@engramx/idl 0.16.0-rc.1

package/dist/engram.idl.d.ts

@@ -0,0 +1,3839 @@
+import type { Principal } from '@icp-sdk/core/principal';
+import type { ActorMethod } from '@icp-sdk/core/agent';
+import type { IDL } from '@icp-sdk/core/candid';
+
+export interface About {
+  verifiedHuman: boolean;
+  guardianCount: bigint;
+  totalMemoryWrites: bigint;
+  lastAgentWriteAtNs: [] | [bigint];
+  distinctReaderPrincipals: bigint;
+  lastWriteAtNs: [] | [bigint];
+  totalBackupSize: bigint;
+  backupCount: bigint;
+  lastAgentReadAtNs: [] | [bigint];
+  firstWriteAtNs: [] | [bigint];
+  agentCount: bigint;
+  paidMemoryReadEnabled: boolean;
+  version: string;
+  paymentsFrozen: boolean;
+  agentMemoryWrites: bigint;
+  agentMemoryReads: bigint;
+  auditLogSize: bigint;
+  memoryFileCount: bigint;
+  firstAgentWriteAtNs: [] | [bigint];
+  lastReadAtNs: [] | [bigint];
+  writesPaused: boolean;
+  distinctReaderClients: bigint;
+  totalMemoryReads: bigint;
+  walletActivatedAtNs: [] | [bigint];
+  encryptionEnabled: boolean;
+  paidMemoryWriteEnabled: boolean;
+}
+export interface ActionAuth {
+  signature: Uint8Array | number[];
+  pubkey: Uint8Array | number[];
+  nonce: bigint;
+}
+export interface ActivitySnapshot {
+  atNs: bigint;
+  memoryReads: bigint;
+  memoryWrites: bigint;
+}
+export interface AgentCard {
+  x402Support: boolean;
+  name: string;
+  description: string;
+  services: Array<ServiceEntry>;
+}
+export type AgentEndReason =
+  | { Resigned: null }
+  | { OwnerRevoked: null }
+  | { Reset: null }
+  | { KillSwitch: null }
+  | { GuardianRevoked: null };
+export interface AgentEnding {
+  day: bigint;
+  reason: AgentEndReason;
+}
+export interface AgentPaymentSignatures {
+  agent: Principal;
+  signedToday: bigint;
+  root: Principal;
+}
+export interface AgentPermissions {
+  canReadMemory: boolean;
+  scopes: [] | [Array<string>];
+  canReadBackup: [] | [boolean];
+  callsPerMinute: bigint;
+  canAppendMemory: boolean;
+  canReadWallet: boolean;
+}
+export interface AgentRecord {
+  status: AgentStatus;
+  earlierKeys: Array<HeldKey>;
+  permissions: AgentPermissions;
+  principal: Principal;
+  keyRotationCount: bigint;
+  publicKeyHash: [] | [string];
+  pairedAtNs: bigint;
+  enrolment: EnrolmentProof;
+  lastSeenNs: bigint;
+  name: string;
+  root: Principal;
+  ended: [] | [AgentEnding];
+  keyNomination: [] | [KeyNomination];
+  keyRotatedAtNs: bigint;
+  keyHeldFrom: LogPosition;
+}
+export type AgentStatus = { Active: null } | { Resigned: null } | { Revoked: null };
+export interface AgentWriteReview {
+  cursor: bigint;
+  head: bigint;
+  rows: Array<AgentWriteRow>;
+  earliest: bigint;
+  capped: boolean;
+}
+export interface AgentWriteRow {
+  source: [] | [string];
+  path: [] | [string];
+  entry: AuditEntry;
+  version: [] | [bigint];
+  connector: [] | [string];
+}
+export interface AlertConfig {
+  url: [] | [string];
+  money: boolean;
+  classes: [] | [Array<[string, boolean]>];
+  agentWrites: boolean;
+  guardian: boolean;
+  approvals: boolean;
+}
+export interface AlertStatus {
+  lastDeliveredAtNs: [] | [bigint];
+  failures: bigint;
+  totalAudit: bigint;
+  cursor: bigint;
+  disabled: boolean;
+  config: AlertConfig;
+}
+export interface AnchorPushStatus {
+  anchorTickAtNs: [] | [bigint];
+  okAtNs: [] | [bigint];
+  cadenceSeconds: bigint;
+  attemptTotal: bigint;
+  currentTotal: bigint;
+  timerTickAtNs: [] | [bigint];
+  okTotal: bigint;
+  carrierArmedAtNs: bigint;
+  attemptAtNs: [] | [bigint];
+  skipCursor: bigint;
+  lastError: string;
+}
+export interface ApprovalRequest {
+  id: string;
+  expiresAtNs: bigint;
+  status: ApprovalStatus;
+  denialReason: [] | [string];
+  policyField: string;
+  approvedBy: [] | [Principal];
+  createdAtNs: bigint;
+  approvedAtNs: [] | [bigint];
+  binding: string;
+  operation: string;
+  rationale: string;
+  policyLimit: bigint;
+  caller: Principal;
+  amount: bigint;
+}
+export type ApprovalStatus =
+  { Used: null } | { Approved: null } | { Denied: null } | { Expired: null } | { Pending: null };
+export interface AuditEntry {
+  id: bigint;
+  entryHash: Uint8Array | number[];
+  callerRole: Role;
+  operation: string;
+  details: string;
+  caller: Principal;
+  success: boolean;
+  timestampNs: bigint;
+}
+export interface AuditHead {
+  headHash: Uint8Array | number[];
+  size: bigint;
+}
+export type AuthorityClass =
+  { standingAuthority: null } | { valueBearing: null } | { standard: null };
+export interface BackupMetadata {
+  status: BackupStatus;
+  sha256: string;
+  backupId: string;
+  createdBy: Principal;
+  createdAtNs: bigint;
+  totalSize: bigint;
+  backupLabel: [] | [string];
+  backupType: BackupType;
+  dbType: string;
+  chunkCount: bigint;
+  parentBackupId: [] | [string];
+}
+export interface BackupRetentionReport {
+  maxBackups: bigint;
+  dbType: string;
+  prunedBackups: bigint;
+}
+export type BackupStatus = { Uploading: null } | { Failed: null } | { Finalized: null };
+export type BackupType =
+  { PartialSnapshot: null } | { IncrementalDiff: null } | { FullSnapshot: null };
+export interface BatchReadItem {
+  result: { Ok: MemoryFile } | { Err: Error };
+  path: string;
+}
+export interface BearerToken {
+  expiresAtNs: bigint;
+  status: BearerTokenStatus;
+  lastUsedNs: bigint;
+  permissions: AgentPermissions;
+  tokenId: string;
+  clientLabel: string;
+  issuedAtNs: bigint;
+  tokenHash: string;
+  issuedBy: Principal;
+}
+export type BearerTokenStatus = { Active: null } | { Revoked: null } | { Expired: null };
+export interface CallerSignatureCount {
+  count: bigint;
+  role: Role;
+  root: [] | [Principal];
+  caller: Principal;
+}
+export interface CertifiedAuditHead {
