v0 source pure

Remaining is what the claim still owes.

Covers is whether a claim credited at height — by the verifier, or not — is in the range.

String says the range in words.

Amount writes base units as whole tokens with the symbol: 12,000,000 → "12 GNOT".

Cap is the day cap: max(the floor, a tenth of the lock).

CheckSend is what a send must satisfy: a positive amount between the minimum and the maximum.

Claim pays up to n claims (n ≤ 20) taking recipients in turns: the oldest open claim of each recipient with something waiting, as much of it as both meters allow, the fee as its first installment, skipping a recipient whose meter is dry. epoch and epochAt are hlmailbox's payouts epoch for this route. It returns how many claims it paid something on; the payments went through env.PayFee and env.Pay.

ClaimJSON is one claim by id, or the sweep entry under that id, or "null".

ClaimOf is a claim by id, or nil.

ClaimsPage is up to PageLines waiting claims from the from-th on (from 0), in the page's order, as a JSON array of ClaimJSON's objects; "[]" past the end.

Credit books an incoming transfer: a claim in the recipient's queue, or — for a burn below the fee, one to a realm address (sweep), or one above the lock — the sweep queue. height is the block height now (what a range names the claim by); epoch is hlmailbox's payouts epoch for the route now (a fresh queue's meter starts there). It returns whether it was swept.

A burn above the lock cannot be honest (a mint needs a lock and a burn needs supply, so the supply is never above the lock): it is swept, owed and paying nobody until GovDAO directs it, which also bounds every claim by the lock. An amount that would overflow what is owed is refused outright (the message stays undelivered), and so is every credit while a predecessor's pages are still arriving (AP4): the relayer brings the message again once the last page is in.

Decide is what a builder's closure does when its proposal executes: it records the decision and settles the at-once test against the live state — a lowering, a cancel, a restore of a withheld claim and the void of ids a guardian's standing payouts flag names apply now; everything else waits 7 days for Execute. A migrate is checked again here (R31, AR2: the state may have moved since the proposal was made) and a cancel, or a migrate that re-points a migration nothing was pulled from, is taken on a migrated route.

DraftApplyRefund: GovDAO's own at-once apply of a queued refund decision whose 7 days have passed (AT2). A refund is the one decision whose gate the realm cannot read — Solana's: the token's router there must be this realm and the kind 6 executed, which hlwatch reads and alarms NOT ENROLLED ON SOLANA while it is not — and anyone's Execute on the note alone let a refunded sender, his id in the proposal's description, apply his refund the day it matured while a kind 6 deferred by one flag left the predecessor the router, then deliver his send there with the published tool: minted twice, the lock short for good. So Execute refuses the kind, and a refund is applied by this builder alone — at once, like an unpause — the member having read hlwatch's gate before the vote. The apply is the delay's own (apply's refund branch: mustBeEnrolled's 14-day note asked again, the sum at most the lock, a send refunded since skipped), and the realm asks its payouts flag of it as of a sweep payment. Refused — when the proposal is made and again when it executes, the proposal surviving for a retry — for a decision that is no refund, one not pending (applied, cancelled), one whose delay has not passed, and until the note is 14 days old. The description names the refund decision and carries its text, the ids included.

DraftCancel: cancel a pending decision of this route.

DraftCapFloor: the day cap's floor; never below the compiled launch floor, and its quarter never below the fee (a recipient's meter holds a quarter of the cap at most and the fee is a claim's first installment, whole: a quarter under the fee would stall every new recipient's first payment, with no flag and no alarm).

DraftCredit: credit a claim by id, by hand (§5.3): refused for an id already done unless its claim stands voided, or the id is a sweep entry's (R11) — the credit then replaces the entry with the claim it names, the cure for a burn to a realm or non-gno recipient, or a diverted credit. The amount is at most the lock (R26, R7's rule for the verifier's credits: a credit above the lock cannot be honest, and a claim above it would ask Claim for coins the lock does not hold); the closure asks again.

DraftFee: the fee and the minimum together; the fee not below the fee floor and not above a quarter of the cap floor (the most a recipient's meter can hold, and the fee is the first installment, whole), the minimum positive and not above the maximum.

DraftFeeFloor: the fee floor; not above the fee, not negative.

DraftMaximum: the per-message maximum; never below the minimum. The description reminds GovDAO of the order a raise takes (R15): the pausable ISM's per-message maximum on Solana (r/hlgov's kind 12) is raised first, since a send above it leaves gno.land and is refused at delivery for good — stranded until a refund by id.

DraftMigrate: the lock, the claims and the send records go to a successor realm at pkgpath — a deployed realm's, never a sub-identity's (`host#subpath`; the mailbox refuses such a route too), never a route the mailbox registers already (R31: the mailbox would refuse it when the migration applies, a week on, the vote wasted), and one that announced itself to the mailbox from its own code for this route (Env.AnnouncedFor: the symbol it named, "" if it never announced itself, R25 and AQ5), so the lock never goes to a path with no realm behind it — a typo, or an undeployed path whose namespace owner could deploy anything there and pull it — nor to the other token's successor by a slip. A route that succeeds another migrates on only once its own import has ended (R28, R31): before page 0 nothing has moved, and its MigratedTo would make its Import refuse, the predecessor's Pull revert for ever and the lock sit on the first predecessor, which refuses everything, with no decision that reaches it. The same checks are made again when the migration applies (mustMigrate).

