@rootzero/contracts 1.14.0 → 1.15.0

package/core/Host.sol

@@ -1,15 +1,17 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AccessControl} from "./Access.sol";
+import {AccessDenied, CallerAccess, CommanderAccess} from "./Access.sol";
+import {Runtime} from "./Runtime.sol";
+import {Annotate} from "../commands/admin/Annotate.sol";
 import {Appoint} from "../commands/admin/Appoint.sol";
 import {Authorize} from "../commands/admin/Authorize.sol";
 import {Dismiss} from "../commands/admin/Dismiss.sol";
 import {Unauthorize} from "../commands/admin/Unauthorize.sol";
 import {ExecutePayable} from "../commands/admin/Execute.sol";
-import {Label} from "../commands/admin/Label.sol";
 import {Revoke} from "../guards/Revoke.sol";
 import {IntroductionEvent} from "../events/Introduction.sol";
+import {Accounts} from "../utils/Accounts.sol";
 import {Nodes} from "../utils/Nodes.sol";
 
 /// @title IHostIntroduction
@@ -21,6 +23,55 @@ interface IHostIntroduction {
     function introduce(uint peer, uint blocknum) external;
 }
 
+/// @title HostIntroduction
+/// @notice Shared deployment-time introduction behavior for rootzero hosts.
+/// Calls a deployed commander during construction without adding an inbound
+/// introduction endpoint to the inheriting host.
+abstract contract HostIntroduction is Runtime {
+    /// @param cmdr Commander address to introduce this host to when it is a deployed contract.
+    /// @dev Deployment reverts if a contract commander does not accept `introduce(uint,uint)`.
+    constructor(address cmdr) {
+        if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
+        introduceTo(Nodes.toHost(cmdr));
+    }
+
+    /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
+    /// @dev Accepts host and endpoint IDs such as commands, ports, queries, and guards.
+    /// Reverts when `node` is not local or embeds the zero address.
+    /// @param node Local EVM node ID whose underlying contract receives the introduction.
+    function introduceTo(uint node) internal {
+        IHostIntroduction(Nodes.addr(node)).introduce(host, block.number);
+    }
+}
+
+/// @title CommandHost
+/// @notice Minimal host base for commander-only command execution.
+/// Does not include admin commands, peer authorization, guardians, inbound
+/// introductions, generic execution, or a native-token receive function.
+/// Commands using trusted `NodeCalls` must separately compose a `TrustAccess` policy.
+abstract contract CommandHost is CommanderAccess, CallerAccess, HostIntroduction {
+    /// @dev Thrown when a commander-only host is deployed without an external commander.
+    error InvalidCommander();
+
+    /// @param cmdr Nonzero address allowed to invoke hosted commands.
+    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {
+        if (cmdr == address(0)) revert InvalidCommander();
+    }
+
+    function enforceCaller(address caller) internal view virtual override returns (address) {
+        return enforceCommander(caller);
+    }
+
+}
+
+/// @title Admins
+/// @notice Optional bundle of the default host administration commands.
+abstract contract Admins is Annotate, ExecutePayable, Authorize, Unauthorize {}
+
+/// @title Guardians
+/// @notice Optional bundle for guardian management and the default revoke guard.
+abstract contract Guardians is Appoint, Dismiss, Revoke {}
+
 /// @title Host
 /// @notice Abstract base contract for rootzero host implementations.
 /// Inherits admin command support (authorize, unauthorize, label, executePayable),
@@ -28,30 +79,21 @@ interface IHostIntroduction {
 /// optionally introduces itself to a commander host at deployment.
 /// Accepts native ETH payments via the `receive` function.
 abstract contract Host is
-    Authorize,
-    Unauthorize,
-    Revoke,
-    Appoint,
-    Dismiss,
-    Label,
-    ExecutePayable,
+    Admins,
+    Guardians,
+    HostIntroduction,
     IntroductionEvent,
     IHostIntroduction
 {
-    /// @param cmdr Commander address; passed to `AccessControl`.
+    /// @param cmdr Commander address; used by the composed access capabilities.
     ///        If `cmdr` is a deployed contract, the host calls `introduce`
     ///        on it during construction.
-    constructor(address cmdr) AccessControl(cmdr) {
-        if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
-        introduceTo(Nodes.toHost(cmdr));
-    }
+    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {}
 
