@rootzero/contracts 1.12.0 → 1.13.0

package/commands/Provision.sol

@@ -42,7 +42,8 @@ abstract contract Provision is CommandBase, ProvisionHook {
     /// @notice Provision ALLOCATION request blocks and output matching CUSTODY state blocks.
     /// @param c Command context; `c.input` must contain ALLOCATION blocks.
     /// @return CUSTODY block stream matching the provisioned allocations.
-    function provision(CommandContext calldata c) external onlyCommand returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function provision(CommandContext calldata c) external onlyCommand returns (bytes memory, bytes memory) {
         (Cur memory input, uint outputs) = openInput(c.input, descriptor);
         Writer memory output = Writers.allocCustodies(outputs);
 
@@ -52,7 +53,7 @@ abstract contract Provision is CommandBase, ProvisionHook {
             output.appendCustody(allocation);
         }
 
-        return output.finish();
+        return (output.finish(), "");
     }
 }
 
@@ -70,9 +71,10 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
     /// @notice Provision ALLOCATION request blocks with access to a mutable native-value budget.
     /// @param c Command context; `c.input` must contain ALLOCATION blocks.
     /// @return CUSTODY block stream matching the provisioned allocations.
+    /// @return Remaining native value as a refund transaction stream.
     function provisionPayable(
         CommandContext calldata c
-    ) external payable onlyCommand returns (bytes memory) {
+    ) external payable onlyCommand returns (bytes memory, bytes memory) {
         (Cur memory input, uint outputs) = openInput(c.input, descriptor);
         Writer memory output = Writers.allocCustodies(outputs);
         Budget memory budget = openValue();
@@ -83,8 +85,7 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
             output.appendCustody(allocation);
         }
 
-        closeValue(c.account, budget);
-        return output.finish();
+        return (output.finish(), closeValue(budget, c.account));
     }
 }
 

package/commands/Recover.sol

@@ -32,7 +32,8 @@ abstract contract RecoverPayable is CommandBase, Payable, RecoverHook {
     /// @notice Recover each recover block in the command request.
     /// @param c Command context; `c.input` must contain Recover blocks.
     /// @return Empty output state.
-    function recoverPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory) {
+    /// @return Remaining native value as a refund transaction stream.
+    function recoverPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
         Budget memory budget = openValue();
 
@@ -41,7 +42,6 @@ abstract contract RecoverPayable is CommandBase, Payable, RecoverHook {
             recover(handler, key, witness, useValue(budget, resources));
         }
 
-        closeValue(c.account, budget);
-        return "";
+        return ("", closeValue(budget, c.account));
     }
 }

package/commands/Relay.sol

@@ -35,14 +35,14 @@ abstract contract RelayPayable is CommandBase, Payable, RoutePayableHook {
     /// @notice Relay one RELAY request block with the command account and current state.
     /// @param c Command context; `c.input` must contain exactly one RELAY block.
     /// @return Empty output state.
-    function relayPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory) {
+    /// @return Remaining native value as a refund transaction stream.
+    function relayPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory, bytes memory) {
         (Cur memory input, , ) = openLane(c.input, descriptor, Lane.Input, 1);
         (uint portal, uint resources, bytes memory context) = input.relayToContext(c.account, c.state);
 
         Budget memory budget = openValue();
         route(portal, resources, context, budget);
 
