hlmailbox source realm

The routes a successor announces for (AQ5): a migrate names only a successor announced for its own route, so a slip never sends the GNOT lock to a realm whose code moves BUBBLE, or the other way round.

ActiveVerifier is the pkgpath of the verifier GovDAO chose for an origin ("" if none).

AddRoute registers a successor route realm (a route's migrate names it), so flags can be set on it too, and records the succession both ways (AQ1): the caller's `successor`, the new route's `predecessor`, which is what lets the successor take a message addressed to the predecessor (Process) — the burns name the predecessor until kind 6 enrolls the successor. The path is a deployed realm's: a sub-identity's (`host#subpath`) is refused, since the route powers are keyed by exact pkgpath (mustBeRoute) and such a path would hand them to a token its host mints for free; a path that is a route already is refused (a chain never cycles). A route that migrated already re-points its migration (AR2): its migrate decision names another successor while the first pulled nothing — the route's own state refuses once page 0 moved, and a first successor that migrated on holds the lock, so it is refused here too — and the first's registration is dropped with the flags copied to it, the new path taking its place with the flags standing on the route now.

AnnounceSuccessor is how a realm offers itself as a route's successor (R25): called once from that realm's own code (its init, usually), naming the route it succeeds — GNOT or BUBBLE (AQ5: a migrate names only a successor announced for its own route) — it is kept under the caller's exact pkgpath, which a route's migrate builder and its closure require of the path they name — so the lock never goes to a path with no realm behind it (a typo, or an undeployed path whose namespace owner could deploy anything there and pull the lock). Only an /r/ realm, with its own cur: a sub-realm identity (host#subpath, a token a realm mints for free) is refused as in RegisterVerifier, so every entry costs a package deployment and the listing (render.gno) is bounded. Nothing is ever withdrawn; GovDAO reads the successor's source before it votes, as before.

ClearEnrolled is r/hlgov's word, from its cancel closure, that the kind 6 whose note stands on the route at path was cancelled (R37, AS2): the note goes, so the route's refund gate reads "no kind 6" again and its clock restarts with a re-proposal — before, a cancelled, lost or held kind 6 left the note standing and the gate opened on the realm's clock alone while the predecessor was still the enrolled router. r/hlgov's exact pkgpath alone, for a route; a route with no note is left as it is.

ClearFlag clears the caller's own flag on one function of a route. It resets no meter.

ClearFlags clears every seat's flag for fn on the calling route — the void builder's andUnpause option (§5.3), which reopens payouts in the same closure as the void. It reports whether any flag was cleared.

Count is how many messages went out: the next message's nonce.

Delivered is the block height a message (by id, in hex) was delivered at here; 0 if it never was.

Dispatch sends body to recipient on destination, from whoever calls it — a realm, usually — and returns the message's id. The sender is the caller's address as Hyperlane carries one; the nonce is the message's index in the merkle tree. The event is §13's: id, nonce, origin, destination, sender, recipient, hash.

Dropped is the predecessor whose re-point dropped the realm at path from the line (R35) — a route no more, in nobody's chain, that neither sends (Dispatch refuses it) nor takes (Process refuses it) — or "" for a route, a realm never registered, or one registered afresh since.

DroppedRoutes lists the dropped successors' pkgpaths (R35's tombstones; Dropped names each one's predecessor): routes no more, whose addresses the routes still refuse as a send's recipient and sweep at a credit (AT6), as a registered route's — a holder may have pasted one as a deposit address while its page printed it as the lock's holder to be, and a claim credited to it would be paid into a realm no counter of the line holds. Bounded by the re-points a bridge sees in its life, as Routes is by its migrations.

Enrolled is the block height and unix time r/hlgov last dispatched a kind 6 enrolling the route at path as the token's router on Solana (NoteEnrolled); 0, 0 if never, or for no route. A route's refund builder waits 7 days after it (AR1).

Execute applies a queued decision whose 7 days have passed. Anyone may call it; the relayers do. A queued rotation of signers or seats applies only while the set it was decided against still stands: one that finds the signers or the seats changed in between panics (it stays pending; GovDAO cancels it and proposes afresh).

