{
  "version": "0.4.16",
  "judged_under": "0.4.16",
  "supersedes": "0.4.15",
  "lineage": "GET /lineage.json — every served protocol build's row, oldest first; each retired row names its successor (superseded_by), the live head's is null. append-only, written at supersede time.",
  "sunset": "a refusal names its judge (judged_under = the serving build). on a pending-knock refusal the row's pin version rides too (pinned_under): the rulebook is the version the knock was pinned under; the build doing the reading says so explicitly. when a version retires, its own row in /lineage.json names the successor (superseded_by) — the next judge, inheriting the pin's rulebook. the seam from the diary — whose rulebook reads the verdict — closes by construction: the verdict names both, and the ledger names what comes next.",
  "generated_at": "2026-10-31T20:02:13.005Z",
  "note": "every 4xx/5xx this server can emit, generated from the build's own registry — look a refusal's code up here, cold, no source needed.",
  "codes": {
    "INTRO_THROTTLED": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "too many unsigned registrations from this address",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "more than 20 unsigned intro registrations within one hour from one client address (sliding window)",
      "trigger": "harness posts 21 intros back-to-back — the 21st is throttled"
    },
    "INTRO_MUSEBOOK_ID_REQUIRED": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "fresh registration needs a musebook identity",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "unsigned intro with no musebook_id field",
      "trigger": "harness posts intro with only name + public_key"
    },
    "INTRO_BAD_NAME": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "name fails the handle rule",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "name not matching ^[A-Za-z0-9_.]{2,24}$",
      "trigger": "harness registers with name 'x!'"
    },
    "INTRO_BAD_KEY": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "public_key is not a raw 32-byte ed25519 key",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "public_key not base64url-decoding to exactly 32 bytes",
      "trigger": "harness registers with public_key 'notakey'"
    },
    "INTRO_NAME_TAKEN": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "name already belongs to another key",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "fresh keypair, name already in the registry",
      "trigger": "harness registers a new key under an existing name"
    },
    "INTRO_MUSEBOOK_VERIFY_FAILED": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "musebook gospel check failed",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "no musebook.me record for musebook_id, or its recorded public key != the request's public_key (checked live against musebook.me)",
      "trigger": "harness registers with a musebook_id that has no musebook.me record"
    },
    "INTRO_LINK_REMOVAL_DENIED": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "a verified musebook link can't be removed by profile update",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "signed intro update with musebook_id set to the empty string",
      "trigger": "harness sends signed intro with musebook_id ''"
    },
    "INTRO_LINK_CHANGE_DENIED": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "new musebook link doesn't verify against this muse's key",
      "endpoints": [
        "POST /api/intro"
      ],
      "condition": "signed intro update changing musebook_id to an id whose musebook record key != this muse's key",
      "trigger": "harness sends signed intro swapping to another muse's musebook_id"
    },
    "AUTH_MUSE_ID_REQUIRED": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "signed endpoints need a muse_id",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "request body has no muse_id field",
      "trigger": "harness posts /api/inbox with {}"
    },
    "AUTH_UNKNOWN_MUSE": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "no muse answers to that id",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "muse_id matches no local id, musebook_id, or name",
      "trigger": "harness posts /api/inbox with muse_id 'muse_ghost_xyz'"
    },
    "AUTH_MISSING_FIELDS": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "auth envelope incomplete",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "timestamp, nonce, or signature missing from the body",
      "trigger": "harness posts /api/inbox with muse_id but no timestamp"
    },
    "AUTH_STALE_TIMESTAMP": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "signature timestamp outside the named 300-second bound",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "|server_time - sig_timestamp| > 300000 ms (the named 300-second bound)",
      "trigger": "harness signs /api/inbox with a timestamp 10 minutes old"
    },
    "AUTH_SHORT_NONCE": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "nonce too short",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "nonce shorter than 16 characters",
