@rootzero/contracts 1.15.0 → 1.17.0

package/codec/Decoders.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, Tx} from "../core/Types.sol";
+import {AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, Position, Tx} from "../core/Types.sol";
 import {Blocks} from "./Blocks.sol";
 import {Sizes, Specs} from "./Specs.sol";
 import {Cursors, Cur} from "../utils/Cursors.sol";
@@ -32,20 +32,17 @@ library Decoders {
         cur.state = Cursors.wrap(source[i:], 0, 0);
     }
 
-    /// @notice Open the first homogeneous run in `source` using `stride`.
+    /// @notice Open the first homogeneous run in `source`.
     /// @param source Calldata block stream to open.
-    /// @param stride Number of blocks per group, or zero for an ungrouped stream.
     /// @return cur Cursor spanning the first homogeneous run.
-    function open(
-        bytes calldata source,
-        uint stride
-    ) internal pure returns (Cur memory cur) {
+    function open(bytes calldata source) internal pure returns (Cur memory cur) {
         (uint abs, uint limit) = Cursors.bounds(source);
-        if (stride == 0 && abs == limit) return cur;
+        if (abs == limit) revert Blocks.EmptyRun();
 
         bytes4 key = bytes4(source);
-        (uint groups, uint end) = Blocks.scope(abs, limit, key, stride);
-        cur.state = Cursors.create(abs, end - abs, groups, 0, 0);
+        (uint count, uint end) = Blocks.run(abs, limit, key);
+        if (count == 0) revert Blocks.EmptyRun();
+        cur.state = Cursors.create(abs, end - abs, count, 0, 0);
     }
 
     /// @notice Return whether `cur` has unread bytes.
@@ -163,6 +160,16 @@ library Decoders {
         return Blocks.find(offset + i, offset + end, key) - offset;
     }
 
+    /// @notice Count consecutive blocks with `key` from the current cursor position.
+    /// @dev Does not advance the cursor.
+    /// @param cur Cursor to inspect.
+    /// @param key Block key forming the run.
+    /// @return count Number of consecutive matching blocks.
+    function run(Cur memory cur, bytes4 key) internal pure returns (uint count) {
+        (uint i, uint offset, uint len) = cur.state.decode();
+        (count, ) = Blocks.run(offset + i, offset + len, key);
+    }
+
     /// @notice Consume one LIST block and return a cursor over its items.
     /// @param cur Cursor advanced past the list.
     /// @return items Cursor spanning the list payload.
@@ -269,6 +276,16 @@ library Decoders {
         (account, asset) = Blocks.unpackAccountAsset(abs);
     }
 
+    /// @notice Decode and consume one HOST_ASSET block.
+    /// @param cur Cursor advanced past the block.
+    /// @return host Decoded host identifier.
+    /// @return asset Decoded asset identifier.
+    function unpackHostAsset(Cur memory cur) internal pure returns (uint host, bytes32 asset) {
+        uint abs;
+        (cur.state, abs) = cur.state.consume(Sizes.HostAsset);
+        (host, asset) = Blocks.unpackHostAsset(abs);
+    }
+
     /// @notice Decode and consume one AMOUNT block.
     /// @param cur Cursor advanced past the block.
     /// @return asset Decoded asset identifier.
@@ -455,6 +472,13 @@ library Decoders {
         (value.account, value.asset) = unpackAccountAsset(cur);
     }
 
+    /// @notice Decode one HOST_ASSET block into its structured value.
+    /// @param cur Cursor advanced past the block.
+    /// @return value Structured host and asset.
+    function unpackHostAssetValue(Cur memory cur) internal pure returns (HostAsset memory value) {
+        (value.host, value.asset) = unpackHostAsset(cur);
+    }
+
     /// @notice Decode one AMOUNT block into its structured value.
     /// @param cur Cursor advanced past the block.
     /// @return value Structured asset amount.
@@ -532,6 +556,20 @@ library Decoders {
         (value.host, value.asset, value.amount) = unpackCustody(cur);
     }
 
