hlgov state

namespace

pkgPath

// must match gnomod.toml

KindCancel

KindUnpause

KindTokenISM

KindReserved

// reserved (§13): the client's state layout is fixed for the deployment's life; refused

KindGuardians

KindRouter

KindProtocolFee

KindUpgrade

KindSuccessor

KindMintLimits

// set mint limits (§13): a token's per-message maximum and day cap on the pausable ISM; the 7-day group

maxCancel

// numbers one cancel names

maxProtocolFee

// lamports: the mailbox's max\_protocol\_fee, 0.05 SOL, fixed at its init (§5.5)

MaxDecisionBody

syncReach

// a sync sequence raises the counter by at most this (the realm's own bound, §13; kind 10 is reserved since v35)

seatCount

guardianSeats

maxSeatChanges

// kind 5: two guardian seats plus either watch slot

launchRecipient

// the admin program 4ogRnw9iPGa4dY8qqCs1aBWxHQvKSzHh5ttz53sLFTM9

launchPausableISM

// the pausable ISM 6oudxto59ktYrpvqEVXTb5Tuo7vzBpkgnsPWoPXVF5Fv

launchClient

// the light client 2mphYtLZ7HnCfrFhGH2c4Do9C9UoysevkmkDb8UkbAu2

launchSolSeat1

// Nz2u3N3RAMwq9pjw1Vv7ktN7nX4rNe4Uw5rdL9o9c3o

launchSolSeat2

// AvqEe2hdx3HH87NU9CR5GSarCD1sR6PQ2H5AjwSnC4b

launchSolSeat3

// B5NgM4oD1vYKTEGSe33RaSsHbyGzxKvoaycGqhjbyEV1

launchSolSeat4

// Q8HoML8efSufEhvYsSffmHAGJ6YnYb2QwyMVwQYt9Ds

launchSolSeat5

// 2hxnxGiPf6cuuYXjThehyDnkXpUKjQai8fp14zkcgzjB

launchSolSeat6

// 3SpxeQf1JTfErvkpd3Kq33Q72H4yhLynKPVECdj9ckmf

launchSequence

launchGovernor

launchGovernor is the governor (M1k): the mailbox's, compiled here too so a member reads it in this realm's served source; init refuses a deploy with another. bridge/local/e2e.sh swaps it for gnodev's test1.

destination

recipient

former

// every decision recipient a swap replaced (R29): retired admin programs, which kind 9 and a swap refuse for good

client

// the light client: shown on the page; no kind names it (kind 4 is reserved)

solSeats

// Solana's seats as this realm last set them: a mirror kind 5 warns against, shown on the page

last

// the number of the last decision dispatched; the next is last + 1

sent

// seqKey(number) → \*decision

ledger

decision

decision is one dispatched decision: its body (kind ‖ number ‖ params) and its dispatches; a kind 6 for a route of this chain also keeps the route it enrolled and the height it noted with the mailbox (R37: a cancel of it clears that note while it is the latest).

recipientParams

sequenceParams

cancelParams

kindParams

init.43

mustKey

now

itoa

u64s

hx

seqKey

caller

mustBeLive

Request

Request is what a builder returns (M1k): the proposal GovDAO's proxy executes after the yield (Proposal), and the same decision the governor runs directly before it (Govern); see hlgnot's.

who

who names a previous realm in a refusal: its pkgpath, or a user's address.

mustBeGovernor

mustBeGovernor is a decision's identity check (M1k), read from the closure's own live cur: the governor's own call until it yields on r/hlmailbox, gno.land/r/gov/dao's proxy exactly after (or from the first block, when no governor was compiled); see hlgnot's.

Govern

Govern is the governor's way in before the yield (M1k): the same closure GovDAO's proxy runs after it, called non-crossing in this frame so it reads the governor from cur.Previous() — and dispatches through the mailbox under this realm's own authority, as the proxy's execution does; refused for anyone else and for everyone once the governor yielded on r/hlmailbox (or when none was compiled); see hlgnot's.

Address

Recipient

Recipient is the program decisions are addressed to, in hex.

Former

Former lists every decision recipient a swap replaced, in hex, oldest first (R29): retired admin programs.

isFormer

mustNotBeFormer

mustNotBeFormer refuses a retired admin program as a kind 9's successor or as the decision recipient (R29): a program whose authorities went to a successor answers Retired to every decision, and a kind 9 naming it dies on its successor\_init (NotInherited), so the decision would pend until a cancel — a wasted vote and a standing line on hlwatch. Checked when a proposal is made, in its closure, and when a queued swap would apply.

