@engramx/client 0.16.0-rc.2 → 0.16.0-rc.20

package/README.md

@@ -40,8 +40,11 @@ console.log(`loaded ${ctx.includedFiles}/${ctx.totalFiles} files`);
 
 // AS THE AGENT WORKS: append (append-only; the canister concatenates the delta)
 const receipt = await engram.appendMemory('memory/daily.md', '## Notes\nSomething happened.');
-// receipt = { version, seq, head }. `head` is the audit-chain head this write advanced to, hex —
-// the evidence the write landed, verifiable by a third party against the chain and its anchor.
+// receipt = { version, seq, head }. `head` is the memory file's chain head after this write, hex —
+// the evidence the write landed. It is not the audit-chain head: this write's audit-log entry
+// records it, so the audit head that getCertifiedAuditHead() certifies, and the registry anchors,
+// covers it without being equal to it. A verifier goes from `head` to that entry, then along the
+// audit chain to a certified head. ⟨2026-10-13: this called `head` the audit-chain head.⟩
 // Carry it forward: reading the file back later returns content, not proof.
 
 // Point reads: one file, or several at once
@@ -54,6 +57,19 @@ const files = await engram.readMemoryBatch(['MEMORY.md', 'memory/daily.md']);
 // const balance = await engram.walletBalance();
 ```
 
+> ⟨2026-10-15⟩ The receipt is wider now: `{ version, seq, head, prev, atNs, contentRoot, size,
+> recordId, recordPrev, sent }`. `prev`, `atNs`, `contentRoot` and `size` are the rest of the memory-file
+> event, so with `sent` (the bytes this write sent) you recompute `head` yourself; `recordId` and
+> `recordPrev` place the write's entry in the engram's record. Capture the evidence right after the
+> write, and anyone can check it later — no key, no owner:
+>
+> ```typescript
+> const bundle = await engram.captureEvidence(receipt, 'memory/daily.md');
+> // fs.writeFileSync('bundle.json', JSON.stringify(bundle));
+> // npx @engramx/client@0.16.0-rc.20 verify bundle.json  → each link, the signed time, the entries walked
+> ```
+
+
 ### What you can actually call today (2026-08-17)
 
 Two things in the snippet above are worth stating plainly rather than letting you discover them.
@@ -72,7 +88,7 @@ in-repo consumer as a reason to report what breaks, not as a warning that it doe
 
 The 2026-08-17 charter diet (below) deleted a lot of caller-less methods and **deliberately kept
 these two.** Zero in-repo callers was the reason to look at them; it was not the reason to decide.
-Three facts decided it. They are what `npx @engramx/mcp connect` *instructs* whoever builds a new
+Three facts decided it. They are what `npx @engramx/mcp@0.16.0-rc.20 connect` *instructs* whoever builds a new
 SDK-lane agent to call, verbatim, in the guide the dashboard's connect page renders — deleting a method
 while still telling people to call it is the failure this whole exercise exists to prevent.
 `startSession()` is the only read on the **update** path, so it is the only one the canister can
@@ -98,13 +114,15 @@ Pair your agent with an engram:
 
 ```bash
 # Pair the agent on this machine with the engram and install the OpenClaw plugin
-pnpm dlx @engramx/client@0.16.0-rc.2 pair <invite-code> --engram <canister-id> --target openclaw
+pnpm dlx @engramx/client@0.16.0-rc.20 pair <invite-code> --engram <canister-id> --target openclaw
 
 # Replacement machine — after pairing, restore memory from the engram
-pnpm dlx @engramx/client migrate --engram <canister-id> --recover
+pnpm dlx @engramx/client@0.16.0-rc.20 migrate --engram <canister-id> --recover
 ```
 
-`pair` generates the key for this engram at `~/.engramx/session.key` (and, on the first pairing, the agent's lasting key at `~/.engramx/root.key`), pairs the agent — the CLI prints `Paired as an agent` — and installs the OpenClaw plugin. `migrate` then moves memory, saving a local checkpoint first — run `npx @engramx/client rollback` to undo. Its default direction pushes local memory files to the engram; `--recover` instead restores database backups, and memory files sync automatically on next OpenClaw startup.
+`pair` generates the key for this engram at `~/.engramx/session.key` (and, on the first pairing, the agent's lasting key at `~/.engramx/root.key`), pairs the agent — the CLI prints `Paired as an agent` — and installs the OpenClaw plugin. `migrate` then moves memory, saving a local checkpoint first — run `npx @engramx/client@0.16.0-rc.20 rollback` to undo. Its default direction pushes local memory files to the engram; `--recover` instead restores database backups, and memory files sync automatically on next OpenClaw startup.
