@rootzero/contracts 1.6.0 → 1.7.0

package/CHANGELOG.md

@@ -3,6 +3,39 @@
 Until the protocol reaches integration-stable status, minor versions may include
 breaking API changes. Breaking changes are called out explicitly.
 
+## 1.7.0
+
+### Breaking Changes
+
+- Renamed peer callable surfaces to ports:
+  - `contracts/peer` moved to `contracts/ports`.
+  - `PeerEvent` / `event Peer` became `PortEvent` / `event Port`.
+  - `PeerBase`, `IPeer*`, and `Peer*` endpoint contracts became `PortBase`,
+    `IPort*`, and `Port*`.
+  - Peer endpoint functions and labels now use `port*` names, such as
+    `portPipePayable`, `portDispatchPayable`, and `portSettle`.
+  - Node helpers and layout tags now use `Port` terminology:
+    `Nodes.toPort`, `Nodes.isPort`, `Nodes.port`, and
+    `Nodes.portSelector`.
+- Removed the generic `PortRecoverContextPayable`; recovery is now routed by
+  the command-level `recoverContextPayable` to concrete ports such as
+  `portPipePayable`.
+- Renamed the `#contextRecovery` handler field from `target` to `port`.
+- Changed port entrypoint calldata parameter naming to `data` to avoid
+  clashing with nested context `request` fields.
+
+### Added
+
+- Added `RecoverContextPayable` and `#contextRecovery` for command-level
+  recovery routing with a commitment key, resources, handler port, and context
+  witness.
+- Added `Dispatch(uint indexed host, uint chain, uint resources, bytes32 digest, bytes32 ref)`
+  as the discovery/event surface for dispatch tracking.
+- Added `ContextRecovery` schema/cursor support and context schema aliases for
+  reusable nested block schemas.
+- Added `Values.drain`, `Payable.openValue`, and `Payable.closeValue` to make
+  payable command budget lifecycles explicit.
+
 ## 1.6.0
 
 ### Added
@@ -15,7 +48,7 @@ breaking API changes. Breaking changes are called out explicitly.
   asset ID without the full host runtime.
 - Added `Escrows` as a keyed ledger for amounts reserved outside normal
   balances.
-- Added `Commitment(bytes32 indexed account, bytes32 key, bytes32 digest, uint status)`
+- Added `Commitment(uint indexed host, bytes32 key, bytes32 digest, uint status)`
   and the `Commitments` core mixin for digest commitments and witness/recovery
   flows.
 

package/Endpoints.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-// Aggregator: re-exports command, admin, peer, guard, and query endpoint abstractions.
+// Aggregator: re-exports command, admin, port, guard, and query endpoint abstractions.
 // Import this file to inherit from the full rootzero callable host surface without managing individual paths.
 
 // Shared helpers
@@ -16,6 +16,7 @@ import { DebitAccount, DebitAccountHook } from "./commands/Debit.sol";
 import { Deposit, DepositHook, DepositPayable, DepositPayableHook } from "./commands/Deposit.sol";
 import { Payout, PayoutHook } from "./commands/Payout.sol";
 import { Provision, ProvisionHook, ProvisionPayable, ProvisionPayableHook } from "./commands/Provision.sol";
+import { RecoverContextPayable, RecoverContextPayableHook } from "./commands/Recover.sol";
 import { RelayPayable, DispatchPayableHook } from "./commands/Relay.sol";
 import { Withdraw, WithdrawHook } from "./commands/Withdraw.sol";
 
@@ -33,18 +34,17 @@ import { Init, InitHook } from "./commands/admin/Init.sol";
 import { Label } from "./commands/admin/Label.sol";
 import { Unauthorize } from "./commands/admin/Unauthorize.sol";
 
