@rev-net/core-v6 0.0.17 → 0.0.19

package/SKILLS.md

@@ -8,7 +8,8 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Contract | Role |
 |----------|------|
-| `REVDeployer` | Deploys revnets, permanently owns the project NFT, acts as data hook and cash-out hook. Manages stages, splits, auto-issuance, buyback hooks, 721 hooks, suckers, and split operators. (~1,287 lines) |
+| `REVDeployer` | Deploys revnets, permanently owns the project NFT. Manages stages, splits, auto-issuance, buyback hooks, suckers, split operators, and configuration state storage. Exposes `OWNER()` view returning the REVOwner address. Calls DEPLOYER-restricted setters on REVOwner during deployment to store `cashOutDelayOf` and `tiered721HookOf`. |
+| `REVOwner` | Runtime hook contract for all revnets. Implements `IJBRulesetDataHook` + `IJBCashOutHook`. Set as the `dataHook` in each revnet's ruleset metadata. Handles pay hooks, cash-out hooks, mint permissions, and sucker verification. Stores `cashOutDelayOf` and `tiered721HookOf` mappings (set by REVDeployer via DEPLOYER-restricted setters `setCashOutDelayOf()` and `setTiered721HookOf()`). (~310 lines) |
 | `REVLoans` | Issues token-collateralized loans from revnet treasuries. Each loan is an ERC-721 NFT. Burns collateral on borrow, re-mints on repay. Charges tiered fees (REV protocol fee + source fee + prepaid fee). (~1,359 lines) |
 
 ## Key Functions
@@ -21,14 +22,15 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 | `REVDeployer.deployFor(revnetId, config, terminals, suckerConfig, hookConfig, allowedPosts)` | Permissionless | Same as `deployFor` but deploys a tiered ERC-721 hook with pre-configured tiers. Optionally configures Croptop posting criteria and grants publisher permission to add tiers. |
 | `REVDeployer.deploySuckersFor(revnetId, suckerConfig)` | Split operator | Deploy new cross-chain suckers post-launch. Validates ruleset allows sucker deployment (bit 2 of `extraMetadata`). Uses stored config hash for cross-chain matching. |
 
-### Data Hooks
+### Data Hooks (REVOwner)
 
 | Function | Permissions | What it does |
 |----------|------------|-------------|
-| `REVDeployer.beforePayRecordedWith(context)` | Terminal callback | Calls the 721 hook first for split specs, then calls the buyback hook with a reduced amount context (payment minus split amount). Adjusts the returned weight proportionally for splits (`weight = mulDiv(weight, amount - splitAmount, amount)`) so the terminal only mints tokens for the amount entering the project. Assembles pay hook specs (721 hook specs first, then buyback spec). |
-| `REVDeployer.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: calculates 2.5% fee, enforces 30-day cash-out delay, returns modified count + fee hook spec. |
-| `REVDeployer.afterCashOutRecordedWith(context)` | Permissionless | Cash-out hook callback. Receives fee amount and pays it to the fee revnet's terminal. Falls back to returning funds if fee payment fails. |
-| `REVDeployer.hasMintPermissionFor(revnetId, ruleset, addr)` | View | Returns `true` for: loans contract, buyback hook, buyback hook delegates, or suckers. |
+| `REVOwner.beforePayRecordedWith(context)` | Terminal callback | Calls the 721 hook first for split specs, then calls the buyback hook with a reduced amount context (payment minus split amount). Adjusts the returned weight proportionally for splits (`weight = mulDiv(weight, amount - splitAmount, amount)`) so the terminal only mints tokens for the amount entering the project. Assembles pay hook specs (721 hook specs first, then buyback spec). Reads `tiered721HookOf` from REVOwner storage. |
+| `REVOwner.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: calculates 2.5% fee, enforces 30-day cash-out delay (reads `cashOutDelayOf` from REVOwner storage), returns modified count + fee hook spec. |
+| `REVOwner.afterCashOutRecordedWith(context)` | Permissionless | Cash-out hook callback. Receives fee amount and pays it to the fee revnet's terminal. Falls back to returning funds if fee payment fails. |
+| `REVOwner.hasMintPermissionFor(revnetId, ruleset, addr)` | View | Returns `true` for: loans contract, buyback hook, buyback hook delegates, or suckers. |
+| `REVOwner.cashOutDelayOf(revnetId)` | View | Returns the cash-out delay timestamp from REVOwner storage. Exposed for REVLoans compatibility (REVLoans imports IREVOwner for this). |
 
