@bananapus/suckers-v6 0.0.78 → 0.0.79

package/src/JBSucker.sol

@@ -10,7 +10,6 @@ import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.s
 import {IJBProjects} from "@bananapus/core-v6/src/interfaces/IJBProjects.sol";
 import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
 import {IJBTokens} from "@bananapus/core-v6/src/interfaces/IJBTokens.sol";
-import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
 import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
 import {JBFixedPointNumber} from "@bananapus/core-v6/src/libraries/JBFixedPointNumber.sol";
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
@@ -37,6 +36,7 @@ import {MerkleLib} from "./utils/MerkleLib.sol";
 
 // Local: structs (alphabetized)
 import {JBAccountingSnapshot} from "./structs/JBAccountingSnapshot.sol";
+import {JBChainAccounting} from "./structs/JBChainAccounting.sol";
 import {JBClaim} from "./structs/JBClaim.sol";
 import {JBInboxTreeRoot} from "./structs/JBInboxTreeRoot.sol";
 import {JBMessageRoot} from "./structs/JBMessageRoot.sol";
@@ -185,6 +185,12 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// double-spend guard.
     uint256 internal constant _INBOX_ROOT_RING_SIZE = 4;
 
+    /// @notice Extra destination gas budgeted per source accounting context carried in a gossip bundle.
+    /// @dev Covers the receiver's per-context storage writes in `_storeChainAccounting`, so the messaging gas limit
+    /// scales with the bundle (via `_messagingGasLimit`) instead of a fixed cap that would bound how large the
+    /// cross-chain mesh can grow before the destination call runs out of gas.
+    uint256 internal constant _MESSENGER_SOURCE_CONTEXT_GAS_LIMIT = 75_000;
+
     /// @notice The depth of the merkle tree used to store the outbox and inbox.
     uint32 internal constant _TREE_DEPTH = 32;
 
@@ -223,10 +229,13 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// @custom:param index The leaf's index in the inbox tree.
     mapping(address token => mapping(uint256 index => bytes32)) public override executedLeafHashOf;
 
-    /// @notice The last known total token supply on the peer chain, updated each time a bridge message is received.
-    /// @dev Used by data hooks to compute `effectiveTotalSupply = localSupply + sum(peerChainTotalSupply)` across all
-    /// suckers, preventing cash out tax bypass on chains where a holder dominates the local supply.
-    uint256 public peerChainTotalSupply;
+    /// @notice The last known total token supply on each peer chain, updated each time a bridge message carries that
+    /// chain's accounting record.
+    /// @dev The registry sums the freshest value across every peer chain to drive cross-chain cash out tax, preventing
+    /// a holder who dominates one chain's local supply from bypassing the tax. Returns 0 for a chain no record has been
+    /// received for.
+    /// @custom:param chainId The peer chain to read the last known total supply of.
+    mapping(uint256 chainId => uint256) public peerChainTotalSupplyOf;
 
     /// @notice The total retained failed-fee ETH excluded from native add-to-balance accounting.
     uint256 public retainedToRemoteFeeBalance;
@@ -242,11 +251,12 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// @custom:param account The address owed the retained ETH.
     mapping(address account => uint256 amount) public retainedTransportPaymentRefundOf;
 
-    /// @notice The source chain freshness key for the most recent accepted peer snapshot.
-    /// @dev Only snapshots with a strictly newer source freshness key are accepted, preventing stale rollbacks.
-    /// Named to align with the `JBMessageRoot.sourceTimestamp` field it tracks.
-    /// Returns 0 if no snapshot has been received yet.
-    uint256 public snapshotTimestamp;
+    /// @notice The source-chain freshness key of the most recent accepted accounting record for each peer chain.
+    /// @dev A record for a peer chain is accepted only when its freshness key is strictly newer than the stored one,
+    /// so stale relays cannot roll back that chain's surplus, balance, or supply. Each peer chain is gated
+    /// independently. Returns 0 for a chain no record has been received for.
+    /// @custom:param chainId The peer chain to read the latest accepted freshness key of.
+    mapping(uint256 chainId => uint256) public snapshotTimestampOf;
 
