timelock_guardian state

TargetConfig

TargetConfig binds a named target to the only address allowed to schedule actions against it, an enforced minimum delay, and an optional guardian who can veto pending actions. Without this binding a timelock attests nothing: anyone could schedule their own short-delay action against any name and "execute" it.

Action

Action represents a scheduled operation that can only execute after its delay has elapsed, and only within its grace window. State model (re-audit 2026-09-02): only PENDING and EXECUTED actions are stored. Executed records are permanent attestations consumers check via IsExecuted. Cancelled, vetoed, and expired actions are REAPED from state — their history lives in emitted events — so the live-action cap bounds live exposure and can never be consumed permanently by schedule/cancel cycling.

MinDelayFloor

MaxDelay

// 10 years

GracePeriod

// 30 days

MaxTargetsPerOwner

MaxPendingPerTarget

MaxTargetNameLen

MaxDataLen

MaxRenderActions

RenderIndexCap

targets

targetNames

// insertion-ordered for deterministic iteration

ownerTargets

actions

actionIDs

// insertion-ordered render window, self-trimmed to RenderIndexCap

pending

pendingTargets

ptIndex

nextID

init.20

now

rejectStraySend

rejectStraySend aborts when coins are attached to a call (fix Y6): this realm handles no funds and holds no banker, so an attached send would strand on the realm address forever. Aborting reverts the transfer back to the sender. Fails open for realm-routed calls, whose attached send lands on the intermediary realm, never here.

mustGetTarget

mustGet

isValidName

expired

removeID

addPendingTarget

removePendingTarget

removePendingTarget drops a target from the with-pendings list in O(1) by swapping the last entry into its slot. Order afterwards is deterministic (a pure function of the operation history), which is all iteration needs.

dropPending

dropPending removes id from its target's pending list. Bounded: the list never exceeds MaxPendingPerTarget.

reap

reap removes a non-executed action from state entirely; its history is the emitted event. Executed records are permanent attestations: reap refuses them outright (round-2 hardening), so no future caller can erase one by mistake.

sweepExpired

sweepExpired reaps the expired pending actions of ONE target (fix Y4/Y2: the old global budget-windowed sweep let long-delay entries at the front of a shared queue starve everything behind them). A target's list is bounded by MaxPendingPerTarget, so the sweep is a bounded scan. Expiry history is the emitted event.

pendingCount

pendingCount is the length of the target's live list. The counter it replaces (fix Y4) could desync from the lists it mirrored; a length cannot. It may briefly include not-yet-swept expired actions; those are reaped by the next Schedule's sweep or by anyone's Expire, and in the worst case an owner briefly under-uses their own quota — never another tenant's.

sanitize

sanitize makes attacker-controlled text safe to embed in markdown and single-line summaries: backticks, pipes, newlines, link syntax, and raw HTML brackets (fix Y3: gnoweb has no HTML sanitization layer, so a literal \<script> tag must never reach the page) are replaced so a Data string cannot break out of its cell, inject rows or markup, or render a live link.

truncate

truncate shortens s to at most n runes without splitting a multibyte character. n is clamped to a minimum of 4 (re-audit: n\<=2 sliced out of bounds).

RegisterTarget

RegisterTarget creates a named target. The caller becomes its owner — the only address that may schedule actions against it. minDelay is the enforced floor for every action's delay. guardian may be empty (no guardian) or an address empowered to veto pending actions.

SetGuardian

SetGuardian changes (or clears, with "") the target's guardian. Owner only, and REFUSED while the target has pending actions: the guardian's veto power exists precisely to check the owner during a delay window, so the owner must not be able to strip it mid-window. KNOWN LIMIT (documented, round-3 audit): the owner can cancel all pending actions, change the guardian, and reschedule — the price is a full fresh MinDelay on every rescheduled action, and every step emits an event (cancellations + the guardian change below), so observers always get MinDelay of warning under the new guardian regime. Guardians protect open windows, not the owner's future.

TransferTargetOwnership

TransferTargetOwnership OFFERS a target to a new owner; the nominee must AcceptTargetOwnership to complete it (fix Y5: a one-step transfer let anyone fill a stranger's per-owner quota and dump pending obligations — with an attacker-chosen guardian — on an address that never asked). Owner only. Pass "" to clear a pending offer. Nothing changes hands until the nominee accepts.

AcceptTargetOwnership

AcceptTargetOwnership completes a pending ownership offer; only the nominee can accept. The nominee's quota is checked HERE — consent time — so an offer can never overfill an account that did not agree to carry it.

Schedule

Schedule creates a new timelocked action against a registered target. Only the target's owner may schedule. The delay must be at least the target's registered minimum and at most MaxDelay. Returns the action ID.

Execute

Execute marks an action as executed. Anyone can call this — the timelock is the protection, not the executor's identity. The action must exist, be pending, its delay elapsed, and its grace window not yet expired.

Cancel

Cancel removes a pending action. Only the target's CURRENT owner can cancel (re-audit: the scheduling creator's rights must not survive an ownership transfer). The record is reaped; history is the event.

Veto

Veto cancels a pending action as the target's guardian. This is the guardian's whole power: it can stop a scheduled action during the delay window, never create or execute one. The record is reaped; history is the event.

Expire

Expire reaps a provably expired action. Permissionless (fix Y2): an expired action decides nothing — reaping it only writes down what the clock already decided — so anyone may free the quota slot it holds. This is the recovery valve that makes a wedged target impossible: before it, a phantom expired entry consumed quota and blocked SetGuardian until a global sweep happened to reach it; now its own target's owner — or anyone else — reaps it directly.

GetTarget

GetTarget returns a formatted summary of a registered target.

GetAction

GetAction returns a formatted summary of a single pending or executed action. Cancelled/vetoed/expired actions are reaped — their history is in emitted events.

GetPending

GetPending returns the IDs of all pending, non-expired actions, grouped by target, insertion-ordered within a target. Only targets that actually hold live pendings are visited (round-2 fix Y-1), so the scan cannot be inflated by registrations alone.

IsReady

IsReady returns true if the action exists, is pending, its delay has elapsed, and it has not expired.

IsExecuted

IsExecuted returns true if the action exists and was executed. This is the consumer-side check: combined with target registration it attests that the target's registered owner scheduled the action, it waited at least the registered minimum delay, no guardian vetoed it, and it was executed within its grace window. Executed records are permanent.

Render

Render returns a markdown overview. Never panics. Cancelled, vetoed, and expired actions are reaped from state; their history is in events. The page shows the most recent actions only (the ordering index is bounded — fix Y4); older executed records stay queryable via GetAction/IsExecuted forever.

formatAction

renderActionRow