The vault

The vault is the house's ledger of physical custody: one row for every object it holds, or expects to hold, on a collector's behalf. Where an object is, what it is committed to, and who owns it are three different facts, kept in three columns and never collapsed into one, because collapsing them is how a card comes to be listed that nobody at the house has ever seen.

Three facts, never collapsed#

Every object in the vault carries all three at once. They move independently, they are stored in separate columns, and none of them is inferred from another.

The fact	Its states	Who moves it
Where the object is `custody`	expected → received → verified → outbound → released	The desk, by handling the object. Custody only moves forward, and nothing un-releases: an object that comes back is a new intake with its own history.
What it is committed to `availability`	Available, with the consignment desk, live at auction, listed at a fixed price, sold and settling, on its way to you, released	The owner and the desk, through the doors below. One object is only ever committed to one channel.
Who owns it `owner_user_id`	An account, or nobody yet on an anonymous submission the desk has not bound to one	A sale, or a sale the house unwinds. Ownership changes without the object moving at all.

A custody move is not an economic event

Carrying a card from a collector's shelf into the vault, or back out of it, is not a purchase, a sale, a gain or a loss. An owner transfer inside the vault touches no money column on a holding, and the register books nothing for it. The two ledgers meet only where a real transaction happened: a paid invoice, a settled consignment.

What "vaulted" means, and who is allowed to say it#

Vaulted means one thing on this platform: a named member of the house's staff received the object, checked it against the identity claimed for it, and put it away. It is the transition into verified, it is a desk action, and the actor is written onto the event.

A collector can never self-certify. Nothing an owner types reaches that state, and the free-text location note on a register position is the owner's own note: it prices nothing, counts nothing, and is never read as custody. Where the product says a card is in the Minthouse Vault, a person at Minthouse put it there.

What the collector sees is deliberately small: In transit to Minthouse, Minthouse Vault, Leaving the vault, Released from the vault, and a timeline of what happened and when. The internal storage location never crosses that line, and where the desk has flagged an object for a second look the collector is told that it is under review and not why: the reason is the desk's own working note, and it can concern somebody who is not the reader.

Nothing lists before the house holds it#

The route that turns a submission into a live lot asks the vault first, and refuses a submission with no verified asset behind it. The refusal names the two desk actions that answer it, taking the card in and verifying it, rather than offering an override.

Why the gate exists

A lot used to go on sale the moment the desk clicked, with nothing anywhere in the record saying the physical card had ever arrived. A card could therefore sell, and a buyer could pay for it, before the house had touched it. The gate is the answer, and it is on the listing door rather than in a checklist, because a rule enforced by a habit is enforced until the day it is busy.

One certificate is one live object#

A certification number identifies a single physical slab, so the vault holds at most one live asset per grading company and number. That is a partial unique index in the database, over the rows that have not been released, rather than a check in the code that writes them: a second intake of a certificate that is already here fails at the write, and the desk is told the intake needs a person before it needs a row.

The history is append-only in SQLite itself. Triggers abort any update or delete on the event table, so a custody record cannot be edited into a different past. Every consequential change writes the actor, the states it moved from and to, and, for the transitions the house derives rather than types, an idempotency reference that is unique: applying the same consequence twice is refused by the database rather than by the code that happened to run.

Keeping a purchase in the vault#

A buyer who has paid may keep the card in Minthouse custody instead of having it shipped. Ownership has already moved with the sale; what this decides is where the object sleeps.

The buyer
The choice. On a paid invoice, keep it in the vault or take delivery. Taking delivery is the default and needs no decision: an address and the desk's dispatch do it.
The house
Custody records the buyer. Where the card was a consignor's vaulted asset, ownership transfers and the object does not move. Where it was the house's own inventory, a fresh asset records the buyer's custody of a card the house physically holds.
The house
The shipment ends vaulted. A terminal state of its own, with its own timestamp. No dispatch date and no delivery date are written, because no parcel moved.

Vaulted is constructive delivery

The buyer has everything a delivery gives them except the cardboard, so the clocks run as if it had been delivered. The seven-day buyer protection window starts at the moment custody is recorded, and the consignor's payout becomes eligible on that same clock: the payout gate accepts a delivered shipment or a vaulted one, and neither the buyer's remedy nor the seller's money waits on a courier that was never asked to move.

Two refusals are worth knowing about, because both are the honest answer rather than a convenience:

A consigned lot with no recorded custody cannot be kept. The house does not write a verified row to satisfy a button. If the listing predates the vault ledger, the desk records the custody it actually has, with an actor on the row, and the choice opens after that.
A sale the house has since unwound takes the card back with it. Ownership returns to the consignor, and the door that ships a card home refuses in the meantime rather than waiting for the next sync pass.