     //*********************************************************************//
     // -------------------- internal stored properties ------------------- //
@@ -301,12 +311,10 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     // -------------------- private stored properties -------------------- //
     //*********************************************************************//
 
-    /// @notice Caches a local token's authoritative accounting-context currency, derived once and reused on later
-    /// snapshots. A project's accounting-context currency is immutable once set, so the cached value never goes stale;
-    /// only an authoritative read is cached (a not-yet-configured token uses the convention without caching, so a later
-    /// snapshot re-reads it once its context exists).
-    /// @custom:param token The local token.
-    mapping(address token => uint32 currency) private _cachedCurrencyOf;
+    /// @notice Whether a peer chain already has an entry in `_peerChainIds`, so the enumerable set inserts each chain
+    /// at most once.
+    /// @custom:param chainId The peer chain to check membership of.
+    mapping(uint256 chainId => bool) private _isKnownPeerChainId;
 
     /// @notice The ID of the project (on the local chain) that this sucker is associated with.
     uint256 private _localProjectId;
@@ -318,10 +326,19 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// @dev A zero value preserves the default same-address deterministic peer.
     bytes32 private _peer;
 
-    /// @notice The peer chain's per-currency surplus and balance from the latest snapshot.
-    /// @dev Rebuilt from each fresher snapshot; dropped contexts are absent without per-entry versioning or clearing.
-    /// A read sums these and values them into the requested currency.
-    JBPeerChainContext[] private _peerContexts;
+    /// @notice The set of peer chains this sucker holds an accounting record for.
+    /// @dev The registry enumerates this to aggregate every chain's value and to gather records for re-gossiping. A
+    /// chain is appended on its first accepted record and never removed, so the set stays small and bounded by the
+    /// project's chain count.
+    uint256[] private _peerChainIds;
+
+    /// @notice Each peer chain's raw, un-valued per-context surplus and balance from its latest accepted record.
+    /// @dev Stored exactly as received — in the source chain's own token addresses and decimals — so the record can
+    /// be
+    /// re-gossiped to other chains faithfully and resolved to local currencies at read time. A fresher record for a
+    /// chain replaces that chain's set from scratch; a context dropped by the fresher record simply vanishes.
+    /// @custom:param chainId The peer chain to read the raw contexts of.
+    mapping(uint256 chainId => JBSourceContext[]) private _peerContextsOf;
 
     //*********************************************************************//
     // ---------------------------- constructor -------------------------- //
@@ -579,11 +596,9 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
             });
         }
 
-        _storePeerChainAccounting({
-            sourceTimestamp: root.sourceTimestamp,
-            sourceTotalSupply: root.sourceTotalSupply,
-            sourceContexts: root.sourceContexts
-        });
+        // Store every accounting record in the gossip bundle that rode along with this root, keeping the freshest per
+        // source chain. The token-local inbox update above and this per-chain accounting are gated independently.
+        _storeAccountingBundle(root.accounts);
     }
 
     /// @notice Receive a peer-chain accounting snapshot from the remote sucker without updating any token-local inbox
@@ -606,11 +621,8 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
             revert JBSucker_InvalidMessageVersion({received: snapshot.version, expected: MESSAGE_VERSION});
         }
 
-        _storePeerChainAccounting({
-            sourceTimestamp: snapshot.sourceTimestamp,
-            sourceTotalSupply: snapshot.sourceTotalSupply,
-            sourceContexts: snapshot.sourceContexts
-        });
+        // Store every accounting record in the gossip bundle, keeping the freshest per source chain.
+        _storeAccountingBundle(snapshot.accounts);
     }
 
     /// @notice Configure which remote-chain tokens each local terminal token maps to, enabling (or disabling) those
@@ -767,7 +779,9 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         uint256 sourceTimestamp = _nextSourceTimestamp();
         JBAccountingSnapshot memory snapshot = JBSuckerLib.buildAccountingSnapshot({
             directory: DIRECTORY,
+            registry: REGISTRY,
             projectId: projectId(),
+            exceptChainId: peerChainId(),
             messageVersion: MESSAGE_VERSION,
             sourceTimestamp: sourceTimestamp
         });
@@ -868,28 +882,112 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         return _outboxOf[token];
     }
 