 ### Split Operator
 
@@ -47,7 +49,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Function | Permissions | What it does |
 |----------|------------|-------------|
-| `REVLoans.borrowFrom(revnetId, source, minBorrowAmount, collateralCount, beneficiary, prepaidFeePercent)` | Permissionless (caller must grant BURN_TOKENS to REVLoans) | Open a loan: burn collateral tokens, pull funds from revnet via `useAllowanceOf`, pay REV fee (1%) + terminal fee (2.5%), transfer remainder to beneficiary, mint loan NFT. |
+| `REVLoans.borrowFrom(revnetId, source, minBorrowAmount, collateralCount, beneficiary, prepaidFeePercent)` | Permissionless (caller must grant BURN_TOKENS to REVLoans) | Open a loan: enforce cash-out delay if set (cross-chain deployment protection), burn collateral tokens, pull funds from revnet via `useAllowanceOf`, pay REV fee (1%) + terminal fee (2.5%), transfer remainder to beneficiary, mint loan NFT. |
 | `REVLoans.repayLoan(loanId, maxRepayBorrowAmount, collateralCountToReturn, beneficiary, allowance)` | Loan NFT owner | Repay fully or partially. Returns funds to revnet via `addToBalanceOf`, re-mints collateral tokens, burns/replaces the loan NFT. Supports permit2 signatures. |
 | `REVLoans.reallocateCollateralFromLoan(loanId, collateralCountToTransfer, source, minBorrowAmount, collateralCountToAdd, beneficiary, prepaidFeePercent)` | Loan NFT owner | Refinance: remove excess collateral from an existing loan and open a new loan with the freed collateral. Burns original, mints two replacements. |
 | `REVLoans.liquidateExpiredLoansFrom(revnetId, startingLoanId, count)` | Permissionless | Clean up loans past the 10-year liquidation duration. Burns NFTs and decrements accounting totals. Collateral is permanently lost. |
@@ -57,7 +59,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Function | What it does |
 |----------|-------------|
-| `REVLoans.borrowableAmountFrom(revnetId, collateralCount, decimals, currency)` | Calculate how much can be borrowed for a given collateral amount. Aggregates surplus from all terminals, applies bonding curve. |
+| `REVLoans.borrowableAmountFrom(revnetId, collateralCount, decimals, currency)` | Calculate how much can be borrowed for a given collateral amount. Returns 0 during the cash-out delay period. Aggregates surplus from all terminals, applies bonding curve. |
 | `REVLoans.determineSourceFeeAmount(loan, amount)` | Calculate the time-proportional source fee for a loan repayment. Zero during prepaid window, linear accrual after. |
 | `REVLoans.loanOf(loanId)` | Returns the full `REVLoan` struct for a loan. |
 | `REVLoans.loanSourcesOf(revnetId)` | Returns all `(terminal, token)` pairs used for loans by a revnet. |
@@ -139,6 +141,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Error | When It Fires |
 |-------|---------------|
+| `REVLoans_CashOutDelayNotFinished(cashOutDelay, blockTimestamp)` | When borrowing during the 30-day cash-out delay period (cross-chain deployment protection). |
 | `REVLoans_CollateralExceedsLoan(collateralToReturn, loanCollateral)` | When trying to return more collateral than the loan holds. |
 | `REVLoans_InvalidPrepaidFeePercent(prepaidFeePercent, min, max)` | When `prepaidFeePercent` is outside the allowed range (2.5%--50%). |
 | `REVLoans_InvalidTerminal(terminal, revnetId)` | When the specified terminal is not registered for the revnet. |
@@ -187,11 +190,17 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 | Mapping | Visibility | Type | Purpose |
 |---------|-----------|------|---------|
 | `amountToAutoIssue` | `public` | `revnetId => stageId => beneficiary => uint256` | Premint tokens per stage per beneficiary |
-| `cashOutDelayOf` | `public` | `revnetId => uint256` | Timestamp when cash outs unlock (0 = no delay) |
 | `hashedEncodedConfigurationOf` | `public` | `revnetId => bytes32` | Config hash for cross-chain sucker validation |
-| `tiered721HookOf` | `public` | `revnetId => address` | Deployed 721 hook address (if any) |
 | `_extraOperatorPermissions` | `internal` | `revnetId => uint256[]` | Custom permissions for split operator (no auto-getter) |
 