+
+⟨2026-10-13⟩ `pair` moves no memory unless you add `--migrate`, and `--yes` never adds it. Without it, `pair` leaves any OpenClaw memory files on this machine where they are and prints one line: how many it found, and the `migrate` command that moves them. With `--migrate`, it runs that migration after pairing — each file is uploaded, then deleted here, and `rollback` restores them. Through 0.16.0-rc.11, `pair` ran the migration on every pairing, whatever the `--target` (Claude too), and answered its own question under `--yes`.
 
 ⟨2026-09-29⟩ From code, pairing is one call: `EngramClient.pairAgent(inviteCode, root)`, or sign the
 statement with `signEnrolment(root, engramId, key, inviteCode)` and call the engram's `pairAgent`
@@ -118,7 +136,7 @@ If the owner of the wallet allows it (a standing allowance they set for this age
 page), the agent can open an engram of its own through the engram it works in. The owner may be a program. Whoever runs that program is the owner for every purpose on these pages.
 
 ```bash
-npx @engramx/client open-engram --engram <canister-id>
+npx @engramx/client@0.16.0-rc.20 open-engram --engram <canister-id>
 ```
 
 The engram it works in pays to open it, from its own balance, and the agent's lasting key
@@ -127,7 +145,7 @@ paid in is the agent's from the moment the new engram exists, and nothing is tak
 reads the allowance first and stops, with nothing spent, when there is none; it never creates a
 lasting key; and it prints the engram's own sentence when the engram refuses. It then prints the
 owner kit's command that acts as the new engram's owner with the same file —
-`npx @engramx/owner --connect --key-file <that file> --registry <id>`, with both filled in — which
+`npx @engramx/owner@0.16.0-rc.20 --connect --key-file <that file> --registry <id>`, with both filled in — which
 mints an invite for an agent to pair into it. The agent's lasting key is an owner key for the engram
 it opened only; on the engram it works in it stays an agent. The agent's work in an engram its own
 key owns is never counted on its track record. From code: `EngramClient.getChildAllowance(key)`,
@@ -193,6 +211,13 @@ wrapper went. *(16 names)*
 `getAgentWriteReview`, `markAgentWritesReviewed` and `getEngramCard` (the vocabulary change: owner,
 agent, guardian).
 
+⟨2026-10-07⟩ The memory-log walk is still exported, as a module function rather than a class method:
+`assembleMemoryArchive(fetchPage, options)` takes the engram's own `listMemoryLog` as `fetchPage` —
+an owner-authenticated actor's, bound (`actor.listMemoryLog.bind(actor)`) — reads the page exactly as
+the engram serves it (`{ firstAvailableSeq; head; page : { items; total; withheld } }`, advancing by
+`items.length + withheld`), and `verifyMemoryArchive` checks the archive against an export receipt.
+The `assembleMemoryArchive` in group 4 below is the class method that left.
+
 **2. Renamed on the engram — the capability survives under a new name.** *(4 names)*
 
 | you called | call instead |
@@ -271,6 +296,10 @@ does not expose. They stayed because the encryption runbook instructs whoever mi
 Deleting a method a runbook tells people to call, while the runbook still tells them to call it, is
 worse than the blemish. Moving the family to `@engramx/owner` is a two-repo change: the doc rider
 first, then the methods.
+⟨2026-10-13⟩ The owner ruled to move it. `git-revert`'s engram step went first: the CLI now reverts
+the local memory repo and prints the owner kit's `--restore` command, because replacing a file is the
+owner's act (`@engramx/owner`, `restoreMemory`). The encryption trio follows with its runbook; it
+needs the owner kit to take this package's encryption module (`@engramx/client/encryption`).
 
 **The removals are a break.** A method this class no longer has fails at the call site, loudly,
 with a `TypeError`; a method the SDK no longer *declares* to the canister fails as a catchable
@@ -283,6 +312,9 @@ approval-request reads, an agent's key-hash rotation, the whole backup lane, and
 marketplace: `listServices` → `submitServiceRequestWithPayment` → `pollJobResult`/`getJob` →
 `getJobResult`, with `confirmJob`/`disputeJob` to settle. From here, no method returns to this class
 without a named caller. "A seller might want it" is how the last two dozen got here.
+⟨CORRECTED 2026-10-13⟩ The buyer half is not on this class: it moved to `MarketClient` (the market
+is its own canister) when `payAndCall` was deleted on 2026-09-30 — `listServices` → `createJob` →
+`pollJobStatus`/`getJob` → `getJobResult`, with `confirmJob`/`disputeJob` to settle.
 
 ## Backup API
 
@@ -348,10 +380,39 @@ ever empty again, such a call would report `'indeterminate'` by design — the S
 canonicity.) Pass `{ registryId }` to ask a different fleet (e.g. staging); the answer is then
 _that fleet's_ testimony, not canonicity.
 
+## Verify a birth chain ⟨2026-10-26⟩
+
+Every engram a registry opens gets a **birth record**: its id, the engram it was opened from (none
+for a first engram), its engram number, its birth time, a random secret, and the fingerprint of its
+parent's record. The engram holds its own record and copies of its ancestors' records, and serves
+them to its **owner only** (`getBirthChain`) — the owner decides whom to show them to. The registry
+certifies each record's fingerprint, and nothing else, in its certified tree (`getCertifiedBirth`,
+public: it reveals only whether a fingerprint is present). A record holds no person's identity,
+memory or wallet data.