-    /// @notice The peer chain's raw per-context surplus and balance from the latest snapshot, bundled with the peer
-    /// chain ID and snapshot freshness key.
-    /// @dev The contexts are un-valued, in each context's own currency and decimals — the registry dedups same-peer
-    /// suckers by freshness, then values each context into a requested currency. The sucker consults no price oracle.
-    /// @return contexts The per-currency surplus and balance from the latest snapshot.
-    /// @return chainId The peer chain these contexts belong to.
-    /// @return snapshot The source freshness key of the latest snapshot.
-    function peerChainContextsOf()
+    /// @notice The raw, un-valued accounting record this sucker holds for every peer chain it has heard about.
+    /// @dev The registry reads this to gather a project's full cross-chain knowledge and re-gossip it. Records are
+    /// returned exactly as received (in each source chain's own token addresses and decimals) so the next receiver
+    /// resolves them to its own local currencies independently.
+    /// @return accounts One raw accounting record per known peer chain.
+    function peerChainAccountsOf() external view returns (JBChainAccounting[] memory accounts) {
+        uint256[] storage chainIds = _peerChainIds;
+        uint256 numChains = chainIds.length;
+        accounts = new JBChainAccounting[](numChains);
+        for (uint256 i; i < numChains;) {
+            uint256 chainId = chainIds[i];
+            accounts[i] = JBChainAccounting({
+                chainId: chainId,
+                totalSupply: peerChainTotalSupplyOf[chainId],
+                contexts: _peerContextsOf[chainId],
+                timestamp: snapshotTimestampOf[chainId]
+            });
+            unchecked {
+                ++i;
+            }
+        }
+    }
+
+    /// @notice One peer chain's per-currency surplus and balance from its latest accepted record, plus that record's
+    /// freshness key.
+    /// @dev Resolves each raw stored context to its local currency and folds same-currency, same-decimals entries
+    /// together. The result is un-valued — the registry values each context into a requested currency; the sucker
+    /// consults no price oracle. Contexts that share a currency but carry different decimals are kept separate because
+    /// the raw amounts are on different scales and cannot be summed directly.
+    /// @param chainId The peer chain to read the contexts of.
+    /// @return contexts The per-currency surplus and balance for the chain.
+    /// @return snapshot The source freshness key of the chain's latest accepted record.
+    function peerChainContextsOf(uint256 chainId)
         external
         view
-        returns (JBPeerChainContext[] memory contexts, uint256 chainId, uint256 snapshot)
+        returns (JBPeerChainContext[] memory contexts, uint256 snapshot)
     {
-        return (_peerContexts, peerChainId(), snapshotTimestamp);
+        JBSourceContext[] storage rawContexts = _peerContextsOf[chainId];
+        uint256 numRaw = rawContexts.length;
+
+        // Copy the raw contexts to memory and resolve each source-local token to a local token (mapping first, identity
+        // fallback). The bytecode-heavy currency resolution and fold then run in the library.
+        JBSourceContext[] memory raw = new JBSourceContext[](numRaw);
+        address[] memory localTokens = new address[](numRaw);
+        for (uint256 i; i < numRaw;) {
+            JBSourceContext storage ctx = rawContexts[i];
+            raw[i] = ctx;
+            address contextToken = _localTokenForRemoteToken[ctx.token];
+            localTokens[i] = contextToken == address(0) ? _toAddress(ctx.token) : contextToken;
+            unchecked {
+                ++i;
+            }
+        }
+
+        contexts = JBSuckerLib.foldPeerContexts({
+            directory: DIRECTORY, projectId: projectId(), localTokens: localTokens, rawContexts: raw
+        });
+        snapshot = snapshotTimestampOf[chainId];
+    }
+
+    /// @notice The peer chains this sucker reports accounting for.
+    /// @dev With `includeVirtual` false, returns only the directly-connected peer chain (the one this sucker is bridged
+    /// to). With `includeVirtual` true, also returns every other chain it has learned about through gossip relayed by
+    /// that peer. The directly-connected peer is always present (with a zero value until its first record) so the
+    /// registry can enumerate the chain the moment this sucker is deployed. Until the sucker receives its first record,
+    /// that entry is an empty sentinel (value 0, freshness 0) which the registry skips, so a freshly-deployed active
+    /// sucker takes over a chain's accounting only once it has synced real data — a deprecated sucker's record keeps
+    /// answering for the chain during the migration window.
+    /// @param includeVirtual Whether to also include virtually-known (gossiped) peer chains.
+    /// @return chainIds The peer chain IDs.
+    function peerChainIds(bool includeVirtual) external view returns (uint256[] memory chainIds) {
+        uint256 directPeer = peerChainId();
+        // The direct peer is a real remote chain — never the local chain or chain 0.
+        bool directValid = directPeer != 0 && directPeer != block.chainid;
+
+        // Directly-connected: just the bridged peer chain.
+        if (!includeVirtual) {
+            if (!directValid) return new uint256[](0);
+            chainIds = new uint256[](1);
+            chainIds[0] = directPeer;
+            return chainIds;
+        }
+
+        // Virtual-inclusive: every chain heard about, plus the direct peer if no record has placed it there yet.
+        bool appendDirect = directValid && !_isKnownPeerChainId[directPeer];
+        uint256 len = _peerChainIds.length;
+        chainIds = new uint256[](appendDirect ? len + 1 : len);
+        for (uint256 i; i < len;) {
+            chainIds[i] = _peerChainIds[i];
+            unchecked {
+                ++i;
+            }
+        }
+        if (appendDirect) chainIds[len] = directPeer;
     }
 
