hlgnot source realm

Balance is the ugnot this realm's account holds; it is the lock unless someone sent coins here outside a transfer.

Claim pays up to n claims (n ≤ 20) taking recipients in turns under the meters, the fee as each claim's first installment. Anyone may call it; the relayers do. It returns how many claims it paid something on.

Counters is the identity's five counters (§5.9): sentTotal, paidTotal, owed, voided, lost.

Domain is the Solana domain this route sends to and takes from.

Execute applies a queued decision whose 7 days have passed. Anyone may call it; the relayers do. A sweep payment moves coins out of the lock, so under a standing payouts flag it waits for the unpause like a claim (§5.9: nothing paid under a suspect verifier). A refund is never Execute's (AT2): the state refuses the kind, and GovDAO applies it by NewApplyRefundRequest after hlwatch's Solana check.

Govern is the governor's way in before the yield (M1k): the governor — the compiled launchGovernor, by its own transaction (the MsgRun script that makes the request in the same transaction; never through another realm) — makes a builder's decision directly, the same closure GovDAO's proxy runs after the yield: the same checks, the same at-once test, the same 7-day queue and 14-day deadline, the same record and events. The closure is called non-crossing, in this frame, so it reads the governor from cur.Previous() as it reads the proxy after the yield. Refused for anyone else, and for everyone once the governor yielded on r/hlmailbox (or when none was compiled): GovDAO's proposals decide then. A request past its 14 days is refused (the deadline error) and made afresh.

Locked is the lock: what backs synthetic GNOT on Solana, by the counters (sent − paid).

Migrated is the successor's pkgpath once a migration applied, "" before.

Process takes a token message from Solana and credits a claim to its recipient. Anyone may call it — a relayer, usually — with the verifier's metadata and the message, both in hex. The mailbox checks the verifier and that the message was never delivered; this checks it came from the enrolled router (the old one too, for 7 days after a swap). A refused message stays undelivered and can be brought again. A realm registered as a successor credits nothing before the last page of its predecessor's migration is in (R32) — a message addressed to itself as much as one addressed to the predecessor (AQ1: the mailbox hands a migrated route's messages to its successor) — and a migrated realm refuses before the mailbox is asked: the successor takes it.

Pull is the successor's: once a migrate decision names it, the realm at that pkgpath calls Pull from its own code, page by page from 0, and receives the lock (paid to its address, with page 0) and the records to import, up to 500 a page (the snapshot's More says whether a page follows); a page pulled already hands over nothing. Page 0 moves the lock, so under a standing payouts flag it waits for the unpause like a sweep payment (R27, R16: nothing paid under a suspect verifier); the flag follows the claims to the successor (hlmailbox.AddRoute).

Render:

 1""                the route's page (the first 100 waiting claims and sweep entries, the rest counted)
 2"decisions"       the decisions page: the last 100 pending and executed per kind
 3"json"            the figures for the agents
 4"decisions.json"  every decision
 5"claim/<id>"      one claim by message id, or the swept amount, or "null"
 6"claims/<from>"   up to 100 waiting claims from the <from>-th on, in the page's order, as a JSON array
 7"sweeps/<from>"   up to 100 sweep entries from the <from>-th on, by id, as a JSON array
 8"send/<id>"       one send by message id ({"id","from","amount","at","imported","refunded","writtenOff"}), or "null"
 9"refunds/<from>"  up to 100 sends refunded here from the <from>-th on, by id, as a JSON array (AQ2: what the
10                  monitors read to drop a refunded send from what is in flight)

Router is the enrolled router on Solana, in hex.

TransferRemote sends amount of GNOT to recipient on destination (a Solana address in base58, or 32 bytes in hex) and returns the message id in hex. The call must be a direct user call sending exactly amount + fee in ugnot: the amount is locked here, the fee goes to r/hlfees. The amount is between the minimum and the per-message maximum; a realm's address as recipient is refused.

NewApplyRefundRequest applies a queued refund decision whose 7 days have passed, at once (AT2): GovDAO's own act, the member having read hlwatch's gate first — the token's router on Solana is this realm and the kind 6 is executed there — since this realm cannot see Solana, and a refund applied while the predecessor is still the router lets the refunded sender deliver his send there after it (minted twice, AR1); Execute refuses a refund. The apply is the delay's own: the note's 14 days asked again, the sum at most the lock; under a standing payouts flag it waits for the unpause like a claim (the closure refuses, the proposal retried within its 14 days). Refused for a decision that is no refund, not pending, or not yet due; the description names the refund decision and carries its text, the ids included.