+    /// @notice Decode and consume one POSITION block.
+    function unpackPosition(
+        Cur memory cur
+    ) internal pure returns (bytes32 asset, uint amount, bytes32 liability, uint debt) {
+        uint abs;
+        (cur.state, abs) = cur.state.consume(Sizes.Position);
+        (asset, amount, liability, debt) = Blocks.unpackPosition(abs);
+    }
+
+    /// @notice Decode one POSITION block into its structured value.
+    function unpackPositionValue(Cur memory cur) internal pure returns (Position memory value) {
+        (value.asset, value.amount, value.liability, value.debt) = unpackPosition(cur);
+    }
+
     /// @notice Decode one TRANSACTION block into its structured value.
     /// @param cur Cursor advanced past the block.
     /// @return value Structured transaction.

package/codec/Descriptors.sol

@@ -37,7 +37,6 @@ library Descriptors {
         state = Specs.normalize(state, true);
         input = Specs.normalize(input, false);
         output = Specs.normalize(output, true);
-
         descriptor = pack(state, input, output, transactions, flags);
     }
 

package/codec/Keys.sol

@@ -9,8 +9,6 @@ pragma solidity ^0.8.33;
 library Keys {
     /// @dev Empty / unset key.
     bytes4 constant Empty = bytes4(0);
-    /// @dev Wildcard key used in discovery when any block stream is accepted.
-    bytes4 constant Any = 0xffffffff;
     /// @dev Input amount - (bytes32 asset, uint amount)
     bytes4 constant Amount = bytes4(keccak256("#amount"));
     /// @dev Ledger balance - (bytes32 asset, uint amount)
@@ -21,6 +19,8 @@ library Keys {
     bytes4 constant Allowance = bytes4(keccak256("#allowance"));
     /// @dev Cross-host custody state - (uint host, bytes32 asset, uint amount)
     bytes4 constant Custody = bytes4(keccak256("#custody"));
+    /// @dev Asset-liability position state - (bytes32 asset, uint amount, bytes32 liability, uint debt)
+    bytes4 constant Position = bytes4(keccak256("#position"));
     /// @dev List wrapper; payload is an embedded repeated block stream
     bytes4 constant List = bytes4(keccak256("#list"));
     /// @dev EVM-encoded payload field; layout follows standard ABI tuple encoding
@@ -62,6 +62,8 @@ library Keys {
     bytes4 constant Status = bytes4(keccak256("#status"));
     /// @dev Structural account asset form - (bytes32 account, bytes32 asset)
     bytes4 constant AccountAsset = bytes4(keccak256("#accountAsset"));
+    /// @dev Structural host asset form - (uint host, bytes32 asset)
+    bytes4 constant HostAsset = bytes4(keccak256("#hostAsset"));
     /// @dev Structural account amount form - (bytes32 account, bytes32 asset, uint amount)
     bytes4 constant AccountAmount = bytes4(keccak256("#accountAmount"));
     /// @dev Structural host amount form - (uint host, bytes32 asset, uint amount)

package/codec/Readers.sol

@@ -94,6 +94,31 @@ library Readers {
         }
     }
 
+    /// @notice Consume a HOST_ASSET block and return its fields.
+    /// @param cur Reader; advanced past the block.
+    /// @return host Host identifier.
+    /// @return asset Asset identifier.
+    function unpackHostAsset(Reader memory cur) internal pure returns (uint host, bytes32 asset) {
+        uint abs = consume(cur, Keys.HostAsset, 64, 64);
+        assembly ("memory-safe") {
+            host := mload(abs)
+            asset := mload(add(abs, 0x20))
+        }
+    }
+
+    /// @notice Consume a POSITION block and return its fields.
+    function unpackPosition(
+        Reader memory cur
+    ) internal pure returns (bytes32 asset, uint amount, bytes32 liability, uint debt) {
+        uint abs = consume(cur, Keys.Position, 128, 128);
+        assembly ("memory-safe") {
+            asset := mload(abs)
+            amount := mload(add(abs, 0x20))
+            liability := mload(add(abs, 0x40))
+            debt := mload(add(abs, 0x60))
+        }
+    }
+
     /// @notice Consume a TRANSACTION block and return its fields.
     /// @param cur Reader; advanced past the block.
     /// @return from Source account identifier.

