@rootzero/contracts 1.28.0 → 1.30.0

package/core/Access.sol

@@ -6,7 +6,6 @@ import {GuardianEvent} from "../events/Guardian.sol";
 import {Runtime} from "./Runtime.sol";
 import {Accounts} from "../utils/Accounts.sol";
 import {Nodes} from "../utils/Nodes.sol";
-import {addrOr} from "../utils/Utils.sol";
 
 /// @dev Thrown when a caller, account, or node lacks required access.
 error AccessDenied();
@@ -37,20 +36,23 @@ abstract contract TrustAccess {
 /// @title CommanderAccess
 /// @notice Minimal commander-based access control shared by host access policies.
 abstract contract CommanderAccess is Runtime {
-    /// @dev Trusted commander address.
-    /// Defaults to `address(this)` when no external commander is provided.
-    address internal immutable commander;
+    /// @dev Commander host ID. Defaults to this contract's host ID when self-managed.
+    uint internal immutable commander;
 
-    /// @param cmdr Commander address, or zero to make this contract self-managed.
-    constructor(address cmdr) {
-        commander = addrOr(cmdr, address(this));
+    /// @dev Native commander address resolved from `commander` at construction.
+    address internal immutable commanderAddr;
+
+    /// @param cmdr Local host ID of the commander, or zero to make this contract self-managed.
+    constructor(uint cmdr) {
+        commander = cmdr == 0 ? host : cmdr;
+        commanderAddr = cmdr == 0 ? address(this) : Nodes.hostAddr(cmdr);
     }
 
     /// @notice Assert that `caller` is the commander and return it.
     /// @param caller Address to validate.
     /// @return The same `caller` value if it is the commander.
     function enforceCommander(address caller) internal view returns (address) {
-        if (caller == address(0) || caller != commander) {
+        if (caller == address(0) || caller != commanderAddr) {
             revert AccessDenied();
         }
         return caller;
@@ -61,11 +63,11 @@ abstract contract CommanderAccess is Runtime {
 /// @title AdminAccess
 /// @notice Commander access with the admin account derived from the commander.
 abstract contract AdminAccess is CommanderAccess {
-    /// @dev Admin account ID derived from the commander address at construction time.
+    /// @dev Admin account ID derived from the resolved commander address at construction time.
     bytes32 internal immutable admin;
 
     constructor() {
-        admin = Accounts.toAdmin(commander);
+        admin = Accounts.toAdmin(commanderAddr);
     }
 
     /// @notice Assert that `account` is the admin account and `caller` is the commander.
@@ -99,7 +101,7 @@ abstract contract NodeAccess is AdminAccess, TrustAccess, NodeEvent {
     /// whose host ID has been explicitly authorized.
     /// @param caller Address to check.
     function isTrustedCaller(address caller) internal view returns (bool) {
-        return caller == commander || caller == address(this) || nodes[Nodes.toHost(caller)];
+        return caller == commanderAddr || caller == address(this) || nodes[Nodes.toHost(caller)];
     }
 
     /// @notice Assert that `node` is in the trusted set and return it.
@@ -112,7 +114,7 @@ abstract contract NodeAccess is AdminAccess, TrustAccess, NodeEvent {
 
     /// @notice Assert that `caller` is a trusted peer other than the commander.
     function enforcePeer(address caller) internal view returns (address) {
-        if (caller == commander) revert CommanderNotAllowed();
+        if (caller == commanderAddr) revert CommanderNotAllowed();
         if (caller == address(0) || !isTrustedCaller(caller)) {
             revert AccessDenied();
         }

package/core/Calls.sol

@@ -10,122 +10,110 @@ import {Nodes} from "../utils/Nodes.sol";
 /// @param err Revert data returned by the failed call.
 error FailedCall(address addr, bytes4 selector, bytes err);
 
