<!-- GENERATED by scripts/gen-reference-docs.ts from chainc/resolverkinds.ts — do not edit by hand; edit the source and rerun. -->

# Reference: Every First-Party Resolver Kind

ChainRender ships **66 first-party resolver kinds** — 61 resolve on-chain during the render `eth_call`, 5 reach an off-chain edge and therefore declare `CLIENT_FETCH` (grade ≤ C by Invariant R2). Each kind's details follow the table, in the same order. This page is generated from `chainc/resolverkinds.ts`, the same list `vocabulary().resolverKinds`, the builder and the MCP server's `chainrender_search_kinds` / `chainrender_describe_kind` read, so it cannot drift from them. For how resolvers work and how to write your own, see **[Resolvers](./resolvers.md)** and **[Writing a Resolver](../guides/writing-a-resolver.md)**.

**Encoding args.** A slot's `arg` is the 0x-hex bytes the resolver receives. Encode them exactly as the kind says: `abi.encode(...)` of the listed args by default, or the raw concatenation when the kind is marked *packed* (for example `ensName` takes exactly the 20 address bytes and reverts `bad args` on a 32-byte `abi.encode`). `test/resolverkind-args-drift.ts` encodes the ENS kinds from these descriptors and resolves them against the real contracts.

**Grades.** *Data edge on-chain* means the read is part of the render `eth_call`; the app's grade still depends on everything else it declares (see **[The Trust Grade](../concepts/trust-grade.md)**). A kind whose meaning is delegated to a mutable authority says so in its summary and grades ≤ C through the dependency axis.

## All kinds

| Kind | Data edge | Capability | Args |
|---|---|---|---|
| `uniV3Price` | on-chain | READ_CHAIN | pool, dec0, dec1, invert |
| `uniV4Price` | on-chain | READ_CHAIN | stateView, poolId, dec0, dec1, invert |
| `uniV3Position` | on-chain | READ_CHAIN | positionManager, tokenId, field |
| `aavePosition` | on-chain | READ_CHAIN | pool, user, field |
| `uniQuote` | on-chain | READ_CHAIN | quoter, tokenIn, tokenOut, amountIn, fee, outDecimals, field |
| `approvalState` | on-chain | READ_CHAIN | token, owner, spender, needed, field |
| `curvePool` | on-chain | READ_CHAIN | pool, i, j, dx, outDecimals, field |
| `portfolio` | on-chain | READ_CHAIN | reads, outDecimals, field |
| `cowOrder` | on-chain | READ_CHAIN | composableCow, owner, handler, salt, staticInput, offchainInput, proof, sellDec, buyDec, field |
| `cowTwap` | on-chain | READ_CHAIN | staticInput, sellDec, buyDec, field |
| `cowIntent` | on-chain | READ_CHAIN | fullAppData, expectedAppData, field |
| `vault4626` | on-chain | READ_CHAIN | vault, assetDec, shareDec, field |
| `vault7540` | on-chain | READ_CHAIN | vault, controller, requestId, assetDec, shareDec, field |
| `oracle-feed` | on-chain | READ_CHAIN | feed, fracDigits, maxStaleSeconds |
| `credential` | on-chain | READ_CHAIN | statementId, a, b, c, pub |
| `credential-bound` | on-chain | READ_CHAIN | statementId, a, b, c, pub |
| `ensText` | on-chain | READ_CHAIN | node, key |
| `ensAddr` | on-chain | READ_CHAIN | node *(packed)* |
| `ensName` | on-chain | READ_CHAIN | who *(packed)* |
| `ensV2` | on-chain | READ_CHAIN | resolver, inner, isText |
| `ensApp` | on-chain | READ_CHAIN | node |
| `ensNameChain` | on-chain | READ_CHAIN | who, coinType |
| `identityVerified` | on-chain | READ_CHAIN | subject, schema, uid |
| `identityClaim` | on-chain | READ_CHAIN | uid, schema, subject |
| `por-coverage` | on-chain | READ_CHAIN | reserveFeed, token, fracDigits, maxStaleSeconds |
| `por-reserves` | on-chain | READ_CHAIN | reserveFeed, token, fracDigits, maxStaleSeconds |
| `por-supply` | on-chain | READ_CHAIN | reserveFeed, token, fracDigits, maxStaleSeconds |
| `erc3643-status` | on-chain | READ_CHAIN | token, holder |
| `erc3643-verified` | on-chain | READ_CHAIN | token, holder |
| `erc3643-frozen` | on-chain | READ_CHAIN | token, holder |
| `erc3643-can-transfer` | on-chain | READ_CHAIN | token, from, to, amount |
| `cred-status` | on-chain | READ_CHAIN | registry, credentialId, expectedIssuer |
| `cred-valid` | on-chain | READ_CHAIN | registry, credentialId, expectedIssuer |
| `efp-follows` | on-chain | READ_CHAIN | listRecords, slot, target |
| `efp-state` | on-chain | READ_CHAIN | listRecords, slot, target |
| `efp-tag` | on-chain | READ_CHAIN | listRecords, slot, target, tag |
| `efp-list-size` | on-chain | READ_CHAIN | listRecords, slot |
| `rep-vouch` | on-chain | READ_CHAIN | registry, attester, subject, topic |
| `rep-tally` | on-chain | READ_CHAIN | registry, attesters, subject, topic |
| `rep-aggregate` | on-chain | READ_CHAIN | subject, sources, ctxs |
| `ccip-supported` | on-chain | READ_CHAIN | router, destSelector |
| `ccip-fee` | on-chain | READ_CHAIN | router, destSelector, feeToken, receiver, gasLimit, feeDecimals, fracDigits |
| `sig-1271` | on-chain | READ_CHAIN | account, hash, signature |
| `stealth-meta` | on-chain | READ_CHAIN | registry, registrant, schemeId |
| `shielded-root` | on-chain | READ_CHAIN | pool, callData |
| `shielded-set` | on-chain | READ_CHAIN | pool, callData |
| `shielded-nullifier` | on-chain | READ_CHAIN | pool, callData |
| `msg-712` | off-chain | CLIENT_FETCH | typedData |
| `poster-feed` | off-chain | READ_CHAIN + CLIENT_FETCH | poster, tagTopic |
| `stealth-scan` | off-chain | READ_CHAIN + CLIENT_FETCH | announcer, schemeId |
| `clip-count` | on-chain | READ_CHAIN | registry, depHash |
| `clip-slice` | on-chain | READ_CHAIN | registry, depHash, index |
| `settle-status` | on-chain | READ_CHAIN | agreement, assetDecimals, fracDigits |
| `settle-principal` | on-chain | READ_CHAIN | agreement, assetDecimals, fracDigits |
| `settle-repaid` | on-chain | READ_CHAIN | agreement, assetDecimals, fracDigits |
| `trust-facets` | on-chain | READ_CHAIN | subject |
| `door-knocks` | on-chain | READ_CHAIN | registry, target, assetDecimals, fracDigits |
| `door-feed` | off-chain | READ_CHAIN + CLIENT_FETCH | registry, target |
| `proof-setup` | on-chain | READ_CHAIN | registry, id |
| `artifact-verify` | off-chain | CLIENT_FETCH | expectedSha256, uri |
| `compute-credit` | on-chain | READ_CHAIN | vault, playKey, assetDecimals, fracDigits |
| `xchain-balance` | on-chain | READ_CHAIN | token, holder, maxAgeSeconds, fracDigits |
| `xchain-snapshot-balance` | on-chain | READ_CHAIN | token, holder, maxAgeSeconds, fracDigits |
| `xchain-adopted-balance` | on-chain | READ_CHAIN | claimId, holder, maxAgeSeconds, fracDigits |
| `swap-lock` | on-chain | READ_CHAIN | id, maxAgeSeconds, fracDigits |
| `scope-disclosure` | on-chain | READ_CHAIN | subject |