-// Peer endpoints
-import { PeerBase, encodePeerCall } from "./peer/Base.sol";
-import { PeerAllowAssets, IPeerAllowAssets } from "./peer/AllowAssets.sol";
-import { PeerAllowance, IPeerAllowance } from "./peer/Allowance.sol";
-import { PeerRedeemBalance, RedeemBalanceHook, IPeerRedeemBalance } from "./peer/Redeem.sol";
-import { PeerCreditAccount, IPeerCreditAccount } from "./peer/Credit.sol";
-import { PeerDebitAccount, IPeerDebitAccount } from "./peer/Debit.sol";
-import { PeerDenyAssets, IPeerDenyAssets } from "./peer/DenyAssets.sol";
-import { PeerPipePayable, IPeerPipePayable } from "./peer/Pipe.sol";
-import { PeerRecover, RecoverHook, IPeerRecover } from "./peer/Recover.sol";
-import { PeerDispatchPayable, IPeerDispatchPayable } from "./peer/Dispatch.sol";
-import { PeerSettle, IPeerSettle } from "./peer/Settle.sol";
+// Port endpoints
+import { PortBase, encodePortCall } from "./ports/Base.sol";
+import { PortAllowAssets, IPortAllowAssets } from "./ports/AllowAssets.sol";
+import { PortAllowance, IPortAllowance } from "./ports/Allowance.sol";
+import { PortRedeemBalance, RedeemBalanceHook, IPortRedeemBalance } from "./ports/Redeem.sol";
+import { PortCreditAccount, IPortCreditAccount } from "./ports/Credit.sol";
+import { PortDebitAccount, IPortDebitAccount } from "./ports/Debit.sol";
+import { PortDenyAssets, IPortDenyAssets } from "./ports/DenyAssets.sol";
+import { PortPipePayable, IPortPipePayable } from "./ports/Pipe.sol";
+import { PortDispatchPayable, IPortDispatchPayable } from "./ports/Dispatch.sol";
+import { PortSettle, IPortSettle } from "./ports/Settle.sol";
 
 // Guard endpoints
 import { GuardBase, encodeGuardCall } from "./guards/Base.sol";

package/Events.sol

@@ -11,6 +11,7 @@ import { BalanceEvent } from "./events/Balance.sol";
 import { CommanderEvent } from "./events/Commander.sol";
 import { CommandEvent } from "./events/Command.sol";
 import { CommitmentEvent } from "./events/Commitment.sol";
+import { DispatchEvent } from "./events/Dispatch.sol";
 import { PositionEvent } from "./events/Position.sol";
 import { ReceivedEvent } from "./events/Received.sol";
 import { EventEmitter } from "./events/Emitter.sol";
@@ -20,7 +21,7 @@ import { IntroductionEvent } from "./events/Introduction.sol";
 import { LabeledEvent } from "./events/Labeled.sol";
 import { LockedEvent } from "./events/Locked.sol";
 import { NodeEvent } from "./events/Node.sol";
-import { PeerEvent } from "./events/Peer.sol";
+import { PortEvent } from "./events/Port.sol";
 import { QueryEvent } from "./events/Query.sol";
 import { RootedEvent } from "./events/Rooted.sol";
 import { RouteEvent } from "./events/Route.sol";

package/README.md

@@ -271,8 +271,8 @@ blocks executed in order within one transaction:
 