+  total: bigint;
+  certificate: [] | [Uint8Array | number[]];
+  headHash: Uint8Array | number[];
+  size: bigint;
+  witness: [] | [Uint8Array | number[]];
+}
+export interface CheckpointPage {
+  firstAvailableSeq: bigint;
+  page: Page_15;
+  scannedThroughSeq: bigint;
+}
+export interface ChildAllowanceRow {
+  root: Principal;
+  remaining: bigint;
+}
+export interface ChildOpening {
+  attachCycles: bigint;
+  balance: bigint;
+  allowances: Array<ChildAllowanceRow>;
+  floorCycles: bigint;
+}
+export interface CondenseCheckpointRow {
+  by: Principal;
+  seq: bigint;
+  toSeq: bigint;
+  opsRoot: Uint8Array | number[];
+  atNs: bigint;
+  fromSeq: bigint;
+  headAtBoundary: Uint8Array | number[];
+  opCount: bigint;
+}
+export interface CondensePreview {
+  scannedFromSeq: bigint;
+  scanTruncated: boolean;
+  firstAvailableSeq: bigint;
+  unlocked: boolean;
+  totalEvents: bigint;
+  maxUnlockableToSeq: bigint;
+  bestUnfilteredReceipt: [] | [{ seq: bigint; toSeq: bigint; fromSeq: bigint }];
+  opCountInRange: bigint;
+  filteredReceiptsSeen: bigint;
+  coveringReceipt: [] | [{ seq: bigint; toSeq: bigint; fromSeq: bigint }];
+  proposedToSeq: bigint;
+}
+export interface CondenseResult {
+  seq: bigint;
+  toSeq: bigint;
+  opsRoot: Uint8Array | number[];
+  head: Uint8Array | number[];
+  fromSeq: bigint;
+  headAtBoundary: Uint8Array | number[];
+  newFirstAvailableSeq: bigint;
+  historyBytesDelta: bigint;
+  opCount: bigint;
+}
+export type ControlHandover =
+  { MovedByRegistry: null } | { NotHeldHere: null } | { MovedByEngram: null };
+export interface CycleSnapshot {
+  seq: bigint;
+  source: { balance: null } | { self: null };
+  atNs: bigint;
+  cycles: bigint;
+}
+export interface Eip3009Authorization {
+  r: Uint8Array | number[];
+  s: Uint8Array | number[];
+  v: number;
+  to: string;
+  value: bigint;
+  from: string;
+  validAfter: bigint;
+  nonce: Uint8Array | number[];
+  validBefore: bigint;
+}
+export interface Eip712Registration {
+  encodeTypeString: string;
+  cooloffEndsAtNs: bigint;
+  typeId: Uint8Array | number[];
+}
+export interface Eip712SignatureOut {
+  r: Uint8Array | number[];
+  s: Uint8Array | number[];
+  v: number;
+  rendered: string;
+  digest: Uint8Array | number[];
+}
+export type Eip712Value =
+  | { string: string }
+  | { bool: boolean }
+  | { uint: bigint }
+  | { address: string }
+  | { fixedBytes: Uint8Array | number[] }
+  | { bytes: Uint8Array | number[] };
+export interface Engram {
+  /**
+   * / ⟨0.16.0⟩ `about()` — the ONE public projection, replacing `status()` and absorbing `metrics()`.
+   * /
+   * / Two public projections of one canister was the L2.2 defect: both answered "what is this engram
+   * / like", disagreed about which counters they carried, and `status()` additionally masked two
+   * / fields behind an `authorized` flag whose own declaration admitted the problem — "a consumer
+   * / that must remember to check a sibling flag is one that will eventually forget."
+   * /
+   * / The fix is not a better flag. The gated fields MOVED (see `getOwnerConsole`), so there is no
+   * / masked field to forget and no flag to check. Reaching the gated record is the authorization.
+   * /
+   * / Ungated by design and marked for the L8 gate-grep.
+   * / PUBLIC: existence, shape, posture and day-floored activity. No principal, no balance, no
+   * / precise timestamp — nothing here identifies a person or reveals when they are at the keyboard.
+   */
+  about: ActorMethod<[], About>;
+  /**
+   * / The NEW key accepts the nomination the agent's current key (`agentKey`) made of it, and takes
+   * / over the agent's record: the same lasting identity, enrolment statement, invite and
+   * / permissions, today's spending and signature totals, and any spending limit the owner set for
+   * / that agent. From this message on, `agentKey` is not an agent of this engram and every call it
+   * / makes as one is refused. The registry is not called: it goes on naming the same open
+   * / engagement (`KeyReplacement`'s header says why and what a modified engram could do with it).
+   * /
+   * / ONE MESSAGE, NO AWAIT: every check, the move of the record and of each per-key total, and the
+   * / record entry happen together, so no call can fall between a check and the move, and no total
+   * / is ever held by both keys or by neither. Answers the record as the new key now holds it.
+   * /
+   * / WHO MAY CALL is decided by `KeyReplacement.accepted`: only the key a pending, unexpired
+   * / nomination names. That check compares the caller inside the module, where
+   * / test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
+   * / no role here until the move.
+   */
+  acceptAgentKeyNomination: ActorMethod<[Principal], Result_70>;
+  /**
+   * / Consensus transform for the alert webhook outcall: collapse the response to status-only so
+   * / replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
+   * /
+   * / PUBLIC: not a choice. The management canister invokes a transform on every replica as part of
+   * / the HTTP-outcall protocol, and that invocation carries no caller identity to gate on — a gate
+   * / here would refuse the only caller there is and break every alert this canister sends. Safe
+   * / because it is total and stateless: it reads its argument and returns, touching nothing.
+   */
+  actionAlertTransform: ActorMethod<
+    [{ context: Uint8Array | number[]; response: HttpRequestResult }],
+    HttpRequestResult
+  >;
+  /**
+   * / Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
+   * / of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
+   * / shape is IMMUTABLE: any change mints a new typeId.