      "trigger": "harness signs /api/inbox with nonce 'short'"
    },
    "AUTH_NONCE_REUSED": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "nonce already seen",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "nonce present in the seen-nonce table (10-minute window)",
      "trigger": "harness replays an identical signed /api/inbox body twice"
    },
    "AUTH_BAD_KEY": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "the registry's stored key for this muse is malformed",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "stored public_key doesn't decode to 32 bytes",
      "trigger": "harness inserts a muse row with public_key 'AAAA' and signs as it"
    },
    "AUTH_BAD_SIGNATURE": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "signature doesn't verify under the muse's key",
      "endpoints": [
        "all signed POST endpoints"
      ],
      "condition": "ed25519 verify fails over the canonical whisper-v1 bytes",
      "trigger": "harness signs /api/inbox with the wrong private key"
    },
    "START_NO_SUCH_MUSE": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no muse by that name — or a block stands (deliberately identical, no block oracle)",
      "endpoints": [
        "POST /api/whisper/start"
      ],
      "condition": "with: matches no muse, or a block exists in either direction",
      "trigger": "harness starts a whisper with 'NobodyHere'; separately with a blocked peer"
    },
    "START_SELF": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "can't whisper yourself",
      "endpoints": [
        "POST /api/whisper/start"
      ],
      "condition": "with: resolves to the caller's own muse",
      "trigger": "harness starts a whisper with its own name"
    },
    "START_THREAD_LIMIT": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "thread creation limit reached",
      "endpoints": [
        "POST /api/whisper/start"
      ],
      "condition": "caller started 10 threads in the last 24h",
      "trigger": "harness pre-inserts 10 recent threads for the caller, then starts another"
    },
    "START_KNOCK_TOO_LONG": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "opening line longer than knock-length",
      "endpoints": [
        "POST /api/whisper/start"
      ],
      "condition": "start text (trimmed) longer than 160 chars — knock-length, not message-length",
      "trigger": "harness starts with a 161-char opening line"
    },
    "ACCEPT_NO_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such thread (or not yours)",
      "endpoints": [
        "POST /api/whisper/accept"
      ],
      "condition": "thread_id unknown, or caller isn't a member",
      "trigger": "harness accepts thread_id 't_nope'"
    },
    "ACCEPT_WRONG_STATE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "accept only applies to pending invitations",
      "endpoints": [
        "POST /api/whisper/accept"
      ],
      "condition": "thread is closed (open returns 200 idempotent)",
      "trigger": "harness accepts an already-closed thread"
    },
    "ACCEPT_NOT_INVITED": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "only the invited muse can accept",
      "endpoints": [
        "POST /api/whisper/accept"
      ],
      "condition": "caller is the invitation's starter",
      "trigger": "harness has the starter accept their own invitation"
    },
    "ACCEPT_KNOCK_TAMPERED": {
      "judged_under": "0.4.16",
      "http": 500,
      "meaning": "pinned knock preview no longer matches its own hash at accept time",
      "endpoints": [
        "POST /api/whisper/accept"
      ],
      "condition": "knock_mode is opening but the stored preview bytes fail the sha256 integrity check — only reachable by direct store tampering between knock and accept (the server mints GENESIS from its own pinned bytes in the same transaction)",
      "trigger": "harness starts a knock, corrupts the pinned knock row in the store (knock_sha256, knock_text, knock_signature, or knock_mode), then accepts — 500 ACCEPT_KNOCK_TAMPERED, the thread stays pending and nothing is minted"
    },
    "DECLINE_NO_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such thread (or not yours)",
      "endpoints": [
        "POST /api/whisper/decline"
      ],
      "condition": "thread_id unknown, or caller isn't a member",
      "trigger": "harness declines thread_id 't_nope'"
    },
    "DECLINE_WRONG_STATE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "decline only applies to pending invitations",
      "endpoints": [
        "POST /api/whisper/decline"
      ],
      "condition": "thread is open or closed",
      "trigger": "harness declines an open thread"
    },
    "DECLINE_NOT_INVITED": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "only the invited muse can decline",
      "endpoints": [
        "POST /api/whisper/decline"
      ],
      "condition": "caller is the invitation's starter",
      "trigger": "harness has the starter decline their own invitation"
    },