+### REVOwner
+
+| Mapping | Visibility | Type | Purpose |
+|---------|-----------|------|---------|
+| `DEPLOYER` | `public` | `address` | REVDeployer address (storage variable, set once via `initialize()`) |
+| `cashOutDelayOf` | `public` | `revnetId => uint256` | Timestamp when cash outs unlock (0 = no delay). Set by REVDeployer via `setCashOutDelayOf()`. |
+| `tiered721HookOf` | `public` | `revnetId => address` | Deployed 721 hook address (if any). Set by REVDeployer via `setTiered721HookOf()`. |
+
 ### REVLoans
 
 | Mapping | Visibility | Type | Purpose |
@@ -212,20 +221,21 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 4. **Loan ID encoding.** `loanId = revnetId * 1_000_000_000_000 + loanNumber`. Each revnet supports ~1 trillion loans. Use `revnetIdOfLoanWith(loanId)` to decode.
 5. **uint112 truncation risk.** `REVLoan.amount` and `REVLoan.collateral` are `uint112`. Values above ~5.19e33 truncate silently.
 6. **Auto-issuance stage IDs.** Computed as `block.timestamp + i` during deployment. These match the Juicebox ruleset IDs because `JBRulesets` assigns IDs the same way (`latestId >= block.timestamp ? latestId + 1 : block.timestamp`), producing identical sequential IDs when all stages are queued in a single `deployFor()` call.
-7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound.
-8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage.
+7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. This is by design.
+8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage. Enforced in both `beforeCashOutRecordedWith` (direct cash outs) and `REVLoans.borrowFrom` / `borrowableAmountFrom` (loans). The delay is stored on REVOwner (`cashOutDelayOf(revnetId)`) and set by REVDeployer during deployment via `setCashOutDelayOf()`. REVLoans imports IREVOwner (not IREVDeployer) to read it.
 9. **`cashOutTaxRate` cannot be MAX.** Must be strictly less than `MAX_CASH_OUT_TAX_RATE` (10,000). Revnets cannot fully disable cash outs.
 10. **Split operator is singular.** Only ONE address can be split operator at a time. The operator can replace itself via `setSplitOperatorOf` but cannot delegate or multi-sig.
 11. **NATIVE_TOKEN on non-ETH chains.** `JBConstants.NATIVE_TOKEN` on Celo means CELO, on Polygon means MATIC -- not ETH. Use ERC-20 WETH instead. The config matching hash does NOT catch terminal configuration differences.
 12. **Loan source array is unbounded.** `_loanSourcesOf[revnetId]` grows without limit. No validation that a terminal is actually registered for the project.
 13. **Flash-loan surplus exposure.** `borrowableAmountFrom` reads live surplus. A flash loan can temporarily inflate the treasury to borrow more than the sustained value supports.
 14. **Fee revnet must have terminals.** Cash-out fees and loan protocol fees are paid to `FEE_REVNET_ID`. If that project has no terminal for the token, the fee silently fails (try-catch).
-15. **Buyback hook is immutable per deployer.** `REVDeployer.BUYBACK_HOOK` is set at construction time. All revnets deployed by the same deployer share the same buyback hook.
+15. **Buyback hook is immutable per deployer.** `BUYBACK_HOOK` is set at construction time on both REVDeployer and REVOwner. All revnets deployed by the same deployer share the same buyback hook.
 16. **Cross-chain config matching.** `hashedEncodedConfigurationOf` covers economic parameters (baseCurrency, stages, auto-issuances) but NOT terminal configurations, accounting contexts, or sucker token mappings. Two deployments with identical hashes can have different terminal setups.
 17. **Loan fee model has three layers.** See Constants table for exact values: REV protocol fee, terminal fee, and prepaid source fee (borrower-chosen, buys interest-free window). After the prepaid window, source fee accrues linearly over the remaining loan duration.
 18. **Permit2 fallback.** `REVLoans` uses permit2 for ERC-20 transfers as a fallback when standard allowance is insufficient. Wrapped in try-catch.
 19. **39.16% cash-out tax crossover.** Below ~39% cash-out tax, cashing out is more capital-efficient than borrowing. Above ~39%, loans become more efficient because they preserve upside while providing liquidity. Based on CryptoEconLab academic research. Design implication: revnets intended for active token trading should consider this threshold when setting `cashOutTaxRate`.
 20. **REVDeployer always deploys a 721 hook** via `HOOK_DEPLOYER.deployHookFor` — even if `baseline721HookConfiguration` has empty tiers. This is correct by design: it lets the split operator add and sell NFTs later without migration. Non-revnet projects should follow the same pattern by using `JB721TiersHookProjectDeployer.launchProjectFor` (or `JBOmnichainDeployer.launchProjectFor`) instead of bare `launchProjectFor`.
+21. **REVOwner circular dependency.** REVOwner and REVDeployer have a circular dependency broken by a one-shot `initialize()` call. `REVOwner.DEPLOYER` is a storage variable (not immutable) set via `initialize()`. If `initialize()` is never called or called with the wrong address, all runtime hook behavior breaks. Deploy order: REVOwner first, then REVDeployer(owner=REVOwner), then REVOwner.initialize(deployer). REVOwner stores `cashOutDelayOf` and `tiered721HookOf` mappings, which are set by REVDeployer via DEPLOYER-restricted setters (`setCashOutDelayOf()`, `setTiered721HookOf()`).
 
