@rootzero/contracts 1.29.0 → 1.30.0

package/codec/Keys.sol

@@ -11,8 +11,6 @@ library Keys {
     bytes4 constant Empty = bytes4(0);
     /// @dev Input amount - (bytes32 asset, uint amount)
     bytes4 constant Amount = bytes4(keccak256("#amount"));
-    /// @dev Native-asset cashout request - (uint amount)
-    bytes4 constant Cashout = bytes4(keccak256("#cashout"));
     /// @dev Pipeline bootstrap request - (bytes32 asset, uint amount, uint budget)
     bytes4 constant Bootstrap = bytes4(keccak256("#bootstrap"));
     /// @dev Ledger balance - (bytes32 asset, uint amount)
@@ -41,7 +39,7 @@ library Keys {
     bytes4 constant Transaction = bytes4(keccak256("#transaction"));
     /// @dev Sub-command invocation - (uint cmd, uint value, #bytes as input)
     bytes4 constant Step = bytes4(keccak256("#step"));
-    /// @dev Portal relay input - (uint portal, uint resources, #bytes as input)
+    /// @dev Pipeline handoff envelope - (#bytes as input, #bytes as steps)
     bytes4 constant Relay = bytes4(keccak256("#relay"));
     /// @dev Command context transport - (bytes32 account, #bytes as state, #bytes as input)
     bytes4 constant Context = bytes4(keccak256("#context"));

package/codec/Schema.sol

@@ -89,8 +89,6 @@ library Schemas {
     string constant Account = "bytes32 account";
     string constant Asset = "bytes32 asset";
     string constant Status = "uint code";
-    string constant Cashout = "uint amount";
-
     // Two-word payloads
 
     string constant Amount = "bytes32 asset, uint amount";
@@ -119,7 +117,7 @@ library Schemas {
 
     string constant Step = "uint cmd, uint value, #bytes as input";
     string constant Call = "uint target, uint resources, #bytes as payload";
-    string constant Relay = "uint portal, uint resources, #bytes as input";
+    string constant Relay = "#bytes as input, #bytes as steps";
     string constant Dispatch = "uint portal, uint resources, #bytes as payload";
     string constant Context = "bytes32 account, #bytes as state, #bytes as input";
     string constant Recover = "uint handler, uint resources, bytes32 key, #bytes as witness";

package/codec/Specs.sol

@@ -25,8 +25,6 @@ library Sizes {
     uint constant Step = 2 * Header + 2 * Word;
     /// @dev STATUS block: 8 header + 32 status code = 40 bytes
     uint constant Status = B32;
-    /// @dev CASHOUT block: 8 header + 32 native-asset amount = 40 bytes
-    uint constant Cashout = B32;
     /// @dev BOOTSTRAP block: 8 header + 32 asset + 32 amount + 32 budget = 104 bytes
     uint constant Bootstrap = B96;
     /// @dev AMOUNT block: 8 header + 32 asset + 32 amount = 72 bytes
@@ -63,13 +61,13 @@ library Specs {
     uint private constant Exact96 = 96 * SizeFields;
     uint private constant Exact128 = 128 * SizeFields;
     uint private constant UnboundedHint128 = uint(128) << 136;
+    uint private constant UnboundedMin16Hint256 = (uint(16) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin40Hint256 = (uint(40) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin72Hint256 = (uint(72) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin48Hint512 = (uint(48) << 192) | (uint(512) << 136);
     uint private constant UnboundedMin104Hint256 = (uint(104) << 192) | (uint(256) << 136);
 