-/// @notice Execute a raw `command(bytes)` call and decode its state and credit results.
-/// @dev The caller must validate and authorize the command before entering this helper.
-/// Uses one scratch region for both call data and return data. Successful return data
-/// must use the exact ABI layout of `(bytes, uint)`.
-function rawCommandCall(
+/// @notice Try a raw low-level call to another node and return whether it succeeded.
+/// @param node Node ID of the callee.
+/// @param value Native value to forward in wei.
+/// @param data Complete encoded calldata to send.
+/// @return success True if the low-level call succeeded.
+function tryRawCall(uint node, uint value, bytes memory data) returns (bool success) {
+    address addr = Nodes.addr(node);
+    (success, ) = payable(addr).call{value: value}(data);
+}
+
+/// @notice Try a raw low-level call using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function tryRawCall(
     bytes4 selector,
-    address target,
+    address addr,
     uint value,
-    bytes32 account,
-    bytes memory state,
-    bytes calldata input
-) returns (bytes memory output, uint credit) {
+    bytes memory args
+) returns (bool success) {
     assembly ("memory-safe") {
-        let scratch := mload(0x40)
-        let statelen := mload(state)
-        let ctxlen := add(56, add(statelen, input.length))
-
-        // ABI envelope for command(bytes).
-        mstore(scratch, selector)
-        mstore(add(scratch, 0x04), 0x20)
-        mstore(add(scratch, 0x24), ctxlen)
-
-        // CONTEXT(account, BYTES(state), BYTES(input)).
-        let ctx := add(scratch, 0x44)
-        // 0xc5769e23 = bytes4(keccak256("#context"))
-        mstore(ctx, or(shl(224, 0xc5769e23), shl(192, sub(ctxlen, 8))))
-        // `ctxlen` is dead after the header and can carry the complete call length.
-        ctxlen := add(68, and(add(ctxlen, 0x1f), not(0x1f)))
-        mstore(add(ctx, 0x08), account)
-        let stateblk := add(ctx, 0x28)
-        // 0x6911b332 = bytes4(keccak256("#bytes"))
-        mstore(stateblk, or(shl(224, 0x6911b332), shl(192, statelen)))
-        mcopy(add(stateblk, 0x08), add(state, 0x20), statelen)
-        let inputblk := add(add(stateblk, 0x08), statelen)
-        let inputlen := input.length
-        mstore(inputblk, or(shl(224, 0x6911b332), shl(192, inputlen)))
-        calldatacopy(add(inputblk, 0x08), input.offset, inputlen)
-
-        // ABI word alignment also covers the input header's full-word write. Advance
-        // the free memory pointer once, after the return-data size is also known.
-        let inputend := and(add(add(scratch, ctxlen), 0x1f), not(0x1f))
-        let success := call(gas(), target, value, scratch, ctxlen, 0, 0)
-        let retlen := returndatasize()
-        if iszero(success) {
-            // FailedCall(target, selector, returndata)
-            // 0x20577b07 = FailedCall(address,bytes4,bytes)
-            mstore(scratch, shl(224, 0x20577b07))
-            mstore(add(scratch, 0x04), target)
-            mstore(add(scratch, 0x24), selector)
-            mstore(add(scratch, 0x44), 0x60)
-            mstore(add(scratch, 0x64), retlen)
-            mstore(add(add(scratch, 0x84), retlen), 0)
-            returndatacopy(add(scratch, 0x84), 0, retlen)
-            revert(scratch, add(0x84, and(add(retlen, 0x1f), not(0x1f))))
-        }
-
-        if lt(retlen, 0x60) { revert(0, 0) }
-        returndatacopy(scratch, 0, retlen)
-
-        // Strictly validate the exact ABI layout for (bytes, uint). The returned
-        // byte array can then point directly into the copied returndata.
-        if iszero(eq(mload(scratch), 0x40)) { revert(0, 0) }
-        let len1 := mload(add(scratch, 0x40))
-        if gt(len1, sub(retlen, 0x60)) { revert(0, 0) }
-        let pad1 := and(add(len1, 0x1f), not(0x1f))
-        if iszero(eq(retlen, add(0x60, pad1))) { revert(0, 0) }
-        output := add(scratch, 0x40)
-        credit := mload(add(scratch, 0x20))
-
-        let retend := and(add(add(scratch, retlen), 0x1f), not(0x1f))
-        if gt(retend, inputend) { inputend := retend }
-        mstore(0x40, inputend)
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := call(gas(), addr, value, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
     }
 }
 