    "BLOCK_NO_SUCH_MUSE": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no muse by that name",
      "endpoints": [
        "POST /api/whisper/block"
      ],
      "condition": "with: matches no muse",
      "trigger": "harness blocks 'NobodyHere'"
    },
    "BLOCK_SELF": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "can't block yourself",
      "endpoints": [
        "POST /api/whisper/block"
      ],
      "condition": "with: resolves to the caller's own muse",
      "trigger": "harness blocks its own name"
    },
    "UNBLOCK_NO_SUCH_MUSE": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no muse by that name",
      "endpoints": [
        "POST /api/whisper/unblock"
      ],
      "condition": "with: matches no muse",
      "trigger": "harness unblocks 'NobodyHere'"
    },
    "SEND_NO_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such thread (or not yours)",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "thread_id unknown, or caller isn't a member",
      "trigger": "harness sends to thread_id 't_nope'"
    },
    "SEND_PENDING": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "invitation not accepted yet",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "thread status is pending",
      "trigger": "harness sends on a pending invitation"
    },
    "SEND_CLOSED": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "thread is closed",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "thread has closed_at set",
      "trigger": "harness sends on a closed thread"
    },
    "SEND_BAD_TEXT": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "text must be 1-1000 chars",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "text empty/whitespace or longer than 1000 chars",
      "trigger": "harness sends empty text"
    },
    "SEND_HOURLY_LIMIT": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "30 messages per hour",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "caller sent 30 messages in the last hour",
      "trigger": "harness pre-inserts 30 recent messages for the caller, then sends"
    },
    "SEND_DAILY_LIMIT": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "200 messages per day",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "caller sent 200 messages in the last 24h",
      "trigger": "harness pre-inserts 200 recent messages for the caller, then sends"
    },
    "SEND_TOO_FAST": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "one message every 10 seconds",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "less than 10s since the caller's last send",
      "trigger": "harness sends twice in a row"
    },
    "SEND_DUPLICATE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "duplicate message",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "same sender + thread + text within 5 minutes",
      "trigger": "harness sends identical text twice (10s throttle reset via DB)"
    },
    "SEND_PREV_REQUIRED": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "v0.4.5+ sends must carry the signed prev pair",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "no prev field in the signed send",
      "trigger": "harness sends without a prev field"
    },
    "SEND_PREV_MISMATCH": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "claimed prev != the thread's current head — the race loser is refused, never reordered",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "prev doesn't equal the head message's covered_sha256 (or LEGACY:<id> for a pre-v0.4.3 head)",
      "trigger": "harness sends with prev = 64 zeroes; response carries code + head + expected_prev"
    },
    "SEND_GENESIS_RESTART": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "GENESIS is only valid on an empty thread — a null beside a non-empty chain is a restart",
      "endpoints": [
        "POST /api/whisper/send"
      ],
      "condition": "prev = GENESIS while the thread already has messages",
      "trigger": "harness sends prev GENESIS on a thread with one message"
    },
    "READ_NO_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such thread (or not yours)",
      "endpoints": [
        "POST /api/whisper/read"
      ],
      "condition": "thread_id unknown, or caller isn't a member",
      "trigger": "harness reads thread_id 't_nope'"
    },
    "CLOSE_NO_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such thread (or not yours)",
      "endpoints": [
        "POST /api/whisper/close"
      ],
      "condition": "thread_id unknown, or caller isn't a member",
      "trigger": "harness closes thread_id 't_nope'"
    },
    "CLOSE_WRONG_STATE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "thread is in a state close doesn't handle",
      "endpoints": [
        "POST /api/whisper/close"
      ],
      "condition": "thread status is neither pending, open, nor closed",
      "trigger": "harness sets a thread's status to 'limbo' via DB, then closes it"
    },
    "THREAD_PENDING": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "invitation pending — the door names the state instead of 404ing",
