@rootzero/contracts 1.26.0 → 1.28.0

package/CHANGELOG.md

@@ -8,6 +8,54 @@ sections are immutable and must continue to describe the tagged release.
 
 ## Unreleased
 
+## 1.28.0
+
+### Breaking Changes
+
+- Expanded STEP's native `value` field from `uint128` to `uint`, increasing an
+  empty STEP block from 64 to 80 bytes. Plain native values now use `uint`
+  throughout runtime APIs; packed `resources` remain separate `uint` words
+  whose EVM value lane is extracted explicitly with `useResourceValue`.
+- Replaced the `CommandCalls` abstraction and its allocating `encodeCommandCall`
+  and `callCommand` helpers with the free `rawCommandCall` function. The caller
+  now supplies the decoded selector and target after validating and authorizing
+  the command, then uses the single-scratch assembly call path.
+- Added the required `ExecuteHook` to `Pipeline` and removed its `dispatch` hook.
+  Steps whose command IDs target the current host use `execute`; other commands
+  are checked through `TrustAccess` and called directly with `rawCommandCall`.
+
+### Changed
+
+- Added the free `unpackCommand` utility for validating a command node and
+  extracting its selector and target in one operation. Pipeline steps now use
+  it to validate command IDs and select local execution by target address.
+- Simplified `NodeAccess.ensureTrusted` to a single mapping check; an unset zero
+  node already resolves to false like every other untrusted node.
+
+## 1.27.0
+
+### Breaking Changes
+
+- Removed `BootstrapBudgetHook`. Bootstrap budget contributions now debit the
+  account's local native asset through the standard `DebitAccountHook`.
+- Removed the external `bootstrap` endpoint and `BootstrapInternal`. Bootstrap
+  is now a pipeline-local command implemented directly by `Bootstrap` while
+  retaining its registered command ID and descriptor metadata.
+- Replaced the codec-specific `Executions.ZeroStride` error with global
+  `UnexpectedState` and `UnexpectedInput` errors for pipeline-local lane
+  violations.
+
+### Changed
+
+- Node authorization and revocation now reject foreign-chain and opaque node
+  IDs, keeping the trusted-node set local to the host chain.
+- Asserting EVM, admin, and user account helpers now require a nonzero embedded
+  address while continuing to return the original account ID.
+- Documented that either side of a position may be absent, using a zero
+  identifier and quantity like an omitted transaction endpoint.
+- Bootstrap uses assigned step value before debiting any remaining native-asset
+  amount from the account and returns unused value as credit.
+
 ## 1.26.0
 
 ### Breaking Changes

package/Core.sol

@@ -12,9 +12,9 @@ import { Balances, InsufficientFunds } from "./core/Balances.sol";
 import { Escrows, InsufficientEscrow } from "./core/Escrows.sol";
 import { NativeAsset, Runtime } from "./core/Runtime.sol";
 import { Admins, CommandHost, Guardians, Host, HostIntroduction, IHostIntroduction } from "./core/Host.sol";
-import { CommandCalls, FailedCall, NodeCalls, PortCalls, RawNodeCalls } from "./core/Calls.sol";
+import { FailedCall, NodeCalls, PortCalls, RawNodeCalls, rawCommandCall } from "./core/Calls.sol";
 import { EndpointBase, InputEndpointBase } from "./core/Endpoint.sol";
-import { PipeHook, Pipeline } from "./core/Pipeline.sol";
+import { ExecuteHook, PipeHook, Pipeline } from "./core/Pipeline.sol";
 import { Budget, Budgets } from "./execution/Budget.sol";
 import { CreditAccountHook, DebitAccountHook, PostHook, RepayHook, SettleHook, Settlement } from "./core/Settlement.sol";
 import { Portal } from "./core/Portal.sol";

package/Endpoints.sol

@@ -6,14 +6,14 @@ pragma solidity ^0.8.33;
 
 // Shared endpoint hooks
 import {Flags} from "./codec/Descriptors.sol";
-import {PipeHook} from "./core/Pipeline.sol";
+import {ExecuteHook, PipeHook} from "./core/Pipeline.sol";
 import {CreditAccountHook, DebitAccountHook, PostHook, RepayHook, SettleHook} from "./core/Settlement.sol";
 
