hlgnot state

namespace

pkgPath

// must match gnomod.toml

mailboxPath

feesPath

bubblePath

// the live token realm, never redeployed

hlbubblePath

hlgovPath

gnot

// one GNOT in ugnot

launchFee

launchMinimum

launchFeeFloor

launchCapFloor

launchMaximum

launchRouter

// the GNOT token program BXpQkFcsHEsqVxvFQ2e4VSgfDSNBCKQsuKx9Qd2xtKj2

maxI64

launchGovernor

launchGovernor is the governor (M1k): the mailbox's, compiled here too so a member reads it in this realm's served source; init refuses a deploy with another. bridge/local/e2e.sh swaps it for gnodev's test1.

st

realms

init.18

mustKey

now

u32

itoa

caller

mustHex

isRealm

isRealm is whether an address is a realm of the bridge: the six compiled here, every route realm the mailbox registers (R39) and every one it dropped (AT6: a re-pointed-away successor, a route no more that nothing of the line can move coins out of) — a successor's address, which its page prints as the lock's holder and a holder pastes as a deposit address, is refused as a recipient at send and swept at a credit, to be credited to its owner by id, never paid into a realm's account outside every counter. A handful of reads.

mustBeLive

mustNotBePaused

mustNotBeDropped

mustNotBeDropped refuses a realm the mailbox dropped from its line (R35): its predecessor re-pointed the migration to another successor while this realm had pulled nothing, so it is a route no more — Solana's token may still name it the router until the next kind 6, and a send or a credit here would be against a lock no realm of the line holds. The mailbox refuses its Dispatch and its Process too; the line's last realm takes every message addressed to it once its import has ended.

syncLaunch

syncLaunch empties the meters at the launch, once: they start empty there as at a deploy (§5.4).

Address

Locked

Locked is the lock: what backs synthetic GNOT on Solana, by the counters (sent − paid).

Balance

Balance is the ugnot this realm's account holds; it is the lock unless someone sent coins here outside a transfer.

Router

Router is the enrolled router on Solana, in hex.

Domain

Domain is the Solana domain this route sends to and takes from.

Fee

Minimum

FeeFloor

CapFloor

Maximum

Cap

Counters

Counters is the identity's five counters (§5.9): sentTotal, paidTotal, owed, voided, lost.

Migrated

Migrated is the successor's pkgpath once a migration applied, "" before.

TransferRemote

TransferRemote sends amount of GNOT to recipient on destination (a Solana address in base58, or 32 bytes in hex) and returns the message id in hex. The call must be a direct user call sending exactly amount + fee in ugnot: the amount is locked here, the fee goes to r/hlfees. The amount is between the minimum and the per-message maximum; a realm's address as recipient is refused.

Process

Process takes a token message from Solana and credits a claim to its recipient. Anyone may call it — a relayer, usually — with the verifier's metadata and the message, both in hex. The mailbox checks the verifier and that the message was never delivered; this checks it came from the enrolled router (the old one too, for 7 days after a swap). A refused message stays undelivered and can be brought again. A realm registered as a successor credits nothing before the last page of its predecessor's migration is in (R32) — a message addressed to itself as much as one addressed to the predecessor (AQ1: the mailbox hands a migrated route's messages to its successor) — and a migrated realm refuses before the mailbox is asked: the successor takes it.

Claim

Claim pays up to n claims (n ≤ 20) taking recipients in turns under the meters, the fee as each claim's first installment. Anyone may call it; the relayers do. It returns how many claims it paid something on.

pay

env

env is what the state machine asks of this realm.