     uint constant Empty = uint(bytes32(Keys.Empty));
-    uint constant Cashout = uint(bytes32(Keys.Cashout)) | Exact32;
     uint constant Bootstrap = uint(bytes32(Keys.Bootstrap)) | Exact96;
     uint constant Amount = uint(bytes32(Keys.Amount)) | Exact64;
     uint constant Balance = uint(bytes32(Keys.Balance)) | Exact64;
@@ -85,7 +83,7 @@ library Specs {
     uint constant Account = uint(bytes32(Keys.Account)) | Exact32;
     uint constant Transaction = uint(bytes32(Keys.Transaction)) | Exact128;
     uint constant Step = uint(bytes32(Keys.Step)) | UnboundedMin72Hint256;
-    uint constant Relay = uint(bytes32(Keys.Relay)) | UnboundedMin72Hint256;
+    uint constant Relay = uint(bytes32(Keys.Relay)) | UnboundedMin16Hint256;
     uint constant Context = uint(bytes32(Keys.Context)) | UnboundedMin48Hint512;
     uint constant Recover = uint(bytes32(Keys.Recover)) | UnboundedMin104Hint256;
     uint constant Dispatch = uint(bytes32(Keys.Dispatch)) | UnboundedMin72Hint256;

package/codec/Writers.sol

@@ -433,13 +433,12 @@ library Writers {
 
     /// @notice Append a RELAY block.
     /// @param writer Destination writer.
-    /// @param portal Destination portal to encode.
-    /// @param resources Packed resources to encode.
     /// @param input Relay input to encode.
-    function appendRelay(Writer memory writer, uint portal, uint resources, bytes memory input) internal pure {
-        uint size = Sizes.B64 + Sizes.Header + input.length;
+    /// @param steps Remaining steps to encode.
+    function appendRelay(Writer memory writer, bytes memory input, bytes memory steps) internal pure {
+        uint size = 3 * Sizes.Header + input.length + steps.length;
         uint i = reserve(writer, size);
-        Blocks.writeRelay(writer.dst, i, portal, resources, input);
+        Blocks.writeRelay(writer.dst, i, input, steps);
     }
 
     /// @notice Append a DISPATCH block.
@@ -574,11 +573,11 @@ library Writers {
         Blocks.copyCall(writer.dst, i, target, resources, payload);
     }
 
-    /// @notice Append a RELAY block by copying its nested input from calldata.
-    function copyRelay(Writer memory writer, uint portal, uint resources, bytes calldata input) internal pure {
-        uint size = Sizes.B64 + Sizes.Header + input.length;
+    /// @notice Append a RELAY block by copying its nested streams from calldata.
+    function copyRelay(Writer memory writer, bytes calldata input, bytes calldata steps) internal pure {
+        uint size = 3 * Sizes.Header + input.length + steps.length;
         uint i = reserve(writer, size);
-        Blocks.copyRelay(writer.dst, i, portal, resources, input);
+        Blocks.copyRelay(writer.dst, i, input, steps);
     }
 
     /// @notice Append a DISPATCH block by copying its nested payload from calldata.

package/commands/Base.sol

@@ -7,7 +7,8 @@ import {Blocks} from "../codec/Blocks.sol";
 import {Specs} from "../codec/Specs.sol";
 import {HostAmount, Position} from "../core/Types.sol";
 import {Execution, Executions} from "../execution/Execution.sol";
-import {Descriptors, Flags} from "../codec/Descriptors.sol";
+import {Descriptors} from "../codec/Descriptors.sol";
+import {Flags} from "../utils/Flags.sol";
 import {Nodes} from "../utils/Nodes.sol";
 
 using Executions for Execution;
@@ -62,7 +63,7 @@ abstract contract CommandBase is CallerAccess, EndpointBase {
     /// @return id Command node ID.
     /// @return published Published endpoint descriptor.
     function command(string memory name, uint descriptor) internal returns (uint id, uint published) {
-        id = Nodes.toCommand(name, address(this));
+        id = Nodes.toCommand(name, address(this), uint8(descriptor));
         published = endpoint(id, name, descriptor);
     }
 

package/commands/Cashout.sol

@@ -2,19 +2,18 @@
 pragma solidity ^0.8.33;
 
 import {Execution, Executions, CommandBase, Specs} from "./Base.sol";
-import {Blocks} from "../codec/Blocks.sol";
+import {Memory} from "../codec/Blocks.sol";
 import {Sizes} from "../codec/Specs.sol";
-import {Cursors} from "../utils/Cursors.sol";
 import {Action} from "../annotations/Action.sol";
 import {Actions} from "../utils/Actions.sol";
-import {UnexpectedState} from "../utils/Errors.sol";
+import {InvalidAsset, UnexpectedInput} from "../utils/Errors.sol";
 
 using Executions for Execution;
 