DraftRefund: refund sends by id to their senders — a successor's duty, over the sends it imported from its predecessor (AQ2, §5.3): a refunded send stays deliverable on Solana, so only a send addressed to a router the token no longer enrolls is ever refunded, after kind 6 enrolled this realm — which the realm cannot see, so it reads the note r/hlgov leaves with the mailbox when it dispatches a kind 6 for this route (Env.Enrolled) and refuses until the note is 14 days old (AR1, R37, mustBeEnrolled; asked again when the refund applies): a refund that lands before kind 6 lets one stranger's Reemit and delivery of the refunded send mint it twice, with no realm able to refuse the message. Necessary, not sufficient: the member checks hlwatch first, which reads the token's enrolled router on Solana and the kind 6's state there, alarms a refund proposal whose successor the token has not enrolled and prints DELIVERED beside any id Solana processed — and the apply, after the 7 days, is GovDAO's own at-once decision (DraftApplyRefund, AT2), never anyone's Execute, so that check stands between the delay and the coins. A live route's own send, stranded or not, is never refunded: it waits for a kind 12 (§5.4). The sum is at most the lock (R30, the sweep payment's bound: a forgery paid before its void can leave the lock short of the sends it imported), checked again when it applies.

DraftRestore: restore voided claims, voided sweep entries, or written-off sends, by id — a write-off's inverse (R38): a mistaken write-off (a record two providers showed differently read as delivered, a neighbouring id in a list) books lost for the deployment's life, the watch's "mistaken void" alarm stands as long, and a later forged credit up to that amount moves the alarm's figure and trips nothing; the restore clears the mark and takes the amount back out of lost, after 7 days like a forged claim's restore, since it re-opens the identity.

DraftRouter: the remote router; the old one's messages stay accepted 7 days after the swap applies.

DraftSweep: pay sweep entries, named by id (comma separated, up to MaxIDs), to an address — their sum, at most the lock (R11: a forged entry above the lock is voided, never paid out of coins the lock does not hold). The queue is settled by id (R19): a paid entry is dropped with its index, so it never stands to be credited by id or voided a second time, and the counters never go negative. A voided entry is restored first; a claim's id is no entry's; an entry voided or gone by the time the payment applies is skipped and the note says so.

DraftVoid: void credits by id — a list of up to MaxIDs ids, claims or sweep entries (an entry as forged only), or a Range ("heights:<from>-<to>", every credit at those heights; "since:<from>", every credit the verifier made at or after it), closed at height — the block height the proposal is made at (R14), so what it covers never grows before it executes — and covering at most MaxRangeClaims credits, voidable or not (R23: the walk at execution visits them all), else GovDAO splits it by heights — as withheld or forged, with the unpause option — the functions whose flags to clear (comma separated, "" for none) and the seats to vacate (comma separated, "" for none; seatOf gives each seat's holder now, recorded so a seat whose occupant changes before the proposal executes is skipped, R17), applied in the same closure as the void so the void and the reopening never execute in the wrong order (§5.3). A range must cover a credit the void can take when the proposal is made; one in it the void cannot take as it stands (forged already; withheld, paid or a sweep entry, for a void as withheld) is skipped, not refused.

DraftWriteOff: book refunded sends, by id (comma separated, up to MaxIDs), as lost (AR1) — a refunded send delivered on Solana after all, by a stranger's Reemit before kind 6 replaced the predecessor's router or in the day a hold's lift leaves, minted a second time against nothing, and no builder but this one closes the identity: lock = sentTotal − paidTotal = supply + owed + voided − lost, the amount lost. Only a refunded send, once; the realm cannot see Solana, so the member reads hlwatch's DELIVERED line for each id first and the description says so. After 7 days; an id written off by another decision since is skipped and counted.

Execute applies a queued decision whose delay has passed; on a migrated route only a migrate that re-points a migration nothing was pulled from (AR2: apply asks). Never a refund (AT2): its apply is GovDAO's own at-once decision (DraftApplyRefund), made after hlwatch's check that the token's router on Solana is this realm — a check the realm cannot make and anyone's Execute would skip.

Export hands the state to the successor a page at a time (R13): page 0 carries the counters (the realm pays the lock with it) and every page up to size records — the claims first, every claim ever credited (open, voided and paid, so a void or a restore reaches them on the successor, R12), then the sweep entries, then the sends, a refunded one with its mark (R33: the monitors drop a refunded send from what is in flight by the realm that answers send/<id> for it, so the record is never dropped; the refund counters follow it) — each leaving this state as it goes, so a page outgrows no block however long the route ran. The pages go in order; a page handed over already exports nothing (and the realm pays nothing). Only after a migrate decision applied.

Exported is how many pages went to the successor so far: the next Pull takes that page number.

