@rootzero/contracts 0.9.2 → 0.9.4

package/commands/Base.sol

@@ -2,11 +2,9 @@
 pragma solidity ^0.8.33;
 
 import {NodeCalls} from "../core/Calls.sol";
-import {Cur} from "../Cursors.sol";
 import {CommandEvent} from "../events/Command.sol";
 import {Keys} from "../blocks/Keys.sol";
 import {Ids, Selectors} from "../utils/Ids.sol";
-import {Budget, Values} from "../utils/Value.sol";
 
 /// @notice Execution context passed to every command invocation.
 struct CommandContext {
@@ -25,22 +23,18 @@ struct CommandContext {
 abstract contract CommandBase is NodeCalls, CommandEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
-    /// @dev Thrown when the raw active account word in calldata does not match the decoded context account.
-    error ActiveAccountMismatch();
     /// @dev Thrown when `onlyAdmin` finds that `account` is not the admin account.
     error NotAdmin();
 
-    /// @dev Restrict execution to trusted callers whose decoded context account matches the active calldata account.
-    modifier onlyCommand(bytes32 account) {
-        if (activeAccount() != account) revert ActiveAccountMismatch();
-        enforceCaller(msg.sender);
+    /// @dev Restrict execution to the commander using the host's admin account.
+    modifier onlyAdmin(bytes32 account) {
+        if (account != adminAccount) revert NotAdmin();
+        enforceCommander(msg.sender);
         _;
     }
 
-    /// @dev Restrict execution to trusted callers using the host's admin account.
-    modifier onlyAdmin(bytes32 account) {
-        if (activeAccount() != account) revert ActiveAccountMismatch();
-        if (account != adminAccount) revert NotAdmin();
+    /// @dev Restrict execution to trusted callers.
+    modifier onlyCommand() {
         enforceCaller(msg.sender);
         _;
     }
@@ -66,40 +60,4 @@ abstract contract CommandBase is NodeCalls, CommandEvent {
     function commandId(string memory name) internal view returns (uint) {
         return Ids.toCommand(Selectors.command(name), address(this));
     }
-
-    /// @notice Return the active command account directly from the fixed tuple head in calldata.
-    /// @dev Command entrypoints use the ABI shape `name((bytes32,bytes,bytes))`, so the tuple head
-    /// starts at byte 36 of `msg.data`, with the account field at bytes [36:68).
-    function activeAccount() internal pure returns (bytes32 account) {
-        account = bytes32(msg.data[36:68]);
-    }
-}
-
-/// @title CommandPayable
-/// @notice Abstract base for commands that accept native value (`msg.value`).
-/// Provides a shared settlement hook for any unspent value remaining in the
-/// command's mutable budget after execution completes.
-abstract contract CommandPayable is CommandBase {
-    /// @dev Thrown when a payable command completes with unspent native value.
-    /// Override `settleValue` to implement refund or forwarding behavior instead.
-    error UnusedValue(uint remaining);
-
-    /// @notice Drains the command budget and settles any remaining native value.
-    /// @dev Calls the amount-based `settleValue` hook only when some value remains.
-    /// @param account Caller's account identifier for the current invocation.
-    /// @param budget Mutable native-value budget used during command execution.
-    function settleValue(bytes32 account, Budget memory budget) internal {
-        uint remaining = Values.drain(budget);
-        if (remaining != 0) settleValue(account, remaining);
-    }
-
-    /// @notice Handles leftover native value after a payable command has finished.
-    /// @dev Override this hook to refund or redirect unused value for a command.
-    /// The default implementation rejects any leftover amount.
-    /// @param account Caller's account identifier for the current invocation.
-    /// @param remaining Unspent native value left in the budget, in wei.
-    function settleValue(bytes32 account, uint remaining) internal virtual {
-        account;
-        revert UnusedValue(remaining);
-    }
 }

package/commands/Burn.sol

@@ -25,18 +25,18 @@ abstract contract Burn is CommandBase, BurnHook {
     uint internal immutable burnId = commandId(NAME);
 
     constructor() {
-        emit Command(host, burnId, NAME, "", Keys.Balance, Keys.Empty, false);
+        emit Command(host, burnId, NAME, "0:1:0", "", Keys.Balance, Keys.Empty, false);
     }
 
-    function burn(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory state, , ) = cursor(c.state, 1);
+    function burn(CommandContext calldata c) external onlyCommand returns (bytes memory) {
+        (Cur memory state, ) = cursor(c.state, 1);
 
         while (state.i < state.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
             burn(c.account, asset, meta, amount);
         }
 
