@rootzero/contracts 1.5.0 → 1.7.0

package/CHANGELOG.md

@@ -3,6 +3,55 @@
 Until the protocol reaches integration-stable status, minor versions may include
 breaking API changes. Breaking changes are called out explicitly.
 
+## 1.7.0
+
+### Breaking Changes
+
+- Renamed peer callable surfaces to ports:
+  - `contracts/peer` moved to `contracts/ports`.
+  - `PeerEvent` / `event Peer` became `PortEvent` / `event Port`.
+  - `PeerBase`, `IPeer*`, and `Peer*` endpoint contracts became `PortBase`,
+    `IPort*`, and `Port*`.
+  - Peer endpoint functions and labels now use `port*` names, such as
+    `portPipePayable`, `portDispatchPayable`, and `portSettle`.
+  - Node helpers and layout tags now use `Port` terminology:
+    `Nodes.toPort`, `Nodes.isPort`, `Nodes.port`, and
+    `Nodes.portSelector`.
+- Removed the generic `PortRecoverContextPayable`; recovery is now routed by
+  the command-level `recoverContextPayable` to concrete ports such as
+  `portPipePayable`.
+- Renamed the `#contextRecovery` handler field from `target` to `port`.
+- Changed port entrypoint calldata parameter naming to `data` to avoid
+  clashing with nested context `request` fields.
+
+### Added
+
+- Added `RecoverContextPayable` and `#contextRecovery` for command-level
+  recovery routing with a commitment key, resources, handler port, and context
+  witness.
+- Added `Dispatch(uint indexed host, uint chain, uint resources, bytes32 digest, bytes32 ref)`
+  as the discovery/event surface for dispatch tracking.
+- Added `ContextRecovery` schema/cursor support and context schema aliases for
+  reusable nested block schemas.
+- Added `Values.drain`, `Payable.openValue`, and `Payable.closeValue` to make
+  payable command budget lifecycles explicit.
+
+## 1.6.0
+
+### Added
+
+- Added `AdminBase` as the shared base for admin commands and exported it from
+  `Endpoints.sol`.
+- Added `Cursors.read1` and `Cursors.read2` for unchecked byte-sized calldata
+  reads.
+- Added `NativeAsset` as a reusable base for helpers that need the local native
+  asset ID without the full host runtime.
+- Added `Escrows` as a keyed ledger for amounts reserved outside normal
+  balances.
+- Added `Commitment(uint indexed host, bytes32 key, bytes32 digest, uint status)`
+  and the `Commitments` core mixin for digest commitments and witness/recovery
+  flows.
+
 ## 1.5.0
 
 ### Breaking Changes

package/Core.sol

@@ -1,12 +1,14 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-// Aggregator: re-exports the core host, runtime, access, node-call, and validation layer.
+// Aggregator: re-exports the core host, runtime, access, ledger, node-call, and validation layer.
 // Import this file to bring the full rootzero host base layer into scope.
 
 import { AccessControl } from "./core/Access.sol";
 import { Balances, InsufficientFunds } from "./core/Balances.sol";
-import { Runtime } from "./core/Runtime.sol";
+import { Commitments } from "./core/Commitments.sol";
+import { Escrows, InsufficientEscrow } from "./core/Escrows.sol";
+import { NativeAsset, Runtime } from "./core/Runtime.sol";
 import { Host, IHostIntroduction } from "./core/Host.sol";
 import { FailedCall, NodeCalls } from "./core/Calls.sol";
 import { Payable } from "./core/Payable.sol";

package/Endpoints.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-// Aggregator: re-exports command, admin, peer, guard, and query endpoint abstractions.
+// Aggregator: re-exports command, admin, port, guard, and query endpoint abstractions.
 // Import this file to inherit from the full rootzero callable host surface without managing individual paths.
 
