hlgov source realm

Body is a dispatched decision's body in hex, by number ("" if none).

Destination is the Solana domain decisions go to.

Execute applies a queued change (a recipient swap) whose 7 days have passed; anyone may call it. A swap decided while its target was nobody applies only while that holds (R29): one that finds its target the recipient already (a second swap to the same program) or a former recipient (replaced since) is refused and stays pending for GovDAO's cancel; the recipient it replaces joins the former ones.

Former lists every decision recipient a swap replaced, in hex, oldest first (R29): retired admin programs.

Govern is the governor's way in before the yield (M1k): the same closure GovDAO's proxy runs after it, called non-crossing in this frame so it reads the governor from cur.Previous() — and dispatches through the mailbox under this realm's own authority, as the proxy's execution does; refused for anyone else and for everyone once the governor yielded on r/hlmailbox (or when none was compiled); see hlgnot's.

Last is the number of the last decision dispatched; Next the number the next one takes; Start the compiled number the counter began at (the predecessor's last number; 0 for a chain's first r/hlgov).

Recipient is the program decisions are addressed to, in hex.

Redispatch sends an executed decision again — the same number and parameters, a new message — by anyone, until the admin program has recorded it (a copy it has recorded is accepted and ignored there).

Render: "" the page; "json"; "decisions" and "decisions.json" the ledger; "decision/<n>" one dispatched decision.

SolSeat is the Solana pubkey this realm last set for a seat (1–4 guardians, 5–6 watch keys), in hex.

NewCancelQueuedRequest cancels a queued change of this realm (a recipient swap), at once; it is proposed before Launch too.

NewCancelRequest is kind 1: cancel pending decisions of the mailbox channel on Solana (channel 0, the only one this realm writes), by a list of numbers (comma separated, at most 16: form 0) or by a range "from-to", inclusive (form 1); each number one this realm dispatched. It executes at once there. The body is `salt u64 ‖ form u8 ‖ …` (§13), the salt drawn when the proposal executes, so the description names the numbers and the ledger's note and the decision's page carry the salt.

NewEnrollRouterRequest is kind 6: enroll a token's remote router for a domain. For gno.land's own domain the router must be a route realm registered with hlmailbox — the launch routes, and the successors their migrations named — as 32 bytes: the synthetic program takes every Dispatch from the router it enrolls as a mint order, and hlmailbox's Dispatch is open to any realm, so any other address would mint synthetic that no lock backs; the token's own route (R36), unmigrated, and — a successor — one that pulled page 0 (R35). The rules are checked when the proposal is made and again when it executes. The closure then notes with the mailbox the route it enrolled and the height (hlmailbox.NoteEnrolled, AR1): that route's refund builder waits 14 days after the note (R37: a week for the delivery, a week for Solana's clock), since a refunded send stays deliverable on Solana until the predecessor's router is replaced; a cancel of the kind 6 clears the note (NewCancelRequest).

NewSetClientLayoutRequest is kind 4, which §13 reserves (v27, AM7): the client's state layout the pausable ISM and the immutable admin program read is fixed for the deployment's life (version 1), a client upgrade keeps it, and a new layout is a successor admin program and pausable ISM by kind 9. The builder refuses every call, so no kind-4 message ever leaves here; the admin program refuses one at execution too.

NewSetDecisionRecipientRequest changes the program decisions are addressed to, 7 days after the proposal executes: how a successor admin program receives them. Never the current recipient, and never a former one (R29: a retired program answers Retired to every decision) — checked when the proposal is made, in its closure and when the queued change would apply.

NewSetGuardiansRequest is kind 5: replace guardian seats (1–4, two at most) and watch slots (5–6) on Solana, four entries at most. A key that holds a seat as this realm last set it is warned about in the description, not refused: the admin program's own check spends a decision naming a seat's current key, and this realm's mirror of the seats can drift from the truth. It lands 7 days after delivery through any flag or hold.

NewSetMintLimitsRequest is kind 12: a token's (0 GNOT, 1 BUBBLE) per-message maximum and rolling day cap on the pausable ISM, in base units (§13: token u8 ‖ maximum u64 ‖ day cap u64; compiled there at launch as 25,000 a message and 100,000 a day of each token). A maximum of 0 (every mint refused) and a day cap below the maximum (a message at the maximum could never pass) are refused when the proposal is made: the admin program and the pausable ISM take any values, so the nonsense is caught here, as every builder catches it early. The maximum is never below the token's route's per-message maximum on gno.land (R15), checked when the proposal is made and when it executes: a send between the two would leave gno.land and be refused at delivery for good, stranded until a refund by id — so a raise is the Solana limit first (this), the route's maximum after, and a lowering the other way round. It lands 7 days after delivery.

NewSetProtocolFeeRequest is kind 7: the mailbox's protocol fee (lamports, at most its 0.05 SOL maximum) and its beneficiary (the treasurer's Solana key).

NewSetTokenISMRequest is kind 3: point a token (0 GNOT, 1 BUBBLE) at the pausable ISM, or at none (all zeros).

NewSyncSequenceRequest raises this realm's counter so that the next decision takes number n — the number the admin program expects next after a foreign decision took one — at once; nothing moves on Solana. It only ever raises: a number at or below the next one is refused when the proposal is made and again when it executes (the counter may have moved in between), so a number the admin program recorded is never reused.

NewTransferToSuccessorRequest is kind 9: hand every authority to an immutable successor admin program — never the admin program itself, the decision recipient this realm knows, checked when the proposal is made and again when it executes (a recipient swap landing in between would otherwise turn a pre-armed transfer into one the admin program only spends: it re-points every authority to itself and dies on its own SuccessorInit, the programs lane's S-15), as kind 8 refuses its self-upgrade; and never a former recipient (R29), a retired program whose successor_init answers NotInherited. The admin program refuses a successor whose programdata shows an upgrade authority; the builder cannot read Solana, so a member checks that by RPC before proposing.

NewUnpauseRequest is kind 2: clear the flags set before its delivery on the pausable ISM (object 0) or the admin program (object 1), 24 hours after it arrives, unless two guardians' flags hold.

NewUpgradeRequest is kind 8: upgrade a program from a staged buffer whose ELF hashes to elfHash (sha256, hex) — never the admin program's own id (§13: its upgrade authority is burned, so the decision could only be spent; a new admin program is a successor by kind 9), checked when the proposal is made and when it executes.

Request is what a builder returns (M1k): the proposal GovDAO's proxy executes after the yield (Proposal), and the same decision the governor runs directly before it (Govern); see hlgnot's.