Three parts, and two of them were already there

A Vigil account is not a Vigil contract. It is a Safe, with CANDIDE's Social Recovery Module switched on, and one guardian: Vigil.

Safe v1.4.1 (L2)                        you are the only owner, threshold 1
 └── module: CANDIDE Social Recovery      7-day grace period, audited (Ackee, v0.0.1)
      └── guardian: Vigil, threshold 1    the only guardian
           └── the will                   heirs (1–5), how many must sign, the silence

Opening one is two transactions from your own wallet: createProxyWithNonce on Safe's factory (the account's address comes from your address and a slot number, so the page finds it again with no database), then one Safe transaction — a MultiSendCallOnly batch — that switches on CANDIDE's module, names Vigil as its only guardian, and writes the will into Vigil. Every owner action after that is one Safe transaction sent from your wallet with Safe's pre-validated signature, which Safe accepts only when the sender is that owner.

From a knock to the keys, call by call

1. knock(account) — from an heir's wallet. Vigil records the time and the Safe's nonce (how many transactions it has ever executed). Refused unless the caller is named in the will (NotHeir), and refused while another knock is still live (AlreadyKnocking).
2. the silence — nothing is called. Any Safe transaction the owner makes raises the nonce, and a knock whose nonce no longer matches is void (OwnerActive). So does answer() ("I'm here") and rewriting the will.
3. claim(account) — from an heir, once the silence has passed to the second (TooSoon before it). Vigil checks the nonce has not moved and that it is still the account's guardian, clears the knock, and calls CANDIDE's confirmRecovery(account, heirs, threshold, execute = true). That is its one power.
4. CANDIDE's 7 days — the module records a recovery that may be finalised after 7 days. The owner can call cancelRecovery() from the account until then; the page's "I'm here" button does exactly that at this stage.
5. finalizeRecovery(account) — anyone may call it after the 7 days. CANDIDE removes the old owner and makes the heirs the owners, with the threshold the will set.

Silence alone does nothing: until an heir knocks, there is nothing to count. A knock is an event on chain (Knocked, naming the heir and the moment it may be claimed), so it is visible to anyone who looks — including the owner, on this site.

The one contract that is ours

contracts/Vigil.sol — 5,354 bytes of runtime, compiled with solc 0.8.26. It is not audited. It has no owner, no admin and no upgrade path; it holds no token and refuses ether. It has exactly five functions that write: setWill, revoke and answer (called by the account itself), and knock and claim (called by an heir). Everything else is a view.

It is deployed through the standard CREATE2 deployer with a fixed salt, so its address — 0xE9A164b27c6b117d124137D1402E227A18aA93E2 — is a function of its bytecode and its one constructor argument, CANDIDE's module. Anyone can rebuild it from this site's source and get the same address; if the address holds different code, it is not Vigil. Its current state: not deployed yet — the first account deploys it.

If it were wrong, the worst it could do is cast its vote too early — which starts CANDIDE's 7 days, which the owner can still cancel. It cannot move anything itself.

Found on this chain, and checked

Nobody announced CANDIDE's Social Recovery Module on Robinhood Chain, but its 7-day deployment is there, at the same address as on every chain CANDIDE lists: 0x088f6cfD8BB1dDb1BB069CCb3fc1A98927D233f2. Before using it, this site checked:

• its code hash is identical to the same address on Base, Arbitrum and Optimism, where CANDIDE deployed it and its source is verified;
• its recovery period — an immutable, baked into the code — reads 604,800 seconds (7 days) out of the runtime itself, and no 3- or 14-day value appears;
• it answers as "Social Recovery Module", version 0.0.1 — the version Ackee Blockchain audited;
• the 3-day and 14-day deployments are NOT on this chain, so the site never offers a grace period that does not exist.

Its README on GitHub describes a newer version, in which changing guardians cancels a pending recovery. The deployed 0.0.1 does not do that, so when you remove Vigil during a hand-over, the page cancels the hand-over first, in the same transaction. The site is built against the deployed source, saved in research/src/srm/, not against the documentation.

Everything passes on. Most of it has a price.

At block 67,307,975, 271 Morpho markets named 262 oracles, which named 82 feeds. 35 tokenized stocks came out of that with a Robinhood USD feed of their own, which is what the page prices them with. 15 did not — 15 of those because their only "oracle" reads a Uniswap pool — and they are still read, still shown and still inherited, just without a price.

Read, inherited, but not priced

What was actually run

Every transaction below was built by js/plan.js — the same file the page loads — and sent on a fresh fork of Robinhood Chain against the real Safe and the real CANDIDE module. Every "refused" is classified by the error it was refused with, and carries a control proving the same call succeeds when the guard is not in the way.

The properties

Broken on purpose

28 of 28 were caught by the property named for them, after the untouched build passed 24/24.

Fuzzed

2 seeds of 57 operations each — including 10 knocks, 4 votes, 2 finished hand-overs and 3 answers that landed — ran clean against the real contracts; then 8 deliberately broken builds were replayed, and 8 were caught by the invariant named for each.

The first fuzz run caught only 4 of 8 planted breaks — not because the other four were safe, but because random walks almost never got through a whole silence to a claim, and the balance invariant only watched the account, not where a withdrawal went. The fuzzer now ends every seed with a scripted walk down the whole path, and checks every wallet's balance.

Read this before you put anything in it

• Silence is not death. If an heir knocks and you say nothing for the whole silence and 7 days more — in hospital, travelling, not looking — the account passes to them. Choose the silence for the longest absence you can imagine.
• Nobody will tell you about a knock. There is no server and no email. The knock is public and this site shows it, but only when you look. Using the account now and then answers any knock.
• An heir who knocks while you are alive learns nothing and loses nothing — but you should talk to them. Each knock starts a new silence.
• Your heirs' wallets are the will. If an heir loses their key, their share of the account is lost with it. Two of three heirs, say, is more robust than one.
• Vigil is not audited. Safe and CANDIDE's module are; the one contract this site adds is not. Its only power is one guardian vote, and a wrong vote still leaves you 7 days to cancel.
• It is not a legal will, and it does not settle taxes, debts or disputes. Tell whoever handles your estate that it exists.
• Robinhood's tokenized stocks have their own rules about who may hold them. An heir must be someone who can.

Everything this site touches

Each one read back on the live chain by tools/verify-infra.mjs, with controls that had to fail. 35 stock tokens and their feeds were checked the same way.