## Details

### `uniV3Price`

Live Uniswap V3 pool spot price from slot0().sqrtPriceX96 (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x756e695633507269636500000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` | the V3 pool |
| `dec0` | `uint8` |  |
| `dec1` | `uint8` |  |
| `invert` | `bool` |  |

### `uniV4Price`

Live Uniswap V4 pool spot price via StateView.getSlot0(poolId) (READ_CHAIN); additive to V3; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x756e695634507269636500000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `stateView` | `address` | the V4 StateView lens |
| `poolId` | `bytes32` |  |
| `dec0` | `uint8` |  |
| `dec1` | `uint8` |  |
| `invert` | `bool` |  |

### `uniV3Position`

Render a Uniswap V3 LP position (pair, fee, tick range, liquidity, fees owed) via positions(tokenId); fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x756e695633506f736974696f6e00000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `positionManager` | `address` |  |
| `tokenId` | `uint256` |  |
| `field` | `uint8` | 0=summary 1=liquidity 2/3=feesOwed0/1 5/6=tickLower/Upper |

### `aavePosition`

Render an Aave V3 lending position (collateral, debt, borrowing power, health factor) via getUserAccountData(user); fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x61617665506f736974696f6e0000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` |  |
| `user` | `address` |  |
| `field` | `uint8` | 0=summary 1=collateralUsd 2=debtUsd 3=availableUsd 4=healthFactor 5=liqThresholdPct 6=ltvPct |

### `uniQuote`

Render a Uniswap V3 swap quote (expected amountOut) via QuoterV2 before signing; ESTIMATE only (swap must carry min-out); fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x756e6951756f7465000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `quoter` | `address` |  |
| `tokenIn` | `address` |  |
| `tokenOut` | `address` |  |
| `amountIn` | `uint256` |  |
| `fee` | `uint24` |  |
| `outDecimals` | `uint8` |  |
| `field` | `uint8` | 0=formatted amountOut 1=raw 2=gasEstimate |

### `approvalState`

Render whether an owner approved a spender for enough of a token (Approve vs Swap gating) via ERC-20 allowance; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x617070726f76616c537461746500000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` |  |
| `owner` | `address` |  |
| `spender` | `address` |  |
| `needed` | `uint256` |  |
| `field` | `uint8` | 0=word 1=raw allowance 2=bool covered |

### `curvePool`

Render Curve pool state (get_dy quote / balances) broadening AMM coverage beyond Uniswap; get_dy is an ESTIMATE; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6375727665506f6f6c0000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` |  |
| `i` | `int128` |  |
| `j` | `int128` |  |
| `dx` | `uint256` |  |
| `outDecimals` | `uint8` |  |
| `field` | `uint8` | 0=get_dy formatted 1=raw 2=balance(i) 3=coin(i) |

### `portfolio`

Render an aggregated TOTAL summing many on-chain numeric reads (complements multiread which joins); fail-closed per read (partial total).

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x706f7274666f6c696f0000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `reads` | `tuple(address target,bytes callData,uint8 mulScale,uint8 divScale)[]` |  |
| `outDecimals` | `uint8` |  |
| `field` | `uint8` | 0=formatted total 1=raw 2=count succeeded |

### `cowOrder`

Render the LIVE discrete order a CoW Protocol conditional/programmatic order (Composable CoW) would emit THIS block via getTradeableOrderWithSignature (READ_CHAIN); works for every order type (TWAP/StopLoss/GoodAfterTime/PerpetualStableSwap/TradeAboveThreshold); a revert means no valid order this block → fails closed to "not active".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636f774f72646572000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `composableCow` | `address` | the deployed ComposableCoW (caller-supplied; NEVER hardcoded) |
| `owner` | `address` | the order owner (smart-contract wallet / Safe) |
| `handler` | `address` | the conditional-order handler (e.g. the TWAP handler) |
| `salt` | `bytes32` |  |
| `staticInput` | `bytes` | the handler's static params (the order definition) |
| `offchainInput` | `bytes` | optional off-chain input (empty for most) |
| `proof` | `bytes32[]` | merkle proof (empty for a single create()d order) |
| `sellDec` | `uint8` |  |
| `buyDec` | `uint8` |  |
| `field` | `uint8` | 0=status 1=sellAmount 2=buyAmount 3=validTo(unix) 4=partiallyFillable |

> First intent-DeFi resolver (doc 163). getTradeableOrderWithSignature is view but may revert BY DESIGN when no order is valid this block — the fail-closed floor renders that honestly. A live 'ready this block' badge / countdown is a ⚙ client enhancement, not this Grade-A read.