-/// @title RawNodeCalls
-/// @notice Low-level inter-node call helpers without target authorization.
-abstract contract RawNodeCalls {
-    /// @notice Try a raw low-level call to another node and return whether it succeeded.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return success True if the low-level call succeeded.
-    function tryRawCall(uint node, uint value, bytes memory data) internal returns (bool success) {
-        address addr = Nodes.addr(node);
-        (success, ) = payable(addr).call{value: value}(data);
-    }
+/// @notice Make a raw low-level call to another node and revert when it fails.
+/// @param node Node ID of the callee.
+/// @param value Native value to forward in wei.
+/// @param data Complete encoded calldata to send.
+/// @return out Return data from the successful call.
+function rawCall(uint node, uint value, bytes memory data) returns (bytes memory out) {
+    bool success;
+    address addr = Nodes.addr(node);
+    (success, out) = payable(addr).call{value: value}(data);
+    if (!success) revert FailedCall(addr, bytes4(data), out);
+}
 
-    /// @notice Make a raw low-level call to another node and revert when it fails.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return out Return data from the successful call.
-    function rawCall(uint node, uint value, bytes memory data) internal returns (bytes memory out) {
-        bool success;
-        address addr = Nodes.addr(node);
-        (success, out) = payable(addr).call{value: value}(data);
-        if (!success) revert FailedCall(addr, bytes4(data), out);
+/// @notice Make a raw low-level call using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function rawCall(
+    bytes4 selector,
+    address addr,
+    uint value,
+    bytes memory args
+) returns (bytes memory out) {
+    bool success;
+    assembly ("memory-safe") {
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := call(gas(), addr, value, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
+
+        let size := returndatasize()
+        out := mload(0x40)
+        mstore(out, size)
+        returndatacopy(add(out, 0x20), 0, size)
+        mstore(add(add(out, 0x20), size), 0)
+        mstore(0x40, and(add(add(add(out, 0x20), size), 0x1f), not(0x1f)))
     }
+    if (!success) revert FailedCall(addr, selector, out);
+}
 
-    /// @notice Make a raw low-level read-only query to another node and revert when it fails.
-    /// @param node Node ID of the callee.
-    /// @param data Encoded calldata to send.
-    /// @return out Return data from the successful query.
-    function rawQuery(uint node, bytes memory data) internal view returns (bytes memory out) {
-        bool success;
-        address addr = Nodes.addr(node);
-        (success, out) = addr.staticcall(data);
-        if (!success) revert FailedCall(addr, bytes4(data), out);
-    }
+/// @notice Make a raw low-level read-only query to another node and revert when it fails.
+/// @param node Node ID of the callee.
+/// @param data Complete encoded calldata to send.
+/// @return out Return data from the successful query.
+function rawQuery(uint node, bytes memory data) view returns (bytes memory out) {
+    bool success;
+    address addr = Nodes.addr(node);
+    (success, out) = addr.staticcall(data);
+    if (!success) revert FailedCall(addr, bytes4(data), out);
+}
 
+/// @notice Make a raw read-only query using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function rawQuery(
+    bytes4 selector,
+    address addr,
+    bytes memory args
+) view returns (bytes memory out) {
+    bool success;
+    assembly ("memory-safe") {
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := staticcall(gas(), addr, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
+
+        let size := returndatasize()
+        out := mload(0x40)
+        mstore(out, size)
+        returndatacopy(add(out, 0x20), 0, size)
+        mstore(add(add(out, 0x20), size), 0)
+        mstore(0x40, and(add(add(add(out, 0x20), size), 0x1f), not(0x1f)))
+    }
+    if (!success) revert FailedCall(addr, selector, out);
 }
 
 /// @title NodeCalls
 /// @notice Trusted low-level inter-node calls backed by a host-provided node policy.
-abstract contract NodeCalls is RawNodeCalls, TrustAccess {
+abstract contract NodeCalls is TrustAccess {
     /// @notice Try a trusted low-level call to another node and return whether it succeeded.
     /// @param node Node ID of the callee.
     /// @param value Native value to forward in wei.

package/core/Host.sol

@@ -28,11 +28,13 @@ interface IHostIntroduction {
 /// Calls a deployed commander during construction without adding an inbound
 /// introduction endpoint to the inheriting host.
 abstract contract HostIntroduction is Runtime {
-    /// @param cmdr Commander address to introduce this host to when it is a deployed contract.
+    /// @param cmdr Local host ID to introduce this host to, or zero for no introduction.
     /// @dev Deployment reverts if a contract commander does not accept `introduce(uint,uint)`.
-    constructor(address cmdr) {
-        if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
-        introduceTo(Nodes.toHost(cmdr));
+    constructor(uint cmdr) {
+        if (cmdr == 0 || cmdr == host) return;
+        address target = Nodes.hostAddr(cmdr);
+        if (target.code.length == 0) return;
+        IHostIntroduction(target).introduce(host, block.number);
     }
 
