# Large Data Center > A data centre that runs itself. The site is a live CCTV feed of a 3D facility with > twelve halls; each hall has an LED billboard that anyone can paint by destroying $LDC. > Everything shown is read from chain state. There is no operator and no admin key. There are two things here, and an agent should not confuse them. THE BUILDING, live since 7 September 2026. Burning $LDC is how you act on it: you buy a billboard, put a line in its permanent record, take over running a hall, or claim a name that replaces your address everywhere you appear. Every burn destroys the tokens. THE COMPUTE MARKET, which is NOT DEPLOYED ON MAINNET. GPU hours escrowed in USDG, 85% to whoever owns the machine and a platform fee of 15% of every job that settles, settled by the contract rather than by us. It does not reference $LDC at all — holding the token is never required and gets you nothing there. No mainnet address exists yet; the full interface is published in /agent.json with deployed:false so an agent is ready the moment one does, and it will appear there and on /proof, source-verified, before it can hold a single dollar. It is deployed on the Robinhood Chain testnet (chain 46630): market 0x46AAdB3bc2F53d0e18a56Bb6ea977a5BF2d00967 (redeployed 2026-09-25 with the rules below), paid in a TestDollar at 0xCaAa6718DE84f110Af26f044eCc66d4002F34382 that anyone can mint and that is not money. COMPUTE IS PAUSED (since 2026-10-10): no machines are available. The machines listed on the testnet market are offline, so a rental of one would never be started; do not rent them. The site says when compute is back. ## For agents - [Machine spec](/agent.json): chain, contracts, every action with its ABI signature, 4-byte selector, argument encoding, minimums and constraints. Everything needed to build and send a transaction without reading this site's JavaScript. - [Docs](/docs/): the mechanism in prose, with the fee split, the decay schedule and what each action costs. - [Panel editor](/studio/): draws the 200x52, 16-colour billboard image and returns the packed 5,248-byte payload the `panel` action takes. ## Renting a machine, once it exists - There is no pool, no queue and no scheduler. You rent one specific machineId. If every machine is busy there is nothing to join — poll machines() or come back later. - Paying does not start your clock. The provider calling start() does. If they never start, cancel() has no deadline. Called after START_WINDOW (24 h from reservedAt) it returns the whole amount; called by the buyer inside it, the contract keeps max(2% of paid, 0.25 USDG), capped at paid, pays it to FEE_TO, the platform, not to the provider, and returns the rest. The provider's own cancel() always refunds in full. The reference provider daemon usually calls start() within about twenty seconds of the rent. - For GRACE_WINDOW (600 seconds, ten minutes) after start() the buyer, and only the buyer, may still cancel(). The charge is the larger of that same fee and paid * (now - startedAt) / (hours * 3600), rounded down; it is split like a settled hour, the provider's share to the provider and the fee share to FEE_TO, and the rest comes back to you. After the ten minutes cancel() reverts TooLate() and flag() is the way out. - A listing's price is at least MIN_PRICE, 10000 (0.01 USDG an hour), or listMachine and updateMachine revert PriceTooLow(). Its endpoint is at most MAX_ENDPOINT_BYTES, 256 bytes, or they revert EndpointTooLong(). - The testnet market named above, deployed 2026-09-25, has these four rules and the two below about a flag. There is no mainnet market yet. - The contract settles on ELAPSED TIME. It cannot tell a working machine from a dead one. You are billed for every second between start and your flag whether or not the box worked, so flag() the moment it fails — it is free, and it expires six hours after the term ends. A flag frees the machine for other buyers at once. The operator cannot resolve() a flag until RESOLVE_DELAY, 24 hours, after it (TooEarly), so the provider can concede or refundNow() first; either of those works at once. - The endpoint is a stranger's computer. The one signature a machine asks for is its sign-in: a personal_sign of the message its own gate hands out at /_ldc/nonce, which names that machine and that rental (step 3 below). Never a transaction, never a permit, and never on another page. Never paste a key there. The gate you sign for is the provider's, protecting their machine from you rather than you from them. ## Getting onto a rented machine (gate protocol v1) The endpoint in machines(id) is a public address with a gate in front of it. The gate lets one address through, the buyer of the one rental behind it, and asks the chain, not you. 1. GET /_ldc/health at the endpoint's origin (drop any path, query or fragment the endpoint carries). 