-        closeValue(c.account, budget);
-        return "";
+        return ("", closeValue(budget, c.account));
     }
 }

package/commands/Withdraw.sol

@@ -28,16 +28,17 @@ abstract contract Withdraw is CommandBase, WithdrawHook {
     /// @notice Withdraw each BALANCE block from the command state to the command account.
     /// @param c Command context; `c.state` must contain BALANCE blocks.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function withdraw(
         CommandContext calldata c
-    ) external onlyCommand returns (bytes memory) {
+    ) external onlyCommand returns (bytes memory, bytes memory) {
         (Cur memory state, ) = openState(c.state, descriptor);
 
         while (state.i < state.len) {
             (bytes32 asset, uint amount) = state.unpackBalance();
             withdraw(c.account, asset, amount);
         }
-        return "";
+        return ("", "");
     }
 }
 

package/commands/admin/AllowAssets.sol

@@ -25,16 +25,17 @@ abstract contract AllowAssets is AdminBase, AllowAssetsHook {
     /// @notice Allow each ASSET block in the admin request.
     /// @param c Admin command context; `c.input` must contain ASSET blocks.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function allowAssets(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             bytes32 asset = input.unpackAsset();
             allowAsset(asset);
         }
-        return "";
+        return ("", "");
     }
 }
 

package/commands/admin/Allowance.sol

@@ -29,13 +29,14 @@ abstract contract Allowance is AdminBase, AllowanceHook {
     /// @notice Apply each ALLOWANCE block in the admin request.
     /// @param c Admin command context; `c.input` must contain ALLOWANCE blocks.
     /// @return Empty output state.
-    function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             (uint peer, bytes32 asset, uint amount) = input.unpackAllowance();
             allowance(peer, asset, amount);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Appoint.sol

@@ -19,15 +19,16 @@ abstract contract Appoint is AdminBase {
     /// @notice Appoint each ACCOUNT block in the admin request as a guardian.
     /// @param c Admin command context; `c.input` must contain ACCOUNT blocks.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function appoint(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             bytes32 account = input.unpackAccount();
             setGuardian(account, true);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Authorize.sol

@@ -20,13 +20,14 @@ abstract contract Authorize is AdminBase {
     /// @notice Authorize each NODE block in the admin request.
     /// @param c Admin command context; `c.input` must contain NODE blocks.
     /// @return Empty output state.
-    function authorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function authorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             uint node = input.unpackNode();
             setNode(node, true);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/DenyAssets.sol

@@ -25,16 +25,17 @@ abstract contract DenyAssets is AdminBase, DenyAssetsHook {
     /// @notice Deny each ASSET block in the admin request.
     /// @param c Admin command context; `c.input` must contain ASSET blocks.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function denyAssets(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             bytes32 asset = input.unpackAsset();
             denyAsset(asset);
         }
-        return "";
+        return ("", "");
     }
 }
 

package/commands/admin/Dismiss.sol

@@ -19,15 +19,16 @@ abstract contract Dismiss is AdminBase {
     /// @notice Dismiss each ACCOUNT block in the admin request from guardian status.
     /// @param c Admin command context; `c.input` must contain ACCOUNT blocks.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function dismiss(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             bytes32 account = input.unpackAccount();
             setGuardian(account, false);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Execute.sol

@@ -23,7 +23,8 @@ abstract contract ExecutePayable is AdminBase, Payable {
     /// @notice Execute each CALL block in the admin request.
     /// @param c Admin command context; `c.input` must contain CALL blocks.
     /// @return Empty output state.
-    function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
         Budget memory budget = openValue();
 
@@ -31,6 +32,6 @@ abstract contract ExecutePayable is AdminBase, Payable {
             (uint target, uint resources, bytes calldata data) = input.unpackCall();
             rawCall(target, useValue(budget, resources), data);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Label.sol

@@ -19,13 +19,14 @@ abstract contract Label is AdminBase {
     /// @notice Publish each LABEL block in the admin request.
     /// @param c Admin command context; `c.input` must contain LABEL blocks.
     /// @return Empty output state.
-    function label(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function label(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             (uint node, bytes32 namespace, string memory name) = input.unpackLabel();
             emit Labeled(node, namespace, name);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Schemas.sol