+
+```typescript
+import { verifyBirthChain, fromCandidBirthRecord } from '@engramx/client/verify';
+
+const reply = await engram.getBirthChain(); // as the engram's owner
+if ('Err' in reply) throw new Error(JSON.stringify(reply.Err));
+const records = reply.Ok.map(fromCandidBirthRecord);
+// The registry's witnesses are fetched for you (`registryBirthWitness`); pass `fetchWitness` to
+// supply your own.
+const verdict = await verifyBirthChain(agent, registryId, records, { expectChild: engramId });
+// verdict.verified — every record certified against the IC root key AND every link holds
+// verdict.complete — the chain starts at a first engram (a part-way run is still verifiable)
+// verdict.links    — per record: certified or not, and why
+```
+
+Fingerprints are recomputed from the canonical encoding (`encodeBirthRecord`), never read off the
+wire. There is no certified proof of absence: an uncertified link is "not proven", not "proven false".
+
 ## OpenClaw Integration
 
 The `--target openclaw` option on `pair` handles plugin installation and `openclaw.json` configuration automatically. For manual setup or customization, see the README of the `@engramx/openclaw` package on npm.
 
+⟨2026-10-13⟩ It installs the plugin released with this package, at the same version. If a different version is already installed, `pair` stops before it pairs, names that version, and prints the command that upgrades it; the invite is not used, so the same command runs again afterwards. When it installs nothing (OpenClaw's gateway is not running, or both installers fail), it says so and why, and prints the command that installs the plugin. Until this day it printed "Installed EngramX plugin for OpenClaw" in every case.
+
 ## Maturity of the payment and identity surfaces
 
 Verified against the canister interface on 2026-08-16. "Stubbed" was doing too much work here, so

package/dist/EngramClient.d.ts

@@ -2,7 +2,8 @@ import { type CertifiedAuditHead, type VerifiedAuditHead } from './certifiedAudi
 import { Ed25519KeyIdentity } from '@icp-sdk/core/identity';
 import { Principal } from '@icp-sdk/core/principal';
 import { idlFactory } from './idl.js';
-import type { MemoryHistory, MemoryRangePage, MemoryFile, MemoryFileInfo, SessionContext, Pairing, AuditPage, AgentRecord, ChildAllowanceRow, EngramStatus, OwnerConsole, GuardianRecord, BackupMetadata, BackupType, ApprovalRequest } from './types.js';
+import { type EvidenceBundle } from './evidence.js';
+import type { MemoryHistory, MemoryRangePage, MemoryFile, MemoryFileInfo, SessionContext, Pairing, AuditPage, AgentRecord, AgentGrant, ChildAllowanceRow, EngramStatus, OwnerConsole, GuardianRecord, BackupMetadata, BackupRetention, BackupType, ApprovalRequest } from './types.js';
 /**
  * Source class declared on an append — recorded permanently in the engram's audit chain beside
  * this agent's principal. Declared by the caller, NOT verified by the canister; a false
@@ -37,6 +38,21 @@ export interface MemoryReceipt {
     seq: bigint;
     /** Chain head after this write, hex. The thing to hand a verifier. */
     head: string;
+    /** The memory-file chain head before this write, hex. */
+    prev: string;
+    /** The write's time (nanoseconds), as the event committed it. */
+    atNs: bigint;
+    /** The file's content root after the write, hex. */
+    contentRoot: string;
+    /** The file's size after the write, in bytes. */
+    size: bigint;
+    /** The id of this write's entry in the engram's chained record. */
+    recordId: bigint;
+    /** The record head just before that entry, hex (empty for the record's first entry). */
+    recordPrev: string;
+    /** The bytes this write sent: the appended delta (separator and any encryption included), or the
+     *  whole new content of a revise. What the memory-file event commits to. */
+    sent: Uint8Array;
 }
 export interface EngramClientConfig {
     /** The engram canister ID */
@@ -51,8 +67,6 @@ export interface EngramClientConfig {
     cacheMaxAge?: number;
     /** Max cache entries. Default: 100 */
     cacheMaxSize?: number;
-    /** Path for offline queue. Default: null (disabled) */
-    offlineQueuePath?: string;
     /** Encrypt memory content client-side via vetKeys. Default: false (plaintext).
      *  Enable for new/migrated engrams; the canister must support vetKD. Reads of
      *  legacy plaintext keep working regardless. */
@@ -73,7 +87,6 @@ export declare class EngramClient {
     private agent;
     private actor;
     private cache;
-    private offlineQueue?;
     private identity;
     private canisterId;
     private encryption;
@@ -109,13 +122,12 @@ export declare class EngramClient {
     /**
      * Append `content` to a memory file (append-only; the canister concatenates the delta).