 Each step names a target command, the resources it may spend, and its request.
 The state threads through: whatever one command returns becomes the input
-state of the next, and the final state must be empty — value cannot be left
-dangling at the end of a pipeline. This is the core of `Pipeline.pipe`:
+state of the next, and the final state must be empty. This is the core of
+`Pipeline.pipe`:
 
 ```solidity
 while (input.i < input.len) {
@@ -304,19 +304,19 @@ response: #accountAmount { bytes32 account, bytes32 asset, uint amount }
 Like commands, every query announces its request and response schemas at
 deployment, so tooling knows how to call it without artifacts.
 
-## Peers
+## Ports
 
-Peers are the host-to-host surfaces, callable only by trusted hosts. The two
+Ports are the host-to-host surfaces, callable only by trusted peer hosts. The two
 central ones are batches all the way down:
 
-- `peerSettle` consumes `#transaction { bytes32 from, bytes32 to, bytes32 asset,
+- `portSettle` consumes `#transaction { bytes32 from, bytes32 to, bytes32 asset,
   uint amount }` blocks, debiting `from` and crediting `to` per
   block — how two hosts record settlement between their ledgers.
-- `peerPipePayable` consumes `#pipe` blocks, each carrying an account, an
+- `portPipePayable` consumes `#context` blocks, each carrying an account, an
   initial state, and a run of steps — a complete pipeline delivered by another
-  host, executed locally with its own resource budget.
+  host, executed locally against the peer call's shared value budget.
 
-This is also the cross-chain mechanism. `relayPayable` (or `peerDispatchPayable`)
+This is also the cross-chain mechanism. `relayPayable` (or `portDispatchPayable`)
 wraps a pipe and addresses it to a chain; a bridge adapter moves the **raw
 bytes**; the destination host parses them with the same cursor rules and runs
 the same pipeline loop. Nothing in the payload is EVM-specific — step targets
@@ -363,7 +363,7 @@ Repo layout:
 
 - `contracts/core` — host, access control, balances, pipeline, validation
 - `contracts/commands` — standard commands and admin commands
-- `contracts/peer` — peer surfaces for inter-host and cross-chain flows
+- `contracts/ports` — peer surfaces for inter-host and cross-chain flows
 - `contracts/guards` — guardian direct actions
 - `contracts/queries` — read-only query endpoints
 - `contracts/blocks` — block schema, cursor parsing, writers

package/blocks/Cursors.sol

@@ -548,28 +548,13 @@ library Cursors {
         return createBlock(Keys.Context, bytes.concat(account, toBytesBlock(state), toBytesBlock(request)));
     }
 
-    /// @notice Encode a PIPE block.
-    /// @param resources Chain resources assigned to the pipe.
-    /// @param account Command account identifier.
-    /// @param state Embedded state block stream.
-    /// @param steps Embedded step block stream.
-    /// @return Encoded PIPE block bytes.
-    function toPipeBlock(
-        uint resources,
-        bytes32 account,
-        bytes memory state,
-        bytes memory steps
-    ) internal pure returns (bytes memory) {
-        return createBlock(Keys.Pipe, bytes.concat(bytes32(resources), toContextBlock(account, state, steps)));
-    }
-
     /// @notice Encode a RELAY block.
     /// @param chain Destination chain node ID.
-    /// @param resources Chain-adapter-specific resources for the destination pipe.
-    /// @param steps Nested step block stream.
+    /// @param resources Chain-adapter-specific resources for the destination context.
+    /// @param request Nested request block stream.
     /// @return Encoded RELAY block bytes.
-    function toRelayBlock(uint chain, uint resources, bytes memory steps) internal pure returns (bytes memory) {
-        return createBlock(Keys.Relay, bytes.concat(bytes32(chain), bytes32(resources), toBytesBlock(steps)));
+    function toRelayBlock(uint chain, uint resources, bytes memory request) internal pure returns (bytes memory) {
+        return createBlock(Keys.Relay, bytes.concat(bytes32(chain), bytes32(resources), toBytesBlock(request)));
     }
 
     /// @notice Encode a DISPATCH block.
@@ -1155,33 +1140,18 @@ library Cursors {
         cur.exit(end);
     }
 
-    /// @notice Consume a PIPE block and return its resources and context fields.
-    /// @param cur Cursor; advanced past the block.
-    /// @return resources Chain resources assigned to the pipe.
-    /// @return account Command account identifier.
-    /// @return state Embedded state block stream.
-    /// @return steps Embedded step block stream.
-    function unpackPipe(
-        Cur memory cur
-    ) internal pure returns (uint resources, bytes32 account, bytes calldata state, bytes calldata steps) {
-        uint end = cur.enter(Keys.Pipe, 32 + Sizes.Header + 32 + 2 * Sizes.Header, 0);
-        resources = uint(cur.read32());
-        (account, state, steps) = cur.unpackContext();
-        cur.exit(end);
-    }
-
-    /// @notice Consume a RELAY block and return its destination chain, resources, and step stream.
+    /// @notice Consume a RELAY block and return its destination chain, resources, and request stream.