-        state.complete();
+        state.close();
         return "";
     }
 }

package/commands/Credit.sol

@@ -22,17 +22,18 @@ abstract contract CreditAccountHook {
 /// An optional ACCOUNT block in the request overrides the default `c.account` destination.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
     string private constant NAME = "creditAccount";
+    string private constant REQUEST = string.concat(Schemas.Unit, ", maybe ", Schemas.Account);
 
     uint internal immutable creditAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, creditAccountId, NAME, Schemas.Account, Keys.Balance, Keys.Empty, false);
+        emit Command(host, creditAccountId, NAME, "0:1:0", REQUEST, Keys.Balance, Keys.Empty, false);
     }
 
     function creditAccount(
         CommandContext calldata c
-    ) external onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory state, , ) = cursor(c.state, 1);
+    ) external onlyCommand returns (bytes memory) {
+        (Cur memory state, ) = cursor(c.state, 1);
         bytes32 to = Cursors.resolveAccount(c.request, c.account);
 
         while (state.i < state.bound) {
@@ -40,7 +41,7 @@ abstract contract CreditAccount is CommandBase, CreditAccountHook {
             creditAccount(to, asset, meta, amount);
         }
 
-        state.complete();
+        state.close();
         return "";
     }
 }

package/commands/Debit.sol

@@ -27,15 +27,15 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
     uint internal immutable debitAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, debitAccountId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, false);
+        emit Command(host, debitAccountId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
     /// @notice Override to customize request parsing or batching for debits.
     /// The default implementation iterates AMOUNT blocks, calls
     /// `debitAccount`, and emits matching BALANCE blocks.
     function debitAccount(bytes32 account, bytes calldata request) internal virtual returns (bytes memory) {
-        (Cur memory input, uint count, ) = cursor(request, 1);
-        Writer memory writer = Writers.allocBalances(count);
+        (Cur memory input, uint groups) = cursor(request, 1);
+        Writer memory writer = Writers.allocBalances(groups);
 
         while (input.i < input.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = input.unpackAmount();
@@ -43,12 +43,13 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
             writer.appendBalance(asset, meta, amount);
         }
 
-        return input.complete(writer);
+        input.close();
+        return writer.finish();
     }
 
     function debitAccount(
         CommandContext calldata c
-    ) external onlyCommand(c.account) returns (bytes memory) {
+    ) external onlyCommand returns (bytes memory) {
         return debitAccount(c.account, c.request);
     }
 }

package/commands/Deposit.sol

@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, CommandPayable, Keys } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
+import { Payable } from "../core/Payable.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
-import { Budget, Values } from "../utils/Value.sol";
+import { Budget } from "../utils/Value.sol";
 
 using Cursors for Cur;
 using Writers for Writer;
@@ -41,14 +42,14 @@ abstract contract Deposit is CommandBase, DepositHook {
     uint internal immutable depositId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, false);
+        emit Command(host, depositId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
     function deposit(
         CommandContext calldata c
-    ) external onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory request, uint count, ) = cursor(c.request, 1);
-        Writer memory writer = Writers.allocBalances(count);
+    ) external onlyCommand returns (bytes memory) {
+        (Cur memory request, uint groups) = cursor(c.request, 1);
+        Writer memory writer = Writers.allocBalances(groups);
 
         while (request.i < request.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = request.unpackAmount();
@@ -56,28 +57,29 @@ abstract contract Deposit is CommandBase, DepositHook {
             writer.appendBalance(asset, meta, amount);
         }
 
-        return request.complete(writer);
+        request.close();
+        return writer.finish();
     }
 }
 
 /// @title DepositPayable
 /// @notice Command that receives externally sourced assets and records them as BALANCE state.
 /// Use `depositPayable` when the hook needs tracked access to `msg.value` via a mutable budget.
-abstract contract DepositPayable is CommandPayable, DepositPayableHook {
+abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
     string private constant NAME = "depositPayable";
 
     uint internal immutable depositPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositPayableId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, true);
+        emit Command(host, depositPayableId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, true);
     }
 
     function depositPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory request, uint count, ) = cursor(c.request, 1);
-        Writer memory writer = Writers.allocBalances(count);
-        Budget memory budget = Values.fromMsg();
+    ) external payable onlyCommand returns (bytes memory) {
+        (Cur memory request, uint groups) = cursor(c.request, 1);
+        Writer memory writer = Writers.allocBalances(groups);
+        Budget memory budget = valueBudget();
 
         while (request.i < request.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = request.unpackAmount();
@@ -86,7 +88,8 @@ abstract contract DepositPayable is CommandPayable, DepositPayableHook {
         }
 
         settleValue(c.account, budget);
-        return request.complete(writer);
+        request.close();
+        return writer.finish();
     }
 }
 

package/commands/Provision.sol

@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandContext, CommandBase, CommandPayable, Keys} from "./Base.sol";
+import {CommandContext, CommandBase, Keys} from "./Base.sol";
+import {Payable} from "../core/Payable.sol";
 import {HostAmount, Cursors, Cur, Schemas, Writer, Writers} from "../Cursors.sol";
-import {Budget, Values} from "../utils/Value.sol";
+import {Budget} from "../utils/Value.sol";
 using Cursors for Cur;
 using Writers for Writer;
 