      *
-     * @returns the write {@link MemoryReceipt}. **Special case:** if an `offlineQueue` is configured
-     * and the network call fails with a transport error, the encoded delta is queued for a later
-     * `syncOfflineQueue()` and this returns `null` — there is no receipt for a write that has not
-     * happened, and a caller that surfaces one must say "queued", not report a version. Deterministic
-     * errors (validation, permission, writes-paused, non-framed base in encrypted mode) always throw.
+     * @returns the write {@link MemoryReceipt}. Every failure throws — a transport error, and the
+     * deterministic ones (validation, permission, writes-paused, non-framed base in encrypted mode).
+     * ⟨2026-10-13, the owner's 4A⟩ It returned `MemoryReceipt | null` until then, null meaning
+     * "deferred to the offline queue"; the queue had no consumer that could switch it on and went.
      */
-    appendMemory(path: string, content: string, source?: MemorySource): Promise<MemoryReceipt | null>;
+    appendMemory(path: string, content: string, source?: MemorySource): Promise<MemoryReceipt>;
     /**
      * The engram's file listing.
      *
@@ -234,7 +246,10 @@ export declare class EngramClient {
      *  Same class as the readAuditLog envelope defect corrected 2026-08-20 two methods below,
      *  and caught the same way: by a live call, because tsc has nothing to check here.
      *  This method is the CYCLES projection its name and both MCP catalogs promise.
-     *  Corrected 2026-08-25. */
+     *  Corrected 2026-08-25.
+     *  ⟨2026-10-13, the owner's 3A⟩ tsc has something to check now: the actor is typed with the
+     *  generated interface (idl.ts · SdkEngramService) and unwrap returns the reply's own Ok type, so
+     *  this defect would not compile today. */
     walletBalance(): Promise<bigint>;
     /** ⟨0.16.0, L1 + L3⟩ Paged and enveloped. The wire method moved to `listAuditEntries` and the
      *  CALL followed it, but the RESULT HANDLING did not: this returned the raw
@@ -244,11 +259,15 @@ export declare class EngramClient {
      *  `this.actor` is `ActorSubclass<any>`, so the declared type is an unchecked assertion and tsc
      *  had nothing to catch it with: the rename compiled and looked done.
      *  Corrected 2026-08-20 to the idiom every sibling here already uses.
+     *  ⟨2026-10-13⟩ The actor is typed now (idl.ts · SdkEngramService); see walletBalance above.
      *
      *  ⟨CORRECTED 2026-09-29, owner ruling follow-up 16 (B)⟩ Returns the PAGE, not `.items`. An agent
      *  now reads only the entries it caused, so a window of the record comes back with `withheld`
      *  counting what it was not shown; handing back the bare array would let an agent mistake its part
-     *  of the record for the whole. `limit` is the window's span, not a row count. */
+     *  of the record for the whole. `limit` is the window's span, not a row count.
+     *  ⟨2026-10-18⟩ Since the owner's ruling 6B of 2026-10-14 the rest of the window comes back in
+     *  `sealed` as hash-only rows (id, digest, entry hash) in place of the `withheld` count, so
+     *  `items + sealed` is the window examined; see `AuditPage`. */
     readAuditLog(fromIndex?: number, limit?: number): Promise<AuditPage>;
     /** How many entries the chained audit log currently holds — the page bound for
      *  {@link readAuditLog}.
@@ -270,6 +289,21 @@ export declare class EngramClient {
     /** The chained audit-log head plus the IC certificate over it (raw, unverified). Use
      *  getVerifiedAuditHead() to verify it against the IC root key. */
     getCertifiedAuditHead(): Promise<CertifiedAuditHead>;
+    /**
+     * ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ Capture the evidence of a write this client
+     * just made, as a bundle anyone can check later with `engramx verify` — with no owner, no key and
+     * no account.
+     *
+     * Call it right after the write: it reads the certified record head NOW (the certificate's signed
+     * time is the time the bundle proves), reads this writer's own record entry back (an agent reads
+     * the entries it caused), and the hash-only rows from that entry to the captured head. A head that
+     * does not yet cover the write (a lagging replica) is read again, up to five times.
+     *
+     * THROWS when the evidence cannot be made — never a bundle that would fail its own check: when the
+     * entry cannot be read back in full by this caller (a write made through a paid session is logged
+     * under the session's payer), or the head never covers the write.