 // Commands
 import {CommandBase} from "./commands/Base.sol";
 import {Allocate, AllocateHook} from "./commands/Allocate.sol";
 import {Burn, BurnHook} from "./commands/Burn.sol";
-import {Bootstrap, BootstrapBudgetHook, BootstrapInternal} from "./commands/Bootstrap.sol";
+import {Bootstrap} from "./commands/Bootstrap.sol";
 import {Cashout, CashoutHook, CashoutInternal} from "./commands/Cashout.sol";
 import {CreditAccount, CreditAccountInternal} from "./commands/Credit.sol";
 import {DebitAccount, DebitAccountInternal} from "./commands/Debit.sol";

package/README.md

@@ -276,6 +276,14 @@ next. Balance carries `{ asset, amount }`, debt carries `{ liability, debt }`,
 and position carries their flat combination
 `{ asset, amount, liability, debt }`.
 
+Either side of a position may be absent. An absent asset side is encoded as
+`asset = 0, amount = 0`; an absent liability side is encoded as
+`liability = 0, debt = 0`. This mirrors transaction blocks, where a zero `from`
+or `to` omits that side of the transfer. A one-sided position remains useful
+when a command must preserve position-shaped state for later composition;
+otherwise the narrower `#balance` or `#debt` block expresses the same live
+value more directly.
+
 `#debt` and `#position` are general live state rather than persisted
 lending-specific debt records. Debt carries value owed or required; position
 pairs that liability with value acquired or controlled. A command may preserve
@@ -357,7 +365,7 @@ A single command is rarely the whole story. A pipeline is a run of `#step`
 blocks executed in order within one transaction:
 
 ```txt
-step { uint cmd, uint128 value, #bytes as input }
+step { uint cmd, uint value, #bytes as input }
 ```
 