-    /// @notice The peer chain total supply bundled with the peer chain ID and snapshot freshness key.
-    /// @dev Lets aggregators (e.g. `JBSuckerRegistry`) read the value, peer chain, and freshness in one call instead
-    /// of three separate staticcalls. The `value` is identical to `peerChainTotalSupply`.
+    /// @notice One peer chain's total supply bundled with the peer chain ID and the record's freshness key.
+    /// @dev Lets the registry read the value, the peer chain it belongs to, and its freshness in one call. The `value`
+    /// matches `peerChainTotalSupplyOf(chainId)`.
+    /// @param chainId The peer chain to read the total supply value of.
     /// @return A `JBPeerChainValue` with the total supply, peer chain ID, and snapshot freshness key.
-    function peerChainTotalSupplyValue() external view returns (JBPeerChainValue memory) {
+    function peerChainTotalSupplyValue(uint256 chainId) external view returns (JBPeerChainValue memory) {
         return JBPeerChainValue({
-            value: peerChainTotalSupply, peerChainId: peerChainId(), snapshotTimestamp: snapshotTimestamp
+            value: peerChainTotalSupplyOf[chainId],
+            peerChainId: chainId,
+            snapshotTimestamp: snapshotTimestampOf[chainId]
         });
     }
 
@@ -1308,13 +1406,6 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         });
     }
 
-    /// @notice What is the maximum time it takes for a message to be received on the other side.
-    /// @dev Be sure to keep in mind if a message fails having to retry and the time it takes to retry.
-    /// @return The maximum time it takes for a message to be received on the other side.
-    function _maxMessagingDelay() internal pure virtual returns (uint40) {
-        return 14 days;
-    }
-
     /// @notice Cash out project tokens for terminal tokens.
     /// @param projectToken The project token to cash out (unused, kept for interface compatibility).
     /// @param count The number of project tokens to cash out.
@@ -1486,75 +1577,72 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         internal
         virtual;
 
