memba_feed_v1 state

MaxBodyLen

// post body (roadmap 4.1)

MaxMediaCIDs

// stored per post; pin/serve pipeline is P2

MaxCIDLen

// defensive cap on a single CID string

FeedPageSize

// posts per rendered page / default JSON window

MaxPageLimit

// hard cap on any JSON read window (DoS guard)

MaxRenderPage

// deepest gnoweb page; beyond → use the cursor API

MaxRepliesPerPost

FlagThreshold

// unique flags before auto-hide

MinAccountAgeForFlag

// blocks since first post (~1-2h)

FlagsPerDayBudget

// per address per BlocksPerDay window

BlocksPerDay

// ~5s blocks; approximation is fine

MinPostIntervalBlocks

YoungMinPostIntervalBlocks

YoungAccountBlocks

// first ~day

Post

flagBudget

posts

// padID(id) -> \*Post (live + hidden + not-yet-swept tombstones)

liveFeed

// padID(id) -> true

byAuthor

// author + ":" + padID(id) -> true

byParent

// padID(parent) + ":" + padID(child) -> true

liveCount

// number of keys in liveFeed

replyCount

// padID(parent) -> uint64 (live replies)

nextPostID

// monotonic; NEVER iterated by reads

lastPostH

// addr -> int64 (last CreatePost height)

firstSeenH

// addr -> int64 (first write interaction height)

flags

// padID(id) -> \*avl.Tree (flagger addr -> true)

flagSpend

// addr -> \*flagBudget

reactions

tombstones

// padID(id) -> true

moderators

paused

owner

init.32

padID

padID zero-pads to 12 digits so AVL string order == numeric order. 12 digits ≥ 31,000 years of one post per block — effectively unbounded.

getPost

mustGetPost

authorKey

parentKey

getReplyCount

addToLiveIndexes

addToLiveIndexes registers a visible post in every live index (B1). A reply is only linked into its parent's byParent/replyCount indexes when the parent is still LIVE. On CreatePost the parent was just verified live, so this is always true there. The guard matters on the UnhidePost re-add path: if the parent was deleted+swept while the reply sat hidden, re-linking would recreate an orphan byParent/replyCount entry under a parent id no longer in \`posts\` (never sweepable again) — the exact leak SweepTombstones' byParent-prefix cleanup was added to prevent. An unhidden reply whose parent is gone simply becomes standalone live content, which is how a reply to a removed parent is already treated everywhere else.

removeFromLiveIndexes

removeFromLiveIndexes drops a post from every live index (hide/delete).

assertNotPaused

assertCallerIsOwner

touchFirstSeen

touchFirstSeen records the first write interaction height for an address.

accountAge

PauseRealm

UnpauseRealm

IsPaused

TransferOwnership

TransferOwnership moves realm ownership (deployer multisig rotation).

GetOwner

CreatePost

CreatePost publishes a post (replyTo == 0) or a reply (replyTo == parent id). Open write: any wallet, subject to the block cooldown and body caps. Returns the new post id.

EditPost

EditPost lets the author replace the body of a visible post.

DeletePost

DeletePost soft-deletes the author's own post: content cleared, dropped from every live index (frees render slots immediately — B1), queued for hard-GC (B2). Replies stay: they render as replies to an unavailable post.

FlagPost

FlagPost files a community flag. Guards, in order: - flag rights are EARNED BY PARTICIPATION: the caller must have a firstSeen record (anchored by their first successful CreatePost) at least MinAccountAgeForFlag blocks old. A failed flag cannot anchor age itself — an on-chain abort reverts every write in the tx, so recording firstSeen here and then panicking would revert the record and deadlock pure flaggers; requiring a prior post is the honest, implementable account-age gate (realms cannot query global account age); - one flag per address per post; - per-day flag budget per address (blunts coordinated flag-brigades). At FlagThreshold unique flags the post auto-hides (reversible via UnhidePost).

reactionEmojis

reactionEmojis is the fixed on-chain reaction set. Changing it is a realm version bump (redeploy), so it is deliberately small and stable.

isReactionEmoji

reactionSubKey

reactionSubKey namespaces a reactor's entry within a post's reaction tree. The NUL separator cannot appear in a fixed-set emoji or a bech32 address, so (emoji, addr) round-trips unambiguously.

