# Sender gates — every message arm, and what authorises its caller

<!-- GENERATED by tools/sender-gates.mjs. Do not edit by hand. -->

Every message arm on every contract, with the mechanism that authorises its
caller or the fact that it has none. **Every arm is either caller-authorised or
deliberately permissionless** — there is no third category, and an arm in
neither is a finding. `SenderGates.spec.ts` asserts that, and enumerates the
permissionless set by name, so an arm arriving there by accident fails the build
rather than being assumed intentional.

**Three mechanisms count as authorisation**, because three are in use:

- **compares sender** — `in.senderAddress == cfg.ledgerAddr` and friends. Also
  appears reversed (`look.loadValue() == in.senderAddress`), which a
  left-hand-side-only check reports as an open door.
- **sender IS the key** — the sender is the dictionary key for the caller's own
  record, so the caller cannot name anyone else's. Not a weaker gate.
- **signature** — a cryptographic gate, deliberately sender-agnostic.

The throw code is not part of the test: `throw 100` is the common case, but
`300`, `401`, `800` and `915` are all sender gates too.

**Totals:** 168 arms · 117 authorised (compares sender 112, sender IS the key 3, signature 2) · 51 permissionless.

## Authorised arms

| contract | line | arm | mechanism | where |
|---|---|---|---|---|
| `primes_bounty_vault.tolk` | 553 | `SetWallet` | compares sender | inline |
| `primes_bounty_vault.tolk` | 565 | `PayEraBounty` | compares sender | inline |
| `primes_bounty_vault.tolk` | 620 | `PaySpecialNumberRebate` | compares sender | inline |
| `primes_bounty_vault.tolk` | 672 | `PayProgramBounty` | sender IS the key | inline |
| `primes_bounty_vault.tolk` | 694 | `AccrueDiscovery` | sender IS the key | inline |
| `primes_bounty_vault.tolk` | 750 | `ClaimDiscovery` | sender IS the key | inline |
| `primes_claim_receipt.tolk` | 92 | `ReceiptAdvance` | compares sender | inline |
| `primes_claim_receipt.tolk` | 118 | `ReceiptRestore` | compares sender | inline |
| `primes_collection.tolk` | 279 | `SetLedger` | compares sender | inline |
| `primes_collection.tolk` | 289 | `RelayAnnotation` | compares sender | inline |
| `primes_collection.tolk` | 341 | `MintItem` | compares sender | inline |
| `primes_constellation_item.tolk` | 172 | `Populate` | compares sender | inline |
| `primes_constellation_item.tolk` | 200 | `Transfer` | compares sender | inline |
| `primes_constellations_collection.tolk` | 173 | `SetRegistrar` | compares sender | inline |
| `primes_constellations_collection.tolk` | 200 | `MintConstellation` | compares sender | inline |
| `primes_generator_item.tolk` | 156 | `Populate` | compares sender | inline |
| `primes_generator_item.tolk` | 173 | `Transfer` | compares sender | inline |
| `primes_generator_item.tolk` | 218 | `Burn` | compares sender | inline |
| `primes_generators_collection.tolk` | 359 | `SetLedger` | compares sender | inline |
| `primes_generators_collection.tolk` | 369 | `SetRegistrar` | compares sender | inline |
| `primes_generators_collection.tolk` | 401 | `DeployGenerator` | compares sender | inline |
| `primes_item.tolk` | 331 | `Populate` | compares sender | inline |
| `primes_item.tolk` | 366 | `ItemAnnotate` | compares sender | inline |
| `primes_item.tolk` | 387 | `CreditTribute` | compares sender | inline |
| `primes_item.tolk` | 397 | `CreditDividend` | compares sender | inline |
| `primes_item.tolk` | 427 | `ClaimTribute` | compares sender | inline |
| `primes_item.tolk` | 459 | `Transfer` | compares sender | inline |
