One purchase.
Many checkpoints.
Every acquisition walks this state machine, one state at a time, with a durable record at each step. Right now nothing walks it at all: there is no verified deployment, so the buyer only accumulates.
Reading the live Zilkroad floor…
The strategy's first operational state: accumulate verified creator receipts while unverified marketplace functionality stays disabled. No purchase order exists, so no state below is active.
Main path
Terminal & intervention states
Failure is a first-class outcome, not an exception. Any of these can end or pause a purchase; a custody mismatch pauses new outflows for reconciliation.

- Marketplace purchase path unverified. Zilkroad's market is live and its public read endpoints (market/stats, market/tokens) are verified read-only observations. No purchase API has been verified and no purchase is authorized: marketplaceBuyVerified is false.
- Conversion route unverified. The ETH → ZEC route and its refund path are untested with exact identities. routeVerified and refundVerified are false.
- Safety caps unconfigured. Price ceiling, max purchase size, daily export cap and outstanding exposure are all null. priceCapsConfigured is false.
Full gate register with required evidence: /status.
| Absolute all-in price ceiling | Not configured |
| Max concurrent acquisitions | 1 |
| Max outstanding export | Not configured |
| Max daily export | Not configured |
“Not configured” blocks activation — it never defaults to unlimited.
A public Refresh re-reads indexed data. It cannot spend treasury funds, submit purchases, or advance any state — only the protected worker, inside the approved policy and funding boundary, moves money. There is no public button that spends.