 /// @notice Hook implemented by hosts that withdraw native assets from accounts.
 abstract contract CashoutHook {
     /// @notice Withdraw an exact native-asset amount from `account`.
-    /// Called once per CASHOUT input block.
+    /// Called once per native BALANCE block in state.
     /// @dev Implementations must revert when the requested amount cannot be withdrawn.
     /// @param account Account whose native asset is withdrawn.
     /// @param amount Native-asset amount to withdraw.
@@ -28,7 +27,7 @@ abstract contract Cashout is CommandBase, CashoutHook, Action {
     uint private immutable id;
 
     constructor() {
-        (id, descriptor) = command("cashout", Specs.Empty, Specs.Cashout, Specs.Empty, 0);
+        (id, descriptor) = command("cashout", Specs.Balance, Specs.Empty, Specs.Empty, 0);
         action(id, Actions.Cashout);
     }
 
@@ -37,8 +36,8 @@ abstract contract Cashout is CommandBase, CashoutHook, Action {
         return id;
     }
 
-    /// @notice Withdraw native-asset amounts from the command account.
-    /// @param context Command context carrying a CASHOUT input stream.
+    /// @notice Withdraw native BALANCE state from the command account.
+    /// @param context Command context carrying a BALANCE state stream.
     /// @return output Empty output state.
     /// @return credit Zero native budget credit.
     function cashout(
@@ -47,7 +46,9 @@ abstract contract Cashout is CommandBase, CashoutHook, Action {
         Execution memory exec = openCommand(context, descriptor);
 
         while (exec.more()) {
-            cashout(exec.account, exec.unpackCashout());
+            (bytes32 asset, uint amount) = exec.unpackBalance();
+            if (asset != nativeAsset) revert InvalidAsset();
+            cashout(exec.account, amount);
         }
 
         return exec.close();
@@ -57,10 +58,10 @@ abstract contract Cashout is CommandBase, CashoutHook, Action {
 /// @title ExecuteCashout
 /// @notice Extends cashout with optimized local pipeline execution.
 abstract contract ExecuteCashout is Cashout {
-    /// @notice Execute cashout directly against a calldata CASHOUT stream.
+    /// @notice Execute cashout directly against native BALANCE state held in memory.
     /// @param account Account whose native asset is withdrawn.
-    /// @param state Empty pipeline state required by the command schema.
-    /// @param input CASHOUT block stream.
+    /// @param state BALANCE block stream held in pipeline memory.
+    /// @param input Empty input required by the command schema.
     /// @param value Native value assigned to this command; must be zero.
     /// @return handled Always true because this helper executed the command.
     /// @return output Empty output state.
@@ -72,14 +73,15 @@ abstract contract ExecuteCashout is Cashout {
         uint value
     ) internal returns (bool handled, bytes memory output, uint credit) {
         if (value != 0) revert ValueNotAllowed();
-        if (state.length != 0) revert UnexpectedState();
-        if (input.length % Sizes.Cashout != 0) revert Blocks.InvalidBlock();
+        if (input.length != 0) revert UnexpectedInput();
 
-        (uint abs, uint end) = Cursors.bounds(input);
+        (uint abs, uint end) = Memory.bounds(state, Sizes.Balance);
         while (abs < end) {
-            cashout(account, Blocks.unpackCashout(abs));
+            (bytes32 asset, uint amount) = Memory.unpackBalance(abs);
+            if (asset != nativeAsset) revert InvalidAsset();
+            cashout(account, amount);
             unchecked {
-                abs += Sizes.Cashout;
+                abs += Sizes.Balance;
             }
         }
         return (true, "", 0);

package/commands/Relay.sol

@@ -7,26 +7,25 @@ using Executions for Execution;
 