-    /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
-    /// @dev Accepts host and endpoint IDs such as commands, ports, queries, and guards.
-    /// Reverts when `node` is not local or embeds the zero address.
-    /// @param node Local EVM node ID whose underlying contract receives the introduction.
-    function introduceTo(uint node) internal {
-        IHostIntroduction(Nodes.addr(node)).introduce(host, block.number);
+    /// @notice Assert that `caller` may invoke commands on a peer-aware host.
+    function enforceCaller(address caller) internal view virtual override returns (address) {
+        if (caller == address(0) || !isTrustedCaller(caller)) revert AccessDenied();
+        return caller;
     }
 
     /// @notice Record a host introduction claim.
@@ -59,7 +101,7 @@ abstract contract Host is
     /// @param peer Host node ID being introduced.
     /// @param blocknum Block number at which the host was deployed.
     function introduce(uint peer, uint blocknum) external {
-        emit Introduction(host, Nodes.matchHost(peer, msg.sender), blocknum);
+        emit Introduction(host, Nodes.matchHost(peer, msg.sender), Accounts.toUser(tx.origin), blocknum);
     }
 
     /// @notice Accept native ETH transfers (e.g. from command value flows).

package/docs/Schema.md

@@ -27,12 +27,23 @@ For example, the standard `amount` alias uses the key derived from `#amount`
 and the schema body `{ bytes32 asset, uint amount }`. Custom block keys do not
 have to be keccak-derived. They
 are opaque `bytes4` tags and only need to be unique in the context where they are
-used. A host can publish the meaning of a custom key with:
+used. A host can publish the meaning of a custom key as an annotation:
 
 ```solidity
-event Schema(uint indexed host, uint spec, string body, bytes32 name);
+event Annotation(uint indexed entity, bytes data);
+#schema { uint spec, #string as body, bytes32 name }
 ```
 
+Annotation merge behavior is defined by the annotation block type rather than
+by the `Annotation` event. A `#schema` annotation is identified by its entity
+and the block key encoded in `spec`: distinct keys accumulate, while the latest
+trusted claim for the same key replaces the earlier one. Other annotation types
+may define additive, historical, or explicitly revocable behavior instead.
+
+The standard `#action { uint action }` annotation assigns one primary semantic
+action to an entity. The latest trusted value replaces the previous value, and
+`Actions.None` clears the classification.
+
 For example, a host-specific payment block can use a small literal, the command
 selector, or any other chosen `bytes4` value as long as that key is not
 overloaded in the relevant host/schema context.
@@ -155,7 +166,7 @@ top-level structure.
 
 ## Field Aliases
 
-Block aliases are published in `Schema` events. Field aliases are presentation
+Block aliases are published in `#schema` annotations. Field aliases are presentation
 metadata for tooling. They do not change payload layout or runtime keys.
 
 ```txt
@@ -306,8 +317,8 @@ invalid in any path segment.
 - `#list`: generic list wrapper emitted by `many`
 
 Custom input shapes should define their own context-local block spec and publish
-it with a `Schema` event. Endpoint contracts can use `schema(...)` to construct
-and publish that spec:
+it with a `#schema` annotation. Endpoint contracts can use `schema(...)` to
+construct and publish that spec:
 
 ```solidity
 uint input = schema(1, 64, 64, 64, "{ bytes32 asset, uint amount }", bytes32(0));

package/events/Annotation.sol

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {EventEmitter} from "./Emitter.sol";
+
+/// @notice Emitted to attach encoded annotation blocks to an entity.
+/// @dev `data` is a protocol block stream. A single block is the conventional
+/// case, but related annotations may be emitted together. Annotations are claims
+/// by the emitting contract, and each block key defines its annotation type.
+/// Consumers process events in log order and blocks in stream order, then apply
+/// the identity and merge rules defined by each annotation type. The event does
+/// not impose a universal replacement policy: a type may replace, accumulate,
+/// preserve history, or define its own revocation convention.
+abstract contract AnnotationEvent is EventEmitter {
+    string private constant ABI = "event Annotation(uint indexed entity, bytes data)";
+
+    /// @param entity Entity being annotated.
+    /// @param data Encoded annotation block stream, conventionally containing one block.
+    event Annotation(uint indexed entity, bytes data);
+
+    constructor() {
+        emit EventAbi(ABI);
+    }
+}

package/events/Guardian.sol

@@ -3,12 +3,12 @@ pragma solidity ^0.8.33;
 
 import { EventEmitter } from "./Emitter.sol";
 