package/codec/Schema.sol

@@ -43,10 +43,13 @@ pragma solidity ^0.8.33;
 // - command input and state streams are each a single run of blocks under the
 //   current protocol convention; the block format may support other shapes in
 //   future protocol surfaces
-// - `balance(...)` and `custody(...)` are live, linear state in the active command pipeline
+// - `balance(...)`, `custody(...)`, and `position(...)` are live, linear state in the active command pipeline
 // - pipeline state belongs to the active account while the pipeline is executing
 // - while a balance or custody is in-flight as pipeline state, it is not simultaneously persisted
 //   in another ledger/store by this protocol
+// - a position pairs live asset and liability sides; commands may transform either side
+// - position state is transient and does not itself create or erase an externally persisted obligation
+// - positions support backward composition, but pipeline steps always execute in encoded order
 // - commands must preserve, transform, settle, or intentionally consume pipeline state
 // - input blocks such as `amount(...)`, `allocation(...)`, and `allowance(...)`
 //   express intent, constraints, or references
@@ -78,6 +81,7 @@ library Schemas {
     string constant Amount = "{ bytes32 asset, uint amount }";
     string constant Balance = "{ bytes32 asset, uint amount }";
     string constant AccountAsset = "{ bytes32 account, bytes32 asset }";
+    string constant HostAsset = "{ uint host, bytes32 asset }";
 
     // Three-word payloads
 
@@ -90,6 +94,7 @@ library Schemas {
 
     // Four-word payloads
 
+    string constant Position = "{ bytes32 asset, uint amount, bytes32 liability, uint debt }";
     string constant Transaction = "{ bytes32 from, bytes32 to, bytes32 asset, uint amount }";
     string constant HostAccountAmount = "{ uint host, bytes32 account, bytes32 asset, uint amount }";
 

package/codec/Specs.sol

@@ -27,10 +27,14 @@ library Sizes {
     uint constant Amount = B64;
     /// @dev BALANCE block: 8 header + 32 asset + 32 amount = 72 bytes
     uint constant Balance = B64;
+    /// @dev HOST_ASSET block: 8 header + 32 host + 32 asset = 72 bytes
+    uint constant HostAsset = B64;
     /// @dev ALLOCATION/CUSTODY block: 8 header + 32 host + 32 asset + 32 amount = 104 bytes
     uint constant HostAmount = B96;
     /// @dev TRANSACTION block: 8 header + 32 from + 32 to + 32 asset + 32 amount = 136 bytes
     uint constant Transaction = B128;
+    /// @dev POSITION block: 8 header + four-word asset-liability pair = 136 bytes
+    uint constant Position = B128;
 }
 
 /// @title Specs
@@ -44,7 +48,6 @@ library Specs {
     error InvalidSpec();
     /// @dev A direct specification cannot contain a wrapper block.
     error InvalidContainer();
-
     uint private constant SizeFields = (uint(1) << 192) | (uint(1) << 160) | (uint(1) << 136);
 
     // Reusable field shapes keep public specs readable while remaining valid
@@ -60,12 +63,12 @@ library Specs {
     uint private constant UnboundedMin104Hint256 = (uint(104) << 192) | (uint(256) << 136);
 
     uint constant Empty = uint(bytes32(Keys.Empty));
-    uint constant Any = uint(bytes32(Keys.Any)) | UnboundedHint128;
     uint constant Amount = uint(bytes32(Keys.Amount)) | Exact64;
     uint constant Balance = uint(bytes32(Keys.Balance)) | Exact64;
     uint constant Allocation = uint(bytes32(Keys.Allocation)) | Exact96;
     uint constant Allowance = uint(bytes32(Keys.Allowance)) | Exact96;
     uint constant Custody = uint(bytes32(Keys.Custody)) | Exact96;
+    uint constant Position = uint(bytes32(Keys.Position)) | Exact128;
     uint constant List = uint(bytes32(Keys.List)) | UnboundedHint128;
     uint constant Evm = uint(bytes32(Keys.Evm)) | UnboundedHint128;
     uint constant Bytes = uint(bytes32(Keys.Bytes)) | UnboundedHint128;
@@ -87,6 +90,7 @@ library Specs {
 
