Instructions

Every handler in #[program]. Marked 🔁 = permissionless crank (any signer may advance it); 🔒 = authority-gated; 📖 = read-only.

Instruction	Args	Signer	Semantics	Errors
health	—	caller	Liveness probe; emits HealthChecked{version:1}.	—
initialize_pause	—	authority	One-time init of PauseState singleton; caller becomes pause authority.	—
🔒 pause	—	authority	Instant freeze; clears any pending unpause.	NotPauseAuthority, AlreadyPaused
🔒 propose_unpause	—	authority	Arms unpause at slot + UNPAUSE_TIMELOCK_SLOTS.	NotPauseAuthority, NotPaused, ArithmeticOverflow
🔁 execute_unpause	—	caller	Lands unpause once notice slot passes; no authority check.	NoPendingUnpause, UnpauseTimelockNotElapsed
create_subaccord	risk_type, evidence_spec, staking_token, min_stake, jurors_per_dispute, alpha_bps, review_window, commit_window, reveal_window, max_appeals, fee_per_juror, authority, evidence_operator	creator	Permissionless pool init. risk_type != [0;32]. max_appeals <= MAX_APPEALS.	InvalidOptions, MaxAppealsLimitExceeded
stake	amount	juror	SPL transfer juror→vault; credits real delta (fee-on-transfer safe). First stake (0→+) increments staker_count.	ProgramPaused, InvalidAmount, ArithmeticOverflow
unstake	amount	juror	PDA-signed vault→juror. Full unstake (+→0) decrements staker_count. Never halted by pause.	InvalidAmount, StakeLocked, InsufficientBalance, ArithmeticOverflow
🔒 propose_subaccord_update	nonce, payload: UpdatePayload	authority	Writes PendingUpdate; executable after UPDATE_TIMELOCK_SLOTS.	ImmutableSubaccord, Unauthorized, ArithmeticOverflow
🔁 execute_subaccord_update	—	caller	Applies timelocked payload to Subaccord; closes PendingUpdate.	TimelockNotElapsed
create_dispute	options: Vec<[u8;32]>, evidence_hash, nonce, fee	filer	Arbitrable CPI entry. Custodies jurors_per_dispute · fee_per_juror. Requires staker_count >= jurors_per_dispute.	ProgramPaused, InvalidOptions, FeeMismatch, InsufficientJurors, ArithmeticOverflow
post_snapshot	merkle_root, total_stake	poster	Bonds 1 × max-appeal-fee; arms challenge_deadline = now + SNAPSHOT_CHALLENGE_WINDOW_SECS; records anchor_slot.	InvalidState, ArithmeticOverflow
challenge_snapshot	proof: FraudProof	challenger	Challenger bonds equal; dispatches the 5 predicates. Fraud ⇒ void + both bonds→challenger. False ⇒ challenger bond→poster.	InvalidState, SnapshotChallengeWindowExpired, InvalidMembershipProof
🔁 finalize_snapshot	—	caller	After window passes unchallenged: returns poster bond, status→Finalized.	InvalidState, SnapshotChallengeWindowOpen
🔁 request_vrf	—	caller	CPI into VRF oracle if committed_vrf.is_none() and snapshot finalized. One-shot.	VrfAlreadyCommitted, SnapshotNotFinalized
commit_vrf_callback	randomness: [u8;32]	vrf_program_identity	Stores VRF result. Only the VRF program can call (identity-constrained).	VrfAlreadyCommitted
🔁 draw	draw_attempt, memberships: Vec<JurorMembership>	caller	Verifies each MST proof + sortition (cum_before ≤ r_i < cum_after) + inflation guard; active_draws += 1; inits Round. Collisions revert; retry with draw_attempt+1.	SnapshotNotFinalized, InvalidState, InvalidPanelSize, VrfNotCommitted, InvalidMembershipProof, InsufficientStake, SortitionMismatch, DuplicateJuror, InflatedStake, ArithmeticOverflow
commit	commitment: [u8;32]	juror	commitment = hash(vote_le ‖ salt ‖ juror_pubkey). Window: review_end ≤ now < commit_end.	InvalidState, CommitWindowClosed, NotDrawnJuror, CommitAlreadyExists, ArithmeticOverflow
reveal	vote, salt	juror	Recomputes hash; stores vote. Window: commit_end ≤ now < reveal_end.	InvalidState, InvalidVote, RevealWindowClosed, NotDrawnJuror, CommitMissing, AlreadyRevealed, RevealMismatch, ArithmeticOverflow
🔁 finalize_round	—	caller	After reveal_end: plurality tally, write result (default 0 if no reveals), →RoundResolved.	InvalidState, RoundNotFinalizable
🔁 finalize_dispute	—	caller	After appeal window: slashes incoherent (α·min_stake), splits pool to coherent, folds no-flip bonds, decrements active_draws, writes final_ruling, →Final.	InvalidState, AppealWindowOpen, InvalidPanelSize, InvalidMembershipProof, ArithmeticOverflow
appeal	—	appellant	Permissionless. Pays N_new·fee_per_juror + bond (== new fee). current_round++, →Created.	ProgramPaused, InvalidState, MaxAppealsReached, AppealWindowClosed, InsufficientJurors, ArithmeticOverflow
🔁 claim_appeal_refund	round_idx	caller	Returns a flipped bond to its appellant after Final. Idempotent (zeroes on payout).	InvalidState, InvalidMembershipProof, InvalidAmount
📖 get_ruling	—	caller	Returns Option<u8> (None until Final).	—

UpdatePayload variants: MinStake, JurorsPerDispute, AlphaBps, ReviewWindow, CommitWindow, RevealWindow, MaxAppeals, FeePerJuror, Authority, EvidenceOperator.

See: state machine, accounts, errors. Draw trust chain in sortition & VRF.