@engramx/idl 0.16.0-rc.1

package/dist/engram.did

@@ -0,0 +1,4045 @@
+type X402SignOutcome = 
+ variant {
+   ApprovalPending: ApprovalRequest;
+   Signed: SignedAuthorization;
+ };
+type WriteReceipt = 
+ record {
+   head: blob;
+   seq: nat;
+   version: nat;
+ };
+type WorldIdRpContext = 
+ record {
+   createdAt: nat;
+   expiresAt: nat;
+   nonce: text;
+   rpId: text;
+   signature: text;
+ };
+type WorldIdConfig = 
+ record {
+   action: text;
+   appId: text;
+   configured: bool;
+   rpId: text;
+ };
+type WalletBalances = 
+ record {
+   ckusdcE6s: nat;
+   ckusdtE6s: nat;
+   cycles: nat;
+   icpE8s: nat;
+ };
+type Voucher = 
+ record {
+   cumulativeAmount: nat;
+   sequence: nat;
+   sessionId: text;
+   signature: blob;
+ };
+type UnrecordableEngagement = 
+ record {
+   ended: AgentEnding;
+   invite: text;
+   "principal": principal;
+   root: principal;
+ };
+type TrackRecordNotice = 
+ variant {
+   NotRecorded: text;
+   Recorded;
+ };
+type TokenAmount = 
+ variant {
+   Ckusdc: nat;
+   Ckusdt: nat;
+   Icp: nat;
+ };
+type TimerHealth = 
+ record {
+   alertTimerArmed: bool;
+   jobExpiryArmed: bool;
+   jobExpiryFastMode: bool;
+   sessionExpiryArmed: bool;
+ };
+type StorageReport = 
+ record {
+   auditLogSize: nat;
+   backupCount: nat;
+   backupSize: nat;
+   fileLimit: nat;
+   memoryFilesCount: nat;
+   memoryFilesSize: nat;
+   sessionFilesCount: nat;
+   sessionFilesSize: nat;
+   totalContentSize: nat;
+   totalFiles: nat;
+   versionHistoryCount: nat;
+   versionHistorySize: nat;
+ };
+type SpendingPolicy = 
+ record {
+   allowedCallers: opt vec principal;
+   blockedCallers: opt vec principal;
+   maxConcurrentSessions: opt nat;
+   maxPerDay: opt nat;
+   maxPerTransaction: opt nat;
+   maxSessionDeposit: opt nat;
+   maxSessionDuration: opt int;
+   rateLimitPerMinute: opt nat;
+   sessionIdleTimeout: opt int;
+ };
+type SpendCeiling = 
+ record {
+   maxPerDay: opt nat;
+   spentToday: nat;
+ };
+type SigningFloorStatus = 
+ record {
+   balance: nat;
+   floor: nat;
+   perSignature: nat;
+   signaturesAboveFloor: nat;
+ };
+type SignedTransaction = 
+ record {
+   rawTx: text;
+   txHash: text;
+ };
+type SignedAuthorization = 
+ record {
+   authorization:
+    record {
+      from: text;
+      nonce: text;
+      signature: text;
+      to: text;
+      validAfter: nat;
+      validBefore: nat;
+      value: nat;
+    };
+   header: text;
+   paidAmount: nat;
+ };
+type SignatureCounts = 
+ record {
+   byCaller: vec CallerSignatureCount;
+   total: nat;
+ };
+type SessionIntent = 
+ record {
+   costPerCall: opt nat;
+   description: opt text;
+   expiryNs: int;
+   minDeposit: opt nat;
+   network: text;
+   recipient: text;
+   suggestedDeposit: nat;
+   token: text;
+ };
+type SessionContext = 
+ record {
+   files: vec MemoryFile;
+   includedFiles: nat;
+   totalBytes: nat;
+   totalFiles: nat;
+   truncated: bool;
+ };
+type SessionConfig = 
+ record {
+   autoClose: bool;
+   idleTimeout: opt int;
+   maxDeposit: nat;
+ };
+type ServiceEntry = 
+ record {
+   domains: vec text;
+   endpoint: text;
+   name: text;
+   skills: vec text;
+   version: text;
+ };
+type Seat = 
+ record {
+   firstPaymentDay: opt nat;
+   lastPaymentDay: opt nat;
+   pairedDay: nat;
+   produced: nat;
+   weeks: nat64;
+ };
+type Role = 
+ variant {
+   Admin;
+   Agent;
+   Anonymous;
+   Buyer;
+   Engram;
+   Guardian;
+   Other;
+   Owner;
+   Root;
+   Seller;
+   Viewer;
+   WasmAdmin;
+ };
+type RetentionClassSpec = 
+ variant {
+   vault;
+   working:
+    record {
+      maxBytes: opt nat;
+      maxVersions: opt nat;
+      thinning: variant {
+                  logSpaced: record {denseTail: nat;};
+                  tail;
+                };
+    };
+ };
+type ResyncReport = 
+ record {
+   cannotBeRecorded: vec UnrecordableEngagement;
+   endingsAcknowledged: nat;
+   notRecorded:
+    vec
+     record {
+       event: text;
+       "principal": principal;
+       root: principal;
+       why: text;
+     };
+   startsAcknowledged: nat;
+ };
+type Result_9 = 
+ variant {
+   Err: Error;
+   Ok: SignedTransaction;
+ };
+type Result_8 = 
+ variant {
+   Err: Error;
+   Ok: nat;
+ };
+type Result_70 = 
+ variant {
+   Err: Error;
+   Ok: AgentRecord;
+ };
+type Result_7 = 
+ variant {
+   Err: Error;
+   Ok: vec Seat;
+ };
+type Result_69 = 
+ variant {
+   Err: Error;
+   Ok: Eip712Registration;
+ };
+type Result_68 = 
+ variant {
+   Err: Error;
+   Ok: record {activatesAtNs: int;};
+ };
+type Result_67 = 
+ variant {
+   Err: Error;
+   Ok: CondenseResult;
+ };
+type Result_66 = 
+ variant {
+   Err: Error;
+   Ok: MemoryRangeExport;
+ };
+type Result_64 = 
+ variant {
+   Err: Error;
+   Ok: Page_21;
+ };
+type Result_63 = 
+ variant {
+   Err: Error;
+   Ok: AgentWriteReview;
+ };
+type Result_62 = 
+ variant {
+   Err: Error;
+   Ok: BackupMetadata;
+ };
+type Result_61 = 
+ variant {
+   Err: Error;
+   Ok: ChildAllowanceRow;
+ };
+type Result_60 = 
+ variant {
+   Err: Error;
+   Ok: ChildOpening;
+ };
+type Result_6 = 
+ variant {
+   Err: Error;
+   Ok: RailHealth;
+ };
+type Result_59 = 
+ variant {
+   Err: Error;
+   Ok: blob;
+ };
+type Result_58 = 
+ variant {
+   Err: Error;
+   Ok: EvmAddresses;
+ };
+type Result_57 = 
+ variant {
+   Err: Error;
+   Ok: AlertStatus;
+ };
+type Result_56 = 
+ variant {
+   Err: Error;
+   Ok: MemoryHistory;
+ };
+type Result_55 = 
+ variant {
+   Err: Error;
+   Ok: MemoryRetentionPolicy;
+ };
+type Result_54 = 
+ variant {
+   Err: Error;
+   Ok: OwnerConsole;
+ };
+type Result_53 = 
+ variant {
+   Err: Error;
+   Ok: record {paths: vec text;};
+ };
+type Result_52 = 
+ variant {
+   Err: Error;
+   Ok: SigningFloorStatus;
+ };
+type Result_51 = 
+ variant {
+   Err: Error;
+   Ok: SpendCeiling;
+ };
+type Result_50 = 
+ variant {
+   Err: Error;
+   Ok: SpendingPolicy;
+ };
+type Result_5 = 
+ variant {
+   Err: Error;
+   Ok: SignatureCounts;
+ };
+type Result_49 = 
+ variant {
+   Err: Error;
+   Ok: StorageReport;
+ };
+type Result_48 = 
+ variant {
+   Err: Error;
+   Ok: WalletBalances;
+ };
+type Result_47 = 
+ variant {
+   Err: Error;
+   Ok: WorldIdConfig;
+ };
+type Result_46 = 
+ variant {
+   Err: Error;
+   Ok: WorldIdRpContext;
+ };
+type Result_45 = 
+ variant {
+   Err: Error;
+   Ok: opt text;
+ };
+type Result_44 = 
+ variant {
+   Err: Error;
+   Ok: bool;
+ };
+type Result_43 = 
+ variant {
+   Err: Error;
+   Ok: text;
+ };
+type Result_42 = 
+ variant {
+   Err: Error;
+   Ok: Page_20;
+ };
+type Result_41 = 
+ variant {
+   Err: Error;
+   Ok: Page_19;
+ };
+type Result_40 = 
+ variant {
+   Err: Error;
+   Ok: Page_18;
+ };
+type Result_4 = 
+ variant {
+   Err: Error;
+   Ok: Eip712SignatureOut;
+ };
+type Result_39 = 
+ variant {
+   Err: Error;
+   Ok: Page_17;
+ };
+type Result_38 = 
+ variant {
+   Err: Error;
+   Ok: Page_16;
+ };
+type Result_37 = 
+ variant {
+   Err: Error;
+   Ok: CheckpointPage;
+ };
+type Result_36 = 
+ variant {
+   Err: Error;
+   Ok: Page_14;
+ };
+type Result_35 = 
+ variant {
+   Err: Error;
+   Ok: Page_13;
+ };
+type Result_34 = 
+ variant {
+   Err: Error;
+   Ok: Page_12;
+ };
+type Result_33 = 
+ variant {
+   Err: Error;
+   Ok: Page_11;
+ };
+type Result_32 = 
+ variant {
+   Err: Error;
+   Ok: Page_10;
+ };
+type Result_31 = 
+ variant {
+   Err: Error;
+   Ok: ReceiptPage;
+ };
+type Result_30 = 
+ variant {
+   Err: Error;
+   Ok: Page_8;
+ };
+type Result_3 = 
+ variant {
+   Err: Error;
+   Ok: X402SignOutcome;
+ };
+type Result_29 = 
+ variant {
+   Err: Error;
+   Ok: LogPage;
+ };
+type Result_28 = 
+ variant {
+   Err: Error;
+   Ok: Page_6;
+ };
+type Result_27 = 
+ variant {
+   Err: Error;
+   Ok: Page_5;
+ };
+type Result_26 = 
+ variant {
+   Err: Error;
+   Ok: Page_4;
+ };
+type Result_25 = 
+ variant {
+   Err: Error;
+   Ok: PaymentSignatureCounts;
+ };
+type Result_24 = 
+ variant {
+   Err: Error;
+   Ok: Page_2;
+ };
+type Result_23 = 
+ variant {
+   Err: Error;
+   Ok: Page_1;
+ };
+type Result_22 = 
+ variant {
+   Err: Error;
+   Ok: Page;
+ };
+type Result_21 = 
+ variant {
+   Err: Error;
+   Ok: principal;
+ };
+type Result_20 = 
+ variant {
+   Err: Error;
+   Ok: EngramSessionState;
+ };
+type Result_2 = 
+ variant {
+   Err: Error;
+   Ok: ControlHandover;
+ };
+type Result_19 = 
+ variant {
+   Err: Error;
+   Ok: Pairing;
+ };
+type Result_18 = 
+ variant {
+   Err: Error;
+   Ok: CondensePreview;
+ };
+type Result_17 = 
+ variant {
+   Err: Error;
+   Ok: vec BatchReadItem;
+ };
+type Result_16 = 
+ variant {
+   Err: Error;
+   Ok: MemoryByteChunk;
+ };
+type Result_15 = 
+ variant {
+   Err: Error;
+   Ok: GuardianRecord;
+ };
+type Result_14 = 
+ variant {
+   Err: Error;
+   Ok: ResetReport;
+ };
+type Result_13 = 
+ variant {
+   Err: Error;
+   Ok: ResyncReport;
+ };
+type Result_12 = 
+ variant {
+   Err: Error;
+   Ok: SessionContext;
+ };
+type Result_11 = 
+ variant {
+   Err: Error;
+   Ok: MemoryFile;
+ };
+type Result_10 = 
+ variant {
+   Err: Error;
+   Ok: BackupRetentionReport;
+ };
+type Result_1 = 
+ variant {
+   Err: Error;
+   Ok;
+ };
+type Result = 
+ variant {
+   Err: Error;
+   Ok: WriteReceipt;
+ };
+type ResetReport = 
+ record {
+   agentsPurged: nat;
+   agentsRemoved: nat;
+   filesCleared: nat;
+   guardiansRemoved: nat;
+ };
+type Repudiation = 
+ record {
+   atNs: int;
+   auditId: nat;
+   path: text;
+   reason: text;
+   version: nat;
+ };
+type RegisteredType = 
+ record {
+   ackIrrevocable: bool;
+   authorityClass: AuthorityClass;
+   chainId: nat;
+   cooloffEndsAtNs: int;
+   dailySignCap: nat;
+   destinationFields: vec text;
+   domainName: text;
+   domainSeparator: vec nat8;
+   domainVersion: text;
+   encodeTypeString: text;
+   fields: vec record {
+                 text;
+                 text;
+               };
+   primaryType: text;
+   registeredAtNs: int;
+   typeHash: vec nat8;
+   typeId: blob;
+   verifyingContract: text;
+ };
+type ReceiptPage = 
+ record {
+   firstAvailableSeq: nat;
+   page: Page_9;
+   scannedThroughSeq: nat;
+ };
+type RailHealth = 
+ record {
+   cycles: nat;
+   escrowOpen: opt nat;
+   freezeReservation: nat;
+   memoryBytes: nat;
+   paidVouchersConsumed: nat;
+   sendHeadroom: nat;
+   sessionsClosed: nat;
+   sessionsClosing: nat;
+   sessionsExpired: nat;
+   sessionsOpen: nat;
+   unknownSessionRefusals: nat;
+ };
+type PurgedAgent = 
+ record {
+   ended: AgentEnding;
+   enrolledKey: principal;
+   invite: text;
+   name: text;
+   pairedAtNs: int;
+   "principal": principal;
+   purgedAtNs: int;
+   root: principal;
+ };
+type PaymentSignatureCounts = 
+ record {
+   agents: Page_3;
+   day: int;
+   limit: nat;
+   marketplace: opt MarketplacePaymentSignatures;
+ };
+type PaymentSignature = 
+ record {
+   asset: opt text;
+   authorization: opt Eip3009Authorization;
+   network: text;
+   nonce: blob;
+   publicKey: opt blob;
+   scheme: text;
+   sender: text;
+   signature: blob;
+ };
+type Pairing = 
+ record {
+   agent: AgentRecord;
+   trackRecord: TrackRecordNotice;
+ };
+type Page_9 = 
+ record {
+   items: vec ExportReceiptRow;
+   total: nat;
+   withheld: nat;
+ };
+type Page_8 = 
+ record {
+   items: vec record {
+                lastModifiedAtNs: int;
+                path: text;
+                version: nat;
+              };
+   total: nat;
+   withheld: nat;
+ };
+type Page_7 = 
+ record {
+   items: vec MemoryLogEvent;
+   total: nat;
+   withheld: nat;
+ };
+type Page_6 = 
+ record {
+   items: vec ApprovalRequest;
+   total: nat;
+   withheld: nat;
+ };
+type Page_5 = 
+ record {
+   items: vec EngramSessionState;
+   total: nat;
+   withheld: nat;
+ };
+type Page_4 = 
+ record {
+   items: vec OwnershipTransfer;
+   total: nat;
+   withheld: nat;
+ };
+type Page_3 = 
+ record {
+   items: vec AgentPaymentSignatures;
+   total: nat;
+   withheld: nat;
+ };
+type Page_21 = 
+ record {
+   items: vec OwnerRow;
+   total: nat;
+   withheld: nat;
+ };
+type Page_20 = 
+ record {
+   items: vec ActivitySnapshot;
+   total: nat;
+   withheld: nat;
+ };
+type Page_2 = 
+ record {
+   items: vec PurgedAgent;
+   total: nat;
+   withheld: nat;
+ };
+type Page_19 = 
+ record {
+   items: vec AgentRecord;
+   total: nat;
+   withheld: nat;
+ };
+type Page_18 = 
+ record {
+   items: vec record {
+                name: text;
+                "principal": principal;
+                status: AgentStatus;
+              };
+   total: nat;
+   withheld: nat;
+ };
+type Page_17 = 
+ record {
+   items: vec BackupMetadata;
+   total: nat;
+   withheld: nat;
+ };
+type Page_16 = 
+ record {
+   items: vec BearerToken;
+   total: nat;
+   withheld: nat;
+ };
+type Page_15 = 
+ record {
+   items: vec CondenseCheckpointRow;
+   total: nat;
+   withheld: nat;
+ };
+type Page_14 = 
+ record {
+   items: vec CycleSnapshot;
+   total: nat;
+   withheld: nat;
+ };
+type Page_13 = 
+ record {
+   items: vec text;
+   total: nat;
+   withheld: nat;
+ };
+type Page_12 = 
+ record {
+   items: vec RegisteredType;
+   total: nat;
+   withheld: nat;
+ };
+type Page_11 = 
+ record {
+   items: vec record {
+                activeFromNs: int;
+                address: text;
+              };
+   total: nat;
+   withheld: nat;
+ };
+type Page_10 = 
+ record {
+   items: vec GuardianRecord;
+   total: nat;
+   withheld: nat;
+ };
+type Page_1 = 
+ record {
+   items: vec AuditEntry;
+   total: nat;
+   withheld: nat;
+ };
+type Page = 
+ record {
+   items: vec Repudiation;
+   total: nat;
+   withheld: nat;
+ };
+type OwnershipTransfer = 
+ record {
+   atNs: int;
+   authorizedBy: principal;
+   from: opt principal;
+   to: principal;
+ };
+type OwnerRow = 
+ record {
+   firstPaymentDay: opt nat;
+   lastPaymentDay: opt nat;
+   pairedDay: nat;
+   produced: nat;
+   root: principal;
+   weeks: nat64;
+ };
+type OwnerConsole = 
+ record {
+   agentRevisablePathCount: nat;
+   cyclesBalance: nat;
+   memoryKeyEpoch: nat;
+   owner: opt principal;
+   pendingApprovalCount: nat;
+   protectedPathCount: nat;
+   unknownSessionRefusals: nat;
+ };
+type MemoryVersionSummary = 
+ record {
+   atNs: int;
+   by: principal;
+   contentRoot: blob;
+   kind: variant {
+           append;
+           restore;
+           set;
+           tombstone;
+         };
+   seq: nat;
+   size: nat;
+   version: nat;
+ };
+type MemorySource = 
+ variant {
+   agentDerived;
+   deterministic;
+   fileSync;
+   human;
+   sessionTranscript;
+ };
+type MemoryRetentionPolicy = 
+ record {
+   entries: vec record {
+                  text;
+                  RetentionClassSpec;
+                };
+   guards: vec record {
+                 notBeforeNs: int;
+                 prefix: text;
+               };
+ };
+type MemoryRangeExport = 
+ record {
+   atNs: int;
+   authorFilter: opt principal;
+   fromSeq: nat;
+   head: blob;
+   opsRoot: blob;
+   seq: nat;
+   toSeq: nat;
+ };
+type MemoryMaintainStatus = 
+ record {
+   attachDetail: text;
+   attachOk: bool;
+   lastEvictions: nat;
+   lastMaintainAtNs: opt int;
+   lastScrubbed: nat;
+   more: bool;
+   refused: bool;
+   refusedQuota: text;
+   totalEvictions: nat;
+   totalFindings: nat;
+ };
+type MemoryLogOp = 
+ variant {
+   append: record {
+             deltaHash: blob;
+             deltaSize: nat;
+             newSize: nat;
+           };
+   condense:
+    record {
+      fromSeq: nat;
+      headAtBoundary: blob;
+      opCount: nat;
+      opsRoot: blob;
+      toSeq: nat;
+    };
+   evict:
+    record {
+      byteCount: nat;
+      chunkCount: nat;
+      evictedRoot: blob;
+      fromVersion: nat;
+      toVersion: nat;
+    };
+   exported:
+    record {
+      authorFilter: opt principal;
+      fromSeq: nat;
+      opsRoot: blob;
+      toSeq: nat;
+    };
+   imported: MemoryLogImportNote;
+   restore: record {
+              manifest: MemoryLogManifest;
+              toVersion: nat;
+            };
+   set: record {manifest: MemoryLogManifest;};
+   tombstone;
+ };
+type MemoryLogManifest = 
+ record {
+   chunks: vec MemoryLogChunkRef;
+   contentRoot: blob;
+   totalSize: nat;
+ };
+type MemoryLogImportNote = 
+ variant {
+   genesis: record {boundTo: opt blob;};
+   legacyDelete;
+   legacyGap: record {firstSurviving: nat;};
+   legacyTruncated: record {
+                      prefixHash: blob;
+                      storedBytes: nat;
+                    };
+   legacyUnreconstructable: record {
+                              contentHash: blob;
+                              reason: text;
+                            };
+ };
+type MemoryLogEvent = 
+ record {
+   atNs: int;
+   by: principal;
+   contentRoot: blob;
+   op: MemoryLogOp;
+   path: text;
+   prev: blob;
+   seq: nat;
+   size: nat;
+   version: nat;
+ };
+type MemoryLogChunkRef = 
+ record {
+   birthSeq: nat;
+   hash: blob;
+   size: nat;
+ };
+type MemoryHistory = 
+ record {
+   everCount: nat;
+   evictedCount: nat;
+   evictions: vec MemoryEviction;
+   oldestRetainedVersion: nat;
+   retainedCount: nat;
+   versions: vec MemoryVersionSummary;
+ };
+type MemoryFile = 
+ record {
+   content: blob;
+   lastModifiedAtNs: int;
+   lastModifiedBy: principal;
+   path: text;
+   version: nat;
+ };
+type MemoryEviction = 
+ record {
+   cause: variant {
+            maxBytes;
+            maxVersions;
+          };
+   evictSeq: nat;
+   evictedRoot: blob;
+   fromVersion: nat;
+   toVersion: nat;
+   trigger: variant {
+              globalCap;
+              perFileCap;
+              policy;
+              thinLogSpaced;
+              thinTail;
+            };
+ };
+type MemoryByteChunk = 
+ record {
+   bytes: blob;
+   fileSize: nat;
+   more: bool;
+ };
+type MarketplacePaymentSignatures = 
+ record {
+   limit: nat;
+   marketplace: principal;
+   sharedSignedToday: nat;
+ };
+type LogPosition = 
+ record {
+   reads: nat;
+   "record": nat;
+ };
+type LogPage = 
+ record {
+   firstAvailableSeq: nat;
+   head: blob;
+   page: Page_7;
+ };
+type KeyNomination = 
+ record {
+   atNs: int;
+   key: principal;
+ };
+type HttpResponse = 
+ record {
+   body: blob;
+   headers: vec record {
+                  text;
+                  text;
+                };
+   status_code: nat16;
+   upgrade: opt bool;
+ };
+type HttpRequestResult = 
+ record {
+   body: blob;
+   headers: vec HttpHeader;
+   status: nat;
+ };
+type HttpRequest = 
+ record {
+   body: blob;
+   headers: vec record {
+                  text;
+                  text;
+                };
+   method: text;
+   url: text;
+ };
+type HttpHeader = 
+ record {
+   name: text;
+   value: text;
+ };
+type HeldKey = 
+ record {
+   from: LogPosition;
+   key: principal;
+   until: LogPosition;
+ };
+type GuardianStatus = 
+ variant {
+   Active;
+   Pending;
+ };
+type GuardianRecord = 
+ record {
+   addedAtNs: int;
+   name: text;
+   permissions: GuardianPermissions;
+   "principal": principal;
+   status: GuardianStatus;
+ };
+type GuardianPermissions = 
+ record {
+   canFreezePayments: bool;
+   canPauseWrites: bool;
+   canRevokeAgents: bool;
+   scopes: opt vec text;
+ };
+type GenesisNote = 
+ record {
+   genesisAtNs: int;
+   note: text;
+   predecessorHeadHash: opt blob;
+   predecessorSize: opt nat;
+   version: text;
+ };
+type ExportReceiptRow = 
+ record {
+   atNs: int;
+   authorFilter: opt principal;
+   by: principal;
+   fromSeq: nat;
+   opsRoot: blob;
+   seq: nat;
+   toSeq: nat;
+ };
+type EvmAddresses = 
+ record {
+   engramRegistration: text;
+   pay: text;
+ };
+type Error = 
+ variant {
+   Conflict: text;
+   Invalid: text;
+   NotFound: text;
+   Other: text;
+   Refused: text;
+   Unavailable: text;
+ };
+type EnrolmentProof = 
+ record {
+   enrolledKey: principal;
+   inviteCode: text;
+   rootPubkey: blob;
+   signature: blob;
+ };
+type Enrolment = 
+ record {
+   engram: principal;
+   enrolledKey: principal;
+   rootPubkey: blob;
+   signature: blob;
+ };
+type EngramSessionStatus = 
+ variant {
+   closed;
+   closing;
+   expired;
+   open;
+   other: text;
+ };
+type EngramSessionState = 
+ record {
+   consumed: nat;
+   deposited: nat;
+   id: text;
+   lastActivityAtNs: int;
+   openedAtNs: int;
+   payer: principal;
+   remaining: nat;
+   status: EngramSessionStatus;
+   voucherCount: nat;
+ };
+type Engram = 
+ service {
+   /// ⟨0.16.0⟩ `about()` — the ONE public projection, replacing `status()` and absorbing `metrics()`.
+   /// 
+   /// Two public projections of one canister was the L2.2 defect: both answered "what is this engram
+   /// like", disagreed about which counters they carried, and `status()` additionally masked two
+   /// fields behind an `authorized` flag whose own declaration admitted the problem — "a consumer
+   /// that must remember to check a sibling flag is one that will eventually forget."