     /// @param cur Cursor; advanced past the block.
     /// @return chain Destination chain node ID.
-    /// @return resources Chain-adapter-specific resources for the destination pipe.
-    /// @return steps Embedded step block stream.
+    /// @return resources Chain-adapter-specific resources for the destination context.
+    /// @return request Embedded request block stream.
     function unpackRelay(
         Cur memory cur
-    ) internal pure returns (uint chain, uint resources, bytes calldata steps) {
+    ) internal pure returns (uint chain, uint resources, bytes calldata request) {
         uint end = cur.enter(Keys.Relay, 64 + Sizes.Header, 0);
         chain = cur.readUint();
         resources = cur.readUint();
-        steps = cur.unpackBytes();
+        request = cur.unpackBytes();
         cur.exit(end);
     }
 
@@ -1200,6 +1170,23 @@ library Cursors {
         cur.exit(end);
     }
 
+    /// @notice Consume a CONTEXT_RECOVERY block and return its port, key, resources, and embedded context cursor.
+    /// @param cur Cursor; advanced past the block.
+    /// @return port Recovery handler port node ID.
+    /// @return key Commitment or recovery lookup key.
+    /// @return resources Chain resources assigned to the recovery attempt.
+    /// @return context Cursor scoped to the embedded CONTEXT witness block.
+    function unpackContextRecovery(
+        Cur memory cur
+    ) internal pure returns (uint port, bytes32 key, uint resources, Cur memory context) {
+        uint end = cur.enter(Keys.ContextRecovery, 96 + Sizes.Header, 0);
+        port = cur.readUint();
+        key = cur.read32();
+        resources = cur.readUint();
+        context = cur.take(Keys.Context);
+        cur.exit(end);
+    }
+
     // Type-specific validators
 
     /// @notice Validate an AUTH block at position `i` and extract deadline and proof.
@@ -1388,21 +1375,21 @@ library Cursors {
     // Transform helpers
     // -------------------------------------------------------------------------
 
-    /// @notice Consume a RELAY block and encode its destination pipe payload.
+    /// @notice Consume a RELAY block and encode its destination context payload.
     /// @param cur Cursor; advanced past the RELAY block.
-    /// @param account Account identifier to embed in the destination pipe context.
-    /// @param state State block stream to embed in the destination pipe context.
+    /// @param account Account identifier to embed in the destination context.
+    /// @param state State block stream to embed in the destination context.
     /// @return chain Destination chain node ID.
-    /// @return resources Chain resources assigned to the destination pipe.
-    /// @return pipe Encoded PIPE block containing `account`, `state`, and relay steps.
-    function relayToPipe(
+    /// @return resources Chain resources assigned to the destination context.
+    /// @return context Encoded CONTEXT block containing `account`, `state`, and relay request.
+    function relayToContext(
         Cur memory cur,
         bytes32 account,
         bytes calldata state
-    ) internal pure returns (uint chain, uint resources, bytes memory pipe) {
-        bytes calldata steps;
-        (chain, resources, steps) = cur.unpackRelay();
-        pipe = toPipeBlock(resources, account, bytes(state), bytes(steps));
+    ) internal pure returns (uint chain, uint resources, bytes memory context) {
+        bytes calldata request;
+        (chain, resources, request) = cur.unpackRelay();
+        context = toContextBlock(account, bytes(state), bytes(request));
     }
 
     // -------------------------------------------------------------------------

package/blocks/Keys.sol

@@ -41,16 +41,16 @@ library Keys {
     bytes4 constant Transaction = bytes4(keccak256("#transaction"));
     /// @dev Sub-command invocation - (uint target, uint resources, #bytes as request)
     bytes4 constant Step = bytes4(keccak256("#step"));
-    /// @dev Cross-chain pipe relay - (uint chain, uint resources, #bytes as steps)
+    /// @dev Cross-chain relay request - (uint chain, uint resources, #bytes as request)
     bytes4 constant Relay = bytes4(keccak256("#relay"));
+    /// @dev Command context transport - (bytes32 account, #bytes as state, #bytes as request)
+    bytes4 constant Context = bytes4(keccak256("#context"));
+    /// @dev Recoverable context witness - (uint port, bytes32 key, uint resources, #context)
+    bytes4 constant ContextRecovery = bytes4(keccak256("#contextRecovery"));
     /// @dev Cross-chain encoded payload dispatch - (uint chain, uint resources, #bytes as payload)
     bytes4 constant Dispatch = bytes4(keccak256("#dispatch"));
     /// @dev Raw external call - (uint target, uint resources, #bytes as payload)
     bytes4 constant Call = bytes4(keccak256("#call"));
-    /// @dev Command context transport - (bytes32 account, #bytes as state, #bytes as request)
-    bytes4 constant Context = bytes4(keccak256("#context"));
-    /// @dev Pipeline invocation - (uint resources, #context)
-    bytes4 constant Pipe = bytes4(keccak256("#pipe"));