Flagged is whether some guardian's standing payouts flag on route names this claim — by its message id, or by a range covering the height it was credited at (a "since" range only if the verifier credited it): the test that makes GovDAO's void of that claim at once (§5.3). A watch key's flag never counts.

Flags lists the standing flags of a route as "fn seat@time[ids…]" lines.

Govern is the governor's way in before the yield (M1k): the governor — the compiled launchGovernor, by its own transaction (a MsgCall, or the MsgRun script that makes the request in the same transaction; never through another realm) — makes a builder's decision directly, the same closure GovDAO's proxy runs after the yield: the same checks, the same at-once test, the same 7-day queue and 14-day deadline, the same record and events. The closure is called non-crossing, in this frame, so it reads the governor from cur.Previous() as it reads the proxy after the yield. Refused for anyone else, and for everyone once the governor yielded (or when none was compiled): GovDAO's proposals decide then. A request past its 14 days is refused (the deadline error, as a proposal's denial) and made afresh.

Hook is this mailbox's merkle tree hook id in hex: the 32 bytes every checkpoint for a message from here names.

IsGuardianSeat is whether a seat number is a guardian's (1–4) rather than a watch key's (5–6).

IsRoute is whether a pkgpath is one of the route realms this mailbox keeps flags for.

LaunchOrigin is the Solana domain the launch values name.

LaunchedAt is the unix time the Launch decision executed, 0 before: the routes' meters start empty there.

Live is whether the Launch decision has executed: before it the routes refuse sends and credits.

LocalDomain is this chain's Hyperlane domain id.

MarkDone marks a message id delivered without a message: a route's credit-by-vote (§5.3) does it, so the id can never be credited twice. Only a registered route may call it, and only for an id not done.

Message is the message dispatched with this nonce, in hex, and the tree's root right after it ("", "" if none).

NoteEnrolled is r/hlgov's note, from its kind-6 closure, that it dispatched a decision enrolling the route at path as the token's router on Solana at this block height (AR1): the route's refund builder and its apply read it (Enrolled) and refuse a refund until the note is 14 days old (R37: a week for the delivery, a week for Solana's own clock), since a refunded send stays deliverable on Solana until the predecessor's router is replaced and a refund that lands first lets one stranger's Reemit and delivery mint it twice. The latest note counts: a later kind 6 for the route restarts the wait; a cancelled one clears it (ClearEnrolled). Necessary, not sufficient — the realm cannot see Solana; hlwatch reads the token's enrolled router there and alarms a refund proposal whose successor the token has not enrolled.

NotePulled is the predecessor's note, from its Pull, that the successor its migrate registered has pulled page 0 (R35): the lock and the counters moved with it, so the migration is under way — the route's own state refuses a re-point from here on, and AddRoute refuses one too — and r/hlgov's kind 6 may enrol the successor: before it a kind 6 could name a route a re-point then drops, leaving Solana's token minting for a realm in nobody's chain. Only the route whose successor it is notes it; a second note (a second Pull of page 0) changes nothing.

Paused is what the routes ask: whether any seat's flag for fn stands on route.

PayoutsEpoch is how many times an unpause or a removal cleared a standing payouts flag on route, and when the last one did: the routes empty their meters when it changes (§5.4).

Predecessor is the route whose migrate registered path as its successor; "" for a launch route, or no route.

Process takes a message from another chain for the caller, who must be its recipient — or a route that succeeds the recipient along the chain of migrations (AQ1: a burn addressed to a migrated route is the successor's to credit, once its last page is in; the route decides when), a successor a re-point dropped from that chain counted as a hop of its predecessor's (R35: the line's last realm takes what is addressed to it; the dropped realm itself, a route no more, is refused). metadata is whatever the origin's active verifier needs (the signers' checkpoint and signatures, for the ed25519 one). The message must be for this chain and never delivered; it is marked delivered, then the verifier is asked, and a verifier's error is a panic, so the whole transaction reverts with the mark and the message stays deliverable (§5.1). It is then handed back for the recipient to act on.

