v1 state

Renderer

Renderer draws one token for wallets. Implemented by the view realm.

rendererPath

renderer

RegisterRenderer

RegisterRenderer is called BY the approved view realm, handing over the object that draws. Refused from anywhere else.

registerRenderer

ClearRenderer

ClearRenderer withdraws the art at once, approval included, so the realm that drew it cannot simply register again: approving one takes the timelock. Admin, recovery or guardian.

clearRenderer

RendererPath

HasRenderer

TokenURI

TokenURI is the token's image, as a data: URI, for a token that exists. A renderer that answers nothing gets the built-in card instead: an empty \<img src> is a broken picture in every wallet.

TokenMetadata

TokenMetadata is the token's metadata as a camelCase JSON string, the shape Adena reads. The image is not in it; that is TokenURI.

builtinImage

THE BUILT-IN CARD, for when no view is registered: the name, plainly. Deliberately plain and deliberately free of anything that could go stale. No URL — a domain this realm named could lapse and be bought by somebody else, and the link would then live in every wallet forever — and no colours or claims that a policy change could make wrong.

builtinMetadata

escapeXML

escapeJSON

maxTimelock

executeWindow

maxPathLen

kindAdmin

kindRecovery

kindTrust

kindDelay

kindRenderer

pendingOp

admin

recovery

guardian

timelockDelay

pending

vetoes

veto

isAdmin

isRecovery

isGuardian

assertAdmin

assertAdminOrRecovery

assertCanRevoke

isRealmPath

isRealmPath accepts only a realm package path on this chain. A registry or a view proves what it is by BEING that realm, and its address is derived from the path here, so a wallet can never be trusted (nsdata audit L-4): no wallet address is the hash of a realm path. Ephemeral \`maketx run\` realms (gno.land/e/...), pure packages (/p/) and sub-realm paths (with ':') are refused with it.

liveOp

liveOp is the pending change of one kind, or nil — an expired one is treated as absent everywhere, so it can be neither executed nor used to block a new proposal.

canCancel

canCancel: recovery may cancel anything; the admin what the admin proposed; the guardian the admin's GRANTS — a registry, the art, the timelock — and never a rotation. A hot key able to block rotations could, with recovery lost, block the one change that replaces recovery (and with it, the guardian) for good.

delayFor

delayFor is the wait a proposal gets. An admin replacing RECOVERY waits twice the timelock: it is the one move by which a stolen admin key could eventually take the root role, so it gets the longest window for recovery to see it and cancel it. The case it exists for — recovery lost — only costs a slower replacement.

evicting

evicting reports a live rotation of the admin that recovery proposed — recovery replacing a key it no longer trusts. While admin and recovery are still one key, at the deploy, nothing is an eviction.

byTheAdminAlone

byTheAdminAlone: proposed by the admin, and the admin is not also recovery.

vetoedUntil

vetoedUntil is when the admin may propose \`kind\` again, or 0.

dropVetoesBy

dropVetoesBy lifts the vetoes one key sent: a guardian replaced or stood down, perhaps because it was stolen, does not keep the admin shut out.

dropProposalsOf

dropProposalsOf removes every pending change \`who\` proposed: the admin's plans, the moment recovery proposes to evict it.

setPending

proposeTrust

proposeRenderer

proposeDelay

proposeDelay bounds the value before anything is computed from it, so no input can wrap (nsdata audit L-3), and the proposal shows the value it would set, so a monitor can tell "to zero" from "up".

proposeAdmin

proposeRecovery

cancelPending

executePending

dropOrphans

dropOrphans removes every pending change whose proposer no longer holds a role. Called after each rotation; see the note at the top.

untrust

setGuardian

setGuardian takes recovery, to seat a guardian as much as to replace or stand down a live one — otherwise the first move of a thief holding the admin key would be to point the guardian at themselves, disarming the emergency stop; and seating an EMPTY seat with its own bot left the thief a key that outlived its eviction, untrusting the registry and vetoing the new admin's grants, removable only by recovery (re-audit 2026-10-16, L-4). The deploy seats it while its key still holds recovery. The address must be real (nsdata audit I-4).

clearGuardian

ProposeTrust

ProposeTrust starts trusting a registry, by package path, after the timelock. Admin only.

ProposeRenderer

ProposeRenderer approves a view realm to draw the art, after the timelock. Admin only. The realm then registers itself (art.gno).

ProposeTimelockDelay

ProposeTimelockDelay changes the timelock, after the current one. Admin only.

ProposeAdminTransfer

ProposeAdminTransfer rotates the admin after the timelock. Admin or recovery; when recovery proposes it, the admin cannot cancel it.

ProposeRecoveryTransfer

ProposeRecoveryTransfer rotates recovery after the timelock — twice the timelock when the admin proposes it. Admin or recovery; recovery can cancel either, so a stolen admin key cannot take it.

CancelPending

ExecutePending

ExecutePending applies a matured change. Anyone may call it.

Untrust

Untrust withdraws a registry's power to mint and burn, at once. Admin, recovery or guardian: removing a power is the safe direction, and a registry that has gone wrong must be stoppable in one transaction.

SetGuardian

ClearGuardian

Admin

Recovery

Guardian

TimelockDelay

PendingAdmin

GetPending

ListPending

ListPending names the kinds with a live pending change, comma-separated.