 /// @notice Hook implemented by hosts that relay command contexts.
 abstract contract RelayPayableHook {
-    /// @notice Override to relay a command context to `portal`.
+    /// @notice Override to relay a command context and its pipeline continuation.
     /// @dev Relay hooks may forward only EMPTY or BALANCE state. They must not
     /// relay DEBT, POSITION, or other state whose destination handling can fail:
     /// the source state is consumed before destination success is known.
-    /// @param portal Destination portal implementation's host ID. Implementations
-    /// may validate or resolve it for their transport.
-    /// @param resources Opaque packed chain-specific destination resources, not
-    /// plain native value. EVM adapters extract the low 128-bit value lane with
-    /// `useResourceValue`; higher bits may encode execution gas or other data.
+    /// `funds` contains only this handoff STEP's assigned value, not the source
+    /// pipeline's complete remaining budget. Implementations must consume or
+    /// forward `state`; the command returns empty state when the hook completes.
     /// @param account Destination command account.
     /// @param state Complete state forwarded into the destination context.
-    /// @param input Input forwarded into the destination context.
+    /// @param input Command-specific input supplied by the handoff step.
+    /// Implementations define and decode this stream according to their transport.
+    /// @param steps Remaining STEP stream owned by the handoff.
     /// @param funds Execution carrying value available for transport fees and
     /// destination resource funding.
     function relay(
-        uint portal,
-        uint resources,
         bytes32 account,
         bytes calldata state,
         bytes calldata input,
+        bytes calldata steps,
         Execution memory funds
     ) internal virtual;
 }
@@ -37,14 +36,14 @@ abstract contract RelayPayable is CommandBase, RelayPayableHook {
     uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("relayPayable", Specs.Empty, Specs.Relay, Specs.Empty, Flags.Funded);
+        (, descriptor) = command("relayPayable", Specs.Empty, Specs.Relay, Specs.Empty, Flags.HandoffFunded);
     }
 
     /// @notice Relay one RELAY input block with the command account and empty state.
     function relayPayable(bytes calldata context) external payable onlyCommand returns (bytes memory, uint) {
         Execution memory exec = openCommand(context, descriptor);
-        (uint portal, uint resources, bytes calldata input) = exec.oninput().unpackRelay();
-        relay(portal, resources, exec.account, context[0:0], input, exec);
+        (bytes calldata input, bytes calldata steps) = exec.oninput().unpackRelay();
+        relay(exec.account, context[0:0], input, steps, exec);
         return exec.close();
     }
 }
@@ -58,7 +57,7 @@ abstract contract RelayBalancePayable is CommandBase, RelayPayableHook {
     uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("relayBalancePayable", Specs.Balance, Specs.Relay, Specs.Empty, Flags.Funded);
+        (, descriptor) = command("relayBalancePayable", Specs.Balance, Specs.Relay, Specs.Empty, Flags.HandoffFunded);
     }
 
     /// @notice Relay one RELAY input block with the command account and current state.
@@ -67,8 +66,8 @@ abstract contract RelayBalancePayable is CommandBase, RelayPayableHook {
     /// @return Native value to add to the caller's budget.
     function relayBalancePayable(bytes calldata context) external payable onlyCommand returns (bytes memory, uint) {
         Execution memory exec = openCommand(context, descriptor);
-        (uint portal, uint resources, bytes calldata input) = exec.oninput().unpackRelay();
-        relay(portal, resources, exec.account, exec.takeRawState(), input, exec);
+        (bytes calldata input, bytes calldata steps) = exec.oninput().unpackRelay();
+        relay(exec.account, exec.takeRawState(), input, steps, exec);
         return exec.close();
     }
 }

package/commands/admin/Execute.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.33;
 
 import {AdminBase, Execution, Executions, Flags, Specs} from "./Base.sol";
-import {RawNodeCalls} from "../../core/Calls.sol";
+import {rawCall} from "../../core/Calls.sol";
 
 using Executions for Execution;
 