+   */
+  addEip712Type: ActorMethod<
+    [
+      {
+        primaryType: string;
+        canonicalTypeString: string;
+        domainName: string;
+        verifyingContract: string;
+        dailySignCap: bigint;
+        fields: Array<[string, string]>;
+        destinationFields: Array<string>;
+        authorityClass: { standingAuthority: null } | { valueBearing: null } | { standard: null };
+        chainId: bigint;
+        domainVersion: string;
+        ackIrrevocable: boolean;
+      },
+    ],
+    Result_69
+  >;
+  /**
+   * / Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
+   * / and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
+   */
+  addEvmWithdrawDestination: ActorMethod<[string], Result_68>;
+  /**
+   * / ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
+   * /
+   * / This method had five distinct ways to say no through one `text`, and a caller could only tell
+   * / them apart by matching prose. They are now three different arms because they call for three
+   * / different responses: `#Invalid` means fix the argument and retry, `#Refused` means you are not
+   * / the owner and retrying changes nothing, and `#Conflict` means the request was well-formed and
+   * / permitted but this engram's state says no — the principal already holds an incompatible role,
+   * / or the roster is full. Only the last is worth an agent's time to resolve.
+   */
+  addGuardian: ActorMethod<[Principal, string, GuardianPermissions], Result_1>;
+  /**
+   * / Returns the write RECEIPT, not just the version.
+   * /
+   * / The receipt was always computed and then thrown away: MemoryRouter hands back
+   * / {seq; version; contentRoot; head}, the audit detail stringifies `seq=`/`head=` into prose, and
+   * / the caller got a bare Nat. So a writer could be told their write landed but not be given the
+   * / evidence it landed — they had to read the audit log back and parse a string to learn the head
+   * / their own write produced. `head` is the chain head AFTER this write; it transitively commits
+   * / to contentRoot, which is why the root is not repeated here (the same ruling that dropped
+   * / per-entry contentRoot from the audit entries).
+   * /
+   * / This is the half of a consumer request that costs nothing: the commitment ledger was still
+   * / "trust whoever runs the service" one hop from the proof — a third party can now be handed the receipt
+   * / directly by whoever wrote the content. A return-TYPE change cannot be absorbed by the client
+   * / subset rule, so it can only ride an interface break; this release is one.
+   */
+  appendMemory: ActorMethod<[string, Uint8Array | number[], [] | [MemorySource]], Result>;
+  /**
+   * / Replace the retained log prefix through `toSeq` with a single checkpoint.
+   * /
+   * / PREFIX-ONLY: there is no `fromSeq`, because the library made that unrepresentable rather than
+   * / merely checked — a condense always starts at the current floor. It refuses unless an
+   * / UNFILTERED export receipt already covers the whole range; call previewCondense first,
+   * / which reports how far your existing receipts reach.
+   * /
+   * / `historyBytesDelta` is SIGNED, and the sign is the point. A condense subtracts the dropped
+   * / entries' canonical bytes and adds the checkpoint's own, so condensing a short prefix of small
+   * / entries can leave the history meter HIGHER than it found it. The owner is told which happened
+   * / rather than left to assume the number went down.
+   * /
+   * / Gated on requireWritesNotPaused — unlike the export. This one destroys retained entries, which
+   * / is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
+   * / owner-initiated, owner-only, and already chained into the audit log.
+   */
+  applyCondense: ActorMethod<[bigint], Result_67>;
+  /**
+   * / Owner-only: activate a guardian who has registered against an invite.
+   * /
+   * / Until this call the guardian is `#Pending` and can do NOTHING — registering is a claim, this
+   * / is the grant. That two-step is what stops a leaked invite code from producing a live guardian
+   * / on its own.
+   * /
+   * / `#Conflict("Guardian is already active")` when there is nothing to do — the refusal says the
+   * / state the caller asked for is the state that holds, rather than pretending it acted.
+   */
+  approveGuardian: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Owner-only: approve one pending over-limit request, letting the agent retry the operation
+   * / its policy refused.
+   * /
+   * / ⚠ THE APPROVAL IS SINGLE-USE AND EXPIRES IN ONE HOUR. Approving does not perform the
+   * / operation and does not raise the policy — it opens a window. The agent must retry within
+   * / the hour, and the retry CONSUMES the approval (`#Used`); a second attempt needs a second
+   * / approval. Past the hour it becomes `#Expired` on first touch. Neither state is recoverable by
+   * / approving again — the owner approves a NEW request.
+   * / ⟨2026-09-29, review finding X-11⟩ One exception, made by the engram and not by the owner: when
+   * / the retry's signer FAILS, nothing was signed, so the approval goes back from `#Used` to
+   * / `#Approved` with its original expiry and an `approval.released` entry says so.
+   * /
+   * / ⚠ IT IS BOUND TO THE EXACT OPERATION THAT WAS REQUESTED, not to the agent. An approval
+   * / carries the operation, the amount and the binding it was raised for, and consuming it checks
+   * / all three — so approving a request does not grant the agent a general allowance for the
+   * / hour, and cannot be redirected at a different recipient or a larger sum.
+   * /
+   * / Refuses `#NotFound` for an unknown id, and `#Conflict` NAMING THE STATUS when the request is
+   * / no longer pending — already approved, denied or expired. The status is in the message because
+   * / "not pending" is the one refusal here an owner acts on differently depending on which it is.
+   */
+  approveRequest: ActorMethod<[string], Result_1>;
+  /**
+   * / Discard a backup started by `backupInit` and never finalized. The way out of a failed upload,
+   * / and the reason a stalled one need not occupy space indefinitely. Same gate as the rest of the
+   * / write half: owner, or an agent holding `canAppendMemory`.
+   */
+  backupAbort: ActorMethod<[string], Result_1>;
+  /**
+   * / Close a backup started by `backupInit` and mark it usable.
+   * /
+   * / ⚠ ONLY THE CREATOR MAY FINALIZE — `#Refused("Not the creator of this backup")`. An agent
+   * / cannot close an upload someone else began, so a half-finished backup belongs to whoever
+   * / started it.
+   * /
+   * / Refuses with `#Conflict` when the backup is already finalized, when it is marked failed, and
+   * / when it holds ZERO chunks or zero total size — an empty backup is refused rather than recorded
+   * / as a success, which is the difference between "no backup" and "a backup of nothing".
+   * /
+   * / It does NOT verify the `sha256` declared at init; see that method for what the digest is and
+   * / is not.
+   */
+  backupFinalize: ActorMethod<[string], Result_1>;
+  /**
+   * / Begin a chunked backup upload. Returns the `backupId` every later call in the sequence needs.
+   * /
+   * / **THE SEQUENCE**, which no individual signature here conveys:
+   * / `backupInit` → `backupPushChunk` × N → `backupFinalize`, or `backupAbort` to discard. A backup
+   * / that is never finalized is not a backup; `backupFinalize` refuses one with zero chunks or zero
+   * / total size rather than recording an empty success.