-/// @notice Emitted when a guardian account status changes on a host.
+/// @notice Emitted when a user account's guardian role changes on a host.
 abstract contract GuardianEvent is EventEmitter {
     string private constant ABI = "event Guardian(uint indexed host, bytes32 account, bool active)";
 
     /// @param host Host node ID where the guardian change occurred.
-    /// @param account Guardian account ID.
+    /// @param account User account ID assigned or removed as a guardian.
     /// @param active True if the guardian is enabled, false if revoked.
     event Guardian(uint indexed host, bytes32 account, bool active);
 

package/events/Introduction.sol

@@ -5,12 +5,13 @@ import { EventEmitter } from "./Emitter.sol";
 
 /// @notice Emitted when a host introduces itself to another host.
 abstract contract IntroductionEvent is EventEmitter {
-    string private constant ABI = "event Introduction(uint indexed host, uint peer, uint blocknum)";
+    string private constant ABI = "event Introduction(uint indexed host, uint peer, bytes32 origin, uint blocknum)";
 
     /// @param host Host node ID receiving the introduction.
     /// @param peer Host node ID of the introducing contract.
+    /// @param origin Transaction-origin address encoded as a chain-agnostic user account.
     /// @param blocknum Block number at which the host was deployed.
-    event Introduction(uint indexed host, uint peer, uint blocknum);
+    event Introduction(uint indexed host, uint peer, bytes32 origin, uint blocknum);
 
     constructor() {
         emit EventAbi(ABI);

package/execution/Execution.sol

@@ -166,6 +166,14 @@ library Executions {
         exec.decoders = cur.seekAbs(end);
     }
 
+    /// @notice Require the active execution decoder to be at absolute position `abs`.
+    /// @dev The most recent lane-aware decoder operation determines the active lane.
+    /// @param exec Execution whose active decoder position is validated.
+    /// @param abs Expected absolute position.
+    function expectAbs(Execution memory exec, uint abs) internal pure {
+        exec.decoders.expectAbs(abs);
+    }
+
     /// @notice Consume a LIST block and return a cursor scoped to its payload.
     /// @param exec Execution whose decoder is advanced.
     /// @param lane Decoder lane containing the LIST block.
@@ -520,6 +528,21 @@ library Executions {
         exec.decoders = cur.seekAbs(end);
     }
 
+    /// @notice Decode and consume one ANNOTATION block from `lane`.
+    /// @param exec Execution whose decoder is advanced.
+    /// @param lane Decoder lane to consume.
+    /// @return entity Decoded entity identifier.
+    /// @return data Decoded annotation block stream.
+    function unpackAnnotation(
+        Execution memory exec,
+        uint8 lane
+    ) internal pure returns (uint entity, bytes calldata data) {
+        uint cur = exec.decoders.select(lane);
+        uint end;
+        (entity, data, end) = Blocks.unpackAnnotation(cur.absolute());
+        exec.decoders = cur.seekAbs(end);
+    }
+
     /// @notice Decode and consume one CONTEXT block from `lane`.
     /// @param exec Execution whose decoder is advanced.
     /// @param lane Decoder lane to consume.
@@ -573,17 +596,16 @@ library Executions {
     /// @notice Decode and consume one LABEL block from `lane`.
     /// @param exec Execution whose decoder is advanced.
     /// @param lane Decoder lane to consume.
-    /// @return id Decoded node identifier.
     /// @return namespace Decoded label namespace.
     /// @return name Decoded label text.
     function unpackLabel(
         Execution memory exec,
         uint8 lane
-    ) internal pure returns (uint id, bytes32 namespace, string memory name) {
+    ) internal pure returns (bytes32 namespace, string memory name) {
         uint cur = exec.decoders.select(lane);
         uint abs = cur.absolute();
         uint end;
-        (id, namespace, name, end) = Blocks.unpackLabel(abs);
+        (namespace, name, end) = Blocks.unpackLabel(abs);
         exec.decoders = cur.seekAbs(end);
     }
 