@@ -13,7 +13,7 @@ using Executions for Execution;
 /// through `useResourceValue`.
 /// Only callable by the admin account.
 /// Unspent top-level `msg.value` is returned as native budget credit.
-abstract contract ExecutePayable is RawNodeCalls, AdminBase {
+abstract contract ExecutePayable is AdminBase {
     uint private immutable descriptor;
 
     constructor() {

package/core/Access.sol

@@ -6,7 +6,6 @@ import {GuardianEvent} from "../events/Guardian.sol";
 import {Runtime} from "./Runtime.sol";
 import {Accounts} from "../utils/Accounts.sol";
 import {Nodes} from "../utils/Nodes.sol";
-import {addrOr} from "../utils/Utils.sol";
 
 /// @dev Thrown when a caller, account, or node lacks required access.
 error AccessDenied();
@@ -37,20 +36,23 @@ abstract contract TrustAccess {
 /// @title CommanderAccess
 /// @notice Minimal commander-based access control shared by host access policies.
 abstract contract CommanderAccess is Runtime {
-    /// @dev Trusted commander address.
-    /// Defaults to `address(this)` when no external commander is provided.
-    address internal immutable commander;
+    /// @dev Commander host ID. Defaults to this contract's host ID when self-managed.
+    uint internal immutable commander;
 
-    /// @param cmdr Commander address, or zero to make this contract self-managed.
-    constructor(address cmdr) {
-        commander = addrOr(cmdr, address(this));
+    /// @dev Native commander address resolved from `commander` at construction.
+    address internal immutable commanderAddr;
+
+    /// @param cmdr Local host ID of the commander, or zero to make this contract self-managed.
+    constructor(uint cmdr) {
+        commander = cmdr == 0 ? host : cmdr;
+        commanderAddr = cmdr == 0 ? address(this) : Nodes.hostAddr(cmdr);
     }
 
     /// @notice Assert that `caller` is the commander and return it.
     /// @param caller Address to validate.
     /// @return The same `caller` value if it is the commander.
     function enforceCommander(address caller) internal view returns (address) {
-        if (caller == address(0) || caller != commander) {
+        if (caller == address(0) || caller != commanderAddr) {
             revert AccessDenied();
         }
         return caller;
@@ -61,11 +63,11 @@ abstract contract CommanderAccess is Runtime {
 /// @title AdminAccess
 /// @notice Commander access with the admin account derived from the commander.
 abstract contract AdminAccess is CommanderAccess {
-    /// @dev Admin account ID derived from the commander address at construction time.
+    /// @dev Admin account ID derived from the resolved commander address at construction time.
     bytes32 internal immutable admin;
 
     constructor() {
-        admin = Accounts.toAdmin(commander);
+        admin = Accounts.toAdmin(commanderAddr);
     }
 
     /// @notice Assert that `account` is the admin account and `caller` is the commander.
@@ -99,7 +101,7 @@ abstract contract NodeAccess is AdminAccess, TrustAccess, NodeEvent {
     /// whose host ID has been explicitly authorized.
     /// @param caller Address to check.
     function isTrustedCaller(address caller) internal view returns (bool) {
-        return caller == commander || caller == address(this) || nodes[Nodes.toHost(caller)];
+        return caller == commanderAddr || caller == address(this) || nodes[Nodes.toHost(caller)];
     }
 
     /// @notice Assert that `node` is in the trusted set and return it.
@@ -112,7 +114,7 @@ abstract contract NodeAccess is AdminAccess, TrustAccess, NodeEvent {
 