| `primes_item.tolk` | 513 | `ForwardToOwner` | compares sender | inline |
| `primes_jetton_master.tolk` | 190 | `SetLedger` | compares sender | inline |
| `primes_jetton_master.tolk` | 198 | `MintOp` | compares sender | inline |
| `primes_jetton_master.tolk` | 206 | `MintGenesis` | compares sender | inline |
| `primes_jetton_master.tolk` | 214 | `SealAuthority` | compares sender | inline |
| `primes_jetton_master.tolk` | 221 | `BurnNotification` | compares sender | inline |
| `primes_jetton_wallet.tolk` | 169 | `InternalTransfer` | compares sender | inline |
| `primes_jetton_wallet.tolk` | 223 | `Transfer` | compares sender | inline |
| `primes_jetton_wallet.tolk` | 269 | `Burn` | compares sender | inline |
| `primes_ledger.tolk` | 3902 | `CardMint` | compares sender | via `handleCardMint` |
| `primes_ledger.tolk` | 3903 | `CardRecruitCounted` | compares sender | via `handleCardRecruitCounted` |
| `primes_ledger.tolk` | 3904 | `LedgerClaimTribute` | compares sender | via `handleClaimTribute` |
| `primes_ledger.tolk` | 3906 | `DividendCredited` | compares sender | via `handleDividendCredited` |
| `primes_ledger.tolk` | 3909 | `SetSinks` | compares sender | via `handleSetSinks` |
| `primes_ledger.tolk` | 3910 | `SetInviteConfig` | compares sender | via `handleSetInviteConfig` |
| `primes_ledger.tolk` | 3911 | `Ignite` | compares sender | via `handleIgnite` |
| `primes_ledger.tolk` | 3913 | `GenesisSeed` | compares sender | via `handleGenesisSeed` |
| `primes_ledger.tolk` | 3914 | `ClearingCleared` | compares sender | via `handleClearingCleared` |
| `primes_ledger.tolk` | 3915 | `RoyaltyToRatchet` | compares sender | via `handleRoyaltyToRatchet` |
| `primes_ledger.tolk` | 3924 | `SettlePrimeClearing` | compares sender | inline |
| `primes_ledger.tolk` | 3968 | `SetPeers` | compares sender | via `handleSetPeers` |
| `primes_ledger.tolk` | 3970 | `MarkOffHead` | compares sender | via `handleMarkOffHead` |
| `primes_ledger.tolk` | 3974 | `MintWonLot` | compares sender | via `handleSettle` |
| `primes_ledger.tolk` | 3975 | `MintConfirmed` | compares sender | via `handleMintConfirmed` |
| `primes_lp_position.tolk` | 383 | `LpCredit` | compares sender | inline |
| `primes_lp_position.tolk` | 401 | `ConfirmWithdraw` | compares sender | inline |
| `primes_lp_position.tolk` | 411 | `RestorePosition` | compares sender | inline |
| `primes_lp_position.tolk` | 435 | `Withdraw` | compares sender | inline |
| `primes_lp_position.tolk` | 456 | `ToSink` | compares sender | inline |
| `primes_lp_position.tolk` | 474 | `PositionVote` | compares sender | inline |
| `primes_lp_position.tolk` | 499 | `PositionPropose` | compares sender | inline |
| `primes_lp_position.tolk` | 513 | `Relock` | compares sender | inline |
| `primes_lp_sink.tolk` | 176 | `SetWallet` | compares sender | inline |
| `primes_lp_sink.tolk` | 184 | `TransferNotification` | compares sender | inline |
| `primes_market.tolk` | 2486 | `HeadUpdate` | compares sender | inline |
| `primes_market.tolk` | 2502 | `LaunchOpen` | compares sender | inline |
| `primes_market.tolk` | 2512 | `SettleConfirmed` | compares sender | inline |
| `primes_market.tolk` | 2549 | `MarkRejected` | compares sender | inline |
| `primes_minter_card.tolk` | 193 | `CardMintRefunded` | compares sender | inline |
| `primes_minter_card.tolk` | 204 | `CardAddRecruit` | compares sender | inline |
| `primes_minter_card.tolk` | 227 | `CardPrimeMinted` | compares sender | inline |
| `primes_ratchet.tolk` | 1207 | `PoolInject` | compares sender | inline |
| `primes_ratchet.tolk` | 1227 | `UpdateVenue` | compares sender | inline |