     /// @dev Authentication proof - (uint cid, uint deadline, #bytes as proof); must appear last in its segment
     bytes4 constant Auth = bytes4(keccak256("#auth"));
     /// @dev Asset descriptor without amount - (bytes32 asset)

package/blocks/Schema.sol

@@ -21,6 +21,8 @@ pragma solidity ^0.8.33;
 //   stable format everywhere. EVM resources use the low 128 bits as native value.
 // - dotted field names and aliases, e.g. `dst.chain` or `#bytes as dst.payload`,
 //   are offchain projection metadata only and do not change runtime encoding
+// - a child block without an inline body, e.g. `#context as witness`, may resolve
+//   to a known schema in the active schema context; unresolved aliases are invalid
 // - fixed fields are packed in declaration order
 // - blocks have fixed fields followed by a dynamic child-block tail
 // - child block tails are embedded directly, without an extra stream wrapper
@@ -69,10 +71,10 @@ library Schemas {
     string constant Allowance = "#allowance { uint host, bytes32 asset, uint amount }";
     string constant Transaction = "#transaction { bytes32 from, bytes32 to, bytes32 asset, uint amount }";
     string constant Context = "#context { bytes32 account, #bytes as state, #bytes as request }";
-    string constant Pipe = "#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }";
+    string constant ContextRecovery = "#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }";
     string constant Call = "#call { uint target, uint resources, #bytes as payload }";
     string constant Step = "#step { uint target, uint resources, #bytes as request }";
-    string constant Relay = "#relay { uint chain, uint resources, #bytes as steps }";
+    string constant Relay = "#relay { uint chain, uint resources, #bytes as request }";
     string constant Dispatch = "#dispatch { uint chain, uint resources, #bytes as payload }";
     string constant Bounty = "#bounty { uint amount, bytes32 relayer }";
     string constant Fee = "#fee { uint amount }";

package/blocks/Writers.sol

@@ -28,7 +28,6 @@ library Hints {
     uint constant Step = 256;
     uint constant Call = 256;
     uint constant Context = 512;
-    uint constant Pipe = 608;
 }
 
 /// @title Writers
@@ -233,14 +232,6 @@ library Writers {
         return allocFromHint(count, Hints.Context);
     }
 
-    /// @notice Allocate a writer for `count` PIPE blocks using a per-block capacity hint.
-    /// @dev The backing buffer expands automatically if encoded pipes exceed the initial hint.
-    /// @param count Number of pipe blocks to allocate space for.
-    /// @return writer Allocated growable writer.
-    function allocPipes(uint count) internal pure returns (Writer memory writer) {
-        return allocFromHint(count, Hints.Pipe);
-    }
-
     // -------------------------------------------------------------------------
     // Fixed-width write helpers
     // -------------------------------------------------------------------------
@@ -905,32 +896,6 @@ library Writers {
         appendBlock32BytesBytes(writer, Keys.Context, account, state, request);
     }
 
-    /// @notice Append a PIPE block with a nested CONTEXT block.
-    /// @param writer Destination writer; `i` is advanced by the encoded PIPE block length.
-    /// @param resources Chain resources assigned to the pipe.
-    /// @param account Command account identifier.
-    /// @param state Raw nested state payload.
-    /// @param steps Raw nested step payload.
-    function appendPipe(
-        Writer memory writer,
-        uint resources,
-        bytes32 account,
-        bytes memory state,
-        bytes memory steps
-    ) internal pure {
-        uint i = writer.i;
-        uint len = 64 + 3 * Sizes.Header + state.length + steps.length;
-        uint next = i + Sizes.Header + len;
-        i = reserve(writer, next, next);
-
-        uint p = writeHeader(writer.dst, i, Keys.Pipe, uint32(max32(len)));
-        assembly ("memory-safe") {
-            mstore(add(p, 0x08), resources)
-        }
-
-        writeBlock32BytesBytes(writer.dst, i + Sizes.Header + 32, Keys.Context, account, state, steps);
-    }
-
     /// @notice Append a STATUS form block.
     /// @param writer Destination writer; `i` is advanced by `Sizes.Status`.
     /// @param code Status code to encode.

package/commands/Deposit.sol

@@ -81,7 +81,7 @@ abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
     ) external payable onlyCommand returns (bytes memory) {
         (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
         Writer memory writer = Writers.allocBalances(groups);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             (bytes32 asset, uint amount) = request.unpackAmount();
@@ -89,7 +89,7 @@ abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
             writer.appendBalance(asset, amount);
         }
 
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return writer.finish();
     }

package/commands/Provision.sol

@@ -78,7 +78,7 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
     ) external payable onlyCommand returns (bytes memory) {