 Each step names a command, the native value it may spend, and its input.
@@ -367,23 +375,26 @@ next step, allowing one command to fund later commands. The standard
 `bootstrap` command consumes a stream of
 `#bootstrap { bytes32 asset, uint amount, uint budget }` requests and atomically
 debits each asset through the standard account hook, introduces matching
-`#balance` state, and sources summed trusted credit through its dedicated budget
-hook. This is the core of
+`#balance` state, and debits each nonzero budget contribution from the account's
+native asset through the same hook. Its pipeline-local implementation uses assigned step value first when
+bootstrapping the native asset, debits any remainder from the account, and
+returns unused assigned value as credit. Bootstrap is registered with command
+metadata but is only executable through local pipeline execution. This is the core of
 `Pipeline.pipe`:
 
 ```solidity
 while (cur.more()) {
-    (uint cmd, uint128 value, bytes calldata input) = cur.unpackStep();
+    (uint cmd, uint value, bytes calldata input) = cur.unpackStep();
+    (bytes4 selector, address target) = unpackCommand(cmd);
     if (budget < value) revert InsufficientValue();
     unchecked { budget -= value; }
     uint credit;
-    (state, credit) = dispatch(
-        cmd,
-        account,
-        state,
-        input,
-        value
-    );
+    if (target == address(this)) {
+        (state, credit) = execute(cmd, account, state, input, value);
+    } else {
+        ensureTrusted(cmd);
+        (state, credit) = rawCommandCall(selector, target, value, account, state, input);
+    }
     budget += credit;
 }
 if (state.length != 0) revert UnexpectedState();
@@ -396,21 +407,24 @@ settles that final value once.
 A transfer, for instance, is a two-step pipeline: `debitAccount` turns an
 `#amount` input into `#balance` state, and `payout` consumes that state
 toward a recipient. Because a pipeline is just blocks, it is also the unit of
-command batching. A step's `uint128 value` is drawn directly from the shared
-native-value budget. Transport envelopes retain separate chain-specific
-`resources` fields for adapters that also need gas or runtime parameters.
+command batching. A step's plain `uint value` is drawn directly from the shared
+native-value budget. Transport envelopes retain separate opaque, packed
+chain-specific `resources` fields for adapters that also need gas or runtime
+parameters. A `resources` word is never itself native value; EVM adapters use
+`useResourceValue` to extract its low 128-bit value lane before spending it.
 
-Hosts that implement a pipeline locally can inherit `BootstrapInternal`,
+Hosts that implement a pipeline locally can inherit `Bootstrap`,
 `CashoutInternal`, `DebitAccountInternal`, `CreditAccountInternal`,
 `SettleInternal`, and
-`RepayInternal` to advertise the canonical command endpoints while routing
+`RepayInternal` to register canonical command metadata while routing
 their local command IDs through `executeBootstrap`, `executeCashout`,
 `executeDebitAccount`, `executeCreditAccount`, `executeSettle`, and
 `executeRepay`. The bootstrap, cashout, and debit adapters decode fixed-stride
 calldata input directly; the other three
 decode memory-backed pipeline state. All avoid an external self-call. Pass the
-step value into each adapter; all six reject nonzero value because the commands
-are non-funded.
+step value into each adapter. Bootstrap is pipeline-local rather than an
+externally callable command and may consume value for native-asset balance;
+the other five reject nonzero value because those commands are non-funded.
 
 Positions also support backward-composed pipelines. In an exact-output route,
 the asset side can represent the desired result while the liability side
@@ -497,11 +511,11 @@ names, access sets, balances — from logs alone, with no artifact files.
 Import from the package entry points rather than deep paths:
 
 - `@rootzero/contracts/Core.sol` — `Host`, access control, `Balances`,
-  `Settlement`, `PipeHook`, `Pipeline`, `Portal`, validator
+  `Settlement`, `ExecuteHook`, `PipeHook`, `Pipeline`, `Portal`, validator
 - `@rootzero/contracts/Commands.sol` — `CommandBase`, `Execution`, `Flags`,
   codec helpers, and shared value types for authoring custom commands
 - `@rootzero/contracts/Endpoints.sol` — command, admin, port, guard, and query
-  mixins, their hooks (including `PipeHook`), and `Flags`