### `cowTwap`

Decode a CoW TWAP order staticInput + block.timestamp into schedule progress — part X/N, next-slice countdown, per-part sell/min-limit, status pending/active/gap/finished (READ_CHAIN, pure); fails closed to "-".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636f775477617000000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `staticInput` | `bytes` | the TWAP.Data abi-encoded blob (order definition; caller-supplied) |
| `sellDec` | `uint8` |  |
| `buyDec` | `uint8` |  |
| `field` | `uint8` | 0=summary 1=partSellAmount 2=minPartLimit 3=currentPart(1-based) 4=totalParts 5=secondsToNext 6=status 7=interval(t) |

> Renders the schedule the staticInput ENCODES, projected against block.timestamp (deterministic, Grade A). It does NOT assert the order is registered/tradeable on ComposableCoW — pair with the cowOrder kind for that live proof.

### `cowIntent`

Verify a presented CoW app-data document matches the order appData it committed to (keccak256(fullAppData), per the CoW app-data SDK) ON CHAIN (READ_CHAIN) — "verified" / "app-data mismatch"; the anti-phishing "verify what you sign" integrity anchor; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636f77496e74656e740000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `fullAppData` | `bytes` | the exact stringified app-data document bytes shown to the user (carries metadata + pre/post CoW Hooks) |
| `expectedAppData` | `bytes32` | the order's on-chain appData (GPv2Order word 6; e.g. via cowOrder) |
| `field` | `uint8` | 0=verdict (verified/app-data mismatch) 1=computed appData hash (0x hex) |

> Integrity ANCHOR only (Grade A keccak): proves the document you are shown is the one the order committed to. The human-readable decode of the hooks {target,callData,gasLimit} into a step plan is a CLIENT layer over these hash-verified bytes (on-chain JSON parsing is impractical) — the msg-712/sig-1271 split. Pair with cowOrder for the full card.

### `vault4626`

Render an ERC-4626 tokenized vault: NAV per share (convertToAssets of 1 share), total assets, share supply, shares-per-asset (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7661756c74343632360000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `vault` | `address` | the ERC-4626 vault (caller-supplied; blesses no vault) |
| `assetDec` | `uint8` |  |
| `shareDec` | `uint8` |  |
| `field` | `uint8` | 0=NAV/share(asset units) 1=totalAssets 2=totalSupply(shares) 3=shares per 1 asset |

> convertToAssets/totalAssets are the vault's OWN valuation — a faithful render of what the vault reports, not a claim it is correct; the trust boundary is the vault's pricing logic. Composes with por-coverage + oracle-feed for a full vault panel.

### `vault7540`

Render an ERC-7540 async vault request queue for a controller: pending/claimable redeem (shares) and pending/claimable deposit (assets) (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7661756c74373534300000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `vault` | `address` |  |
| `controller` | `address` |  |
| `requestId` | `uint256` | 0 for the common single-slot flow |
| `assetDec` | `uint8` |  |
| `shareDec` | `uint8` |  |
| `field` | `uint8` | 0=pending redeem(shares) 1=claimable redeem(shares) 2=pending deposit(assets) 3=claimable deposit(assets) |

> The redemption/deposit queue tokenized-treasury products hide behind a dashboard, read trustlessly. Built for RWA/T-bill funds (async request/settle).

### `oracle-feed`

Read an AggregatorV3-shaped oracle feed as on-chain state (READ_CHAIN); rendered with provenance (feed, round) and freshness (age, STALE past a caller bound); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6f7261636c652d66656564000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `feed` | `address` | the AggregatorV3-shaped feed (caller-supplied; ChainRender blesses no oracle) |
| `fracDigits` | `uint8` | display fractional digits |
| `maxStaleSeconds` | `uint256` | 0 = show age but never assert stale; >0 = flag STALE past this age |

### `credential`

Verify a zero-knowledge proof ON CHAIN (READ_CHAIN) and render only the proven statement, never the witness. Fails closed to "Unverified".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x63726564656e7469616c00000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `statementId` | `bytes32` | indexes the immutable StatementRegistry |
| `a` | `uint256[2]` | Groth16 proof point A |
| `b` | `uint256[2][2]` | Groth16 proof point B (EIP-197 order) |
| `c` | `uint256[2]` | Groth16 proof point C |
| `pub` | `uint256[]` | public inputs; for member-of-set, pub[0] is the set root |

Statements: `member-of-set`

> member-of-set: prove membership of a set (public root) revealing nothing about which member.

### `credential-bound`

Verify a BOUND, single-use credential proof (READ_CHAIN): non-transferable (bound to its holder) and spendable once. Verifying is READ_CHAIN; consuming (spending the nullifier) is a separate WRITE_CHAIN action on the ownerless NullifierRegistry.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Consume step:** WRITE_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x63726564656e7469616c2d626f756e6400000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `statementId` | `bytes32` |  |
| `a` | `uint256[2]` |  |
| `b` | `uint256[2][2]` |  |
| `c` | `uint256[2]` |  |
| `pub` | `uint256[4]` | [nullifierHash, root, externalNullifier, signalHash] |

Statements: `member-bound`

> member-bound: consuming spends the nullifier; a copied proof cannot be replayed (bound to its holder).

### `ensText`

Read an ENS text record (avatar, url, com.twitter, …) for a namehash node, live on-chain.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x656e735465787400000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `node` | `bytes32` | ENS namehash |
| `key` | `string` | text record key |

### `ensAddr`

Resolve an ENS namehash node to its address, live on-chain.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** packed — the raw bytes, concatenated (`abi.encodePacked`)

Kind constant: `0x656e734164647200000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `node` | `bytes32` | ENS namehash; exactly 32 raw bytes (the resolver checks args.length == 32) |

### `ensName`

Verified primary ENS name for an address, live on-chain: reads <addr>.addr.reverse, then forward-resolves the name and requires it to point back to the address; mismatch or no record falls back.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** packed — the raw bytes, concatenated (`abi.encodePacked`)

Kind constant: `0x656e734e616d6500000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `who` | `address` | the account; exactly 20 raw bytes, NOT a 32-byte abi.encode and NOT a namehash (the resolver derives the reverse node itself and checks args.length == 20) |

### `ensV2`

ENSv2 record read live on-chain from the name's resolver (discovered once via the Universal Resolver at seed time): one lean staticcall that fits the render stipend. A CCIP-Read (EIP-3668 OffchainLookup) record renders "off-chain (CCIP)" — the floor detects the boundary but does not cross it; no resolver / empty → "—"; other revert → "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x656e735632000000000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `resolver` | `address` | the name's resolver, discovered off-chain via the ENSv2 Universal Resolver at seed time (not hardcoded) |
| `inner` | `bytes` | the record call to staticcall on it: addr(node) = 0x3b3b57de ‖ node, or text(node,key) = 0x59d1d43c ‖ abi.encode(node,key) |
| `isText` | `bool` | true when inner returns a string (text); false for an address (addr) |

> Following a CCIP-Read record is a client hook (CLIENT_FETCH → ≤ C by R2) and is NOT what this kind does; this kind only reads on-chain and marks the boundary. Resolver discovery is a seed-time step, so a name that later changes resolver keeps rendering from the old one until re-seeded.