         (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
         Writer memory writer = Writers.allocCustodies(groups);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             HostAmount memory allocation = request.unpackAllocationValue();
@@ -86,7 +86,7 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
             writer.appendCustody(allocation);
         }
 
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return writer.finish();
     }

package/commands/Recover.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommandBase, CommandContext, Keys} from "./Base.sol";
+import {Payable} from "../core/Payable.sol";
+import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Budget} from "../utils/Value.sol";
+
+using Cursors for Cur;
+
+abstract contract RecoverContextPayableHook {
+    /// @notice Override to recover one committed context witness.
+    /// @param port Recovery handler port node ID.
+    /// @param key Commitment or recovery lookup key.
+    /// @param resources Chain resources assigned to the recovery attempt.
+    /// @param context Cursor scoped to the embedded CONTEXT witness block.
+    /// @param budget Mutable native-value budget available to the recovery attempt.
+    function recoverContext(uint port, bytes32 key, uint resources, Cur memory context, Budget memory budget) internal virtual;
+}
+
+/// @title RecoverContextPayable
+/// @notice Command that forwards ContextRecovery request blocks to a virtual hook.
+/// Produces no output state.
+abstract contract RecoverContextPayable is CommandBase, Payable, RecoverContextPayableHook {
+    uint internal immutable recoverContextPayableId = commandId(this.recoverContextPayable.selector);
+
+    constructor() {
+        emit Command(host, recoverContextPayableId, "1:0:0", Schemas.ContextRecovery, Keys.Empty, Keys.Empty, true);
+        emit Labeled(recoverContextPayableId, bytes32(0), "recoverContextPayable");
+    }
+
+    /// @notice Recover each ContextRecovery block in the command request.
+    /// @param c Command context; `c.request` must contain ContextRecovery blocks.
+    /// @return Empty output state.
+    function recoverContextPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory) {
+        (Cur memory request, , ) = Cursors.init(c.request, 1);
+        Budget memory budget = openValue();
+
+        while (request.i < request.len) {
+            (uint port, bytes32 key, uint resources, Cur memory context) = request.unpackContextRecovery();
+            recoverContext(port, key, resources, context, budget);
+        }
+
+        closeValue(c.account, budget);
+        request.complete();
+        return "";
+    }
+}

package/commands/Relay.sol

@@ -37,12 +37,12 @@ abstract contract RelayPayable is CommandBase, Payable, DispatchPayableHook {
     /// @return output Empty output state.
     function relayPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory output) {
         (Cur memory request, ) = Cursors.init(c.request, 1, 1);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
-        (uint chain, uint resources, bytes memory pipe) = request.relayToPipe(c.account, c.state);
-        dispatch(chain, resources, pipe, budget);
+        (uint chain, uint resources, bytes memory context) = request.relayToContext(c.account, c.state);
+        dispatch(chain, resources, context, budget);
         
-        settleValue(c.account, budget);
+        closeValue(c.account, budget);
         request.complete();
         return "";
     }

package/commands/admin/Execute.sol

@@ -27,7 +27,7 @@ abstract contract ExecutePayable is AdminBase, Payable {
     /// @return Empty output state.
     function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory) {
         (Cur memory request, , ) = Cursors.init(c.request, 1);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             (uint target, uint resources, bytes calldata data) = request.unpackCall();

package/core/Commitments.sol

@@ -4,7 +4,7 @@ pragma solidity ^0.8.33;
 import {CommitmentEvent} from "../events/Commitment.sol";
 
 /// @title Commitments
-/// @notice On-chain registry for account-scoped digest commitments.
+/// @notice On-chain registry for digest commitments.
 abstract contract Commitments is CommitmentEvent {
     /// @dev key -> committed digest.
     mapping(bytes32 key => bytes32 digest) internal commitments;

package/core/Payable.sol

@@ -5,16 +5,14 @@ import {Budget, Values} from "../utils/Value.sol";
 
 /// @title Payable
 /// @notice Abstract mixin for entrypoints that accept native value (`msg.value`).
-/// Provides a shared settlement hook for any unspent value remaining in the
-/// mutable budget after execution completes.
+/// Provides shared helpers for mutable native-value budgets.
 abstract contract Payable {
     /// @dev Thrown when a payable entrypoint completes with unspent native value.
-    /// Override `settleValue` to implement refund or forwarding behavior instead.
     error UnusedValue(uint remaining);
 
-    /// @notice Create a native-value budget from the current call's `msg.value`.
-    /// @return Budget initialised with the full `msg.value`.