Pulled is whether the successor at path pulled page 0 of its predecessor's migration, as the predecessor's Pull noted it (NotePulled): the lock and the counters moved, so the migration is never re-pointed and a kind 6 may enrol it (R35). False for a launch route, a successor that pulled nothing, or no route.

Reemit emits the Dispatch event of a message dispatched earlier again, in this block, by anyone: a message dispatched before a validator-set change, or whose results leaf is bigger than the ISM accepts, is then delivered from a fresh header. The id is unchanged, so the other side's processed-message record still refuses a second delivery.

RegisterVerifier is how a verifier realm offers itself: called once from that realm (its init, usually), it is kept under the caller's pkgpath, which GovDAO names to activate it. Only an /r/ realm may register, and once; a sub-realm identity (`cur.Sub(…)`, a token a realm mints for free, whose pkgpath `host#subpath` passes the prefix test) is refused, so every entry costs a package deployment and the listing (bounded; render.gno) cannot be flooded. Nothing is ever unregistered.

Render:

 1""                  the mailbox's page: the launch values live or waiting, verifiers, signers, seats, flags
 2"decisions"         the decisions page: the last 100 pending and executed per kind
 3"json"              domain, hook, count, root, live, signers, verifiers (the first 20 registered paths and the
 4                    count), seats, flags, routes (each with its predecessor and successor, and the height and
 5                    time of the kind 6 that enrolled it on Solana: enrolled, enrolledAt), successors (the
 6                    first 20 announced paths, the count, and successorRoutes: the route each announced for),
 7                    for the agents
 8"decisions.json"    every decision, as a JSON array
 9"msg/<nonce>"       one dispatched message: {"nonce","id","root","height","message"}; "null" if none
10"msgs/<from>"       up to 20 messages from nonce <from> on, as a JSON array
11"verifiers/<from>"  up to 20 registered verifier paths from offset <from> on, in path order, as a JSON array
12"successors/<from>" up to 20 announced successor paths from offset <from> on, in path order, as a JSON array
13"delivered/<id>"    the block height a message id (hex) was delivered at here, 0 if never

Root is the merkle tree's root now, in hex.

RouteSymbol is the token a realm's route is for (R36): the launch paths' compiled symbols; for every other realm the route it announced itself a successor of (SuccessorFor — a registered successor always announced, AQ5); "" for one that never did. r/hlgov's kind 6 compares it with the token it names, so a slip can never enrol one token's route as the other's router.

Routes lists the route realms' pkgpaths.

SeatOf is the seat an address holds, 0 if none.

SetFlag sets, or re-asserts, the caller's flag on one function of a route: fn is sends, credits or payouts. ids is what a guardian's payouts flag suspects — a comma-separated list of message ids, or a range of credits ("heights:<from>-<to>" inclusive, or "since:<from>" for every credit the verifier makes from that height on) — "" otherwise; a re-assertion replaces it. A watch key's flag never names ids or a range.

SignerKeys is the signer set in hex, comma separated, in the order signatures name them.

Signers is the signer set and its rule: copies, so a verifier can read them and nobody can change them.

Successor is the route path's migrate registered; "" while it never migrated, or for no route.

SuccessorAnnounced is whether a realm at this pkgpath announced itself as a possible successor: what a route's migrate builder and its closure require of the path they name (R25).

SuccessorFor is the route — GNOT or BUBBLE — a realm at this pkgpath announced itself as a successor of (AQ5); "" if it never announced itself. A route's migrate builder and its closure refuse another route's successor.

VacateSeat removes the key in a seat if holder still has it, its flags with it (a payouts flag among them restarting the route's meters): the void builder's unpause option retires keys in the same closure as the void (§5.3). Only a route realm may call it. It reports whether the seat was vacated: a seat whose occupant changed since the proposal named it, or one emptied since, is left as it is (R17), so a replacement that landed in between is never undone by a removal that meant the key before it.

VerifierRegistered is whether a realm at this pkgpath registered as a verifier.

