Planning

docs/market-transparency.md

@@ -4,7 +4,7 @@
 
 ## Current status: no real payments
 
-**The running Wikideck market is a testnet sandbox. It does not process real cryptocurrency payments.** XMR amounts, payment confirmations, fees, seller payouts and refunds are simulated. Checkout provides **no payable Monero address**. Do not send cryptocurrency to a host, author-fee address or address someone provides in a message to pay a sandbox order.
+**The running Wikideck market is a testnet sandbox. It does not process real cryptocurrency payments.** New listing prices are native XMR amounts; payment confirmations, fees, seller payouts and refunds are simulated. Historical USD orders retain their original terms and are labeled as legacy. Checkout provides **no payable Monero address**. Do not send cryptocurrency to a host, author-fee address or address someone provides in a message to pay a sandbox order.
 
 **Card delivery is real on the selected blockchain.** When a seller signs delivery, they authorize an actual NFT transfer, even though the buyer only clicked a simulated-payment button. A `paid` or `mock-paid` label here is **not evidence of real money received**. Do not deliver valuable assets in exchange for mock payment.
 
@@ -35,13 +35,13 @@ The seller may cancel an available fixed-price listing. An auction cannot be can
 
 Fixed-price checkout reserves the local listing for **30 minutes from reservation**. An unpaid reservation expires and can reopen if the card is still eligible. A seller cannot cancel the reserved listing through the normal cancellation action.
 
-Auctions last one minute to 30 days. Bids are signed but **unfunded**; each bid must meet the opening price and exceed an existing highest bid by at least $0.01. The seller's own address cannot bid, but alternate-wallet shill bidding is not prevented. There are no funded bid deposits, identity checks or automatic nonpayment penalties.
+Sandbox auctions last one minute to 30 days. Bids are signed but **unfunded**; each new v3 bid must meet the opening price and exceed an existing highest bid by at least one atomic unit. Historical USD auctions are read-only and retain their original bid terms. The seller's own address cannot bid, but alternate-wallet shill bidding is not prevented. There are no funded bid deposits, identity checks or automatic nonpayment penalties. Live auctions remain a separate release gate.
 
 The auction winner must check out and complete mock payment within **30 minutes after auction close**, not 30 minutes after clicking checkout. Without bids the auction expires at closing. An unpaid winner causes expiry; there is no automatic runner-up sale. The seller can relist later.
 
 ### 3. Buyer simulates payment
 
-The buyer sees the USD price, simulated gross XMR, host fee, author fee, seller net and payment deadline. The conversion is a configured test rate—**not a live market quote**. Quote amounts, fee allocations and delivery-confirmation requirements are stored with the order; later configuration changes do not silently reprice it.
+For a new version-3 order, the buyer sees the exact signed XMR gross, host fee, author fee, seller net and payment deadline. No USD conversion or exchange rate is applied. Legacy version-2 USD orders retain their previously signed USD price and snapshotted mock-XMR quote; they are not reinterpreted as XMR. Quote amounts, fee allocations and delivery-confirmation requirements remain stored with each order.
 
 Only the order's buyer can sign **Simulate XMR payment**, and eligibility is checked again. This action changes an accounting status; it does not verify a Monero transaction or contact SHKeeper. Other users cannot mark the order paid through the normal participant-authorized API, but the buyer's signature alone never proves real payment.
 
@@ -79,7 +79,7 @@ The author recipient is:
 
 **This is a payout recipient, not a checkout address.** Setting hosting fees to zero does not disable the author allocation. Checksum verification does not prove recipient ownership. The author fee is source-level policy, not a guarantee that every independently modified host runs the same release; verify the host and its disclosed terms.
 
-USD values use integer cents. XMR uses 12-decimal atomic units. Simulated gross is rounded up to an atomic unit; each fee is rounded down separately; net is exactly gross minus both fees. A fee below one atomic unit rounds to zero. Existing orders retain their agreed accounting, including legacy orders predating the author fee. Old open listings lacking the current policy must be relisted with fresh authorization.
+New v3 XMR prices and fees use integer 12-decimal atomic units. Buyer gross is the exact signed listed amount; there is no USD conversion or gross-up. Each fee rounds down separately; seller net is exactly gross minus both fees. A fee below one atomic unit rounds to zero. Historical v2 orders retain their original USD cents, mock-XMR quote and accounting, including legacy orders predating the author fee. Eligible old open listings are read-only until the seller retires and relists with fresh v3 authorization.
 
 Fees apply to completed marketplace sales—not listing creation, auction bids, free NFT transfers or card-for-card trades. Failed/expired/refunded orders do not produce successful payout accounting. There is **no finalized live processor/network-fee or refund-cost policy**; one must be disclosed before real payments are enabled. The test numbers are not a promise about future all-in costs.
 
@@ -103,7 +103,7 @@ There is currently **no built-in arbitration service, buyer insurance, chargebac
 
 ## What the offline SHKeeper prototype demonstrates—not a live promise
 
-The proposed flow would have the buyer pay gross XMR into the operator's merchant wallet, the host verify it using SHKeeper, the seller sign NFT delivery, and the host pay the seller net plus the separate author allocation after canonical delivery checks. This temporarily entrusts funds to the operator and its processor administration. SHKeeper does not by itself guarantee that a seller delivers or that an operator honors a refund.
+The earlier disconnected prototype modeled a USD-denominated SHKeeper invoice, gross XMR into an operator merchant wallet, seller-signed NFT delivery, then operator payout of seller net and the separate author allocation. This would temporarily entrust funds to the operator and its processor administration. SHKeeper does not by itself guarantee that a seller delivers or that an operator honors a refund. This USD invoice prototype is **not connected to the new native-XMR marketplace** and must not be silently used to convert its prices; any future processor path requires verified exact-XMR capability or a separately approved architecture.
 
 The disconnected prototype tests:
 
@@ -134,7 +134,7 @@ Those are **requirements for a future offering**, not assurances already fulfill
 ## A practical checklist for users
 
 1. Check the host's domain, chain and **mock/live status**. Today's release is mock-only: do not pay real XMR.
-2. Review the exact card ID, counterparty, USD price, displayed XMR, both fees, net proceeds and deadlines before signing.
+2. Review the exact card ID, counterparty, native-XMR price (or clearly labeled historical USD price), both fees, net proceeds and deadlines before signing.
 3. Keep the order/listing ID, host origin, agreed terms, status and NFT transfer identity for your records. A screenshot or status label is not independently verified proof of payment; never include secret keys/passwords in evidence.
 4. Use **Your activity** on the same market host to inspect progress. Confirmations refer to canonical inclusion, not a money guarantee. Refresh after a timeout; contact the actual host through a verified channel if one is published.
 5. Sellers: never equate a simulated or buyer-supplied receipt with real payment. Buyers: do not assume an off-chain reservation locks the card or guarantees a refund.