 // Shared helpers
@@ -16,10 +16,12 @@ import { DebitAccount, DebitAccountHook } from "./commands/Debit.sol";
 import { Deposit, DepositHook, DepositPayable, DepositPayableHook } from "./commands/Deposit.sol";
 import { Payout, PayoutHook } from "./commands/Payout.sol";
 import { Provision, ProvisionHook, ProvisionPayable, ProvisionPayableHook } from "./commands/Provision.sol";
+import { RecoverContextPayable, RecoverContextPayableHook } from "./commands/Recover.sol";
 import { RelayPayable, DispatchPayableHook } from "./commands/Relay.sol";
 import { Withdraw, WithdrawHook } from "./commands/Withdraw.sol";
 
 // Admin commands
+import { AdminBase } from "./commands/admin/Base.sol";
 import { AllowAssets, AllowAssetsHook } from "./commands/admin/AllowAssets.sol";
 import { Allowance, AllowanceHook } from "./commands/admin/Allowance.sol";
 import { Appoint } from "./commands/admin/Appoint.sol";
@@ -32,18 +34,17 @@ import { Init, InitHook } from "./commands/admin/Init.sol";
 import { Label } from "./commands/admin/Label.sol";
 import { Unauthorize } from "./commands/admin/Unauthorize.sol";
 
-// Peer endpoints
-import { PeerBase, encodePeerCall } from "./peer/Base.sol";
-import { PeerAllowAssets, IPeerAllowAssets } from "./peer/AllowAssets.sol";
-import { PeerAllowance, IPeerAllowance } from "./peer/Allowance.sol";
-import { PeerRedeemBalance, RedeemBalanceHook, IPeerRedeemBalance } from "./peer/Redeem.sol";
-import { PeerCreditAccount, IPeerCreditAccount } from "./peer/Credit.sol";
-import { PeerDebitAccount, IPeerDebitAccount } from "./peer/Debit.sol";
-import { PeerDenyAssets, IPeerDenyAssets } from "./peer/DenyAssets.sol";
-import { PeerPipePayable, IPeerPipePayable } from "./peer/Pipe.sol";
-import { PeerRecover, RecoverHook, IPeerRecover } from "./peer/Recover.sol";
-import { PeerDispatchPayable, IPeerDispatchPayable } from "./peer/Dispatch.sol";
-import { PeerSettle, IPeerSettle } from "./peer/Settle.sol";
+// Port endpoints
+import { PortBase, encodePortCall } from "./ports/Base.sol";
+import { PortAllowAssets, IPortAllowAssets } from "./ports/AllowAssets.sol";
+import { PortAllowance, IPortAllowance } from "./ports/Allowance.sol";
+import { PortRedeemBalance, RedeemBalanceHook, IPortRedeemBalance } from "./ports/Redeem.sol";
+import { PortCreditAccount, IPortCreditAccount } from "./ports/Credit.sol";
+import { PortDebitAccount, IPortDebitAccount } from "./ports/Debit.sol";
+import { PortDenyAssets, IPortDenyAssets } from "./ports/DenyAssets.sol";
+import { PortPipePayable, IPortPipePayable } from "./ports/Pipe.sol";
+import { PortDispatchPayable, IPortDispatchPayable } from "./ports/Dispatch.sol";
+import { PortSettle, IPortSettle } from "./ports/Settle.sol";
 
 // Guard endpoints
 import { GuardBase, encodeGuardCall } from "./guards/Base.sol";

package/Events.sol

@@ -10,6 +10,8 @@ import { Actions } from "./utils/Actions.sol";
 import { BalanceEvent } from "./events/Balance.sol";
 import { CommanderEvent } from "./events/Commander.sol";
 import { CommandEvent } from "./events/Command.sol";
+import { CommitmentEvent } from "./events/Commitment.sol";
+import { DispatchEvent } from "./events/Dispatch.sol";
 import { PositionEvent } from "./events/Position.sol";
 import { ReceivedEvent } from "./events/Received.sol";
 import { EventEmitter } from "./events/Emitter.sol";
@@ -19,7 +21,7 @@ import { IntroductionEvent } from "./events/Introduction.sol";
 import { LabeledEvent } from "./events/Labeled.sol";
 import { LockedEvent } from "./events/Locked.sol";
 import { NodeEvent } from "./events/Node.sol";
-import { PeerEvent } from "./events/Peer.sol";
+import { PortEvent } from "./events/Port.sol";
 import { QueryEvent } from "./events/Query.sol";
 import { RootedEvent } from "./events/Rooted.sol";
 import { RouteEvent } from "./events/Route.sol";

package/README.md

@@ -271,8 +271,8 @@ blocks executed in order within one transaction:
 
