On-Ramp

Endpoints for adding a property (the on-ramp). A record can be started before an account exists, and what a read returns depends on who is asking:

• Owner reads. A request carrying the owner's signed-in session returns the full on-ramp record, including email, recipients, and collectedFields (the owner's answers to the property questions).
• All other reads. Any other request for the same record returns a redacted view: the property's location and parcel data, media, status, and steps (with signing links and signer details removed), plus the booleans hasEmail and hasRecipients in place of the values. collectedFields is absent.
• Claiming a logged-out start. A start made without a session that creates a record nobody owns yet returns a one-time sessionId. The server stores only a hash, and the secret is bound to the record it was issued for. To bind the record to the signed-in owner, send the secret as the X-On-Ramp-Session header on the first authenticated PATCH of that record, or on a POST to the record's claim operation. A repeat logged-out start on the same unclaimed record rotates the secret only when it presents the current one in X-On-Ramp-Session; without it, the start returns the redacted view, writes nothing, and returns no sessionId. An authenticated start on an existing unclaimed record without the header also returns the redacted view and writes nothing. A start on a record that already has an owner returns the redacted view and no sessionId.
• Claiming by token id. POST /on-ramp/{network}/{contract}/{tokenId}/claim binds an unclaimed record to the signed-in owner, with the owner's verified email and wallet address in the body. A record on the current trust agreement is assigned with the same token id. An unclaimed record on an older trust agreement is retired and replaced by a fresh record for the same parcel on the current agreement, and the response carries the new token id (the old token id reads as superseded and the GraphQL premintSuccessor query follows it to the live record). A record created from a mailed QR code also needs its claim secret in X-On-Ramp-Session. Claiming the same record again from the same account returns it unchanged; a record already claimed by someone else is refused with 409 already_claimed, a QR record without its secret with 403 possession_required, a record whose process has moved past the first steps (or has signed documents, a paid fee, or a live order) with 422 needs_admin, and a record that does not exist with 404 not_found. The GraphQL claimState field on a token reports UNCLAIMED or CLAIMED to any reader, and never who claimed it.
• Authenticated starts. A start made with a signed-in session binds the owner from the session's verified credentials and returns no sessionId.