 ### NATIVE_TOKEN Accounting on Non-ETH Chains
 
@@ -300,8 +310,14 @@ Quick-reference for common read operations. All functions are `view`/`pure` and
 | What | Call | Returns |
 |------|------|---------|
 | Config hash (cross-chain matching) | `REVDeployer.hashedEncodedConfigurationOf(revnetId)` | `bytes32` |
-| 721 hook address | `REVDeployer.tiered721HookOf(revnetId)` | `IJB721TiersHook` |
-| Cash-out delay timestamp | `REVDeployer.cashOutDelayOf(revnetId)` | `uint256` (0 = no delay) |
+| REVOwner address | `REVDeployer.OWNER()` | `address` |
+
+### REVOwner State
+
+| What | Call | Returns |
+|------|------|---------|
+| 721 hook address | `REVOwner.tiered721HookOf(revnetId)` | `IJB721TiersHook` |
+| Cash-out delay timestamp | `REVOwner.cashOutDelayOf(revnetId)` | `uint256` (0 = no delay) |
 
 ## Example Integration
 

package/USER_JOURNEYS.md

@@ -29,7 +29,7 @@ Or: `REVDeployer.deployFor(revnetId=0, configuration, terminalConfigurations, su
 1. `revnetId = PROJECTS.count() + 1` (next available ID)
 2. `_makeRulesetConfigurations` converts stages to JBRulesetConfigs:
    - Validates: at least one stage, `startsAtOrAfter` strictly increasing, `cashOutTaxRate < MAX`, splits required if `splitPercent > 0`
-   - Each stage becomes a ruleset with: duration = `issuanceCutFrequency`, weight = `initialIssuance`, weightCutPercent = `issuanceCutPercent`, data hook = REVDeployer address
+   - Each stage becomes a ruleset with: duration = `issuanceCutFrequency`, weight = `initialIssuance`, weightCutPercent = `issuanceCutPercent`, data hook = REVOwner address
    - Fund access limits: unlimited surplus allowance per terminal/token (for loans)
    - Encoded configuration hash computed from economic parameters
    - Auto-issuance amounts stored: `amountToAutoIssue[revnetId][block.timestamp + i][beneficiary] += count`
@@ -91,12 +91,13 @@ Or: `REVDeployer.deployFor(revnetId=0, configuration, terminalConfigurations, su
 
 **Entry point:** `JBMultiTerminal.pay(projectId, token, amount, beneficiary, minReturnedTokens, memo, metadata)`
 
-This is a standard Juicebox payment, but REVDeployer intervenes as the data hook.
+This is a standard Juicebox payment, but REVOwner intervenes as the data hook.
 