@@ -956,13 +978,12 @@ library Executions {
 
     /// @notice Append a LABEL block to execution output.
     /// @param exec Execution receiving the block.
-    /// @param id Node identifier to encode.
     /// @param namespace Label namespace to encode.
     /// @param name Label text to encode.
-    function outputLabel(Execution memory exec, uint id, bytes32 namespace, string memory name) internal pure {
-        uint size = Sizes.B64 + Sizes.Header + bytes(name).length;
+    function outputLabel(Execution memory exec, bytes32 namespace, string memory name) internal pure {
+        uint size = Sizes.B32 + Sizes.Header + bytes(name).length;
         uint i = reserve(exec, size);
-        Blocks.writeLabel(exec.output, i, id, namespace, name);
+        Blocks.writeLabel(exec.output, i, namespace, name);
     }
 
     /// @notice Append a SCHEMA block to execution output.

package/guards/Base.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AccessControl} from "../core/Access.sol";
 import {EndpointBase} from "../core/Endpoint.sol";
+import {GuardianAccess} from "../core/Access.sol";
 import {Specs} from "../codec/Specs.sol";
 import {Nodes} from "../utils/Nodes.sol";
 import {Selectors} from "../utils/Selectors.sol";
@@ -10,10 +10,10 @@ import {Selectors} from "../utils/Selectors.sol";
 /// @title GuardBase
 /// @notice Abstract base for guardian-only direct host actions.
 /// Guard actions are non-payable direct calls with no command context, state, or response.
-abstract contract GuardBase is AccessControl, EndpointBase {
+abstract contract GuardBase is GuardianAccess, EndpointBase {
     /// @dev Restrict execution to active guardian addresses.
     modifier onlyGuardian() {
-        if (!isGuardian(msg.sender)) revert AccessDenied();
+        enforceGuardian(msg.sender);
         _;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rootzero/contracts",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Solidity contracts and protocol building blocks for rootzero hosts and commands.",
   "private": false,
   "license": "GPL-3.0-only",

package/ports/Base.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.33;
 
 import { NodeCalls } from "../core/Calls.sol";
+import { NodeAccess } from "../core/Access.sol";
 import { Specs } from "../codec/Specs.sol";
 import { EndpointBase } from "../core/Endpoint.sol";
 import { Nodes } from "../utils/Nodes.sol";
@@ -12,14 +13,11 @@ import { Descriptors } from "../codec/Descriptors.sol";
 /// @notice Abstract base for peer-facing rootzero ports.
 /// Ports handle inter-host operations between cooperating hosts.
 /// Access is restricted to trusted peer callers via `onlyPeer`.
-abstract contract PortBase is NodeCalls, EndpointBase {
-    /// @dev Thrown when the commander attempts to call a port entrypoint directly.
-    error CommanderNotAllowed();
+abstract contract PortBase is NodeCalls, NodeAccess, EndpointBase {
 
     /// @dev Restrict execution to trusted callers, excluding the commander.
     modifier onlyPeer() {
-        if (msg.sender == commander) revert CommanderNotAllowed();
-        enforceCaller(msg.sender);
+        enforcePeer(msg.sender);
         _;
     }
 