+  mixins, their hooks (including `ExecuteHook` and `PipeHook`), and `Flags`
 - `@rootzero/contracts/Codec.sol` — `Blocks`, calldata `Cur`/`Cursors`, memory
   `Memory`, `Writers`, `Schemas`, `Descriptors`, `Flags`, `Keys`, and
   `Specs`

package/Utils.sol

@@ -10,7 +10,7 @@ import { Actions } from "./utils/Actions.sol";
 import { Amounts, Assets } from "./utils/Assets.sol";
 import { ECDSA } from "./utils/ECDSA.sol";
 import { Ids } from "./utils/Ids.sol";
-import { Nodes } from "./utils/Nodes.sol";
+import { Nodes, unpackCommand } from "./utils/Nodes.sol";
 import { Layout } from "./utils/Layout.sol";
 import { BadAmount, InsufficientValue, InvalidAccount, InvalidAsset, InvalidContract, InvalidId, InvalidPreimage, MissingCursor, NotDivisible, OutOfBounds, UnauthorizedAsset, UnconsumedData, UnexpectedPosition, ValueOverflow, ZeroAddress, ZeroAmount} from "./utils/Errors.sol";
 import { addrOr, applyBps, beforeBps, bytes32ToInt, bytes32ToString, clear8, clear16, clear32, clear64, divisible, ensureAddr, ensureContract, hash32, intToBytes32, isFamily, matchesBase, MAX_BPS, max8, max16, max24, max32, max40, max64, max96, max128, max160, replace8, replace16, replace32, replace64, retryTicket, toLocalBase, toUnspecifiedBase } from "./utils/Utils.sol";

package/codec/Blocks.sol

@@ -761,17 +761,17 @@ library Blocks {
     /// @param cmd Command identifier.
     /// @param value Native value assigned to the step.
     /// @param input Command input.
-    function writeStep(bytes memory dst, uint i, uint cmd, uint128 value, bytes memory input) internal pure {
-        uint len = 48 + Sizes.Header + input.length;
+    function writeStep(bytes memory dst, uint i, uint cmd, uint value, bytes memory input) internal pure {
+        uint len = 64 + Sizes.Header + input.length;
         uint key = uint32(Keys.Step);
         uint byteskey = uint32(Keys.Bytes);
         assembly ("memory-safe") {
             let p := add(add(dst, 0x20), i)
             mstore(p, or(shl(224, key), shl(192, len)))
             mstore(add(p, 0x08), cmd)
-            mstore(add(p, 0x28), shl(128, value))
+            mstore(add(p, 0x28), value)
 
-            let q := add(p, 0x38)
+            let q := add(p, 0x48)
             let inputlen := mload(input)
             mstore(q, or(shl(224, byteskey), shl(192, inputlen)))
             mcopy(add(q, 0x08), add(input, 0x20), inputlen)
@@ -1031,17 +1031,17 @@ library Blocks {
     }
 
     /// @notice Encode a STEP block at `i`, copying its nested input from calldata.
-    function copyStep(bytes memory dst, uint i, uint cmd, uint128 value, bytes calldata input) internal pure {
-        uint len = max32(48 + Sizes.Header + input.length);
+    function copyStep(bytes memory dst, uint i, uint cmd, uint value, bytes calldata input) internal pure {
+        uint len = max32(64 + Sizes.Header + input.length);
         uint key = uint32(Keys.Step);
         uint byteskey = uint32(Keys.Bytes);
         assembly ("memory-safe") {
             let p := add(add(dst, 0x20), i)
             mstore(p, or(shl(224, key), shl(192, len)))
             mstore(add(p, 0x08), cmd)
-            mstore(add(p, 0x28), shl(128, value))
+            mstore(add(p, 0x28), value)
 
-            let q := add(p, 0x38)
+            let q := add(p, 0x48)
             let inputlen := input.length
             mstore(q, or(shl(224, byteskey), shl(192, inputlen)))
             calldatacopy(add(q, 0x08), input.offset, inputlen)
@@ -1836,14 +1836,14 @@ library Blocks {
     /// @return end Absolute position after the block.
     function unpackStep(
         uint abs
-    ) internal pure returns (uint cmd, uint128 value, bytes calldata input, uint end) {
+    ) internal pure returns (uint cmd, uint value, bytes calldata input, uint end) {
         uint limit;
         (abs, limit) = expectKey(abs, Keys.Step);
         assembly ("memory-safe") {
             cmd := calldataload(abs)
-            value := shr(128, calldataload(add(abs, 0x20)))
+            value := calldataload(add(abs, 0x20))
         }
-        (input, end) = unpackBytes(abs + 48);
+        (input, end) = unpackBytes(abs + 64);
         if (end != limit) revert InvalidBlock();
     }
 
@@ -2203,14 +2203,14 @@ library Blocks {
     /// @param value Native value assigned to the step.
     /// @param input Raw nested input payload.
     /// @return encoded Encoded STEP block bytes.