-    function valueBudget() internal view returns (Budget memory) {
+    /// @notice Open a native-value budget from the current call's `msg.value`.
+    /// @return Budget initialized with the full `msg.value`.
+    function openValue() internal view returns (Budget memory) {
         return Budget({remaining: msg.value});
     }
 
@@ -24,36 +22,25 @@ abstract contract Payable {
     /// @param resources Packed chain resources.
     /// @return value Native value to forward in wei.
     function useValue(Budget memory budget, uint resources) internal pure returns (uint128 value) {
-        return Values.use(budget, uint128(resources));
+        value = uint128(resources);
+        Values.use(budget, value);
     }
 
-    /// @notice Deduct the EVM value lane from a packed resource word as a new sub-budget.
-    /// @dev EVM resources use the low 128 bits as native value/endowment.
-    /// @param budget Mutable parent budget to deduct from.
-    /// @param resources Packed chain resources.
-    /// @return A new budget with the EVM value lane remaining.
-    function allocateValue(Budget memory budget, uint resources) internal pure returns (Budget memory) {
-        return Values.allocate(budget, uint128(resources));
-    }
-
-    /// @notice Drains the budget and settles any remaining native value.
-    /// @dev Calls the amount-based `settleValue` hook only when some value remains.
+    /// @notice Close a native-value budget and settle any drained value.
     /// @param account Account identifier for the current invocation.
-    /// @param budget Mutable native-value budget used during execution.
-    function settleValue(bytes32 account, Budget memory budget) internal {
-        uint value = budget.remaining;
+    /// @param budget Mutable native-value budget to close.
+    function closeValue(bytes32 account, Budget memory budget) internal {
+        uint value = Values.drain(budget);
         if (value == 0) return;
-        budget.remaining = 0;
         settleValue(account, value);
     }
 
-    /// @notice Handles leftover native value after payable execution has finished.
-    /// @dev Override this hook to refund or redirect unused value.
-    /// The default implementation rejects any leftover amount.
+    /// @notice Handle a drained native value amount.
+    /// @dev Override to refund or redirect unused value. The default rejects it.
     /// @param account Account identifier for the current invocation.
-    /// @param remaining Unspent native value left in the budget, in wei.
-    function settleValue(bytes32 account, uint remaining) internal virtual {
+    /// @param value Drained native value amount to settle, in wei.
+    function settleValue(bytes32 account, uint value) internal virtual {
         account;
-        revert UnusedValue(remaining);
+        revert UnusedValue(value);
     }
 }

package/core/Pipeline.sol

@@ -32,6 +32,7 @@ abstract contract Pipeline is Payable {
 
     /// @notice Execute a STEP block stream through the pipeline.
     /// @dev Reverts with `UnexpectedState` if the final threaded state is non-empty.
+    /// Callers remain responsible for settling any unspent value in `budget`.
     /// @param account Account identifier used for each dispatched step.
     /// @param state Initial state block stream passed to the first step.
     /// @param steps STEP block stream to execute.
@@ -50,7 +51,6 @@ abstract contract Pipeline is Payable {
         }
 
         if (state.length != 0) revert UnexpectedState();
-        settleValue(account, budget);
         input.complete();
     }
 }

package/docs/Schema.md

@@ -58,7 +58,6 @@ Once a child block appears, no more fixed fields may follow.
 ```txt
 #call { uint target, uint resources, #bytes as payload }
 #context { bytes32 account, #bytes as state, #bytes as request }
-#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }
 ```
 
 The tail is embedded directly as child block bytes. There is no wrapper around a
@@ -118,6 +117,18 @@ maybe #account { bytes32 account } as recipient
 
 Aliases may be used on any block item, including child blocks and prime items.
 
+A child block without an inline body may also be used as a schema reference:
+
+```txt
+#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }
+```
+
+Alias resolution is context-dependent. A consumer may resolve `#context` from the
+standard `Schemas` table, from app-specific schemas, or from another active
+schema context. Consumers should reject schemas with unresolved aliases. The
+runtime encoding is still an embedded child block with the referenced key and
+layout.
+
 ## Field Paths
 
 Field names and aliases may use dotted paths for offchain projection. A dotted
@@ -271,7 +282,7 @@ Common protocol schemas live in `contracts/blocks/Schema.sol`:
 #call { uint target, uint resources, #bytes as payload }
 #step { uint target, uint resources, #bytes as request }
 #context { bytes32 account, #bytes as state, #bytes as request }
-#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }
+#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }
 #auth { uint cid, uint deadline, #bytes as proof }
 ```