| `primes_ratchet.tolk` | 1243 | `TransferNotification` | compares sender | inline |
| `primes_ratchet.tolk` | 1323 | `SetLedger` | compares sender | inline |
| `primes_ratchet.tolk` | 1334 | `SetJettonWallet` | compares sender | inline |
| `primes_ratchet.tolk` | 1346 | `DedustPayout` | compares sender | inline |
| `primes_ratchet.tolk` | 1432 | `SetTstonWallet` | compares sender | inline |
| `primes_ratchet.tolk` | 1451 | `TonstakersWithdrawal` | compares sender | inline |
| `primes_registrar.tolk` | 2158 | `RecordMint` | compares sender | inline |
| `primes_registrar.tolk` | 2189 | `AwardEraTrophy` | compares sender | inline |
| `primes_registrar.tolk` | 2214 | `TransferTrophy` | compares sender | inline |
| `primes_registrar.tolk` | 2238 | `SetLedger` | compares sender | inline |
| `primes_registrar.tolk` | 2249 | `SetItemCode` | compares sender | inline |
| `primes_registrar.tolk` | 2266 | `SetGeneratorsCollection` | compares sender | inline |
| `primes_registrar.tolk` | 2281 | `SetSink` | compares sender | inline |
| `primes_registrar.tolk` | 2293 | `SetConstellationCollection` | compares sender | inline |
| `primes_registrar.tolk` | 2310 | `Annotate` | compares sender | inline |
| `primes_registrar.tolk` | 2331 | `SinkAnnotate` | compares sender | inline |
| `primes_registrar.tolk` | 2380 | `OpenBuild` | compares sender | inline |
| `primes_registrar.tolk` | 2498 | `OwnershipProof` | compares sender | inline |
| `primes_registrar.tolk` | 2533 | `OwnershipAssigned` | compares sender | inline |
| `primes_registrar.tolk` | 2676 | `ConstellationBuilt` | compares sender | inline |
| `primes_sink.tolk` | 354 | `SetWallet` | compares sender | inline |
| `primes_sink.tolk` | 366 | `TransferNotification` | compares sender | inline |
| `primes_sink.tolk` | 422 | `FloorQuote` | compares sender | inline |
| `primes_stake.tolk` | 480 | `SetWallet` | compares sender | inline |
| `primes_stake.tolk` | 493 | `TransferNotification` | compares sender | inline |
| `primes_stake.tolk` | 568 | `Settle` | compares sender | inline |
| `primes_stake_position.tolk` | 262 | `StakeCredit` | compares sender | inline |
| `primes_stake_position.tolk` | 283 | `StakeSettled` | compares sender | inline |
| `primes_stake_position.tolk` | 313 | `RestoreStake` | compares sender | inline |
| `primes_stake_position.tolk` | 339 | `Claim` | compares sender | inline |
| `primes_stake_position.tolk` | 346 | `Relock` | compares sender | inline |
| `primes_stake_position.tolk` | 352 | `Withdraw` | compares sender | inline |
| `primes_treasury.tolk` | 650 | `SetWallets` | compares sender | inline |
| `primes_treasury.tolk` | 664 | `TransferNotification` | compares sender | inline |
| `primes_treasury.tolk` | 740 | `RelockVote` | compares sender | inline |
| `primes_treasury.tolk` | 757 | `WithdrawLp` | compares sender | inline |
| `primes_treasury.tolk` | 792 | `ExpireVote` | compares sender | inline |
| `primes_treasury.tolk` | 809 | `Vote` | compares sender | inline |
| `primes_treasury.tolk` | 843 | `Propose` | compares sender | inline |
| `primes_venue_timelock.tolk` | 219 | `SetRatchet` | compares sender | inline |
| `primes_venue_timelock.tolk` | 227 | `Queue` | compares sender | inline |
| `primes_venue_timelock.tolk` | 260 | `Cancel` | compares sender | inline |
| `primes_vesting.tolk` | 212 | `SetWallet` | compares sender | inline |
| `primes_voucher.tolk` | 275 | `SetVault` | compares sender | inline |
| `primes_voucher.tolk` | 283 | `ClaimVoucher` | signature | inline |
| `primes_voucher.tolk` | 314 | `ReceiptDelta` | compares sender | inline |
| `primes_voucher.tolk` | 338 | `BurnSigner` | signature | inline |