+   /// 
+   /// The fix is not a better flag. The gated fields MOVED (see `getOwnerConsole`), so there is no
+   /// masked field to forget and no flag to check. Reaching the gated record is the authorization.
+   /// 
+   /// Ungated by design and marked for the L8 gate-grep.
+   /// PUBLIC: existence, shape, posture and day-floored activity. No principal, no balance, no
+   /// precise timestamp — nothing here identifies a person or reveals when they are at the keyboard.
+   about: () -> (About) query;
+   /// The NEW key accepts the nomination the agent's current key (`agentKey`) made of it, and takes
+   /// over the agent's record: the same lasting identity, enrolment statement, invite and
+   /// permissions, today's spending and signature totals, and any spending limit the owner set for
+   /// that agent. From this message on, `agentKey` is not an agent of this engram and every call it
+   /// makes as one is refused. The registry is not called: it goes on naming the same open
+   /// engagement (`KeyReplacement`'s header says why and what a modified engram could do with it).
+   /// 
+   /// ONE MESSAGE, NO AWAIT: every check, the move of the record and of each per-key total, and the
+   /// record entry happen together, so no call can fall between a check and the move, and no total
+   /// is ever held by both keys or by neither. Answers the record as the new key now holds it.
+   /// 
+   /// WHO MAY CALL is decided by `KeyReplacement.accepted`: only the key a pending, unexpired
+   /// nomination names. That check compares the caller inside the module, where
+   /// test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
+   /// no role here until the move.
+   acceptAgentKeyNomination: (agentKey: principal) -> (Result_70);
+   /// Consensus transform for the alert webhook outcall: collapse the response to status-only so
+   /// replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
+   /// 
+   /// PUBLIC: not a choice. The management canister invokes a transform on every replica as part of
+   /// the HTTP-outcall protocol, and that invocation carries no caller identity to gate on — a gate
+   /// here would refuse the only caller there is and break every alert this canister sends. Safe
+   /// because it is total and stateless: it reads its argument and returns, touching nothing.
+   actionAlertTransform: (args:
+    record {
+      context: blob;
+      response: HttpRequestResult;
+    }) -> (HttpRequestResult) query;
+   /// Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
+   /// of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
+   /// shape is IMMUTABLE: any change mints a new typeId.
+   addEip712Type: (spec:
+    record {
+      ackIrrevocable: bool;
+      authorityClass: variant {
+                        standard;
+                        standingAuthority;
+                        valueBearing;
+                      };
+      canonicalTypeString: text;
+      chainId: nat;
+      dailySignCap: nat;
+      destinationFields: vec text;
+      domainName: text;
+      domainVersion: text;
+      fields: vec record {
+                    text;
+                    text;
+                  };
+      primaryType: text;
+      verifyingContract: text;
+    }) -> (Result_69);
+   /// Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
+   /// and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
+   addEvmWithdrawDestination: (dest: text) -> (Result_68);
+   /// ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
+   /// 
+   /// This method had five distinct ways to say no through one `text`, and a caller could only tell
+   /// them apart by matching prose. They are now three different arms because they call for three
+   /// different responses: `#Invalid` means fix the argument and retry, `#Refused` means you are not
+   /// the owner and retrying changes nothing, and `#Conflict` means the request was well-formed and
+   /// permitted but this engram's state says no — the principal already holds an incompatible role,
+   /// or the roster is full. Only the last is worth an agent's time to resolve.
+   addGuardian: (guardianPrincipal: principal, name: text, permissions:
+    GuardianPermissions) -> (Result_1);
+   /// Returns the write RECEIPT, not just the version.
+   /// 
+   /// The receipt was always computed and then thrown away: MemoryRouter hands back
+   /// {seq; version; contentRoot; head}, the audit detail stringifies `seq=`/`head=` into prose, and
+   /// the caller got a bare Nat. So a writer could be told their write landed but not be given the
+   /// evidence it landed — they had to read the audit log back and parse a string to learn the head
+   /// their own write produced. `head` is the chain head AFTER this write; it transitively commits
+   /// to contentRoot, which is why the root is not repeated here (the same ruling that dropped
+   /// per-entry contentRoot from the audit entries).
+   /// 
+   /// This is the half of a consumer request that costs nothing: the commitment ledger was still
+   /// "trust whoever runs the service" one hop from the proof — a third party can now be handed the receipt
+   /// directly by whoever wrote the content. A return-TYPE change cannot be absorbed by the client
+   /// subset rule, so it can only ride an interface break; this release is one.
+   appendMemory: (path: text, content: blob, source: opt MemorySource) ->
+    (Result);
+   /// Replace the retained log prefix through `toSeq` with a single checkpoint.
+   /// 
+   /// PREFIX-ONLY: there is no `fromSeq`, because the library made that unrepresentable rather than
+   /// merely checked — a condense always starts at the current floor. It refuses unless an
+   /// UNFILTERED export receipt already covers the whole range; call previewCondense first,
+   /// which reports how far your existing receipts reach.
+   /// 
+   /// `historyBytesDelta` is SIGNED, and the sign is the point. A condense subtracts the dropped
+   /// entries' canonical bytes and adds the checkpoint's own, so condensing a short prefix of small
+   /// entries can leave the history meter HIGHER than it found it. The owner is told which happened
+   /// rather than left to assume the number went down.
+   /// 
+   /// Gated on requireWritesNotPaused — unlike the export. This one destroys retained entries, which
+   /// is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
+   /// owner-initiated, owner-only, and already chained into the audit log.
+   applyCondense: (toSeq: nat) -> (Result_67);
+   /// Owner-only: activate a guardian who has registered against an invite.
+   /// 
+   /// Until this call the guardian is `#Pending` and can do NOTHING — registering is a claim, this
+   /// is the grant. That two-step is what stops a leaked invite code from producing a live guardian
+   /// on its own.
+   /// 
+   /// `#Conflict("Guardian is already active")` when there is nothing to do — the refusal says the
+   /// state the caller asked for is the state that holds, rather than pretending it acted.
+   approveGuardian: (guardianPrincipal: principal) -> (Result_1);
+   /// Owner-only: approve one pending over-limit request, letting the agent retry the operation
+   /// its policy refused.
+   /// 
+   /// ⚠ THE APPROVAL IS SINGLE-USE AND EXPIRES IN ONE HOUR. Approving does not perform the
+   /// operation and does not raise the policy — it opens a window. The agent must retry within
+   /// the hour, and the retry CONSUMES the approval (`#Used`); a second attempt needs a second
+   /// approval. Past the hour it becomes `#Expired` on first touch. Neither state is recoverable by
+   /// approving again — the owner approves a NEW request.
+   /// ⟨2026-09-29, review finding X-11⟩ One exception, made by the engram and not by the owner: when
+   /// the retry's signer FAILS, nothing was signed, so the approval goes back from `#Used` to
+   /// `#Approved` with its original expiry and an `approval.released` entry says so.
+   /// 
+   /// ⚠ IT IS BOUND TO THE EXACT OPERATION THAT WAS REQUESTED, not to the agent. An approval
+   /// carries the operation, the amount and the binding it was raised for, and consuming it checks
+   /// all three — so approving a request does not grant the agent a general allowance for the
+   /// hour, and cannot be redirected at a different recipient or a larger sum.
+   /// 
+   /// Refuses `#NotFound` for an unknown id, and `#Conflict` NAMING THE STATUS when the request is
+   /// no longer pending — already approved, denied or expired. The status is in the message because
+   /// "not pending" is the one refusal here an owner acts on differently depending on which it is.
+   approveRequest: (requestId: text) -> (Result_1);
+   /// Discard a backup started by `backupInit` and never finalized. The way out of a failed upload,
+   /// and the reason a stalled one need not occupy space indefinitely. Same gate as the rest of the
+   /// write half: owner, or an agent holding `canAppendMemory`.
+   backupAbort: (backupId: text) -> (Result_1);
+   /// Close a backup started by `backupInit` and mark it usable.
+   /// 
+   /// ⚠ ONLY THE CREATOR MAY FINALIZE — `#Refused("Not the creator of this backup")`. An agent
+   /// cannot close an upload someone else began, so a half-finished backup belongs to whoever
+   /// started it.
+   /// 
+   /// Refuses with `#Conflict` when the backup is already finalized, when it is marked failed, and
+   /// when it holds ZERO chunks or zero total size — an empty backup is refused rather than recorded
+   /// as a success, which is the difference between "no backup" and "a backup of nothing".
+   /// 
+   /// It does NOT verify the `sha256` declared at init; see that method for what the digest is and
+   /// is not.
+   backupFinalize: (backupId: text) -> (Result_1);
+   /// Begin a chunked backup upload. Returns the `backupId` every later call in the sequence needs.
+   /// 
+   /// **THE SEQUENCE**, which no individual signature here conveys:
+   /// `backupInit` → `backupPushChunk` × N → `backupFinalize`, or `backupAbort` to discard. A backup
+   /// that is never finalized is not a backup; `backupFinalize` refuses one with zero chunks or zero
+   /// total size rather than recording an empty success.
+   /// 
+   /// ⚠ THE `sha256` IS YOUR DECLARATION, NOT THIS CANISTER'S FINDING. It is taken here, before any
+   /// bytes arrive, stored with the metadata and carried through finalize UNCHANGED — verified at
+   /// the site 2026-08-21: `Backup.finalizeBackup` checks existence, creator, state and non-emptiness
+   /// and does NOT recompute or compare a digest. So it is a commitment a restorer can check the
+   /// bytes against LATER, and it is not evidence the bytes match. Treating it as a canister-verified
+   /// hash is the misreading to avoid — and it is an easy one to reach, because the REGISTRY's
+   /// chunked upload (`engramWasmInit`/`PushChunk`/`Finalize`) has the same shape and DOES verify:
+   /// it hashes the assembled bytes and refuses on mismatch. Same protocol, opposite semantics.
+   /// 
+   /// **TWO DIFFERENT PERMISSIONS GUARD THE TWO HALVES.** Writing (init, push, finalize, abort) is
+   /// owner-or-agent and an AGENT additionally needs `canAppendMemory`; reading
+   /// (`backupPullChunk`) needs `read_backup`. An agent can therefore be able to upload a backup
+   /// and unable to download one, or the reverse, which is the point of splitting them.
+   /// 
+   /// The write half also refuses while writes are PAUSED.
+   backupInit: (dbType: text, backupType: BackupType, parentBackupId:
+    opt text, sha256: text, backupLabel: opt text) -> (Result_43);
+   /// Read one chunk of a finalized backup, by index.
+   /// 
+   /// ⚠ GATED ON `read_backup`, which is NOT the permission the upload half uses — that one is
+   /// `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
+   /// carrying it away are different authorities.
+   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_59) query;
+   backupPushChunk: (backupId: text, chunkIndex: nat, data: blob) ->
+    (Result_1);
+   /// The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
+   /// by name when the agent is unknown or has nothing pending — never a silent success.
+   cancelAgentKeyNomination: (agentKey: principal) -> (Result_1);
+   /// Close a session the caller paid for: settle what was consumed, refund the remainder.
+   /// 
+   /// PAYER-ONLY, enforced inside the gateway. This is the exit that did not exist — `endSession`
+   /// and `forceCloseSession` were on the MARKET, which is withheld, and whose escrow subaccount is
+   /// under a different principal entirely, so its close could never have reached these funds.
+   closeSession: (sessionId: text) -> (Result_1);
+   /// Convert the engram's OWN earned ckUSDC/ckUSDT into its OWN cycles, via the cashier — the
+   /// engram-self top-up path. Owner-only; per-call cap + cooldown (irreversible); NOT freeze-gated
+   /// (infrastructure funding). Flow: read the engram's deposit address on the cashier, move the
+   /// engram's tokens there, then have the cashier convert — the cashier self-authorizes because the
+   /// caller (this engram) is a registered active engram (registry isRegisteredActiveEngram seam).
+   /// (The owner-funded path lives entirely in the frontend: owner → cashier deposit → topUp.)
+   /// ⟨0.16.0, L4 — `token : Text` KEPT, deliberately, and this note exists so the sweep that finds
+   /// it does not re-litigate it.⟩
+   /// 
+   /// `ownerWithdraw` and the market's `recoverEscrow` both took `Wire.TokenAmount` because they
+   /// accept ICP (e8s) BESIDE the stablecoins (e6) — mixed decimals behind one number is a real
+   /// hundred-fold error. This method accepts ckUSDC and ckUSDT only. Both are e6, so there is no
+   /// unit to get wrong, and the census (row 258) rules the pair as `(token, amountE6)`.
+   /// 
+   /// `Wire.TokenAmount` would be actively WORSE here: its `#Icp` arm is a token this path cannot
+   /// convert, so the type would make an unacceptable value REPRESENTABLE and hand back a runtime
+   /// rejection anyway — losing the one property the variant is for while gaining a wider type.
+   /// 
+   /// ⟨2026-10-02⟩ The second parameter is NAMED `amountE6` now, as the census row above rules the
+   /// pair — e6 base units of the token named first. A name only: Candid passes arguments by
+   /// position, so nothing on the wire moved.
+   convertEarningsToCycles: (token: text, amountE6: nat) -> (Result_8);
+   /// Owner-only: mint a single-use invite code an agent redeems with `pairAgent`.
+   /// 
+   /// ⚠ READ THIS BEFORE INVITING SOMEONE BACK. Pairing is ONE-SHOT PER PRINCIPAL on
+   /// this engram: `pairAgent` refuses ANY caller that already holds a record — `#Active`,
+   /// `#Revoked` or `#Resigned` alike — so a principal you have revoked can NEVER redeem another
+   /// invite, however many you mint. That is deliberate, because `revokeAgent` is a soft status
+   /// change and a revoked key talking its way back in would undo it. The remedy is a DIFFERENT
+   /// WALLET; the only thing that clears the record is `resetEngram`, which severs everything else
+   /// too.
+   /// 
+   /// Two caps, each refusing with `#Conflict` and naming its own limit: concurrent ACTIVE agents
+   /// (multi-agent owners legitimately need several — a connector host plus a coding agent), and
+   /// concurrent unexpired INVITES. Neither is a rate limit; both are ceilings you clear by revoking
+   /// or by letting invites lapse.
+   /// 
+   /// A principal that is already a GUARDIAN cannot become an agent — a guardian is an
+   /// independent check on agents, so one wallet must not hold both.
+   createAgentInvite: (name: text, permissions: AgentPermissions) ->
+    (Result_43);
+   /// Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
+   /// co-owner and not a recovery agent.
+   /// 
+   /// ⚠ WHAT A GUARDIAN CAN DO IS EXACTLY THREE THINGS, all of them BRAKES: revoke agents,
+   /// freeze payments, pause writes. That is the whole permission set (`GuardianPermissions`), and
+   /// the three flags are FROZEN — any future permission arrives as a scope string instead.
+   /// 
+   /// ⚠ WHAT A GUARDIAN CANNOT DO, said plainly because the word invites the opposite reading: they
+   /// cannot read memory, cannot move money, cannot transfer ownership, and **cannot recover a lost
+   /// owner key**. A guardian is not a recovery mechanism. An owner appointing one against the day
+   /// they lose access is appointing the wrong thing.
+   /// 
+   /// Two steps, and the invite is only the first: the invitee registers, which leaves them
+   /// `#Pending` and INERT, and `approveGuardian` is what makes them active. A guardian who has
+   /// registered but not been approved can do none of the three.
+   /// 
+   /// ⚠ AN AGENT CANNOT BECOME A GUARDIAN, and the refusal lands at REGISTRATION rather than
+   /// here: this call will happily mint an invite for a principal that already holds an agent
+   /// record, and `registerGuardian` then refuses it with "An agent cannot also be a guardian".
+   /// So an invite that fails to redeem for that reason is not a bad code. The rule exists because
+   /// a check must be independent of the thing it checks.
+   createGuardianInvite: (name: text, permissions: GuardianPermissions) ->
+    (Result_43);
+   /// OWNER-ONLY deletion of a stored backup.
+   /// 
+   /// ⚠ NOT THE SAME GATE AS THE REST OF THE FAMILY, and the asymmetry is deliberate: `backupInit`,
+   /// `backupPushChunk`, `backupFinalize` and `backupAbort` accept an agent holding
+   /// `canAppendMemory`, and `backupPullChunk` accepts one holding `read_backup`. Only the OWNER may
+   /// delete. So an agent can take backups and carry them away and cannot destroy one —
+   /// creating is delegable, destroying is not.
+   /// 
+   /// `backupAbort` is the agent's way out of a failed UPLOAD; it discards something never
+   /// finalized. This removes a finished backup, which is a different act on a different object.
+   deleteBackup: (backupId: text) -> (Result_1);
+   /// ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>`. The receipt was already
+   /// being computed and written into the audit line — `receiptSuffix(r)` — and then discarded, so
+   /// a caller could not cite the seq its own delete produced and had to go looking for it in a log
+   /// it may not be allowed to read. A delete is an EVENT on the chain; an event that will not tell
+   /// you where it landed is evidence nobody can point at. Same projection as writeMemory.
+   deleteMemoryFile: (path: text) -> (Result);
+   /// Owner-only: deny one pending over-limit request, with a `reason` the agent can read.
+   /// 
+   /// The reason is stored on the request rather than discarded, which is the point of taking it —
+   /// an agent told only "denied" retries, and one told why can adapt or stop asking. It is the
+   /// owner's message to whoever raised the request, not an audit-only field.
+   /// 
+   /// Terminal: a denied request cannot be approved afterwards. Like `approveRequest` it refuses
+   /// `#NotFound` for an unknown id and `#Conflict` when the request is no longer pending, and it
+   /// does not change the policy — the next request over the same limit will be raised again.
+   denyRequest: (requestId: text, reason: text) -> (Result_1);
+   /// Force the tECDSA derivation and return the address.
+   /// 
+   /// It exists because the gateway's own derivation fires from a timer that is lazy on some
+   /// replicas, and until it lands the EVM quote advertises the `0x0` fallback and settle fails
+   /// closed — a live money surface quoting an address that cannot receive.
+   /// 
+   /// ⟨0.16.0, B-2⟩ Derivation now comes from `EvmIdentity`, and the return type carries the
+   /// outcome: this used to answer `""` on failure, which is a Text a caller can and did paste into
+   /// a payment flow. An empty string is not an address, and saying so is the difference between a
+   /// failed derivation and an address of nothing.
+   /// 
+   /// ⚠ TRANSITIONAL: it also primes the ic402 gate, because the gate still settles commerce on this
+   /// canister until those 47 methods move. That second call disappears with them — it is listed in
+   /// the move order in the spec's B-2 addendum, not left for someone to find.
+   /// 
+   /// PUBLIC: it inherits `getEvmAddress`'s gate rather than choosing one, and could not usefully be
+   /// narrower — it exists so a caller can make the derivation happen BEFORE a payment flow, and the
+   /// derivation itself is ungated. Idempotent and bounded to the same one-derivation-per-lifetime
+   /// work, so an anonymous caller can cause it once and no more.
+   /// ⟨L7⟩ UPDATE, NOT QUERY, and this one does not merely await — it WRITES. The body awaits
+   /// `EvmIdentity.deriveAddress` (the management canister's `ecdsa_public_key`) and
+   /// `gate.deriveEvmRecipientAt` ⟨renamed 2026-09-22 with the path⟩, then caches the result in `evmAddressCache`. So a query is
+   /// impossible twice over: it could not await the derivation, and it could not keep the answer.
+   /// Named `ensure*` rather than `get*` for that reason — the write is the point, and a read verb
+   /// would have promised a cheapness this cannot deliver.
+   /// 
+   /// ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
+   /// the site.⟩
+   ensureEvmReady: () -> (Result_43);
+   /// Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
+   /// 
+   /// This is the receipt ledgerfs Q2 requires before any of those entries may be condensed away.
+   /// The canister cannot know the owner KEPT the bytes it served — it can only prove they were
+   /// SERVED — and `opsRoot` is what makes a kept copy verifiable forever afterwards. Keep it with
+   /// the archive; without it the download is just bytes.
+   /// 
+   /// NOT gated on requireWritesNotPaused, deliberately. A guardian pause is an emergency brake on
+   /// changing the record; an export changes nothing about the files and only appends its own
+   /// attestation. Trapping the owner's own data behind the brake would make the pause a hostage
+   /// situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
+   /// failed its integrity check must not attest anything it cannot vouch for.
+   exportMemoryRange: (fromSeq: nat, toSeq: nat, authorFilter:
+    opt principal) -> (Result_66);
+   /// ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
+   /// The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
+   /// case — the guardian is the exceptional one. A name that says otherwise sends an owner looking
+   /// for a method that does not exist. `unfreezePayments`, its owner-only inverse, never carried the
+   /// prefix, so the pair read as unrelated.
+   /// 
+   /// WHAT THE FREEZE ACTUALLY COVERS ⟨enumerated 2026-08-21 from the eight `requirePaymentsNotFrozen`
+   /// call sites, because it was written down nowhere and had to be re-derived to be trusted⟩:
+   /// 
+   ///   · EVERY SIGNING PATH, which is the point of the brake. `signX402Payment` and
+   ///     `sysSignX402Payment` through `x402SignFor`; `signEip712` and `sysSignEip712` through
+   ///     `eip712SignFor`; `signEngramRegistration` directly. ⟨The two helpers are why a grep of an
+   ///     individual method's body finds nothing — the check is one level down.⟩
+   ///   · `addEip712Type` and `addEvmWithdrawDestination` — pre-staging for a later payout is the
+   ///     thing a brake most needs to stop, so the destination list is frozen along with the signing.
+   ///   · `sessionReadMemory` and `sessionAppendMemory` — the paid-memory rail, money coming IN.
+   /// 
+   /// AND WHAT IT DELIBERATELY DOES NOT, stated so the absence is not read as an oversight:
+   /// 
+   ///   · `convertEarningsToCycles` — the owner's OWN earnings becoming their OWN engram's fuel. A
+   ///     frozen engram still burns cycles, so freezing this would let a brake starve the thing it
+   ///     is protecting. Owner-only, capped per call, and it moves nothing outward.
+   ///   · `approveRequest` — an approval is not a spend. The spend it authorises goes through
+   ///     `x402SignFor`, which IS frozen, so an approval granted during a freeze simply waits.
+   ///   · `transferOwnership` — ownership is not a payment, and a guardian's PAYMENTS brake is not
+   ///     a veto on who owns the engram.
+   /// 
+   /// ⚠ The three exclusions are a reading of intent, not a ruling: no declaration stated the scope
+   /// before this one. If any of them is wrong, this comment is where the argument should happen.
+   freezePayments: () -> (Result_1);
+   /// Delivery status + config readback. Owner-only (the URL is a secret).
+   getActionAlertStatus: () -> (Result_57) query;
+   /// Agents need to know what they may revise, so they can read it too. Whole-value config, same
+   /// carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
+   /// protected path and a revisable path are opposite grants, and one accessor for both would be a
+   /// name that lies about which power it reports.
+   /// 
+   /// Refusal reason preserved from the trap: a grant is a power, and its absence and its
+   /// concealment are different facts.
+   getAgentRevisablePaths: () -> (Result_53) query;
+   /// OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
+   /// paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
+   /// of the last one, and how many were produced. Never an amount, a recipient or a nonce.
+   /// 
+   /// WHY THE OWNER ALWAYS READS IT: these are the rows the metrics reader the registry designated may
+   /// read (`sysGetAgentSeatWeeks`), and an owner deciding whether to leave that read on must be able
+   /// to see exactly what it is handed. The reader's rows are these rows without the root, in the same
+   /// order. Anyone else is refused by name (`#Refused getAgentSeatWeeks: …`), never answered with an
+   /// empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
+   /// Two rows can name one root: an agent paired again after it left is a second engagement.
+   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_64) query;
+   /// Owner: everything written into this engram by someone other than the owner since the last
+   /// markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
+   /// qualifiesForReview for why those two families are recognised differently).
+   /// `capped=true` means exactly 200 rows were returned and MORE unreviewed writes exist beyond
+   /// them — the UI must page (markAgentWritesReviewed(?lastShownId)) and must NOT present 200
+   /// as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
+   /// aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
+   getAgentWriteReview: () -> (Result_63) query;
+   /// Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
+   /// engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
+   /// and none of these fields is a secret — `total` is already public via getCertifiedAuditHead.
+   /// See the field comments above for how to read the combinations.
+   getAnchorPushStatus: () -> (AnchorPushStatus) query;
+   /// The plain chain head — size and hash, world-readable, no certificate.
+   /// 
+   /// ⟨0.16.0, census `keep (NEW)`⟩ It was specced and never built. `Wire.AuditHead`'s own
+   /// declaration says why it matters: heads exist TO BE COMPARED (L8), a head nobody can read
+   /// witnesses nothing, and the registry and cashier already served exactly this shape — so the
+   /// engram, "the canister that IS the evidence product", was the one chain a verifier could not
+   /// ask for a head without also asking for a certificate it may not want.
+   /// 
+   /// PUBLIC: bare, and it cannot refuse — a chain head discloses nothing about content or callers,
+   /// and gating it would make the comparison it exists for depend on permission. `getCertifiedAuditHead`
+   /// below serves the same head WITH the subnet certificate for a caller that needs to verify it
+   /// was signed rather than asserted.
+   getAuditHead: () -> (AuditHead) query;
+   getBackupMetadata: (backupId: text) -> (Result_62) query;
+   /// The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
+   /// 
+   /// PUBLIC: a payer about to send money needs to know which cashier this engram will accept credit
+   /// from, BEFORE sending it — paying a cashier this engram does not recognise collects funds that
+   /// never become rent. The registry publishes the same fact as `getRentBiller`; publishing it here
+   /// too is what lets the two be COMPARED, which is the only way to catch a mismatch.