 **What happens:**
 
 1. Terminal records payment in store
-2. Store calls `REVDeployer.beforePayRecordedWith(context)`:
+2. Store calls `REVOwner.beforePayRecordedWith(context)`:
+   - Reads `tiered721HookOf` from REVOwner storage
    - Calls 721 hook's `beforePayRecordedWith` for split specs (tier purchases)
    - Computes `projectAmount = context.amount.value - totalSplitAmount`
    - Calls buyback hook's `beforePayRecordedWith` with reduced amount context
@@ -108,14 +109,14 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
    - 721 hook processes tier purchases
    - Buyback hook processes swap (if applicable)
 
-**Preview**: Call `JBMultiTerminal.previewPayFor(revnetId, token, amount, beneficiary, metadata)` to simulate the full payment including REVDeployer's data hook effects (buyback routing, 721 tier splits, weight adjustment). Returns the expected token count and hook specifications. When the buyback hook is active, noop specs may carry routing diagnostics (TWAP tick, liquidity, pool ID) even when the protocol mint path wins.
+**Preview**: Call `JBMultiTerminal.previewPayFor(revnetId, token, amount, beneficiary, metadata)` to simulate the full payment including REVOwner's data hook effects (buyback routing, 721 tier splits, weight adjustment). Returns the expected token count and hook specifications. When the buyback hook is active, noop specs may carry routing diagnostics (TWAP tick, liquidity, pool ID) even when the protocol mint path wins.
 
-**Events:** No revnet-specific events. The payment is handled by `JBMultiTerminal` and `JBController` (see nana-core-v6). REVDeployer's `beforePayRecordedWith` is a `view` function and emits nothing.
+**Events:** No revnet-specific events. The payment is handled by `JBMultiTerminal` and `JBController` (see nana-core-v6). REVOwner's `beforePayRecordedWith` is a `view` function and emits nothing.
 
 **Edge cases:**
 - If the buyback hook determines a DEX swap is better, weight = 0 and the buyback hook spec receives the full project amount. The buyback hook buys tokens on the DEX and mints them to the payer.
 - If `totalSplitAmount >= context.amount.value`, `projectAmount = 0`, weight = 0, and no tokens are minted by the terminal. All funds go to 721 tier splits.
-- If no 721 hook is set (`tiered721HookOf[revnetId] == address(0)`), only the buyback hook is consulted.
+- If no 721 hook is set (`tiered721HookOf[revnetId] == address(0)` on REVOwner), only the buyback hook is consulted.
 
 ---
 
@@ -126,9 +127,9 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
 **What happens:**
 
 1. Terminal records cash-out in store
-2. Store calls `REVDeployer.beforeCashOutRecordedWith(context)`:
+2. Store calls `REVOwner.beforeCashOutRecordedWith(context)`:
    - **If sucker:** Returns 0% tax, full cash-out count, no hooks (fee exempt)
-   - **If cash-out delay active:** Reverts with `REVDeployer_CashOutDelayNotFinished`
+   - **If cash-out delay active:** Reads `cashOutDelayOf` from REVOwner storage, reverts with `REVDeployer_CashOutDelayNotFinished`
    - **If no tax or no fee terminal:** Returns parameters unchanged
    - **Otherwise:** Splits cash-out into fee portion (2.5%) and non-fee portion:
      - `feeCashOutCount = mulDiv(cashOutCount, 25, 1000)`
@@ -138,17 +139,17 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
      - Returns `nonFeeCashOutCount` as the adjusted cash-out count + hook spec for fee
 3. Terminal burns ALL of the user's specified token count
 4. Terminal transfers the reclaimed amount to the beneficiary
-5. Terminal calls `REVDeployer.afterCashOutRecordedWith(context)`:
+5. Terminal calls `REVOwner.afterCashOutRecordedWith(context)`:
    - Transfers fee amount from terminal to this contract
    - Pays fee to fee revnet's terminal via `feeTerminal.pay`
    - On failure: returns funds to the originating project via `addToBalanceOf`
 
-**Preview**: Call `JBMultiTerminal.previewCashOutFrom(holder, revnetId, cashOutCount, tokenToReclaim, beneficiary, metadata)` to simulate the full cash out including REVDeployer's data hook effects (fee splitting, tax rate). Returns the expected reclaim amount and hook specifications. For a simpler estimate without data hook effects, use `JBTerminalStore.currentTotalReclaimableSurplusOf(revnetId, cashOutCount, decimals, currency)`.
+**Preview**: Call `JBMultiTerminal.previewCashOutFrom(holder, revnetId, cashOutCount, tokenToReclaim, beneficiary, metadata)` to simulate the full cash out including REVOwner's data hook effects (fee splitting, tax rate). Returns the expected reclaim amount and hook specifications. For a simpler estimate without data hook effects, use `JBTerminalStore.currentTotalReclaimableSurplusOf(revnetId, cashOutCount, decimals, currency)`.
 