Figures is the realm's page body: the settings, the identity and the queues. launchedAt is hlmailbox's launch time (the meter is shown as the launch reset leaves it until the first Claim applies the reset).

Import takes a page of a predecessor's snapshot into this state: the counters add (page 0 carries them), the claims keep their ids, states and order — a recipient's queue places every imported claim at a base plus its old seq, and its counter is raised to the predecessor's final one on first seeing the recipient (R20), so this route's own credits land above every place a later page can claim — the open ones queued, the voided and paid ones kept as records, the sweep entries and the sends as they were, a refunded send with its mark, in the refunds index and counted (R33). The pages go in order, each once; from the first to the one that says no more follows, Credit refuses (AP4). epoch is this route's payouts epoch now: the queues it makes start there. Page 0 empties the bridge meter and every quarter as of now and takes launchedAt — hlmailbox's launch time — as the launch the meters were last emptied for (R34): a successor starts with empty meters, as a launch route does at Launch and every route after an unpause, and its first Claim applies no launch reset, which rewound every meter to the launch, months back, and filled them all at once — a third cap in the 24 hours the predecessor closed. The queues a later page makes start empty at their first claim, as every queue does.

Imported is how many of a predecessor's pages this route took in: 0 for a route that succeeded none.

Importing is whether a predecessor's pages are still arriving: from page 0's import until the page that says no more follows (AP4). A successor's adopt loop reads it to know when it is done.

JSON is the figures for the agents; launchedAt as Figures takes it.

MeterLevels is the bridge meter's level now and a recipient's, after refilling under the given epoch.

Migrated is whether the lock went to a successor; every function refuses then.

MustHaveImported is the gate on a message the router addressed to this route's predecessor (AQ1): hlmailbox lets a successor take such a message — the burns name the predecessor until kind 6 enrolls the successor — and this route credits it only once the predecessor's last page is in: before page 0 the lock is not here (the credit would be swept as one above the lock), and between pages Credit refuses anyway. The message waits undelivered meanwhile and the relayer brings it again; after the last page it is an ordinary credit, done once in the shared mailbox. A route that succeeded none refuses such a message for good.

MustSend is the gate on a send, asked by the realm's TransferRemote before anything moves (R35, F28; AT7): a route that succeeds another takes no send before its predecessor's last page is in — the mirror of MustTake — nor before r/hlgov has dispatched the kind 6 enrolling it as the token's router on Solana (Env.Enrolled: the note the kind-6 closure leaves with the mailbox, cleared by a cancel). Before page 0 nothing has moved, so the migration may still be re-pointed (AR2) and this realm dropped: a send through it would lock the sender's coins in a realm Solana never enrols (kind 6 waits for page 0), which cannot refund them (its own send, never a refund's) and cannot migrate (a route no more) — stranded for good. Between pages the lock is only partly here and Credit refuses anyway; a send waits for the last page as a credit does. After the last page and before the kind 6, the token program refuses a sender that is not its enrolled router, so every send would park on Solana until a kind 6 lands — weeks under a hold, never if GovDAO cancels it — unrefundable as the route's own (§5.3: a live route's stranded send waits for a kind 12, since a refund voids nothing on Solana); with the note in, a send parks a week at most (the kind 6's own clock there; a hold defers it, the guardians' sends flag the brake). A launch route sends as it always did: the setup step enrolled it, and no kind 6 ever notes it.

MustTake is the gate on every incoming message, asked by the realm's Process before the mailbox is: toSelf is whether the message names this realm as its recipient, predecessor the route whose migrate registered this one (hlmailbox.Predecessor of the realm's own path, "" for a launch route). A route that succeeds another credits nothing before its predecessor's last page is in — a message addressed to itself included (R32, AR3): before page 0 the lock is not here, so an honest burn to the successor, which kind 6 may enroll the day the migrate applies, would be swept as one above the lock, owed and paying nobody until a sweep payment by vote — so every message waits undelivered meanwhile and the relayer brings it again. A message addressed to another realm is a predecessor's (MustHaveImported): taken once the last page is in, refused for good by a route that succeeded none. A launch route takes its own as it always did.

RefundsPage is up to PageLines sends refunded here from the from-th on (from 0), by id, as a JSON array of SendJSON's objects: what the monitors read to drop a refunded send from what is in flight (AQ2); "[]" past the end.

ResetMeters empties both meters as of now (the launch).

RouterAccepts is whether a message from this sender is from the route's router: the current one, or the old one within the 7 days after a swap.

Send records an outgoing transfer that locked amount.

SendJSON is one send by id — {"id","from","amount","at","imported","refunded","writtenOff"}: "refunded" the unix time it was, 0 if not, "writtenOff" the unix time it was written off as delivered on Solana after its refund (AR1), 0 if not, and "imported" whether a predecessor's page brought it (the only sends a refund may name, AQ2) — or "null".

SendOf is the record of a send by id, or nil.

Sends is how many sends are recorded.

SweepOf is a sweep entry by id, or nil.

SweepsPage is up to PageLines sweep entries from the from-th on (from 0), by id, as a JSON array of {"id","swept"}; "[]" past the end.

SweptOf is the amount swept under an id (0 if none), voided or not.