NewCancelRequest cancels a pending decision of this route, at once. It is proposed before Launch too.

NewCreditRequest credits a claim by hand after 7 days: amount (in ugnot) to a recipient under a message id. It marks the id done and refuses an id already done, unless that id's claim stands voided, in which case the claim is restored and its remainder replaced by this recipient and amount at the back of the recipient's queue.

NewMigrateRequest hands the lock, the claims and the send records to a successor realm after 7 days: the successor then calls Pull from its own code and takes them over. The successor must have announced itself to the mailbox from its own code first, for the GNOT route (hlmailbox.AnnounceSuccessor(cur, "GNOT"), R25 and AQ5), and must not be a route the mailbox registers already (R31) — checked when the proposal is made and when it applies, so the lock never goes to a path with no realm behind it, nor to the BUBBLE route's successor by a slip. A realm that succeeds another (a successor registered by its predecessor's migrate) migrates on only once its own import has ended (R31): before page 0 nothing has moved and the lock would be stranded for good.

NewRefundRequest queues a refund of sends by message id (comma separated) to their senders, 7 days: the cure for sends a migration stranded undelivered — the sends imported from the predecessor, once kind 6 has enrolled this realm on Solana for 14 days by r/hlgov's note with the mailbox (AR1, R37: a refunded send stays deliverable there until the predecessor's router is replaced), checked when the proposal is made and when it applies. After the 7 days GovDAO applies it by NewApplyRefundRequest (AT2), never anyone by Execute.

NewRestoreRequest restores voided claims by message id: a withheld one at once, a forged one after 7 days.

NewSetCapFloorRequest sets the day cap's floor (in ugnot): a lowering at once, never below the launch floor; a raise after 7 days.

NewSetFeeFloorRequest sets the fee floor (in ugnot), not above the fee: a lowering at once, a raise after 7 days.

NewSetFeeRequest sets the fee and the minimum together (in ugnot), the fee not below the fee floor: lowering both at once, raising either after 7 days.

NewSetMaximumRequest sets the per-message maximum (in ugnot), never below the minimum: a lowering at once, a raise after 7 days.

NewSetRouterRequest swaps the router (a Solana program id in base58, or 32 bytes in hex) after 7 days; the old router's messages stay accepted for 7 days more.

NewSweepRequest pays sweep entries, named by message id (comma separated, up to 256), to an address after 7 days: their sum, at most the lock. The paid entries are dropped (R19), so none is ever paid, credited by id or voided twice; an entry voided or gone by then is skipped, the decision's note saying so.

NewVoidRequest voids credits by message id (comma separated, up to 256; a claim, or a sweep entry as forged) or by a range of credits ("heights:<from>-<to>", every credit at those block heights; "since:<from>", every credit the verifier made from that height on), closed at the height the proposal is made and covering at most 1,000 credits (a bigger range is split by heights), as withheld (the remainder stays booked, restorable) or as forged (the remainder dropped, the paid part lost; a sweep entry's amount dropped from what is owed). A credit a guardian's standing payouts flag names — by id, or by a range covering it — is voided the moment the proposal executes; the rest wait 7 days. The unpause option takes the unpause builder's parameters — the functions whose flags to clear (sends, credits, payouts; comma separated, "" for none) and the seats to vacate (comma separated, "" for none; each seat's holder now is recorded, and a seat whose occupant changed by execution is skipped) — applied in the same closure, after the void.

NewWriteOffRequest books refunded sends, by message id (comma separated), as lost after 7 days (AR1): a refunded send delivered on Solana after all (a stranger's Reemit) minted a second time against nothing, and the write-off closes the identity by its amount; only a refunded send, once — the member reads hlwatch's DELIVERED line for the id first.

Request is what a builder returns (M1k): the proposal GovDAO's proxy executes after the yield (Proposal), and the same decision the governor runs directly before it (Govern). The closure is one; only who may run it changes with the yield. A Request comes from a builder alone — the type is this realm's and the closure unexported, so no other code can build one or change what it decides — and a stranger holding one can only hand it back to Govern, which refuses everyone but the governor.