+     */
+    captureEvidence(receipt: MemoryReceipt, path: string): Promise<EvidenceBundle>;
     /** Fetch the certified audit head and VERIFY it against the IC root key — returns the certified
      *  head bytes and whether the replica's claim agrees, WITHOUT trusting this replica. */
     getVerifiedAuditHead(): Promise<VerifiedAuditHead>;
@@ -300,6 +334,13 @@ export declare class EngramClient {
      *  Terminal for this principal on this engram: pairing is one-shot, so working for it again
      *  needs a new principal and a fresh invite. Throws on a refusal (not an agent, already ended). */
     resignAgent(): Promise<void>;
+    /** ⟨2026-10-21, round 11 g⟩ THIS agent's own grant, as the engram enforces it against the key
+     *  this client signs with: what it may read, where it may write (`permissions.scopes`, the
+     *  `memory.append:<path>` rules — none means anywhere it could before), its rate
+     *  (`permissions.callsPerMinute`, 0 = no limit) and its payment limits. Read it before writing to
+     *  avoid a refusal the owner then has to explain. Only the caller's own grant — never another
+     *  agent's. Throws on a refusal: the owner, a revoked or resigned agent, a guardian or a stranger. */
+    myGrant(): Promise<AgentGrant>;
     /** ⟨2026-09-29, the owner's ruling of that date (follow-up 10, option A)⟩ Step one of replacing
      *  THIS agent's key on the engram: the key this client signs with nominates `newKey`. Nothing
      *  moves until the new key accepts (`acceptAgentKeyNomination`, called by a client that signs with
@@ -357,6 +398,13 @@ export declare class EngramClient {
      *  chunk, then check the reassembled sha256 against it before applying anything. A restore that
      *  cannot state the hash it expected is not a restore. */
     getBackupMetadata(backupId: string): Promise<BackupMetadata>;
+    /** ⟨2026-10-21, the owner's round-11 answers h and m⟩ How many backups of `dbType` the engram
+     *  keeps for EACH creator — this agent's own included — and whether that number is the engram's
+     *  default (`isDefault`, the owner never set one). Since that day the cap is per creator: this
+     *  agent's finalize prunes only this agent's own oldest backups beyond it, never the owner's or
+     *  another agent's. Needs the upload permission (`canAppendMemory`); throws on a refusal — a
+     *  reader-only agent, a revoked or resigned one, a guardian, a stranger — never a made-up number. */
+    getBackupRetention(dbType: string): Promise<BackupRetention>;
     latestBackupMatchesHash(dbType: string, sha256: string): Promise<BackupMetadata | null>;
     /** Encrypt a backup payload IFF this engram is in Private mode — the SAME toggle that governs
      *  memory files governs backups (encrypt files ⇒ encrypt backups). Produces a whole-blob
@@ -417,10 +465,6 @@ export declare class EngramClient {
         total: number;
         failed: string[];
     }>;
-    syncOfflineQueue(): Promise<{
-        synced: number;
-        failed: number;
-    }>;
     /**
      * Redeem an invite as the key for this engram, enrolled under the agent's lasting key (`root`).
      *

package/dist/EngramClient.js

@@ -3,20 +3,28 @@ import { verifyCertifiedAuditHead, } from './certifiedAudit.js';
 import { Principal } from '@icp-sdk/core/principal';
 import { LRUCache } from './cache.js';
 import { idlFactory } from './idl.js';
-import { OfflineQueue } from './offline.js';
 import { loadSessionKey, identityFromSeed } from './auth.js';
 import { signEnrolment } from './actionReceipt.js';
 import { unwrapResult, errorMessage } from './wire.js';
 import { EncryptionManager } from './encryption.js';
+import { EVIDENCE_FORMAT } from './evidence.js';
+import { sealedRowOf } from './recordChain.js';
 const memorySourceArg = (s) => s === undefined ? [] : [{ [s]: null }];
-const receiptOf = (r) => ({
+const hexOf = (b) => Array.from(b)
+    .map((x) => x.toString(16).padStart(2, '0'))
+    .join('');
+const receiptOf = (r, sent) => ({
     version: r.version,
     seq: r.seq,
-    head: Array.from(r.head)
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join(''),
+    head: hexOf(r.head),
+    prev: hexOf(r.prev),
+    atNs: r.atNs,
+    contentRoot: hexOf(r.contentRoot),
+    size: r.size,
+    recordId: r.recordId,
+    recordPrev: hexOf(r.recordPrev),
+    sent,
 });
-const ALLOWED_OFFLINE_METHODS = new Set(['appendMemory']);
 function validateMemoryPath(p) {
     if (p.includes('\0'))
         throw new Error('Path contains null byte');
@@ -155,9 +163,6 @@ export class EngramClient {
         });
         // If the caller didn't force a mode, sync it from the canister's flag lazily.
         this.encryptionModeSynced = config.encryptMemory !== undefined;
-        if (config.offlineQueuePath) {
-            this.offlineQueue = new OfflineQueue(config.offlineQueuePath);
-        }
     }
     async readMemory(path) {
         validateMemoryPath(path);
@@ -198,11 +203,10 @@ export class EngramClient {
     /**
      * Append `content` to a memory file (append-only; the canister concatenates the delta).