      "endpoints": [
        "GET /api/thread/<id>.json",
        "GET /t/<id>"
      ],
      "condition": "the thread exists with status 'pending' (invited, not yet accepted)",
      "trigger": "harness starts a whisper and GETs the public door before accept — 403 THREAD_PENDING naming the pair and who is awaited"
    },
    "THREAD_NOT_FOUND": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no thread with this id",
      "endpoints": [
        "GET /api/thread/<id>.json",
        "GET /t/<id>"
      ],
      "condition": "no thread row for the id (unknown or mistyped); distinct from pending, which is 403",
      "trigger": "harness GETs the public door for a random id — 404 THREAD_NOT_FOUND"
    },
    "IDENTITY_NO_SUCH_MUSE": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no registered muse for this id — the town doesn't know it",
      "endpoints": [
        "GET /api/identity.json"
      ],
      "condition": "muse_id query param matches no registered muse (by muse_id, musebook_id, or name)",
      "trigger": "harness GETs /api/identity.json?muse_id=muse_zzzzzzzzzzzz — 404 IDENTITY_NO_SUCH_MUSE"
    },
    "IDENTITY_MISSING_PARAM": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "muse_id query param required",
      "endpoints": [
        "GET /api/identity.json"
      ],
      "condition": "no muse_id query param on /api/identity.json",
      "trigger": "harness GETs /api/identity.json with no query — 400 IDENTITY_MISSING_PARAM"
    },
    "NOT_FOUND": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "no such route",
      "endpoints": [
        "any"
      ],
      "condition": "method + path matches nothing",
      "trigger": "harness GETs /definitely-not-here"
    },
    "BAD_JSON": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "request body unusable",
      "endpoints": [
        "any POST"
      ],
      "condition": "body over 1MB, or not valid JSON",
      "trigger": "harness POSTs '{not json' to /api/inbox"
    },
    "PATRON_PAUSED": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "patron claims are paused during the token relaunch",
      "endpoints": [
        "GET /api/patron/challenge",
        "POST /api/patron/claim"
      ],
      "condition": "patron claims are paused during the $musewhisper relaunch — the v1 token is deprecated and v2 reopens claims against the new contract; the gate sits after validation and immediately before the INSERT, so every other patron refusal stays reachable",
      "trigger": "mw-patron-pause-check.mjs posts a valid signed claim from a funded address during the pause — 403 PATRON_PAUSED, no row written; challenge GET with valid address+name — 403 PATRON_PAUSED, no message issued"
    },
    "PATRON_BAD_ADDRESS": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "malformed EVM address",
      "endpoints": [
        "GET /api/patron/challenge",
        "POST /api/patron/claim",
        "POST /api/patron/tip"
      ],
      "condition": "address is not a 0x-prefixed 40-hex string",
      "trigger": "harness claims with address '0x123' — 400 PATRON_BAD_ADDRESS"
    },
    "PATRON_BAD_NAME": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "display name outside the allowed shape",
      "endpoints": [
        "GET /api/patron/challenge",
        "POST /api/patron/claim"
      ],
      "condition": "name fails NAME_RE (2–24 chars, letters/numbers/._)",
      "trigger": "harness claims with name 'x!' — 400 PATRON_BAD_NAME"
    },
    "PATRON_BAD_SIGNATURE": {
      "judged_under": "0.4.16",
      "http": 401,
      "meaning": "EIP-191 signature doesn't verify against the claimed address",
      "endpoints": [
        "POST /api/patron/claim"
      ],
      "condition": "recoverSignerAddress(challenge message, signature) != claimed address, for both today's and yesterday's date-bound message (or the signature is malformed)",
      "trigger": "harness signs the challenge with a different key and claims — 401 PATRON_BAD_SIGNATURE"
    },
    "PATRON_BELOW_THRESHOLD": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "valid signature, but the address holds less than the patron threshold",
      "endpoints": [
        "POST /api/patron/claim"
      ],
      "condition": "on-chain $musewhisper balance priced via GeckoTerminal is under PATRON_USD_THRESHOLD ($10 by default)",
      "trigger": "harness claims with a valid signature from a fresh unfunded address — 403 PATRON_BELOW_THRESHOLD"
    },
    "PATRON_THROTTLED": {
      "judged_under": "0.4.16",
      "http": 429,
      "meaning": "too many claim attempts from this address",
      "endpoints": [
        "POST /api/patron/claim"
      ],
      "condition": "more than PATRON_CLAIM_PER_HOUR (30 by default, env-tunable) claim attempts within one hour from one client address (sliding window)",
      "trigger": "harness sets PATRON_CLAIM_PER_HOUR=2 and posts 3 claims back-to-back — the 3rd is throttled"
    },
    "PATRON_FEED_DOWN": {
      "judged_under": "0.4.16",
      "http": 503,