-**Events:** No revnet-specific events. Cash-out events are emitted by `JBMultiTerminal` and `JBController`. REVDeployer's `beforeCashOutRecordedWith` is a `view` function. The `afterCashOutRecordedWith` hook processes fees but does not emit events.
+**Events:** No revnet-specific events. Cash-out events are emitted by `JBMultiTerminal` and `JBController`. REVOwner's `beforeCashOutRecordedWith` is a `view` function. The `afterCashOutRecordedWith` hook on REVOwner processes fees but does not emit events.
 
 **Edge cases:**
-- Suckers bypass both the cash-out fee AND the cash-out delay. The `_isSuckerOf` check is the only gate.
+- Suckers bypass both the cash-out fee AND the cash-out delay. The `REVOwner._isSuckerOf` check is the only gate.
 - `cashOutTaxRate == 0` means no tax and no revnet fee. The terminal's 2.5% protocol fee only applies up to the `feeFreeSurplusOf` amount (round-trip prevention), not the full reclaim.
 - Micro cash-outs (< 40 wei at 2.5%) round `feeCashOutCount` to 0, bypassing the fee. Gas cost far exceeds the bypassed fee.
 - The fee is paid to `FEE_REVNET_ID`, not `REV_ID`. These may be different projects.
@@ -163,6 +164,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
 **Prerequisites:**
 - Caller must hold `collateralCount` revnet ERC-20 tokens
 - Caller must grant `BURN_TOKENS` permission to the REVLoans contract for the revnet's project ID via `JBPermissions.setPermissionsFor()`. Without this, the transaction reverts in `JBController.burnTokensOf` with `JBPermissioned_Unauthorized`.
+- The revnet's cash-out delay must have passed (if one was set during cross-chain deployment). `borrowableAmountFrom` returns 0 and `borrowFrom` reverts with `REVLoans_CashOutDelayNotFinished` until the 30-day delay expires.
 
 **Key parameters:**
 
@@ -181,6 +183,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
    - `collateralCount > 0` (no zero-collateral loans)
    - `source.terminal` is registered for the revnet in the directory
    - `prepaidFeePercent` in range [25, 500]
+   - Cash-out delay has passed: resolves the `REVOwner` from the current ruleset's `dataHook`, checks `IREVOwner.cashOutDelayOf(revnetId)` (stored on REVOwner). Reverts with `REVLoans_CashOutDelayNotFinished(cashOutDelay, block.timestamp)` if `cashOutDelay > block.timestamp`.
 2. **Loan ID generation:** `revnetId * 1_000_000_000_000 + (++totalLoansBorrowedFor[revnetId])`
 3. **Loan creation in storage:**
    - `source`, `createdAt = block.timestamp`, `prepaidFeePercent`, `prepaidDuration = mulDiv(prepaidFeePercent, 3650 days, 500)`
@@ -210,6 +213,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
 - `prepaidDuration` at minimum (25): `25 * 3650 days / 500 = 182.5 days`. At maximum (500): `500 * 3650 days / 500 = 3650 days`.
 - Both the REV fee payment and the source fee payment failures are non-fatal. If either `feeTerminal.pay` or `source.terminal.pay` reverts, the fee amount is transferred to the beneficiary instead.
 - Loan NFT is minted to `_msgSender()`, not `beneficiary`. The caller owns the loan; the beneficiary receives the funds.
+- When a revnet deploys to a new chain with `startsAtOrAfter` in the past, `REVDeployer` sets a 30-day cash-out delay via `REVOwner.setCashOutDelayOf()`. Both `borrowFrom` and `borrowableAmountFrom` enforce this delay by resolving the REVOwner from the current ruleset's `dataHook` and checking `IREVOwner.cashOutDelayOf(revnetId)` (stored on REVOwner). This prevents cross-chain arbitrage via loans during the delay window.
 
