsewhere.

Prune

Prune clears a listing that can no longer complete. Anyone may call it. WHY ANYONE. A listing goes stale without this realm hearing about it: the name is transferred elsewhere, lapses, is frozen, or the seller revokes the approval. Buy refuses such a listing — but a refusal is a panic, and a panic reverts everything, including any attempt to delete the listing on the way out. Found on Pearl, 2026-09-10: three refused buys, three listings still stored, each message saying "the listing is gone". A stale listing is not harmless while it sits there. Revoking the approval is how a seller would naturally "cancel"; if that seller later grants the marketplace an operator approval to list something else, the old listing completes again, at the old price. Clearing it is the fix, and nobody should have to wait for the seller to think of it. The caller gains nothing but the storage deposit the listing held, which the chain refunds to whoever frees storage. That is the right incentive: the only thing Prune can do is remove a listing that is already dead — staleReason must name a reason, or it refuses.

Buy

Buy completes a sale in the buyer's own transaction. Order matters here. Everything that can refuse the sale is checked before a single coin moves, and the name moves before the money does, so there is no arrangement of failures that leaves the seller paid and the buyer empty-handed. A panic anywhere reverts all of it.

get

staleReason

staleReason says why a listing can no longer complete, or "" when it can. ONE ANSWER FOR THREE CALLERS. Buy refuses on it, Prune clears on it, and the reads report live=false on it. They used to be three separate lists of checks, and the reads' list had no approval check: a listing whose seller had revoked permission showed as live, with an enabled Buy button, and failed at the checkout. Each of these is a real thing that happens, not a defensive flourish: - changed hands: the seller transferred the name elsewhere - lapsed and re-registered: owner and validity match again, but it is not the asset the listing was written against (Listing.registered) - sold and bought back: same owner, same registration, but a different ownership epoch — an operator grant survives transfers (Listing.epoch) - withdrawn permission: the seller revoked the approval

approvedTo

Whether this realm may move that token on the seller's behalf. Either form of GRC-721 permission counts: approved for the one token, or an operator for everything the seller holds. \`self\` is threaded in from the caller rather than looked up, because a realm can only learn its own address from its own \`cur\`.

splitTokenID

assertNoSend

This realm takes no payment on anything except Buy.

row

GetListing

GetListing returns one row, or "" when nothing is listed.

ListForSale

ListForSale pages through everything on offer, cheapest first within a page. \`after\` is the last token id of the previous page.

ListingsBy

ListingsBy is everything one wallet has up for sale. Walks the whole tree because listings are keyed by token id, not by seller: a second index would be a second thing to keep correct and a second thing the seller pays storage for, to save a walk over a list that is small by construction.

CountListed

CountSold

Quote

Quote is what a buyer pays and what the seller receives, before anybody signs anything. The fee is read live, so this is the same arithmetic Buy will do rather than a copy of it that can drift.

Version

Version lets the site tell which shape it is talking to without guessing from a function signature.

Listing

A listing. Kept small on purpose: the seller pays to store it, and everything derivable is derived rather than copied. The seller's address is here because the name can change hands outside this realm and a stale seller must be caught, not trusted.

listings

sold

// completed sales, for the honest version of a stat

marketAddr

maxPage

minPrice

// zero would be a giveaway, not a sale

maxPrice

// guards the fee arithmetic from overflow

ugnot