-    /// @notice Store the latest peer-chain accounting snapshot if it is fresher than the cached one.
-    /// @dev The context set is rebuilt from scratch for each fresher snapshot. A stale snapshot is ignored instead of
-    /// reverting so bridge delivery order cannot roll back supply, surplus, or balance.
-    /// @param sourceTimestamp The source-chain freshness key.
-    /// @param sourceTotalSupply The source-chain total project-token supply.
-    /// @param sourceContexts The source-chain per-context surplus and balance.
-    function _storePeerChainAccounting(
+    /// @notice Store every record in a cross-chain accounting bundle, keeping the freshest record per source chain.
+    /// @dev Shared by both inbound paths — `fromRemote` (root) and `fromRemoteAccounting` — so a root send and an
+    /// accounting-only send propagate the same gossip bundle.
+    /// @param accounts The per-source-chain accounting records carried by an inbound message.
+    function _storeAccountingBundle(JBChainAccounting[] calldata accounts) internal {
+        uint256 numAccounts = accounts.length;
+        for (uint256 i; i < numAccounts;) {
+            JBChainAccounting calldata account = accounts[i];
+            _storeChainAccounting({
+                chainId: account.chainId,
+                sourceTimestamp: account.timestamp,
+                sourceTotalSupply: account.totalSupply,
+                sourceContexts: account.contexts
+            });
+            unchecked {
+                ++i;
+            }
+        }
+    }
+
+    /// @notice Store one source chain's accounting record if it is fresher than the one already held for that chain.
+    /// @dev A record for the local chain is ignored — a chain reads its own accounting directly. Each peer chain is
+    /// gated independently on a strictly-newer freshness key, so a stale relay cannot roll back any chain and records
+    /// delivered out of order converge. Contexts are stored raw (in the source chain's own token addresses) so the
+    /// record can be re-gossiped faithfully; each receiver resolves them to its own local currencies at read time.
+    /// @param chainId The source chain the record describes.
+    /// @param sourceTimestamp The record's source-chain freshness key.
+    /// @param sourceTotalSupply The source chain's total project-token supply.
+    /// @param sourceContexts The source chain's raw per-context surplus and balance.
+    function _storeChainAccounting(
+        uint256 chainId,
         uint256 sourceTimestamp,
         uint256 sourceTotalSupply,
         JBSourceContext[] calldata sourceContexts
     )
         internal
     {
-        // Only accept snapshots whose source freshness key is strictly newer than the last accepted one.
-        if (sourceTimestamp <= snapshotTimestamp) return;
+        // A chain reads its own accounting locally, so never store a record describing the local chain — even one a
+        // peer forwarded back to us. Chain 0 is not a real chain ID, so reject it as malformed.
+        if (chainId == block.chainid || chainId == 0) return;
 
-        // Advance the snapshot freshness key used by the registry to dedup same-peer suckers.
-        snapshotTimestamp = sourceTimestamp;
+        // Accept a record only when its source freshness key is strictly newer than the last accepted one for this
+        // chain. Ignoring (not reverting) means bridge delivery order cannot roll a chain back.
+        if (sourceTimestamp <= snapshotTimestampOf[chainId]) return;
+
+        // Advance this chain's freshness key, which the registry uses to dedup redundant same-chain records.
+        snapshotTimestampOf[chainId] = sourceTimestamp;
 
         // Update unconditionally — a legitimate zero supply must clear phantom cached supply.
-        peerChainTotalSupply = sourceTotalSupply;
+        peerChainTotalSupplyOf[chainId] = sourceTotalSupply;
+
+        // Append the chain to the enumerable set on its first accepted record so the registry can enumerate it.
+        if (!_isKnownPeerChainId[chainId]) {
+            _isKnownPeerChainId[chainId] = true;
+            _peerChainIds.push(chainId);
+        }
 
-        // Rebuild the per-currency context set from scratch. A context that dropped out of this fresher snapshot is
-        // simply absent from the new set, so no per-entry clearing is needed.
-        delete _peerContexts;
+        // Rebuild this chain's raw context set from scratch. A context dropped by the fresher record is simply absent.
+        // Each context is stored verbatim so it can be re-gossiped faithfully; folding to a local currency happens at
+        // read time in `peerChainContextsOf`.
+        delete _peerContextsOf[chainId];
+        JBSourceContext[] storage storedContexts = _peerContextsOf[chainId];
 
