Core Concepts
Ownership, lease lifecycle, freeze, and recovery.
Ownership and Control
Control is contract state, not an access key. A leased account runs the hos-wallet contract with zero access keys. The owner operates it from a wallet they already control, through an account named in the wallet’s control set.
The wallet supports Transfer, FunctionCall, and DeterministicStateInit. AddKey, DeleteKey, DeleteAccount, and DeployContract do not exist in the accepted action set, so a leased account cannot acquire a full-access key or delete itself.
Rented-Name Lease Lifecycle
The canonical lifecycle is:
| State | Meaning |
| Active | The lease is current and the account can be operated normally. |
| Grace | The lease has passed its expiry time but remains renewable by its current owner. |
| Reclaimable | The grace period has ended and the name can return to its namespace. |
Expired is not a separate lifecycle state. It is a display condition for the moment the lease term ends; the account is then in Grace.
Freeze
You can freeze your account when you suspect unauthorized access. While self-frozen, operated actions and recovery are rejected. Only the owner-controlled unfreeze path can clear that state.
Recovery
Recovery is optional and configured per account. A recovery completes only when all three checks pass:
- Attestation. The request must come through the approved recovery flow.
- Timelock. The notified owner has a fixed waiting period in which to cancel.
- Watcher quorum. Independent watchers approve the specific destination.
If any check fails, recovery stops. If the account changes while recovery is in progress, the update is cancelled instead of replacing the newer account state.