IsTrusted

Trusted

Trusted lists every address that may mint or burn, comma-separated. nsdata compares this with its own address before adopting tokens, so the format is part of the contract: addresses only, no spaces.

TrustedPath

TrustedPath reports the package path a registry was trusted as, or "".

collectionName

collectionSymbol

genesisRegistry

genesisView

token

ledger

trusted

locks

epochs

lastSeq

maxLockBit

Bits a lock value may use. Eight is plenty for a registry and keeps a caller from storing arbitrary integers in a realm that cannot be patched to reject them later.

validLockBits

validLockBits is the range check, alone, so it can be tested directly.

validLockBit

validLockBit checks a bit INDEX, for SetLock. Separate from validLockBits, which checks a whole mask, because confusing the two is exactly the bug SetLock shipped with for one commit.

lockBitsOf

bump

holds

THE HOLDS AND THE EPOCH LIVE IN THE LEDGER'S OWN HOOKS. grc721/v0 calls an issuer-registered extension on every mint, transfer and burn, after the ledger write and before the event, and a panic in a hook aborts the movement. So the two rules this realm exists to keep are enforced at the one place EVERY movement passes through — not in the wrappers below, which merely repeat the hold check to give a clearer error first. Why that matters in a realm that never hands out a Teller: it makes the rules a property of the ledger rather than of whichever entry point a future reader adds or a marketplace finds. A transfer that reaches the ledger by any route moves the epoch, and a held token does not move. Approvals do not pass through a hook, so Approve checks the hold itself. The type is unexported and the only instance is attached to the private ledger, so no other realm can reach these methods.

init.94

assertNoSend

COINS SENT HERE ARE DESTROYED, SO REFUSE THEM. This realm has no banker, no withdrawal and no sweep, and it can never gain one — that is the whole premise of freezing it. Anything attached to a call would sit at its address until the chain ends. Checked only for a direct user call: when another realm calls in, any coins the user attached went to THAT realm, not to this one, and refusing them here would break legitimate registry calls.

assertTrusted

assertTrusted is the whole security model for minting. A caller that can mint can invent a name, and a name is the product. So this is checked against the REALM address of the caller rather than an address it hands us — a registry proves what it is by being it. Only package paths can be trusted (governance.gno), so a wallet can never be in this set.

Mint

Mint creates a token, optionally already held in place. \`lockBits\` is the hold it starts with — a free-tier name is minted locked so there is never an instant in which it could be approved and sold before the registry got round to locking it (nothing runs between the ledger write and the line that sets the bits). Zero for an ordinary paid name.

Burn

Burn destroys a token. Reachable only by a trusted registry, which calls it when a name lapses past its grace period and is reclaimed. NOT reachable by the holder. A GRC-721 that lets an owner burn is correct for collectibles and wrong here: the token is a lease on a name, and destroying it would leave the registry holding a record for a name whose token no longer exists. Letting go of a name is letting it expire. The hold and the epoch are cleared by the burn hook (holds.OnBurn), the per-token approval by the ledger itself.

SetLock

SetLock turns one hold bit on or off. Trusted registry only. The registry decides what a bit means; this realm only guarantees that while any bit is set, nothing moves the token.

assertUnlocked

LockBits

LockBits reports the current hold; 0 means free to move.

IsLocked

Epoch

Epoch reports the ownership epoch of a token, or 0 for one that does not exist. See epochs.

Approve

Approve grants (or, to the empty address, withdraws) the per-token approval. Refused while the token is held: approvals do not pass through a ledger hook, so this is the one place the hold is checked.

RevokeApproval

RevokeApproval withdraws a token's per-token approval. grc721/v0 revokes by approving the empty address; this keeps the named entry point the site and tools already call, and allows it while the token is held — withdrawing a permission is the safe direction. The owner, or an operator acting for the owner, the same two callers Approve accepts.

SetApprovalForAll

TransferFrom

TransferFrom carries NO expiry check, and that is a deliberate reversal of what nslogic once did. Refusing to transfer an expired token is an anti-scam measure, and it belongs in the REGISTRY, not here: this realm does not know what expiry is and must not learn, because the moment it holds policy it stops being the small frozen thing it exists to be. The registry keeps the rule by refusing to RESOLVE an expired name. A buyer can still acquire a worthless token from a careless seller, which is true of every NFT on every chain, and the marketplace disclaimers say so. The hold is checked here for a clear error and again by the ledger hook, which also moves the epoch.

SafeTransferFrom

SafeTransferFrom is kept for the standard signature. grc721/v0 has no receiver hook (gno has no contract-receiver registry to check), so it is TransferFrom — as the vendored version effectively was, its receiver check being a stub that always said yes.

OwnerOf

Exists

BalanceOf

GetApproved

IsApprovedForAll

Name

Symbol

GetName

GetSymbol

TokenCount

TotalSupply

ID

ID is the collection id wallets and indexers key on: "\<this realm's path>.MNS.0000000".

Render

Render builds its string by concatenation rather than with ufmt. NO DEPENDENCIES THIS REALM DOES NOT ABSOLUTELY NEED. It is meant to be deployed once and never replaced, so every import is a permanent commitment to somebody else's package. grc721/v0 (with avl and seqid, which it already depends on) is here because it IS the thing this realm is; a formatter, for one page of text, is not worth that.

itoa

itoa, because importing a package to print one number would outlast every reason we had for wanting it.