     /// @notice Assert that `caller` is a trusted peer other than the commander.
     function enforcePeer(address caller) internal view returns (address) {
-        if (caller == commander) revert CommanderNotAllowed();
+        if (caller == commanderAddr) revert CommanderNotAllowed();
         if (caller == address(0) || !isTrustedCaller(caller)) {
             revert AccessDenied();
         }

package/core/Calls.sol

@@ -10,122 +10,110 @@ import {Nodes} from "../utils/Nodes.sol";
 /// @param err Revert data returned by the failed call.
 error FailedCall(address addr, bytes4 selector, bytes err);
 
-/// @notice Execute a raw `command(bytes)` call and decode its state and credit results.
-/// @dev The caller must validate and authorize the command before entering this helper.
-/// Uses one scratch region for both call data and return data. Successful return data
-/// must use the exact ABI layout of `(bytes, uint)`.
-function rawCommandCall(
+/// @notice Try a raw low-level call to another node and return whether it succeeded.
+/// @param node Node ID of the callee.
+/// @param value Native value to forward in wei.
+/// @param data Complete encoded calldata to send.
+/// @return success True if the low-level call succeeded.
+function tryRawCall(uint node, uint value, bytes memory data) returns (bool success) {
+    address addr = Nodes.addr(node);
+    (success, ) = payable(addr).call{value: value}(data);
+}
+
+/// @notice Try a raw low-level call using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function tryRawCall(
     bytes4 selector,
-    address target,
+    address addr,
     uint value,
-    bytes32 account,
-    bytes memory state,
-    bytes calldata input
-) returns (bytes memory output, uint credit) {
+    bytes memory args
+) returns (bool success) {
     assembly ("memory-safe") {
-        let scratch := mload(0x40)
-        let statelen := mload(state)
-        let ctxlen := add(56, add(statelen, input.length))
-
-        // ABI envelope for command(bytes).
-        mstore(scratch, selector)
-        mstore(add(scratch, 0x04), 0x20)
-        mstore(add(scratch, 0x24), ctxlen)
-
-        // CONTEXT(account, BYTES(state), BYTES(input)).
-        let ctx := add(scratch, 0x44)
-        // 0xc5769e23 = bytes4(keccak256("#context"))
-        mstore(ctx, or(shl(224, 0xc5769e23), shl(192, sub(ctxlen, 8))))
-        // `ctxlen` is dead after the header and can carry the complete call length.
-        ctxlen := add(68, and(add(ctxlen, 0x1f), not(0x1f)))
-        mstore(add(ctx, 0x08), account)
-        let stateblk := add(ctx, 0x28)
-        // 0x6911b332 = bytes4(keccak256("#bytes"))
-        mstore(stateblk, or(shl(224, 0x6911b332), shl(192, statelen)))
-        mcopy(add(stateblk, 0x08), add(state, 0x20), statelen)
-        let inputblk := add(add(stateblk, 0x08), statelen)
-        let inputlen := input.length
-        mstore(inputblk, or(shl(224, 0x6911b332), shl(192, inputlen)))
-        calldatacopy(add(inputblk, 0x08), input.offset, inputlen)
-
-        // ABI word alignment also covers the input header's full-word write. Advance
-        // the free memory pointer once, after the return-data size is also known.
-        let inputend := and(add(add(scratch, ctxlen), 0x1f), not(0x1f))
-        let success := call(gas(), target, value, scratch, ctxlen, 0, 0)
-        let retlen := returndatasize()
-        if iszero(success) {
-            // FailedCall(target, selector, returndata)
-            // 0x20577b07 = FailedCall(address,bytes4,bytes)
-            mstore(scratch, shl(224, 0x20577b07))
-            mstore(add(scratch, 0x04), target)
-            mstore(add(scratch, 0x24), selector)
-            mstore(add(scratch, 0x44), 0x60)
-            mstore(add(scratch, 0x64), retlen)
-            mstore(add(add(scratch, 0x84), retlen), 0)
-            returndatacopy(add(scratch, 0x84), 0, retlen)
-            revert(scratch, add(0x84, and(add(retlen, 0x1f), not(0x1f))))
-        }
-
-        if lt(retlen, 0x60) { revert(0, 0) }
-        returndatacopy(scratch, 0, retlen)
-
-        // Strictly validate the exact ABI layout for (bytes, uint). The returned
-        // byte array can then point directly into the copied returndata.
-        if iszero(eq(mload(scratch), 0x40)) { revert(0, 0) }
-        let len1 := mload(add(scratch, 0x40))
-        if gt(len1, sub(retlen, 0x60)) { revert(0, 0) }
-        let pad1 := and(add(len1, 0x1f), not(0x1f))
-        if iszero(eq(retlen, add(0x60, pad1))) { revert(0, 0) }
-        output := add(scratch, 0x40)
-        credit := mload(add(scratch, 0x20))
-
-        let retend := and(add(add(scratch, retlen), 0x1f), not(0x1f))
-        if gt(retend, inputend) { inputend := retend }
-        mstore(0x40, inputend)
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := call(gas(), addr, value, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
     }
 }
 