+   * /
+   * / ⚠ THE `sha256` IS YOUR DECLARATION, NOT THIS CANISTER'S FINDING. It is taken here, before any
+   * / bytes arrive, stored with the metadata and carried through finalize UNCHANGED — verified at
+   * / the site 2026-08-21: `Backup.finalizeBackup` checks existence, creator, state and non-emptiness
+   * / and does NOT recompute or compare a digest. So it is a commitment a restorer can check the
+   * / bytes against LATER, and it is not evidence the bytes match. Treating it as a canister-verified
+   * / hash is the misreading to avoid — and it is an easy one to reach, because the REGISTRY's
+   * / chunked upload (`engramWasmInit`/`PushChunk`/`Finalize`) has the same shape and DOES verify:
+   * / it hashes the assembled bytes and refuses on mismatch. Same protocol, opposite semantics.
+   * /
+   * / **TWO DIFFERENT PERMISSIONS GUARD THE TWO HALVES.** Writing (init, push, finalize, abort) is
+   * / owner-or-agent and an AGENT additionally needs `canAppendMemory`; reading
+   * / (`backupPullChunk`) needs `read_backup`. An agent can therefore be able to upload a backup
+   * / and unable to download one, or the reverse, which is the point of splitting them.
+   * /
+   * / The write half also refuses while writes are PAUSED.
+   */
+  backupInit: ActorMethod<[string, BackupType, [] | [string], string, [] | [string]], Result_43>;
+  /**
+   * / Read one chunk of a finalized backup, by index.
+   * /
+   * / ⚠ GATED ON `read_backup`, which is NOT the permission the upload half uses — that one is
+   * / `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
+   * / carrying it away are different authorities.
+   */
+  backupPullChunk: ActorMethod<[string, bigint], Result_59>;
+  backupPushChunk: ActorMethod<[string, bigint, Uint8Array | number[]], Result_1>;
+  /**
+   * / The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
+   * / by name when the agent is unknown or has nothing pending — never a silent success.
+   */
+  cancelAgentKeyNomination: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Close a session the caller paid for: settle what was consumed, refund the remainder.
+   * /
+   * / PAYER-ONLY, enforced inside the gateway. This is the exit that did not exist — `endSession`
+   * / and `forceCloseSession` were on the MARKET, which is withheld, and whose escrow subaccount is
+   * / under a different principal entirely, so its close could never have reached these funds.
+   */
+  closeSession: ActorMethod<[string], Result_1>;
+  /**
+   * / Convert the engram's OWN earned ckUSDC/ckUSDT into its OWN cycles, via the cashier — the
+   * / engram-self top-up path. Owner-only; per-call cap + cooldown (irreversible); NOT freeze-gated
+   * / (infrastructure funding). Flow: read the engram's deposit address on the cashier, move the
+   * / engram's tokens there, then have the cashier convert — the cashier self-authorizes because the
+   * / caller (this engram) is a registered active engram (registry isRegisteredActiveEngram seam).
+   * / (The owner-funded path lives entirely in the frontend: owner → cashier deposit → topUp.)
+   * / ⟨0.16.0, L4 — `token : Text` KEPT, deliberately, and this note exists so the sweep that finds
+   * / it does not re-litigate it.⟩
+   * /
+   * / `ownerWithdraw` and the market's `recoverEscrow` both took `Wire.TokenAmount` because they
+   * / accept ICP (e8s) BESIDE the stablecoins (e6) — mixed decimals behind one number is a real
+   * / hundred-fold error. This method accepts ckUSDC and ckUSDT only. Both are e6, so there is no
+   * / unit to get wrong, and the census (row 258) rules the pair as `(token, amountE6)`.
+   * /
+   * / `Wire.TokenAmount` would be actively WORSE here: its `#Icp` arm is a token this path cannot
+   * / convert, so the type would make an unacceptable value REPRESENTABLE and hand back a runtime
+   * / rejection anyway — losing the one property the variant is for while gaining a wider type.
+   * /
+   * / ⟨2026-10-02⟩ The second parameter is NAMED `amountE6` now, as the census row above rules the
+   * / pair — e6 base units of the token named first. A name only: Candid passes arguments by
+   * / position, so nothing on the wire moved.
+   */
+  convertEarningsToCycles: ActorMethod<[string, bigint], Result_8>;
+  /**
+   * / Owner-only: mint a single-use invite code an agent redeems with `pairAgent`.
+   * /
+   * / ⚠ READ THIS BEFORE INVITING SOMEONE BACK. Pairing is ONE-SHOT PER PRINCIPAL on
+   * / this engram: `pairAgent` refuses ANY caller that already holds a record — `#Active`,
+   * / `#Revoked` or `#Resigned` alike — so a principal you have revoked can NEVER redeem another
+   * / invite, however many you mint. That is deliberate, because `revokeAgent` is a soft status
+   * / change and a revoked key talking its way back in would undo it. The remedy is a DIFFERENT
+   * / WALLET; the only thing that clears the record is `resetEngram`, which severs everything else
+   * / too.
+   * /
+   * / Two caps, each refusing with `#Conflict` and naming its own limit: concurrent ACTIVE agents
+   * / (multi-agent owners legitimately need several — a connector host plus a coding agent), and
+   * / concurrent unexpired INVITES. Neither is a rate limit; both are ceilings you clear by revoking
+   * / or by letting invites lapse.
+   * /
+   * / A principal that is already a GUARDIAN cannot become an agent — a guardian is an
+   * / independent check on agents, so one wallet must not hold both.
+   */
+  createAgentInvite: ActorMethod<[string, AgentPermissions], Result_43>;
+  /**
+   * / Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
+   * / co-owner and not a recovery agent.
+   * /
+   * / ⚠ WHAT A GUARDIAN CAN DO IS EXACTLY THREE THINGS, all of them BRAKES: revoke agents,
+   * / freeze payments, pause writes. That is the whole permission set (`GuardianPermissions`), and
+   * / the three flags are FROZEN — any future permission arrives as a scope string instead.
+   * /
+   * / ⚠ WHAT A GUARDIAN CANNOT DO, said plainly because the word invites the opposite reading: they
+   * / cannot read memory, cannot move money, cannot transfer ownership, and **cannot recover a lost
+   * / owner key**. A guardian is not a recovery mechanism. An owner appointing one against the day
+   * / they lose access is appointing the wrong thing.
+   * /
+   * / Two steps, and the invite is only the first: the invitee registers, which leaves them
+   * / `#Pending` and INERT, and `approveGuardian` is what makes them active. A guardian who has
+   * / registered but not been approved can do none of the three.