@@ -19,13 +19,14 @@ abstract contract PublishSchema is AdminBase {
     /// @notice Publish each SCHEMA block in the admin request.
     /// @param c Admin command context; `c.input` must contain SCHEMA blocks.
     /// @return Empty output state.
-    function publishSchema(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function publishSchema(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             (bytes4 key, string memory body, bytes32 name) = input.unpackSchema();
             emit Schema(host, key, body, name);
         }
-        return "";
+        return ("", "");
     }
 }

package/commands/admin/Unauthorize.sol

@@ -20,13 +20,14 @@ abstract contract Unauthorize is AdminBase {
     /// @notice Unauthorize each NODE block in the admin request.
     /// @param c Admin command context; `c.input` must contain NODE blocks.
     /// @return Empty output state.
-    function unauthorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+    /// @return Empty transaction stream.
+    function unauthorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
         (Cur memory input, ) = openInput(c.input, descriptor);
 
         while (input.i < input.len) {
             uint node = input.unpackNode();
             setNode(node, false);
         }
-        return "";
+        return ("", "");
     }
 }

package/core/Calls.sol

@@ -90,17 +90,18 @@ abstract contract CommandCalls is NodeCalls {
     /// @param account Command account identifier.
     /// @param state Current command state block stream.
     /// @param request Command input block stream.
-    /// @return Decoded command output block stream.
+    /// @return nextState Decoded command output state block stream.
+    /// @return transactions Decoded command transaction block stream.
     function callCommand(
         uint command,
         uint128 value,
         bytes32 account,
         bytes memory state,
         bytes calldata request
-    ) internal returns (bytes memory) {
+    ) internal returns (bytes memory nextState, bytes memory transactions) {
         bytes4 selector = Nodes.commandSelector(command);
         bytes memory data = abi.encodeWithSelector(selector, CommandContext(account, state, request));
-        return abi.decode(trustedCall(command, value, data), (bytes));
+        return abi.decode(trustedCall(command, value, data), (bytes, bytes));
     }
 }
 

package/core/Endpoint.sol

@@ -58,21 +58,6 @@ abstract contract EndpointBase is Runtime, EndpointEvent, LabeledEvent, SchemaEv
         if (size == 0) size = 1;
     }
 
-    /// @notice Return an 8-byte lane value for a generic LIST containing `item`.
-    /// @param item Block key expected inside each LIST payload.
-    /// @return Packed lane key `[Keys.List][item]`.
-    function many(bytes4 item) internal pure returns (bytes8) {
-        return bytes8(bytes.concat(Keys.List, item));
-    }
-
-    /// @notice Append an explicit group size to an 8-byte lane value.
-    /// @param value Packed lane key `[key][item]`.
-    /// @param size Explicit per-operation group size for the lane.
-    /// @return Packed lane key plus group byte.
-    function group(bytes8 value, uint8 size) internal pure returns (bytes9) {
-        return bytes9(bytes.concat(value, bytes1(size)));
-    }
-
     /// @dev Open a descriptor lane and return its effective group and output counts.
     /// An absent lane inherits `expected`; a present lane must match it when nonzero.
     /// @param source Block stream to open for the requested lane.
@@ -118,20 +103,37 @@ abstract contract EndpointBase is Runtime, EndpointEvent, LabeledEvent, SchemaEv
         (input, , outputs) = openLane(source, descriptor, Lane.Input, 0);
     }
 
-    /// @notice Publish the default local block schema and return `Keys.Local`.
-    /// @param body Schema DSL string describing the block payload body.
-    /// @return The default context-local block key.
-    function localSchema(string memory body) internal returns (bytes4) {
-        return localSchema(1, body);
+    /// @notice Return an 8-byte lane value for a generic LIST containing `item`.
+    /// @param item Block key expected inside each LIST payload.
+    /// @return Packed lane key `[Keys.List][item]`.
+    function many(bytes4 item) internal pure returns (bytes8) {
+        return bytes8(bytes.concat(Keys.List, item));
+    }
+
+    /// @notice Append an explicit group size to an 8-byte lane value.
+    /// @param value Packed lane key `[key][item]`.
+    /// @param size Explicit per-operation group size for the lane.
+    /// @return Packed lane key plus group byte.
+    function group(bytes8 value, uint8 size) internal pure returns (bytes9) {
+        return bytes9(bytes.concat(value, bytes1(size)));
     }
 