-    function createStep(uint cmd, uint128 value, bytes memory input) internal pure returns (bytes memory encoded) {
+    function createStep(uint cmd, uint value, bytes memory input) internal pure returns (bytes memory encoded) {
         uint len = max32(Sizes.Step + input.length);
         encoded = allocate(len);
         writeStep(encoded, 0, cmd, value, input);
     }
 
     /// @notice Encode a STEP block by copying its nested input from calldata.
-    function createStepCopy(uint cmd, uint128 value, bytes calldata input) internal pure returns (bytes memory encoded) {
+    function createStepCopy(uint cmd, uint value, bytes calldata input) internal pure returns (bytes memory encoded) {
         uint len = max32(Sizes.Step + input.length);
         encoded = allocate(len);
         copyStep(encoded, 0, cmd, value, input);

package/codec/Decoders.sol

@@ -740,7 +740,7 @@ library Decoders {
     /// @return input Decoded command input.
     function unpackStep(
         Cur memory cur
-    ) internal pure returns (uint cmd, uint128 value, bytes calldata input) {
+    ) internal pure returns (uint cmd, uint value, bytes calldata input) {
         uint abs = cur.state.absolute();
         uint end;
         (cmd, value, input, end) = Blocks.unpackStep(abs);

package/codec/Keys.sol

@@ -39,7 +39,7 @@ library Keys {
     bytes4 constant Account = bytes4(keccak256("#account"));
     /// @dev Transfer record passed through the pipeline - (bytes32 from, bytes32 to, bytes32 asset, uint amount)
     bytes4 constant Transaction = bytes4(keccak256("#transaction"));
-    /// @dev Sub-command invocation - (uint cmd, uint128 value, #bytes as input)
+    /// @dev Sub-command invocation - (uint cmd, uint value, #bytes as input)
     bytes4 constant Step = bytes4(keccak256("#step"));
     /// @dev Portal relay input - (uint portal, uint resources, #bytes as input)
     bytes4 constant Relay = bytes4(keccak256("#relay"));

package/codec/Schema.sol

@@ -29,10 +29,11 @@ pragma solidity ^0.8.33;
 // - `portal` fields identify destination portal hosts. By convention the value
 //   is the portal implementation's host ID; core passes it through unchanged
 //   and hooks may validate or resolve it for their transport
-// - `resources` fields are chain-specific resource words. A portal adapter
-//   interprets them for the destination runtime. EVM resources use the low
-//   128 bits as native value.
-// - STEP encodes native `value` directly as uint128; it does not carry a
+// - `resources` fields are opaque chain-specific packed words, not native
+//   values. A portal adapter interprets them for the destination runtime. EVM
+//   resources use the low 128 bits as native value, extracted explicitly with
+//   `useResourceValue` before spending.
+// - STEP encodes native `value` directly as uint; it does not carry a
 //   chain-specific resources word
 // - dotted field names and aliases, e.g. `dst.portal` or `#bytes as dst.payload`,
 //   are offchain projection metadata only and do not change runtime encoding
@@ -60,6 +61,8 @@ pragma solidity ^0.8.33;
 // - while a balance, debt, or custody is in-flight as pipeline state, it is not simultaneously persisted
 //   in another ledger/store by this protocol
 // - debt carries only a live liability side; position pairs live balance and debt sides
+// - either position side may be absent by setting both its identifier and quantity to zero,
+//   analogous to omitting a transaction side with a zero `from` or `to`
 // - debt and position state are transient and do not themselves create or erase an externally persisted obligation
 // - positions support backward composition, but pipeline steps always execute in encoded order
 // - commands must preserve, transform, settle, or intentionally consume pipeline state
@@ -114,7 +117,7 @@ library Schemas {
 
     // Composite payloads
 
-    string constant Step = "uint cmd, uint128 value, #bytes as input";
+    string constant Step = "uint cmd, uint value, #bytes as input";
     string constant Call = "uint target, uint resources, #bytes as payload";
     string constant Relay = "uint portal, uint resources, #bytes as input";
     string constant Dispatch = "uint portal, uint resources, #bytes as payload";

package/codec/Specs.sol

@@ -21,8 +21,8 @@ library Sizes {
     uint constant B128 = Header + 4 * Word;
     /// @dev 8 header + 160 payload = 168 bytes total.
     uint constant B160 = Header + 5 * Word;