-        // Fold each source context into the local currency it resolves to. Resolution prefers the token mapping (so a
-        // same-asset token at a different remote address binds to the right local context) and falls back to identity
-        // for same-address tokens; the local currency is then derived from that resolved local token's authoritative
-        // accounting context, NOT trusted from the wire.
         uint256 numContexts = sourceContexts.length;
         for (uint256 i; i < numContexts;) {
-            JBSourceContext calldata ctx = sourceContexts[i];
-
-            address contextToken = _localTokenForRemoteToken[ctx.token];
-            if (contextToken == address(0)) contextToken = _toAddress(ctx.token);
-            (uint32 contextCurrency, bool authoritative) = _localCurrencyOf(contextToken);
-
-            // Cache an authoritative currency so later snapshots reuse it instead of re-reading the terminal. The
-            // accounting-context currency is immutable, so the cache never goes stale; a not-yet-configured token is
-            // left uncached and re-read next time.
-            if (authoritative && _cachedCurrencyOf[contextToken] == 0) {
-                _cachedCurrencyOf[contextToken] = contextCurrency;
-            }
-
-            // Accumulate into an existing entry that matches on BOTH currency AND decimals, or append a new one. The
-            // decimals must match: `surplus`/`balance` are raw, un-valued token amounts, so two contexts that share a
-            // currency but carry different decimals are on different scales and cannot be summed directly.
-            uint256 numStored = _peerContexts.length;
-            bool merged;
-            for (uint256 j; j < numStored;) {
-                if (_peerContexts[j].currency == contextCurrency && _peerContexts[j].decimals == ctx.decimals) {
-                    _peerContexts[j].surplus = _saturatingAddU128(_peerContexts[j].surplus, ctx.surplus);
-                    _peerContexts[j].balance = _saturatingAddU128(_peerContexts[j].balance, ctx.balance);
-                    merged = true;
-                    break;
-                }
-                unchecked {
-                    ++j;
-                }
-            }
-            if (!merged) {
-                _peerContexts.push(
-                    JBPeerChainContext({
-                        currency: contextCurrency, decimals: ctx.decimals, surplus: ctx.surplus, balance: ctx.balance
-                    })
-                );
-            }
-
+            storedContexts.push(sourceContexts[i]);
             unchecked {
                 ++i;
             }
@@ -1811,43 +1899,30 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         return ERC2771Context._contextSuffixLength();
     }
 