      *
-     * @returns the write {@link MemoryReceipt}. **Special case:** if an `offlineQueue` is configured
-     * and the network call fails with a transport error, the encoded delta is queued for a later
-     * `syncOfflineQueue()` and this returns `null` — there is no receipt for a write that has not
-     * happened, and a caller that surfaces one must say "queued", not report a version. Deterministic
-     * errors (validation, permission, writes-paused, non-framed base in encrypted mode) always throw.
+     * @returns the write {@link MemoryReceipt}. Every failure throws — a transport error, and the
+     * deterministic ones (validation, permission, writes-paused, non-framed base in encrypted mode).
+     * ⟨2026-10-13, the owner's 4A⟩ It returned `MemoryReceipt | null` until then, null meaning
+     * "deferred to the offline queue"; the queue had no consumer that could switch it on and went.
      */
     async appendMemory(path, content, source) {
         validateMemoryPath(path);
@@ -246,32 +250,7 @@ export class EngramClient {
         const deltaText = nonEmpty ? `\n${content}` : content;
         // Plaintext: raw UTF-8 delta. Encrypted: a length-framed, individually-sealed segment.
         const delta = await this.encryption.encodeAppendDelta(this.actor, deltaText);
-        // Only the NETWORK call is wrapped for offline deferral. Everything above (validation, encryption
-        // mode + framing checks, delta encoding) and the unwrap below throw DETERMINISTIC / logic errors
-        // (bad path, non-framed base, writes-paused, permission denied) that MUST surface — they must never
-        // be swallowed into the offline queue and reported as a fake success.
-        let rawResult;
-        try {
-            rawResult = await this.actor.appendMemory(path, delta, memorySourceArg(source));
-        }
-        catch (err) {
-            if (this.offlineQueue) {
-                // Queue the ALREADY-ENCODED delta bytes (separator + framing baked in) so the replay sends a
-                // valid Candid `vec nat8`, not a raw string, and does not re-run the read-dependent framing.
-                this.offlineQueue.enqueue('appendMemory', [
-                    path,
-                    Array.from(delta),
-                    memorySourceArg(source),
-                ]);
-                // null, NOT a zeroed receipt. The old sentinel was BigInt(0) — a version number that never
-                // existed — and under the receipt shape the equivalent would be a record with an empty
-                // head, which is indistinguishable from a real receipt to a caller that does not check.
-                // There is no receipt for a write that has not happened; null says exactly that.
-                return null;
-            }
-            throw err;
-        }
-        const receipt = receiptOf(this.unwrap(rawResult));
+        const receipt = receiptOf(this.unwrap(await this.actor.appendMemory(path, delta, memorySourceArg(source))), Uint8Array.from(delta));
         this.cache.invalidate(`mem:${path}`);
         return receipt;
     }
@@ -304,7 +283,7 @@ export class EngramClient {
             // errorMessage, NOT `new Error(r.Err)`: Err is a six-armed VARIANT, and stringifying it
             // yields "[object Object]" — it compiles, it runs, and it destroys the message. Same
             // defect the shared unwrap was written for; this call site had been missed.
-            if (r.Err !== undefined)
+            if ('Err' in r)
                 return [p, new Error(errorMessage(r.Err))];
             const raw = r.Ok;
             try {
@@ -524,7 +503,7 @@ export class EngramClient {
         const bytes = this.encryption.isEnabled()
             ? await this.encryption.encodeFramedSegmentBytes(this.actor, raw)
             : raw;
-        const receipt = receiptOf(this.unwrap(await this.actor.reviseMemory(path, bytes)));
+        const receipt = receiptOf(this.unwrap(await this.actor.reviseMemory(path, bytes)), Uint8Array.from(bytes));
         // Revise REPLACES content, so a stale cached read is not merely short — it is the wrong
         // content entirely, served confidently for the rest of the TTL.
         this.cache.invalidate(`mem:${path}`);
@@ -553,7 +532,10 @@ export class EngramClient {
      *  Same class as the readAuditLog envelope defect corrected 2026-08-20 two methods below,
      *  and caught the same way: by a live call, because tsc has nothing to check here.
      *  This method is the CYCLES projection its name and both MCP catalogs promise.
-     *  Corrected 2026-08-25. */
+     *  Corrected 2026-08-25.
+     *  ⟨2026-10-13, the owner's 3A⟩ tsc has something to check now: the actor is typed with the
+     *  generated interface (idl.ts · SdkEngramService) and unwrap returns the reply's own Ok type, so
+     *  this defect would not compile today. */
     async walletBalance() {
         return this.unwrap(await this.actor.getWalletBalances(), 'getWalletBalances').cycles;
     }
@@ -569,11 +551,15 @@ export class EngramClient {
      *  `this.actor` is `ActorSubclass<any>`, so the declared type is an unchecked assertion and tsc
      *  had nothing to catch it with: the rename compiled and looked done.
      *  Corrected 2026-08-20 to the idiom every sibling here already uses.