-/// @title RawNodeCalls
-/// @notice Low-level inter-node call helpers without target authorization.
-abstract contract RawNodeCalls {
-    /// @notice Try a raw low-level call to another node and return whether it succeeded.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return success True if the low-level call succeeded.
-    function tryRawCall(uint node, uint value, bytes memory data) internal returns (bool success) {
-        address addr = Nodes.addr(node);
-        (success, ) = payable(addr).call{value: value}(data);
-    }
+/// @notice Make a raw low-level call to another node and revert when it fails.
+/// @param node Node ID of the callee.
+/// @param value Native value to forward in wei.
+/// @param data Complete encoded calldata to send.
+/// @return out Return data from the successful call.
+function rawCall(uint node, uint value, bytes memory data) returns (bytes memory out) {
+    bool success;
+    address addr = Nodes.addr(node);
+    (success, out) = payable(addr).call{value: value}(data);
+    if (!success) revert FailedCall(addr, bytes4(data), out);
+}
 
-    /// @notice Make a raw low-level call to another node and revert when it fails.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return out Return data from the successful call.
-    function rawCall(uint node, uint value, bytes memory data) internal returns (bytes memory out) {
-        bool success;
-        address addr = Nodes.addr(node);
-        (success, out) = payable(addr).call{value: value}(data);
-        if (!success) revert FailedCall(addr, bytes4(data), out);
+/// @notice Make a raw low-level call using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function rawCall(
+    bytes4 selector,
+    address addr,
+    uint value,
+    bytes memory args
+) returns (bytes memory out) {
+    bool success;
+    assembly ("memory-safe") {
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := call(gas(), addr, value, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
+
+        let size := returndatasize()
+        out := mload(0x40)
+        mstore(out, size)
+        returndatacopy(add(out, 0x20), 0, size)
+        mstore(add(add(out, 0x20), size), 0)
+        mstore(0x40, and(add(add(add(out, 0x20), size), 0x1f), not(0x1f)))
     }
+    if (!success) revert FailedCall(addr, selector, out);
+}
 
-    /// @notice Make a raw low-level read-only query to another node and revert when it fails.
-    /// @param node Node ID of the callee.
-    /// @param data Encoded calldata to send.
-    /// @return out Return data from the successful query.
-    function rawQuery(uint node, bytes memory data) internal view returns (bytes memory out) {
-        bool success;
-        address addr = Nodes.addr(node);
-        (success, out) = addr.staticcall(data);
-        if (!success) revert FailedCall(addr, bytes4(data), out);
-    }
+/// @notice Make a raw low-level read-only query to another node and revert when it fails.
+/// @param node Node ID of the callee.
+/// @param data Complete encoded calldata to send.
+/// @return out Return data from the successful query.
+function rawQuery(uint node, bytes memory data) view returns (bytes memory out) {
+    bool success;
+    address addr = Nodes.addr(node);
+    (success, out) = addr.staticcall(data);
+    if (!success) revert FailedCall(addr, bytes4(data), out);
+}
 