     uint constant Status = uint(bytes32(Keys.Status)) | Exact32;
     uint constant AccountAsset = uint(bytes32(Keys.AccountAsset)) | Exact64;
+    uint constant HostAsset = uint(bytes32(Keys.HostAsset)) | Exact64;
     uint constant AccountAmount = uint(bytes32(Keys.AccountAmount)) | Exact96;
     uint constant HostAmount = uint(bytes32(Keys.HostAmount)) | Exact96;
     uint constant HostAccountAsset = uint(bytes32(Keys.HostAccountAsset)) | Exact96;
@@ -237,4 +241,5 @@ library Specs {
     function group(uint spec, uint8 n) internal pure returns (uint) {
         return replace8(spec, 128, n);
     }
+
 }

package/codec/Writers.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AssetAmount, AccountAmount, HostAmount, Tx} from "../core/Types.sol";
+import {AssetAmount, AccountAmount, HostAmount, Position, Tx} from "../core/Types.sol";
 import {Blocks} from "./Blocks.sol";
 import {Buffers} from "./Buffers.sol";
 import {Sizes, Specs} from "./Specs.sol";
@@ -44,7 +44,7 @@ library Writers {
         (uint capacity, bool growable) = Specs.allocation(spec, groups);
         if (capacity == 0) return writer;
 
-        writer.cur = Buffers.cursor(capacity, groups, growable, 0);
+        writer.cur = Buffers.cursor(capacity, Specs.count(spec, groups), growable, 0);
     }
 
     // -------------------------------------------------------------------------
@@ -204,6 +204,15 @@ library Writers {
         Blocks.writeAccountAsset(writer.dst, i, account, asset);
     }
 
+    /// @notice Append a HOST_ASSET block.
+    /// @param writer Destination writer.
+    /// @param host Host identifier to encode.
+    /// @param asset Asset identifier to encode.
+    function appendHostAsset(Writer memory writer, uint host, bytes32 asset) internal pure {
+        uint i = reserve(writer, Sizes.HostAsset);
+        Blocks.writeHostAsset(writer.dst, i, host, asset);
+    }
+
     /// @notice Append an ALLOCATION block.
     /// @param writer Destination writer.
     /// @param host Host identifier to encode.
@@ -291,6 +300,23 @@ library Writers {
         Blocks.writeHostAccountAsset(writer.dst, i, host, account, asset);
     }
 
+    /// @notice Append a POSITION block.
+    function appendPosition(
+        Writer memory writer,
+        bytes32 asset,
+        uint amount,
+        bytes32 liability,
+        uint debt
+    ) internal pure {
+        uint i = reserve(writer, Sizes.Position);
+        Blocks.writePosition(writer.dst, i, asset, amount, liability, debt);
+    }
+
+    /// @notice Append a structured POSITION value.
+    function appendPosition(Writer memory writer, Position memory value) internal pure {
+        appendPosition(writer, value.asset, value.amount, value.liability, value.debt);
+    }
+
     /// @notice Append a TRANSACTION block.
     /// @param writer Destination writer.
     /// @param from Debit account identifier.

package/commands/Base.sol

@@ -5,7 +5,7 @@ import {CallerAccess} from "../core/Access.sol";
 import {EndpointBase} from "../core/Endpoint.sol";
 import {Blocks} from "../codec/Blocks.sol";
 import {Specs} from "../codec/Specs.sol";
-import {HostAmount} from "../core/Types.sol";
+import {HostAmount, Position} from "../core/Types.sol";
 import {Execution, Executions, Lanes} from "../execution/Execution.sol";
 import {ReceivedEvent} from "../events/Received.sol";
 import {Actions} from "../utils/Actions.sol";
@@ -22,6 +22,8 @@ using Executions for Execution;
 abstract contract CommandBase is CallerAccess, EndpointBase, ReceivedEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
+    /// @dev Thrown when a non-funded internal command receives native value.
+    error ValueNotAllowed();
 