The hole that made the second rule explicit

Keeping a purchase clears the asset's link to the lot it was sold as, because the lot is over. The pass that returns ownership after an unwound sale joined through exactly that link, so it never saw a kept card: a buyer who won a dispute was refunded in full and kept the object, and no invariant fired. The sale an asset came from is now read off the asset's own event ledger, which survives every later clearing, and an owner still holding under a disowned sale is named by the reconciliation pass.

Selling a card that is already here#

A vaulted card can be submitted for sale without posting it anywhere. The submission claims the object atomically, by a guarded update that only one submission can win, so a card can never be with two channels at once and a race with a ship-out request resolves rather than double-books.

Lane	What the seller agrees	What the desk may do
Auction	An optional confidential reserve, never above the low estimate.	List it at the agreed reserve, or ask the seller to agree another. Neither raising nor lowering it is permitted.
Fixed price	A price. A fixed price is the floor, so there is no reserve.	List it at exactly that figure, or refuse. A fixed-price sale carries no auction house fee and no seller commission, so the consignor is owed the full price. Conditions of Sale §7.

A seller may take their own open fixed-price listing down while nothing is reserved against it, from their register. An auction consignment is withdrawn through the desk instead, because bidders are owed a word.

Asking for a card back#

The owner
The request. Recorded against the asset, which takes it off the market: nothing can list a card that is on its way to the door.
The house
Out, then home. The desk records the object leaving, and records it arriving. Two calls, because they are two facts and the gap between them is real.

A request is refused, with the reason, where the card is not verified as being in the vault, where the desk has it under review, where it is committed to a sale, and where it sits under a sale the house has disowned.

Derivation, not hooks#

The vault follows the same discipline as the portfolio engine: it does not sit inside the money paths, it reads what they already committed. A sync pass walks the lots, invoices and shipments and applies each consequence exactly once, keyed by that unique event reference: promoted becomes listed, declined becomes available, a passed or withdrawn lot returns the card to its owner's shelf, a paid sale moves ownership, a shipment carries the object out of the building.

The consequence worth stating is the same one: a defect in this module cannot corrupt a settlement, cannot block a close and cannot double-charge an invoice, because nothing in the settlement path calls it.

Reconciliation#

The desk's reconciliation report asks the vault for every way it can disagree with the rest of the record, and each answer names an object rather than a count:

An asset listed against a lot that is not open.
An asset marked sold and settling with no paid invoice behind it.
An owner whose asset points at somebody else's register position.
A live certificate that also sits on another account's open position.
Custody the house holds with no owner attributed to it.
Anything the desk has flagged for review, still waiting on a person.
An owner still holding a card under a sale the house has disowned. The sync pass returns those on its next tick; one standing here means the pass could not, and it is the worst state this ledger can be in.

Custody that predates the ledger is recorded by a desk-triggered backfill: it writes rows for the custody the house can actually prove from the record, open promoted consignments and paid purchases that never shipped, and reports what it cannot prove instead of guessing at it.

What the house undertakes, and what it does not#

What the vault is for

Every custody transition is recorded, with an actor, and the owner can read the timeline of their own object.
Nothing lists until the house has the object and has verified it.
One certificate, one live object, enforced by the database rather than by diligence.
A card in the vault is the owner's. Being in the house's keeping makes it no part of the house's property, and a custody transfer moves no value in either direction.

What is not undertaken, stated rather than left to be assumed

There is no insurance. The house does not insure objects in the vault, does not arrange or hold cover on them, and nothing on this site should be read as saying otherwise.
The published agreements do not say who bears loss or damage while a card is in the vault. Neither the Conditions of Sale nor the Terms of Service allocate that risk, and this documentation will not fill the silence with a guarantee the house has not given. The only published term that touches it is the liability cap in Terms of Service §13. Anyone whose decision turns on the answer should put the question to the desk in writing, in advance, and get the answer in writing.
No storage terms are published. This build charges nothing to hold a card and publishes no schedule of storage fees, and no term is published for how long the house will keep an object. An unsold lot returns at the consignor's expense under Conditions of Sale §7.
Verification is not an appraisal and not a grade. The desk checks that the object is the object the record claims. What it is worth is the register's estimate, and the grade remains the grading company's opinion under Authenticity and enforcement.

On this deployment#

Custody on this deployment is real custody

The catalogue at minthouse.io is real consignments only, so every vault row records a physical card the house actually holds: the ledger, the gate, the append-only history and the reconciliation run exactly as described here, over real objects. Until the first consignments arrive the register is simply empty. The terms under which the house holds a consigned card are the consignment terms in the Conditions of Sale, not this page.