The three leaf states the registry admits (#157 three-state-leaf-codec). Requests carry an edge, not a value, so these are no longer something a builder chooses: they are the bytes each edge's trie move reads and writes, and walkEdge below is the one place that pairs them with their edge.

The three leaf states the registry admits (#157 three-state-leaf-codec). Requests carry an edge, not a value, so these are no longer something a builder chooses: they are the bytes each edge's trie move reads and writes, and walkEdge below is the one place that pairs them with their edge.

The three leaf states the registry admits (#157 three-state-leaf-codec). Requests carry an edge, not a value, so these are no longer something a builder chooses: they are the bytes each edge's trie move reads and writes, and walkEdge below is the one place that pairs them with their edge.

Walk one request's edge through a speculative trie and return the proof steps the fold states for it (#183).

The edge names the move and its leaf bytes, from the table `types.ak` publishes. The proof is the one the cage verifies at this request's own position in the batch, so it is read BEFORE a replacement and AFTER an insert, exactly as the cage's own walk does.

A tag outside the table names no move: the cage refuses it `edge-inadmissible` before touching the trie, so the builder walks nothing either and states the proof the refusal will be judged against. All five excluded encodings leave the local trie unchanged for refusal fixtures.

One site, so the connected fold and the update builder cannot drift apart about what an edge does to the trie.

What a supported edge owes the mint, as (kind, quantity). Registration mints one active token (kind 1); retirement burns one.

The policy a kind names in this registry's configuration.

The approval binding (#157 approval-asset-binding): the asset name the application policy mints to certify one edge, blake2b_256(edge ‖ key ‖ owner ‖ destination address ‖ destination datum hash). One formula, recomputed by the cage from the request it rides; a builder that computes it differently makes an honest booking refuse loudly at the fold.

A request's destination as approvalName binds it.

The hash an approval binds for the datum a request carries (#419): the BLAKE2b-256 of the datum's serialisation, empty for none — the bytes the request named before it carried the datum, so an approval's name is unchanged for the same tuple.

The consumer pin as a ledger ScriptHash. Loud on bad width (the mint gate enforces 28 bytes on chain; this mirrors it builder-side so a misconfigured pin fails at build, not on ledger).

The withdrawal account for the pinned consumer: the exact script credential from the pin, on the cage's network.

A key-hash withdrawal account (exhibit controls only): lets a row point a withdrawal at an ordinary key, where no script executes and only the cage's own credential check can refuse. Loud on bad width, like the pin helper above.

The bound exhibit consumer, unparameterized (NOTE-021): no operator key, no appointed processor — the consumer authenticates batches from transaction evidence alone. One derivation, used for boot pinning, builder witnesses, and identity checks — never separate computations that could disagree.

Build the bound consumer Script from config bytes (mirror of mkCageScript). Builders attach this as the hook withdrawal witness.

Parse the node's named failed-witness field (The script hash is:ScriptHash HEX) and return the hash — the FIRST occurrence, which names the failing script (later occurrences repeat the same failure's context). Anchored on the opening quote (hash letters also occur in ScriptHash itself, so a hex scan from the marker misfires). Length-checked to 56 hex chars (a 28-byte script hash) so partial garbage never matches. Nothing when the reason carries no named field (non-script failures: extraneous witnesses, unregistered withdrawals, balance errors).

Parse a builder-EVALUATION failure's named script field (pwcScriptHash = ScriptHash HEX, first occurrence) and return the hash. NOTE-018 bind: fork-occupied assertions match THIS field against the derived applied identity — never a hex substring of the full ErrorCall show (transaction data, values and parameterized script bytes can all contain the state policy). Same 56-hex rule.

True when the refusal is budget exhaustion rather than a semantic predicate failure. Kept to the OBSERVED node wording (overspending the budget); unknown budget wordings fail closed elsewhere (no named semantic match), never silently accepted.