     /// @dev Restrict execution to trusted callers.
     modifier onlyCommand() {
@@ -74,20 +76,11 @@ abstract contract CommandBase is CallerAccess, EndpointBase, ReceivedEvent {
         published = endpoint(id, name, descriptor);
     }
 
-    /// @notice Open a command state stream and return the expected output block count.
-    /// @param source State block stream to open.
-    /// @param descriptor Packed command endpoint descriptor.
-    /// @param batches Required batch count, or zero to accept the state count.
-    /// @return exec Execution with its output buffer metadata initialized for the state batch count.
-    function openState(
-        bytes calldata source,
-        uint descriptor,
-        uint batches
-    ) internal view returns (Execution memory exec) {
-        return Executions.openState(source, descriptor, batches);
-    }
-
-    /// @notice Open a command execution with batches derived from its input and state lanes.
+    /// @notice Open and validate both command lanes, including lanes declared EMPTY.
+    /// Batches are derived from the input and state lanes. A non-empty stream for
+    /// a lane whose descriptor has zero stride reverts instead of being ignored.
+    /// Commands must account for the complete validated state by consuming it,
+    /// transforming and returning it, forwarding it intact, or reverting.
     /// @param state Current command state block stream.
     /// @param input Command input block stream.
     /// @param descriptor Packed command endpoint descriptor.

package/commands/Burn.sol

@@ -36,9 +36,9 @@ abstract contract Burn is CommandBase, BurnHook, Action {
     function burn(
         bytes32 account,
         bytes calldata state,
-        bytes calldata
+        bytes calldata input
     ) external onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openState(state, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (bytes32 asset, uint amount) = exec.unpackBalance(Lanes.State);

package/commands/Credit.sol

@@ -3,12 +3,15 @@ pragma solidity ^0.8.33;
 
 import {Execution, Executions, CommandBase, Lanes, Specs} from "./Base.sol";
 import {CreditAccountHook} from "../core/Settlement.sol";
+import {Blocks} from "../codec/Blocks.sol";
+import {Reader, Readers} from "../codec/Readers.sol";
 
 using Executions for Execution;
+using Readers for Reader;
 
 /// @title CreditAccount
 /// @notice Command that delivers BALANCE state blocks to an account via a virtual hook.
-/// Use for internally recording credits that have already been settled externally.
+/// Use for internally recording credits that have already been posted externally.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
     uint private immutable descriptor;
     uint private immutable id;
@@ -29,9 +32,9 @@ abstract contract CreditAccount is CommandBase, CreditAccountHook {
     function creditAccount(
         bytes32 account,
         bytes calldata state,
-        bytes calldata
+        bytes calldata input
     ) external onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openState(state, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (bytes32 asset, uint amount) = exec.unpackBalance(Lanes.State);
@@ -41,3 +44,35 @@ abstract contract CreditAccount is CommandBase, CreditAccountHook {
         return close(exec, account);
     }
 }
+
+/// @title InternalCreditAccount
+/// @notice Extends the advertised credit-account command with memory-state pipeline dispatch.
+/// @dev This adapter is not a separate command. It uses the command ID and account hook
+/// inherited from `CreditAccount` while accepting the state location used by `Pipeline`.
+abstract contract InternalCreditAccount is CreditAccount {
+    /// @notice Execute the inherited credit-account command from an internal pipeline.
+    /// @param account Account credited by each balance.
+    /// @param state BALANCE block stream held in pipeline memory.
+    /// @param input Empty input required by the command schema.
+    /// @param value Native value assigned to the command; must be zero.
+    /// @return output Empty output state.
+    /// @return transactions Empty transaction stream.
+    function executeCreditAccount(
+        bytes32 account,
+        bytes memory state,
+        bytes calldata input,
+        uint128 value
+    ) internal returns (bytes memory, bytes memory) {
+        if (value != 0) revert ValueNotAllowed();
+        if (input.length != 0) revert Executions.ZeroStride();
+        if (state.length == 0) revert Blocks.EmptyRun();
+
+        Reader memory reader = Readers.open(state);
+        while (reader.more()) {
+            (bytes32 asset, uint amount) = reader.unpackBalance();
+            creditAccount(account, asset, amount);
+        }
+
+        return ("", "");
+    }
+}