 ---
 

package/foundry.toml

@@ -2,7 +2,7 @@
 solc = '0.8.28'
 evm_version = 'cancun'
 via_ir = true
-optimizer_runs = 100
+optimizer_runs = 200
 libs = ["node_modules", "lib"]
 fs_permissions = [{ access = "read-write", path = "./"}]
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rev-net/core-v6",
-    "version": "0.0.17",
+    "version": "0.0.19",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -19,14 +19,14 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'revnet-core-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.21",
-        "@bananapus/buyback-hook-v6": "^0.0.21",
-        "@bananapus/core-v6": "^0.0.27",
-        "@bananapus/ownable-v6": "^0.0.14",
+        "@bananapus/721-hook-v6": "^0.0.22",
+        "@bananapus/buyback-hook-v6": "^0.0.22",
+        "@bananapus/core-v6": "^0.0.28",
+        "@bananapus/ownable-v6": "^0.0.15",
         "@bananapus/permission-ids-v6": "^0.0.14",
-        "@bananapus/router-terminal-v6": "^0.0.20",
-        "@bananapus/suckers-v6": "^0.0.17",
-        "@croptop/core-v6": "^0.0.22",
+        "@bananapus/router-terminal-v6": "^0.0.21",
+        "@bananapus/suckers-v6": "^0.0.18",
+        "@croptop/core-v6": "^0.0.23",
         "@openzeppelin/contracts": "^5.6.1",
         "@uniswap/v4-core": "^1.0.2",
         "@uniswap/v4-periphery": "^1.0.3"

package/script/Deploy.s.sol

@@ -30,6 +30,8 @@ import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/
 import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
 
 import {REVDeployer} from "./../src/REVDeployer.sol";
+import {REVOwner} from "./../src/REVOwner.sol";
+import {IREVDeployer} from "./../src/interfaces/IREVDeployer.sol";
 import {REVAutoIssuance} from "../src/structs/REVAutoIssuance.sol";
 import {REVConfig} from "../src/structs/REVConfig.sol";
 import {REVDescription} from "../src/structs/REVDescription.sol";
@@ -91,6 +93,8 @@ contract DeployScript is Script, Sphinx {
     // forge-lint: disable-next-line(mixed-case-variable)
     bytes32 REVLOANS_SALT = "_REV_LOANS_SALT_V6_";
     // forge-lint: disable-next-line(mixed-case-variable)
+    bytes32 REVOWNER_SALT = "_REV_OWNER_SALT_V6_";
+    // forge-lint: disable-next-line(mixed-case-variable)
     address LOANS_OWNER;
     // forge-lint: disable-next-line(mixed-case-variable)
     address OPERATOR;
@@ -323,7 +327,6 @@ contract DeployScript is Script, Sphinx {
                     tiersConfig: JB721InitTiersConfig({
                         tiers: new JB721TierConfig[](0), currency: ETH_CURRENCY, decimals: 18
                     }),
-                    reserveBeneficiary: address(0),
                     flags: REV721TiersHookFlags({
                         noNewTiersWithReserves: false,
                         noNewTiersWithVotes: false,
@@ -369,6 +372,8 @@ contract DeployScript is Script, Sphinx {
         bool _singletonsExist;
         // The address of the previously deployed REVLoans, if found.
         address _existingRevloansAddr;
+        // The address of the previously deployed REVOwner, if found.
+        address _existingOwnerAddr;
         // The address of the previously deployed REVDeployer, if found.
         address _existingDeployerAddr;
 
@@ -392,6 +397,19 @@ contract DeployScript is Script, Sphinx {
                     // Flag that singletons were found.
                     _singletonsExist = true;
 
+                    // Also predict and verify the owner.
+                    (_existingOwnerAddr,) = _isDeployed({
+                        salt: REVOWNER_SALT,
+                        creationCode: type(REVOwner).creationCode,
+                        arguments: abi.encode(
+                            IJBBuybackHookRegistry(address(buybackHook.registry)),
+                            core.controller.DIRECTORY(),
+                            _candidateId,
+                            suckers.registry,
+                            _candidateRevloansAddr
+                        )
+                    });
+
                     // Also predict and verify the deployer.
                     (_existingDeployerAddr,) = _isDeployed({
                         salt: DEPLOYER_SALT,
@@ -404,7 +422,8 @@ contract DeployScript is Script, Sphinx {
                             croptop.publisher,
                             IJBBuybackHookRegistry(address(buybackHook.registry)),
                             _candidateRevloansAddr,
-                            TRUSTED_FORWARDER
+                            TRUSTED_FORWARDER,
+                            _existingOwnerAddr
                         )
                     });
                     // Stop searching — we found the deployed singletons.
@@ -431,7 +450,18 @@ contract DeployScript is Script, Sphinx {
                 trustedForwarder: TRUSTED_FORWARDER
             });
 