     /// @notice Publish a context-local block schema and return its key.
     /// @param key Context-local key value.
     /// @param body Schema DSL string describing the block payload body.
     /// @return The context-local block key.
-    function localSchema(uint32 key, string memory body) internal returns (bytes4) {
-        bytes4 k = Keys.local(key);
-        emit Schema(host, k, body, bytes32(0));
+    function schema(uint32 key, string memory body) internal returns (bytes4) {
+        return schema(key, body, bytes32(0));
+    }
+
+    /// @notice Publish a named context-local block schema and return its key.
+    /// @param key Context-local key value.
+    /// @param body Schema DSL string describing the block payload body.
+    /// @param name Schema alias name, or zero for unnamed schemas.
+    /// @return The context-local block key.
+    function schema(uint32 key, string memory body, bytes32 name) internal returns (bytes4) {
+        bytes4 k = bytes4(key);
+        emit Schema(host, k, body, name);
         return k;
     }
 

package/core/Host.sol

@@ -43,7 +43,15 @@ abstract contract Host is
     ///        on it during construction.
     constructor(address cmdr) AccessControl(cmdr) {
         if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
-        IHostIntroduction(cmdr).introduce(host, block.number);
+        introduceTo(Nodes.toHost(cmdr));
+    }
+
+    /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
+    /// @dev Accepts host and endpoint IDs such as commands, ports, queries, and guards.
+    /// Reverts when `node` is not local or embeds the zero address.
+    /// @param node Local EVM node ID whose underlying contract receives the introduction.
+    function introduceTo(uint node) internal {
+        IHostIntroduction(Nodes.addr(node)).introduce(host, block.number);
     }
 
     /// @notice Record a host introduction claim.
@@ -51,7 +59,7 @@ abstract contract Host is
     /// @param peer Host node ID being introduced.
     /// @param blocknum Block number at which the host was deployed.
     function introduce(uint peer, uint blocknum) external {
-        emit Introduction(Nodes.matchHost(peer, msg.sender), blocknum);
+        emit Introduction(host, Nodes.matchHost(peer, msg.sender), blocknum);
     }
 
     /// @notice Accept native ETH transfers (e.g. from command value flows).

package/core/Payable.sol

@@ -2,15 +2,16 @@
 pragma solidity ^0.8.33;
 
 import {Budget, Values} from "../utils/Value.sol";
+import {Cursors} from "../Cursors.sol";
+import {ReceivedEvent} from "../events/Received.sol";
+import {Actions} from "../utils/Actions.sol";
+import {NativeAsset} from "./Runtime.sol";
 import {max128} from "../utils/Utils.sol";
 
 /// @title Payable
 /// @notice Abstract mixin for entrypoints that accept native value (`msg.value`).
 /// Provides shared helpers for mutable native-value budgets.
-abstract contract Payable {
-    /// @dev Thrown when a payable entrypoint completes with unspent native value.
-    error UnusedValue(uint remaining);
-
+abstract contract Payable is NativeAsset, ReceivedEvent {
     /// @notice Open a native-value budget from the current call's `msg.value`.
     /// @return Budget initialized with the full `msg.value`.
     function openValue() internal view returns (Budget memory) {
@@ -33,21 +34,20 @@ abstract contract Payable {
         Values.use(budget, value);
     }
 