     /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
@@ -53,9 +55,9 @@ abstract contract CommandHost is CommanderAccess, CallerAccess, HostIntroduction
     /// @dev Thrown when a commander-only host is deployed without an external commander.
     error InvalidCommander();
 
-    /// @param cmdr Nonzero address allowed to invoke hosted commands.
-    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {
-        if (cmdr == address(0)) revert InvalidCommander();
+    /// @param cmdr Nonzero local host ID allowed to invoke hosted commands.
+    constructor(uint cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {
+        if (cmdr == 0) revert InvalidCommander();
     }
 
     function enforceCaller(address caller) internal view virtual override returns (address) {
@@ -82,10 +84,10 @@ abstract contract Guardians is Appoint, Dismiss, Revoke {
 /// optionally introduces itself to a commander host at deployment.
 /// Accepts native ETH payments via the `receive` function.
 abstract contract Host is Admins, Guardians, HostIntroduction, IntroductionEvent, IHostIntroduction {
-    /// @param cmdr Commander address; used by the composed access capabilities.
-    ///        If `cmdr` is a deployed contract, the host calls `introduce`
-    ///        on it during construction.
-    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {}
+    /// @param cmdr Commander host ID; used by the composed access capabilities.
+    ///        If the encoded native target is a deployed contract, the host
+    ///        calls `introduce` on it during construction.
+    constructor(uint cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {}
 
     /// @notice Assert that `caller` may invoke commands on a peer-aware host.
     function enforceCaller(address caller) internal view virtual override returns (address) {

package/core/Pipeline.sol

@@ -2,11 +2,11 @@
 pragma solidity ^0.8.33;
 
 import {Blocks} from "../codec/Blocks.sol";
+import {Keys} from "../codec/Keys.sol";
 import {TrustAccess} from "./Access.sol";
-import {rawCommandCall} from "./Calls.sol";
-import {Cursors} from "../utils/Cursors.sol";
 import {InsufficientValue, OutOfBounds, UnexpectedState} from "../utils/Errors.sol";
-import {unpackCommand} from "../utils/Nodes.sol";
+import {Nodes} from "../utils/Nodes.sol";
+import {Flags} from "../utils/Flags.sol";
 
 /// @notice Hook implemented by hosts that execute encoded step streams.
 abstract contract PipeHook {
@@ -21,31 +21,188 @@ abstract contract PipeHook {
 
 /// @notice Hook implemented by pipeline hosts that execute host-local commands.
 abstract contract ExecuteHook {
-    /// @notice Execute one command whose node ID targets the current host.
-    /// @dev Implementations must revert for unsupported local command IDs.
+    /// @notice Try to execute one command whose node ID targets the current host.
+    /// @dev Implementations returning `handled = true` are responsible for
+    /// authorizing the command. Return false without side effects to delegate to
+    /// the trusted normal external entrypoint. Handoff commands must be delegated
+    /// because this hook receives ordinary input without the continuation that
+    /// Pipeline adds to the RELAY envelope. Implementations may revert instead.
     function execute(
         uint cmd,
         bytes32 account,
         bytes memory state,
         bytes calldata input,
         uint value
-    ) internal virtual returns (bytes memory output, uint credit);
+    ) internal virtual returns (bool handled, bytes memory output, uint credit);
 }
 