## Permissionless arms

No caller authorisation, by design. The spec enumerates this set by name.

| contract | line | arm |
|---|---|---|
| `primes_bounty_vault.tolk` | 774 | `RetryBountyPayout` |
| `primes_bounty_vault.tolk` | 813 | `Excesses` |
| `primes_collection.tolk` | 316 | `GetRoyaltyParams` |
| `primes_constellation_item.tolk` | 241 | `ProveOwnership` |
| `primes_constellation_item.tolk` | 264 | `GetStaticData` |
| `primes_constellations_collection.tolk` | 183 | `GetRoyaltyParams` |
| `primes_generator_item.tolk` | 233 | `GetStaticData` |
| `primes_generators_collection.tolk` | 379 | `GetRoyaltyParams` |
| `primes_item.tolk` | 499 | `GetStaticData` |
| `primes_item.tolk` | 534 | `ProveOwnership` |
| `primes_item.tolk` | 561 | `TopUp` |
| `primes_jetton_master.tolk` | 261 | `ProvideWalletAddress` |
| `primes_jetton_master.tolk` | 284 | `Excesses` |
| `primes_ledger.tolk` | 3905 | `ClaimDividend` |
| `primes_ledger.tolk` | 3907 | `RetryCredit` |
| `primes_ledger.tolk` | 3908 | `RetryMint` |
| `primes_ledger.tolk` | 3912 | `SyncLaunch` |
| `primes_ledger.tolk` | 3916 | `DonateFloor` |
| `primes_ledger.tolk` | 3969 | `SweepOps` |
| `primes_ledger.tolk` | 3971 | `SyncHead` |
| `primes_ledger.tolk` | 3972 | `AdvanceHead` |
| `primes_ledger.tolk` | 3973 | `OpenBuild` |
| `primes_ledger.tolk` | 3976 | `RetryItem` |
| `primes_ledger.tolk` | 3977 | `QuoteFloor` |
| `primes_lp_position.tolk` | 551 | `Expire` |
| `primes_market.tolk` | 2075 | `OpenLot` |
| `primes_market.tolk` | 2221 | `OpenHeadLot` |
| `primes_market.tolk` | 2300 | `BidLot` |
| `primes_market.tolk` | 2411 | `CloseLot` |
| `primes_market.tolk` | 2449 | `RetryPremiumForward` |
| `primes_minter_card.tolk` | 157 | `Mint` |
| `primes_ratchet.tolk` | 1223 | `Flush` |
| `primes_ratchet.tolk` | 1416 | `Stake` |
| `primes_ratchet.tolk` | 1420 | `Unstake` |
| `primes_ratchet.tolk` | 1424 | `Harvest` |
| `primes_ratchet.tolk` | 1428 | `RecoverExit` |
| `primes_ratchet.tolk` | 1466 | `PayoutOwnershipAssigned` |
| `primes_ratchet.tolk` | 1474 | `PayoutDistributedAsset` |
| `primes_ratchet.tolk` | 1484 | `Excesses` |
| `primes_registrar.tolk` | 2471 | `ProveInput` |
| `primes_registrar.tolk` | 2609 | `CloseBuild` |
| `primes_registrar.tolk` | 2734 | `ExpireBuild` |
| `primes_sink.tolk` | 474 | `Excesses` |
| `primes_stake_position.tolk` | 358 | `Expire` |
| `primes_treasury.tolk` | 894 | `Execute` |
| `primes_treasury.tolk` | 982 | `Distribute` |
| `primes_treasury.tolk` | 1031 | `Prune` |
| `primes_treasury.tolk` | 1046 | `Excesses` |
| `primes_venue_timelock.tolk` | 268 | `Execute` |
| `primes_venue_timelock.tolk` | 296 | `RetryUpdateVenue` |
| `primes_vesting.tolk` | 226 | `Release` |

## Limits

Lexical, not semantic. This does not prove the address compared against is the
RIGHT one, and it follows only one level of `handleX` delegation. Its job is to
make the set countable and to fail loudly when an arm appears that nobody
classified.