-    /// @notice Close a native-value budget and settle any drained value.
-    /// @param account Account identifier for the current invocation.
-    /// @param budget Mutable native-value budget to close.
-    function closeValue(bytes32 account, Budget memory budget) internal {
-        uint value = Values.drain(budget);
-        if (value == 0) return;
-        settleValue(account, value);
-    }
+    /// @notice Drain a native-value budget into a credit-only TRANSACTION block.
+    /// @dev Emits `Received` with `Actions.Refund` when a transaction is created.
+    /// @param budget Mutable budget whose remaining value is drained.
+    /// @param account Destination account to credit with the remaining native value.
+    /// @return transaction Encoded TRANSACTION block, or empty bytes when the budget is empty.
+    function closeValue(
+        Budget memory budget,
+        bytes32 account
+    ) internal returns (bytes memory transaction) {
+        uint amount = Values.drain(budget);
+        if (amount == 0) return "";
 
-    /// @notice Handle a drained native value amount.
-    /// @dev Override to refund or redirect unused value. The default rejects it.
-    /// @param account Account identifier for the current invocation.
-    /// @param value Drained native value amount to settle, in wei.
-    function settleValue(bytes32 account, uint value) internal virtual {
-        account;
-        revert UnusedValue(value);
+        transaction = Cursors.toTransactionBlock(bytes32(0), account, nativeAsset, amount);
+        emit Received(account, nativeAsset, amount, Actions.Refund, 0);
     }
+
 }

package/core/Pipeline.sol

@@ -1,34 +1,38 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {Cursors, Cur} from "../Cursors.sol";
+import {Cursors, Cur, Readers, Reader} from "../Cursors.sol";
 import {Payable} from "./Payable.sol";
+import {Settlement} from "./Settlement.sol";
 import {Budget} from "../utils/Value.sol";
 
 using Cursors for Cur;
+using Readers for Reader;
 
 /// @title Pipeline
 /// @notice Core pipeline functionality shared by higher-level surfaces.
-abstract contract Pipeline is Payable {
+abstract contract Pipeline is Payable, Settlement {
     /// @dev Thrown when the pipeline finishes with non-empty threaded state.
     error UnexpectedState();
 
     /// @notice Override to dispatch one piped step.
-    /// Called once per STEP block. The returned bytes become the state passed to
-    /// the next step, and the final returned state must be empty.
+    /// Called once per STEP block. The returned state becomes the state passed to
+    /// the next step, and the final returned state must be empty. Returned
+    /// transactions are decoded and passed individually to `settle` before the next step runs.
     /// @param target Node ID to invoke or handle.
     /// @param account Account identifier for the piped context.
     /// @param state Current threaded state block stream.
     /// @param request Step request block stream.
     /// @param value Native EVM value assigned to this step.
-    /// @return Updated state block stream for the next step.
+    /// @return nextState Updated state block stream for the next step.
+    /// @return transactions Transaction block stream produced by the command.
     function dispatch(
         uint target,
         bytes32 account,
         bytes memory state,
         bytes calldata request,
         uint128 value
-    ) internal virtual returns (bytes memory);
+    ) internal virtual returns (bytes memory nextState, bytes memory transactions);
 
     /// @notice Execute a STEP block stream through the pipeline.
     /// @dev Reverts with `UnexpectedState` if the final threaded state is non-empty.
@@ -37,20 +41,19 @@ abstract contract Pipeline is Payable {
     /// @param state Initial state block stream passed to the first step.
     /// @param steps STEP block stream to execute.
     /// @param budget Mutable native-value budget shared across all steps.
-    function pipe(
-        bytes32 account,
-        bytes memory state,
-        bytes calldata steps,
-        Budget memory budget
-    ) internal {
+    function pipe(bytes32 account, bytes memory state, bytes calldata steps, Budget memory budget) internal {
         (Cur memory input, ) = Cursors.init(steps, 1);
 
         while (input.i < input.len) {
             (uint target, uint resources, bytes calldata request) = input.unpackStep();
-            state = dispatch(target, account, state, request, useValue(budget, resources));
+            Reader memory txs;
+            (state, txs.source) = dispatch(target, account, state, request, useValue(budget, resources));
+            while (txs.more()) {
+                (bytes32 from, bytes32 to, bytes32 asset, uint amount) = txs.unpackTransaction();
+                settle(from, to, asset, amount);
+            }
         }
 
