# Optional market hosting and host fee wallet

These are **server runtime** environment variables, not browser settings. The single-node and three-node Compose profiles default the market runtime to off; the gated mainnet and dedicated custody profiles opt in. They do not enable real payments.

| Variable | Default | Effect |
| --- | --- | --- |
| `WIKIDECK_MARKET_RUNTIME_ENABLED` | `0` | `1` opens the local market journal, exposes market APIs, and starts reconciliation. `0` leaves market data untouched, does not reconcile it, and returns 404 for market APIs. Resolve existing orders before disabling a market with unresolved activity. |
| `WIKIDECK_MARKET_ENABLED` | `1` | `0` removes public listings and rejects new listings, bids, purchases, custody reservations and fictitious funding. Node validation, mining, peer sync and free transfers/trades continue unchanged. |
| `WIKIDECK_MARKET_TRADING_ENABLED` | `1` | `0` pauses new trading/funding but keeps public listings browsable. Useful for maintenance/read-only operation. |
| `WIKIDECK_MARKET_HOST_FEE_ADDRESS` | Fixed project author XMR address | Public Monero recipient for the **hosting commission**, independently of the fixed additional author commission. |
| `WIKIDECK_MARKET_FEE_BPS` | `250` | Existing hosting commission rate, in basis points; range 0–5000. |
| `WIKIDECK_CUSTODY_MODE` | `off` in the application | Existing custody-service control: `off` or testnet-only `sandbox`. The dedicated custody Compose stack deliberately enables `sandbox` and provisions PostgreSQL. |

Booleans accept exactly `0`/`1`; malformed or empty flags fail startup. The fee address must be a checksum-valid **mainnet Monero standard address or subaddress** under the current XMR policy; integrated addresses, URLs, other networks and blank values are rejected. It is not a private key, buyer deposit address, or proof of ownership. No RPC/wallet access is needed to validate it.

Default wallet:

44xHcCdFhW4b951yBHpkTPdLSJ85qTCnFQ8N7m96TtqqRL3dbhzbEH4fe2SJ3a6ESHcNyzCYH5nYJ9ActR1JtkeA7QYGbQv

Set supported variables in the shell/Compose environment or a local Compose environment file, then recreate the intended app container. They are not browser build variables. Merely restarting a container does not replace its environment. The quick-start single-node and three-node profiles deliberately leave the market runtime off; explicitly enable it only for an operator-managed market. In the three-node configuration shared values apply to all nodes; per-service environment overrides allow different hosts/fees. Do not point independent markets at a shared financial schema.

## Existing obligations remain available

Turning off the market runtime is **not a funds freeze or deletion**. The market journal is preserved, but APIs and reconciliation are unavailable until the runtime is enabled again; this can pause existing-order resolution. Do not disable or stop an active market with unresolved orders or custody liabilities. PostgreSQL remains required if that node has PostgreSQL-backed liabilities; the switch is not a shortcut to abandoning custody responsibilities. The separate `WIKIDECK_MARKET_ENABLED=0` policy is different: it pauses new activity while retaining the market runtime and its existing resolution controls.

A peer that never wants custody can leave `WIKIDECK_CUSTODY_MODE=off`; mining, peer sync, and free card transfers/trades do not require the market runtime or dedicated PostgreSQL stack.

## Fee recipient and signature compatibility

New native-XMR listings and custody listings snapshot the configured host fee address. Buyer checkout/reservation must authorize that same recipient. Both UIs show it during review and include it in signed terms. Recipient tampering invalidates the signature, and an unsigned/omitted recipient is accepted **only as the historical default author address**, never as authorization for an arbitrary configured wallet.

Existing signature bytes remain valid: omission retains the original message; explicitly supplied recipients add a domain-tagged fee tuple. Old USD/native-XMR records are not rewritten. Changing the environment changes **new listings**, not existing listings/orders or accumulated revenue. New checkout against an old listing follows its original recipient. For a new recipient, cancel/relist with fresh seller authorization. Hosting rate and the fixed 1% author policy remain separate; defaulting both recipients to the same wallet does not merge the rates.

The custody SQLite fixture records newly settled simulated host revenue under its snapshotted recipient. PostgreSQL production settlement/host withdrawals are still unimplemented: configuring an address does not create automatic transfers. Historical unallocated host revenue remains historical; it is not silently reassigned. The offline sale-lock candidate now preserves the hosting recipient in a tagged signed-terms extension. A [disposable PostgreSQL accounting rehearsal](custody-sale-rehearsal.md) verifies that the signed snapshot receives simulated revenue even after current host policy changes; this is not active-chain delivery or a live host withdrawal service.

Validation: current TypeScript/Vite build, 172 offline regressions and 31 PostgreSQL integration tests passed. Tests cover strict flag/address validation, paused/disabled behavior, continuing existing-order delivery, preserved balances/cancellations, signed-recipient tampering and recipient snapshots across config changes, including the isolated accounting rehearsal. Real XMR remains disabled.