@@ -44,7 +42,21 @@ abstract contract PortBase is NodeCalls, EndpointBase {
         uint output,
         bool funded
     ) internal returns (uint id, uint descriptor) {
+        descriptor = Descriptors.create(Specs.Empty, input, output, 0, funded ? Descriptors.Funded : 0);
+        return port(name, descriptor);
+    }
+
+    /// @notice Publish an already constructed port descriptor and default label.
+    /// @param name Port entrypoint name and default label. It must exactly
+    /// match the Solidity port function name used by the canonical ABI.
+    /// @param descriptor Packed port endpoint descriptor.
+    /// @return id Port node ID.
+    /// @return published Published endpoint descriptor.
+    function port(
+        string memory name,
+        uint descriptor
+    ) internal returns (uint id, uint published) {
         id = Nodes.toPort(Selectors.port(name), address(this));
-        descriptor = endpoint(id, name, Specs.Empty, input, output, 0, funded ? Descriptors.Funded : 0);
+        published = endpoint(id, name, descriptor);
     }
 }

package/ports/Settle.sol

@@ -5,17 +5,21 @@ import {PortBase} from "./Base.sol";
 import {Settlement} from "../core/Settlement.sol";
 import {Specs} from "../Codec.sol";
 import {Execution, Executions, Lanes} from "../execution/Execution.sol";
+import {Action} from "../annotations/Action.sol";
+import {Actions} from "../utils/Actions.sol";
 
 using Executions for Execution;
 
 /// @title PortSettle
 /// @notice Port that consumes peer-supplied TRANSACTION blocks through debit and credit hooks.
 /// Each TRANSACTION block calls `debitAccount` for `from` and `creditAccount` for `to`.
-abstract contract PortSettle is PortBase, Settlement {
+abstract contract PortSettle is PortBase, Settlement, Action {
     uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = port("portSettle", Specs.Transaction, Specs.Empty, false);
+        uint id;
+        (id, descriptor) = port("portSettle", Specs.Transaction, Specs.Empty, false);
+        action(id, Actions.Settle);
     }
 
     /// @notice Execute the port-settle call.

package/queries/Base.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.33;
 
 import { EndpointBase } from "../core/Endpoint.sol";
+import { Descriptors } from "../codec/Descriptors.sol";
 import { Specs } from "../codec/Specs.sol";
 import { Nodes } from "../utils/Nodes.sol";
 import { Selectors } from "../utils/Selectors.sol";
@@ -24,7 +25,21 @@ abstract contract QueryBase is EndpointBase {
         uint input,
         uint output
     ) internal returns (uint id, uint descriptor) {
+        descriptor = Descriptors.create(Specs.Empty, input, output, 0, 0);
+        return query(name, descriptor);
+    }
+
+    /// @notice Publish an already constructed query descriptor and default label.
+    /// @param name Query entrypoint name and default label. It must exactly
+    /// match the Solidity query function name used by the canonical ABI.
+    /// @param descriptor Packed query endpoint descriptor.
+    /// @return id Query node ID.
+    /// @return published Published endpoint descriptor.
+    function query(
+        string memory name,
+        uint descriptor
+    ) internal returns (uint id, uint published) {
         id = Nodes.toQuery(Selectors.query(name), address(this));
-        descriptor = endpoint(id, name, Specs.Empty, input, output, 0, 0);
+        published = endpoint(id, name, descriptor);
     }
 }

package/utils/Accounts.sol

@@ -10,7 +10,6 @@ import {ensureAddr, isFamily, toLocalBase, toUnspecifiedBase} from "./Utils.sol"
 ///
 /// Account IDs embed a 4-byte type tag in bits [255:224]:
 ///   - `Admin`    — chain-local EVM address in bits [191:32]
-///   - `Guardian` — chain-local EVM address in bits [191:32]
 ///   - `User`     — chain-agnostic EVM address in bits [191:32]
 ///
 /// If the first byte is zero, the account is an opaque
@@ -26,8 +25,6 @@ library Accounts {
     uint24 constant Family = (uint24(Layout.Evm) << 8) | uint24(Layout.Account);
     /// @dev Full 4-byte type prefix for admin accounts (chain-local EVM address).
     uint32 constant Admin = (uint32(Layout.Evm) << 16) | (uint32(Layout.Account) << 8) | uint32(Layout.Admin);
-    /// @dev Full 4-byte type prefix for guardian accounts (chain-local EVM address).
-    uint32 constant Guardian = (uint32(Layout.Evm) << 16) | (uint32(Layout.Account) << 8) | uint32(Layout.Guardian);
     /// @dev Full 4-byte type prefix for user accounts (chain-agnostic EVM address).
     uint32 constant User = (uint32(Layout.Evm) << 16) | (uint32(Layout.Account) << 8) | uint32(Layout.User);
 