+   getBillerId: () -> (opt principal) query;
+   /// ⟨0.16.0, L9/L10 — census row⟩ `Wire.CertifiedAuditHead`, not an anonymous record. The
+   /// registry, market and cashier already served the shared type; the engram — the canister that
+   /// IS the evidence product — was the one chain still answering in a shape of its own, missing
+   /// `witness` entirely. One certified-head shape on every chain is the point: a verifier that can
+   /// read three of them and not the fourth has to special-case the one that matters most.
+   /// 
+   /// `witness = null` is the honest answer here and is NOT the same as an empty proof. This engram
+   /// certifies its head via `CertifiedData` but keeps no witness tree, so there is no reveal to
+   /// encode; `?Blob` lets it say "I do not serve a proof" rather than fabricate one.
+   /// 
+   /// PUBLIC: the certificate is the point — it lets a stranger verify against the NNS root key
+   /// instead of trusting this replica, and a proof that requires a role to fetch rests on exactly
+   /// the authority it was introduced to remove.
+   getCertifiedAuditHead: () -> (CertifiedAuditHead) query;
+   /// The allowance of the agent holding `agentPrincipal`: its lasting key and the openings left.
+   /// Readable by the owner and by that agent's own key — refused loudly to anyone else, never a zero
+   /// (a zero would be a claim about another owner's grant).
+   /// 
+   /// ⟨2026-10-01, review F2⟩ A QUERY, so the refusal is deliberately NOT written to the denial log: a
+   /// query's state writes are discarded when it returns, and the `denied` call first written here
+   /// recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
+   /// WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
+   getChildAllowance: (agentPrincipal: principal) -> (Result_61) query;
+   /// Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
+   /// agent's request is refused, the balance now, and every agent's allowance. The console's cost
+   /// sentence reads it. Cycles are owner-class information, as on the owner's console read.
+   getChildOpening: () -> (Result_60) query;
+   /// Derive the shared memory-encryption key, encrypted under the caller's transport
+   /// public key. Gated to owner + read-agents (the same principals allowed to read
+   /// memory). The client decrypts it locally with its transport secret key.
+   /// ⟨0.16.0⟩ THE FOLD: `epoch` is now an optional argument here, and the separate
+   /// `getEncryptedMemoryKeyForEpoch` is gone. Two methods differing only by whether one parameter
+   /// is present is what an optional argument is for, and the split forced a client to decide which
+   /// to call before it knew whether it needed rotation.
+   /// 
+   /// `null` means CURRENT — not epoch 0. Those coincide today (nothing increments the epoch yet)
+   /// and will not after the first rotation, which is exactly when a caller that meant "the key that
+   /// seals my memory now" must not silently receive a superseded one. `?0` still names epoch 0
+   /// explicitly for a client rebuilding an old cache entry.
+   /// 
+   /// Refusing a FUTURE epoch is not a bounds check, it is the rotation invariant: pre-deriving a
+   /// key for an epoch nobody has reached would make rotating to it meaningless.
+   /// 
+   /// Also converted off the lowercase `#ok/#err` dialect (L5) — that spelling arrived from ic402
+   /// and had no business on a vetKD path, which touches nothing of ic402's.
+   /// 
+   /// ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   /// `VetKeys.ManagementCanister.vetKdDeriveKey`. A query cannot await, so the round trip is the
+   /// cost. Stated here because L7 requires the reason be readable from the interface rather than
+   /// inferred by opening the body — which is exactly what had to happen to write this line.
+   getEncryptedMemoryKey: (epoch: opt nat, transportPublicKey: blob) ->
+    (Result_59);
+   /// ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
+   /// 
+   /// The card's config hardcodes `x402Support = true`, answering a buyer's question with a fact
+   /// about the software rather than about THIS engram. B1 moved the 402 challenge machinery to the
+   /// market; the one x402-payable rail the engram kept is `sessionReadMemory`, gated by
+   /// `paidMemoryReadEnabled`, which DEFAULTS TO FALSE. So a discovering agent was told this engram
+   /// takes x402 payments while every paid read on a default engram is refused with "the owner has
+   /// not opened the monetized read rail". Ruled (a) over keeping `true` to mean "can PARTICIPATE in
+   /// x402, including as a payer" — defensible, but not what a service card says to a buyer.
+   /// 
+   /// Overridden HERE rather than at the config because the card is built once as a `public let`
+   /// while the flag is runtime state, and `getCard()` belongs to the VENDORED ic402 module, which
+   /// is not ours to edit.
+   /// 
+   /// ⚠ `signEngramRegistration` also reads `getCard()` and is deliberately NOT changed. It signs an
+   /// ERC-8004 registration for on-chain publication — a point-in-time attestation nobody can
+   /// re-sign every time an owner opens or closes the rail. Whether a signed record should carry
+   /// mutable operational state at all is a different decision, it is signing-adjacent, and the
+   /// ruling did not reach it. Filed, not folded in.
+   /// 
+   /// PUBLIC: an agent card is a DISCOVERY document — its entire function is to tell a party that
+   /// has never met this engram what it is and how to transact with it. A card behind a gate cannot
+   /// be discovered, and the ERC-8004 ecosystem it participates in assumes an open read.
+   getEngramCard: () -> (AgentCard) query;
+   /// PUBLIC: the engram's permanent spawn ordinal — a provable, non-sensitive fact. It identifies a
+   /// canister, never a person.
+   /// null = spawned before numbering existed; the owner can backfill via syncEngramNumber().
+   getEngramNumber: () -> (opt nat) query;
+   /// Re-pointed at `EvmIdentity` (B-2): custody derivation no longer routes through the ic402
+   /// Gateway, which is leaving for the market canister. Behaviour is unchanged for a caller — same
+   /// address, same tECDSA key — but the engram no longer needs a marketplace to know its own
+   /// address, which is the whole point of the split.
+   /// 
+   /// ⟨2026-08-21⟩ DO NOT FOLD THIS WITH `getEvmSignerAddress`. The 0.16.0 census carried the fold
+   /// as an open item, conditional on "if the derivation is identical". It is not, and the condition
+   /// is decidable here rather than by reading either comment:
+   /// 
+   ///   this method   EvmIdentity.deriveAddress  ->  derivation_path = []
+   ///   the signer    eip712PublicKey            ->  derivation_path = ["eip712"]
+   /// 
+   /// ⟨CORRECTED 2026-09-22 — the two paths above are what the code passed until KEY-PATHS §4 step 5;
+   /// the table is kept because the ARGUMENT it makes is unchanged and is the reason the fold is
+   /// still refused.⟩ The signer now reads `KeyPaths.EIP712` = `["engramx","eip712","secp256k1","v1"]`
+   /// and this method still derives at the empty path, because `pay` is the one row the genesis could
+   /// not move — ic402 2.15.0 parameterises `EvmSigner` but not `Gateway.deriveEvmRecipient`,
+   /// `EvmSender` or `Identity`, and moving the signer without them would split receiving from
+   /// spending. The paths are still DIFFERENT, which is the whole of the argument below, and they get
+   /// further apart at the genesis rather than closer.
+   /// 
+   /// ⟨SHIPPED 2026-09-22, ic402 2.16.0 — the table is now BOTH rows labelled, and the argument is
+   /// unchanged, which is the point of keeping every version of it here:
+   /// 
+   ///   this method   EvmIdentity.deriveAddress  ->  KeyPaths.PAY    = ["engramx","pay","secp256k1","v1"]
+   ///   the signer    eip712PublicKey            ->  KeyPaths.EIP712 = ["engramx","eip712","secp256k1","v1"]
+   /// 
+   /// Two paths, one master key, therefore two addresses — exactly as when one of them was `[]`.
+   /// The fold stays refused for the reason below, not because one side happened to be a default.
+   /// What changed upstream is that `Gateway`, `EvmSender` and `Identity` all take a path now, so
+   /// the payment identity could move as ONE thing: this derivation, the gateway's inbound
+   /// recipient and outbound sender, and `Payments.evmSigner`. The genesis install derives them.⟩
+   /// 
+   /// Same master key and curve, different paths, therefore different public keys and DIFFERENT
+   /// ADDRESSES — that is what a derivation path is for. The difference is also deliberate and
+   /// security-bearing, not incidental: the signer key is declared "outbound-only, N=1, never the
+   /// payment path — this key must never be able to move ic402 pool funds", so merging the two
+   /// would hand the signing surface the payment key. `getEvmSignerAddress` carries the warning
+   /// from its side ("the payment key's address is NOT this one, by design"); this is the other
+   /// side, because a fold is proposed by whoever reads either declaration first.
+   /// 
+   /// The gates differ too, which a fold would also have to collapse: this method is UNGATED (any
+   /// caller may cause the derivation) and `getEvmSignerAddress` is owner-only.
+   /// 
+   /// PUBLIC: an address is a destination, not a capability — publishing it lets anyone PAY this
+   /// engram and lets nobody spend from it. It has to be readable by a stranger because a stranger
+   /// is exactly who needs it. The write it causes is bounded to one derivation and one
+   /// set-once custody stamp per engram lifetime, which is what keeps "any caller may cause it"
+   /// safe rather than merely permitted.
+   /// ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   /// `EvmIdentity.deriveAddress`, which reaches the management canister's `ecdsa_public_key`. A
+   /// query cannot await it.
+   /// 
+   /// ⟨Marker added 2026-08-23; the census row already said "L7 marked (ecdsa_public_key)" and the
+   /// site did not carry the mark. Same `public func` form as its two neighbours above.⟩
+   /// 
+   /// ⟨2026-09-28⟩ THE REPLY IS A RECORD, `Types.EvmAddresses` — the payment address (`pay`, what this
+   /// method returned alone until then) and the address that signs the engram's own registrations
+   /// (`engramRegistration`). The owner decided that date to publish the registration address as a new
+   /// field on an existing address reply, not as a new method; nothing served it before, so an
+   /// agent could not read the address whose nonce `signEngramRegistration` needs and whose ETH
+   /// pays its gas. The registration address is read FROM THE SIGNER ITSELF
+   /// (`engramRegSigner.getEvmAddress`), not re-derived beside it, so the published address is by
+   /// construction the one the signatures come from. It is cached inside that signer object; the
+   /// cache is not stable, so the first call after an upgrade re-derives it once — the same one
+   /// public-key read, bounded, that the payment branch does on a null cache.
+   /// 
+   /// It refuses rather than half-answers: if either address cannot be derived the reply is
+   /// `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
+   /// failed derivation — that is fail-to-empty on a money surface, and it stops here).
+   getEvmAddress: () -> (Result_58);
+   /// The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
+   /// the address this canister derives for itself.
+   /// 
+   /// PUBLIC: an address is a public identifier on every chain it exists on; it is a destination,
+   /// not a capability, and knowing it confers nothing. `null` means the owner registered none,
+   /// which a payer needs to be able to tell from an address they failed to read.
+   getEvmOwnerAddress: () -> (opt text) query;
+   /// D1 ships with this: the address of the DEDICATED signing key. Without it the owner funds the
+   /// wrong address — the payment key's address is NOT this one, by design.
+   /// 
+   /// ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: `eip712PublicKey()` awaits
+   /// the management canister's `ecdsa_public_key`. A query cannot await, so the round-trip is the
+   /// cost — stated here because L7 requires the reason be readable from the interface rather than
+   /// inferred by opening the body.
+   getEvmSignerAddress: () -> (Result_43);
+   /// PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
+   /// 
+   /// The fourth of the four evidence methods (`getAuditHead`, `getCertifiedAuditHead`,
+   /// `listAuditEntries`, this) that every chain canister now serves in the same shape. Ungated for
+   /// the same reason the head is: a verifier who must ask permission to learn where a chain starts
+   /// cannot verify it, and nothing here identifies anybody.
+   getGenesisNote: () -> (GenesisNote) query;
+   /// A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
+   getGuardianAlertStatus: () -> (Result_57) query;
+   /// The market this engram will accept signing requests from — `null` until the registry pushes
+   /// one at spawn, which is why `requireMarket` refuses fleet-wide today.
+   /// 
+   /// PUBLIC: this is the whole of what stands between a stranger and this engram's signing key. A
+   /// counterparty evaluating an engram's market claim has to be able to read which market it is
+   /// pinned to, and `null` — "pinned to nobody, so it signs for nobody" — is the most important
+   /// answer it can give.
+   getMarketId: () -> (opt principal) query;
+   /// FD, the one coordinated interface break: history no longer carries per-version CONTENT.
+   /// 
+   /// The legacy shape returned a full snapshot of every version, which is what made history cost
+   /// O(total bytes ever written) and forced a per-version truncation cap that silently mangled
+   /// large files. What a reader gets now is the COMMITMENT — size and content root per version —
+   /// and content is read per version through readMemoryBytes, verified as it is served.
+   /// 
+   /// Two deliberate shape changes beyond dropping the bytes:
+   /// 
+   ///   * it is a RESULT. The old surface returned `[]` for "no such file", "you may not read
+   ///     this", and "this file genuinely has no history" alike — a gated empty indistinguishable
+   ///     from a real one, which is the exact failure class this store exists to end. A refusal
+   ///     now says so.
+   ///   * the counts ride along. `everCount` vs `retainedCount` makes byte eviction impossible to
+   ///     hide: a reader who sees them differ knows something was reclaimed, and `evictions`
+   ///     carries the disclosure — chain sequence and evicted root — for each range.
+   /// 
+   /// Paging is by version number, which works as its own cursor because versions are dense and
+   /// never renumbered: the next page starts at the last version returned plus one. Defaults
+   /// return the whole history of any file a pre-FD engram could have held.
+   getMemoryHistory: (path: text, start: opt nat, max: opt nat) ->
+    (Result_56) query;
+   /// PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
+   /// history would be a public, fleet-enumerable feed of when each owner terminated a trust
+   /// relationship — readable by, among others, the party just terminated.
+   getMemoryKeyEpoch: () -> (nat) query;
+   /// BLS verification key for the shared memory-encryption key. Used by the
+   /// client to verify the derived key. Static per (context, key_id) — cacheable.
+   /// 
+   /// PUBLIC: intentionally unauthenticated — a vetKD public key reveals nothing secret and
+   /// cannot decrypt anything — the sensitive derivation is getEncryptedMemoryKey
+   /// below, which IS gated (read_memory) and returns key material encrypted to the
+   /// caller's transport key. Do not add an auth guard here (breaks client caching).
+   /// ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   /// `VetKeys.ManagementCanister.vetKdPublicKey`. A query cannot await, so the round trip is the
+   /// cost of getting a key nobody has to trust us for — which is the point of publishing it.
+   /// 
+   /// ⟨Marker added 2026-08-23; the census row already said "L7 (vetKD pubkey call)" and the site did
+   /// not carry it. Declared `public func` rather than `public shared`, which is why the naming rule
+   /// in check-update-for-read.mjs did not see it — the census population did.⟩
+   getMemoryKeyVerificationKey: () -> (blob);
+   /// Memory maintenance liveness. PUBLIC: ungated on purpose, like the anchor-push status — a stalled
+   /// sweep or a failed storage check is exactly what a third party must be able to observe, and
+   /// a gated read that failed to empty would report a healthy zero to anyone without a role.
+   /// Counts and flags only — the paths involved are in the chained audit entries, where the
+   /// access rules that govern them already apply.
+   getMemoryMaintainStatus: () -> (MemoryMaintainStatus) query;
+   /// The DECLARED policy. Read it together with getMemoryRetentionGuards — on its own it is not
+   /// what governs eviction.
+   /// ⟨0.16.0⟩ ONE PROJECTION, absorbing what were two methods — and the fold is a correctness fix,
+   /// not tidying.
+   /// 
+   /// Declared policy and the guards holding it back were separate reads, and a console rendering
+   /// only the first told an owner their policy was in force while a guard still held it. The old
+   /// `.did` warned in prose that the two had to be read TOGETHER; a comment is not a mechanism, and
+   /// the guard arms on the FIRST policy an owner ever sets — so the surface misled every owner who
+   /// ever touched retention, from first use. Making it one record makes reading half of it
+   /// impossible: the trap becomes structure.
+   /// 
+   /// Refusal reasons of both merge: an empty policy reads as "nothing is capped, every version kept
+   /// forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
+   /// "nothing is held back".
+   getMemoryRetentionPolicy: () -> (Result_55) query;
+   /// The metrics reader this engram answers — `null` until the spawning registry names one.
+   /// 
+   /// PUBLIC: an owner deciding whether to switch the read off needs to know who it is, and anyone
+   /// comparing this engram's copy with the reader the registry publishes (`getMetricsReader` there)
+   /// needs the same value. A canister id is not a secret.
+   getMetricsReaderId: () -> (opt principal) query;
+   /// A guardian asking about their OWN standing.
+   /// 
+   /// #NotFound and not #Refused, deliberately, even though this reads a roster no stranger may
+   /// see: the only row it can ever return is the caller's own, so "you are not a guardian here" is
+   /// a fact about the caller, told to the caller. There is nothing to leak by omission — which is
+   /// the test the #NotFound arm sets.
+   getMyGuardianStatus: () -> (Result_15) query;
+   /// ⟨0.16.0, NEW⟩ The gated half of the status() split.
+   /// 
+   /// Every field is bare — no masking, no `authorized` discriminator — because reaching this record
+   /// AT ALL is the authorization. An unauthorized caller gets `#Err(#Refused …)` and no record.
+   /// 
+   /// `cyclesBalance` is a bare `Nat`, and that retires an argument this repo carried for weeks. It
+   /// was `nat`, then widened to `opt nat` so a refusal could be `null`, which broke every published
+   /// client (rule 4) and bought a masked answer nobody had asked for — the census could not even
+   /// find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
+   getOwnerConsole: () -> (Result_54) query;
+   /// Owner + agents only (agents need it to avoid writing protected paths).
+   /// 
+   /// A NAMED RECORD, not a Page: the setter replaces this list wholesale, so there is no window to
+   /// page over and no `total` that could differ from `items.size()`. Forcing the Page shape here
+   /// would be uniformity for its own sake — the census ratified the whole-value-config carve-out
+   /// precisely so L3 does not become a rule applied past its meaning.
+   /// 
+   /// The trap's `whyNotEmpty` clause is preserved as the `#Refused` reason: `[]` would read as "no
+   /// path on this engram is protected", and an agent consults this list precisely to avoid
+   /// writing one — so a fabricated empty here does not merely misinform, it invites the write the
+   /// list exists to prevent.
+   getProtectedPaths: () -> (Result_53) query;
+   /// Whether the metrics reader's read is answered — `true` from birth.
+   /// 
+   /// PUBLIC: the promise that an owner can switch this read off can be checked only if the switch
+   /// can be read — the reason the reader pointer is public too. It discloses one setting, never a row.
+   getSeatWeeksReadEnabled: () -> (bool) query;
+   /// Owner-only, Billing-class: the signing floor, the balance, one signature's price, and how many
+   /// payment signatures the balance carries above the floor before `signX402Payment` is refused by
+   /// name. The same numbers the check uses, so Billing can say only what the engram enforces.
+   getSigningFloor: () -> (Result_52) query;
+   /// The registry that spawned this engram, if it recorded one.
+   /// 
+   /// PUBLIC: it is the provenance claim. An engram asserting it is part of a fleet, under that
+   /// fleet's attested template and rent rail, is asserting something a stranger must be able to
+   /// check against the registry named here — and a provenance you need permission to read is not
+   /// provenance. `null` says this engram makes no such claim, which is equally worth serving.
+   getSpawnedBy: () -> (opt principal) query;
+   /// Read the engram-wide daily ceiling and what has been spent against it today, across every
+   /// caller. ⟨2026-09-28, the owner's decision to add the ceiling⟩
+   /// ⟨CORRECTED 2026-09-29, review finding X-8: "spent" means signed in x402 payments; typed-data
+   /// and the engram's registration signatures are not counted here — see `setSpendCeiling`.⟩
+   /// 
+   /// OWNER-ONLY, for the reason `getSpendPolicy` is: the limits are the owner's custody
+   /// configuration, and the engram-wide total would also tell one agent how much the others spent.
+   /// A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
+   /// "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
+   getSpendCeiling: () -> (Result_51) query;
+   /// Read the caps in force for a caller.
+   /// 
+   /// OWNER-ONLY, and this is where it diverges from the market's inbound twin, which is public.
+   /// There the limits ride inside every 402 challenge, so withholding them would hide nothing.
+   /// Here the engram serves no 402s at all: these caps are the owner's private custody
+   /// configuration, and publishing them would tell any caller exactly how large a signing request
+   /// can be before it needs an approval nobody is watching for.
+   getSpendPolicy: (caller: opt principal) -> (Result_50) query;
+   getStorageStats: () -> (Result_49) query;
+   /// Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
+   /// and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
+   /// leaks nothing (booleans about our own scheduling).
+   /// 
+   /// IDLE STEADY STATE (no webhook, no x402 sessions, no service jobs):
+   ///   alertTimerArmed=false  sessionExpiryArmed=false  jobExpiryArmed=false  jobExpiryFastMode=false
+   /// 
+   /// ⚠ CORRECTED 2026-08-19. This said `jobExpiryArmed=TRUE` and that it "stays true by design —
+   /// ic402 keeps an hourly idle POLL because createJobFromReceipt is synchronous and cannot disarm a
+   /// timer itself". Both halves are stale, and an ops reader comparing a live engram against this
+   /// paragraph would have seen `false` and gone looking for a fault that is not there.
+   /// 
+   /// The engram sets `setExpiryIdlePollSeconds(0)` in its actor body, and ic402's ServiceRegistry
+   /// CANCELS the timer outright at 0 rather than re-arming it — so the hourly tick this paragraph
+   /// promised has not existed since that line landed. Independently, B1 moved job creation to the
+   /// market: the engram now serves no job method at all, so nothing can arm the timer in the first
+   /// place. `jobExpiryArmed` reads false on an idle engram, and false is CORRECT.
+   /// 
+   /// EXPECTED FALSE POSITIVE: for up to one interval after any install or upgrade,
+   /// sessionExpiryArmed reads true with zero sessions. ic402's startTimers arms unconditionally
+   /// because a persistent actor re-runs its init body BEFORE postupgrade restores stable sessions,
+   /// so a predicate-gated arm would skip exactly the canisters that have live ones. The first tick
+   /// disarms it. Still true minutes after an upgrade is a real bug — report it upstream.
+   /// NOT the whole timer story. The hourly CYCLE timer — which also carries audit anchoring — is
+   /// deliberately absent: it is a `transient let` armed unconditionally at init, so an "armed"
+   /// boolean for it would read true forever and tell you nothing, exactly the false-positive the
+   /// paragraph above describes for sessionExpiryArmed. Use getAnchorPushStatus() instead: last-tick
+   /// TIMESTAMPS are evidence where an arm flag is only an intention.
+   /// 
+   /// PUBLIC: the same standing as the two liveness reads above. Booleans and timestamps about this
+   /// canister's own timers — nothing about content, callers or money — and a liveness signal only
+   /// its owner can read cannot tell a third party that the engram is still running.
+   getTimerHealth: () -> (TimerHealth) query;
+   /// PUBLIC: a cap identifies no user, and a caller deserves to know the rule before it stops them.
+   /// 
+   /// ⟨0.16.0, L8⟩ Was owner-gated behind a trap. The disclosure law asks what the value reveals, and
+   /// the answer here is nothing about anybody — it is a policy ceiling, not a balance or a history.
+   /// Publishing it removes the trap AND the envelope: an ungated read has no refusal to carry, so
+   /// wrapping it in `Result` would be ceremony that implies a gate exists.
+   /// 
+   /// Predictability is itself the honesty posture: a limit that only reveals itself by refusing a
+   /// top-up teaches the caller by failure. `/// PUBLIC:` is the marker the L8 gate greps for.
+   getTopUpLimits: () ->
+    (record {
+       cooldownSeconds: nat;
+       maxCkusdcE6s: nat;
+     }) query;
+   /// ⟨0.16.0⟩ `walletBalance()` DELETED — a ONE-LETTER trap beside `walletBalances()`, and a strict
+   /// projection of it: it returned `ExperimentalCycles.balance()`, which is `WalletBalances.cycles`.
+   /// 
+   /// Two methods whose names differ by a single character, with the same gate and one a subset of
+   /// the other, is a call site waiting to be written wrong — and wrong in the direction that
+   /// silently reads cycles when it meant to read money. Doc callers (CLI-REFERENCE, Docs.vue) sweep
+   /// to the survivor.
+   /// RENAMED from `walletBalances` (L2.1: `get*` for a single value).
+   /// 
+   /// Stays an UPDATE, marked per L7: it awaits three ICRC-1 ledgers. The name cannot say that, so
+   /// the declaration does — a caller budgeting round-trips needs to know this is not a query.
+   /// 
+   /// The ledger failure is `#Unavailable`, not `#Invalid`: a dependency refused or timed out, the
+   /// request was fine, and retry is the correct response. That is the one arm in the whole set that
+   /// means "try again", and it is the reason `Error` is a closed variant rather than a sentence.
+   /// 
+   /// ⟨L7⟩ MARKER ADDED 2026-08-23, reasoning above UNCHANGED — this block already said "Stays an
+   /// UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
+   /// to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
+   getWalletBalances: () -> (Result_48);
+   /// Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
+   /// read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
+   /// engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
+   /// fabrication is indistinguishable from the truth by construction.
+   getWorldIdConfig: () -> (Result_47) query;
+   /// ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
+   /// `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
+   /// query can do none of them.
+   /// 
+   /// Owner-only: produce a World ID 4.0 relying-party context for the frontend's IDKit request.
+   /// Valid iff the derived signer address (getWorldIdRpSignerAddress) is registered for this rp_id in
+   /// the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
+   /// it authorizes opening one verification request, nothing else.