-    /// @notice The authoritative accounting-context currency the project uses for a local token. Peer context is keyed
-    /// by this currency so a consumer reads it under the same currency it already works in (which the project may set
-    /// to a well-known id like USD rather than the token-keyed convention).
-    /// @dev Both lookups use a low-level staticcall guarded by a returndata-length check, so a missing or
-    /// non-conforming directory/terminal (including one that returns short/empty data) can't block a bridge message —
-    /// it just yields the fallback. Returns the cached value when one exists (the accounting-context currency is
-    /// immutable, so the cache never goes stale). Falls back to the conventional `uint32(uint160(token))` only when the
-    /// project has no local accounting context for the token yet; that fallback is NOT cached, so a later snapshot
-    /// re-reads it once the context exists.
-    /// @param token The resolved local token.
-    /// @return currency The project's accounting-context currency for the token.
-    /// @return authoritative Whether `currency` came from a cached or configured accounting context (true) or the
-    /// convention fallback (false). `fromRemote` caches only authoritative results, since those are immutable.
-    function _localCurrencyOf(address token) internal view returns (uint32 currency, bool authoritative) {
-        // Reuse the value derived on an earlier snapshot — no need to read the terminal again.
-        uint32 cached = _cachedCurrencyOf[token];
-        if (cached != 0) return (cached, true);
-
-        uint256 forProjectId = projectId();
-
-        // Resolve the project's primary terminal for the token. An `address` return needs a full word.
-        (bool terminalOk, bytes memory terminalData) =
-            address(DIRECTORY).staticcall(abi.encodeCall(IJBDirectory.primaryTerminalOf, (forProjectId, token)));
-        if (terminalOk && terminalData.length >= 32) {
-            address terminal = abi.decode(terminalData, (address));
-            if (terminal != address(0)) {
-                // Read the token's accounting context. The struct encodes to three words.
-                (bool contextOk, bytes memory contextData) =
-                    terminal.staticcall(abi.encodeCall(IJBTerminal.accountingContextForTokenOf, (forProjectId, token)));
-                if (contextOk && contextData.length >= 96) {
-                    JBAccountingContext memory accountingContext = abi.decode(contextData, (JBAccountingContext));
-                    if (accountingContext.currency != 0) return (accountingContext.currency, true);
-                }
+    /// @notice What is the maximum time it takes for a message to be received on the other side.
+    /// @dev Be sure to keep in mind if a message fails having to retry and the time it takes to retry.
+    /// @return The maximum time it takes for a message to be received on the other side.
+    function _maxMessagingDelay() internal pure virtual returns (uint40) {
+        return 14 days;
+    }
+
+    /// @notice The destination gas limit a gossip-carrying message needs to store its bundle on the remote chain.
+    /// @dev A fixed base (`MESSENGER_BASE_GAS_LIMIT`) plus `_MESSENGER_SOURCE_CONTEXT_GAS_LIMIT` per source context, so
+    /// the budget grows with the bundle. Without this, a fixed cap would bound the mesh: once the bundle's contexts
+    /// exceed the cap, the destination `fromRemote`/`fromRemoteAccounting` runs out of gas. Every bridge variant sizes
+    /// its outbound gas limit from this so the OP-stack, Arbitrum, and CCIP suckers scale identically.
+    /// @param accounts The accounting records carried by the message.
+    /// @return gasLimit The destination gas limit to request from the bridge.
+    function _messagingGasLimit(JBChainAccounting[] memory accounts) internal pure returns (uint256 gasLimit) {
+        uint256 contextCount;
+        uint256 numAccounts = accounts.length;
+        for (uint256 i; i < numAccounts;) {
+            contextCount += accounts[i].contexts.length;
+            unchecked {
+                ++i;
             }
         }
-        // forge-lint: disable-next-line(unsafe-typecast)
-        return (uint32(uint160(token)), false);
+        return MESSENGER_BASE_GAS_LIMIT + (contextCount * _MESSENGER_SOURCE_CONTEXT_GAS_LIMIT);
     }
 
     /// @notice The calldata. Preferred to use over `msg.data`.
@@ -1899,21 +1974,6 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         }
     }
 
-    /// @notice Adds two `uint128` amounts, saturating at `type(uint128).max` instead of overflowing.
-    /// @dev Saturation keeps a pathological peer snapshot from reverting the receive path; the cap can only
-    /// under-report a remote amount, the safe direction.
-    /// @param a The first amount.
-    /// @param b The second amount.
-    /// @return The saturated sum.
-    function _saturatingAddU128(uint128 a, uint128 b) internal pure returns (uint128) {
-        unchecked {
-            uint256 sum = uint256(a) + uint256(b);
-            // The cast only runs when `sum <= type(uint128).max`, so it cannot truncate.
-            // forge-lint: disable-next-line(unsafe-typecast)
-            return sum > type(uint128).max ? type(uint128).max : uint128(sum);
-        }
-    }
-
     /// @notice Selects which retained inbox root a proof should be validated against, honoring a small window of
     /// recently-accepted roots rather than only the latest.
     /// @dev Computes the branch root implied by the proof once, then returns the first retained ring root it matches.
@@ -2020,7 +2080,9 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
 
         JBMessageRoot memory message = JBSuckerLib.buildSnapshotMessage({
             directory: DIRECTORY,
+            registry: REGISTRY,
             projectId: projectId(),
+            exceptChainId: peerChainId(),
             remoteToken: remoteToken.addr,
             amount: amount,
             nonce: nonce,