Glossary
The nouns, defined once. Each links back to where it does work.
A container holding balances, capability slots, and named slots, plus a predicate — a program over its own transitions the substrate enforces on every change. Nothing is ownerless; a turn touching one cell leaves every other cell untouched.
An atomic batch of actions, ed25519-signed by its actor. Each action presents a capability and must discharge every guard in scope. The whole turn commits or none of it does.
An unforgeable token naming an authority over one cell — a set of rights plus a chain of restricting caveats, bound by an HMAC tag rooted in the cell's secret. Attenuable but never amplifiable. Lineage: macaroons → biscuit → the proof system.
The authority guard checks required ⊆ held. The predicate guard checks the target cell's program accepts the transition. An undischarged guard voids the turn.
The tamper-evident record a committed turn leaves. It binds the whole post-state via a domain-tagged commitment and pins its parent by hash. Receipts chain; the chain is the history.
The hash a committed turn emits: q = commit(receiptBody). It opens to exactly one post-state; a second pre-image would be the only way to forge a receipt for a different state — exactly the collision-resistance assumption.
A server that presents a plausible state it never legitimately produced. The light client catches it: there is no verifying chain for a forged history. Summon one in the explorer.
A turn's nonce, marked spent in the actor's set once it commits. Presenting it again is a double-spend and is refused for freshness. The project's namesake primitive.
A durable, re-attachable reference behind a membrane. It is what a snapshot embeds so a screenshot can re-open as a per-viewer, attenuated live surface.