### `ensApp`

Read a name app-manifest text key (chainrender.app) and render the app reference it points to (READ_CHAIN); empty -> "-"; ENS as the naming layer for ChainRender apps (dogfood).

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x656e734170700000000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `node` | `bytes32` | ENS namehash; reads text(node, "chainrender.app") |

### `ensNameChain`

ENSIP-19 multichain verified primary name: the name an address resolves to ON A GIVEN CHAIN (per-coinType reverse), forward-verified via addr(node,coinType)==who (READ_CHAIN); reverts to slot fallback on mismatch.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x656e734e616d65436861696e0000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `who` | `address` |  |
| `coinType` | `uint256` | ENSIP-11: 0x80000000 \| chainId (mainnet=60, default-EVM=0x80000000); picks the reverse namespace label |

> Chain-aware identity. Correct + self-verifying, but renders a live name only where an ENSIP-19 reverse registrar for that coinType is deployed/populated (e.g. L1 coinType 60) — resolver-ready elsewhere.

### `identityVerified`

Read whether an EAS attestation is valid for (subject, schema, uid) → "verified" / "unverified". Reveals the claim, not the data (doc 17).

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6964656e74697479566572696669656400000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `subject` | `address` |  |
| `schema` | `bytes32` |  |
| `uid` | `bytes32` |  |

### `identityClaim`

Read the claimed string a subject published under a valid EAS attestation; reverts to slot fallback otherwise.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6964656e74697479436c61696d00000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `uid` | `bytes32` |  |
| `schema` | `bytes32` |  |
| `subject` | `address` |  |

### `por-coverage`

Proof-of-Reserve coverage% = attested reserves ÷ token totalSupply (READ_CHAIN), with provenance (feed, round) + freshness and a backed / under-collateralized badge; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x706f722d636f7665726167650000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `reserveFeed` | `address` | AggregatorV3-shaped PoR feed (caller-supplied; ChainRender blesses no oracle) |
| `token` | `address` | tokenized-asset ERC-20 (totalSupply/decimals) |
| `fracDigits` | `uint8` | display fractional digits |
| `maxStaleSeconds` | `uint256` | 0 = show age but never assert stale; >0 = flag STALE past this age |

> sibling kinds por-reserves / por-supply share the same args and return the reserve and supply figures.

### `por-reserves`

Attested reserves from a Proof-of-Reserve feed, in feed units (READ_CHAIN); STALE-suffixed past the caller bound; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x706f722d72657365727665730000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `reserveFeed` | `address` |  |
| `token` | `address` |  |
| `fracDigits` | `uint8` |  |
| `maxStaleSeconds` | `uint256` |  |

### `por-supply`

Token totalSupply in token units (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x706f722d737570706c7900000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `reserveFeed` | `address` |  |
| `token` | `address` |  |
| `fracDigits` | `uint8` |  |
| `maxStaleSeconds` | `uint256` |  |

### `erc3643-status`

ERC-3643 holder compliance status "<eligibility> / <account>" (verified / not verified, active / frozen) via the token's identity registry + isFrozen (READ_CHAIN). DISPLAY only — a value move re-checks on chain.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x657263333634332d737461747573000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` | ERC-3643 token (caller-supplied) |
| `holder` | `address` |  |

> DISPLAY, not enforcement; identity registry + compliance are agent-mutable → grades ≤ C (DEP_MUTABLE), never A. Sibling kinds erc3643-verified / erc3643-frozen share these args.

### `erc3643-verified`

Whether an address is a verified (KYC'd) ERC-3643 investor via identityRegistry.isVerified (READ_CHAIN). DISPLAY only; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x657263333634332d766572696669656400000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` |  |
| `holder` | `address` |  |

> agent-mutable source → grades ≤ C (DEP_MUTABLE).

### `erc3643-frozen`

Whether an ERC-3643 holder is frozen via isFrozen (READ_CHAIN). DISPLAY only; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x657263333634332d66726f7a656e000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` |  |
| `holder` | `address` |  |

> agent-mutable source → grades ≤ C (DEP_MUTABLE).

### `erc3643-can-transfer`

Whether a transfer from→to of amount would currently pass the token's modular compliance via canTransfer (READ_CHAIN). A PREVIEW computed against caller-claimed addresses — UX, never a security boundary; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x657263333634332d63616e2d7472616e73666572000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` |  |
| `from` | `address` |  |
| `to` | `address` |  |
| `amount` | `uint256` |  |

> DISPLAY / preview, not enforcement; agent-mutable compliance → grades ≤ C (DEP_MUTABLE).

### `cred-status`

Credential lifecycle status VALID / EXPIRED / REVOKED / UNKNOWN (or "issuer mismatch") from a CredentialStatusRegistry (READ_CHAIN), with issuer-key provenance; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x637265642d737461747573000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | a CredentialStatusRegistry (caller-supplied) |
| `credentialId` | `bytes32` |  |
| `expectedIssuer` | `address` | address(0) disables the issuer-key binding check |

> composes with the ZK credential kind: anonymous membership proof + revocable, issuer-bound validity. Sibling kind cred-valid returns valid/invalid.