@@ -53,11 +50,6 @@ library Accounts {
         return prefix(account) == Admin;
     }
 
-    /// @notice Return true if `account` is a guardian account.
-    function isGuardian(bytes32 account) internal pure returns (bool) {
-        return prefix(account) == Guardian;
-    }
-
     /// @notice Return true if `account` is a user account.
     function isUser(bytes32 account) internal pure returns (bool) {
         return prefix(account) == User;
@@ -87,14 +79,6 @@ library Accounts {
         return value;
     }
 
-    /// @notice Assert that `value` is a guardian account and return it unchanged.
-    /// @param value Account identifier to validate.
-    /// @return account The same `value` if it is a guardian account.
-    function guardian(bytes32 value) internal pure returns (bytes32 account) {
-        if (!isGuardian(value)) revert InvalidAccount();
-        return value;
-    }
-
     /// @notice Assert that `value` is a user account and return it unchanged.
     /// @param value Account identifier to validate.
     /// @return account The same `value` if it is a user account.
@@ -110,13 +94,6 @@ library Accounts {
         return bytes32(toLocalBase(Admin) | (uint(uint160(account)) << 32));
     }
 
-    /// @notice Encode an EVM address as a chain-local guardian account ID.
-    /// @param account EVM address to embed.
-    /// @return Guardian account ID bound to the current chain.
-    function toGuardian(address account) internal view returns (bytes32) {
-        return bytes32(toLocalBase(Guardian) | (uint(uint160(account)) << 32));
-    }
-
     /// @notice Encode an EVM address as a chain-agnostic user account ID.
     /// @param account EVM address to embed.
     /// @return User account ID without a chain binding.

package/utils/Cursors.sol

@@ -20,9 +20,22 @@ struct Cur {
 /// bits  96-111   groups
 /// bits 112-119   flags (consumer-defined)
 /// bits 120-127   tag
-/// A packed word may contain a lower cursor in bits 0-127 and a higher cursor
-/// in bits 128-255. Operations target the lower cursor; `select` swaps a
-/// requested tagged cursor into that position.
+///
+/// A cursor is one 128-bit value with this layout. A pair is a 256-bit value
+/// containing a lower cursor in bits 0-127 and an optional higher cursor in
+/// bits 128-255. The lower cursor is the active cursor: navigation and
+/// inspection operations target it, and `select` swaps a requested tagged
+/// cursor into that position while preserving the pair.
+///
+/// A mark is a standalone cursor value used as an immutable positional
+/// reference. It retains the cursor's offset, length, groups, flags, and tag,
+/// but may carry a different `i`. A mark has no intrinsic boundary or movement
+/// semantics; callers may later use its position for comparison, validation,
+/// seeking, or another operation. Because it has the ordinary single-cursor
+/// layout, existing positional decoding and absolute-position rules also apply
+/// to marks. A zero mark identifies the empty cursor at position zero; `before`
+/// therefore treats it as already reached.
+///
 /// The zero word represents an absent cursor.
 library Cursors {
     /// @dev A cursor position exceeds its logical length.
@@ -37,8 +50,8 @@ library Cursors {
     /// @dev Paired cursors must have different identity tags.
     error DuplicateTag(uint8 tag);
 
-    /// @dev Neither packed cursor has the requested tag.
-    error MissingTag(uint8 tag);
+    /// @dev Neither packed cursor matches the requested identity.
+    error MissingCursor();
 
     // Creation and sources
 
@@ -97,6 +110,14 @@ library Cursors {
         len = uint32(cur >> 64);
     }
 
+    /// @notice Return the active cursor without its position.
+    /// @dev Ignores the upper cursor when `cur` is a pair.
+    /// @param cur Packed cursor or cursor pair.
+    /// @return The lower cursor's offset, length, groups, flags, and tag.
+    function frame(uint cur) internal pure returns (uint) {
+        return clear32(uint128(cur), 0);
+    }
+
     /// @notice Return the absolute position of the lower cursor as `offset + i`.
     /// @dev Performs no bounds check.
     /// @param cur Packed cursor or cursor pair.
@@ -144,6 +165,13 @@ library Cursors {
         if (uint32(cur) != i) revert UnexpectedPosition();
     }
 