 /// @title Pipeline
 /// @notice Core pipeline functionality shared by higher-level surfaces.
+/// @dev This gas-sensitive implementation intentionally inlines the command ID
+/// layout and the CONTEXT, BYTES, and RELAY block encodings. Changes to command
+/// selector, target, or flag placement, or to those block layouts, must update
+/// the corresponding assembly and packed-cursor logic here.
 abstract contract Pipeline is TrustAccess, PipeHook, ExecuteHook {
-    function run(
+    /// @dev Private pipeline cursor layout:
+    /// bits 0-31 current STEP offset, 32-63 stream end,
+    /// 64-95 command-input offset, 96-127 command-input length.
+    function unpackBytes(uint abs) private pure returns (uint input, uint end) {
+        uint body;
+        (body, end) = Blocks.expectKey(abs, Keys.Bytes);
+        // `expectKey` constructs `end` as `body + uint32(length)`.
+        unchecked {
+            input = uint32(body) | ((end - body) << 32);
+        }
+    }
+
+    function takeStep(uint cursor) private pure returns (uint cmd, uint value, uint updated) {
+        uint abs = uint32(cursor);
+        uint limit;
+        (abs, limit) = Blocks.expectKey(abs, Keys.Step);
+        assembly ("memory-safe") {
+            cmd := calldataload(abs)
+            value := calldataload(add(abs, 0x20))
+        }
+
+        (uint input, uint end) = unpackBytes(abs + 64);
+        if (end != limit) revert Blocks.InvalidBlock();
+        if (end > uint32(cursor >> 32)) revert OutOfBounds();
+
+        updated = uint32(end) | (uint64(cursor) & (uint(type(uint32).max) << 32)) | (input << 64);
+    }
+
+    function rawInput(uint cursor) private pure returns (bytes calldata input) {
+        assembly ("memory-safe") {
+            input.offset := and(shr(64, cursor), 0xffffffff)
+            input.length := and(shr(96, cursor), 0xffffffff)
+        }
+    }
+
+    /// @dev Execute the prepared command call and strictly decode `(bytes, uint)`.
+    function invokeCommand(
         uint cmd,
+        uint value,
         bytes32 account,
         bytes memory state,
-        bytes calldata input,
-        uint value
+        uint input
     ) private returns (bytes memory output, uint credit) {
-        (bytes4 selector, address target) = unpackCommand(cmd);
-        if (target == address(this)) return execute(cmd, account, state, input, value);
-        ensureTrusted(cmd);
-        return rawCommandCall(selector, target, value, account, state, input);
+        assembly ("memory-safe") {
+            let scratch := mload(0x40)
+            let ctxlen
+            switch iszero(shr(64, input))
+            case 1 {
+                let statelen := mload(state)
+                let inputlen := and(shr(32, input), 0xffffffff)
+                ctxlen := add(56, add(statelen, inputlen))
+
+                mstore(scratch, shl(224, and(shr(160, cmd), 0xffffffff)))
+                mstore(add(scratch, 0x04), 0x20)
+                mstore(add(scratch, 0x24), ctxlen)
+
+                let p := add(scratch, 0x44)
+                mstore(p, or(shl(224, 0xc5769e23), shl(192, sub(ctxlen, 8))))
+                mstore(add(p, 0x08), account)
+                p := add(p, 0x28)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, statelen)))
+                mcopy(add(p, 0x08), add(state, 0x20), statelen)
+                p := add(add(p, 0x08), statelen)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, inputlen)))
+                calldatacopy(add(p, 0x08), and(input, 0xffffffff), inputlen)
+            }
+            default {
+                let statelen := mload(state)
+                let inputlen := and(shr(96, input), 0xffffffff)
+                let stepslen := sub(and(shr(32, input), 0xffffffff), and(input, 0xffffffff))
+                let relaylen := add(16, add(inputlen, stepslen))
+                ctxlen := add(64, add(statelen, relaylen))
+
+                mstore(scratch, shl(224, and(shr(160, cmd), 0xffffffff)))
+                mstore(add(scratch, 0x04), 0x20)
+                mstore(add(scratch, 0x24), ctxlen)
+
+                let p := add(scratch, 0x44)
+                mstore(p, or(shl(224, 0xc5769e23), shl(192, sub(ctxlen, 8))))
+                mstore(add(p, 0x08), account)
+                p := add(p, 0x28)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, statelen)))
+                mcopy(add(p, 0x08), add(state, 0x20), statelen)
+
+                p := add(add(p, 0x08), statelen)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, add(8, relaylen))))
+                p := add(p, 0x08)
+                mstore(p, or(shl(224, 0xc34cc52a), shl(192, relaylen)))
+                p := add(p, 0x08)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, inputlen)))
+                calldatacopy(add(p, 0x08), and(shr(64, input), 0xffffffff), inputlen)
+                p := add(add(p, 0x08), inputlen)
+                mstore(p, or(shl(224, 0x6911b332), shl(192, stepslen)))
+                calldatacopy(add(p, 0x08), and(input, 0xffffffff), stepslen)
+            }
+            ctxlen := add(68, and(add(ctxlen, 0x1f), not(0x1f)))
+            let inputend := and(add(add(scratch, ctxlen), 0x1f), not(0x1f))
+            let success := call(
+                gas(),
+                and(cmd, 0xffffffffffffffffffffffffffffffffffffffff),
+                value,
+                scratch,
+                ctxlen,
+                0,
+                0
+            )
+            let retlen := returndatasize()
+            if iszero(success) {
+                mstore(scratch, shl(224, 0x20577b07))
+                mstore(add(scratch, 0x04), and(cmd, 0xffffffffffffffffffffffffffffffffffffffff))
+                mstore(add(scratch, 0x24), shl(224, and(shr(160, cmd), 0xffffffff)))
+                mstore(add(scratch, 0x44), 0x60)
+                mstore(add(scratch, 0x64), retlen)
+                mstore(add(add(scratch, 0x84), retlen), 0)
+                returndatacopy(add(scratch, 0x84), 0, retlen)
+                revert(scratch, add(0x84, and(add(retlen, 0x1f), not(0x1f))))
+            }
+
+            if lt(retlen, 0x60) {
+                revert(0, 0)
+            }
+            returndatacopy(scratch, 0, retlen)
+            if iszero(eq(mload(scratch), 0x40)) {
+                revert(0, 0)
+            }
+            let len1 := mload(add(scratch, 0x40))
+            if gt(len1, sub(retlen, 0x60)) {
+                revert(0, 0)
+            }
+            let pad1 := and(add(len1, 0x1f), not(0x1f))
+            if iszero(eq(retlen, add(0x60, pad1))) {
+                revert(0, 0)
+            }
+            output := add(scratch, 0x40)
+            credit := mload(add(scratch, 0x20))
+
+            let retend := and(add(add(scratch, retlen), 0x1f), not(0x1f))
+            if gt(retend, inputend) {
+                inputend := retend
+            }
+            mstore(0x40, inputend)
+        }
+    }
+
+    function run(
+        uint cmd,
+        bytes32 account,
+        bytes memory state,
+        uint value,
+        uint cursor
+    ) private returns (bytes memory output, uint credit, uint updated) {
+        if (address(uint160(cmd)) == address(this)) {
+            bool handled;
+            (handled, output, credit) = execute(cmd, account, state, rawInput(cursor), value);
+            if (handled) return (output, credit, cursor);
+        }
+        ensureTrusted(Nodes.command(cmd));
+        bool handoff = uint8(cmd >> 224) & Flags.Handoff != 0;
+        (output, credit) = invokeCommand(cmd, value, account, state, handoff ? cursor : cursor >> 64);
+        updated = handoff ? (cursor & ~uint(type(uint32).max)) | uint32(cursor >> 32) : cursor;
     }
 