+   getWorldIdRpContext: () -> (Result_46);
+   /// Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
+   /// "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
+   /// Portal — the engram never holds or exports a private key (only threshold shares exist, on the
+   /// subnet). Distinct from the payment/EVM address by construction.
+   /// 
+   /// ⟨L7⟩ UPDATE, NOT QUERY, for TWO reasons and the second is the one a reader would miss. It
+   /// awaits `worldIdRpPublicKey()` (management `ecdsa_public_key`), and it calls `denied()` on
+   /// refusal — a state write, which a query cannot perform. So even if the key were cached this
+   /// could not become a query without silently retiring its denial record (ADR-0002's class).
+   getWorldIdRpSignerAddress: () -> (Result_43);
+   /// The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
+   /// artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
+   /// `Result<opt Text>` — and the double wrapper is the entire point, not redundancy.
+   /// 
+   /// `#Ok(null)` means HONEST ABSENCE: no verification is on record, and you were entitled to ask.
+   /// `#Err(#Refused …)` means you may not ask. Under the old bare `?Text` those two collapsed into
+   /// one `null`, so a caller lacking a grant was told an unverified human stands behind this engram
+   /// — a false claim about a person, produced by an authorization failure.
+   /// 
+   /// The artifact stays role-gated because it carries the NULLIFIER. The public, anonymous answer to
+   /// "is a human behind this engram" is `about().verifiedHuman`, which is a boolean and leaks
+   /// nothing.
+   /// 
+   /// ⟨CORRECTED 2026-08-21 — this said `metrics().verifiedHuman`, and `metrics()` no longer exists:
+   /// L2.2 folded it and `status()` into `about()`, which carries the field. The sentence is a
+   /// `///`, so the dead name was PUBLISHED in engram.did and pointed every client at a method the
+   /// canister does not serve. The tombstones below and at `about()` are historical and correct as
+   /// written; this one was present tense, which is the difference that matters.⟩
+   getWorldIdVerification: () -> (Result_45) query;
+   /// ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
+   /// absence of a `#Conflict` here is the point: these are the calls someone makes while something
+   /// is going wrong, and the only two answers that help are "you may not do this" and "there is
+   /// nothing by that name". A missing PERMISSION is `#Refused` rather than `#Conflict` — the
+   /// guardian's standing is what fell short, and no change to engram state would let them through.
+   guardianRevokeAgent: (agentPrincipal: principal) -> (Result_1);
+   /// The HTTP surface: canister-info JSON, OAuth discovery documents, and the MCP route's query
+   /// half. See the `http_request_update` twin below for what upgrades and why.
+   /// 
+   /// PUBLIC: not a choice. The boundary node invokes this for every inbound HTTP request with no
+   /// caller identity to gate on, so a gate here would refuse the only caller there is. Authorization
+   /// lives INSIDE, per route — `/mcp` demands a bearer token, the discovery documents are meant to
+   /// be world-readable by their own specs, and the canister-info JSON serves only facts already
+   /// published by the queries above it.
+   http_request: (request: HttpRequest) -> (HttpResponse) query;
+   /// The update twin of the router above — the routes the query half UPGRADES so their responses
+   /// are consensus-certified and served on the certified hostname.
+   /// 
+   /// PUBLIC: for the same reason as its twin, and it must match. A route the query half upgrades
+   /// but this half does not handle falls through to the 404 at the end, turning a serving fault
+   /// into what reads as a wrong URL — half a fix being worse than none, as the /oauth/authorize
+   /// arm inside records.
+   http_request_update: (request: HttpRequest) -> (HttpResponse);
+   /// ⟨0.16.0⟩ `isPaidMemoryReadEnabled()` DELETED — folded to `about().paidMemoryReadEnabled`
+   /// (L2.6: one idiom for a boolean feature — a setter plus the flag on its family's projection).
+   /// Its callers are a buyer's pre-check and the market canister, both ANONYMOUS, so the public
+   /// projection is exactly where it belongs.
+   /// PUBLIC: a wallet calls this BEFORE its user has any standing on this engram — that is what the
+   /// call is for — so gating it would make the message unreadable at exactly the moment it is
+   /// needed, and a signature given without it is a signature given blind.
+   icrc21_canister_call_consent_message: (request:
+    record {
+      arg: blob;
+      method: text;
+      user_preferences: record {};
+    }) ->
+    (variant {
+       Err: record {
+              description: text;
+              error_code: nat;
+            };
+       Ok:
+        record {
+          consent_message: variant {GenericDisplayMessage: text;};
+          metadata: record {
+                      language: text;
+                      utc_offset_minutes: opt int16;
+                    };
+        };
+     }) query;
+   /// Owner-only: is the derived EVM address CACHED right now, without deriving it to find out.
+   /// 
+   /// WHY A SEPARATE METHOD AND NOT A FIELD ON `getEvmAddress`. That method cannot answer this
+   /// question by construction: when the cache is null it DERIVES, caches the result and returns it,
+   /// so by the time a caller sees the reply the cache is populated either way. Asking it whether the
+   /// cache had been populated changes the answer.
+   /// 
+   /// WHY IT EXISTS AT ALL, since a public surface is never free on a canister meant to go public.
+   /// `evmAddressCache` is money-classed and its annotation says why: derivation is deterministic, so
+   /// a lost cache LOOKS harmless, but until something re-derives, the EVM payment quote advertises
+   /// the fallback — an address that cannot receive. A window in which a live money surface publishes
+   /// an unreceivable address is a money defect, not a cache miss. Nothing else in this canister
+   /// reads that var — one reader and two writers, all in this file — so before this method there was
+   /// no observation anywhere that could tell a survived cache from a rebuilt one, and the upgrade
+   /// coverage gate carried a money-classed var nothing could prove.
+   /// 
+   /// ⚠ IT MUST NEVER DERIVE. A version that fell back to deriving would answer `true` always and
+   /// prove nothing — the same trap `getEvmAddress` sets for anyone trying to use it as a witness.
+   /// It reads the var and nothing else, and it is a `query` precisely so that it CANNOT make the
+   /// inter-canister call a derivation requires: the restriction is enforced by the system, not by
+   /// this comment.
+   /// 
+   /// Owner-gated because it reports on custody posture, and answered as a Result so that a
+   /// wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
+   isEvmAddressCached: () -> (Result_44) query;
+   /// Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
+   /// (an `/auth/connector`-style route) after II authentication. The client then
+   /// redirects the user's browser to `redirectUri` with `?code=<this>` so the
+   /// MCP client (e.g. claude.ai) can exchange it for a bearer token at /oauth/token.
+   /// 
+   /// Owner-only: only the engram owner can authorize a Connector install.
+   issueAuthCode: (redirectUri: text, scope: text, codeChallenge: text,
+    clientId: opt text) -> (Result_43);
+   /// ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
+   /// ROW. A single label for a whole ring misattributes every row recorded under the other source,
+   /// and the source flips by design (self-call first, balance on fallback). Its documentation of
+   /// what the two values mean lives on the type.
+   /// Hourly (timestamp, totalMemoryReads, totalMemoryWrites) snapshots, ~30 days.
+   /// Same guard + fail-to-empty shape as getCycleHistory. Diff consecutive rows for a
+   /// per-engram activity time-series (retention instrumentation).
+   /// RENAMED from `getActivityHistory` (L2.1); named fields replace a bare 3-tuple whose two Nats
+   /// were positionally indistinguishable.
+   /// 
+   /// Refusal reason preserved, and it is the sharpest of this family: a masked `[]` reads as a
+   /// DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
+   /// reader, it feeds a wrong number into a decision about destroying data.
+   listActivitySnapshots: (start: nat, limit: nat) -> (Result_42) query;
+   /// ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
+   /// 
+   /// The refusal prose that used to be `gatedTrap`'s `whyNotEmpty` argument is not lost — it is why
+   /// this method could never fail soft, and it now travels ON THE WIRE inside `#Refused` where a
+   /// caller can actually read it, instead of inside a trap message only a log sees.
+   /// 
+   /// `total` is the ROSTER SIZE, not `items.size()`. That distinction is the whole reason this
+   /// shape exists here: `MAX_AGENTS` clamps the returned rows, and the old code returned the
+   /// clamped array with nothing saying it had clamped — a caller reading 100 agents could not
+   /// tell whether that was all of them. Now a clamped answer is self-describing, and the previous
+   /// behaviour (silently truncate, look complete) is unrepresentable.
+   /// 
+   /// `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
+   /// A method that filters rows by caller sets it — see L1's row-level honesty rule.
+   listAgents: (start: nat, limit: nat) -> (Result_41) query;
+   /// The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
+   /// 
+   /// Two audiences, two methods (L1/L8), rather than one method masking fields by caller: a
+   /// guardian needs enough to revoke (who, what they are called, whether they are active) and no
+   /// more. Field-masking would make the same call return different shapes to different callers,
+   /// which is the design L1 abolished — and it would put the decision about what a guardian may see
+   /// inside a build closure where no gate can read it.
+   /// 
+   /// Refusal reason preserved: `[]` reads as "this engram has no agents", and this is the list a
+   /// guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
+   /// it tells someone acting under emergency powers that there is nothing to act on.
+   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_40) query;
+   /// Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
+   /// 
+   /// The optional leading filter SURVIVES the L3 reshape — ratified (census tier-2 #8) rather than
+   /// assumed, because Billing.vue calls the filtered form live and pushing the filter client-side
+   /// would make the console fetch a queue to discard most of it.
+   /// 
+   /// `total` counts the FILTERED set, not the whole queue: with a filter applied, "how many match"
+   /// is the number a pager needs, and reporting the unfiltered count would make every filtered view
+   /// claim more pages than it has.
+   /// 
+   /// Refusal reason preserved: `[]` reads as "nothing is awaiting the owner's decision".
+   listApprovalRequests: (statusFilter: opt ApprovalStatus, start: nat,
+    limit: nat) -> (Result_28) query;
+   /// ⟨0.16.0⟩ `total` IS THE HEAD COUNTER, and on this method that is the entire point.
+   /// 
+   /// The audit log is a bounded RING: it trims its tail, so "rows you can read" and "entries that
+   /// have ever existed" are different numbers. The old bare array published only the first, which
+   /// made a trimmed log indistinguishable from a complete one — and this is the evidence surface,
+   /// where that difference IS the product. `totalAppended()` is monotonic across trims and is the
+   /// same number `getCertifiedAuditHead` publishes, so a caller comparing page against head gets
+   /// agreement by construction rather than by luck.
+   /// 
+   /// Refusal reason preserved: for an unauthenticated integrity check the caller wants
+   /// `getCertifiedAuditHead()`, which is public and subnet-certified. The BODIES are role-gated.
+   /// 
+   /// ⟨2026-09-29, owner ruling follow-up 16 (B)⟩ AN AGENT READS ONLY THE ENTRIES IT CAUSED; the
+   /// owner and guardians read everything (`RecordView`). So `limit` is a SPAN — how many record ids
+   /// to examine from `start` — and an agent's page holds the entries in that span whose caller is
+   /// its own key, with `withheld` counting the rest: `items.size() + withheld` is the span examined.
+   /// For the owner and a guardian `withheld` is 0 and the page is the span. WHAT WOULD MAKE THIS
+   /// WRONG: a reader who must see the whole record without being the owner or a guardian — the
+   /// public certified head is the answer for integrity, and nothing else is.
+   listAuditEntries: (start: nat, limit: nat) -> (Result_23) query;
+   /// ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
+   /// 
+   /// This method used to answer THREE ways to one question: a list, an `#Err` text, and a trap,
+   /// picked by which kind of caller asked. That split existed only because the return type could
+   /// not carry a refusal — with `Result<Page<T>>` it can, so every caller gets one shape and the
+   /// arm says which no it is. A paired agent lacking `canReadBackup` is `#Refused`; so is
+   /// everyone else who may not ask. The trap is gone: `Debug.trap` is for invariant violations,
+   /// never authorization (L1), and a refusal a caller cannot catch is not a better refusal.
+   /// 
+   /// ⚠ THE RATIFIED LOCKSTEP EXCEPTION THIS CARRIED IS SUPERSEDED, not quietly dropped.
+   /// `ADR-0002-listBackups-refusal-lockstep/listBackups` existed because published
+   /// @engramx/client 0.15.0 declares `IDL.Vec(BackupMetadata)` here and cannot decode a variant at
+   /// all — it throws — and @engramx/openclaw's dedup probe catches that throw and degrades to
+   /// "skipped", so every database silently stops being backed up while the CLI reports success.
+   /// That analysis was correct and is still correct. What changed is its PREMISE: plan v2 measured
+   /// the installed base at zero external users (prod = two engrams, both ours; npm published
+   /// 2026-08-14), so the population the ceremony protected does not exist. The SDK is republished
+   /// at 0.16.0 in this same campaign. If an outside caller ever appears before that ships,
+   /// this reasoning is void and the lockstep is owed again.
+   /// 
+   /// `dbTypeFilter` DIES on the wire (census). The capability does not: `EngramClient.listBackups`
+   /// keeps its optional filter and applies it to the page, so no caller loses the ability to ask
+   /// "backups of this database" — it stops being a thing the canister has to page around.
+   listBackups: (start: nat, limit: nat) -> (Result_39) query;
+   /// List all bearer tokens — Active, Revoked, and Expired. Owner uses this in
+   /// the dashboard to show installed Connectors (claude.ai, Claude Desktop, etc.).
+   /// Refusal reason preserved from the trap: `[]` reads as "no connector is installed on this
+   /// engram" — a claim about what can REACH it. An owner auditing access cannot tell that from
+   /// "you may not see the list", and the two are opposite facts.
+   /// 
+   /// `bearerTokenStore.list()` already resolves each token's status at read time (a token that
+   /// merely stopped being used is reported `#Expired`, not a stale `#Active`), so the page carries
+   /// the same honesty the store gained on 2026-08-17.
+   listBearerTokens: (start: nat, limit: nat) -> (Result_38) query;
+   /// The condense checkpoints in the retained log at or above `startSeq`, oldest first.
+   /// 
+   /// ⟨0.16.0, NEW⟩ The other half of the split above. A checkpoint is the only surviving record of a
+   /// stretch of chain that no longer exists, so this is the list that accounts for the distance
+   /// between `firstAvailableSeq` and the entries an owner remembers writing — without it, a
+   /// condensed prefix is a gap the owner has to take on trust.
+   /// 
+   /// Owner-only like every other archive surface, and for the same structural reason: these rows
+   /// carry the chain positions and roots of entries whose paths were inside the hash preimage.
+   listCondenseCheckpoints: (startSeq: nat, max: nat) -> (Result_37) query;
+   /// ⟨0.16.0⟩ `metrics()` DELETED — absorbed by `about()`.
+   /// 
+   /// Two public projections of one canister (L2.2): `metrics()` and `status()` both answered "what
+   /// is this engram like" and disagreed on which counters they carried, so a consumer had to fetch
+   /// both and know which one owned each field. Every field here survives on `about()`, day-flooring
+   /// included.
+   listCycleSnapshots: (start: nat, limit: nat) -> (Result_36) query;
+   /// Same `withheld` treatment as listMemoryFiles — the tombstone listing filtered reserved paths
+   /// for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
+   /// complete one. Counted before slicing, so policy-hidden rows never blur into paging.
+   listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_35) query;
+   /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
+   /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
+   /// 
+   /// Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
+   /// AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
+   /// registration remains the audit chain under getCertifiedAuditHead.
+   listEip712Types: (start: nat, limit: nat) -> (Result_34) query;
+   /// Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
+   /// 
+   /// NAMED item, not a `(Text, Int)` tuple. The Int is an activation time, and a bare Int beside a
+   /// bare Text told a reader nothing about which was which — the same defect fixed on the purge log.
+   /// 
+   /// Refusal reason preserved, and it has two halves that matter separately: `[]` reads as "this
+   /// engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
+   /// opposite security posture. It also erases any pending 24h activation from view.
+   listEvmWithdrawDestinations: (start: nat, limit: nat) -> (Result_33) query;
+   /// Accessible by owner and guardians.
+   /// 
+   /// Refusal reason carried over from the trap, because it is the sharpest example of why this
+   /// surface may not fail soft: `[]` reads as "this engram has nobody who can freeze payments or
+   /// pause writes" — a claim about who can STOP it. A caller who cannot tell that from "you may not
+   /// see the roster" has been told the engram is unguarded when it may be fully guarded.
+   listGuardians: (start: nat, limit: nat) -> (Result_32) query;
+   /// The export receipts in the retained log at or above `startSeq`, oldest first.
+   /// 
+   /// ⟨0.16.0, L3⟩ ONE LIST, ONE QUESTION. This method used to return receipts AND checkpoints
+   /// together behind a backward `before`/`max` cursor. They answer different questions — what may be
+   /// condensed, and what already was — so a caller wanting one paid to decode the other, and the
+   /// merged shape had to carry two arrays, a truncation flag and an opaque cursor to stay honest
+   /// about a walk that served both. `listCondenseCheckpoints` is the other half.
+   /// 
+   /// The cursor dies with it (census R6): paging is by ABSOLUTE SEQ now, forward, so a caller resumes
+   /// at `scannedThroughSeq + 1` and is finished when that passes `page.total`. `scanTruncated` is
+   /// gone because it has nothing left to say — "I stopped at entry N" is the same claim it made, and
+   /// says it as a position rather than a flag a reader has to pair with a second field.
+   /// 
+   /// Read `MemoryRouter.ReceiptPage` before reading `page.total` as a receipt count. It is not one;
+   /// it is the chain's length, and the declaration says why.
+   listMemoryExportReceipts: (startSeq: nat, max: nat) -> (Result_31) query;
+   /// ⟨0.16.0⟩ THE `withheld` EXEMPLAR — L1 names this exact method as the defect it fixes.
+   /// 
+   /// A non-owner's answer silently dropped every `config/` and `secrets/` row. Not "refused the
+   /// call" and not "returned a marker" — the rows simply were not there, with nothing in band
+   /// saying so, and the filtering happened INSIDE a combinator closure where neither honesty gate
+   /// could see it. Meanwhile `readMemory` returned an explicit refusal for the very same paths.
+   /// Same policy, same caller, two answers, and the quiet one was the lie.
+   /// 
+   /// `withheld` is now the count of rows policy removed. It leaks no names — which is the point:
+   /// the caller learns THAT something is hidden without learning WHAT, so an agent can tell a
+   /// short listing from a complete one and stop inferring the engram is emptier than it is.
+   /// 
+   /// Note the count is computed from the unfiltered list before slicing, so it reports rows hidden
+   /// by POLICY, never rows merely off the end of this page — those are `total`'s job. Conflating
+   /// the two would rebuild the ambiguity in a new place.
+   listMemoryFiles: (start: nat, limit: nat) -> (Result_30) query;
+   /// One page of the memory log, seq-ordered, optionally narrowed to one author.
+   /// 
+   /// THE WINDOW IS THE CURSOR, and the page now states it. The window is
+   /// `items.size() + withheld` entries starting at `max(startSeq, firstAvailableSeq)`; advance by
+   /// that, never by "last entry returned + 1", which stalls forever on the first empty page. Stop
+   /// when the window passes `total`.
+   /// 
+   /// ⟨0.16.0, L3 — CENSUS CONFLICT, RECORDED⟩ The census row says `→R<P<MemoryLogEvent>>` and
+   /// "authorFilter dropped (kills the filtered-window cursor stall)". The stall is real and the
+   /// diagnosis is right; amputating the filter is not the only cure, and it is the expensive one —
+   /// `Archive.vue` ships a working author-filter UI, and "what did this agent write" is a
+   /// question an owner asks of an evidence log. The filter STAYS. What kills the stall instead is
+   /// `withheld`: it carries the count this filter removed from the window, so a short or empty
+   /// filtered page is no longer ambiguous between "nobody wrote here" and "the window was small",
+   /// and the correct cursor advance is computable from the page itself. `pageCap` therefore dies
+   /// with nothing lost — it existed only to disclose a window that `items.size() + withheld` now
+   /// states directly.
+   /// 
+   /// `firstAvailableSeq` and `head` sit BESIDE the page rather than in it. They are facts about the
+   /// chain, not this slice: the condense floor tells a caller reading an archived range where the
+   /// log now begins instead of letting them read it as empty, and the head is what a third party
+   /// checks the page against. Flattening to a bare `Page` to satisfy the shape would buy uniformity
+   /// with the disclosures that make the page verifiable — the hidden-bound defect the census itself
+   /// names on previewCondense's row.
+   listMemoryLog: (startSeq: nat, max: nat, authorFilter: opt principal) ->
+    (Result_29) query;
+   /// The caller's OWN spend-approval requests. ⟨0.16.0, L1 + L3 — fixed 2026-08-18⟩
+   /// 
+   /// Two defects in seven lines, and the first is the one this release exists to remove:
+   /// 
+   ///   · `if (Principal.isAnonymous(msg.caller)) return []` is a FABRICATED EMPTY. An anonymous
+   ///     caller was told "you have no approval requests", which is a claim about their queue rather
+   ///     than about their identity, and is indistinguishable from the honest answer. It refuses now.
+   ///   · The reply was uncapped over `pendingApprovals`, which NEVER SHRINKS — the hourly expiry
+   ///     timer flips a row's status to `#Expired` and deletes nothing. So the array grew for the
+   ///     life of the engram, and a caller with enough history would eventually get a reply too
+   ///     large to decode: not a truncated list, no list at all.
+   /// 
+   /// The caller-scoping is not `withheld`: rows belonging to someone else were never this caller's
+   /// to see, so `total` over their own rows is the honest count and nothing is hidden FROM them.
+   /// (The unbounded MAP is filed separately — pruning an approval record destroys evidence of what
+   /// was asked, which is a retention ruling rather than a shape fix.)
+   listMyApprovalRequests: (start: nat, limit: nat) -> (Result_28) query;
+   /// The payer's own sessions, live ones first. PAYER-SCOPED: a caller sees only their own, which
+   /// is why this needs no role — a session id is not a secret from the person who paid for it.
+   /// 
+   /// ⟨2026-10-02, paged⟩ Takes `(start, limit)` like every other list here, capped at
+   /// `MAX_SESSIONS_PAGE` rows per call; `total` is how many of the caller's sessions still exist.
+   /// It took no arguments, and a cursor added after the freeze is an argument-list change every
+   /// client would break on — the market paged its own pending withdrawals before its cut for the
+   /// same reason. The order is the order sessions were opened.
+   listMySessions: (start: nat, limit: nat) -> (Result_27) query;
+   /// 
+   /// ⟨0.16.0, L3⟩ Paged and enveloped like every other `list*`, and the envelope here is uniformity
+   /// rather than gating: this method cannot refuse anybody, so `#Err` is unreachable on it. That is
+   /// deliberate — the off-chain verifier that reads this chain reads several other lists beside it,
+   /// and one shape for all of them is worth more than saving a variant tag on the one that is
+   /// public. `total` is the FULL chain length, so a verifier holding a short page can tell it has
+   /// not seen the whole custody history — the distinction a bare array could not express.
+   /// 
+   /// PUBLIC: custody history is the answer to "is this engram what it claims to be", and it is
+   /// asked by strangers. `verifyEngramActiveOwner` on the registry answers only about the owner
+   /// IT recorded, so this chain is what a caller composes with when currency matters — which it
+   /// cannot do if it needs a role here.
+   listOwnershipTransfers: (start: nat, limit: nat) -> (Result_26) query;
+   /// ⟨2026-09-29, the platform's question from the build review⟩ OWNER-ONLY: how many payment
+   /// signatures each agent has obtained today, and the daily limit (200, `PaymentSignCap`). The
+   /// owner's console stated the rule and showed no number, because nothing served one; a number it
+   /// made up would be a fabricated zero. Anyone else is refused by name (`#Refused
+   /// listPaymentSignatureCounts: …`), never answered with zeros. Paged like `listAgents`, in the same
+   /// order, one row per agent in the roster; each count is the agent's, taken by its root as the
+   /// signer takes it, so every key the agent holds here shows the same number. The owner is not
+   /// counted and has no row; the marketplace's count is not an agent's and is not here. WHAT WOULD
+   /// MAKE THIS WRONG: a count kept by something other than the agent's root (`PaymentSignCap.rowFor`
+   /// says so beside it).
+   /// 
+   /// ⟨2026-09-30, following the owner's answer 4 of that date⟩ "is not here" no longer holds: the
+   /// marketplace's one shared count today is in the reply's `marketplace` field, with the limit this
+   /// engram enforces for it — beside the agents, never a row among them
+   /// (`PaymentSignCap.marketplaceRow`). Null when no marketplace is set.
+   listPaymentSignatureCounts: (start: nat, limit: nat) -> (Result_25) query;
+   /// Agent records removed by a reset. Each row is a NAMED record with the fields `principal`,
+   /// `name`, `registeredAt` and `purgedAt` — read them BY NAME, never by position.
+   /// ⟨2026-09-29, the vocabulary ruling: pairing is the one verb that admits an agent⟩ The field
+   /// this prose calls `registeredAt` is now `pairedAt`, on the served row and on the agent record
+   /// it is copied from. What is said below about the two timestamps holds for `pairedAt`.
+   /// 
+   /// The names are the whole point, not decoration. Both timestamps are a bare Int, so they were
+   /// positionally indistinguishable at the client: a decoder that swapped registeredAt and
+   /// purgedAt would type-check everywhere and show up only as nonsense in a UI. This prose used to
+   /// describe the row as a positional 4-tuple and readers duly destructured it as one — the same
+   /// bug, twice, in two different repos (corrected 2026-08-16). `agentPurgeLog` really is a
+   /// 4-tuple in stable state; the SERVED shape is not, and that seam is where the mistake starts.