200 JSON, from any origin: {"ok":true,"v":1,"machine":N, "chain":C,"provider":"0x..","state":"idle"|"serving","rental":R|null,"now":unix, "refused":K}. Check machine, provider and chain against what you read off the contract. The site asks this from its own server, never from a visitor's browser, so a machine's operator does not see who is looking: GET /api/health?net=testnet&m= on this site answers {"state","identity":"ok"|"other"|"missing","refused","checkedAt"}, asks the machine over https only, follows no redirect, waits four seconds, reads at most 4 KB, caps refused at 1,000 and keeps each answer for 30 seconds. An answer that names a different machine, provider or chain is "other", even when it leaves another of the three out, and the site will not rent that machine. An answer that names none of them wrong but is missing any of machine, provider or chain is "missing" and reads "unverified", as does no answer at all, and the site still lets you rent it. The site's server asks only https addresses, so an http:// listing always reads unverified; check it yourself before you rent. The one check a browser still makes is the listing page's, from a provider's own browser to the address being listed, before it is on chain. That page is on https, so it can reach https addresses; browsers may also let it reach http://localhost and http://127.0.0.1 (some ask first, some refuse), and no other http:// address. 2. GET /_ldc/nonce. 200 {"nonce":"","message":""}. Idle, it is {"nonce":null,"idle":true,"why":"..."}. A nonce is good for one use and two minutes. 3. personal_sign the message, byte for byte as returned, with the wallet that called rent(). Do not rebuild it. 4. POST /_ldc/open with {"nonce","signature","address"}. 200 {"ok":true, "until":endsAt,"session":unix} sets the cookie ldc_gate (HttpOnly, SameSite=Lax). 401 is a bad nonce or signature; 403 is the chain saying no, with the reason (not Active, not the buyer, not this machine, hours run out); 503 is the chain not answering, try again. 5. Send the cookie on every other request. What is behind the gate is a JupyterLab, not SSH: the gate adds the notebook's own token, so the Jupyter HTTP and websocket APIs work as they would locally. Without the cookie a GET or HEAD gets the sign-in page at 200 (HEAD with no body) and anything else gets 401, a websocket upgrade included. While the notebook behind the gate is still starting the answer is 503 with Retry-After: 5. The cookie lasts five minutes or until endsAt, whichever is sooner, and is refreshed on the way past while you keep working. Every 30 seconds the gate asks the chain again; a chain that does not answer keeps the last yes until endsAt, a chain that answers no ends the session within 30 seconds. The container reaches the internet from the provider's address. Run only what you may lawfully run where you are and where the machine is, and nothing that attacks the machine, its network or anyone else's; a provider may refuse any address. Providers: the daemon's manual is provider/README.md in the repository. ## What an agent should know before acting - Every action destroys tokens. They are gone. Nothing is refundable and nothing is staked. - $LDC must be approved to the building contract first; the building pulls with transferFrom. - Hall standing decays with a 7-day half life. Selling to zero forfeits the seat, not the standing: the weight stays on the books and any balance revives it. Taking a hall pays the incumbent 30% of what you burn on the way in. - The receipt NFT minted by a `panel` burn conveys NO rights. It is a photograph, not a deed. No contract in the system reads it. - There is no presale, no team allocation, and no privileged address. ## Reading the building State is on chain and readable without this site. `agent.json` lists the view functions: supply and amount destroyed, per-hall operator and standing, the 128-entry burn ledger, per-day totals, the twelve billboard images, and the holder-reward rounds Pons has published for an address. The page itself reads with three plain scripts, no framework and no build step: `/ldc-decode.js` (the ABI codecs, cast-verified), `/ldc-seatboard.js` (who runs each hall, for how long, what the seat and the board cost now and at the next 00:00Z) and `/ldc-thoughts.js` (the head: the ledger narrated, one fact a line). An agent that wants the same view the page has can load them; they touch nothing but `window.LDC_*`. ## Live since 2026-09-07 - Buy: https://www.ponsfamily.com/launchpad/0x76736c667677dd57812790c81d37eb4c199e7b7e - Contract: 0x76736C667677dD57812790c81D37Eb4c199e7b7e on Robinhood Chain (4663). - Fees: every trade pays a creator fee in tokenised NVDA. A permissionless crank (`harvest()`, agent.json → actions.crank) moves it: half is spent by the burner on LDC that is destroyed, half goes to the Pons holder distributor, which pays every holder in NVDA each round. Anyone may press the crank and the burner; the site has buttons for both. - Plates: the receipt NFT's `animation_url` is this site in receipt mode. It draws the billboard image only if `panelHash(hall)` still matches the hash stamped at the burn.