### `cred-valid`

"valid" iff the credential is VALID and (when expectedIssuer set) issued by that key — a single word for a gate binding (READ_CHAIN); else "invalid"; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x637265642d76616c696400000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` |  |
| `credentialId` | `bytes32` |  |
| `expectedIssuer` | `address` |  |

### `efp-follows`

Whether a caller-named EFP list currently follows a target address, by scanning the list's ops on chain (READ_CHAIN, last op wins, bounded scan); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6566702d666f6c6c6f7773000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `listRecords` | `address` | EFP List Records contract (caller-supplied; ChainRender blesses no deployment) |
| `slot` | `uint256` | the list's storage slot (from its List Storage Location) |
| `target` | `address` | the address whose relationship to the list to read |

> FORWARD read only (Grade A). Follower counts / reverse lookups are off-chain (EFP indexer) → grade ≤ C; not offered on chain. Sibling kind efp-state shares these args.

### `efp-state`

Compact EFP relationship of a list to a target: following / blocked / muted / not following (READ_CHAIN, bounded scan); fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6566702d73746174650000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `listRecords` | `address` |  |
| `slot` | `uint256` |  |
| `target` | `address` |  |

> block/mute are reserved EFP tags; per EFP a tag only counts while the address is also followed.

### `efp-tag`

Whether a caller-named EFP list currently tags a target with a given tag, e.g. "friend" / "phisher" (READ_CHAIN, bounded scan); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6566702d74616700000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `listRecords` | `address` |  |
| `slot` | `uint256` |  |
| `target` | `address` |  |
| `tag` | `string` | the tag to test for; reserved tags block/mute are also recognized |

### `efp-list-size`

The raw number of ops in a caller-named EFP list (READ_CHAIN); a list-size figure, NOT a follower count; fails closed.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x6566702d6c6973742d73697a6500000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `listRecords` | `address` |  |
| `slot` | `uint256` |  |

> this is the list's own op count, not how many accounts follow the list owner (that is an off-chain indexer aggregate).

### `rep-vouch`

A single attester's vouch status for a subject under a topic: vouched / expired / revoked / unknown (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7265702d766f7563680000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | an AddressAttestationRegistry (caller-supplied) |
| `attester` | `address` | the attester key whose vouch to read |
| `subject` | `address` | the address being vouched for / flagged |
| `topic` | `bytes32` | caller-chosen label, e.g. "trusted-builder" / "scammer" |

> delegated signal: an on-chain read, but its truth is only as good as the attester you trust → grades ≤ C (DEP_MUTABLE), never A. Topic is neutral to sign.

### `rep-tally`

A transparent k-of-n tally: how many of a CALLER-SUPPLIED attester set currently hold a valid vouch for a subject under a topic (READ_CHAIN), rendered "k/n"; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7265702d74616c6c790000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` |  |
| `attesters` | `address[]` | the caller's chosen attester set — the tally is over exactly these |
| `subject` | `address` |  |
| `topic` | `bytes32` |  |

> NOT a global reputation score: every input is an attester the consumer chose; change the set, change the answer. A reverting attester read counts as not-valid (fail-closed per input). Grades ≤ C (delegated, DEP_MUTABLE).

### `rep-aggregate`

Transparent k-of-n reputation across CALLER-supplied sources, rendered "k/n (grade X)" where X is the weakest source's grade ceiling (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7265702d61676772656761746500000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `subject` | `address` |  |
| `sources` | `address[]` | IReputationSource adapters (caller-chosen); 1:1 with ctxs |
| `ctxs` | `bytes[]` | per-source abi-encoded context (e.g. EFP list/slot, or registry/attester/topic) |

> NOT a global score. Grade is capped at the weakest input (an A EFP follow can't launder a C vouch). Unreadable sources count as no-signal (fail-closed); all-unreadable → unavailable. New source types plug in via the IReputationSource adapter seam without changing this kind.

### `ccip-supported`

Whether a Chainlink CCIP destination chain selector is currently supported by a caller-supplied Router, via isChainSupported (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636369702d737570706f72746564000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `router` | `address` | the CCIP Router on the local chain (caller-supplied; blesses no deployment) |
| `destSelector` | `uint64` | the CCIP chain selector of the destination chain |

> on-chain fact of the router's current config (Grade A). The router is Chainlink-operated/upgradeable, so it is 'what the router currently reports,' the same honest posture as the oracle-feed price read.

### `ccip-fee`

The CCIP fee QUOTE for a message to a destination selector, via Router.getFee, denominated in the feeToken (READ_CHAIN); a live quote (like a price); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636369702d666565000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `router` | `address` |  |
| `destSelector` | `uint64` |  |
| `feeToken` | `address` | LINK or wrapped-native; address(0) = pay in native msg.value |
| `receiver` | `address` | destination receiver used only to shape the quote |
| `gasLimit` | `uint256` | 0 = router-default extraArgs; >0 = EVMExtraArgsV1 gas limit |
| `feeDecimals` | `uint8` | 0 = 18 (LINK / wrapped-native) |
| `fracDigits` | `uint8` | display fractional digits |

> ESTIMATE/quote — the actual send (ccipSend) is a USER-declared action, decoded + value-gated, that ChainRender never performs. Delivery status is off-chain (CCIP indexer) → grade ≤ C, not a kind here.

### `sig-1271`

Whether a message hash is validly signed by a CONTRACT ACCOUNT under ERC-1271, via isValidSignature (READ_CHAIN); "valid"/"invalid"; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x7369672d31323731000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `account` | `address` | the contract account (Safe / ERC-4337 / …); caller-supplied |
| `hash` | `bytes32` | the message/typed-data digest that was signed |
| `signature` | `bytes` |  |

> Validity ONLY — the human meaning of the message is rendered client-side (msg-712), never asserted here.

### `stealth-meta`

A registrant's ERC-6538 stealth meta-address (private-payments discovery), via stealthMetaAddressOf (READ_CHAIN); "not registered" if none; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x737465616c74682d6d6574610000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | the ERC-6538 registry (caller-supplied; blesses no deployment) |
| `registrant` | `address` |  |
| `schemeId` | `uint256` | 1 = SECP256k1 with view tags (ERC-5564 default) |

> Discovery is the only on-chain (Grade A) part. The ERC-5564 announce SEND is a declared action; scanning announcements is off-chain (≤ C). ChainRender never custodies a key or derives the address server-side.