+   * /
+   * / ⚠ AN AGENT CANNOT BECOME A GUARDIAN, and the refusal lands at REGISTRATION rather than
+   * / here: this call will happily mint an invite for a principal that already holds an agent
+   * / record, and `registerGuardian` then refuses it with "An agent cannot also be a guardian".
+   * / So an invite that fails to redeem for that reason is not a bad code. The rule exists because
+   * / a check must be independent of the thing it checks.
+   */
+  createGuardianInvite: ActorMethod<[string, GuardianPermissions], Result_43>;
+  /**
+   * / OWNER-ONLY deletion of a stored backup.
+   * /
+   * / ⚠ NOT THE SAME GATE AS THE REST OF THE FAMILY, and the asymmetry is deliberate: `backupInit`,
+   * / `backupPushChunk`, `backupFinalize` and `backupAbort` accept an agent holding
+   * / `canAppendMemory`, and `backupPullChunk` accepts one holding `read_backup`. Only the OWNER may
+   * / delete. So an agent can take backups and carry them away and cannot destroy one —
+   * / creating is delegable, destroying is not.
+   * /
+   * / `backupAbort` is the agent's way out of a failed UPLOAD; it discards something never
+   * / finalized. This removes a finished backup, which is a different act on a different object.
+   */
+  deleteBackup: ActorMethod<[string], Result_1>;
+  /**
+   * / ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>`. The receipt was already
+   * / being computed and written into the audit line — `receiptSuffix(r)` — and then discarded, so
+   * / a caller could not cite the seq its own delete produced and had to go looking for it in a log
+   * / it may not be allowed to read. A delete is an EVENT on the chain; an event that will not tell
+   * / you where it landed is evidence nobody can point at. Same projection as writeMemory.
+   */
+  deleteMemoryFile: ActorMethod<[string], Result>;
+  /**
+   * / Owner-only: deny one pending over-limit request, with a `reason` the agent can read.
+   * /
+   * / The reason is stored on the request rather than discarded, which is the point of taking it —
+   * / an agent told only "denied" retries, and one told why can adapt or stop asking. It is the
+   * / owner's message to whoever raised the request, not an audit-only field.
+   * /
+   * / Terminal: a denied request cannot be approved afterwards. Like `approveRequest` it refuses
+   * / `#NotFound` for an unknown id and `#Conflict` when the request is no longer pending, and it
+   * / does not change the policy — the next request over the same limit will be raised again.
+   */
+  denyRequest: ActorMethod<[string, string], Result_1>;
+  /**
+   * / Force the tECDSA derivation and return the address.
+   * /
+   * / It exists because the gateway's own derivation fires from a timer that is lazy on some
+   * / replicas, and until it lands the EVM quote advertises the `0x0` fallback and settle fails
+   * / closed — a live money surface quoting an address that cannot receive.
+   * /
+   * / ⟨0.16.0, B-2⟩ Derivation now comes from `EvmIdentity`, and the return type carries the
+   * / outcome: this used to answer `""` on failure, which is a Text a caller can and did paste into
+   * / a payment flow. An empty string is not an address, and saying so is the difference between a
+   * / failed derivation and an address of nothing.
+   * /
+   * / ⚠ TRANSITIONAL: it also primes the ic402 gate, because the gate still settles commerce on this
+   * / canister until those 47 methods move. That second call disappears with them — it is listed in
+   * / the move order in the spec's B-2 addendum, not left for someone to find.
+   * /
+   * / PUBLIC: it inherits `getEvmAddress`'s gate rather than choosing one, and could not usefully be
+   * / narrower — it exists so a caller can make the derivation happen BEFORE a payment flow, and the
+   * / derivation itself is ungated. Idempotent and bounded to the same one-derivation-per-lifetime
+   * / work, so an anonymous caller can cause it once and no more.
+   * / ⟨L7⟩ UPDATE, NOT QUERY, and this one does not merely await — it WRITES. The body awaits
+   * / `EvmIdentity.deriveAddress` (the management canister's `ecdsa_public_key`) and
+   * / `gate.deriveEvmRecipientAt` ⟨renamed 2026-09-22 with the path⟩, then caches the result in `evmAddressCache`. So a query is
+   * / impossible twice over: it could not await the derivation, and it could not keep the answer.
+   * / Named `ensure*` rather than `get*` for that reason — the write is the point, and a read verb
+   * / would have promised a cheapness this cannot deliver.
+   * /
+   * / ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
+   * / the site.⟩
+   */
+  ensureEvmReady: ActorMethod<[], Result_43>;
+  /**
+   * / Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
+   * /
+   * / This is the receipt ledgerfs Q2 requires before any of those entries may be condensed away.
+   * / The canister cannot know the owner KEPT the bytes it served — it can only prove they were
+   * / SERVED — and `opsRoot` is what makes a kept copy verifiable forever afterwards. Keep it with
+   * / the archive; without it the download is just bytes.
+   * /
+   * / NOT gated on requireWritesNotPaused, deliberately. A guardian pause is an emergency brake on
+   * / changing the record; an export changes nothing about the files and only appends its own
+   * / attestation. Trapping the owner's own data behind the brake would make the pause a hostage
+   * / situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
+   * / failed its integrity check must not attest anything it cannot vouch for.
+   */
+  exportMemoryRange: ActorMethod<[bigint, bigint, [] | [Principal]], Result_66>;
+  /**
+   * / ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
+   * / The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
+   * / case — the guardian is the exceptional one. A name that says otherwise sends an owner looking
+   * / for a method that does not exist. `unfreezePayments`, its owner-only inverse, never carried the
+   * / prefix, so the pair read as unrelated.
+   * /
+   * / WHAT THE FREEZE ACTUALLY COVERS ⟨enumerated 2026-08-21 from the eight `requirePaymentsNotFrozen`
+   * / call sites, because it was written down nowhere and had to be re-derived to be trusted⟩:
+   * /
+   * /   · EVERY SIGNING PATH, which is the point of the brake. `signX402Payment` and
+   * /     `sysSignX402Payment` through `x402SignFor`; `signEip712` and `sysSignEip712` through
+   * /     `eip712SignFor`; `signEngramRegistration` directly. ⟨The two helpers are why a grep of an
+   * /     individual method's body finds nothing — the check is one level down.⟩
+   * /   · `addEip712Type` and `addEvmWithdrawDestination` — pre-staging for a later payout is the
+   * /     thing a brake most needs to stop, so the destination list is frozen along with the signing.
+   * /   · `sessionReadMemory` and `sessionAppendMemory` — the paid-memory rail, money coming IN.
+   * /
+   * / AND WHAT IT DELIBERATELY DOES NOT, stated so the absence is not read as an oversight:
+   * /
+   * /   · `convertEarningsToCycles` — the owner's OWN earnings becoming their OWN engram's fuel. A
+   * /     frozen engram still burns cycles, so freezing this would let a brake starve the thing it
+   * /     is protecting. Owner-only, capped per call, and it moves nothing outward.