Destination

Destination is the Solana domain decisions go to.

Last

Last is the number of the last decision dispatched; Next the number the next one takes; Start the compiled number the counter began at (the predecessor's last number; 0 for a chain's first r/hlgov).

Next

Start

SolSeat

SolSeat is the Solana pubkey this realm last set for a seat (1–4 guardians, 5–6 watch keys), in hex.

Body

Body is a dispatched decision's body in hex, by number ("" if none).

be32

be64

body

body is kind u8 ‖ seq u64 BE ‖ params (§13).

mustFit

mustFit refuses a body above MaxDecisionBody: the one check every dispatch makes, so no builder can author a decision the mailbox cannot deliver.

dispatch

dispatch sends a decision with the next number and records it; a body above MaxDecisionBody is refused first.

Redispatch

Redispatch sends an executed decision again — the same number and parameters, a new message — by anyone, until the admin program has recorded it (a copy it has recorded is accepted and ignored there).

propose

proposeKind

proposeKind is a Solana decision's builder: at execution it dispatches the message and records the decision as applied; the parameters were checked at creation and are checked again then, the body's size with them.

parseNumber

salt

salt is the 8 bytes a cancel body starts with (§13: random, ignored by the program, so no body is predictable and two cancels of one list differ). gno.land gives a realm no block hash, so it is sha256 over what the block and the decision give — the chain id, the height, the block time, the mailbox's nonce, the decision number and the ledger's next id — drawn in the executing transaction; the decision number alone makes two cancels of one list differ, the rest make it as unpredictable as the block it lands in.

NewCancelRequest

NewCancelRequest is kind 1: cancel pending decisions of the mailbox channel on Solana (channel 0, the only one this realm writes), by a list of numbers (comma separated, at most 16: form 0) or by a range "from-to", inclusive (form 1); each number one this realm dispatched. It executes at once there. The body is \`salt u64 ‖ form u8 ‖ …\` (§13), the salt drawn when the proposal executes, so the description names the numbers and the ledger's note and the decision's page carry the salt.

eachCancelled

eachCancelled walks the decisions a cancel's numbers name — the list, or every dispatched number of the range — in number order.

NewUnpauseRequest

NewUnpauseRequest is kind 2: clear the flags set before its delivery on the pausable ISM (object 0) or the admin program (object 1), 24 hours after it arrives, unless two guardians' flags hold.

parseToken

NewSetTokenISMRequest

NewSetTokenISMRequest is kind 3: point a token (0 GNOT, 1 BUBBLE) at the pausable ISM, or at none (all zeros).

NewSetClientLayoutRequest

NewSetClientLayoutRequest is kind 4, which §13 reserves (v27, AM7): the client's state layout the pausable ISM and the immutable admin program read is fixed for the deployment's life (version 1), a client upgrade keeps it, and a new layout is a successor admin program and pausable ISM by kind 9. The builder refuses every call, so no kind-4 message ever leaves here; the admin program refuses one at execution too.

parseSeatChanges

parseSeatChanges reads "seat:pubkey" pairs (comma separated; the pubkey in base58 or hex): seats 1–6, two guardian seats at most, four entries at most, no seat or key twice.

seatWarnings

seatWarnings names the keys that hold a seat as this realm last set it. The real seats are Solana's, and the admin program refuses a seat's current key itself (§6.5), spending the decision: a true no-op. The mirror here can sit ahead of the truth (a kind 5 the admin program spent) or behind it (a kind 5 of another decision moved a seat), so it is no ground to refuse a proposal — the builder warns in the description and the member reads \`hlwatch\`'s list of the seats as they stand.

NewSetGuardiansRequest

NewSetGuardiansRequest is kind 5: replace guardian seats (1–4, two at most) and watch slots (5–6) on Solana, four entries at most. A key that holds a seat as this realm last set it is warned about in the description, not refused: the admin program's own check spends a decision naming a seat's current key, and this realm's mirror of the seats can drift from the truth. It lands 7 days after delivery through any flag or hold.