@@ -37,12 +38,12 @@ abstract contract Provision is CommandBase, ProvisionHook {
     uint internal immutable provisionId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionId, NAME, Schemas.Allocation, Keys.Empty, Keys.Custody, false);
+        emit Command(host, provisionId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, false);
     }
 
-    function provision(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory request, uint count, ) = cursor(c.request, 1);
-        Writer memory writer = Writers.allocCustodies(count);
+    function provision(CommandContext calldata c) external onlyCommand returns (bytes memory) {
+        (Cur memory request, uint groups) = cursor(c.request, 1);
+        Writer memory writer = Writers.allocCustodies(groups);
 
         while (request.i < request.bound) {
             HostAmount memory allocation = request.unpackAllocationValue();
@@ -50,7 +51,8 @@ abstract contract Provision is CommandBase, ProvisionHook {
             writer.appendCustody(allocation);
         }
 
-        return request.complete(writer);
+        request.close();
+        return writer.finish();
     }
 }
 
@@ -58,21 +60,21 @@ abstract contract Provision is CommandBase, ProvisionHook {
 /// @notice Command that provisions assets to peer hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 /// The hook receives a mutable native-value budget drawn from `msg.value`.
-abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
+abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook {
     string private constant NAME = "provisionPayable";
 
     uint internal immutable provisionPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionPayableId, NAME, Schemas.Allocation, Keys.Empty, Keys.Custody, true);
+        emit Command(host, provisionPayableId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, true);
     }
 
     function provisionPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory request, uint count, ) = cursor(c.request, 1);
-        Writer memory writer = Writers.allocCustodies(count);
-        Budget memory budget = Values.fromMsg();
+    ) external payable onlyCommand returns (bytes memory) {
+        (Cur memory request, uint groups) = cursor(c.request, 1);
+        Writer memory writer = Writers.allocCustodies(groups);
+        Budget memory budget = valueBudget();
 
         while (request.i < request.bound) {
             HostAmount memory allocation = request.unpackAllocationValue();
@@ -81,7 +83,8 @@ abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
         }
 
         settleValue(c.account, budget);
-        return request.complete(writer);
+        request.close();
+        return writer.finish();
     }
 }
 

package/commands/Transfer.sol

@@ -23,7 +23,7 @@ abstract contract Transfer is CommandBase, TransferHook {
     uint internal immutable transferId = commandId(NAME);
 
     constructor() {
-        emit Command(host, transferId, NAME, Schemas.Payout, Keys.Empty, Keys.Empty, false);
+        emit Command(host, transferId, NAME, "1:0:0", Schemas.Payout, Keys.Empty, Keys.Empty, false);
     }
 
     /// @notice Override to customize request parsing or batching for transfers.
@@ -32,7 +32,7 @@ abstract contract Transfer is CommandBase, TransferHook {
     /// @param request Full request bytes.
     /// @return Empty bytes (transfers produce no state output).
     function transfer(bytes32 from, bytes calldata request) internal virtual returns (bytes memory) {
-        (Cur memory input, , ) = cursor(request, 1);
+        (Cur memory input, ) = cursor(request, 1);
         Tx memory value;
         value.from = from;
 
@@ -42,13 +42,13 @@ abstract contract Transfer is CommandBase, TransferHook {
             transfer(value);
         }
 