+   /// 
+   /// resetEngram HARD-DELETES agent records so a purged principal can be invited back
+   /// (owner ruling 2026-08-15). That makes the reset a genuine clear rather than a permanent burn —
+   /// but it also means the `agents` map is no longer evidence that a principal ever held access,
+   /// and the audit chain cannot stand in: it is a bounded ring that trims its oldest entries, so
+   /// agent.pair rows are evicted over the life the rent model assumes. This is that
+   /// evidence, and it is why the tombstone is written rather than the roster simply dropped.
+   /// 
+   /// Owner-gated and TRAPS on refusal: an empty list must mean "no reset has removed an agent",
+   /// never "you may not ask".
+   /// ⟨CORRECTED 2026-10-02: it no longer traps. It is gated through `gatedResult`, so a refusal
+   /// comes back as an `Err` VALUE that names this method — still never as an empty page, which is
+   /// the property the sentence above was protecting.⟩
+   /// RENAMED from `getOperatorPurgeLog` (L2.1: `get*` returns one value, `list*` returns a Page —
+   /// the old name promised a scalar and delivered an array).
+   /// 
+   /// Refusal reason preserved: an empty list must mean "no reset has removed an agent", never
+   /// "you may not ask". On an evidence trail those are not close.
+   /// 
+   /// Named record, not a 4-tuple. Both Ints are timestamps and were positionally indistinguishable
+   /// at the client — swapping registeredAt and purgedAt would have type-checked everywhere and been
+   /// visible only as nonsense in a UI.
+   /// 
+   /// ⟨2026-09-29, review finding LIFE-2⟩ Each row now also carries the agent's `root`, the
+   /// `invite` its enrolment named, and `ended` — why and on what day its engagement ended (its own
+   /// earlier ending, or the reset) — the facts `resyncAgentEdges` re-sends. The stored rows are
+   /// served as they are.
+   listPurgedAgents: (start: nat, limit: nat) -> (Result_24) query;
+   /// ⟨0.16.0⟩ ONE ACCESSOR, folding `readReadLog` and `getDenialLog` — and the fold only became
+   /// safe because of a change made earlier in this same leg.
+   /// 
+   /// They were two methods over the SAME log behind the SAME gate. `getDenialLog`'s own declaration
+   /// explained why the split existed: nothing published this log's head, so a client could only
+   /// reach the OLDEST retained entries, and a "recent refusals" band built on `readReadLog` would
+   /// have rendered the oldest slice of a 10,000-entry ring under those words. That rationale died
+   /// when the Page conversion started publishing `total = totalAppended()` — the head is now a fact
+   /// a caller can read, so paging backward from it is ordinary arithmetic.
+   /// 
+   /// The census proposed deleting `readReadLog` outright as a "duplicate accessor". Checked at the
+   /// site, that premise was false: `getDenialLog` filtered `not e.success`, so deleting the other
+   /// would have removed the only way to read SUCCESSFUL entries — and this ring is overwhelmingly
+   /// successful MCP reads. Folded instead, which keeps both capabilities and still ends the pair.
+   /// 
+   /// ⚠ `limit` IS A SPAN, NOT A ROW COUNT, and the same in both modes: it is how many log ids to
+   /// EXAMINE starting at `start`. Unfiltered, items == the entries in that span. Filtered, items is
+   /// however many of them matched — fewer, and that is not truncation. This is the one honest
+   /// reading, because the alternative (keep scanning until `limit` rows match) hides how far it
+   /// looked, which is precisely what `getDenialLog` had to disclose with `scannedFrom`/`more`.
+   /// A caller knows exactly which ids were examined: `[start, start + limit)`.
+   /// 
+   /// `earliest` is gone as a field and lost nothing: entries carry their own `id`, so a caller
+   /// paging from 0 reads the oldest retained id off the first item. That is L3's stated design —
+   /// items self-identify — rather than a second number to keep in sync.
+   /// 
+   /// `withheld` is 0 even when filtering. The filter is CALLER-REQUESTED; `withheld` means rows
+   /// POLICY removed. Overloading it would rebuild the ambiguity this campaign exists to remove.
+   /// 
+   /// ⚠ **CORRECTED 2026-08-21, BESIDE the paragraph above because it is what the caller contract
+   /// USED to be: THAT RULE WAS REVERSED ON 2026-08-18 AND THIS COMMENT DID NOT FOLLOW.** The body
+   /// below computes `withheld = examined.size() - kept.size()`, and its own dated note explains
+   /// why: `withheld = 0` beside a filter is the FABRICATED-COMPLETE PAGE, and this is the worst
+   /// method in the file to have it on — `successFilter = ?false` is how the denial band asks "who
+   /// was refused here", and a short page claiming nothing was withheld says the engram examined
+   /// this window and found no refusals, when it examined `span` rows of which most were successes.
+   /// 
+   /// So `withheld` now means BOTH policy-removed and filter-removed rows, and a caller can recover
+   /// the examined span as `items.size() + withheld` — which is the successor to the retired
+   /// `scannedFrom`/`head` window, and the number a UI needs to say what it actually looked at
+   /// rather than implying it looked at everything.
+   /// 
+   /// This mattered beyond the file: doc comments are emitted into `engram.did`, so every SDK and
+   /// hand-written client has been reading the pre-fix rule off the interface for three days.
+   /// 
+   /// Named `listReadLog`, not the census's `listDenialEntries`: that name assumed only the denial
+   /// half survived. A method serving every row must not be named for one of them.
+   /// 
+   /// Refusal reason preserved from both: this log has NO public counterpart — no certified head to
+   /// fall back to — so an empty answer would falsely assert nobody has read this record, and an
+   /// empty denial band would assert nobody has ever been refused here.
+   /// 
+   /// WHAT "success = false" MEANS, PRECISELY, kept from getDenialLog because it is easy to misread:
+   /// REFUSED-OR-FAILED, not authorization-denied alone. `denied()` writes authz refusals here, and
+   /// so do settle failures, webhook auto-disables, expiry sweeps and MCP rate limits. Do not narrow
+   /// this to a name it does not carry.
+   /// 
+   /// ⟨2026-09-29, owner ruling follow-up 16 (B)⟩ An agent reads only the entries it caused, here as
+   /// on the chained record — the same `RecordView` filter, and `withheld` counts what it removed
+   /// together with what `successFilter` removed. WHAT WOULD MAKE THIS WRONG: see `listAuditEntries`.
+   listReadLog: (successFilter: opt bool, start: nat, limit: nat) ->
+    (Result_23) query;
+   /// Same visibility as listAuditEntries: the owner, this engram's agents, and ACTIVE guardians
+   /// see disputes. An unauthorized read REFUSES — it does not return an empty list, because an
+   /// empty list reads as "no disputes have been filed", which is a claim, not an absence of one.
+   /// RENAMED from `getRepudiations` (L2.1). Refusal reason preserved: an empty list would read as
+   /// "no disputes have been filed" — and a dispute record that can be mistaken for an absence of
+   /// disputes is worse than no record at all. Not public by design.
+   /// 
+   /// ⟨CORRECTED 2026-09-29, owner ruling follow-up 16 (B)⟩ "Same visibility as listAuditEntries"
+   /// still holds, and so the first sentence no longer does: an agent reads only the record entries it
+   /// caused, and every dispute here is the owner's own `memory.repudiate` entry. So the owner and
+   /// guardians get the rows; an agent gets an empty page whose `withheld` counts the rows in its
+   /// window — which says disputes exist without showing them, never "none have been filed". WHAT
+   /// WOULD MAKE THIS WRONG: a ruling that an agent may see the disputes of its own writes; this would
+   /// then have to look up each disputed version's writer, which it does not do today.
+   listRepudiations: (start: nat, limit: nat) -> (Result_22) query;
+   /// Owner: advance the review cursor — "I have seen everything up to and including uptoAuditId"
+   /// (null = everything at the current head). Bounded so the attestation can never cover entries
+   /// the console did not render; clamped monotonic (the cursor never moves backward) and to the
+   /// current head (never attests the future). Logged, so the review itself is part of the record.
+   /// 
+   /// Deliberately filter-agnostic: the cursor is a plain audit id in the CHAINED log's one id space
+   /// (every family qualifiesForReview admits is written to auditLogger, so they share that space),
+   /// and this never inspects an operation or a role. Widening what the review shows therefore
+   /// changes only which ids the console can pass here — it cannot desynchronise the cursor.
+   markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_8);
+   /// The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
+   /// key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
+   /// nomination per agent — a new one replaces the earlier one, and the record says which. Refused,
+   /// with nothing changed, for a caller that is not an active agent here and for a key that could
+   /// not hold the record (`KeyReplacement.nomineeRefusal`).
+   nominateAgentKey: (newKey: principal) -> (Result_1);
+   /// An AGENT paired here asks this engram to open an engram of its own. This engram attaches 1.3 T of
+   /// its own cycles to the registry's `sysSpawnChild`; the agent's lasting key owns what is opened, and
+   /// the engram is recorded as opened through this one. Answers the new engram's canister id.
+   /// 
+   /// APPROVING IS GIVING: the owner allowed this with `setChildAllowance`, and what is attached is the
+   /// agent's from the moment that engram exists. Nothing is ever taken back, and the registry never
+   /// funds that engram — its owner (the agent) tops it up.
+   /// 
+   /// ORDER, with no await before the allowance is taken: the caller is an active agent; there is a
+   /// registry; payments are not frozen (opening sends this engram's cycles out of it, and a freeze is
+   /// the brake a guardian holds over resources leaving); the balance carries the attachment above this
+   /// engram's own reserve; then one opening is TAKEN from the agent's allowance in this message, and only
+   /// then is the registry called. If the registry refuses or cannot be reached, the opening is GIVEN
+   /// BACK (one added to the current count) and the cycles the call did not use come back by the
+   /// network's refund. Every outcome is written to the record under `agent.openChild` in the message
+   /// that hears the registry's answer, before the reply — in the alerts' money class.
+   /// 
+   /// ⟨CORRECTED 2026-10-01, review F1 and F4 — the sentence "If the registry refuses or cannot be
+   /// reached, the opening is GIVEN BACK" above is what was first built.⟩ The opening is given back only
+   /// when the WHOLE attachment came back as the call's refund (the registry accepted none of it) and
+   /// the owner has not set this agent's count since the take (`ChildAllowance.settle`). A refusal after
+   /// the registry accepted the cycles (the template would not install, or the key came to own an
+   /// engram meanwhile) leaves the 1.3 T in a canister the agent's key controls; giving the opening back
+   /// then let an allowance of 1 drain this engram 1.3 T per call. Now that opening is spent and the
+   /// reply says so.
+   /// 
+   /// WHAT WOULD MAKE THIS WRONG: an await added between `ChildAllowance.take` and the registry call; the
+   /// registry's `CHILD_MIN_ATTACHED_CYCLES` moving without `CHILD_ATTACH_CYCLES`.
+   openChildEngram: () -> (Result_21);
+   openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_20);
+   /// Withdraw tokens to the owner's principal. This is the ONLY way to
+   /// move tokens out of the engram to an external address, and the
+   /// destination is always hardcoded to the owner.
+   /// NOT freeze-gated: the owner always controls their own funds.
+   /// Guardian freeze only blocks agent/public operations.
+   ownerWithdraw: (amount: TokenAmount, ownerAuth: opt ActionAuth) ->
+    (Result_8);
+   /// ⟨0.16.0⟩ `payRentFromEarnings` DELETED — ruled TWICE (B1 and B2), and it was the single
+   /// clearest violation of the OSS/platform split in this repo.
+   /// 
+   /// It hand-declared four cashier methods inline, read `getFeeSchedule`, computed
+   /// `priceE6 = rentUsdE6PerEngramYear * months / 12`, and deposited `priceE6 + 3 * CKUSDC_FEE`
+   /// under a comment explaining that three is "the three token fees the cashier's rail spends" —
+   /// a PUBLIC canister hardcoding how many ledger fees a PRIVATE one consumes internally. Any
+   /// change to the cashier's rail silently mispriced this call.
+   /// 
+   /// It also carried the only RE-ENTRANT cross-canister chain in the system: engram →
+   /// cashier.payRentWithStablecoin → (registry, ledger, CMC …) → back into the SAME engram's
+   /// sysRecordFeeEvent while the originating message was still suspended, both writing the same audit
+   /// ring, with no lock.
+   /// 
+   /// Rent is the cashier's entirely (B2). Owners pay through the cashier's rails; the engram keeps
+   /// append-only receipts and no fee math.
+   /// ⟨0.16.0, L1 — census-ruled⟩ THE ONE-SHOT ARM. Re-redemption is `#Err(#Conflict)`, named in
+   /// the census row for this method, and it is the arm the whole guard exists to express: this
+   /// principal HAS held agent access, and no code will give it back. A caller reading
+   /// `#Conflict` knows to pair a fresh key; a caller reading `#Refused` would keep presenting the
+   /// same identity, which is exactly the loop the one-shot rule was written to stop.
+   /// Redeem an invite code minted by `createAgentInvite`. The CALLER becomes the agent, so
+   /// redeem from the wallet that will do the work.
+   /// 
+   /// ⚠ IT REFUSES ANY CALLER THAT ALREADY HOLDS A RECORD — `#Active`, `#Revoked` or `#Resigned`.
+   /// The `#Revoked` case is the one that matters: revocation is a soft status change, so allowing
+   /// a revoked principal to redeem a fresh invite would be a self-un-revoke. To CHANGE an existing
+   /// agent's permissions the owner uses `setAgentPermissions`; this method is only ever the
+   /// first admission of a principal.
+   /// 
+   /// A GUARDIAN cannot redeem one either. A guardian is an independent check on agents, so one
+   /// wallet must not hold both roles — use a separate wallet.
+   /// 
+   /// Anonymous callers are refused, and every refusal above is recorded in the denial log.
+   /// 
+   /// ⟨RESHAPED 2026-09-28, owner decision: one lasting identity per agent — one root key per agent,
+   /// with an enrolled key per client⟩ The argument is one record: the invite `code` and an
+   /// `enrolment` statement signed by the agent's ROOT key naming this engram, the calling key and
+   /// this code (`Enrolment.verify`). The root is stored on the record and is what the registry keeps
+   /// the track record under. REQUIRED, not optional: every engram launches on this code (the
+   /// building-phase rule, 2026-09-27), so there is no key without a root and no second path for one.
+   /// Two more refusals, each leaving the invite unconsumed: a statement that does not verify, and a
+   /// root that already holds an ACTIVE key here (`Enrolment.activeKeyOf` — one active key per agent
+   /// per engram). The one-shot rule and the five-active cap are unchanged and still read the KEY.
+   /// ⟨CORRECTED 2026-09-29, the cycle-drain hole measured that day⟩ "each leaving the invite
+   /// unconsumed" holds only until the invite's fifth failed statement check: every failed check
+   /// counts against the invite whoever sends it, the fifth voids it (the refusal says so, and the
+   /// record gets `agent.invite.void`), and after that every attempt with it is refused
+   /// `#Conflict` before any check is made (`InviteFailures`).
+   /// 
+   /// ⟨RESHAPED 2026-09-29, review finding LIFE-3⟩ The reply is `Types.Pairing`: the agent
+   /// record AND `trackRecord`, which says plainly when the registry refused or failed to record the
+   /// engagement on the agent's track record, and what to do. Before, the reply was `#Ok` with the
+   /// record alone even when the registry had refused the start, so the agent was never told.
+   pairAgent: (arg: record {
+                      code: text;
+                      enrolment: Enrolment;
+                    }) -> (Result_19);
+   /// ⟨0.16.0, L2.2 — renamed from `guardianPauseWrites`⟩ Same correction as freezePayments above:
+   /// owner-or-guardian, and `resumeWrites` never carried the prefix either.
+   pauseWrites: () -> (Result_1);
+   /// What condensing through `toSeq` would do, and whether it is unlocked. COMMITS NOTHING — it is
+   /// a query, so it structurally cannot; a preview that wrote would be its own trap.
+   /// 
+   /// It does not ask the library, because the library's refusal cannot answer the owner's question.
+   /// `Chain.prepareCondense` reports `lastExported = null` whenever the only receipts present are
+   /// author-FILTERED, since a filtered receipt never satisfies the gate and is never recorded as a
+   /// near-miss — and an owner who exported minutes ago would read that as "you have never
+   /// exported". So `filteredReceiptsSeen` is counted separately, and `maxUnlockableToSeq` says how
+   /// far the receipts already on file reach, so a console can offer that instead of only "no".
+   /// 
+   /// `maxUnlockableToSeq` is a maximum over every retained unfiltered receipt, and a NEWER receipt
+   /// may cover a SHORTER range than an older one — so the scan cannot stop at the first hit. It is
+   /// bounded by entry count instead, and `scannedFromSeq` / `scanTruncated` say where it stopped
+   /// and whether the bound was the reason. A bounded scan that hid its bound would report "no
+   /// receipts" for "I did not look far enough", which is this codebase's own defect class.
+   /// 
+   /// `unlocked` is the export-receipt gate ONLY. It is not a promise the condense will land: the
+   /// history-budget delta is checked at commit time and can still refuse a short prefix.
+   previewCondense: (toSeq: nat) -> (Result_18) query;
+   /// A quote for a session this caller has not opened and is not committed to — the intent a
+   /// buyer signs against. Pure dry run, no state, no funds.
+   /// 
+   /// PUBLIC: a price list nobody can read is not a price list. A buyer has to see the deposit
+   /// minimum and per-call cost BEFORE signing anything, and gating the quote behind a role would
+   /// mean the only way to learn this engram's price is to already be permitted to pay it.
+   /// 
+   /// ⟨CORRECTED 2026-08-24 — this said "⟨L7⟩ UPDATE, NOT QUERY" and cited a market ruling that
+   /// DEC-107 had already closed.⟩ QUERY, per the ruled quote convention: FAST READS. Both
+   /// `quotePayment` and `previewOpenSession` become queries, and L7's open-ruling exception
+   /// retires with them — so the argument written here for keeping it an update was arguing the
+   /// losing side of a decision already made, and was added the same day by not reading forward
+   /// to the ruling. `gate.offerSession` is pure — it validates the intent and returns it — so
+   /// nothing forced the update in the first place.
+   /// 
+   /// ONE-REPLICA CAVEAT, stated here because the ruling requires it at both sites: a query is one
+   /// replica's word and is NOT a settleable challenge. Nothing quoted here can be redeemed. The
+   /// commitment happens in `openSession`, which IS a certified update call, and a buyer who needs
+   /// the price attested rather than quoted takes it from that reply.
+   /// 
+   /// ⟨RESTORED 2026-08-24, owner ruling R-A1⟩ Named to match the market's, because it is the
+   /// same act against a different seller and a reader comparing the two should not have to learn
+   /// two verbs for it.
+   /// 
+   /// ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
+   /// `expiryNs`. Same value, same meaning; only the name carries the unit now.
+   previewOpenSession: () -> (SessionIntent) query;
+   /// Read one memory file at its current version.
+   /// 
+   /// Gated on the `read_memory` permission, so an agent holding that grant reaches it — unlike
+   /// `writeMemory`, which is owner-only.
+   /// 
+   /// ⚠ `config/` AND `secrets/` ARE OWNER-ONLY whatever the grant says, and the refusal is
+   /// `#Refused` rather than `#Invalid` deliberately: the path is well-formed and the file may well
+   /// exist — the caller simply may not have it. Under L1 that distinction is the caller's to branch
+   /// on, which is the whole reason `Error` is a closed variant rather than a sentence.
+   /// 
+   /// ⚠ A QUERY, so it does NOT count as a read. The IC discards query-path state changes, so a
+   /// counter here could never persist; read counting lives on the update path
+   /// (`sessionReadContext` and the MCP reads). A caller measuring engram usage from this method
+   /// will measure nothing.
+   readMemory: (path: text) -> (Result_11) query;
+   /// Read many paths in one call. Per-path Results are KEPT — partial success is the point, and
+   /// one unreadable path must not fail the other nine.
+   /// 
+   /// ⟨0.16.0⟩ The OUTER envelope is new, and it fixes two ways this used to answer dishonestly:
+   /// 
+   ///   · Over the path cap it returned `[("", #Err(#Invalid …))]` — ONE row, for a path the caller
+   ///     never asked about. A consumer looping rows saw a result for the empty path and no result
+   ///     for any real one. The call as a whole failed; dressing that as a per-path outcome is the
+   ///     fabrication ADR-0002 is about.
+   ///   · An AUTHORIZATION refusal was fanned out across every requested path, so one "no" arrived
+   ///     as N per-path noes and read like N independent permission facts about N files.
+   /// 
+   /// Both are now what they are: a single `#Err` for the whole call. `#Ok` still carries a row per
+   /// path, each with its own Result — a refused RESERVED path sits beside a readable one, which is
+   /// a genuine per-path fact.
+   readMemoryBatch: (paths: vec text) -> (Result_17) query;
+   /// ⟨0.16.0⟩ `getMemoryRetentionGuards` DELETED — folded into `getMemoryRetentionPolicy` above.
+   /// It was the second L2.1 array-returning `get*`, and separating it from the policy it modifies
+   /// was the defect described there. Its own docs are preserved at the fold site.
+   /// One page of a file's content — the paged read the whole-file surfaces point at.
+   /// 
+   /// `version = null` reads the live file; a version reads that version as it was recorded.
+   /// The store clamps a page to one chunk, and `more` DISCLOSES the clamp: a caller that cannot
+   /// see it cannot know whether it has the whole range, which is how silent truncation gets
+   /// reintroduced. Loop while `more` is true, advancing by the bytes actually returned.
+   readMemoryBytes: (path: text, offset: nat, len: nat, version: opt nat) ->
+    (Result_16) query;
+   /// The escrow exit for a session whose settle cannot pay.
+   /// 
+   /// PAYER-ONLY, enforced inside the gateway, and deliberately not owner-triggered: the payer's own
+   /// deposit is the only thing here, so making them wait for anyone else would be a worse rail than
+   /// the one this replaces. (The market's twin is admin-triggered because a marketplace session has
+   /// a counterparty; a memory session does not.)
+   /// 
+   /// WHY IT IS NEEDED AT ALL: `closeSessionInternal` settles only when
+   /// `deposited >= consumed + fee`, and vouchers may consume up to the full deposit — so a payer
+   /// who spends their whole budget makes their own session unsettleable, with no adversary
+   /// involved. Before this, the refusal text told them to call `recoverEscrow`, which existed on no
+   /// canister they could reach. RB2 caps consumable spend so ordinary use cannot reach that state;
+   /// this is the way back for a session that already has.
+   /// 
+   /// ⟨CORRECTION 2026-09-30, beside the paragraph above and the first line⟩ No longer true. ic402
+   /// 2.17.0's `closeSessionInternal` settles `min(consumed, deposited − fee)` and skips a refund of
+   /// zero, so a session spent to its whole budget still closes, and under the one-fee reserve a clean
+   /// close leaves the escrow holding nothing or less than one fee, which no transfer can move. The
+   /// way back is for a REFUND LEG THAT FAILED (a transient ledger error): the settle went through,
+   /// ic402 marks the session closed, and the remainder stays in escrow until the payer calls this.
+   /// A failed settle is not this method's case: ic402 puts that session back to open, where this
+   /// method refuses, and the close is retried instead. WHAT WOULD MAKE THIS WRONG: an ic402 whose
+   /// close stops capping the settle, or a live ckUSDC fee above `Env.CKUSDC_FEE`.
+   /// 
+   /// ckUSDC only — an engram session's intent names `Env.CKUSDC_LEDGER` and nothing else, so there
+   /// is no token to choose and no wrong one to pass.
+   /// 
+   /// ⟨2026-10-02, decided — the twin divergence is deliberate⟩ The market's `recoverEscrow` takes
+   /// `Wire.TokenAmount`; this one takes a bare `nat`, and the two stay different on purpose. The
+   /// market escrows more than one token, so the amount has to say which; this engram's sessions
+   /// escrow ckUSDC only, and a `TokenAmount` here would make an `#Icp` amount representable and then
+   /// refuse it at runtime — the argument `convertEarningsToCycles` makes. What changed is the NAME:
+   /// `amountE6`, ckUSDC base units. Candid passes arguments by position, so nothing on the wire moved.
+   /// 
+   /// ⚠ `#Conflict` HERE ALSO COVERS "NOT THE SESSION'S PAYER". ⟨2026-10-02, audited at this site⟩
+   /// The payer check is ic402's (`recoverEscrow` authorizes `caller == session.payer`), and the
+   /// library answers every refusal down one text channel, so "Not authorized: only session payer can
+   /// recover escrow" arrives as `#Conflict`, beside the state refusals (an open session, nothing to
+   /// recover, no such session). Read the MESSAGE, not the arm. This is the 0.16.0 contract as
+   /// ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut dependency
+   /// work. (The payments-frozen refusal in the body is this engram's own, and is state.)
+   /// 
+   /// ⟨2026-10-05, ic402 2.17.3 — beside the list above⟩ A fourth state refusal: a session that reads
+   /// `closing` or `expired`, whose close has not finished. Escrow comes back only from a session that
+   /// reads `closed`, and the refusal moves nothing. A close that stopped part-way (its refund call
+   /// rejected, or a trap) leaves the session reading `closing`, and no method on this engram moves it.
+   recoverEscrow: (sessionId: text, amountE6: nat) -> (Result_8);
+   /// ⟨0.16.0, L1⟩ A REDEMPTION PATH, where the arm choice is a disclosure decision.
+   /// 
+   /// Four of these refusals are about the CODE and one is about the caller. The code arms restate
+   /// exactly what the text already said — an unknown code is `#NotFound`, a used or expired one is
+   /// `#Conflict` — so no fact is newly disclosed by the arms; the anti-enumeration control here is
+   /// the attempt throttle above, not vagueness in the reply. Throttling is itself `#Conflict` (at
+   /// capacity) rather than `#Unavailable`: nothing failed, and the caller's own recent behaviour is
+   /// what closed the door, so "try again" is true only after the stated wait.