 Each step names a target command, the resources it may spend, and its request.
 The state threads through: whatever one command returns becomes the input
-state of the next, and the final state must be empty — value cannot be left
-dangling at the end of a pipeline. This is the core of `Pipeline.pipe`:
+state of the next, and the final state must be empty. This is the core of
+`Pipeline.pipe`:
 
 ```solidity
 while (input.i < input.len) {
@@ -304,19 +304,19 @@ response: #accountAmount { bytes32 account, bytes32 asset, uint amount }
 Like commands, every query announces its request and response schemas at
 deployment, so tooling knows how to call it without artifacts.
 
-## Peers
+## Ports
 
-Peers are the host-to-host surfaces, callable only by trusted hosts. The two
+Ports are the host-to-host surfaces, callable only by trusted peer hosts. The two
 central ones are batches all the way down:
 
-- `peerSettle` consumes `#transaction { bytes32 from, bytes32 to, bytes32 asset,
+- `portSettle` consumes `#transaction { bytes32 from, bytes32 to, bytes32 asset,
   uint amount }` blocks, debiting `from` and crediting `to` per
   block — how two hosts record settlement between their ledgers.
-- `peerPipePayable` consumes `#pipe` blocks, each carrying an account, an
+- `portPipePayable` consumes `#context` blocks, each carrying an account, an
   initial state, and a run of steps — a complete pipeline delivered by another
-  host, executed locally with its own resource budget.
+  host, executed locally against the peer call's shared value budget.
 
-This is also the cross-chain mechanism. `relayPayable` (or `peerDispatchPayable`)
+This is also the cross-chain mechanism. `relayPayable` (or `portDispatchPayable`)
 wraps a pipe and addresses it to a chain; a bridge adapter moves the **raw
 bytes**; the destination host parses them with the same cursor rules and runs
 the same pipeline loop. Nothing in the payload is EVM-specific — step targets
@@ -363,7 +363,7 @@ Repo layout:
 
 - `contracts/core` — host, access control, balances, pipeline, validation
 - `contracts/commands` — standard commands and admin commands
-- `contracts/peer` — peer surfaces for inter-host and cross-chain flows
+- `contracts/ports` — peer surfaces for inter-host and cross-chain flows
 - `contracts/guards` — guardian direct actions
 - `contracts/queries` — read-only query endpoints
 - `contracts/blocks` — block schema, cursor parsing, writers

package/blocks/Cursors.sol

@@ -548,28 +548,13 @@ library Cursors {
         return createBlock(Keys.Context, bytes.concat(account, toBytesBlock(state), toBytesBlock(request)));
     }
 
-    /// @notice Encode a PIPE block.
-    /// @param resources Chain resources assigned to the pipe.
-    /// @param account Command account identifier.
-    /// @param state Embedded state block stream.
-    /// @param steps Embedded step block stream.
-    /// @return Encoded PIPE block bytes.
-    function toPipeBlock(
-        uint resources,
-        bytes32 account,
-        bytes memory state,
-        bytes memory steps
-    ) internal pure returns (bytes memory) {
-        return createBlock(Keys.Pipe, bytes.concat(bytes32(resources), toContextBlock(account, state, steps)));
-    }
-
     /// @notice Encode a RELAY block.
     /// @param chain Destination chain node ID.
-    /// @param resources Chain-adapter-specific resources for the destination pipe.
-    /// @param steps Nested step block stream.
+    /// @param resources Chain-adapter-specific resources for the destination context.
+    /// @param request Nested request block stream.
     /// @return Encoded RELAY block bytes.
-    function toRelayBlock(uint chain, uint resources, bytes memory steps) internal pure returns (bytes memory) {
-        return createBlock(Keys.Relay, bytes.concat(bytes32(chain), bytes32(resources), toBytesBlock(steps)));
+    function toRelayBlock(uint chain, uint resources, bytes memory request) internal pure returns (bytes memory) {
+        return createBlock(Keys.Relay, bytes.concat(bytes32(chain), bytes32(resources), toBytesBlock(request)));
     }
 
     /// @notice Encode a DISPATCH block.
@@ -599,6 +584,30 @@ library Cursors {
         cur.i += n;
     }
 
+    /// @notice Read the next byte from the cursor and advance by 1 byte.
+    /// @dev Performs no bounds, key, length, or cursor checks.
+    /// @param cur Cursor whose current position is advanced by 1 byte.
+    /// @return value Loaded bytes1 value.