-    /// @dev Minimum STEP size: 8 header + 32 command + 16 value + 8 nested BYTES header.
-    uint constant Step = 2 * Header + Word + 16;
+    /// @dev Minimum STEP size: 8 header + 32 command + 32 value + 8 nested BYTES header.
+    uint constant Step = 2 * Header + 2 * Word;
     /// @dev STATUS block: 8 header + 32 status code = 40 bytes
     uint constant Status = B32;
     /// @dev CASHOUT block: 8 header + 32 native-asset amount = 40 bytes
@@ -64,7 +64,6 @@ library Specs {
     uint private constant Exact128 = 128 * SizeFields;
     uint private constant UnboundedHint128 = uint(128) << 136;
     uint private constant UnboundedMin40Hint256 = (uint(40) << 192) | (uint(256) << 136);
-    uint private constant UnboundedMin56Hint256 = (uint(56) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin72Hint256 = (uint(72) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin48Hint512 = (uint(48) << 192) | (uint(512) << 136);
     uint private constant UnboundedMin104Hint256 = (uint(104) << 192) | (uint(256) << 136);
@@ -85,7 +84,7 @@ library Specs {
     uint constant String = uint(bytes32(Keys.String)) | UnboundedHint128;
     uint constant Account = uint(bytes32(Keys.Account)) | Exact32;
     uint constant Transaction = uint(bytes32(Keys.Transaction)) | Exact128;
-    uint constant Step = uint(bytes32(Keys.Step)) | UnboundedMin56Hint256;
+    uint constant Step = uint(bytes32(Keys.Step)) | UnboundedMin72Hint256;
     uint constant Relay = uint(bytes32(Keys.Relay)) | UnboundedMin72Hint256;
     uint constant Context = uint(bytes32(Keys.Context)) | UnboundedMin48Hint512;
     uint constant Recover = uint(bytes32(Keys.Recover)) | UnboundedMin104Hint256;

package/codec/Writers.sol

@@ -414,7 +414,7 @@ library Writers {
     /// @param cmd Command identifier to encode.
     /// @param value Native value to encode.
     /// @param input Command input to encode.
-    function appendStep(Writer memory writer, uint cmd, uint128 value, bytes memory input) internal pure {
+    function appendStep(Writer memory writer, uint cmd, uint value, bytes memory input) internal pure {
         uint size = Sizes.Step + input.length;
         uint i = reserve(writer, size);
         Blocks.writeStep(writer.dst, i, cmd, value, input);
@@ -561,7 +561,7 @@ library Writers {
     }
 
     /// @notice Append a STEP block by copying its nested input from calldata.
-    function copyStep(Writer memory writer, uint cmd, uint128 value, bytes calldata input) internal pure {
+    function copyStep(Writer memory writer, uint cmd, uint value, bytes calldata input) internal pure {
         uint size = Sizes.Step + input.length;
         uint i = reserve(writer, size);
         Blocks.copyStep(writer.dst, i, cmd, value, input);

package/commands/Bootstrap.sol

@@ -1,33 +1,20 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {Execution, Executions, CommandBase, Specs} from "./Base.sol";
+import {CommandBase, Specs} from "./Base.sol";
 import {Blocks} from "../codec/Blocks.sol";
 import {Sizes} from "../codec/Specs.sol";
 import {Cursors} from "../utils/Cursors.sol";
 import {DebitAccountHook} from "../core/Settlement.sol";
-
-using Executions for Execution;
-
-/// @notice Hook implemented by hosts that source bootstrap pipeline budget.
-abstract contract BootstrapBudgetHook {
-    /// @notice Source native-value budget for `account` during bootstrap.
-    /// Called once per BOOTSTRAP input block.
-    /// @dev Implementations must revert unless the contribution can be made available.
-    /// A zero amount is valid and may return immediately without changing state.
-    /// @param account Account funding the pipeline.
-    /// @param amount Native value added to the pipeline budget.
-    function bootstrapBudget(bytes32 account, uint amount) internal virtual;
-}
+import {UnexpectedState} from "../utils/Errors.sol";
 
 /// @title Bootstrap
-/// @notice Command that atomically starts a pipeline with BALANCE state and native-value budget.
-abstract contract Bootstrap is CommandBase, DebitAccountHook, BootstrapBudgetHook {
-    uint private immutable descriptor;
+/// @notice Pipeline-local command that atomically starts with BALANCE state and native-value budget.
+abstract contract Bootstrap is CommandBase, DebitAccountHook {
     uint private immutable id;
 
     constructor() {
-        (id, descriptor) = command("bootstrap", Specs.Empty, Specs.Bootstrap, Specs.Balance, 0);