+   /// 
+   /// ⟨2026-10-02⟩ Answers the `GuardianRecord` it created — `#Pending` until the owner approves —
+   /// rather than `()`. The new guardian learns, in the same reply, the name and permissions the
+   /// owner's invite gave them and that they cannot act until approved; before, that took a second
+   /// read they had no reason to know to make.
+   registerGuardian: (code: text) -> (Result_15);
+   /// Remove a per-caller override so that caller reverts to — and keeps TRACKING — the global caps.
+   /// 
+   /// It travels with its pair and is never dropped alone: without it the only way "back" from an
+   /// override is to overwrite it with a frozen copy of the global policy, which then stops
+   /// following later changes. That makes every override permanent in effect.
+   removeCallerSpendPolicy: (caller: principal) -> (Result_1);
+   /// De-register a type that has NEVER SIGNED. Exists because of a hazard the first external
+   /// validation found within hours (consumer report, 2026-08-06): a bare-name #standard registration —
+   /// cheap, no watcher preconditions — permanently blocked the guarded namespaced registration
+   /// via the collision rule, with no way out. An owner typo could brick a venue integration for
+   /// the engram's lifetime. Never-signed is the whole gate: a type that signed even once is part
+   /// of what the audit chain's eip712.sign entries mean, and stays resolvable forever — this
+   /// removes only authority that was never exercised, which is removing nothing but the mistake.
+   /// NOT freeze-gated, same reasoning as removeEvmWithdrawDestination: this is TIGHTENING, and a
+   /// frozen engram must still be able to shrink what it could sign.
+   removeEip712Type: (typeId: blob) -> (Result_1);
+   removeEvmWithdrawDestination: (dest: text) -> (Result_1);
+   /// Owner-only: remove a guardian from the roster.
+   /// 
+   /// Unlike revoking an agent this is NOT terminal for the principal — the guardian roster does
+   /// not carry the one-shot rule that blocks a revoked agent from ever pairing again, so the
+   /// same wallet can be invited again.
+   /// 
+   /// `#NotFound` rather than `#Refused` when there is no such guardian: only the owner reaches this
+   /// line, so the roster is theirs and its contents are not a secret being withheld from them.
+   removeGuardian: (guardianPrincipal: principal) -> (Result_1);
+   /// Owner disavows a specific memory write, in the open. Marks — never deletes: the content and
+   /// the original audit entry stay exactly where they were; this appends a chained
+   /// `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
+   repudiateMemoryWrite: (path: text, version: nat, reason: text) ->
+    (Result_8);
+   /// ⚠ OWNER-ONLY BULK RESET. Destructive, and wider than its name suggests.
+   /// 
+   /// It severs EVERY grant surface that can outlive a role — agents, guardians, invites and
+   /// connector tokens — clears memory, and returns the operational flags (encryption, writes-paused,
+   /// payments-frozen) to a fresh baseline. Anyone holding access through any of those loses it.
+   /// 
+   /// What SURVIVES, deliberately:
+   ///   · the cumulative counters, which never reset — an engram cannot make itself look new;
+   ///   · memory DELETES are soft, so version history is retained and paths stay enumerable via
+   ///     `listDeletedMemoryFiles`;
+   ///   · `agentPurgeLog`, which is the durable record of who was severed;
+   ///   · ⟨2026-09-29⟩ today's spending totals — each caller's and the engram-wide one — and the
+   ///     owner's engram-wide ceiling. A reset severs access; it never gives back a day's allowance
+   ///     already spent, so a key re-admitted after a reset keeps what it spent today (the totals are
+   ///     kept per calling key).
+   ///   · ⟨2026-10-02⟩ the seat weeks of every engagement (`agentSeatWeeks`), with the signature count
+   ///     they sit beside, and the owner's switch over the metrics reader's read and the reader it
+   ///     names — a reset severs access, it does not change who may read what was kept.
+   /// 
+   /// ⟨2026-10-02⟩ It tells the spawning registry that it happened (`sysNoteReset`), on every reset.
+   /// 
+   /// It is recorded as ONE chained `engram.reset` entry that also names the flag transitions.
+   /// 
+   /// ⚠ AND THE LIMIT OF THAT RECORD, because a caller relying on it should know: the audit chain is
+   /// NOT unbounded. It caps at MAX_ENTRIES and trims its oldest tenth on overflow, so on any engram
+   /// long-lived enough for the rent model to apply, the reset entry is not guaranteed to still be
+   /// there. `agentPurgeLog` is the evidence that does not age out — which is why it exists.
+   resetEngram: () -> (Result_14);
+   /// ⟨2026-09-28, owner decision: an agent can resign from an engram, and the resignation is
+   /// recorded⟩ The AGENT ends its own engagement with this engram.
+   /// 
+   /// WHY IT EXISTS: before this, every ending was something done TO an agent — revoked by the
+   /// owner, by a guardian, by the kill switch, or by a reset — so an agent that wanted to leave
+   /// cleanly had to wait to be fired, and its track record across engrams could not tell a clean exit
+   /// from a firing. This is the one ending the agent itself chooses, and the registry records it
+   /// under its own reason (`#Resigned`), never folded into a revocation.
+   /// 
+   /// TERMINAL for this principal on this engram, exactly like a revocation: the record stays (status
+   /// `#Resigned`, auditable), and `pairAgent` refuses any principal that already holds a
+   /// record, so returning means a different principal and a fresh invite from the owner.
+   /// 
+   /// SELF-SERVICE, so the refusals are about the record's state, not the caller's standing:
+   /// `#NotFound` for a caller that is not an agent here, `#Conflict` for one already ended.
+   /// The roster change and its chained audit line commit BEFORE the registry is told, so a registry
+   /// that is down cannot leave the agent half-resigned; a missed notice is logged by
+   /// `notifyRegistryAgentEdge`. WHAT WOULD MAKE THIS WRONG: a second path that sets `#Resigned`.
+   resignAgent: () -> (Result_1);
+   /// OWNER-ONLY release of the write pause, with the same one-way shape as `unfreezePayments`: a
+   /// guardian holding `canPauseWrites` can stop writes without the owner and cannot restart them,
+   /// and the owner can always restart them. A tripwire rather than a lock.
+   resumeWrites: () -> (Result_1);
+   /// Self-heal: re-send every ACTIVE agent's start to the spawning registry (idempotent — the
+   /// registry mints no duplicate for an open engagement), for when a notice was missed. Owner-only.
+   /// Returns how many the registry ACKNOWLEDGED. ⟨2026-09-28: it used to count sends that did not
+   /// throw, against a method that could not say no; it now counts `#Ok` answers.⟩ It re-sends
+   /// starts only: an ending carries a reason this roster does not keep per principal.
+   /// 
+   /// ⟨CORRECTED 2026-09-29, review finding LIFE-2 — owner's option A⟩ It now re-sends ENDINGS as
+   /// well as starts, endings first (`AgentEdges.resyncPlan` says why): every ended record on the
+   /// roster and every agent a reset removed keeps its ending's reason and day
+   /// (`Types.AgentEnding`), so an ending the registry never received — the one loss that used to
+   /// show an engram's engagement as live on the agent's record forever and block the agent's later starts here —
+   /// is recorded by one call of this. The registry answers an ending it already holds `#Ok`.
+   /// RESHAPED REPLY: `Types.ResyncReport` in place of a bare count — the endings and starts the
+   /// registry acknowledged, and every notice it did not, with its own words, so the owner can tell
+   /// an expected answer (an ending for a start that was never recorded says so) from a real one.
+   /// The calls leave in batches of `RESYNC_BATCH`, each batch in order and wholly answered before the
+   /// next leaves, so the order above holds at the registry.
+   /// ⟨2026-09-29⟩ WHAT A RESYNC CANNOT DO: record an engagement whose start the registry never
+   /// recorded and which has since ENDED. A start is re-sent only for an agent still active here, so
+   /// all that is left to send is the ending, and the registry has nothing to end. The report lists
+   /// each such engagement under `cannotBeRecorded` (key, root, invite, and how and when it ended),
+   /// apart from `notRecorded`, so the owner sees them rather than silence.
+   resyncAgentEdges: () -> (Result_13);
+   /// Return to managed custody: the engram adds the registry back as a controller ALONGSIDE the
+   /// owner — it does not remove the owner. The inverse of `claimSovereignty`, and the reason
+   /// sovereignty is not a one-way door.
+   returnToManaged: () -> (Result_1);
+   /// Replace the whole content of an EXISTING file.
+   /// 
+   /// This is the one thing agents could never do before: every agent write was an append,
+   /// so a file could only ever grow. The ruling that opened it is narrow, and every part of the
+   /// narrowness is enforced below — an agent may replace content only on a path the owner has
+   /// granted, only where retention is not #vault, and only where the file already exists. Vault
+   /// paths stay append-only forever, which is the claim the product makes about them.
+   /// 
+   /// Replacing is safe here in a way it was not in the legacy store: the prior version is not
+   /// overwritten, it is superseded. It stays readable, its hash stays committed, and the agent
+   /// floor keeps its bytes for the window a counterparty needs to extract them.
+   /// ⟨0.16.0, L1⟩ FIVE AGENT REFUSALS, ALL `#Refused`, AND THE UNIFORMITY IS THE FINDING.
+   /// 
+   /// Reserved path, protected path, missing permission, ungranted revise path, `#vault` class — a
+   /// caller could previously tell these apart only by reading five different sentences, and every
+   /// one of them ends the same way: this agent may not make this write, and no retry by this
+   /// agent changes that. The prose already said "Not operator-retryable" four times over,
+   /// because a text field was the only place to put it. It is an arm now.
+   /// 
+   /// The one that could tempt a different arm is `#vault`, which looks like a state fact. It is
+   /// not: the class is an AUTHORIZATION statement about who may replace content there, and it
+   /// resolves to the same "you may not", forever, for everyone but the owner.
+   reviseMemory: (path: text, content: blob) -> (Result);
+   /// Owner-only: revoke one agent.
+   /// 
+   /// ⚠ SOFT AND TERMINAL, which sounds contradictory and is not. The record is not deleted — the
+   /// status becomes `#Revoked` and the row survives, which is what makes the revocation auditable.
+   /// And because `pairAgent` refuses any principal that already holds a record of ANY
+   /// status, this is permanent FOR THAT PRINCIPAL: they cannot be re-invited. Re-admitting the same
+   /// human means a different wallet.
+   /// 
+   /// To narrow what an agent may do rather than end its access, use `setAgentPermissions`.
+   revokeAgent: (agentPrincipal: principal) -> (Result_1);
+   /// Owner-only panic button: revoke EVERY active agent at once. Returns how many were revoked.
+   /// 
+   /// ⚠ IT REVOKES ONLY AGENTS. Invites and connector bearer tokens are separate surfaces with
+   /// their own buttons (`revokeAllInvites`, `revokeAllBearerTokens`), and an owner reaching for one
+   /// of these in an emergency almost certainly wants all three. Nothing here cascades.
+   /// 
+   /// ⚠ AND IT IS IRREVERSIBLE PER PRINCIPAL, which a "revoke all" reads as temporary and is not.
+   /// Each agent's record is set to `#Revoked` rather than deleted, and `pairAgent`
+   /// refuses any principal holding a record of ANY status — so every wallet this touches can never
+   /// be an agent on this engram again. Re-admitting the same agents means new keys. Only
+   /// `resetEngram` clears the records, and it severs everything else with them.
+   /// 
+   /// The revocation is committed BEFORE the registry is told: state is cleared, the audit line is
+   /// written, and only then does it await one notification per revoked agent. So a notification
+   /// that fails leaves the agents revoked here regardless — a partial notify is not a partial
+   /// revocation, which is the direction that matters for a panic button.
+   revokeAllAgents: () -> (Result_8);
+   /// Owner-only panic button: revoke every connector bearer token at once. Returns how many.
+   /// 
+   /// The THIRD independent surface — hosted connectors authenticate with bearer tokens, not with
+   /// agent records or invites, so neither of the buttons above touches them. An owner cutting
+   /// off access completely needs all three, and this is the one that reaches an AI host already
+   /// holding a live session.
+   /// 
+   /// Tokens are re-issuable: revoking them is not permanent the way revoking an agent is.
+   revokeAllBearerTokens: () -> (Result_8);
+   /// ⟨0.16.0⟩ `removeAllGuardians` DELETED — test-only (L6), and verified NOT part of KILL-SWITCH's
+   /// mass-revoke set. The destructive phase-07 suite iterates `removeGuardian` instead, so nothing
+   /// loses a capability: what dies is a bulk spelling no runbook ever invoked.
+   /// Owner-only panic button: void every unredeemed invite. Returns how many were voided.
+   /// 
+   /// Separate from `revokeAllAgents`: this stops invites that have NOT been redeemed yet and
+   /// touches no existing agent. An invite already redeemed is an agent, and only the other
+   /// button reaches it.
+   /// 
+   /// Unlike revoking an agent, this costs nothing permanently — an invite is a one-time code,
+   /// so voiding it and minting a fresh one is the ordinary path.
+   revokeAllInvites: () -> (Result_8);
+   /// Revoke a bearer token by its public tokenId. Idempotent.
+   /// Subsequent /mcp requests using this token will be rejected.
+   revokeBearerToken: (tokenId: text) -> (Result_1);
+   /// ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>` — same reason as the delete
+   /// above, and sharper here: a rollback WRITES A NEW VERSION, so the caller's next question is
+   /// always "which version am I on now". `r.version` was already read for the audit line.
+   rollbackMemory: (path: text, toVersion: nat) -> (Result);
+   /// SELF-SERVICE, and that is the surprising part: the AGENT calls this, not the owner. An
+   /// agent rotates its own CallerKey binding without needing the owner to act.
+   /// 
+   /// ⚠ IT ROTATES THE KEY, NOT THE PRINCIPAL. Only `publicKeyHash` changes; the agent record
+   /// stays keyed on the same principal, keeps its permissions, and keeps its place against the
+   /// one-shot registration rule. So this is the answer to "my key is compromised", and it is NOT a
+   /// way to move an agent seat to a different wallet — that is a new invite, and only if the
+   /// old principal was never revoked.
+   /// ⟨CORRECTED 2026-09-29, the owner's ruling of that date (follow-up 10, option A)⟩ Two sentences
+   /// above are no longer true. An agent's record CAN now move to a different key, in one step and
+   /// with no new invite: `nominateAgentKey` from the current key, then `acceptAgentKeyNomination`
+   /// from the new one. And a compromised key is answered by that move — this method only changes a
+   /// recorded hash, and the compromised principal keeps calling as the agent. This method still
+   /// does what it says; the move is the one that changes which key the engram answers.
+   /// 
+   /// `#Conflict` rather than `#Refused` for a `#Revoked` or `#Resigned` record: the caller IS the
+   /// agent on that record, so its standing is not the problem — the record's state is. An
+   /// agent reading `#Refused` would go looking for a permission that was never missing.
+   rotateAgentKeyHash: (newPublicKeyHash: text) -> (Result_1);
+   /// One-time onboarding seed: writes a starter file so the first read-back is non-empty.
+   /// 
+   /// Owner-only, and it REFUSES once any memory exists — so it can only ever add the initial
+   /// placeholder and can never overwrite real content. Deliberately NOT counted as a write (no
+   /// `totalMemoryWrites`, no `firstWriteAt`): it is a system seed rather than activity, and
+   /// counting it would corrupt both the write metrics and time-to-first-write for every engram.
+   seedMemory: (path: text, content: blob) -> (Result);
+   /// Append to a memory file against a PAID x402 session voucher — the write half of the paid rail,
+   /// authorized by the voucher rather than by a role.
+   /// ⟨2026-09-30, ic402 2.17.0⟩ Authorized by the payer's own call with the voucher: only the
+   /// principal that opened the session, calling as that key, can spend it (see `sessionReadMemory`).
+   /// ⟨CORRECTED 2026-09-30, the owner's answer "2 fresh key"⟩ Authorized by the session KEY's own
+   /// call: the fresh key the payer named at open. The write is attributed to the payer, who paid;
+   /// the record row also names the key that made it.
+   /// 
+   /// ⚠ AS WITH `sessionReadMemory`, EVERY REFUSAL FIRES BEFORE THE VOUCHER IS CONSUMED — nothing is
+   /// written and no funds move. It refuses when payments are frozen, when writes are PAUSED, and
+   /// when the engram is client-side encrypted: a paid session appending plaintext to an encrypted
+   /// store would CORRUPT it, so that refusal is protecting the owner's data rather than gating
+   /// access. Append through the EngramX client/SDK instead.
+   /// ⟨API-101/DEC-101, 2026-08-24 — v3 phase X3⟩ RETURNS THE SAME RECEIPT THE FREE WRITER DOES.
+   /// It answered `Wire.Result<Nat>`: the version, and nothing else. The free `writeMemory` returns
+   /// `{ version; seq; head }`, so a PAYING writer got strictly LESS evidence than a caller who paid
+   /// nothing — on the one rail a stranger can buy, where the receipt is the whole product. The head
+   /// is what makes an append verifiable by someone who was not there; a bare version number is not
+   /// checkable against anything.
+   /// 
+   /// It cost nothing to fix: `r` was already in scope and already being read — the old body did
+   /// `let v = r.version` and passed `r` to `receiptSuffix(r)` for the audit line, then discarded
+   /// everything but the version on the way out. Free until the cut, breaking forever after, which
+   /// is why it lands now rather than after the test migration (ruling R-A2).
+   sessionAppendMemory: (voucher: Voucher, path: text, content: blob) ->
+    (Result);
+   /// The whole engram in one call — newest-first, byte-capped — for an AI host to inject at session
+   /// start. The "read me back" that continuity is built on. `clientLabel` names the reading host
+   /// (e.g. "openclaw", "claude.ai") for the distinct-reader set.
+   /// 
+   /// ⚠ AN UPDATE, NOT A QUERY, AND ON PURPOSE (L7). `readMemory`/`readMemoryBatch` are queries and
+   /// therefore CANNOT persist a read count; this runs on the update path and bumps the reuse
+   /// counters, so a builder whose SDK calls `startSession()` registers a weekly-reused engram as a
+   /// byproduct of normal use rather than through an elective, separate read. Callers should expect
+   /// update latency and consensus cost here, and get a recorded read in exchange.
+   /// 
+   /// ⚠ IT DOES NOT RETURN EVERYTHING, and the omission is deliberate: `config/` and `secrets/` are
+   /// SKIPPED. Those are operational, not agent memory, and must never be blindly spilled into a
+   /// model's context window — so a caller must not treat this as a complete listing of the engram.
+   /// 
+   /// ⚠ RAW STORED BYTES, like `readMemoryBatch`. On a Private (encrypted) engram the content is
+   /// CIPHERTEXT; the key-holding SDK decrypts it. A caller without the key gets bytes it cannot
+   /// read, not an error.
+   sessionReadContext: (clientLabel: text) -> (Result_12);
+   /// Read one memory file against a PAID x402 session voucher. No role, no invite — the voucher is
+   /// the authorization, which is what makes this the engram's one rail a stranger can pay to use.
+   /// 
+   /// ⟨2026-09-30, ic402 2.17.0⟩ WHO MAY SPEND A SESSION: only its payer, calling as the same raw
+   /// Ed25519 key that opened it. The voucher still carries the amount and the sequence; the
+   /// authorization is now the call itself, and the canister no longer checks a voucher signature.
+   /// A stranger can still pay to use this rail — by opening a session of their own.
+   /// ⟨CORRECTED 2026-09-30, the owner's answer "2 fresh key"⟩ Not the payer: the session's own key
+   /// — the fresh Ed25519 key the payer named at open — calling as itself. The payer, who opened
+   /// the session and closes it, is refused here like anyone else who is not that key.
+   /// ⟨CORRECTED 2026-09-30, review⟩ …unless the payer named their own identity key at open, which
+   /// nothing refuses: then the payer IS that key and spends.
+   /// 
+   /// ⚠ EVERY REFUSAL BELOW HAPPENS BEFORE THE VOUCHER IS CONSUMED, so **no funds move on any of
+   /// them**. That is the property a payer most needs and the one a signature cannot express: a
+   /// refusal here costs nothing, and retrying after the owner changes something costs nothing extra.
+   /// 
+   /// It refuses when:
+   ///   · **Paid reads are not enabled — and they are OFF BY DEFAULT.** Selling the owner's memory to
+   ///     any voucher-bearer is a deliberate choice, not a default posture, so on a fresh engram this
+   ///     is the refusal you will get. `getEngramCard`'s `x402Support` reports this same flag, so a
+   ///     buyer can check before paying rather than discover it here.
+   ///   · **The engram is Private (client-side encrypted).** A paid session holds no key and the
+   ///     canister never decrypts, so it could only return ciphertext. Read through the EngramX
+   ///     client/SDK instead — this is not a permission problem and no setting fixes it.
+   ///   · **The path is `config/` or `secrets/`.** Owner-only on every other surface, and a paid
+   ///     session must not be the side door: without this guard a stranger holding a fraction-of-a-
+   ///     cent voucher could read `secrets/*`.
+   ///   · Payments are frozen on this engram.
+   sessionReadMemory: (voucher: Voucher, path: text) -> (Result_11);
+   /// Configure action alerts: an https webhook that receives new chained-audit entries matching the
+   /// enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
+   /// POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
+   /// details) — never memory file contents. Setting a URL (re)arms delivery FROM NOW: the cursor
+   /// jumps to the current end of the log so history is not replayed. Passing url = null disables.
+   /// The URL itself is never written to the audit log (webhook URLs often embed secret tokens).
+   setActionAlertConfig: (cfg: AlertConfig) -> (Result_1);
+   /// Owner-only: replace an existing agent's permission set. The way to NARROW what an agent
+   /// may do without ending their access — `revokeAgent` is terminal for that principal, this is
+   /// not.
+   /// 
+   /// ⚠ ONE GRANT IS REFUSED OUTRIGHT: memory-read to the EngramX PLATFORM principal while this
+   /// engram is Private (encrypted), because that principal could then derive the decryption key and
+   /// Private mode would be a claim rather than a property. It is the mirror of the guard on
+   /// `setEncryptionEnabled`, which refuses to ENABLE Private while that grant already exists —
+   /// between them the invariant holds whichever order an owner works in.
+   /// 
+   /// That refusal is `#Refused` ABOUT THE SUBJECT, not about the caller: the owner is authorized
+   /// and the grantee is not eligible. It is standing rather than a conflict to resolve, so the way
+   /// forward is to grant read to your own agents instead, or to switch to Connected mode first —
+   /// both of which the message says.
+   setAgentPermissions: (agentPrincipal: principal, permissions:
+    AgentPermissions) -> (Result_1);
+   /// Paths an agent holding a grant may REVISE rather than only append to.
+   /// 
+   /// Matching is EXACT, except that an entry ending in "/" grants everything beneath it. A grant
+   /// is a power, so the default reading is the narrow one; the directory form exists because the
+   /// real use case is rotating dated files under a prefix, and per-file grants would be unusable
+   /// for that. What a bare prefix would do — "MEMORY.md" also matching "MEMORY.md.bak" — is the
+   /// kind of accident a permission surface must not have.
+   setAgentRevisablePaths: (paths: vec text) -> (Result_1);
+   /// ⟨0.16.0 — census row⟩ Returns the APPLIED config, which is how this closes the
+   /// setter-without-a-getter gap without adding a method: the write is the read.
+   /// 
+   /// `prunedBackups` is the part that matters. Enforcing a retention cap DELETES finalized backups
+   /// beyond it, and this method used to answer `#Ok(())` over that — the module's own comment
+   /// called it an "ops floor: retention enforcement deletes owner backup data silently", mitigated
+   /// by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
+   /// they are told how many, in the reply and in the audit line.
+   setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_10);
+   /// Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
+   setCallerSpendPolicy: (caller: principal, policy: SpendingPolicy) ->
+    (Result_1);
+   /// Owner-only: set how many engrams `agentPrincipal`'s agent may open of its own through this
+   /// engram. Kept by the agent's lasting key, so it carries over a key replacement. Any count is
+   /// accepted; the registry lets a lasting key open one engram through a parent, ever, so 1 or more
+   /// behaves as 1. 0 withdraws it.
+   /// 
+   /// APPROVING IS GIVING: what this engram attaches to open an engram (1.3 T cycles) is the agent's
+   /// from the moment that engram exists — the agent's lasting key owns it, and nothing is ever taken
+   /// back. The change is written to the record under `agent.childAllowance.set`, which is in the
+   /// alerts' money class (`ActionAlerts.classify`), so an owner or guardian with an alert channel
+   /// hears of it.
+   setChildAllowance: (agentPrincipal: principal, allowed: nat) -> (Result_1);
+   /// ⟨0.16.0⟩ `getEncryptedMemoryKeyForEpoch` DELETED — folded into `getEncryptedMemoryKey`'s epoch
+   /// argument — see that method for the fold and the `null`-means-CURRENT rule.
+   /// Owner-only: turn client-side memory encryption (Private mode) on or off for FUTURE writes.
+   /// 
+   /// ⚠ IT DOES NOT TOUCH EXISTING FILES, and this is the fact that decides whether calling it alone
+   /// is safe. Verified at the site 2026-08-21: the body sets the flag and writes an audit line —
+   /// there is no migration pass. So
+   ///   · turning it ON leaves everything already stored as PLAINTEXT at rest, and
+   ///   · turning it OFF leaves everything already stored as CIPHERTEXT, which the hosted connector
+   ///     cannot read.
+   /// Either direction leaves a MIXED store that the flag alone misdescribes. The owner console
+   /// pairs this call with a migration (`useMemoryEncryption`'s `migrate` / `migrateToPlaintext`)
+   /// for exactly that reason; a caller reaching this method directly gets the flag and nothing else.