### `shielded-root`

A shielded/note pool's current Merkle ROOT (bytes32) via caller-supplied view calldata (READ_CHAIN); a public invariant, never a balance; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736869656c6465642d726f6f7400000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` | the shielded pool (Aztec/Tornado-style/native); caller-supplied |
| `callData` | `bytes` | the pool's own view returning bytes32, e.g. getLastRoot()/currentRoot() |

> Render the privacy BOUNDARY honestly (doc 157 §7): only publicly-provable invariants. Decrypted balances are a client-side, viewing-key-gated enhancement (≤ C, local), never a chain read; shield/unshield/transfer leaks are labelled by the client-side privacy-leak decoder.

### `shielded-set`

A shielded pool's commitment / ANONYMITY-SET size (uint256) via caller-supplied view calldata (READ_CHAIN); how private the pool actually is right now; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736869656c6465642d7365740000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` |  |
| `callData` | `bytes` | the pool's own view returning uint256, e.g. nextIndex()/commitmentCount() |

> A small anonymity set is WEAK privacy — the render says so (card grades it), never masks it.

### `shielded-nullifier`

Whether a nullifier is spent in a shielded pool (bool) via caller-supplied view calldata (READ_CHAIN); "spent"/"unspent"; fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736869656c6465642d6e756c6c69666965720000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `pool` | `address` |  |
| `callData` | `bytes` | the pool's own view returning bool, e.g. isSpent(bytes32)/nullifierHashes(bytes32) |

> Double-spend / already-claimed check WITHOUT revealing identity — the on-chain half of the ZK/nullifier primitive we already ship (credential-bound + NullifierRegistry).

### `msg-712`

Render the EIP-712/191 message you are ABOUT TO SIGN, honestly and fail-closed on opaque fields (anti-phishing "render what you sign"). Client-side render → grade ≤ C; the caller MUST show the warnings.

**Data edge:** off-chain · **Capability:** CLIENT_FETCH · **Args encoding:** `abi.encode`

Kind constant: `0x6d73672d37313200000000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `typedData` | `bytes` | the EIP-712 domain+types+message (client input; rendered by chainc/messaging.ts renderTyped712, NOT a chain read) |

> Not a chain read — it renders CLIENT INPUT (the to-be-signed message). Pairs with sig-1271 (the on-chain validity check). Fails closed: any field it cannot fully type is marked OPAQUE and warned; it never says 'safe to sign.'

### `poster-feed`

An ERC-3722 Poster feed (public posts). Content lives only in NewPost EVENT LOGS (no state), so it is read via eth_getLogs — on-chain DATA but not a re-executable view → grade ≤ C, labeled off-chain.

**Data edge:** off-chain · **Capability:** READ_CHAIN + CLIENT_FETCH · **Args encoding:** `abi.encode`

Kind constant: `0x706f737465722d66656564000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `poster` | `address` | the ERC-3722 Poster contract |
| `tagTopic` | `bytes32` | optional keccak(tag) to filter the indexed tag; 0 = all |

> Event-log feed via the client-side posterFeedFilter() adapter — never dressed as Grade A. Declaring a post (post()) is a user action.

### `stealth-scan`

Scan ERC-5564 Announcement logs to find stealth payments to you. Log data via eth_getLogs (not a view) + local recipient derivation → grade ≤ C, labeled off-chain; ownership derivation is client-side.

**Data edge:** off-chain · **Capability:** READ_CHAIN + CLIENT_FETCH · **Args encoding:** `abi.encode`

Kind constant: `0x737465616c74682d7363616e0000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `announcer` | `address` | the ERC-5564 Announcer singleton |
| `schemeId` | `uint256` | 1 = SECP256k1 with view tags |

> The scan is an off-chain log read; deciding which announcements are YOURS uses your viewing key, client-side. ChainRender never holds the key.

### `clip-count`

The number of clips in an on-chain skeletal-animation library (a CRCL pack stored as a Dependency), via ClipLibraryResolver reassembling the pack from a caller-supplied registry (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636c69702d636f756e7400000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | the DependencyRegistry (caller-supplied; reuses the p5/three library mechanism) |
| `depHash` | `bytes32` | the content hash the library is pinned by (compressedHash) |

> Motion is DATA, stored/hash-verified like p5.js/three.js. Additional clip libraries are additive (each a new content-addressed Dependency) — expandable without editing anything.

### `clip-slice`

One clip's bytes (hex) from an on-chain skeletal-animation library, sliced by the pack's own directory, for the client FK player to decode + play as the deterministic floor (READ_CHAIN, Grade A); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636c69702d736c69636500000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` |  |
| `depHash` | `bytes32` |  |
| `index` | `uint16` | clip index within the pack (0-based; see clip-count) |

> The clip bytes are the on-chain FLOOR: chainc/skeletalanim.ts decodes them and plays via forward kinematics (pure math, no GPU, reproducible → Grade A). A GPU-skinned mesh over the same rig/clip is an optional enhancement that fails closed to the SVG puppet floor. Inspired by UniMate's representation, NOT its neural model (doc 158).

### `settle-status`

Settlement status word (funded / disbursed / settled / defaulted) read from a settlement agreement's on-chain state (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736574746c652d73746174757300000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `agreement` | `address` | the settlement agreement (AttestedLoanChannel / LoanChannel / any ISettlementView) |
| `assetDecimals` | `uint8` | decimals of the escrowed asset (18 = native ETH, 6 = USDC …) for amount display |
| `fracDigits` | `uint8` | display fractional digits |

> sibling kinds settle-principal / settle-repaid share the same args. The render honestly splits the trust: escrow + distribution are on-chain (A) while the disburse/repay legs are attested (≤ C) — the load-bearing rule of docs/172 §5.

### `settle-principal`

Pooled principal of a settlement agreement, in asset units (READ_CHAIN); fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736574746c652d7072696e636970616c00000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `agreement` | `address` |  |
| `assetDecimals` | `uint8` |  |
| `fracDigits` | `uint8` |  |

### `settle-repaid`

Total repaid ÷ principal as a percent string (READ_CHAIN); fails closed to "unavailable" (incl. zero principal).