+   * /   · `approveRequest` — an approval is not a spend. The spend it authorises goes through
+   * /     `x402SignFor`, which IS frozen, so an approval granted during a freeze simply waits.
+   * /   · `transferOwnership` — ownership is not a payment, and a guardian's PAYMENTS brake is not
+   * /     a veto on who owns the engram.
+   * /
+   * / ⚠ The three exclusions are a reading of intent, not a ruling: no declaration stated the scope
+   * / before this one. If any of them is wrong, this comment is where the argument should happen.
+   */
+  freezePayments: ActorMethod<[], Result_1>;
+  /**
+   * / Delivery status + config readback. Owner-only (the URL is a secret).
+   */
+  getActionAlertStatus: ActorMethod<[], Result_57>;
+  /**
+   * / Agents need to know what they may revise, so they can read it too. Whole-value config, same
+   * / carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
+   * / protected path and a revisable path are opposite grants, and one accessor for both would be a
+   * / name that lies about which power it reports.
+   * /
+   * / Refusal reason preserved from the trap: a grant is a power, and its absence and its
+   * / concealment are different facts.
+   */
+  getAgentRevisablePaths: ActorMethod<[], Result_53>;
+  /**
+   * / OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
+   * / paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
+   * / of the last one, and how many were produced. Never an amount, a recipient or a nonce.
+   * /
+   * / WHY THE OWNER ALWAYS READS IT: these are the rows the metrics reader the registry designated may
+   * / read (`sysGetAgentSeatWeeks`), and an owner deciding whether to leave that read on must be able
+   * / to see exactly what it is handed. The reader's rows are these rows without the root, in the same
+   * / order. Anyone else is refused by name (`#Refused getAgentSeatWeeks: …`), never answered with an
+   * / empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
+   * / Two rows can name one root: an agent paired again after it left is a second engagement.
+   */
+  getAgentSeatWeeks: ActorMethod<[bigint, bigint], Result_64>;
+  /**
+   * / Owner: everything written into this engram by someone other than the owner since the last
+   * / markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
+   * / qualifiesForReview for why those two families are recognised differently).
+   * / `capped=true` means exactly 200 rows were returned and MORE unreviewed writes exist beyond
+   * / them — the UI must page (markAgentWritesReviewed(?lastShownId)) and must NOT present 200
+   * / as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
+   * / aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
+   */
+  getAgentWriteReview: ActorMethod<[], Result_63>;
+  /**
+   * / Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
+   * / engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
+   * / and none of these fields is a secret — `total` is already public via getCertifiedAuditHead.
+   * / See the field comments above for how to read the combinations.
+   */
+  getAnchorPushStatus: ActorMethod<[], AnchorPushStatus>;
+  /**
+   * / The plain chain head — size and hash, world-readable, no certificate.
+   * /
+   * / ⟨0.16.0, census `keep (NEW)`⟩ It was specced and never built. `Wire.AuditHead`'s own
+   * / declaration says why it matters: heads exist TO BE COMPARED (L8), a head nobody can read
+   * / witnesses nothing, and the registry and cashier already served exactly this shape — so the
+   * / engram, "the canister that IS the evidence product", was the one chain a verifier could not
+   * / ask for a head without also asking for a certificate it may not want.
+   * /
+   * / PUBLIC: bare, and it cannot refuse — a chain head discloses nothing about content or callers,
+   * / and gating it would make the comparison it exists for depend on permission. `getCertifiedAuditHead`
+   * / below serves the same head WITH the subnet certificate for a caller that needs to verify it
+   * / was signed rather than asserted.
+   */
+  getAuditHead: ActorMethod<[], AuditHead>;
+  getBackupMetadata: ActorMethod<[string], Result_62>;
+  /**
+   * / The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
+   * /
+   * / PUBLIC: a payer about to send money needs to know which cashier this engram will accept credit
+   * / from, BEFORE sending it — paying a cashier this engram does not recognise collects funds that
+   * / never become rent. The registry publishes the same fact as `getRentBiller`; publishing it here
+   * / too is what lets the two be COMPARED, which is the only way to catch a mismatch.
+   */
+  getBillerId: ActorMethod<[], [] | [Principal]>;
+  /**
+   * / ⟨0.16.0, L9/L10 — census row⟩ `Wire.CertifiedAuditHead`, not an anonymous record. The
+   * / registry, market and cashier already served the shared type; the engram — the canister that
+   * / IS the evidence product — was the one chain still answering in a shape of its own, missing
+   * / `witness` entirely. One certified-head shape on every chain is the point: a verifier that can
+   * / read three of them and not the fourth has to special-case the one that matters most.
+   * /
+   * / `witness = null` is the honest answer here and is NOT the same as an empty proof. This engram
+   * / certifies its head via `CertifiedData` but keeps no witness tree, so there is no reveal to
+   * / encode; `?Blob` lets it say "I do not serve a proof" rather than fabricate one.
+   * /
+   * / PUBLIC: the certificate is the point — it lets a stranger verify against the NNS root key
+   * / instead of trusting this replica, and a proof that requires a role to fetch rests on exactly
+   * / the authority it was introduced to remove.
+   */
+  getCertifiedAuditHead: ActorMethod<[], CertifiedAuditHead>;
+  /**
+   * / The allowance of the agent holding `agentPrincipal`: its lasting key and the openings left.
+   * / Readable by the owner and by that agent's own key — refused loudly to anyone else, never a zero
+   * / (a zero would be a claim about another owner's grant).
+   * /
+   * / ⟨2026-10-01, review F2⟩ A QUERY, so the refusal is deliberately NOT written to the denial log: a
+   * / query's state writes are discarded when it returns, and the `denied` call first written here
+   * / recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
+   * / WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
+   */
+  getChildAllowance: ActorMethod<[Principal], Result_61>;
+  /**
+   * / Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
+   * / agent's request is refused, the balance now, and every agent's allowance. The console's cost
+   * / sentence reads it. Cycles are owner-class information, as on the owner's console read.
+   */
+  getChildOpening: ActorMethod<[], Result_60>;
+  /**
+   * / Derive the shared memory-encryption key, encrypted under the caller's transport
+   * / public key. Gated to owner + read-agents (the same principals allowed to read
+   * / memory). The client decrypts it locally with its transport secret key.
+   * / ⟨0.16.0⟩ THE FOLD: `epoch` is now an optional argument here, and the separate
+   * / `getEncryptedMemoryKeyForEpoch` is gone. Two methods differing only by whether one parameter
+   * / is present is what an optional argument is for, and the split forced a client to decide which
+   * / to call before it knew whether it needed rotation.