+   /// 
+   /// ⚠ ENABLING IS REFUSED while the EngramX platform principal holds memory-read access as an
+   /// agent — it could derive the decryption key, which would make Private mode a claim rather
+   /// than a property. Revoke that agent's read access first. The refusal says so, and it is a
+   /// `#Conflict` rather than a `#Refused` because the caller IS the owner and the problem is the
+   /// engram's state, not their standing.
+   /// 
+   /// Private mode also closes the paid read rail by construction: a paid session holds no key, so
+   /// `sessionReadMemory` refuses on an encrypted engram whatever `setPaidMemoryReadEnabled` says.
+   setEncryptionEnabled: (enabled: bool) -> (Result_1);
+   /// Register the owner's EVM address for withdrawals.
+   /// 
+   /// First set: immediate — no guardian needed.
+   /// Change: only allowed if an active guardian exists (proving the owner
+   /// has a safety net). Without a guardian, the address is locked after
+   /// first set — this prevents a compromised II from silently redirecting
+   /// EVM withdrawals when no one is watching.
+   /// 
+   /// The guardian doesn't approve the change — the owner is sovereign.
+   /// The guardian's existence is the gate, not their active consent.
+   setEvmOwnerAddress: (evmAddress: text) -> (Result_1);
+   /// A guardian arms their OWN webhook over the guarded engram's audit stream (same event
+   /// classes and payload as the owner channel — audit metadata, never memory file contents;
+   /// the guardian honesty rail: integrity, not content). Active guardians only. Arming starts
+   /// from NOW (no history replay); url = null disarms and frees the slot.
+   setGuardianAlertConfig: (cfg: AlertConfig) -> (Result_1);
+   /// Per-prefix retention policy. Longest prefix wins; anything unmatched keeps everything.
+   /// 
+   /// A CHANGE does not take effect immediately, in EITHER direction: every prefix whose EFFECTIVE
+   /// class moves is guarded for the same window as the agent floor, so history cannot be
+   /// thinned in the same sweep as the decision to thin it. Loosening waits too — distinguishing
+   /// "tightened" from "loosened" precisely would mean comparing two cap lattices, so armGuards
+   /// (RetentionPolicy.mo) guards any change it sees. That is the conservative reading, and its
+   /// only cost is a delay on keeping MORE, which destroys nothing.
+   setMemoryRetentionPolicy: (entries:
+    vec record {
+          text;
+          RetentionClassSpec;
+        }) -> (Result_1);
+   /// Owner-only: open or close the monetized read rail. When disabled (the default), sessionReadMemory
+   /// fails closed for every voucher-bearer — selling the owner's memory is opt-in, not the default.
+   /// 
+   /// ⚠ ENABLING IT IS NOT SUFFICIENT. On a Private (encrypted) engram `sessionReadMemory` still
+   /// refuses, because a paid session holds no key and the canister never decrypts — see
+   /// `setEncryptionEnabled`. An owner who turns this on and still sees refusals should check that
+   /// flag before looking anywhere else.
+   /// 
+   /// `getEngramCard`'s `x402Support` reports THIS flag, so a buyer can read the rail's state before
+   /// paying rather than discovering it in a refusal.
+   setPaidMemoryReadEnabled: (enabled: bool) -> (Result_1);
+   /// Open or close the paid-memory WRITE rail (RB4). Owner-only, like its read twin.
+   /// 
+   /// Kept as a SEPARATE flag rather than widening `setPaidMemoryReadEnabled` into one switch: an
+   /// owner selling read access has not thereby agreed to sell write access, and a single flag makes
+   /// the larger permission ride in on the smaller one. Two flags is the shape that lets an owner
+   /// say yes to one and no to the other, which is the common case.
+   setPaidMemoryWriteEnabled: (enabled: bool) -> (Result_1);
+   /// ⟨0.16.0, L1⟩ Every validation refusal here is `#Invalid` and the cap is `#Conflict`, and the
+   /// split is worth stating once for the whole whole-value-config family below: a malformed path is
+   /// the CALLER'S to fix and retrying with a corrected list works, while "max 20" is a property of
+   /// this engram that no argument gets around. A caller that cannot tell those apart either edits
+   /// forever or gives up on a request that was one character from valid.
+   setProtectedPaths: (paths: vec text) -> (Result_1);
+   /// OWNER-ONLY: switch the metrics reader's read of the seat weeks off (`false`) or back on (`true`).
+   /// On from birth, by the owner's ruling of 2026-10-02. Off, `sysGetAgentSeatWeeks` refuses the
+   /// reader by name, naming this switch; the rows are still kept and the owner still reads them. Each
+   /// call is a chained record entry (`metrics.setSeatWeeksReadEnabled`, the new and the old value), so
+   /// when the read was on or off is part of the record. Anyone else is refused by name.
+   setSeatWeeksReadEnabled: (enabled: bool) -> (Result_1);
+   /// Set the most this engram may spend per day ACROSS EVERY CALLER — five agents, the owner and the
+   /// marketplace together. `null` removes the ceiling. ⟨2026-09-28⟩
+   /// ⟨CORRECTED 2026-09-29, review finding X-8: "spend" was too wide. The ceiling covers the x402
+   /// payments this engram signs (`signX402Payment` and the marketplace's `sysSignX402Payment`) and
+   /// nothing else: it is the most this engram may sign in x402 payments per day. Two other signing
+   /// paths are NOT counted against it — typed-data signatures (`signEip712` / `sysSignEip712`),
+   /// bounded instead by each registered type's daily count and destination list; and agent-
+   /// registration transactions (`signEngramRegistration`), bounded by three per caller per day and
+   /// the 500-gwei gas ceiling. Whether the ceiling should cover them is a separate owner question.⟩
+   /// 
+   /// WHY: the owner decided on 2026-09-28 to add one daily spending ceiling across all callers on an
+   /// engram and keep the limit of five agents. Every other spending limit is per caller, so without
+   /// this the engram's daily exposure was the SUM of up to seven allowances ($35.00 at the defaults)
+   /// and nobody could see it. The amount is in the same minor units the per-caller caps compare
+   /// (USDC's six decimals: 5_000_000 = $5.00), and like them it does not distinguish tokens.
+   /// 
+   /// A payment that would take today's engram-wide total past this number is not signed: the caller
+   /// gives a reason and it becomes a row in the approval queue, exactly as over a per-caller cap.
+   /// `0` is allowed and means every payment needs the owner's approval.
+   /// ⟨CORRECTED 2026-09-29, review finding X-2: not every payment — a payment of amount 0 crosses no
+   /// limit, so it is signed under a ceiling of 0 too. Whether amount-0 payments should be refused is
+   /// an open owner question.⟩ ⟨CORRECTED 2026-09-29, later — the owner ruled (follow-up 15, option A):
+   /// a payment of amount 0 is now refused by name before any limit is read (`X402Input.refusal`), so
+   /// under a ceiling of 0 every payment that can be signed at all does need the owner's approval.
+   /// And a new engram no longer starts with no ceiling: it starts at `SpendCeiling.DEFAULT_ENGRAM_DAY`
+   /// ($10.00 a day; follow-up 9, option A).⟩ Takes effect on the next
+   /// payment, counted against what was ALREADY spent today (the total is kept whether or not a
+   /// ceiling is set), so setting a ceiling at noon does not grant a fresh day.
+   /// 
+   /// Unlike `setSpendPolicy`, this does NOT auto-approve pending requests it now covers — a request
+   /// held by the ceiling waits for `approveRequest`, or the caller retries against the new ceiling.
+   /// The auto-approval exists for per-caller raises and is kept away from the ceiling on purpose
+   /// (see `resolvePendingOnPolicyRaise`).
+   /// 
+   /// The record entry `spend.setCeiling` carries the new AND the previous value, so a widening is
+   /// distinguishable from a tightening afterwards — the reason `spend.setPolicy` records its limits.
+   /// Not blocked by a payments freeze, like `setSpendPolicy`: setting a limit moves no money.
+   setSpendCeiling: (maxPerDay: opt nat) -> (Result_1);
+   /// Set this engram's spending caps.
+   /// 
+   /// The audit row records the LIMITS, not merely that a change happened, so a WIDENING is
+   /// distinguishable from a tightening afterwards. A quiet policy raise is the shape most custody
+   /// incidents take, and "policy changed" alone cannot tell an investigator which way it moved.
+   /// 
+   /// Raising a cap RESOLVES pending approval requests it now covers — that is the second half of
+   /// the escalation an agent starts when it hits a limit, and without it the queue is a place
+   /// requests go to expire.
+   setSpendPolicy: (policy: SpendingPolicy) -> (Result_1);
+   /// Owner-only: set YOUR OWN safety rails on the funding path — a per-top-up ckUSDC ceiling and a
+   /// minimum gap between top-ups. Read them back with `getTopUpLimits`.
+   /// 
+   /// ⚠ THESE ARE THE OWNER'S LIMITS, NOT THE PLATFORM'S. "Limits" reads like something imposed;
+   /// nothing outside this engram sets them, and an owner may raise them at will. They exist so a
+   /// compromised agent key or a runaway agent cannot drain a wallet in one call or in a fast loop,
+   /// which is a bound on YOUR OWN blast radius rather than on what you are permitted to spend.
+   /// 
+   /// The cooldown defaults to five minutes. `cooldownSeconds = 0` removes the gap entirely, which
+   /// is a real choice and not an error.
+   /// ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE RECORD, NOT TWO ADJACENT NATS. This took
+   /// `(newMaxCkusdcE6s : Nat, cooldownSeconds : Nat)` — the documented swap class, and a live one:
+   /// the suite calls `setTopUpLimits(10_000_000n, 300n)`, and a caller who transposes those gets a
+   /// 300-e6 cap with a 116-DAY cooldown. Candid matches positionally and both are `nat`, so the
+   /// wire accepts it, the types accept it, and the engram is quietly unable to top itself up.
+   /// 
+   /// The field names are NOT a new vocabulary — they are `getTopUpLimits`'s, which already answers
+   /// `{ cooldownSeconds; maxCkusdcE6s }`. Setter and getter now share one shape, so read-modify-
+   /// write is expressible and neither side can drift from the other without the compiler saying so.
+   setTopUpLimits: (limits:
+    record {
+      cooldownSeconds: nat;
+      maxCkusdcE6s: nat;
+    }) -> (Result_1);
+   /// Owner sets the World ID app_id + action + rp_id from their World Developer Portal (rp_id appears
+   /// after "Enable World ID 4.0" on a production app). The action MUST be configured there with
+   /// max_verifications = Unlimited (idempotent /verify → survives IC consensus). After setting this,
+   /// register getWorldIdRpSignerAddress() as the rp_id's signer address in the Portal.
+   setWorldIdConfig: (appId: text, action: text, rpId: text) -> (Result_1);
+   /// Submit a verified-human proof: the IDKitResult from the frontend's World ID flow, forwarded
+   /// VERBATIM (compact JSON, as JSON.stringify emits) to World's /api/v4/verify/{rp_id} over an HTTPS
+   /// outcall (never trust the client). The v4 endpoint verifies both 4.0 proofs and legacy 3.0 proofs,
+   /// so the OrbLegacy migration path and the 4.0 endgame ride the same method. Owner-only. `nullifier`
+   /// is the claimed unique-human pseudonym; it must appear verbatim inside resultJson, binding what we
+   /// store to the payload the verifier actually accepted. Only proof_of_human credentials are accepted
+   /// (selfie is farmable, passport/mnc are document identity — a different tier). Sets worldIdVerified
+   /// and stores the result ONLY on a real verification success — never self-asserted.
+   setWorldIdProof: (resultJson: text, nullifier: text) -> (Result_1);
+   /// Sign a registered type. ONE call, owner-only, freeze-gated — the delay lives on registration
+   /// (D2), never here: an emergency withdrawal must not need two owner round-trips.
+   /// 
+   /// ⟨0.16.0⟩ PERSISTS beside the market's `sysSignEip712` (census row 177, ruled). The owner does
+   /// not lose the ability to sign because a marketplace gained it, and the two share every control
+   /// below the caller gate.
+   signEip712: (typeId: blob, values: vec record {
+                                            text;
+                                            Eip712Value;
+                                          }) -> (Result_4);
+   /// Sign the engram's own ERC-8004 registration tx for client-side broadcast: the engram signs, the client
+   /// broadcasts and keeps the resulting registration id.
+   /// 
+   /// Agent-accessible. The comment here claimed "saves ~55-85M cycles vs registerAgent" until
+   /// 2026-08-17; `registerAgent` — the engram method that broadcast the registration itself — left
+   /// the candid surface in commit d25b53b, so the comparison had outlived its other term. The
+   /// saving was real and is now simply the shape of this method: no RPC outcall, no receipt poll.
+   /// ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE REQUEST RECORD, not three adjacent nats.
+   /// 
+   /// ⟨Ruling R-B3⟩ This method KEEPS. Census row 309 dispositions it `die` ("test-only; folds into
+   /// signEip712 + registered type") and row 311 records the owner's answer: RULED 2026-08-20 —
+   /// KEEP, ERC-8004 stays. Both halves of the `die` rationale fail at the site: it is not
+   /// test-only (a downstream web client's billing page calls it), and it is not a shipped customer
+   /// capability either — that panel sits behind `evmBilling: { mode: 'off' }` in both the flag
+   /// defaults and the shipped config, and its own dialog says the signature is dormant and not
+   /// broadcastable. It is a real surface in a disabled state, which is neither thing the census
+   /// row claimed.
+   /// 
+   /// THE SWAP CLASS, and here it is three-deep: `nonce`, `maxFeePerGas` and `maxPriorityFeePerGas`
+   /// were adjacent and all `Nat`. Transposing the two gas fields type-checks, decodes, and signs a
+   /// transaction whose priority fee exceeds its max fee — invalid on chain, and the 500-gwei
+   /// ceiling below cannot see it because both values are individually under the cap. Named fields
+   /// remove the class.
+   /// 
+   /// ⟨2026-09-28⟩ LIMITED PER CALLER PER DAY. The owner decided to cap this signature rather than
+   /// delete it: each caller (the owner, or an active agent) may obtain
+   /// `EngramRegCap.MAX_PER_CALLER_PER_DAY` registration signatures per UTC day; the next is refused
+   /// with `#Conflict` naming this method. A signature that fails does not count. The `nonce` must
+   /// be the REGISTRATION address's nonce — `getEvmAddress().engramRegistration` — below 2^64 − 1.
+   signEngramRegistration: (req:
+    record {
+      maxFeePerGas: nat;
+      maxPriorityFeePerGas: nat;
+      nonce: nat;
+    }) -> (Result_9);
+   /// Sign an EIP-3009 authorization for x402 payment. Agent-accessible.
+   /// Client probes the URL, extracts chain/token/recipient/amount from the 402, and calls this.
+   /// Canister signs → returns header → client retries with header.
+   /// 
+   /// ⟨0.16.0⟩ PERSISTS beside the market's `sysSignX402Payment` (census row 177, ruled). An agent
+   /// with an x402 rail does not lose it because a marketplace gained one, and both run the same body.
+   /// ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE REQUEST RECORD, not eight positional arguments.
+   /// 
+   /// THE HAZARD IS FUNDS MISDIRECTION, and it is the sharpest case in this batch. `tokenAddress`
+   /// and `recipient` were ADJACENT and both `Text`. Candid matches positionally, so transposing
+   /// them type-checks, decodes, and signs a payment whose payee is the TOKEN CONTRACT rather than
+   /// the intended one — an irreversible outbound signature spending the engram's own key, with
+   /// nothing between the mistake and the money. `tokenName`/`tokenVersion` are a second adjacent
+   /// Text pair; that one only corrupts the EIP-712 domain, so it fails loudly instead.
+   /// 
+   /// Named fields remove the class outright: a transposition is now a decode error at the edge.
+   /// 
+   /// The body is UNCHANGED. Each parameter was referenced exactly once below, so the record is
+   /// destructured on entry rather than threaded through — the diff is the signature and this line,
+   /// which is what makes a reshape of a money path reviewable.
+   signX402Payment: (req:
+    record {
+      amount: nat;
+      approvalId: opt text;
+      chainId: nat;
+      rationale: opt text;
+      recipient: text;
+      tokenAddress: text;
+      tokenName: text;
+      tokenVersion: text;
+    }) -> (Result_3);
+   /// Self-heal: if the registry's spawn-time push was missed, the owner pulls the number from
+   /// the spawning registry. Idempotent; fails closed if the registry has no record.
+   syncEngramNumber: () -> (Result_8);
+   /// Genesis seed — the atomic "spawn only when there's real content" primitive. The spawning
+   /// REGISTRY pushes the owner's first real memory immediately after install, so a canister is
+   /// never spawned holding nothing (see the registry's `provisionEngram` optional genesis).
+   /// 
+   /// Gated `spawnedBy`-only and ONE-SHOT: it refuses once any file exists, so it can seed and never
+   /// overwrite. Unlike the owner-only `seedMemory` placeholder this is REAL owner content, so it
+   /// IS counted as an owner write (`firstWriteAt`, `totalMemoryWrites`) and is authored by the
+   /// OWNER rather than by the registry principal that called it. It never touches the
+   /// agent metrics.
+   /// 
+   /// ⚠ THE PAYLOAD IS `Nat` AND MUST STAY `Nat`, which is a constraint on any client of this
+   /// method rather than an internal detail. Its only caller is the registry, over an
+   /// inter-canister boundary, through a hand-declared actor type — and the registry is ROUTINELY a
+   /// different version from the engram template it is seeding: it upgrades before the fleet does,
+   /// and during a transition it can serve a template older than itself. A return-type change here
+   /// breaks genesis provisioning across that skew. That is measured, not predicted: the registry
+   /// trapped with "IDL error: unexpected IDL type when parsing Nat" while seeding an engram built
+   /// at the staging tag. A receipt would buy nothing anyway — the caller does `ignore await`.
+   /// 
+   /// ⚠ ORDERING: upload the engram TEMPLATE first, then upgrade the registry. The reverse leaves a
+   /// window where a spawn seeds an old-shape engram with a new-shape expectation; the reply fails
+   /// to decode and `provisionEngram` dies on a trap its own `try/catch` cannot reach (ADR-0001),
+   /// failing the WHOLE SPAWN rather than just the seed.
+   sysApplyGenesisSeed: (path: text, content: blob) -> (Result_8);
+   /// OWNER force-close, for a session the payer abandoned.
+   /// 
+   /// ⟨R1b, ruled 2026-08-26: owner-gated, NO guardian.⟩ It moves someone else's money, and only ever
+   /// BACK TO THEM — the destination is the session's own payer and is not caller-influenced, so the
+   /// guardian ceremony that guards destination changes buys nothing here and would strand payers on
+   /// engrams that have no guardian.
+   /// 
+   /// Calls the gateway's NO-AUTH variant deliberately. `gate.closeSession` is payer-only, which is
+   /// why the market's admin-gated `forceCloseSession` could never work: it authorised an admin and
+   /// then delegated to a method that rejects everyone but the payer.
+   /// 
+   /// ⟨NOTE 2026-10-02 — NOT RENAMED, deliberately, and this is the one `sys` method that still has a
+   /// human caller.⟩ The sys-tier retier (ruled 2026-08-24, executed 2026-10-02 on the registry and
+   /// the market) named FOUR admin-called methods; this one became owner-gated two days after that
+   /// list was made, so the ruling never named it. Its caller is the OWNER, a person, which is the
+   /// exact thing the retier removes from the `sys` tier — so "a `sys` method has no human caller"
+   /// stays false here until it is renamed too. Left for the owner: the rename is free until the cut
+   /// and a break after it, and it also moves `packages/client/README.md` and
+   /// `docs/AGENT-ONBOARDING.md`, which name it.
+   sysForceCloseSession: (sessionId: text) -> (Result_1);
+   /// The metrics reader the registry designated reads every engagement's seat weeks, in one call.
+   /// 
+   /// CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
+   /// nobody else — not the owner (who reads `getAgentSeatWeeks`), an agent, a guardian, the registry,
+   /// the biller or the market (ADR-0020: a `sys` method names its caller). Answered only while the
+   /// owner leaves it on (`seatWeeksReadEnabled`, on from birth by the owner's ruling of 2026-10-02).
+   /// 
+   /// WHAT LEAVES: per engagement, the pairing day, the first and last payment-signature days, the
+   /// 64-week map and the count — NO root, NO invite, NO amount, recipient or nonce. The reader matches
+   /// rows to the registry's engagements by day, so no agent's identity leaves this engram here.
+   /// 
+   /// ⟨L7⟩ UPDATE, NOT QUERY, so a refusal leaves its `sysGetAgentSeatWeeks.denied` row naming the
+   /// caller's class, and an answered read leaves a `sysGetAgentSeatWeeks` row in the read log — the
+   /// owner can see every time the reader read. A refusal is `#Refused` naming this method and the
+   /// class (`SeatWeeks.readRefusal`), never an empty list: an empty list is a real answer ("no agent
+   /// has paired here"), and a fabricated one would be counted as one.
+   sysGetAgentSeatWeeks: () -> (Result_7);
+   /// The metrics reader the registry designated reads this engram's paid-rail health, in one call:
+   /// the balance and the line it must stay above, the memory that line is computed from, the sessions
+   /// by state, the escrow open sessions hold, the vouchers spent and the refused ones
+   /// (`RailHealth.RailHealth` says what each is, and what is never in it).
+   /// 
+   /// CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
+   /// nobody else — the owner reads its balance through `getOwnerConsole`. Answered only while the
+   /// owner leaves that reader's read on (`seatWeeksReadEnabled`): the SAME gate and the SAME switch
+   /// as `sysGetAgentSeatWeeks`, because it is the same reader and the owner has one switch over it.
+   /// 
+   /// A QUERY, AND A DEPARTURE FROM THE SYS METHODS BESIDE IT, ON PURPOSE ⟨2026-10-02⟩. It is read
+   /// every hour, and as an update it would leave a row in this engram's read log every hour — about
+   /// 720 a month in a record whose rows are what its owner reads. What a query cannot do is write the
+   /// denial row of a refusal (a query's writes are discarded) — the trade `getOwnerConsole` makes. A
+   /// refusal is still `#Err(#Refused …)` naming this method and the caller's class
+   /// (`RailHealth.readRefusal`), never a zero balance: a made-up zero would read as an engram about
+   /// to freeze. Called by another canister, a query runs replicated and this engram pays for it —
+   /// a few million cycles an hour, the cost of being watched.
+   sysGetRailHealth: () -> (Result_6) query;
+   /// The cashier reads how many signatures this engram has produced, per caller and in total.
+   /// ⟨2026-09-28⟩ The owner's decision of that date: a running counter on the engram, exported to
+   /// the cashier — and to nobody else (`AccessControl.requireCashierForSignatureCounts`).
+   /// 
+   /// ONE NEW METHOD ON THE ENGRAM, not a field on the registry's `sysMeterEngram` reply. The study
+   /// ruled out widening that reply to protect deployed clients, and that reason is gone (nothing is
+   /// launched; the next release reinstalls every canister). The deciding fact is a different one,
+   /// read at the site: `sysMeterEngram` is the REGISTRY's method and answers from the management
+   /// canister's `canister_status` — the registry holds no signature count. Carrying the count in its
+   /// reply would add a registry-to-engram call inside the meter and a second trust hop between the
+   /// counter and the biller. The cashier is already the engram's recognised biller (`cashierId`) and
+   /// already calls it directly (`sysRecordFeeEvent`), so it reads the count at the source.
+   /// 
+   /// UPDATE, NOT QUERY, so that a refusal leaves its `sysGetSignatureCounts.denied` row: a refused
+   /// query cannot write one (see `Gated.mo`'s header). A refusal is `#Refused` naming this method,
+   /// never an empty list or a zero — a zero is a real answer, and a fabricated one would be billed.
+   /// 
+   /// ⟨2026-09-29⟩ Each row names the key, the agent it was enrolled under (none for the owner and
+   /// the marketplace) and the role, so one agent's keys can be added up. And a limit for whoever
+   /// bills from this: the number comes from a canister its owner controls and can reinstall, so bill
+   /// only engrams the registry confirms run published code, and read a lower count than last time as
+   /// a reinstall — the reasoning is at `signaturesByCaller`.
+   sysGetSignatureCounts: () -> (Result_5);
+   /// Rent lifecycle notice — how the OWNER (not the agent) learns their subscription lapsed. D6
+   /// shipped the handoff but every alarm it added talks to the operating service's watchdog; the
+   /// doc named the debt plainly: "an owner learns of their own lapse only by looking." This closes
+   /// it through the channel the owner already has: the entry lands in the audit log under `rent.*`,
+   /// ActionAlerts classifies that as #money (default ON), and the drain delivers it to the owner's
+   /// webhook. No new channel, no new config — an owner who armed alerts gets told.
+   /// 
+   /// Gated exactly like sysRecordFeeEvent (spawnedBy or cashierId): the sweep is the only thing that
+   /// OBSERVES the transition, so it is the only thing that can report it. The state whitelist is
+   /// closed — this is a lifecycle feed, not a free-text push surface into the owner's audit chain.
+   sysNotifyRentLifecycle: (state: text, detail: text) -> (Result_1);
+   /// ⟨0.16.0⟩ `getWalletActivation()` DELETED — folded to `about().walletActivatedAtNs`, with its
+   /// custody-posture rationale carried onto the field. "Can this thing hold money" is a question a
+   /// counterparty is entitled to ask before dealing with an engram, which is why it stays public.
+   /// ⟨0.16.0, sys tier⟩ THE MARKET TELLING CUSTODY, which is the half of the wallet-activation
+   /// story the engram cannot see for itself.
+   /// 
+   /// B1 moved the storefront to the market, so listing an endpoint — a seller offering to be paid —
+   /// happens on a canister this one does not observe. `walletActivatedAt` exists to raise a custody
+   /// decision (a wallet-bearing engram is sovereign-by-default and its owner has a claimSovereignty
+   /// still to complete), and a seller who has never derived an EVM address would have gone
+   /// unstamped forever. That is the under-reporting direction, which is the harmful one: a missing
+   /// flag retires a decision that is still pending.