+    /// @notice Require the lower cursor to be positioned at absolute position `abs`.
+    /// @param cur Packed cursor or cursor pair.
+    /// @param abs Expected absolute position.
+    function expectAbs(uint cur, uint abs) internal pure {
+        if (absolute(cur) != abs) revert UnexpectedPosition();
+    }
+
     /// @notice Return whether the lower cursor contains `flag`.
     /// @param cur Packed cursor or cursor pair.
     /// @param flag Consumer-defined flag bit or bit set.
@@ -279,7 +307,38 @@ library Cursors {
         if (uint8(cur >> 120) == expected) return cur;
 
         updated = swap(cur);
-        if (uint8(updated >> 120) != expected) revert MissingTag(expected);
+        if (uint8(updated >> 120) != expected) revert MissingCursor();
+    }
+
+    // Marks
+
+    /// @notice Select the live cursor whose frame matches the active cursor in `mark`.
+    /// @dev Only the lower 128 bits of `mark` are considered. The returned value
+    /// preserves the cursor pair and places the matching cursor in the lower half.
+    /// A zero frame may select an empty cursor lane.
+    /// @param cur Packed cursor or cursor pair to search.
+    /// @param mark Cursor-shaped positional reference to match.
+    /// @return located Cursor pair with the matching cursor active.
+    function locate(uint cur, uint mark) internal pure returns (uint located) {
+        uint expected = frame(mark);
+        if (frame(cur) == expected) return cur;
+
+        located = swap(cur);
+        if (frame(located) != expected) revert MissingCursor();
+    }
+
+    /// @notice Return whether a matched cursor is positioned before `mark`.
+    /// @dev Returns false at the mark and reverts after it. Only the active lower
+    /// cursor in `mark` participates in the comparison. A zero mark represents
+    /// the already-reached position of an empty cursor.
+    /// @param cur Packed cursor or cursor pair containing the marked cursor.
+    /// @param mark Cursor-shaped positional reference.
+    /// @return Whether the live cursor position precedes the marked position.
+    function before(uint cur, uint mark) internal pure returns (bool) {
+        uint i = uint32(locate(cur, mark));
+        uint target = uint32(mark);
+        if (i > target) revert OutOfBounds();
+        return i < target;
     }
 
     // Consumption

package/utils/Layout.sol

@@ -40,8 +40,6 @@ library Layout {
 
     /// @dev Admin account — chain-local, backed by an EVM address.
     uint8 constant Admin = 0x01;
-    /// @dev Guardian account — chain-local, backed by an EVM address.
-    uint8 constant Guardian = 0x02;
     /// @dev User account — chain-agnostic, backed by an EVM address.
     uint8 constant User = 0x03;
     // -------------------------------------------------------------------------

package/commands/admin/Label.sol

@@ -1,36 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-pragma solidity ^0.8.33;
-
-import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
-using Executions for Execution;
-
-/// @title Label
-/// @notice Admin command that publishes namespaced labels for node IDs.
-/// Each LABEL block in the input emits one `Labeled` event. Only callable by
-/// the admin account.
-abstract contract Label is AdminBase {
-    uint private immutable descriptor;
-
-    constructor() {
-        (, descriptor) = command("label", Specs.Empty, Specs.Label, Specs.Empty, 0, false, true);
-    }
-
-    /// @notice Publish each LABEL block in the admin input.
-    /// @param input LABEL block stream.
-    /// @return Empty output state.
-    /// @return Empty transaction stream.
-    function label(
-        bytes32 account,
-        bytes calldata,
-        bytes calldata input
-    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
-
-        while (exec.more()) {
-            (uint node, bytes32 namespace, string memory name) = exec.unpackLabel(Lanes.Input);
-            emit Labeled(node, namespace, name);
-        }
-
-        return close(exec, account);
-    }
-}