+    function read1(Cur memory cur) internal pure returns (bytes1 value) {
+        uint abs = cur.offset + cur.i;
+        assembly ("memory-safe") {
+            value := calldataload(abs)
+        }
+        cur.i += 1;
+    }
+
+    /// @notice Read the next 2 bytes from the cursor and advance by 2 bytes.
+    /// @dev Performs no bounds, key, length, or cursor checks.
+    /// @param cur Cursor whose current position is advanced by 2 bytes.
+    /// @return value Loaded bytes2 value.
+    function read2(Cur memory cur) internal pure returns (bytes2 value) {
+        uint abs = cur.offset + cur.i;
+        assembly ("memory-safe") {
+            value := calldataload(abs)
+        }
+        cur.i += 2;
+    }
+
     /// @notice Read the next 4 bytes from the cursor and advance by 4 bytes.
     /// @dev Performs no bounds, key, length, or cursor checks.
     /// @param cur Cursor whose current position is advanced by 4 bytes.
@@ -1131,33 +1140,18 @@ library Cursors {
         cur.exit(end);
     }
 
-    /// @notice Consume a PIPE block and return its resources and context fields.
-    /// @param cur Cursor; advanced past the block.
-    /// @return resources Chain resources assigned to the pipe.
-    /// @return account Command account identifier.
-    /// @return state Embedded state block stream.
-    /// @return steps Embedded step block stream.
-    function unpackPipe(
-        Cur memory cur
-    ) internal pure returns (uint resources, bytes32 account, bytes calldata state, bytes calldata steps) {
-        uint end = cur.enter(Keys.Pipe, 32 + Sizes.Header + 32 + 2 * Sizes.Header, 0);
-        resources = uint(cur.read32());
-        (account, state, steps) = cur.unpackContext();
-        cur.exit(end);
-    }
-
-    /// @notice Consume a RELAY block and return its destination chain, resources, and step stream.
+    /// @notice Consume a RELAY block and return its destination chain, resources, and request stream.
     /// @param cur Cursor; advanced past the block.
     /// @return chain Destination chain node ID.
-    /// @return resources Chain-adapter-specific resources for the destination pipe.
-    /// @return steps Embedded step block stream.
+    /// @return resources Chain-adapter-specific resources for the destination context.
+    /// @return request Embedded request block stream.
     function unpackRelay(
         Cur memory cur
-    ) internal pure returns (uint chain, uint resources, bytes calldata steps) {
+    ) internal pure returns (uint chain, uint resources, bytes calldata request) {
         uint end = cur.enter(Keys.Relay, 64 + Sizes.Header, 0);
         chain = cur.readUint();
         resources = cur.readUint();
-        steps = cur.unpackBytes();
+        request = cur.unpackBytes();
         cur.exit(end);
     }
 
@@ -1176,6 +1170,23 @@ library Cursors {
         cur.exit(end);
     }
 
+    /// @notice Consume a CONTEXT_RECOVERY block and return its port, key, resources, and embedded context cursor.
+    /// @param cur Cursor; advanced past the block.
+    /// @return port Recovery handler port node ID.
+    /// @return key Commitment or recovery lookup key.
+    /// @return resources Chain resources assigned to the recovery attempt.
+    /// @return context Cursor scoped to the embedded CONTEXT witness block.
+    function unpackContextRecovery(
+        Cur memory cur
+    ) internal pure returns (uint port, bytes32 key, uint resources, Cur memory context) {
+        uint end = cur.enter(Keys.ContextRecovery, 96 + Sizes.Header, 0);
+        port = cur.readUint();
+        key = cur.read32();
+        resources = cur.readUint();
+        context = cur.take(Keys.Context);
+        cur.exit(end);
+    }
+
     // Type-specific validators
 
     /// @notice Validate an AUTH block at position `i` and extract deadline and proof.
@@ -1364,21 +1375,21 @@ library Cursors {
     // Transform helpers
     // -------------------------------------------------------------------------
 
-    /// @notice Consume a RELAY block and encode its destination pipe payload.
+    /// @notice Consume a RELAY block and encode its destination context payload.
     /// @param cur Cursor; advanced past the RELAY block.
-    /// @param account Account identifier to embed in the destination pipe context.
-    /// @param state State block stream to embed in the destination pipe context.
+    /// @param account Account identifier to embed in the destination context.
+    /// @param state State block stream to embed in the destination context.