+   /// 
+   /// ONE METHOD, NOT A FAMILY (L6). The other surface the old comment named — opening a payment
+   /// session — is NOT here and is not an omission: measured at the market 2026-08-20, `openSession`'s
+   /// caller is a BUYER, and a buying engram signs with a key it derived through `getEvmAddress`,
+   /// which stamps. It is already marked before it can pay. Adding a case for it would be surface
+   /// bought for a gap that does not exist.
+   /// 
+   /// THE SURFACE WHITELIST IS CLOSED, exactly as `sysNotifyRentLifecycle`'s state whitelist is, and
+   /// for the same reason: this is a lifecycle feed, not a free-text push into the owner's audit
+   /// chain. The market is trusted to REPORT, never to compose what the owner reads.
+   /// 
+   /// IDEMPOTENT AND SILENT WHEN ALREADY STAMPED. `markWalletActivated` returns early once the var is
+   /// set, so a second notice writes nothing and still answers `#Ok` — a retry learns it succeeded
+   /// rather than that it failed. The stamp keeps the FIRST wallet-bearing moment, which is the one a
+   /// custody audit wants; a later notice must not overwrite it with its own time.
+   /// 
+   /// The audit line records this engram as the subject, and `surface=endpoint-listed` is what names
+   /// the origin: only the configured market can pass that value, so the line cannot be produced by
+   /// any other caller.
+   sysNotifyWalletActivity: (surface: text) -> (Result_1);
+   /// The rent RECEIPT seam (B2): the cashier tells this engram that money moved on its behalf, and
+   /// the engram appends a `fee.recorded` line to its own audit chain. It computes nothing.
+   /// 
+   /// ⚠ GATED TO TWO PRINCIPALS AND NEITHER IS THE OWNER — the SPAWNING REGISTRY or the CONFIGURED
+   /// CASHIER. An owner cannot write their own fee receipts, which is the point: a receipt an owner
+   /// could forge is not evidence. `getBillerId` publishes which cashier this engram accepts, so the
+   /// same fact is checkable from outside.
+   /// 
+   /// This is the whole of what B2 left on the engram. Entitlement, custody and fee math live on the
+   /// cashier; here there is an append-only record and no arithmetic — so a disagreement between the
+   /// two is visible rather than reconciled silently.
+   /// ⟨API-105/ARCH-108, 2026-08-24 — v3 phase X3⟩ ONE FEE-EVENT RECORD, not three positional
+   /// arguments. ARCH-108 records that the census prescribed this fold and it "was refused for a
+   /// wire-break reason the ruling voids", with the instruction to execute it or ratify
+   /// positional-forever with a dated note — "silence spends the window". Executed.
+   /// 
+   /// The argument for a record here is EVOLUTION, not transposition: unlike `setTopUpLimits`'s two
+   /// adjacent nats, these three types differ, so a swap would not type-check. What positional
+   /// arguments cost is the next field. A fee event is exactly the shape that grows one — token,
+   /// amount, rate — and ADR-0018's rule is that an INBOUND record gains optional fields forever
+   /// while an argument LIST cannot gain anything without breaking every caller at once.
+   /// 
+   /// ⚠ ALL FOUR CALLERS MOVE IN THE SAME CHANGE, and this is ADR-0001's fatal direction: three
+   /// inline hand-IDLs in the cashier and one in the registry declare this method's argument shape
+   /// structurally. Every one of them sits inside `try { … } catch (_e) {}`, which reads as
+   /// containment and is not: a reply-decode mismatch calls `ic0.trap` INSIDE the caller's own
+   /// callback, and Motoko's `catch` sees rejects, never traps. That is the failure that took
+   /// production monitoring dark for ~33h. The ENGRAM WASM MUST SHIP BEFORE its callers, and
+   /// `check-didc-compat` is suspended for the cut, so nothing mechanical will catch a wrong order.
+   sysRecordFeeEvent: (fee:
+    record {
+      cycles: nat;
+      paidThroughNs: opt int;
+      scheduleVersion: opt text;
+    }) -> (Result_1);
+   /// Point this engram at the biller that converts its tokens → cycles. Settable, not hardcoded:
+   /// coupling is by principal id, so the same wasm runs against any deployment's biller.
+   /// 
+   /// ⟨0.16.0, B2⟩ Renamed from `setCashierId`, and NARROWED to the spawning registry (census row
+   /// 266, ruled). Two changes, for two reasons:
+   ///   · "cashier" is a PLATFORM word and this is the OSS wire. `biller` names the role, not the
+   ///     product that fills it.
+   ///   · The write is now sys-tier. It previously accepted the OWNER as well, and that second
+   ///     writer is what the ruling removed — three writers for one field (owner, spawner, and the
+   ///     frontend acting for the owner) is a last-write-wins race over a money-routing target.
+   /// 
+   /// ⚠ THE COST, RULED AND ACCEPTED: an engram whose registry never set this has NO owner remedy.
+   /// `convertEarningsToCycles` fails closed against a null biller, and with the owner leg gone
+   /// nobody but the spawning registry can fix it. That refusal therefore names the real remedy
+   /// rather than telling an owner to run a call they can no longer make.
+   sysSetBillerId: (id: principal) -> (Result_1);
+   /// One-shot assignment of the spawn ordinal — callable ONLY by the spawning registry, ONLY
+   /// while unset. Neither the owner nor any later registry can change an assigned number.
+   sysSetEngramNumber: (n: nat) -> (Result_1);
+   /// Point this engram at the commerce satellite allowed to ask it for signatures. ⟨0.16.0, B1⟩
+   /// 
+   /// SAME AUTHORITY AS `sysSetBillerId`, and for a stronger reason. That one routes money; this one
+   /// confers the capability to ask this canister to sign with its own tECDSA key. Three writers for
+   /// one field would be a last-write-wins race over a SIGNING target — so the spawning registry is
+   /// the only writer, and an engram with no registry has no market to be pointed at.
+   /// 
+   /// The same accepted cost applies, one notch sharper: an engram whose registry never set this can
+   /// never be sold through the market, and no owner action fixes it. Both `sysSign*` methods refuse
+   /// against a null pointer and their refusals name the registry as the remedy rather than telling
+   /// an owner to run a call they cannot make.
+   sysSetMarketId: (id: principal) -> (Result_1);
+   /// Name the metrics reader allowed to read this engram's seat weeks (`sysGetAgentSeatWeeks`).
+   /// ⟨2026-10-02, the owner's ruling of that day⟩
+   /// 
+   /// CALLER: the registry that spawned this engram, and nobody else (ADR-0020) — the same authority
+   /// as `sysSetBillerId` and `sysSetMarketId`. The registry calls it once, at spawn, last of its
+   /// pushes, with exactly this interface: `sysSetMetricsReaderId : (Principal) -> async
+   /// Wire.Result<()>`. ⚠ THAT CLIENT DECLARATION IS HAND-WRITTEN AT THE REGISTRY: a different NAME
+   /// here leaves every newborn with no reader, silently (the push is best-effort and its reject is
+   /// caught), and a different REPLY type traps inside the registry's callback. Rename neither without
+   /// the registry; test/seat-weeks-wiring.test.ts compares the two.
+   /// 
+   /// A CANISTER ONLY: a person's principal, the anonymous principal or the management canister is
+   /// refused `#Invalid` and nothing changes — a person named here would be handed this engram's seat
+   /// counts. Set or replaced, never cleared: the owner's control is the switch
+   /// (`setSeatWeeksReadEnabled`), not the pointer. The chained record entry
+   /// (`metrics.sysSetMetricsReaderId`) is the evidence of when the read was granted, and to whom.
+   sysSetMetricsReaderId: (reader: principal) -> (Result_1);
+   /// The market asks this engram to sign a registered type — B1's seam, settlement leg. ⟨0.16.0⟩
+   /// 
+   /// THE ENGRAM DOES NOT TRUST THE MARKET WITH ANYTHING BEYOND "ask". Every control that bounds
+   /// what may be signed stays here and is unchanged: the type must already be OWNER-REGISTERED
+   /// (the market cannot introduce a shape), its cool-off must have elapsed, its per-type daily cap
+   /// still binds, the destination allowlist still fails closed, and a payments freeze still stops
+   /// it. What the market supplies is the request; what the engram supplies is the whole policy.
+   /// 
+   /// That is what "signatures only" means in code, and it is why this method needs no new authority
+   /// model: an unregistered typeId is refused for the market exactly as it is for the owner.
+   sysSignEip712: (typeId: blob, values: vec record {
+                                               text;
+                                               Eip712Value;
+                                             }) -> (Result_4);
+   /// The market asks this engram to sign an x402 payment — B1's seam, the paid-request leg. ⟨0.16.0⟩
+   /// 
+   /// THE MARKET SUPPLIES THE REQUEST; THE ENGRAM SUPPLIES THE POLICY. Every control below the caller
+   /// gate is unchanged and still binds: a payments freeze stops it, the recipient must be on the
+   /// owner's EVM allowlist if the owner has set one, the per-transaction and per-day caps hold, and
+   /// an over-policy request goes to the OWNER'S approval queue rather than through.
+   /// 
+   /// `#ApprovalPending` is a real answer here, not an error, exactly as it is for an agent: the
+   /// market is told the spend needs the owner and can retry with the `approvalId` once granted. A
+   /// caller that treats it as a failure will simply never complete a spend the owner would have
+   /// allowed — which is the safe direction, and the reason it rides inside `Ok` (L5).
+   /// 
+   /// READ `x402SignFor`'s declaration before setting a policy for this caller. The cap is ONE bucket
+   /// for ALL market traffic; per-seller limits are not expressible in the store it reads.
+   sysSignX402Payment: (chainId: nat, tokenAddress: text, recipient: 
+    text, amount: nat, tokenName: text, tokenVersion: text, rationale:
+    opt text, approvalId: opt text) -> (Result_3);
+   /// Write an `alerts.test` entry into the audit log; the drain timer delivers it to the webhook
+   /// within ~60s. Owner-only; requires a configured URL so the test can actually go somewhere.
+   testActionAlert: () -> (Result_1);
+   /// Guardian test alert — an audited guardian action (`alerts.test`, role Guardian) that every
+   /// armed channel (owner + guardians) receives within ~60s. Requires the caller's own channel
+   /// to be armed so the test has somewhere to land for them.
+   testGuardianAlert: () -> (Result_1);
+   /// RENAMED from `init` (L2.4). This is the OWNERSHIP-TRANSFER method — the most consequential
+   /// owner-facing operation on the canister — and it was named for first-time setup, colliding with
+   /// the actor's own `service : (initArgs)`. A reader scanning for "how does ownership move" found
+   /// nothing; a reader scanning for `init` found a constructor.
+   /// 
+   /// Its read counterpart is `listOwnershipTransfers` (was `getOwnershipHistory`), which now shares
+   /// the stem — the pair was previously unfindable from either half.
+   /// ⟨0.16.0, L1⟩ TWO OF THESE REFUSALS ARE THE FIRST-CLAIM PATH, and they are not authorization.
+   /// 
+   /// On an unowned engram there is no owner to refuse anyone, so "caller must set themselves as
+   /// owner" is a rule about the ARGUMENT — pass your own principal and it succeeds. `#Invalid` says
+   /// retrying with a different argument can work; `#Refused` would tell a first claimant their
+   /// standing was the problem, on the one call where nobody has standing yet.
+   /// 
+   /// ⟨2026-09-29, owner ruling follow-up 8 (option A)⟩ A CHANGE OF OWNER HANDS OVER CONTROL OF THE
+   /// CODE. The new owner becomes a controller of this canister and the former owner stops being one;
+   /// the answer says who moved it (`ControlHandover`). Managed: the registry moves it while it
+   /// accepts the transfer. Sovereign: the registry answers `#EngramMustMove` and this engram sets
+   /// its own controllers. THE OWNER CHANGES HERE ONLY AFTER CONTROL HAS MOVED — if it cannot move,
+   /// the registry's record is put back and nothing is transferred; if even that fails, the refusal
+   /// says who the registry now records and that the same call again finishes it. A standalone
+   /// engram (no registry) cannot know who controls it and changes the owner only, answering
+   /// `#NotHeldHere`. The rules are `src/shared/ControlHandover.mo`'s.
+   /// 
+   /// ⟨2026-09-29, review PR-3: a half-finished change of owner⟩ The registry now MARKS a change of
+   /// owner as unfinished from the moment it moves its record until it sees control move. A sovereign
+   /// engram therefore reports the move (`sysConfirmOwnershipTransfer`) after setting its own
+   /// controllers; until the registry hears it, the registry refuses the new owner's
+   /// `claimSovereignty`, `returnToManaged`, `abandonMyEngram` and `upgradeMyEngram` for this engram.
+   /// While a transfer is marked unfinished, a transfer to anyone but its would-be owner is refused by
+   /// the registry, by name; calling this again with that owner finishes it.
+   /// 
+   /// ⟨2026-09-29, review finding RV-4⟩ THE OWNER NAMING THEMSELVES IS A REPORT, NOT A HAND-ON. It is
+   /// the way out when the registry did not hear that a sovereign engram moved control: it moves
+   /// control to the same owner again and reports it, and it writes NO entry to
+   /// `listOwnershipTransfers` (until this day it wrote one from the owner to themselves, a hand-on
+   /// that did not happen). The record entry says it was a report. `ControlHandover.isReport`.
+   transferOwnership: (newOwner: principal) -> (Result_2);
+   /// OWNER-ONLY release of the payment freeze — and the asymmetry with `freezePayments` is the
+   /// governance design, not an oversight.
+   /// 
+   /// ⚠ A GUARDIAN CAN PULL THIS BRAKE AND CANNOT RELEASE IT. `freezePayments` accepts the owner OR
+   /// a guardian holding `canFreezePayments`; only the owner reaches this method. Two consequences,
+   /// and both parties should know them before the role is accepted:
+   ///   · a guardian can stop payments in an emergency WITHOUT the owner, which is the point;
+   ///   · a guardian cannot hold the engram hostage, because the owner releases it immediately and
+   ///     unilaterally.
+   /// So a guardian's freeze is a TRIPWIRE, not a lock — it buys the time it takes the owner to
+   /// look, and no more.
+   unfreezePayments: () -> (Result_1);
+   /// Consensus transform for the World ID /verify outcall. Replicas each call independently, so the raw
+   /// response (timestamps, `uses`, request-id headers) is non-deterministic. Collapse it to a single
+   /// canonical byte — "1" iff HTTP 200 AND the body asserts success — with no headers, so every replica
+   /// agrees. The caller keys off this byte, never the raw body.
+   /// 
+   /// PUBLIC: not a choice, exactly as `actionAlertTransform` above — the management canister calls
+   /// it on every replica with no caller identity attached. Stateless and total, so being callable
+   /// by anyone grants nothing: an outsider invoking it learns only what they already passed in.
+   worldIdTransform: (args:
+    record {
+      context: blob;
+      response: HttpRequestResult;
+    }) -> (HttpRequestResult) query;
+   /// Write a memory file, creating it or adding a version to it. Returns a write receipt — the new
+   /// `version`, the audit `seq`, and the chain `head` after the write — so a caller can prove what
+   /// it wrote without a second read.
+   /// 
+   /// ⚠ OWNER-ONLY, and this is the one most likely to surprise: an agent holding `write_memory`
+   /// does NOT reach this method. Agent writes go through the agent surface, which applies the
+   /// grant and the protected-path rules on top. `#Refused` here means the caller is not the owner,
+   /// not that a permission is missing.
+   /// 
+   /// It also refuses while writes are PAUSED and while memory is not attached — both are states an
+   /// owner can be in without knowing, so they answer as themselves rather than as a generic failure.
+   /// 
+   /// ⚠ THE FILE-COUNT CAP BLOCKS NEW FILES ONLY. At the cap, creating a new path is refused and
+   /// APPENDING TO AN EXISTING FILE STILL WORKS — the refusal says so, because "you are full" and
+   /// "you cannot write at all" lead to different next actions. A TOMBSTONED path counts as absent,
+   /// so writing to a deleted path is a new file and is capped like one; the delete record survives
+   /// either way.
+   /// 
+   /// Path and content are validated before the caller is even checked, so a malformed request gets
+   /// `#Invalid` rather than a refusal it would waste time investigating.
+   writeMemory: (path: text, content: blob) -> (Result);
+ };
+type Eip712Value = 
+ variant {
+   address: text;
+   "bool": bool;
+   bytes: vec nat8;
+   fixedBytes: vec nat8;
+   string: text;
+   uint: nat;
+ };
+type Eip712SignatureOut = 
+ record {
+   digest: blob;
+   r: blob;
+   rendered: text;
+   s: blob;
+   v: nat8;
+ };
+type Eip712Registration = 
+ record {
+   cooloffEndsAtNs: int;
+   encodeTypeString: text;
+   typeId: blob;
+ };
+type Eip3009Authorization = 
+ record {
+   from: text;
+   nonce: blob;
+   r: blob;
+   s: blob;
+   to: text;
+   v: nat8;
+   validAfter: nat;
+   validBefore: nat;
+   value: nat;
+ };
+type CycleSnapshot = 
+ record {
+   atNs: int;
+   cycles: nat;
+   seq: nat;
+   source: variant {
+             balance;
+             self;
+           };
+ };
+type ControlHandover = 
+ variant {
+   MovedByEngram;
+   MovedByRegistry;
+   NotHeldHere;
+ };
+type CondenseResult = 
+ record {
+   fromSeq: nat;
+   head: blob;
+   headAtBoundary: blob;
+   historyBytesDelta: int;
+   newFirstAvailableSeq: nat;
+   opCount: nat;
+   opsRoot: blob;
+   seq: nat;
+   toSeq: nat;
+ };
+type CondensePreview = 
+ record {
+   bestUnfilteredReceipt: opt record {
+                                fromSeq: nat;
+                                seq: nat;
+                                toSeq: nat;
+                              };
+   coveringReceipt: opt record {
+                          fromSeq: nat;
+                          seq: nat;
+                          toSeq: nat;
+                        };
+   filteredReceiptsSeen: nat;
+   firstAvailableSeq: nat;
+   maxUnlockableToSeq: nat;
+   opCountInRange: nat;
+   proposedToSeq: nat;
+   scanTruncated: bool;
+   scannedFromSeq: nat;
+   totalEvents: nat;
+   unlocked: bool;
+ };
+type CondenseCheckpointRow = 
+ record {
+   atNs: int;
+   by: principal;
+   fromSeq: nat;
+   headAtBoundary: blob;
+   opCount: nat;
+   opsRoot: blob;
+   seq: nat;
+   toSeq: nat;
+ };
+type ChildOpening = 
+ record {
+   allowances: vec ChildAllowanceRow;
+   attachCycles: nat;
+   balance: nat;
+   floorCycles: nat;
+ };
+type ChildAllowanceRow = 
+ record {
+   remaining: nat;
+   root: principal;
+ };
+type CheckpointPage = 
+ record {
+   firstAvailableSeq: nat;
+   page: Page_15;
+   scannedThroughSeq: nat;
+ };
+type CertifiedAuditHead = 
+ record {
+   certificate: opt blob;
+   headHash: blob;
+   size: nat;
+   total: nat;
+   witness: opt blob;
+ };
+type CallerSignatureCount = 
+ record {
+   caller: principal;
+   count: nat;
+   role: Role;
+   root: opt principal;
+ };
+type BearerTokenStatus = 
+ variant {
+   Active;
+   Expired;
+   Revoked;
+ };
+type BearerToken = 
+ record {
+   clientLabel: text;
+   expiresAtNs: int;
+   issuedAtNs: int;
+   issuedBy: principal;
+   lastUsedNs: int;
+   permissions: AgentPermissions;
+   status: BearerTokenStatus;
+   tokenHash: text;
+   tokenId: text;
+ };
+type BatchReadItem = 
+ record {
+   path: text;
+   result: variant {
+             Err: Error;
+             Ok: MemoryFile;
+           };
+ };
+type BackupType = 
+ variant {
+   FullSnapshot;
+   IncrementalDiff;
+   PartialSnapshot;
+ };
+type BackupStatus = 
+ variant {
+   Failed;
+   Finalized;
+   Uploading;
+ };
+type BackupRetentionReport = 
+ record {
+   dbType: text;
+   maxBackups: nat;
+   prunedBackups: nat;
+ };
+type BackupMetadata = 
+ record {
+   backupId: text;
+   backupLabel: opt text;
+   backupType: BackupType;
+   chunkCount: nat;
+   createdAtNs: int;
+   createdBy: principal;
+   dbType: text;
+   parentBackupId: opt text;
+   sha256: text;
+   status: BackupStatus;
+   totalSize: nat;
+ };
+type AuthorityClass = 
+ variant {
+   standard;
+   standingAuthority;
+   valueBearing;
+ };
+type AuditHead = 
+ record {
+   headHash: blob;
+   size: nat;
+ };
+type AuditEntry = 
+ record {
+   caller: principal;
+   callerRole: Role;
+   details: text;
+   entryHash: blob;
+   id: nat;
+   operation: text;
+   success: bool;
+   timestampNs: int;
+ };
+type ApprovalStatus = 
+ variant {
+   Approved;
+   Denied;
+   Expired;
+   Pending;
+   Used;
+ };
+type ApprovalRequest = 
+ record {
+   amount: nat;
+   approvedAtNs: opt int;
+   approvedBy: opt principal;
+   binding: text;
+   caller: principal;
+   createdAtNs: int;
+   denialReason: opt text;
+   expiresAtNs: int;
+   id: text;
+   operation: text;
+   policyField: text;
+   policyLimit: nat;
+   rationale: text;
+   status: ApprovalStatus;
+ };
+type AnchorPushStatus = 
+ record {
+   anchorTickAtNs: opt int;
+   attemptAtNs: opt int;
+   attemptTotal: nat;
+   cadenceSeconds: nat;
+   carrierArmedAtNs: int;
+   currentTotal: nat;
+   lastError: text;
+   okAtNs: opt int;
+   okTotal: nat;
+   skipCursor: nat;
+   timerTickAtNs: opt int;
+ };
+type AlertStatus = 
+ record {
+   config: AlertConfig;
+   cursor: nat;
+   disabled: bool;
+   failures: nat;
+   lastDeliveredAtNs: opt int;
+   totalAudit: nat;
+ };
+type AlertConfig = 
+ record {
+   agentWrites: bool;
+   approvals: bool;
+   classes: opt vec record {
+                      text;
+                      bool;
+                    };
+   guardian: bool;
+   money: bool;
+   url: opt text;
+ };
+type AgentWriteRow = 
+ record {
+   connector: opt text;
+   entry: AuditEntry;
+   path: opt text;
+   source: opt text;
+   version: opt nat;
+ };
+type AgentWriteReview = 
+ record {
+   capped: bool;
+   cursor: nat;
+   earliest: nat;
+   head: nat;
+   rows: vec AgentWriteRow;
+ };
+type AgentStatus = 
+ variant {
+   Active;
+   Resigned;
+   Revoked;
+ };
+type AgentRecord = 
+ record {
+   earlierKeys: vec HeldKey;
+   ended: opt AgentEnding;
+   enrolment: EnrolmentProof;
+   keyHeldFrom: LogPosition;
+   keyNomination: opt KeyNomination;
+   keyRotatedAtNs: int;
+   keyRotationCount: nat;
+   lastSeenNs: int;
+   name: text;
+   pairedAtNs: int;
+   permissions: AgentPermissions;
+   "principal": principal;
+   publicKeyHash: opt text;
+   root: principal;
+   status: AgentStatus;
+ };
+type AgentPermissions = 
+ record {
+   callsPerMinute: nat;
+   canAppendMemory: bool;
+   canReadBackup: opt bool;
+   canReadMemory: bool;
+   canReadWallet: bool;
+   scopes: opt vec text;
+ };
+type AgentPaymentSignatures = 
+ record {
+   agent: principal;
+   root: principal;
+   signedToday: nat;
+ };
+type AgentEnding = 
+ record {
+   day: int;
+   reason: AgentEndReason;
+ };
+type AgentEndReason = 
+ variant {
+   GuardianRevoked;
+   KillSwitch;
+   OwnerRevoked;
+   Reset;
+   Resigned;
+ };
+type AgentCard = 
+ record {
+   description: text;
+   name: text;
+   services: vec ServiceEntry;
+   x402Support: bool;
+ };
+type ActivitySnapshot = 
+ record {
+   atNs: int;
+   memoryReads: nat;
+   memoryWrites: nat;
+ };
+type ActionAuth = 
+ record {
+   nonce: nat;
+   pubkey: blob;
+   signature: blob;
+ };
+type About = 
+ record {
+   agentCount: nat;
+   agentMemoryReads: nat;
+   agentMemoryWrites: nat;
+   auditLogSize: nat;
+   backupCount: nat;
+   distinctReaderClients: nat;
+   distinctReaderPrincipals: nat;
+   encryptionEnabled: bool;
+   firstAgentWriteAtNs: opt int;
+   firstWriteAtNs: opt int;
+   guardianCount: nat;
+   lastAgentReadAtNs: opt int;
+   lastAgentWriteAtNs: opt int;
+   lastReadAtNs: opt int;
+   lastWriteAtNs: opt int;
+   memoryFileCount: nat;
+   paidMemoryReadEnabled: bool;
+   paidMemoryWriteEnabled: bool;
+   paymentsFrozen: bool;
+   totalBackupSize: nat;
+   totalMemoryReads: nat;
+   totalMemoryWrites: nat;
+   verifiedHuman: bool;
+   version: text;
+   walletActivatedAtNs: opt int;
+   writesPaused: bool;
+ };
+service : (initArgs: opt
+                      record {
+                        owner: opt principal;
+                        registry: opt principal;
+                      }) -> Engram