+        (id,) = command("bootstrap", Specs.Empty, Specs.Bootstrap, Specs.Balance, 0);
     }
 
     /// @notice Return the registered BOOTSTRAP command ID.
@@ -35,57 +22,56 @@ abstract contract Bootstrap is CommandBase, DebitAccountHook, BootstrapBudgetHoo
         return id;
     }
 
-    /// @notice Source initial balances and budget contributions for a pipeline.
-    /// @param context Command context carrying a BOOTSTRAP input stream.
-    /// @return output One BALANCE block per BOOTSTRAP input.
-    /// @return credit Sum of trusted native value contributed by every input.
+    /// @dev Bootstrap one local balance, using assigned value before debiting
+    /// any remaining native-asset amount from the account.
     function bootstrap(
-        bytes calldata context
-    ) external onlyCommand returns (bytes memory output, uint credit) {
-        Execution memory exec = openCommand(context, descriptor);
-
-        while (exec.more()) {
-            (bytes32 asset, uint amount, uint budget) = exec.unpackBootstrap();
-            debitAccount(exec.account, asset, amount);
-            bootstrapBudget(exec.account, budget);
-            exec.outputBalance(asset, amount);
-            credit += budget;
+        bytes32 account,
+        bytes32 asset,
+        uint amount,
+        uint budget,
+        uint value
+    ) private returns (uint) {
+        if (asset == nativeAsset) {
+            uint funded = amount < value ? amount : value;
+            unchecked {
+                amount -= funded;
+                value -= funded;
+            }
+            amount += budget;
+        } else {
+            if (amount != 0) debitAccount(account, asset, amount);
+            amount = budget;
         }
 
-        return exec.close(credit);
+        if (amount != 0) debitAccount(account, nativeAsset, amount);
+        return value + budget;
     }
-}
 
-/// @title BootstrapInternal
-/// @notice Extends bootstrap with optimized local pipeline dispatch.
-abstract contract BootstrapInternal is Bootstrap {
     /// @notice Execute bootstrap directly against a calldata BOOTSTRAP stream.
     /// @param account Account funding the pipeline.
     /// @param state Empty pipeline state required by the command schema.
     /// @param input BOOTSTRAP block stream.
-    /// @param value Native value assigned to this command; must be zero.
+    /// @param value Native value available to fund native-asset balances.
     /// @return output One BALANCE block per BOOTSTRAP input.
-    /// @return credit Sum of the sourced budget contributions.
+    /// @return credit Sourced budget contributions plus unused assigned value.
     function executeBootstrap(
         bytes32 account,
         bytes memory state,
         bytes calldata input,
-        uint128 value
+        uint value
     ) internal returns (bytes memory output, uint credit) {
-        if (value != 0) revert ValueNotAllowed();
-        if (state.length != 0) revert Executions.ZeroStride();
+        if (state.length != 0) revert UnexpectedState();
         if (input.length % Sizes.Bootstrap != 0) revert Blocks.InvalidBlock();
 
         (uint abs, uint end) = Cursors.bounds(input);
         output = new bytes(input.length / Sizes.Bootstrap * Sizes.Balance);
+        credit = value;
         uint i;
 
         while (abs < end) {
             (bytes32 asset, uint amount, uint budget) = Blocks.unpackBootstrap(abs);
-            debitAccount(account, asset, amount);
-            bootstrapBudget(account, budget);
+            credit = bootstrap(account, asset, amount, budget, credit);
             Blocks.writeBalance(output, i, asset, amount);
-            credit += budget;
             unchecked {
                 abs += Sizes.Bootstrap;
                 i += Sizes.Balance;

package/commands/Cashout.sol

@@ -7,6 +7,7 @@ import {Sizes} from "../codec/Specs.sol";
 import {Cursors} from "../utils/Cursors.sol";
 import {Action} from "../annotations/Action.sol";
 import {Actions} from "../utils/Actions.sol";
+import {UnexpectedState} from "../utils/Errors.sol";
 
 using Executions for Execution;
 
@@ -67,10 +68,10 @@ abstract contract CashoutInternal is Cashout {
         bytes32 account,
         bytes memory state,
         bytes calldata input,
-        uint128 value
+        uint value
     ) internal returns (bytes memory, uint) {
         if (value != 0) revert ValueNotAllowed();
-        if (state.length != 0) revert Executions.ZeroStride();