     /// @return chain Destination chain node ID.
-    /// @return resources Chain resources assigned to the destination pipe.
-    /// @return pipe Encoded PIPE block containing `account`, `state`, and relay steps.
-    function relayToPipe(
+    /// @return resources Chain resources assigned to the destination context.
+    /// @return context Encoded CONTEXT block containing `account`, `state`, and relay request.
+    function relayToContext(
         Cur memory cur,
         bytes32 account,
         bytes calldata state
-    ) internal pure returns (uint chain, uint resources, bytes memory pipe) {
-        bytes calldata steps;
-        (chain, resources, steps) = cur.unpackRelay();
-        pipe = toPipeBlock(resources, account, bytes(state), bytes(steps));
+    ) internal pure returns (uint chain, uint resources, bytes memory context) {
+        bytes calldata request;
+        (chain, resources, request) = cur.unpackRelay();
+        context = toContextBlock(account, bytes(state), bytes(request));
     }
 
     // -------------------------------------------------------------------------

package/blocks/Keys.sol

@@ -41,16 +41,16 @@ library Keys {
     bytes4 constant Transaction = bytes4(keccak256("#transaction"));
     /// @dev Sub-command invocation - (uint target, uint resources, #bytes as request)
     bytes4 constant Step = bytes4(keccak256("#step"));
-    /// @dev Cross-chain pipe relay - (uint chain, uint resources, #bytes as steps)
+    /// @dev Cross-chain relay request - (uint chain, uint resources, #bytes as request)
     bytes4 constant Relay = bytes4(keccak256("#relay"));
+    /// @dev Command context transport - (bytes32 account, #bytes as state, #bytes as request)
+    bytes4 constant Context = bytes4(keccak256("#context"));
+    /// @dev Recoverable context witness - (uint port, bytes32 key, uint resources, #context)
+    bytes4 constant ContextRecovery = bytes4(keccak256("#contextRecovery"));
     /// @dev Cross-chain encoded payload dispatch - (uint chain, uint resources, #bytes as payload)
     bytes4 constant Dispatch = bytes4(keccak256("#dispatch"));
     /// @dev Raw external call - (uint target, uint resources, #bytes as payload)
     bytes4 constant Call = bytes4(keccak256("#call"));
-    /// @dev Command context transport - (bytes32 account, #bytes as state, #bytes as request)
-    bytes4 constant Context = bytes4(keccak256("#context"));
-    /// @dev Pipeline invocation - (uint resources, #context)
-    bytes4 constant Pipe = bytes4(keccak256("#pipe"));
     /// @dev Authentication proof - (uint cid, uint deadline, #bytes as proof); must appear last in its segment
     bytes4 constant Auth = bytes4(keccak256("#auth"));
     /// @dev Asset descriptor without amount - (bytes32 asset)

package/blocks/Schema.sol

@@ -21,6 +21,8 @@ pragma solidity ^0.8.33;
 //   stable format everywhere. EVM resources use the low 128 bits as native value.
 // - dotted field names and aliases, e.g. `dst.chain` or `#bytes as dst.payload`,
 //   are offchain projection metadata only and do not change runtime encoding
+// - a child block without an inline body, e.g. `#context as witness`, may resolve
+//   to a known schema in the active schema context; unresolved aliases are invalid
 // - fixed fields are packed in declaration order
 // - blocks have fixed fields followed by a dynamic child-block tail
 // - child block tails are embedded directly, without an extra stream wrapper
@@ -69,10 +71,10 @@ library Schemas {
     string constant Allowance = "#allowance { uint host, bytes32 asset, uint amount }";
     string constant Transaction = "#transaction { bytes32 from, bytes32 to, bytes32 asset, uint amount }";
     string constant Context = "#context { bytes32 account, #bytes as state, #bytes as request }";
-    string constant Pipe = "#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }";
+    string constant ContextRecovery = "#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }";
     string constant Call = "#call { uint target, uint resources, #bytes as payload }";
     string constant Step = "#step { uint target, uint resources, #bytes as request }";
-    string constant Relay = "#relay { uint chain, uint resources, #bytes as steps }";
+    string constant Relay = "#relay { uint chain, uint resources, #bytes as request }";
     string constant Dispatch = "#dispatch { uint chain, uint resources, #bytes as payload }";
     string constant Bounty = "#bounty { uint amount, bytes32 relayer }";