+/// @notice Make a raw read-only query using a separate selector and ABI-encoded arguments.
+/// @dev `args` must not include the selector. The byte-array length is temporarily
+/// used as scratch space so the call does not allocate or copy `selector || args`.
+function rawQuery(
+    bytes4 selector,
+    address addr,
+    bytes memory args
+) view returns (bytes memory out) {
+    bool success;
+    assembly ("memory-safe") {
+        let len := mload(args)
+        mstore(args, or(and(len, not(0xffffffff)), shr(224, selector)))
+        success := staticcall(gas(), addr, add(args, 0x1c), add(len, 0x04), 0, 0)
+        mstore(args, len)
+
+        let size := returndatasize()
+        out := mload(0x40)
+        mstore(out, size)
+        returndatacopy(add(out, 0x20), 0, size)
+        mstore(add(add(out, 0x20), size), 0)
+        mstore(0x40, and(add(add(add(out, 0x20), size), 0x1f), not(0x1f)))
+    }
+    if (!success) revert FailedCall(addr, selector, out);
 }
 
 /// @title NodeCalls
 /// @notice Trusted low-level inter-node calls backed by a host-provided node policy.
-abstract contract NodeCalls is RawNodeCalls, TrustAccess {
+abstract contract NodeCalls is TrustAccess {
     /// @notice Try a trusted low-level call to another node and return whether it succeeded.
     /// @param node Node ID of the callee.
     /// @param value Native value to forward in wei.

package/core/Host.sol

@@ -28,11 +28,13 @@ interface IHostIntroduction {
 /// Calls a deployed commander during construction without adding an inbound
 /// introduction endpoint to the inheriting host.
 abstract contract HostIntroduction is Runtime {
-    /// @param cmdr Commander address to introduce this host to when it is a deployed contract.
+    /// @param cmdr Local host ID to introduce this host to, or zero for no introduction.
     /// @dev Deployment reverts if a contract commander does not accept `introduce(uint,uint)`.
-    constructor(address cmdr) {
-        if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
-        introduceTo(Nodes.toHost(cmdr));
+    constructor(uint cmdr) {
+        if (cmdr == 0 || cmdr == host) return;
+        address target = Nodes.hostAddr(cmdr);
+        if (target.code.length == 0) return;
+        IHostIntroduction(target).introduce(host, block.number);
     }
 
     /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
@@ -53,9 +55,9 @@ abstract contract CommandHost is CommanderAccess, CallerAccess, HostIntroduction
     /// @dev Thrown when a commander-only host is deployed without an external commander.
     error InvalidCommander();
 
-    /// @param cmdr Nonzero address allowed to invoke hosted commands.
-    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {
-        if (cmdr == address(0)) revert InvalidCommander();
+    /// @param cmdr Nonzero local host ID allowed to invoke hosted commands.
+    constructor(uint cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {
+        if (cmdr == 0) revert InvalidCommander();
     }
 
     function enforceCaller(address caller) internal view virtual override returns (address) {
@@ -82,10 +84,10 @@ abstract contract Guardians is Appoint, Dismiss, Revoke {
 /// optionally introduces itself to a commander host at deployment.
 /// Accepts native ETH payments via the `receive` function.
 abstract contract Host is Admins, Guardians, HostIntroduction, IntroductionEvent, IHostIntroduction {
-    /// @param cmdr Commander address; used by the composed access capabilities.
-    ///        If `cmdr` is a deployed contract, the host calls `introduce`
-    ///        on it during construction.
-    constructor(address cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {}
+    /// @param cmdr Commander host ID; used by the composed access capabilities.
+    ///        If the encoded native target is a deployed contract, the host
+    ///        calls `introduce` on it during construction.
+    constructor(uint cmdr) CommanderAccess(cmdr) HostIntroduction(cmdr) {}
 
     /// @notice Assert that `caller` may invoke commands on a peer-aware host.
     function enforceCaller(address caller) internal view virtual override returns (address) {