+     *  ⟨2026-10-13⟩ The actor is typed now (idl.ts · SdkEngramService); see walletBalance above.
      *
      *  ⟨CORRECTED 2026-09-29, owner ruling follow-up 16 (B)⟩ Returns the PAGE, not `.items`. An agent
      *  now reads only the entries it caused, so a window of the record comes back with `withheld`
      *  counting what it was not shown; handing back the bare array would let an agent mistake its part
-     *  of the record for the whole. `limit` is the window's span, not a row count. */
+     *  of the record for the whole. `limit` is the window's span, not a row count.
+     *  ⟨2026-10-18⟩ Since the owner's ruling 6B of 2026-10-14 the rest of the window comes back in
+     *  `sealed` as hash-only rows (id, digest, entry hash) in place of the `withheld` count, so
+     *  `items + sealed` is the window examined; see `AuditPage`. */
     async readAuditLog(fromIndex = 0, limit = 50) {
         return this.unwrap(await this.actor.listAuditEntries(BigInt(fromIndex), BigInt(limit)), 'listAuditEntries');
     }
@@ -607,6 +593,94 @@ export class EngramClient {
             certificate: r.certificate.length ? new Uint8Array(r.certificate[0]) : null,
         };
     }
+    /**
+     * ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ Capture the evidence of a write this client
+     * just made, as a bundle anyone can check later with `engramx verify` — with no owner, no key and
+     * no account.
+     *
+     * Call it right after the write: it reads the certified record head NOW (the certificate's signed
+     * time is the time the bundle proves), reads this writer's own record entry back (an agent reads
+     * the entries it caused), and the hash-only rows from that entry to the captured head. A head that
+     * does not yet cover the write (a lagging replica) is read again, up to five times.
+     *
+     * THROWS when the evidence cannot be made — never a bundle that would fail its own check: when the
+     * entry cannot be read back in full by this caller (a write made through a paid session is logged
+     * under the session's payer), or the head never covers the write.
+     */
+    async captureEvidence(receipt, path) {
+        let head = await this.getCertifiedAuditHead();
+        for (let tries = 0; head.total <= receipt.recordId && tries < 5; tries++) {
+            await new Promise((r) => setTimeout(r, 1000));
+            head = await this.getCertifiedAuditHead();
+        }
+        if (head.total <= receipt.recordId) {
+            throw new Error(`captureEvidence: the certified head covers ${head.total} entries and this write's entry is ${receipt.recordId} — the replica has not caught up; try again`);
+        }
+        if (!head.certificate)
+            throw new Error('captureEvidence: the head came back without a certificate');
+        const own = this.unwrap(await this.actor.listAuditEntries(receipt.recordId, 1n), 'listAuditEntries');
+        const entry = own.items.find((e) => e.id === receipt.recordId);
+        if (!entry) {
+            throw new Error(`captureEvidence: this caller cannot read record entry ${receipt.recordId} in full (it was logged under another principal), so it cannot make the bundle; the owner can`);
+        }
+        const rows = [];
+        let next = receipt.recordId + 1n;
+        while (next < head.total) {
+            const page = this.unwrap(await this.actor.listAuditEntries(next, head.total - next), 'listAuditEntries');
+            const got = page.sealed.map((r) => ({
+                id: r.id,
+                digest: Uint8Array.from(r.digest),
+                entryHash: Uint8Array.from(r.entryHash),
+            }));
+            for (const e of page.items)
+                got.push(await sealedRowOf(e));
+            got.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            if (got.length === 0)
+                break;
+            for (const r of got) {
+                if (r.id >= head.total)
+                    break;
+                rows.push({ id: r.id.toString(), digest: hexOf(r.digest), entryHash: hexOf(r.entryHash) });
+            }
+            next = got[got.length - 1].id + 1n;
+        }
+        return {
+            format: EVIDENCE_FORMAT,
+            canisterId: this.canisterId,
+            entry: {
+                id: entry.id.toString(),
+                timestampNs: entry.timestampNs.toString(),
+                caller: entry.caller.toText(),
+                callerRole: Object.keys(entry.callerRole)[0] ?? '',
+                operation: entry.operation,
+                details: entry.details,
+                success: entry.success,
+                entryHash: hexOf(entry.entryHash),
+            },
+            recordPrev: receipt.recordPrev,
+            hashFirstFrom: own.hashFirstFrom.toString(),
+            certified: {
+                certificate: Buffer.from(head.certificate).toString('base64'),
+                headHash: hexOf(head.headHash),
+                total: head.total.toString(),
+            },
+            rows,
+            write: {
+                path,
+                bytes: Buffer.from(receipt.sent).toString('base64'),
+                by: this.identity.getPrincipal().toText(),
+                receipt: {
+                    version: receipt.version.toString(),