     string constant Fee = "#fee { uint amount }";

package/blocks/Writers.sol

@@ -28,7 +28,6 @@ library Hints {
     uint constant Step = 256;
     uint constant Call = 256;
     uint constant Context = 512;
-    uint constant Pipe = 608;
 }
 
 /// @title Writers
@@ -233,14 +232,6 @@ library Writers {
         return allocFromHint(count, Hints.Context);
     }
 
-    /// @notice Allocate a writer for `count` PIPE blocks using a per-block capacity hint.
-    /// @dev The backing buffer expands automatically if encoded pipes exceed the initial hint.
-    /// @param count Number of pipe blocks to allocate space for.
-    /// @return writer Allocated growable writer.
-    function allocPipes(uint count) internal pure returns (Writer memory writer) {
-        return allocFromHint(count, Hints.Pipe);
-    }
-
     // -------------------------------------------------------------------------
     // Fixed-width write helpers
     // -------------------------------------------------------------------------
@@ -905,32 +896,6 @@ library Writers {
         appendBlock32BytesBytes(writer, Keys.Context, account, state, request);
     }
 
-    /// @notice Append a PIPE block with a nested CONTEXT block.
-    /// @param writer Destination writer; `i` is advanced by the encoded PIPE block length.
-    /// @param resources Chain resources assigned to the pipe.
-    /// @param account Command account identifier.
-    /// @param state Raw nested state payload.
-    /// @param steps Raw nested step payload.
-    function appendPipe(
-        Writer memory writer,
-        uint resources,
-        bytes32 account,
-        bytes memory state,
-        bytes memory steps
-    ) internal pure {
-        uint i = writer.i;
-        uint len = 64 + 3 * Sizes.Header + state.length + steps.length;
-        uint next = i + Sizes.Header + len;
-        i = reserve(writer, next, next);
-
-        uint p = writeHeader(writer.dst, i, Keys.Pipe, uint32(max32(len)));
-        assembly ("memory-safe") {
-            mstore(add(p, 0x08), resources)
-        }
-
-        writeBlock32BytesBytes(writer.dst, i + Sizes.Header + 32, Keys.Context, account, state, steps);
-    }
-
     /// @notice Append a STATUS form block.
     /// @param writer Destination writer; `i` is advanced by `Sizes.Status`.
     /// @param code Status code to encode.

package/commands/Deposit.sol

@@ -81,7 +81,7 @@ abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
     ) external payable onlyCommand returns (bytes memory) {
         (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
         Writer memory writer = Writers.allocBalances(groups);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             (bytes32 asset, uint amount) = request.unpackAmount();
@@ -89,7 +89,7 @@ abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
             writer.appendBalance(asset, amount);
         }
 
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return writer.finish();
     }

package/commands/Provision.sol

@@ -78,7 +78,7 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
     ) external payable onlyCommand returns (bytes memory) {
         (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
         Writer memory writer = Writers.allocCustodies(groups);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             HostAmount memory allocation = request.unpackAllocationValue();
@@ -86,7 +86,7 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
             writer.appendCustody(allocation);
         }
 
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return writer.finish();
     }

package/commands/Recover.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommandBase, CommandContext, Keys} from "./Base.sol";
+import {Payable} from "../core/Payable.sol";
+import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Budget} from "../utils/Value.sol";
+
+using Cursors for Cur;
+
+abstract contract RecoverContextPayableHook {
+    /// @notice Override to recover one committed context witness.
+    /// @param port Recovery handler port node ID.
+    /// @param key Commitment or recovery lookup key.
+    /// @param resources Chain resources assigned to the recovery attempt.
+    /// @param context Cursor scoped to the embedded CONTEXT witness block.
+    /// @param budget Mutable native-value budget available to the recovery attempt.
+    function recoverContext(uint port, bytes32 key, uint resources, Cur memory context, Budget memory budget) internal virtual;
+}
+
+/// @title RecoverContextPayable