+   * /
+   * / `null` means CURRENT — not epoch 0. Those coincide today (nothing increments the epoch yet)
+   * / and will not after the first rotation, which is exactly when a caller that meant "the key that
+   * / seals my memory now" must not silently receive a superseded one. `?0` still names epoch 0
+   * / explicitly for a client rebuilding an old cache entry.
+   * /
+   * / Refusing a FUTURE epoch is not a bounds check, it is the rotation invariant: pre-deriving a
+   * / key for an epoch nobody has reached would make rotating to it meaningless.
+   * /
+   * / Also converted off the lowercase `#ok/#err` dialect (L5) — that spelling arrived from ic402
+   * / and had no business on a vetKD path, which touches nothing of ic402's.
+   * /
+   * / ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   * / `VetKeys.ManagementCanister.vetKdDeriveKey`. A query cannot await, so the round trip is the
+   * / cost. Stated here because L7 requires the reason be readable from the interface rather than
+   * / inferred by opening the body — which is exactly what had to happen to write this line.
+   */
+  getEncryptedMemoryKey: ActorMethod<[[] | [bigint], Uint8Array | number[]], Result_59>;
+  /**
+   * / ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
+   * /
+   * / The card's config hardcodes `x402Support = true`, answering a buyer's question with a fact
+   * / about the software rather than about THIS engram. B1 moved the 402 challenge machinery to the
+   * / market; the one x402-payable rail the engram kept is `sessionReadMemory`, gated by
+   * / `paidMemoryReadEnabled`, which DEFAULTS TO FALSE. So a discovering agent was told this engram
+   * / takes x402 payments while every paid read on a default engram is refused with "the owner has
+   * / not opened the monetized read rail". Ruled (a) over keeping `true` to mean "can PARTICIPATE in
+   * / x402, including as a payer" — defensible, but not what a service card says to a buyer.
+   * /
+   * / Overridden HERE rather than at the config because the card is built once as a `public let`
+   * / while the flag is runtime state, and `getCard()` belongs to the VENDORED ic402 module, which
+   * / is not ours to edit.
+   * /
+   * / ⚠ `signEngramRegistration` also reads `getCard()` and is deliberately NOT changed. It signs an
+   * / ERC-8004 registration for on-chain publication — a point-in-time attestation nobody can
+   * / re-sign every time an owner opens or closes the rail. Whether a signed record should carry
+   * / mutable operational state at all is a different decision, it is signing-adjacent, and the
+   * / ruling did not reach it. Filed, not folded in.
+   * /
+   * / PUBLIC: an agent card is a DISCOVERY document — its entire function is to tell a party that
+   * / has never met this engram what it is and how to transact with it. A card behind a gate cannot
+   * / be discovered, and the ERC-8004 ecosystem it participates in assumes an open read.
+   */
+  getEngramCard: ActorMethod<[], AgentCard>;
+  /**
+   * / PUBLIC: the engram's permanent spawn ordinal — a provable, non-sensitive fact. It identifies a
+   * / canister, never a person.
+   * / null = spawned before numbering existed; the owner can backfill via syncEngramNumber().
+   */
+  getEngramNumber: ActorMethod<[], [] | [bigint]>;
+  /**
+   * / Re-pointed at `EvmIdentity` (B-2): custody derivation no longer routes through the ic402
+   * / Gateway, which is leaving for the market canister. Behaviour is unchanged for a caller — same
+   * / address, same tECDSA key — but the engram no longer needs a marketplace to know its own
+   * / address, which is the whole point of the split.
+   * /
+   * / ⟨2026-08-21⟩ DO NOT FOLD THIS WITH `getEvmSignerAddress`. The 0.16.0 census carried the fold
+   * / as an open item, conditional on "if the derivation is identical". It is not, and the condition
+   * / is decidable here rather than by reading either comment:
+   * /
+   * /   this method   EvmIdentity.deriveAddress  ->  derivation_path = []
+   * /   the signer    eip712PublicKey            ->  derivation_path = ["eip712"]
+   * /
+   * / ⟨CORRECTED 2026-09-22 — the two paths above are what the code passed until KEY-PATHS §4 step 5;
+   * / the table is kept because the ARGUMENT it makes is unchanged and is the reason the fold is
+   * / still refused.⟩ The signer now reads `KeyPaths.EIP712` = `["engramx","eip712","secp256k1","v1"]`
+   * / and this method still derives at the empty path, because `pay` is the one row the genesis could
+   * / not move — ic402 2.15.0 parameterises `EvmSigner` but not `Gateway.deriveEvmRecipient`,
+   * / `EvmSender` or `Identity`, and moving the signer without them would split receiving from
+   * / spending. The paths are still DIFFERENT, which is the whole of the argument below, and they get
+   * / further apart at the genesis rather than closer.
+   * /
+   * / ⟨SHIPPED 2026-09-22, ic402 2.16.0 — the table is now BOTH rows labelled, and the argument is
+   * / unchanged, which is the point of keeping every version of it here:
+   * /
+   * /   this method   EvmIdentity.deriveAddress  ->  KeyPaths.PAY    = ["engramx","pay","secp256k1","v1"]
+   * /   the signer    eip712PublicKey            ->  KeyPaths.EIP712 = ["engramx","eip712","secp256k1","v1"]
+   * /
+   * / Two paths, one master key, therefore two addresses — exactly as when one of them was `[]`.
+   * / The fold stays refused for the reason below, not because one side happened to be a default.
+   * / What changed upstream is that `Gateway`, `EvmSender` and `Identity` all take a path now, so
+   * / the payment identity could move as ONE thing: this derivation, the gateway's inbound
+   * / recipient and outbound sender, and `Payments.evmSigner`. The genesis install derives them.⟩
+   * /
+   * / Same master key and curve, different paths, therefore different public keys and DIFFERENT
+   * / ADDRESSES — that is what a derivation path is for. The difference is also deliberate and
+   * / security-bearing, not incidental: the signer key is declared "outbound-only, N=1, never the
+   * / payment path — this key must never be able to move ic402 pool funds", so merging the two
+   * / would hand the signing surface the payment key. `getEvmSignerAddress` carries the warning
+   * / from its side ("the payment key's address is NOT this one, by design"); this is the other
+   * / side, because a fold is proposed by whoever reads either declaration first.
+   * /
+   * / The gates differ too, which a fold would also have to collapse: this method is UNGATED (any
+   * / caller may cause the derivation) and `getEvmSignerAddress` is owner-only.