package/commands/Debit.sol

@@ -3,13 +3,18 @@ pragma solidity ^0.8.33;
 
 import {Execution, Executions, CommandBase, Lanes, Specs} from "./Base.sol";
 import {DebitAccountHook} from "../core/Settlement.sol";
+import {Blocks} from "../codec/Blocks.sol";
+import {Sizes} from "../codec/Specs.sol";
+import {Decoders} from "../codec/Decoders.sol";
+import {Cur} from "../utils/Cursors.sol";
 
 using Executions for Execution;
+using Decoders for Cur;
 
 /// @title DebitAccount
 /// @notice Command that deducts AMOUNT blocks from an account and emits matching BALANCE state.
 /// Use for internally recording debits. The virtual `debitAccount` hook is called once per
-/// AMOUNT block; the default batch implementation handles the full input loop.
+/// AMOUNT block.
 abstract contract DebitAccount is CommandBase, DebitAccountHook {
     uint private immutable descriptor;
     uint private immutable id;
@@ -23,11 +28,16 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
         return id;
     }
 
-    /// @notice Override to customize input parsing or batching for debits.
-    /// The default implementation iterates AMOUNT blocks, calls
-    /// `debitAccount`, and emits matching BALANCE blocks.
-    function debitAccount(bytes32 account, bytes calldata input) internal virtual returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+    /// @notice Debit AMOUNT input blocks from the command account and output matching BALANCE blocks.
+    /// @param input AMOUNT block stream.
+    /// @return BALANCE block stream matching the debited amounts.
+    /// @return Empty transaction stream.
+    function debitAccount(
+        bytes32 account,
+        bytes calldata state,
+        bytes calldata input
+    ) external onlyCommand returns (bytes memory, bytes memory) {
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (bytes32 asset, uint amount) = exec.unpackAmount(Lanes.Input);
@@ -37,16 +47,42 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
 
         return close(exec, account);
     }
+}
 
-    /// @notice Debit AMOUNT input blocks from the command account and output matching BALANCE blocks.
+/// @title InternalDebitAccount
+/// @notice Extends the advertised debit-account command with memory-state pipeline dispatch.
+/// @dev This adapter is not a separate command. It uses the command ID and account hook
+/// inherited from `DebitAccount` while accepting the state location used by `Pipeline`.
+abstract contract InternalDebitAccount is DebitAccount {
+    /// @notice Execute the inherited debit-account command from an internal pipeline.
+    /// @param account Account whose funds are debited.
+    /// @param state Empty pipeline state required by the command schema.
     /// @param input AMOUNT block stream.
-    /// @return BALANCE block stream matching the debited amounts.
-    /// @return Empty transaction stream.
-    function debitAccount(
+    /// @param value Native value assigned to the command; must be zero.
+    /// @return output BALANCE block stream matching the debited amounts.
+    /// @return transactions Empty transaction stream.
+    function executeDebitAccount(
         bytes32 account,
-        bytes calldata,
-        bytes calldata input
-    ) external onlyCommand returns (bytes memory, bytes memory) {
-        return debitAccount(account, input);
+        bytes memory state,
+        bytes calldata input,
+        uint128 value
+    ) internal returns (bytes memory, bytes memory) {
+        if (value != 0) revert ValueNotAllowed();
+        if (state.length != 0) revert Executions.ZeroStride();
+        if (input.length == 0) revert Blocks.EmptyRun();
+
+        Cur memory cur = Decoders.wrap(input);
+        uint count = input.length / Sizes.Amount;
+        bytes memory output = new bytes(count * Sizes.Balance);
+        uint i;
+
+        while (cur.more()) {
+            (bytes32 asset, uint amount) = cur.unpackAmount();
+            debitAccount(account, asset, amount);
+            Blocks.writeBalance(output, i, asset, amount);
+            i += Sizes.Balance;
+        }
+
+        return (output, "");
     }
 }