Request

Request is what a builder returns (M1k): the proposal GovDAO's proxy executes after the yield (Proposal), and the same decision the governor runs directly before it (Govern). The closure is one; only who may run it changes with the yield. A Request comes from a builder alone — the type is this realm's and the closure unexported, so no other code can build one or change what it decides — and a stranger holding one can only hand it back to Govern, which refuses everyone but the governor.

who

who names a previous realm in a refusal: its pkgpath, or a user's address.

mustBeGovernor

mustBeGovernor is a decision's identity check (M1k), read from the closure's own live cur: until the governor yields on r/hlmailbox, the governor's own call — the compiled address, by its own transaction (cur.Previous() a user realm: a MsgCall's, or a MsgRun script's ephemeral realm, whose address is the signer's; never another realm), which is Govern's non-crossing call of the closure — and gno.land/r/gov/dao's proposals refused; after it, or when no governor was compiled, the proxy's exact pkgpath, as before M1k, and the governor refused like anyone. A refusal is a panic: a proposal made before the yield survives for a retry after it, within its 14 days.

propose

Govern

Govern is the governor's way in before the yield (M1k): the governor — the compiled launchGovernor, by its own transaction (the MsgRun script that makes the request in the same transaction; never through another realm) — makes a builder's decision directly, the same closure GovDAO's proxy runs after the yield: the same checks, the same at-once test, the same 7-day queue and 14-day deadline, the same record and events. The closure is called non-crossing, in this frame, so it reads the governor from cur.Previous() as it reads the proxy after the yield. Refused for anyone else, and for everyone once the governor yielded on r/hlmailbox (or when none was compiled): GovDAO's proposals decide then. A request past its 14 days is refused (the deadline error) and made afresh.

NewSetCapFloorRequest

NewSetCapFloorRequest sets the day cap's floor (in ugnot): a lowering at once, never below the launch floor; a raise after 7 days.

NewSetMaximumRequest

NewSetMaximumRequest sets the per-message maximum (in ugnot), never below the minimum: a lowering at once, a raise after 7 days.

NewSetFeeRequest

NewSetFeeRequest sets the fee and the minimum together (in ugnot), the fee not below the fee floor: lowering both at once, raising either after 7 days.

NewSetFeeFloorRequest

NewSetFeeFloorRequest sets the fee floor (in ugnot), not above the fee: a lowering at once, a raise after 7 days.

NewSetRouterRequest

NewSetRouterRequest swaps the router (a Solana program id in base58, or 32 bytes in hex) after 7 days; the old router's messages stay accepted for 7 days more.

NewVoidRequest

NewVoidRequest voids credits by message id (comma separated, up to 256; a claim, or a sweep entry as forged) or by a range of credits ("heights:\<from>-\<to>", every credit at those block heights; "since:\<from>", every credit the verifier made from that height on), closed at the height the proposal is made and covering at most 1,000 credits (a bigger range is split by heights), as withheld (the remainder stays booked, restorable) or as forged (the remainder dropped, the paid part lost; a sweep entry's amount dropped from what is owed). A credit a guardian's standing payouts flag names — by id, or by a range covering it — is voided the moment the proposal executes; the rest wait 7 days. The unpause option takes the unpause builder's parameters — the functions whose flags to clear (sends, credits, payouts; comma separated, "" for none) and the seats to vacate (comma separated, "" for none; each seat's holder now is recorded, and a seat whose occupant changed by execution is skipped) — applied in the same closure, after the void.

NewRestoreRequest

NewRestoreRequest restores voided claims by message id: a withheld one at once, a forged one after 7 days.

NewCreditRequest

NewCreditRequest credits a claim by hand after 7 days: amount (in ugnot) to a recipient under a message id. It marks the id done and refuses an id already done, unless that id's claim stands voided, in which case the claim is restored and its remainder replaced by this recipient and amount at the back of the recipient's queue.

NewSweepRequest

NewSweepRequest pays sweep entries, named by message id (comma separated, up to 256), to an address after 7 days: their sum, at most the lock. The paid entries are dropped (R19), so none is ever paid, credited by id or voided twice; an entry voided or gone by then is skipped, the decision's note saying so.