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x736574746c652d72657061696400000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `agreement` | `address` |  |
| `assetDecimals` | `uint8` |  |
| `fracDigits` | `uint8` |  |

### `trust-facets`

Render a contract's self-declared TRUST FACETS (custody · user-only exit · relayer binding · artifact pinning) from its on-chain `trustFacets()` view (READ_CHAIN); a proof-/EIP-712-bound relayer is shown as "cannot alter", a mutable one is flagged. Fails closed to "unavailable". The shared honesty primitive other cards compose.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x74727573742d6661636574730000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `subject` | `address` | a contract implementing ITrustDisclosure.trustFacets() (agreement / pool / relay) |

### `door-knocks`

A door's PUBLIC TRIBUTE aggregate (total burned, knock count, loudest knock) read from a DoorRegistry's on-chain state via a view (READ_CHAIN) → Grade A. The message history is NOT here (see door-feed, ≤C). Fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x646f6f722d6b6e6f636b73000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | the DoorRegistry |
| `target` | `bytes32` | door key — bytes32(uint160(addr)) for an address, or an ENS namehash |
| `assetDecimals` | `uint8` | decimals of the burned token (for amount display) |
| `fracDigits` | `uint8` | display fractional digits |

> The on-chain half of a door. Pairs with door-feed (the ≤C message list). knock() is a user action, not a render.

### `door-feed`

A door's MESSAGE history. Content lives only in `Knock` EVENT LOGS (no state), read via eth_getLogs — on-chain DATA but not a re-executable view → grade ≤ C, labeled off-chain. Weight-sorted client-side by chainc/door.ts rankKnocks().

**Data edge:** off-chain · **Capability:** READ_CHAIN + CLIENT_FETCH · **Args encoding:** `abi.encode`

Kind constant: `0x646f6f722d666565640000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | the DoorRegistry |
| `target` | `bytes32` | optional door key to scope the feed; 0 = every door on this registry |

> Event-log feed via the client-side doorFeedFilter() adapter — never dressed as Grade A. The Grade-A half is door-knocks.

### `proof-setup`

That a client artifact's SHA-256 is PINNED on-chain in a SetupPinRegistry (content-addressed, append-only), with pinner + uri — read via a view → Grade A for the READ. Whether the digest is the real setup rests on the pinner; the teeth are the ≤C artifact-verify. Fails closed to "unavailable"/"not pinned".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x70726f6f662d7365747570000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `registry` | `address` | the SetupPinRegistry |
| `id` | `bytes32` | content-addressed pin id = keccak256(abi.encode(sha256, uri)) |

> Pairs with artifact-verify (≤C): fetch the artifact, SHA-256 it, compare to this pinned digest.

### `artifact-verify`

Verify a FETCHED client artifact against an on-chain-pinned SHA-256: fetch the bytes + hash them client-side and compare → ≤ C, labeled off-chain (CLIENT_FETCH). The teeth behind proof-setup; never says 'trusted', only 'matches the on-chain pin' (or not).

**Data edge:** off-chain · **Capability:** CLIENT_FETCH · **Args encoding:** `abi.encode`

Kind constant: `0x61727469666163742d7665726966790000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `expectedSha256` | `bytes32` | the pinned digest (from proof-setup) |
| `uri` | `string` | where the client fetches the artifact bytes to hash |

> Pure client check (chainc/proof-badge.ts verifyArtifact) over fetched bytes — not a chain read, never Grade A.

### `compute-credit`

A play-key's compute credit (funded / spent / remaining) in a ComputeCreditVault, read via a view → Grade A. The provider draws down only against the play-key's EIP-712-signed usage receipts (cannot overcharge) and the play-key withdraws unspent anytime. The COMPUTE paid for is off-chain (attested, ≤C) — the card says so. Fails closed to "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x636f6d707574652d637265646974000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `vault` | `address` | the ComputeCreditVault |
| `playKey` | `address` | the scoped play-key whose credit to render |
| `assetDecimals` | `uint8` |  |
| `fracDigits` | `uint8` |  |

> RelayerBinding = Eip712Bound (provider bound to signed receipts). Sign receipts with chainc/compute-credit.ts usageReceiptTypedData.

### `xchain-balance`

A home-token balance proven by storage proof (header -> state root -> token account -> balance slot) and cached PER ROOT SOURCE by an immutable XchainBalanceCache; renders the highest-grade fresh entry as "<amount> <SYMBOL> · proven @ block N · <age>s old · Grade <G> (on <host>)". Age is seconds since the proven header timestamp. Grade = min(root source ceiling, the grade the token record was proven at): same-chain root -> A (relative to the host chain), relay root -> C, Arbitrum parent root (arb-retryable) -> A relative to the host, always shown with the host facet (XchainBalanceResolverV2). Fails closed to "unavailable"; with no fresh entry renders "stale (proven @ block N · Grade <G>)" (V2 with a host facet: "stale (proven @ block N · Grade <G> · on <host> · <facet>)"). Malformed args render "unavailable". Symbols are [A-Za-z0-9]{1,11}, decimals <= 77.

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x78636861696e2d62616c616e6365000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` | the home CanonicalToken (registered in the cache by a proven factory record) |
| `holder` | `address` |  |
| `maxAgeSeconds` | `uint64` | older than this renders stale (X2); dated further than this into the future renders unavailable |
| `fracDigits` | `uint8` |  |

Cross-chain root sources and grade ceilings: `same-chain` → A, `relay` → C, `arb-retryable` → A. Off the home chain the value is shown with the host facet (enforced by `XchainBalanceResolverV2`).

Does **not** establish:

- anything beyond the host chain's own consensus (host-chain grade)
- the balance now - only as of the proven block
- anything the cache or its root source does not establish (see those)

> Refresh with chainc/xchain.ts buildBalanceProof -> XchainBalanceCache.refresh (permissionless, monotone per root source). Register a token once with buildRecordProof -> registerToken.