package/commands/Deposit.sol

@@ -49,10 +49,10 @@ abstract contract Deposit is CommandBase, DepositHook, Action {
     /// @return Empty transaction stream.
     function deposit(
         bytes32 account,
-        bytes calldata,
+        bytes calldata state,
         bytes calldata input
     ) external onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (bytes32 asset, uint amount) = exec.unpackAmount(Lanes.Input);
@@ -82,10 +82,10 @@ abstract contract DepositPayable is CommandBase, DepositPayableHook, Action {
     /// @return Remaining native value as a refund transaction stream.
     function depositPayable(
         bytes32 account,
-        bytes calldata,
+        bytes calldata state,
         bytes calldata input
     ) external payable onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (bytes32 asset, uint amount) = exec.unpackAmount(Lanes.Input);

package/commands/Provision.sol

@@ -41,10 +41,10 @@ abstract contract Provision is CommandBase, ProvisionHook {
     /// @return Empty transaction stream.
     function provision(
         bytes32 account,
-        bytes calldata,
+        bytes calldata state,
         bytes calldata input
     ) external onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             HostAmount memory allocation = exec.unpackAllocationValue(Lanes.Input);
@@ -73,10 +73,10 @@ abstract contract ProvisionPayable is CommandBase, ProvisionPayableHook {
     /// @return Remaining native value as a refund transaction stream.
     function provisionPayable(
         bytes32 account,
-        bytes calldata,
+        bytes calldata state,
         bytes calldata input
     ) external payable onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             HostAmount memory allocation = exec.unpackAllocationValue(Lanes.Input);

package/commands/Recover.sol

@@ -6,21 +6,28 @@ import {Execution, Executions, CommandBase, Lanes, Specs} from "./Base.sol";
 using Executions for Execution;
 
 /// @notice Hook implemented by hosts that recover previously undelivered payloads.
-abstract contract RecoverHook {
+abstract contract RecoverPayableHook {
     /// @notice Override to recover a witness through `handler`.
     /// @param handler Port that should attempt recovery.
+    /// @param resources Chain-specific resources assigned to the recovery attempt.
     /// @param key Recovery lookup key.
     /// @param witness Witness payload used to prove and replay recovery.
-    /// @param value Native EVM value assigned to the recovery attempt.
-    function recover(uint handler, bytes32 key, bytes calldata witness, uint128 value) internal virtual;
+    /// @param funds Shared execution containing the source value budget.
+    function recover(
+        uint handler,
+        uint resources,
+        bytes32 key,
+        bytes calldata witness,
+        Execution memory funds
+    ) internal virtual;
 }
 
 /// @title RecoverPayable
 /// @notice Command that forwards recover input blocks to a virtual hook.
 /// Recovery is witness-driven: the command account pays and receives leftover
-/// value settlement, but the recovered subject is defined by each witness.
+/// value posting, but the recovered subject is defined by each witness.
 /// Produces no output state.
-abstract contract RecoverPayable is CommandBase, RecoverHook {
+abstract contract RecoverPayable is CommandBase, RecoverPayableHook {
     uint private immutable descriptor;
 
     constructor() {
@@ -33,14 +40,14 @@ abstract contract RecoverPayable is CommandBase, RecoverHook {
     /// @return Remaining native value as a refund transaction stream.
     function recoverPayable(
         bytes32 account,
-        bytes calldata,
+        bytes calldata state,
         bytes calldata input
     ) external payable onlyCommand returns (bytes memory, bytes memory) {
-        Execution memory exec = openInput(input, descriptor, 0);
+        Execution memory exec = openCommand(state, input, descriptor, 0);
 
         while (exec.more()) {
             (uint handler, uint resources, bytes32 key, bytes calldata witness) = exec.unpackRecover(Lanes.Input);
-            recover(handler, key, witness, exec.useValue(resources));
+            recover(handler, resources, key, witness, exec);
         }
 
         return close(exec, account);