+                    seq: receipt.seq.toString(),
+                    head: receipt.head,
+                    prev: receipt.prev,
+                    atNs: receipt.atNs.toString(),
+                    contentRoot: receipt.contentRoot,
+                    size: receipt.size.toString(),
+                },
+            },
+        };
+    }
     /** Fetch the certified audit head and VERIFY it against the IC root key — returns the certified
      *  head bytes and whether the replica's claim agrees, WITHOUT trusting this replica. */
     async getVerifiedAuditHead() {
@@ -649,6 +723,15 @@ export class EngramClient {
     async resignAgent() {
         this.unwrap(await this.actor.resignAgent(), 'resignAgent');
     }
+    /** ⟨2026-10-21, round 11 g⟩ THIS agent's own grant, as the engram enforces it against the key
+     *  this client signs with: what it may read, where it may write (`permissions.scopes`, the
+     *  `memory.append:<path>` rules — none means anywhere it could before), its rate
+     *  (`permissions.callsPerMinute`, 0 = no limit) and its payment limits. Read it before writing to
+     *  avoid a refusal the owner then has to explain. Only the caller's own grant — never another
+     *  agent's. Throws on a refusal: the owner, a revoked or resigned agent, a guardian or a stranger. */
+    async myGrant() {
+        return this.unwrap(await this.actor.myGrant(), 'myGrant');
+    }
     /** ⟨2026-09-29, the owner's ruling of that date (follow-up 10, option A)⟩ Step one of replacing
      *  THIS agent's key on the engram: the key this client signs with nominates `newKey`. Nothing
      *  moves until the new key accepts (`acceptAgentKeyNomination`, called by a client that signs with
@@ -761,7 +844,9 @@ export class EngramClient {
         return dbTypeFilter ? page.items.filter((b) => b.dbType === dbTypeFilter) : page.items;
     }
     async pullBackupChunk(backupId, chunkIndex) {
-        return this.unwrap(await this.actor.backupPullChunk(backupId, BigInt(chunkIndex)));
+        const chunk = this.unwrap(await this.actor.backupPullChunk(backupId, BigInt(chunkIndex)));
+        // A blob is typed `Uint8Array | number[]` by the generator; the agent decodes it to a Uint8Array.
+        return chunk instanceof Uint8Array ? chunk : Uint8Array.from(chunk);
     }
     /** One backup's metadata by id. Kept alongside listBackups/pullBackupChunk because
      *  RECOVERY-RUNBOOK §"Restore" names exactly that chain: list or fetch the metadata, pull each
@@ -770,6 +855,15 @@ export class EngramClient {
     async getBackupMetadata(backupId) {
         return this.unwrap(await this.actor.getBackupMetadata(backupId));
     }
+    /** ⟨2026-10-21, the owner's round-11 answers h and m⟩ How many backups of `dbType` the engram
+     *  keeps for EACH creator — this agent's own included — and whether that number is the engram's
+     *  default (`isDefault`, the owner never set one). Since that day the cap is per creator: this
+     *  agent's finalize prunes only this agent's own oldest backups beyond it, never the owner's or
+     *  another agent's. Needs the upload permission (`canAppendMemory`); throws on a refusal — a
+     *  reader-only agent, a revoked or resigned one, a guardian, a stranger — never a made-up number. */
+    async getBackupRetention(dbType) {
+        return this.unwrap(await this.actor.getBackupRetention(dbType), 'getBackupRetention');
+    }
     // deleteBackup and setBackupRetention are owner-only; deleteBackup left in the 2026-08-17
     // charter diet. An agent that can destroy the owner's backups is the append-only
     // guarantee inverted — the whole point of the lane is that a compromised agent cannot erase.
@@ -932,31 +1026,6 @@ export class EngramClient {
         }
         return { migrated, total: files.length, failed };
     }
-    async syncOfflineQueue() {
-        if (!this.offlineQueue)
-            return { synced: 0, failed: 0 };
-        return this.offlineQueue.flush(async (method, args) => {
-            if (!ALLOWED_OFFLINE_METHODS.has(method)) {
-                console.error(`engramx: offline queue contains unknown method "${method}" — operation dropped`);
-                return;
-            }
-            const fn = this.actor[method];
-            if (!fn)
-                throw new Error(`Unknown method: ${method}`);
-            // Queue entries persisted by a pre-source-class SDK carry 2 args; the 3-arg IDL would
-            // throw on arity at encode. Pad with opt-none so an old queue replays as UNTAGGED —
-            // the same thing it was when written.
-            if (method === 'appendMemory' && args.length === 2)
-                args = [...args, []];
-            const result = await fn(...args);
-            if (result && typeof result === 'object' && 'Err' in result) {
-                // Same variant-stringification defect as readMemoryBatch's row mapper: `Err` is a
-                // six-armed record, and `new Error(obj)` renders "[object Object]" over the one sentence
-                // a replay failure needs to carry.
-                throw new Error(errorMessage(result.Err));
-            }
-        });
-    }
     /**
      * Redeem an invite as the key for this engram, enrolled under the agent's lasting key (`root`).
      *