NewRefundRequest

NewRefundRequest queues a refund of sends by message id (comma separated) to their senders, 7 days: the cure for sends a migration stranded undelivered — the sends imported from the predecessor, once kind 6 has enrolled this realm on Solana for 14 days by r/hlgov's note with the mailbox (AR1, R37: a refunded send stays deliverable there until the predecessor's router is replaced), checked when the proposal is made and when it applies. After the 7 days GovDAO applies it by NewApplyRefundRequest (AT2), never anyone by Execute.

NewApplyRefundRequest

NewApplyRefundRequest applies a queued refund decision whose 7 days have passed, at once (AT2): GovDAO's own act, the member having read hlwatch's gate first — the token's router on Solana is this realm and the kind 6 is executed there — since this realm cannot see Solana, and a refund applied while the predecessor is still the router lets the refunded sender deliver his send there after it (minted twice, AR1); Execute refuses a refund. The apply is the delay's own: the note's 14 days asked again, the sum at most the lock; under a standing payouts flag it waits for the unpause like a claim (the closure refuses, the proposal retried within its 14 days). Refused for a decision that is no refund, not pending, or not yet due; the description names the refund decision and carries its text, the ids included.

NewWriteOffRequest

NewWriteOffRequest books refunded sends, by message id (comma separated), as lost after 7 days (AR1): a refunded send delivered on Solana after all (a stranger's Reemit) minted a second time against nothing, and the write-off closes the identity by its amount; only a refunded send, once — the member reads hlwatch's DELIVERED line for the id first.

NewMigrateRequest

NewMigrateRequest hands the lock, the claims and the send records to a successor realm after 7 days: the successor then calls Pull from its own code and takes them over. The successor must have announced itself to the mailbox from its own code first, for the GNOT route (hlmailbox.AnnounceSuccessor(cur, "GNOT"), R25 and AQ5), and must not be a route the mailbox registers already (R31) — checked when the proposal is made and when it applies, so the lock never goes to a path with no realm behind it, nor to the BUBBLE route's successor by a slip. A realm that succeeds another (a successor registered by its predecessor's migrate) migrates on only once its own import has ended (R31): before page 0 nothing has moved and the lock would be stranded for good.

NewCancelRequest

NewCancelRequest cancels a pending decision of this route, at once. It is proposed before Launch too.

Execute

Execute applies a queued decision whose 7 days have passed. Anyone may call it; the relayers do. A sweep payment moves coins out of the lock, so under a standing payouts flag it waits for the unpause like a claim (§5.9: nothing paid under a suspect verifier). A refund is never Execute's (AT2): the state refuses the kind, and GovDAO applies it by NewApplyRefundRequest after hlwatch's Solana check.

Pull

Pull is the successor's: once a migrate decision names it, the realm at that pkgpath calls Pull from its own code, page by page from 0, and receives the lock (paid to its address, with page 0) and the records to import, up to 500 a page (the snapshot's More says whether a page follows); a page pulled already hands over nothing. Page 0 moves the lock, so under a standing payouts flag it waits for the unpause like a sweep payment (R27, R16: nothing paid under a suspect verifier); the flag follows the claims to the successor (hlmailbox.AddRoute).

pausedText

Render

Render: "" the route's page (the first 100 waiting claims and sweep entries, the rest counted) "decisions" the decisions page: the last 100 pending and executed per kind "json" the figures for the agents "decisions.json" every decision "claim/<id>" one claim by message id, or the swept amount, or "null" "claims/<from>" up to 100 waiting claims from the <from>-th on, in the page's order, as a JSON array "sweeps/<from>" up to 100 sweep entries from the <from>-th on, by id, as a JSON array "send/<id>" one send by message id ({"id","from","amount","at","imported","refunded","writtenOff"}), or "null" "refunds/<from>" up to 100 sends refunded here from the <from>-th on, by id, as a JSON array (AQ2: what the monitors read to drop a refunded send from what is in flight)

parseFrom

parseFrom reads a page's offset; -1 (an empty page) for anything but a number.