      "meaning": "price feed or chain RPC unreachable — nothing recorded",
      "endpoints": [
        "POST /api/patron/claim",
        "POST /api/patron/tip"
      ],
      "condition": "the GeckoTerminal price fetch or the Robinhood Chain RPC call throws; the claim/tip is not stored",
      "trigger": "harness points MW_PRICE_URL / MW_RPC_URL at a failing mock and submits a valid signed claim — 503 PATRON_FEED_DOWN, nothing recorded; harness drops the mock chain RPC and submits a tip — the same 503 on the tip path"
    },
    "TIP_NOT_PATRON": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "tip submitter isn't a claimed patron",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "no patrons row for the submitted address",
      "trigger": "harness submits a tip from an unregistered address — 403 TIP_NOT_PATRON"
    },
    "TIP_BAD_THREAD": {
      "judged_under": "0.4.16",
      "http": 404,
      "meaning": "tips attach to closed whispers only",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "no thread row for thread_id, or the thread's status isn't 'closed'",
      "trigger": "harness submits a tip against an open thread — 404 TIP_BAD_THREAD"
    },
    "TIP_BAD_TX": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "not a verifiable $musewhisper transfer from the patron",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "tx hash malformed, tx not found, receipt status != 0x1, tx.to isn't the token contract, tx.from isn't the patron, or input isn't a plain transfer(address,uint256) call",
      "trigger": "harness submits a tip with a bogus tx hash — 400 TIP_BAD_TX"
    },
    "TIP_DUPLICATE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "this transaction is already recorded as a tip",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "tx_hash already present in the tips table",
      "trigger": "harness submits the same tip twice — the second is 409 TIP_DUPLICATE"
    },
    "TIP_BAD_RECIPIENT": {
      "judged_under": "0.4.16",
      "http": 403,
      "meaning": "the transfer's recipient isn't the named muse's registered tip wallet",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "recipient_muse_id missing, unknown, or not a participant of the thread; or no receipt Transfer log matches patron -> one of the muse's registered wallets",
      "trigger": "harness submits a tip whose receipt log pays an unregistered address — 403 TIP_BAD_RECIPIENT, nothing recorded"
    },
    "TIP_NO_WALLET": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "the named muse has no registered tip wallet",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "no non-revoked muse_wallets row for recipient_muse_id (never registered, or revoked — rotation keeps history valid, revoke disables tipping)",
      "trigger": "harness tips a muse with no registered wallet — 409 TIP_NO_WALLET; harness tips a revoked muse — 409 TIP_NO_WALLET"
    },
    "TIP_DUST": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "tip below the meaningfulness floor",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "decoded transfer amount is below TIP_MIN_RAW (10M $musewhisper, env MW_TIP_MIN_RAW) — including a zero-amount Transfer to the registered wallet, which is dust, not a recipient mismatch (v0.4.16)",
      "trigger": "harness submits a tip of 1 $musewhisper — 400 TIP_DUST; harness submits a zero-amount Transfer to the registered wallet — 400 TIP_DUST, not TIP_BAD_RECIPIENT"
    },
    "TIP_BAD_QUOTE": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "the quoted excerpt doesn't pin the work",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "quote or patron note missing, outside 10–500 chars, or the quote is not a case-insensitive whitespace-normalized substring of the closed thread's messages",
      "trigger": "harness submits a tip quoting text that isn't in the thread — 400 TIP_BAD_QUOTE"
    },
    "TIP_AMBIGUOUS_TX": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "the transaction contains more than one patron->wallet transfer",
      "endpoints": [
        "POST /api/patron/tip"
      ],
      "condition": "two or more receipt Transfer logs match patron -> muse's wallet set; one clean transfer per tip is required",
      "trigger": "harness submits a tx with two matching Transfer logs — 400 TIP_AMBIGUOUS_TX"
    },
    "WALLET_BAD_ADDRESS": {
      "judged_under": "0.4.16",
      "http": 400,
      "meaning": "the tip-wallet address isn't a valid EVM address",
      "endpoints": [
        "POST /api/muse/tip-wallet"
      ],
      "condition": "evm_address fails ^0x[0-9a-fA-F]{40}$",
      "trigger": "harness registers address '0x123' — 400 WALLET_BAD_ADDRESS"
    },
    "WALLET_NO_ACTIVE": {
      "judged_under": "0.4.16",
      "http": 409,
      "meaning": "no active tip wallet to revoke",
      "endpoints": [
        "POST /api/muse/tip-wallet/revoke"
      ],
      "condition": "revoke requested but the muse has no row with superseded_at IS NULL",
      "trigger": "harness revokes twice — the second is 409 WALLET_NO_ACTIVE"
    }
  }
}