### `xchain-snapshot-balance`

What an already-deployed home token's own balanceOf returned during a transaction (BalanceSnapshotter.snapshot, gas-floored, code hash and decimals committed), proven by storage proof against the SNAPSHOTTER's storage (header -> state root -> snapshotter account, code hash pinned -> commitment slot) and cached PER ROOT SOURCE by an immutable SnapshotBalanceCache; renders "<amount> <SYMBOL> <0x full address> · balanceOf @ block N (in-transaction) · <age>s old · Grade <G> (on <host>[ · <facet>])". Metadata (name/symbol) is proven separately and used only under the same token code hash and no later than the snapshot block, else "unavailable (no metadata)" / "unavailable (code changed)". Grade = min(entry source ceiling, metadata source ceiling, A): same-chain -> A, relay -> C, arb-retryable -> A relative to the host with the host facet (FacetRequired off home). Stale: "stale (<SYMBOL> <0x address> · balanceOf @ block N · Grade <G>[ · on <host> · <facet>])". Display only; malformed args render "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x78636861696e2d736e617073686f742d62616c616e6365000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `token` | `address` | any existing home ERC-20 whose metadata was recorded and proven (registerToken) |
| `holder` | `address` |  |
| `maxAgeSeconds` | `uint64` | older than this renders stale; dated further than this into the future is skipped |
| `fracDigits` | `uint8` |  |

Cross-chain root sources and grade ceilings: `same-chain` → A, `relay` → C, `arb-retryable` → A. Off the home chain the value is shown with the host facet (enforced by `SnapshotBalanceResolver`).

Does **not** establish:

- anything beyond the host chain's own consensus (host-chain grade)
- the balance now - only what balanceOf returned during a transaction in the snapshot block
- that the holder held this balance outside that call - mid-transaction state can be temporary (flash loans)
- anything the cache, the home BalanceSnapshotter or the root source does not establish (see those)

> Snapshot on home with BalanceSnapshotter.snapshot(token, holders) (permissionless) and recordMetadata(token) once; then chainc/xchain-snapshot.ts buildMetadataProof -> SnapshotBalanceCache.registerToken and buildSnapshotProof -> refresh (monotone per root source).

### `xchain-adopted-balance`

A holder's balance of an already-deployed home token under ONE adoption claim (TokenAdoptionRegistry: the claim names a pinning adapter and a layout adapter by address + code hash; structural code checks at adoption; a witness balance confirmed by a same-chain proof of the adoption block), proven by storage proof under the claim's layout and cached PER ROOT SOURCE by an immutable AdoptedBalanceCache keyed by claim id; renders "<amount> <SYMBOL> <0x full address> · proven @ block N · <age>s old · Grade C (adopted · claim <0x8…8> · on <host>[ · <facet>])". Always Grade C: the layout rests on published evidence the chain does not check (a client that verifies the evidence bundle may show B; nothing shows A). Stale: "stale (<SYMBOL> <0x address> · proven @ block N · Grade C · adopted · claim <0x8…8>[ · on <host> · <facet>])". A proxy upgrade makes every later proof revert. Malformed args or an unregistered claim render "unavailable".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x78636861696e2d61646f707465642d62616c616e636500000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `claimId` | `bytes32` | the CONFIRMED adoption claim the app binds (content-addressed; never 'the' record of a token) |
| `holder` | `address` |  |
| `maxAgeSeconds` | `uint64` | older than this renders stale; dated further than this into the future is skipped |
| `fracDigits` | `uint8` |  |

Cross-chain root sources and grade ceilings: `same-chain` → C, `relay` → C, `arb-retryable` → C. Off the home chain the value is shown with the host facet (enforced by `AdoptedBalanceResolver`). Rests on an adoption claim, so every ceiling is C.

Does **not** establish:

- anything beyond the host chain's own consensus (host-chain grade)
- the balance now - only as of the proven block
- that the claimed storage layout is the token's real one (Grade C) - see the claim's evidence
- anything the cache, the home registry or the root source does not establish (see those)

> Adopt on home with TokenAdoptionRegistry.adopt(claim), confirm with chainc/xchain-adopted.ts buildAdoptedStateProof at the adoption block -> confirmWitness; then buildRegistryProof -> AdoptedBalanceCache.register and buildAdoptedStateProof -> refresh (monotone per root source).

### `swap-lock`

A home-chain HashTimelockSwap lock's state (open / claimed / refunded), proven by storage proof (header -> state root -> swap account, code hash pinned -> stateOf[id] slot; the id is content-addressed, so the proof covers every term) and cached by an immutable SwapLockProofCache, which also guards the counterpart lock on its own chain; renders "<home> lock <state> · <amount> · to 0x8…8[ · ends in <h>h <m>m | past deadline] · proven @ block N · <age>s old · Grade <G> (on <host>[ · <facet>])". The amount uses the token's PROVEN symbol and decimals when it is registered in the pinned XchainBalanceCache, else "<n> base units of 0x8…8". Grade = the root source ceiling: same-chain -> A, arb-retryable -> A relative to the host with the host facet (FacetRequired off home). Stale: "stale (proven @ block N · Grade <G>[ · on <host> · <facet>])". Malformed args or an unproven id render "unavailable". The swap itself is <= C (inclusion before each deadline).

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x737761702d6c6f636b0000000000000000000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `id` | `bytes32` | the home lock id: keccak256(abi.encode(homeChainId, homeSwap, terms)) |
| `maxAgeSeconds` | `uint64` | older than this renders stale; dated further than this into the future renders unavailable |
| `fracDigits` | `uint8` |  |

Cross-chain root sources and grade ceilings: `same-chain` → A, `arb-retryable` → A. Off the home chain the value is shown with the host facet (enforced by `SwapLockResolver`).

Does **not** establish:

- anything beyond the host chain's own consensus (host-chain grade)
- the lock's state now - only as of the proven block
- that 'ends in' is exact - it compares the home chain's deadline with this chain's clock
- anything the lock cache or its root source does not establish (see those)

> Lock on home with HashTimelockSwap.lock(terms); after a home root covering the lock block is delivered, chainc/xchain-swap.ts buildLockProof -> SwapLockProofCache.proveLock (permissionless, monotone). The second party locks on the host with guard = the cache and guardData = the home lock id.

### `scope-disclosure`

What a subject's trust grade does NOT establish (doc 175 X7), read from its IScopeDisclosure via a view -> Grade A for the READ (the list is self-declared text). Renders "does not establish: a · b"; fails closed to "scope not disclosed".

**Data edge:** on-chain · **Capability:** READ_CHAIN · **Args encoding:** `abi.encode`

Kind constant: `0x73636f70652d646973636c6f7375726500000000000000000000000000000000`

| Arg | Type | Note |
|---|---|---|
| `subject` | `address` | any contract implementing IScopeDisclosure (ERC-165-checked) |