         if (state.length != 0) revert UnexpectedState();
-        input.complete();
     }
 }

package/core/Settlement.sol

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+/// @title DebitAccountHook
+/// @notice Hook for debiting externally managed account funds.
+abstract contract DebitAccountHook {
+    /// @notice Override to debit externally managed funds from `account`.
+    /// @param account Source account identifier.
+    /// @param asset Asset identifier.
+    /// @param amount Amount to debit.
+    function debitAccount(bytes32 account, bytes32 asset, uint amount) internal virtual;
+}
+
+/// @title CreditAccountHook
+/// @notice Hook for crediting externally managed account funds.
+abstract contract CreditAccountHook {
+    /// @notice Override to credit externally managed funds to `account`.
+    /// @param account Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param amount Amount to credit.
+    function creditAccount(bytes32 account, bytes32 asset, uint amount) internal virtual;
+}
+
+/// @title Settlement
+/// @notice Settles decoded transactions through debit and credit account hooks.
+abstract contract Settlement is DebitAccountHook, CreditAccountHook {
+    /// @notice Settle one transaction by debiting its source and crediting its destination.
+    /// Returns without calling either hook when `amount` is zero and skips either
+    /// operation when the corresponding account is zero.
+    /// @param from Source account identifier.
+    /// @param to Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param amount Token amount.
+    function settle(bytes32 from, bytes32 to, bytes32 asset, uint amount) internal {
+        if (amount == 0) return;
+        if (from != 0) debitAccount(from, asset, amount);
+        if (to != 0) creditAccount(to, asset, amount);
+    }
+}

package/docs/Schema.md

@@ -33,7 +33,7 @@ used. A host can publish the meaning of a custom key with:
 event Schema(uint indexed host, bytes4 key, string schema, bytes32 name);
 ```
 
-For example, a host-specific payment block can use `Keys.Local`, the command
+For example, a host-specific payment block can use a small literal, the command
 selector, or any other chosen `bytes4` value as long as that key is not
 overloaded in the relevant host/schema context.
 
@@ -300,17 +300,17 @@ invalid in any path segment.
 - `#list`: generic list wrapper emitted by `many`
 
 Custom input shapes should define their own context-local block key and publish
-that key with a `Schema` event:
+that key with a `Schema` event. Endpoint contracts can use `schema(...)` for
+that publication:
 
 ```solidity
-bytes4 constant Input = Keys.Local;
-emit Schema(host, Input, "{ bytes32 asset, uint amount }", bytes32("payment"));
+bytes4 input = schema(1, "{ bytes32 asset, uint amount }");
 ```
 
-Use `Keys.local(n)` when a host needs more than one local block key. The key can
-also be a small literal, a selector, or any other `bytes4` value that is unique
-in the context where it is used. The alias names the block; the schema string
-describes only the payload body.
+Use different numeric keys when a host needs more than one local block key. The
+key can also be a selector or any other `bytes4` value that is unique in the
+context where it is used. The alias names the block; the schema string describes
+only the payload body.
 
 ## Standard Blocks
 

package/events/Introduction.sol

@@ -5,11 +5,12 @@ import { EventEmitter } from "./Emitter.sol";
 
 /// @notice Emitted when a host introduces itself to another host.
 abstract contract IntroductionEvent is EventEmitter {
-    string private constant ABI = "event Introduction(uint indexed host, uint blocknum)";
+    string private constant ABI = "event Introduction(uint indexed host, uint peer, uint blocknum)";
 
-    /// @param host Host node ID of the introducing contract.
+    /// @param host Host node ID receiving the introduction.
+    /// @param peer Host node ID of the introducing contract.
     /// @param blocknum Block number at which the host was deployed.
-    event Introduction(uint indexed host, uint blocknum);
+    event Introduction(uint indexed host, uint peer, uint blocknum);
 
     constructor() {
         emit EventAbi(ABI);