     /// @notice Execute a STEP block stream through the pipeline.
@@ -62,18 +219,21 @@ abstract contract Pipeline is TrustAccess, PipeHook, ExecuteHook {
         bytes calldata steps,
         uint budget
     ) internal virtual override returns (uint remaining) {
-        (uint abs, uint end) = Cursors.bounds(steps);
+        uint cursor;
+        assembly ("memory-safe") {
+            cursor := or(steps.offset, shl(32, add(steps.offset, steps.length)))
+        }
 
-        while (abs < end) {
-            (uint cmd, uint value, bytes calldata input, uint next) = Blocks.unpackStep(abs);
-            if (next > end) revert OutOfBounds();
+        while (uint32(cursor) < uint32(cursor >> 32)) {
+            uint cmd;
+            uint value;
+            (cmd, value, cursor) = takeStep(cursor);
             if (value > budget) revert InsufficientValue();
             unchecked {
                 budget -= value;
             }
-            (state, value) = run(cmd, account, state, input, value);
+            (state, value, cursor) = run(cmd, account, state, value, cursor);
             budget += value;
-            abs = next;
         }
 
         if (state.length != 0) revert UnexpectedState();

package/core/Settlement.sol

@@ -44,7 +44,7 @@ abstract contract SettleHook {
 
 /// @title Settlement
 /// @notice Default account-hook implementation for transaction posting and position settlement.
-abstract contract Settlement is PostHook, SettleHook, RepayHook, DebitAccountHook, CreditAccountHook {
+abstract contract Settlement is PostHook, DebitAccountHook, CreditAccountHook, SettleHook, RepayHook {
     /// @notice Post one transaction by debiting its source and crediting its destination.
     /// Returns without calling either hook when `amount` is zero and skips either
     /// operation when the corresponding account is zero.