hlgnot package

Package hlgnot is the GNOT lock: the bridge's GNOT route on gno.land (bridge/PLAN.md §5.2, §5.4, §5.5).

Out. TransferRemote takes the coins a direct user call sends — exactly amount + fee in ugnot — keeps the amount in the lock, pays the fee to r/hlfees, and sends a token message through r/hlmailbox to the synthetic GNOT program on Solana, which mints as much there.

In. A burn on Solana comes back as a token message: Process takes it from the mailbox (which checks the active verifier and that it was never delivered), checks it came from the enrolled router, and writes a claim in the recipient's queue — never a payment on the spot. Claim pays claims in turns under the meters: a tenth of the lock a day (never below the floor), a quarter of that for any one recipient, the fee as the first installment, from a meter that starts empty at launch and after every unpause that clears a payouts flag. A burn below the fee, or to a realm address, is credited to the sweep queue, which only a GovDAO decision pays.

Who may change what. Nobody: every setting moves by a decision made with the builders below (the fee and minimum, the fee floor, the cap floor, the per-message maximum, the router; a void, a restore or a credit by message id; a sweep payment; a refund by id; a migration to a successor), at once or after 7 days as §5.3 says — the governor's own decision through Govern until it yields on r/hlmailbox, a GovDAO proposal's after (M1k); the guardians and watch keys can only pause (sends, credits, payouts) through r/hlmailbox. Every launch value is compiled in below and written at deploy; nothing is sent or credited until the Launch decision executes.

The state machine — claims, meters, counters, the identity of §5.9 — is gno.land/p/…/hlroute/v0; this realm holds the coins and makes the calls.