-        input.complete();
+        input.close();
         return "";
     }
 
     function transfer(
         CommandContext calldata c
-    ) external onlyCommand(c.account) returns (bytes memory) {
+    ) external onlyCommand returns (bytes memory) {
         return transfer(c.account, c.request);
     }
 }

package/commands/Withdraw.sol

@@ -21,17 +21,18 @@ abstract contract WithdrawHook {
 /// For internal balance credits, use `creditAccount` instead.
 abstract contract Withdraw is CommandBase, WithdrawHook {
     string private constant NAME = "withdraw";
+    string private constant REQUEST = string.concat(Schemas.Unit, ", maybe ", Schemas.Account);
 
     uint internal immutable withdrawId = commandId(NAME);
 
     constructor() {
-        emit Command(host, withdrawId, NAME, Schemas.Account, Keys.Balance, Keys.Empty, false);
+        emit Command(host, withdrawId, NAME, "0:1:0", REQUEST, Keys.Balance, Keys.Empty, false);
     }
 
     function withdraw(
         CommandContext calldata c
-    ) external onlyCommand(c.account) returns (bytes memory) {
-        (Cur memory state, , ) = cursor(c.state, 1);
+    ) external onlyCommand returns (bytes memory) {
+        (Cur memory state, ) = cursor(c.state, 1);
         bytes32 to = Cursors.resolveAccount(c.request, c.account);
 
         while (state.i < state.bound) {
@@ -39,7 +40,7 @@ abstract contract Withdraw is CommandBase, WithdrawHook {
             withdraw(to, asset, meta, amount);
         }
 
-        state.complete();
+        state.close();
         return "";
     }
 }

package/commands/admin/AllowAssets.sol

@@ -21,20 +21,20 @@ abstract contract AllowAssets is CommandBase, AdminEvent, AllowAssetsHook {
     uint internal immutable allowAssetsId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, allowAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, allowAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false);
     }
 
     function allowAssets(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
+        (Cur memory request, ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             (bytes32 asset, bytes32 meta) = request.unpackAsset();
             allowAsset(asset, meta);
         }
 
-        request.complete();
+        request.close();
         return "";
     }
 }

package/commands/admin/Allowance.sol

@@ -26,18 +26,18 @@ abstract contract Allowance is CommandBase, AdminEvent, AllowanceHook {
     uint internal immutable allowanceId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, allowanceId, NAME, Schemas.Allowance, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, allowanceId, NAME, "1:0:0", Schemas.Allowance, Keys.Empty, Keys.Empty, false);
     }
 
     function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
+        (Cur memory request, ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             (uint peer, bytes32 asset, bytes32 meta, uint amount) = request.unpackAllowance();
             allowance(peer, asset, meta, amount);
         }
 
-        request.complete();
+        request.close();
         return "";
     }
 }

package/commands/admin/Authorize.sol

@@ -16,20 +16,20 @@ abstract contract Authorize is CommandBase, AdminEvent {
     uint internal immutable authorizeId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, authorizeId, NAME, Schemas.Node, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, authorizeId, NAME, "1:0:0", Schemas.Node, Keys.Empty, Keys.Empty, false);
     }
 
     function authorize(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
+        (Cur memory request, ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             uint node = request.unpackNode();
             authorize(node);
         }
 
-        request.complete();
+        request.close();
         return "";
     }
 }

package/commands/admin/DenyAssets.sol

@@ -21,20 +21,20 @@ abstract contract DenyAssets is CommandBase, AdminEvent, DenyAssetsHook {
     uint internal immutable denyAssetsId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, denyAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, denyAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false);
     }
 
     function denyAssets(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
+        (Cur memory request, ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             (bytes32 asset, bytes32 meta) = request.unpackAsset();
             denyAsset(asset, meta);
         }
 
-        request.complete();
+        request.close();
         return "";
     }
 }

package/commands/admin/Destroy.sol

@@ -22,7 +22,7 @@ abstract contract Destroy is CommandBase, AdminEvent, DestroyHook {
     uint internal immutable destroyId = commandId(NAME);
 
     constructor(string memory input) {
-        emit Admin(host, destroyId, NAME, input, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, destroyId, NAME, "1:0:0", input, Keys.Empty, Keys.Empty, false);
     }
 
     function destroy(

package/commands/admin/Execute.sol

@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandContext, CommandPayable, Keys} from "../Base.sol";
+import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {Payable} from "../../core/Payable.sol";
 import {Cursors, Cur, Schemas} from "../../Cursors.sol";
 import {AdminEvent} from "../../events/Admin.sol";
-import {Budget, Values} from "../../utils/Value.sol";
+import {Budget} from "../../utils/Value.sol";
 import {Ids} from "../../utils/Ids.sol";
 
 using Cursors for Cur;
@@ -13,26 +14,26 @@ using Cursors for Cur;
 /// @notice Admin command that forwards raw calldata to one or more target nodes.
 /// Each CALL block specifies a target node ID, native value, and raw calldata payload.
 /// Only callable by the admin account.
-abstract contract ExecutePayable is CommandPayable, AdminEvent {
+abstract contract ExecutePayable is CommandBase, Payable, AdminEvent {
     string private constant NAME = "executePayable";
 
     uint internal immutable executePayableId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, executePayableId, NAME, Schemas.Call, Keys.Empty, Keys.Empty, true);
+        emit Admin(host, executePayableId, NAME, "1:0:0", Schemas.Call, Keys.Empty, Keys.Empty, true);
     }
 
     function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
-        Budget memory budget = Values.fromMsg();
+        (Cur memory request, ) = cursor(c.request, 1);
+        Budget memory budget = valueBudget();
 
         while (request.i < request.bound) {
             (uint target, uint value, bytes calldata data) = request.unpackCall();
             address addr = Ids.nodeAddr(target);
-            callAddr(addr, Values.use(budget, value), data);
+            callAddr(addr, useValue(budget, value), data);
         }
 