+/// @notice Command that forwards ContextRecovery request blocks to a virtual hook.
+/// Produces no output state.
+abstract contract RecoverContextPayable is CommandBase, Payable, RecoverContextPayableHook {
+    uint internal immutable recoverContextPayableId = commandId(this.recoverContextPayable.selector);
+
+    constructor() {
+        emit Command(host, recoverContextPayableId, "1:0:0", Schemas.ContextRecovery, Keys.Empty, Keys.Empty, true);
+        emit Labeled(recoverContextPayableId, bytes32(0), "recoverContextPayable");
+    }
+
+    /// @notice Recover each ContextRecovery block in the command request.
+    /// @param c Command context; `c.request` must contain ContextRecovery blocks.
+    /// @return Empty output state.
+    function recoverContextPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory) {
+        (Cur memory request, , ) = Cursors.init(c.request, 1);
+        Budget memory budget = openValue();
+
+        while (request.i < request.len) {
+            (uint port, bytes32 key, uint resources, Cur memory context) = request.unpackContextRecovery();
+            recoverContext(port, key, resources, context, budget);
+        }
+
+        closeValue(c.account, budget);
+        request.complete();
+        return "";
+    }
+}

package/commands/Relay.sol

@@ -37,12 +37,12 @@ abstract contract RelayPayable is CommandBase, Payable, DispatchPayableHook {
     /// @return output Empty output state.
     function relayPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory output) {
         (Cur memory request, ) = Cursors.init(c.request, 1, 1);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
-        (uint chain, uint resources, bytes memory pipe) = request.relayToPipe(c.account, c.state);
-        dispatch(chain, resources, pipe, budget);
+        (uint chain, uint resources, bytes memory context) = request.relayToContext(c.account, c.state);
+        dispatch(chain, resources, context, budget);
         
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return "";
     }

package/commands/admin/AllowAssets.sol

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 abstract contract AllowAssetsHook {
@@ -16,7 +15,7 @@ abstract contract AllowAssetsHook {
 /// @title AllowAssets
 /// @notice Admin command that permits a list of assets via a virtual hook.
 /// Each ASSET block in the request calls `allowAsset`. Only callable by the admin account.
-abstract contract AllowAssets is CommandBase, AdminEvent, AllowAssetsHook {
+abstract contract AllowAssets is AdminBase, AllowAssetsHook {
     uint internal immutable allowAssetsId = commandId(this.allowAssets.selector);
 
     constructor() {

package/commands/admin/Allowance.sol

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {AdminBase, CommandContext, Keys} from "./Base.sol";
 import {Cursors, Cur, Schemas} from "../../Cursors.sol";
-import {AdminEvent} from "../../events/Admin.sol";
 using Cursors for Cur;
 
 abstract contract AllowanceHook {
@@ -20,7 +19,7 @@ abstract contract AllowanceHook {
 /// @title Allowance
 /// @notice Admin command that applies cross-host allowance entries via a virtual hook.
 /// Each ALLOWANCE block grants or updates a host-scoped asset cap. Only callable by the admin account.
-abstract contract Allowance is CommandBase, AdminEvent, AllowanceHook {
+abstract contract Allowance is AdminBase, AllowanceHook {
     uint internal immutable allowanceId = commandId(this.allowance.selector);
 
     constructor() {

package/commands/admin/Appoint.sol

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 /// @title Appoint
 /// @notice Admin command that grants guardian status to a list of account IDs.
 /// Each ACCOUNT block in the request is enabled as a guardian on the host.
 /// Only callable by the admin account.
-abstract contract Appoint is CommandBase, AdminEvent {
+abstract contract Appoint is AdminBase {
     uint internal immutable appointId = commandId(this.appoint.selector);
 
     constructor() {

package/commands/admin/Authorize.sol

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 /// @title Authorize
 /// @notice Admin command that grants authorization to a list of node IDs.
 /// Each NODE block in the request is authorized on the host.
 /// Only callable by the admin account.
-abstract contract Authorize is CommandBase, AdminEvent {
+abstract contract Authorize is AdminBase {
     uint internal immutable authorizeId = commandId(this.authorize.selector);
 
     constructor() {