HasReacted

HasReacted reports whether addr currently has the given emoji on the post. O(log n) point lookup — never a scan.

AddReaction

AddReaction records the caller's emoji reaction. A repeat aborts (rather than no-op) so an optimistic client's double-tap cannot silently burn gas twice — the client gates the button on HasReacted / indexed state.

RemoveReaction

RemoveReaction removes the caller's emoji reaction (toggle-off). Allowed even on a hidden/deleted post so a reactor can always retract; aborts if the caller had not reacted with that emoji.

assertCallerIsOwnerOrModerator

IsModerator

IsModerator reports whether addr currently holds the moderator role.

AddModerator

AddModerator grants the moderator role (owner only).

RemoveModerator

RemoveModerator revokes the moderator role (owner only).

ModRemovePost

ModRemovePost permanently hides a post by moderation. Emits an audited ModAction. The node is tombstoned for hard-GC like an author delete.

UnhidePost

UnhidePost clears flags and restores a flag-hidden post to the live set.

SweepTombstones

SweepTombstones hard-removes up to \`limit\` soft-deleted posts, reclaiming AVL storage so post+delete spam cannot accrete permanent state. Permissionless by design (state-shrink hygiene primitive, not a refund path). Bounded + idempotent: keep \`limit\` small (1-10); re-running drains the next batch and stops at 0. Returns the number of posts swept. For a swept post that was a PARENT, its surviving replies' byParent links (\`padID(parent):padID(child)\`) would otherwise be orphaned under an id no longer in \`posts\` — a permanent leak plus a read inconsistency (replies still enumerable, getReplyCount() disagreeing). So the sweep range-deletes that byParent prefix; the reply posts themselves stay as standalone live content (their parent was removed by its own author). Bounded because the live reply set per post is capped at MaxRepliesPerPost — but a reply-heavy parent makes one sweep step do up to that many removes, so keep \`limit\` small (1) when draining known reply-heavy tombstones.

GetTombstoneCount

GetTombstoneCount returns how many soft-deleted posts await hard-GC.

jsonEscape

jsonEscape escapes a string for embedding in a JSON string literal.

postJSON

postJSON is the qeval read fallback. Note it exposes \`mediaCids\` (P2) and \`repostOf\` (P1) which the CANONICAL indexed path (chain.Emit → backend → feed\_rpc → UI) does NOT carry yet — PostCreated emits neither, the proto reserves repost\_of, and there is no media column. A future dev wiring the qeval fallback must not assume those two are plumbed end-to-end.

boolStr

clampLimit

GetPostJSON

GetPostJSON returns one post (any state — the indexer needs tombstones too).

listWindow

listWindow walks \`tree\` REVERSE (newest first) starting below cursorKey ("" = from the newest), collecting up to limit ids via extract.

idFromPadded

idFromComposite

idsToJSON

ListFeedJSON

ListFeedJSON returns the newest live posts strictly older than cursor (cursor == 0 → from the top). Pass the last id of the previous window as the next cursor. ReverseIterate treats BOTH bounds as inclusive (avl/v0 TraverseInRange), so "strictly older than cursor" = end bound padID(cursor-1): ids are integers, keys are fixed-width, hence key \< padID(cursor) ⟺ key ≤ padID(cursor-1).

ListUserJSON

ListUserJSON returns a user's newest live posts strictly older than cursor (same inclusive-bound rule as ListFeedJSON).

ListRepliesJSON

ListRepliesJSON returns a post's live replies, OLDEST first (conversation order), starting strictly after cursor (0 → from the beginning).

GetStatsJSON

GetStatsJSON returns realm-level counters (monotonic id is informational — no read iterates it).

Render

collectPage

collectPage walks a live index reverse and returns the ids for window k (1-based). Scan is bounded: k is capped at MaxRenderPage by callers.

renderPostLine

renderFeedPage

renderUserPage

renderPost

truncAddr

sanitizeForRender

sanitizeForRender strips markdown-sensitive characters to prevent injection.