-        // Deploy REVDeployer with the REVLoans and buyback hook addresses.
+        // Deploy REVOwner — the runtime data hook that handles pay and cash out callbacks.
+        REVOwner revOwner = _singletonsExist
+            ? REVOwner(_existingOwnerAddr)
+            : new REVOwner{salt: REVOWNER_SALT}({
+                buybackHook: IJBBuybackHookRegistry(address(buybackHook.registry)),
+                directory: core.controller.DIRECTORY(),
+                feeRevnetId: FEE_PROJECT_ID,
+                suckerRegistry: suckers.registry,
+                loans: address(revloans)
+            });
+
+        // Deploy REVDeployer with the REVLoans, buyback hook, and REVOwner addresses.
         (address _deployerAddr, bool _deployerIsDeployed) = _isDeployed({
             salt: DEPLOYER_SALT,
             creationCode: type(REVDeployer).creationCode,
@@ -443,7 +473,8 @@ contract DeployScript is Script, Sphinx {
                 croptop.publisher,
                 IJBBuybackHookRegistry(address(buybackHook.registry)),
                 address(revloans),
-                TRUSTED_FORWARDER
+                TRUSTED_FORWARDER,
+                address(revOwner)
             )
         });
         REVDeployer _basicDeployer = _deployerIsDeployed
@@ -456,24 +487,34 @@ contract DeployScript is Script, Sphinx {
                 publisher: croptop.publisher,
                 buybackHook: IJBBuybackHookRegistry(address(buybackHook.registry)),
                 loans: address(revloans),
-                trustedForwarder: TRUSTED_FORWARDER
+                trustedForwarder: TRUSTED_FORWARDER,
+                owner: address(revOwner)
             });
 
-        // Approve the basic deployer to configure the project.
-        core.projects.approve({to: address(_basicDeployer), tokenId: FEE_PROJECT_ID});
-
-        // Build the config.
-        FeeProjectConfig memory feeProjectConfig = getFeeProjectConfig();
+        // Link the REVOwner to the REVDeployer (can only be called once).
+        if (!_deployerIsDeployed) {
+            revOwner.initialize(IREVDeployer(address(_basicDeployer)));
+        }
 
-        // Configure the project.
-        _basicDeployer.deployFor({
-            revnetId: FEE_PROJECT_ID,
-            configuration: feeProjectConfig.configuration,
-            terminalConfigurations: feeProjectConfig.terminalConfigurations,
-            suckerDeploymentConfiguration: feeProjectConfig.suckerDeploymentConfiguration,
-            tiered721HookConfiguration: feeProjectConfig.tiered721HookConfiguration,
-            allowedPosts: feeProjectConfig.allowedPosts
-        });
+        // Only configure the fee project if singletons were freshly deployed. Re-running `deployFor` on an
+        // already-configured project would fail because the project is no longer blank.
+        if (!_singletonsExist) {
+            // Approve the basic deployer to configure the project.
+            core.projects.approve({to: address(_basicDeployer), tokenId: FEE_PROJECT_ID});
+
+            // Build the config.
+            FeeProjectConfig memory feeProjectConfig = getFeeProjectConfig();
+
+            // Configure the project.
+            _basicDeployer.deployFor({
+                revnetId: FEE_PROJECT_ID,
+                configuration: feeProjectConfig.configuration,
+                terminalConfigurations: feeProjectConfig.terminalConfigurations,
+                suckerDeploymentConfiguration: feeProjectConfig.suckerDeploymentConfiguration,
+                tiered721HookConfiguration: feeProjectConfig.tiered721HookConfiguration,
+                allowedPosts: feeProjectConfig.allowedPosts
+            });
+        }
     }
 
     /// @notice Check whether a contract has already been deployed at its deterministic address.