NewEnrollRouterRequest

NewEnrollRouterRequest is kind 6: enroll a token's remote router for a domain. For gno.land's own domain the router must be a route realm registered with hlmailbox — the launch routes, and the successors their migrations named — as 32 bytes: the synthetic program takes every Dispatch from the router it enrolls as a mint order, and hlmailbox's Dispatch is open to any realm, so any other address would mint synthetic that no lock backs; the token's own route (R36), unmigrated, and — a successor — one that pulled page 0 (R35). The rules are checked when the proposal is made and again when it executes. The closure then notes with the mailbox the route it enrolled and the height (hlmailbox.NoteEnrolled, AR1): that route's refund builder waits 14 days after the note (R37: a week for the delivery, a week for Solana's clock), since a refunded send stays deliverable on Solana until the predecessor's router is replaced; a cancel of the kind 6 clears the note (NewCancelRequest).

routePathOf

routePathOf is the pkgpath of the route realm hlmailbox registers whose address, as 32 bytes, is k; "" if none.

NewSetProtocolFeeRequest

NewSetProtocolFeeRequest is kind 7: the mailbox's protocol fee (lamports, at most its 0.05 SOL maximum) and its beneficiary (the treasurer's Solana key).

NewUpgradeRequest

NewUpgradeRequest is kind 8: upgrade a program from a staged buffer whose ELF hashes to elfHash (sha256, hex) — never the admin program's own id (§13: its upgrade authority is burned, so the decision could only be spent; a new admin program is a successor by kind 9), checked when the proposal is made and when it executes.

NewTransferToSuccessorRequest

NewTransferToSuccessorRequest is kind 9: hand every authority to an immutable successor admin program — never the admin program itself, the decision recipient this realm knows, checked when the proposal is made and again when it executes (a recipient swap landing in between would otherwise turn a pre-armed transfer into one the admin program only spends: it re-points every authority to itself and dies on its own SuccessorInit, the programs lane's S-15), as kind 8 refuses its self-upgrade; and never a former recipient (R29), a retired program whose successor\_init answers NotInherited. The admin program refuses a successor whose programdata shows an upgrade authority; the builder cannot read Solana, so a member checks that by RPC before proposing.

routeMaximum

routeMaximum is a token's per-message maximum on its gno.land route now (base units): what a send may carry out.

NewSetMintLimitsRequest

NewSetMintLimitsRequest is kind 12: a token's (0 GNOT, 1 BUBBLE) per-message maximum and rolling day cap on the pausable ISM, in base units (§13: token u8 ‖ maximum u64 ‖ day cap u64; compiled there at launch as 25,000 a message and 100,000 a day of each token). A maximum of 0 (every mint refused) and a day cap below the maximum (a message at the maximum could never pass) are refused when the proposal is made: the admin program and the pausable ISM take any values, so the nonsense is caught here, as every builder catches it early. The maximum is never below the token's route's per-message maximum on gno.land (R15), checked when the proposal is made and when it executes: a send between the two would leave gno.land and be refused at delivery for good, stranded until a refund by id — so a raise is the Solana limit first (this), the route's maximum after, and a lowering the other way round. It lands 7 days after delivery.

mustRaise

mustRaise refuses a sync sequence that would not raise the counter (§5.3: it never lowers it): n is the number the next decision takes, so the counter becomes n-1, which must be above the counter now — and by at most 2^32, the realm's own bound (§13, R18; kind 10 is reserved since v35 and moves nothing on Solana), so a mistyped number can neither wrap the counter onto numbers the admin program recorded nor put every decision beyond the next number it expects.

NewSyncSequenceRequest

NewSyncSequenceRequest raises this realm's counter so that the next decision takes number n — the number the admin program expects next after a foreign decision took one — at once; nothing moves on Solana. It only ever raises: a number at or below the next one is refused when the proposal is made and again when it executes (the counter may have moved in between), so a number the admin program recorded is never reused.

NewSetDecisionRecipientRequest

NewSetDecisionRecipientRequest changes the program decisions are addressed to, 7 days after the proposal executes: how a successor admin program receives them. Never the current recipient, and never a former one (R29: a retired program answers Retired to every decision) — checked when the proposal is made, in its closure and when the queued change would apply.

NewCancelQueuedRequest

NewCancelQueuedRequest cancels a queued change of this realm (a recipient swap), at once; it is proposed before Launch too.

Execute

Execute applies a queued change (a recipient swap) whose 7 days have passed; anyone may call it. A swap decided while its target was nobody applies only while that holds (R29): one that finds its target the recipient already (a second swap to the same program) or a former recipient (replaced since) is refused and stays pending for GovDAO's cancel; the recipient it replaces joins the former ones.

Render

Render: "" the page; "json"; "decisions" and "decisions.json" the ledger; "decision/\<n>" one dispatched decision.