-        request.complete();
+        request.close();
         settleValue(c.account, budget);
         return "";
     }

package/commands/admin/Init.sol

@@ -22,7 +22,7 @@ abstract contract Init is CommandBase, AdminEvent, InitHook {
     uint internal immutable initId = commandId(NAME);
 
     constructor(string memory input) {
-        emit Admin(host, initId, NAME, input, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, initId, NAME, "1:0:0", input, Keys.Empty, Keys.Empty, false);
     }
 
     function init(

package/commands/admin/Unauthorize.sol

@@ -16,20 +16,20 @@ abstract contract Unauthorize is CommandBase, AdminEvent {
     uint internal immutable unauthorizeId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, unauthorizeId, NAME, Schemas.Node, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, unauthorizeId, NAME, "1:0:0", Schemas.Node, Keys.Empty, Keys.Empty, false);
     }
 
     function unauthorize(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, , ) = cursor(c.request, 1);
+        (Cur memory request, ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             uint node = request.unpackNode();
             unauthorize(node);
         }
 
-        request.complete();
+        request.close();
         return "";
     }
 }

package/core/Access.sol

@@ -78,4 +78,15 @@ abstract contract AccessControl is RootZeroContext, AccessEvent {
         }
         return caller;
     }
+
+    /// @notice Assert that `caller` is the commander and return it.
+    /// Used by admin modifiers to keep governance authority separate from peer trust.
+    /// @param caller Address to validate.
+    /// @return The same `caller` value if it is the commander.
+    function enforceCommander(address caller) internal view returns (address) {
+        if (caller == address(0) || caller != commander) {
+            revert UnauthorizedCaller(caller);
+        }
+        return caller;
+    }
 }

package/core/Context.sol

@@ -27,23 +27,21 @@ abstract contract RootZeroContext {
     /// @param source Calldata slice to parse.
     /// @param group Expected block group size (e.g. 1 for single, 2 for paired).
     /// @return cur Cursor with `bound` set to the end of the first run.
-    /// @return count Total number of blocks in the run (a multiple of `group`).
-    /// @return quotient Number of groups in the run (`count / group`).
-    function cursor(bytes calldata source, uint group) internal pure returns (Cur memory cur, uint count, uint quotient) {
-        cur = Cursors.open(source);
-        (, count, quotient) = cur.primeRun(group);
+    /// @return groups Number of block groups in the run (`prime block count / group`).
+    function cursor(bytes calldata source, uint group) internal pure returns (Cur memory cur, uint groups) {
+        return Cursors.init(source, group);
     }
 
-    /// @notice Open a cursor, prime it, and assert that its normalized quotient matches `expectedQuotient`.
-    /// Equivalent to `open(source)` followed by `primeRun(group)` and a direct quotient equality check.
-    /// Reverts with `Cursors.BadRatio` when the quotient does not match.
+    /// @notice Open a cursor, prime it, and assert that its group count matches `expectedGroups`.
+    /// Equivalent to `open(source)` followed by `primeRun(group)` and a direct group-count equality check.
+    /// Reverts with `Cursors.BadRatio` when the group count does not match.
     /// @param source Calldata slice to parse.
     /// @param group Expected block group size (e.g. 1 for single, 2 for paired).
-    /// @param expectedQuotient Required number of groups in the first run.
+    /// @param expectedGroups Required number of groups in the first run.
     /// @return cur Cursor with `bound` set to the end of the first run.
-    function cursor(bytes calldata source, uint group, uint expectedQuotient) internal pure returns (Cur memory cur) {
-        cur = Cursors.open(source);
-        (, , uint quotient) = cur.primeRun(group);
-        if (quotient != expectedQuotient) revert Cursors.BadRatio();
+    function cursor(bytes calldata source, uint group, uint expectedGroups) internal pure returns (Cur memory cur) {
+        uint groups;
+        (cur, groups) = Cursors.init(source, group);
+        if (groups != expectedGroups) revert Cursors.BadRatio();
     }
 }