+        if (state.length != 0) revert UnexpectedState();
         if (input.length % Sizes.Cashout != 0) revert Blocks.InvalidBlock();
 
         (uint abs, uint end) = Cursors.bounds(input);

package/commands/Credit.sol

@@ -5,6 +5,7 @@ import {Execution, Executions, CommandBase, Specs} from "./Base.sol";
 import {CreditAccountHook} from "../core/Settlement.sol";
 import {Blocks, Memory} from "../codec/Blocks.sol";
 import {Sizes} from "../codec/Specs.sol";
+import {UnexpectedInput} from "../utils/Errors.sol";
 
 using Executions for Execution;
 
@@ -58,10 +59,10 @@ abstract contract CreditAccountInternal is CreditAccount {
         bytes32 account,
         bytes memory state,
         bytes calldata input,
-        uint128 value
+        uint value
     ) internal returns (bytes memory, uint) {
         if (value != 0) revert ValueNotAllowed();
-        if (input.length != 0) revert Executions.ZeroStride();
+        if (input.length != 0) revert UnexpectedInput();
         if (state.length == 0) revert Blocks.EmptyRun();
 
         (uint abs, uint end) = Memory.bounds(state, Sizes.Balance);

package/commands/Debit.sol

@@ -6,6 +6,7 @@ import {DebitAccountHook} from "../core/Settlement.sol";
 import {Blocks} from "../codec/Blocks.sol";
 import {Sizes} from "../codec/Specs.sol";
 import {Cursors} from "../utils/Cursors.sol";
+import {UnexpectedState} from "../utils/Errors.sol";
 
 using Executions for Execution;
 
@@ -61,10 +62,10 @@ abstract contract DebitAccountInternal is DebitAccount {
         bytes32 account,
         bytes memory state,
         bytes calldata input,
-        uint128 value
+        uint value
     ) internal returns (bytes memory, uint) {
         if (value != 0) revert ValueNotAllowed();
-        if (state.length != 0) revert Executions.ZeroStride();
+        if (state.length != 0) revert UnexpectedState();
         if (input.length == 0) revert Blocks.EmptyRun();
         if (input.length % Sizes.Amount != 0) revert Blocks.InvalidBlock();
 

package/commands/Recover.sol

@@ -9,7 +9,8 @@ using Executions for Execution;
 abstract contract RecoverPayableHook {
     /// @notice Override to recover a witness through `handler`.
     /// @param handler Port that should attempt recovery.
-    /// @param resources Chain-specific resources assigned to the recovery attempt.
+    /// @param resources Opaque packed chain-specific resources, not plain native
+    /// value. EVM handlers extract the low 128-bit value lane with `useResourceValue`.
     /// @param key Recovery lookup key.
     /// @param witness Witness payload used to prove and replay recovery.
     /// @param funds Shared execution containing the source value budget.

package/commands/Relay.sol

@@ -13,8 +13,9 @@ abstract contract RelayPayableHook {
     /// the source state is consumed before destination success is known.
     /// @param portal Destination portal implementation's host ID. Implementations
     /// may validate or resolve it for their transport.
-    /// @param resources Chain-specific destination resources. EVM adapters
-    /// may interpret this as packed execution gas and destination value.
+    /// @param resources Opaque packed chain-specific destination resources, not
+    /// plain native value. EVM adapters extract the low 128-bit value lane with
+    /// `useResourceValue`; higher bits may encode execution gas or other data.
     /// @param account Destination command account.
     /// @param state Complete state forwarded into the destination context.
     /// @param input Input forwarded into the destination context.

package/commands/Repay.sol

@@ -7,6 +7,7 @@ import {Action} from "../annotations/Action.sol";
 import {Actions} from "../utils/Actions.sol";
 import {Blocks, Memory} from "../codec/Blocks.sol";
 import {Sizes} from "../codec/Specs.sol";
+import {UnexpectedInput} from "../utils/Errors.sol";
 
 using Executions for Execution;
 
@@ -161,10 +162,10 @@ abstract contract RepayInternal is Repay {
         bytes32 account,
         bytes memory state,
         bytes calldata input,
-        uint128 value
+        uint value
     ) internal returns (bytes memory, uint) {
         if (value != 0) revert ValueNotAllowed();
-        if (input.length != 0) revert Executions.ZeroStride();
+        if (input.length != 0) revert UnexpectedInput();
         if (state.length == 0) revert Blocks.EmptyRun();
 
         (uint abs, uint end) = Memory.bounds(state, Sizes.Debt);