Cancel, Reclaim & Recovery

Cancel and reclaim

• A cancel intent at block c is non-terminal: it starts the cancel delay Δ = CANCEL_DELAY.
• Settlement remains possible only while t < c + Δ.
• Cancelled reclaim becomes available at t ≥ c + Δ and returns the escrowed value to the owner.
• An expired escrow can be reclaimed after its expiry, at its grid-rounded public expiry bound.

Checkpoints and emergency exit

Besides the ordinary root history, the pool keeps a ring of checkpoint roots that only the recovery and terminal paths accept. A checkpoint is recorded automatically every K_cp = 64 leaves and can be triggered permissionlessly at most once per P_cp = 50 blocks; the checkpoint ring holds W_cp = 16 roots. Normal admission never accepts a checkpoint-only root. Emergency escrow exit lets an owner leave through a checkpoint root even when the ordinary history has moved on. An operational reserve of R_ops = 65536 leaves keeps the recovery paths insertable.

Terminal consumption

Every terminal path consumes the escrow’s terminal nullifier, so one escrow cannot be settled and reclaimed, or reclaimed twice.

Guardian pause

• The guardian may pause only OPEN, SETTLE and RECLAIM.
• A pause lasts at most 100 blocks and is followed by a 100-block cooldown.
• Exits, cancel, withdraw and checkpoint are never paused.
• The guardian cannot move, seize or redirect funds.