Yield is the governor's one-way hand-over to GovDAO (M1k): from this block gno.land/r/gov/dao's proposals are the only way a decision is made on every bridge realm — each reads Yielded here before it accepts one, so no realm is ever yielded apart from the rest — and Govern is closed for good. The governor alone, by its own transaction; refused when no governor was compiled (GovDAO governs from the first block) and a second time. A decision the governor queued still applies by Execute(id) after its 7 days, or GovDAO cancels it.

Yielded is the block height the governor yielded at (Yield), 0 until then: what every bridge realm reads before it accepts a decision — the governor's own call before, GovDAO's proxy after (decisions.DAOGoverns).

NewCancelRequest cancels a queued decision of this realm, at once. It is the one builder proposed before Launch.

NewLaunchRequest is the launch's builder — the governor's decision like any other (M1k), the launch vote's once the governor has yielded: its execution makes the realms live, once, with the compiled values. It carries the 14-day deadline every builder carries: a passed launch nobody executed within 14 days of its proposal returns the deadline error (GovDAO denies it for good) and the launch is proposed again, so a forgotten vote is never a standing trap. A second execution errors.

NewRotateSeatsRequest replaces or vacates guardian and watch-key seats: changes is "seat:address" pairs, comma separated, an empty address vacating the seat; two guardians at most per proposal; a seat's current key is refused. Removals alone apply at once; any replacement queues the whole proposal 7 days, and a queued one applies only while the six seats still stand as they did when it was decided. A removed or replaced key's flags clear with it. A removal means the key the seat holds when the proposal is made (the description names it): a seat whose occupant changed by execution — a replacement landed in between — is skipped and the note says so (R21), the proposal spent if nothing was left to remove.

NewRotateSignersRequest sets the signer set and its rule together (§5.3): the keys in hex, comma separated, in the order signatures name them; a threshold, or §11.13's two groups (one of each must sign; threshold 0). It applies at once only as a pure removal — the new set a subset of the old, under the live rule pruned of the removed keys (the same threshold; the groups less the keys that leave), which the active verifier says the remaining set can still meet (Satisfiable, decided when the proposal executes); any other change, a lowered threshold among them, is queued 7 days, and a queued rotation applies only while the signer set and rule are still those it was decided against.

NewSetVerifierRequest activates a registered verifier for an origin, 7 days after the proposal executes.

NewUnpauseRequest clears every seat's flag for the named functions of a route (sends, credits, payouts; comma separated), and may vacate one seat in the same stroke (removeSeat, 0 for none — one seat, so §5.3's cap of two guardians per proposal holds by construction; the void builder's unpause option, which takes a list, counts them). The seat's holder now is what the proposal means and is recorded with it: a seat whose occupant changed by execution — a replacement landed in between — is skipped, and the note says so (R17). It applies at once; the builder refuses one that would clear nothing now, and an executed one that finds nothing to clear is spent (recorded, no effect, no meter reset), never queued.

Key is a signer's ed25519 public key.

Request is what a builder returns (M1k): the proposal GovDAO's proxy executes after the yield (Proposal), and the same decision the governor runs directly before it (Govern). The closure is one; only who may run it changes with the yield. A Request comes from a builder alone — the type is this realm's and the closure unexported, so no other code can build one or change what it decides (the construction and conversion guards of the interrealm spec, §3.2 and §8.2) — and a stranger holding one can only hand it back to Govern, which refuses everyone but the governor.

Rule is how many signers must sign: Threshold of the set, or — when both groups are named (§11.13) — one key of GroupA and one of GroupB. The verifier applies it; Satisfiable says whether a set can still meet it.

Verifier decides whether an incoming message is genuine (§5.1). A verifier is a realm; it registers once with RegisterVerifier and GovDAO activates it by pkgpath. Both methods are non-crossing. An implementation is a type declared in the registering realm: its methods then run under that realm's authority (borrow rule #1) and can write nothing of this realm's. A type declared in /p/ with no object to anchor on (`type V int`) would run under this realm's own authority instead — the no-anchor case — which RegisterVerifier cannot tell apart, so GovDAO activates a verifier whose source it has read; what the mailbox hands a verifier is the recipient's bytes (Verify) or a copy of its own keys (Satisfiable), never a value it keeps.