upkeep source realm

 1which calls which     : upkeep -> subscriptions.Expire(cross, id)
 2                        upkeep -> timelock_guardian.Execute(cross, id)
 3why it is necessary   : the reward must be conditioned on the valve
 4                        actually firing. Only making the call from
 5                        inside this realm ties "the valve fired" and
 6                        "the reward is credited" into one atomic
 7                        transaction; observing from outside cannot.
 8caller identity       : downstream sees cur.Previous() = THIS realm,
 9                        not the poking EOA. Both valves are
10                        permissionless BY DESIGN and use the caller
11                        identity for nothing, so the intermediary
12                        changes no authorization outcome. This realm
13                        is not a deputy for any downstream authority
14                        — it holds none to confuse.
15authorization boundary: upstream, anyone may poke (the reward is the
16                        only thing at stake and the pot is the only
17                        source). Downstream, each valve enforces its
18                        own STATE conditions (grace elapsed, delay
19                        matured) exactly as it would for a direct
20                        caller.
21ordering              : downstream call FIRST, reward accounting
22                        AFTER. A downstream abort therefore reverts
23                        the whole transaction before any pot or
24                        ledger mutation exists.
25failure behavior      : any downstream panic (not expirable, too
26                        early, already executed, unknown id...)
27                        aborts this transaction. No partial state,
28                        no reward, by VM atomicity — not by cleanup
29                        code.
30atomicity assumptions : a Gno transaction is all-or-nothing across
31                        realm boundaries; there is no catch/recover
32                        anywhere on this path (and none may be added
33                        — recovery would break exactly this
34                        guarantee).
35value movement        : none crosses the boundary. Both valves move
36                        no coins; the poke transaction must carry no
37                        coins (subscriptions' assertNoSend reads the
38                        ORIGIN envelope unconditionally — measured,
39                        not assumed). Rewards move only inside this
40                        realm's ledger, funded by explicit Fund
41                        transactions.
42downstream rejection  : reward denied automatically — the abort is
43                        the denial.
44downstream trust      : neither valve trusts nor validates the
45                        caller; both validate state. This realm
46                        symmetrically does not trust the downstream
47                        REPLY beyond "it did not abort".
48replay                : enforced downstream. A second Expire on the
49                        same subscription aborts ("subscription is
50                        expired"); a second Execute aborts ("action
51                        already executed"). A poker cannot be paid
52                        twice for one valve event.
53adversarial callers   : an EOA or realm poking with bogus ids,
54                        premature targets, or replays hits a
55                        downstream abort and pays its own gas. The
56                        remaining economic edge — manufacturing
57                        expirable state to farm rewards — differs
58                        per task. sub_expire: every farmed
59                        subscription permanently locks a sub-record
60                        storage deposit of roughly 30,000ugnot at
61                        the observed 100ugnot/byte rate (Expire
62                        flips status; it does not free the record),
63                        which exceeds MaxReward before price and
64                        gas — loss-making at any legal setting.
65                        timelock_execute: a farmed Action record is
66                        small and its deposit can sit below the
67                        cap, so farming resistance there rests on
68                        the admin keeping the setting below the
69                        measured cycle cost. Funders trust the cap
70                        AND the admin's reward policy, not the cap
71                        alone. The pot is a donation either way —
72                        farming can drain it, never third-party
73                        balances.