+   * /
+   * / PUBLIC: an address is a destination, not a capability — publishing it lets anyone PAY this
+   * / engram and lets nobody spend from it. It has to be readable by a stranger because a stranger
+   * / is exactly who needs it. The write it causes is bounded to one derivation and one
+   * / set-once custody stamp per engram lifetime, which is what keeps "any caller may cause it"
+   * / safe rather than merely permitted.
+   * / ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   * / `EvmIdentity.deriveAddress`, which reaches the management canister's `ecdsa_public_key`. A
+   * / query cannot await it.
+   * /
+   * / ⟨Marker added 2026-08-23; the census row already said "L7 marked (ecdsa_public_key)" and the
+   * / site did not carry the mark. Same `public func` form as its two neighbours above.⟩
+   * /
+   * / ⟨2026-09-28⟩ THE REPLY IS A RECORD, `Types.EvmAddresses` — the payment address (`pay`, what this
+   * / method returned alone until then) and the address that signs the engram's own registrations
+   * / (`engramRegistration`). The owner decided that date to publish the registration address as a new
+   * / field on an existing address reply, not as a new method; nothing served it before, so an
+   * / agent could not read the address whose nonce `signEngramRegistration` needs and whose ETH
+   * / pays its gas. The registration address is read FROM THE SIGNER ITSELF
+   * / (`engramRegSigner.getEvmAddress`), not re-derived beside it, so the published address is by
+   * / construction the one the signatures come from. It is cached inside that signer object; the
+   * / cache is not stable, so the first call after an upgrade re-derives it once — the same one
+   * / public-key read, bounded, that the payment branch does on a null cache.
+   * /
+   * / It refuses rather than half-answers: if either address cannot be derived the reply is
+   * / `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
+   * / failed derivation — that is fail-to-empty on a money surface, and it stops here).
+   */
+  getEvmAddress: ActorMethod<[], Result_58>;
+  /**
+   * / The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
+   * / the address this canister derives for itself.
+   * /
+   * / PUBLIC: an address is a public identifier on every chain it exists on; it is a destination,
+   * / not a capability, and knowing it confers nothing. `null` means the owner registered none,
+   * / which a payer needs to be able to tell from an address they failed to read.
+   */
+  getEvmOwnerAddress: ActorMethod<[], [] | [string]>;
+  /**
+   * / D1 ships with this: the address of the DEDICATED signing key. Without it the owner funds the
+   * / wrong address — the payment key's address is NOT this one, by design.
+   * /
+   * / ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: `eip712PublicKey()` awaits
+   * / the management canister's `ecdsa_public_key`. A query cannot await, so the round-trip is the
+   * / cost — stated here because L7 requires the reason be readable from the interface rather than
+   * / inferred by opening the body.
+   */
+  getEvmSignerAddress: ActorMethod<[], Result_43>;
+  /**
+   * / PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
+   * /
+   * / The fourth of the four evidence methods (`getAuditHead`, `getCertifiedAuditHead`,
+   * / `listAuditEntries`, this) that every chain canister now serves in the same shape. Ungated for
+   * / the same reason the head is: a verifier who must ask permission to learn where a chain starts
+   * / cannot verify it, and nothing here identifies anybody.
+   */
+  getGenesisNote: ActorMethod<[], GenesisNote>;
+  /**
+   * / A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
+   */
+  getGuardianAlertStatus: ActorMethod<[], Result_57>;
+  /**
+   * / The market this engram will accept signing requests from — `null` until the registry pushes
+   * / one at spawn, which is why `requireMarket` refuses fleet-wide today.
+   * /
+   * / PUBLIC: this is the whole of what stands between a stranger and this engram's signing key. A
+   * / counterparty evaluating an engram's market claim has to be able to read which market it is
+   * / pinned to, and `null` — "pinned to nobody, so it signs for nobody" — is the most important
+   * / answer it can give.
+   */
+  getMarketId: ActorMethod<[], [] | [Principal]>;
+  /**
+   * / FD, the one coordinated interface break: history no longer carries per-version CONTENT.
+   * /
+   * / The legacy shape returned a full snapshot of every version, which is what made history cost
+   * / O(total bytes ever written) and forced a per-version truncation cap that silently mangled
+   * / large files. What a reader gets now is the COMMITMENT — size and content root per version —
+   * / and content is read per version through readMemoryBytes, verified as it is served.
+   * /
+   * / Two deliberate shape changes beyond dropping the bytes:
+   * /
+   * /   * it is a RESULT. The old surface returned `[]` for "no such file", "you may not read
+   * /     this", and "this file genuinely has no history" alike — a gated empty indistinguishable
+   * /     from a real one, which is the exact failure class this store exists to end. A refusal
+   * /     now says so.
+   * /   * the counts ride along. `everCount` vs `retainedCount` makes byte eviction impossible to
+   * /     hide: a reader who sees them differ knows something was reclaimed, and `evictions`
+   * /     carries the disclosure — chain sequence and evicted root — for each range.
+   * /
+   * / Paging is by version number, which works as its own cursor because versions are dense and
+   * / never renumbered: the next page starts at the last version returned plus one. Defaults
+   * / return the whole history of any file a pre-FD engram could have held.
+   */
+  getMemoryHistory: ActorMethod<[string, [] | [bigint], [] | [bigint]], Result_56>;
+  /**
+   * / PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
+   * / history would be a public, fleet-enumerable feed of when each owner terminated a trust
+   * / relationship — readable by, among others, the party just terminated.
+   */
+  getMemoryKeyEpoch: ActorMethod<[], bigint>;
+  /**
+   * / BLS verification key for the shared memory-encryption key. Used by the
+   * / client to verify the derived key. Static per (context, key_id) — cacheable.
+   * /
+   * / PUBLIC: intentionally unauthenticated — a vetKD public key reveals nothing secret and
+   * / cannot decrypt anything — the sensitive derivation is getEncryptedMemoryKey
+   * / below, which IS gated (read_memory) and returns key material encrypted to the
+   * / caller's transport key. Do not add an auth guard here (breaks client caching).
+   * / ⟨L7⟩ UPDATE, NOT QUERY, and this is the system call that forces it: the body awaits
+   * / `VetKeys.ManagementCanister.vetKdPublicKey`. A query cannot await, so the round trip is the
+   * / cost of getting a key nobody has to trust us for — which is the point of publishing it.
+   * /
+   * / ⟨Marker added 2026-08-23; the census row already said "L7 (vetKD pubkey call)" and the site did
+   * / not carry it. Declared `public func` rather than `public shared`, which is why the naming rule
+   * / in check-update-for-read.mjs did not see it — the census population did.⟩
+   */
+  getMemoryKeyVerificationKey: ActorMethod<[], Uint8Array | number[]>;
+  /**
+   * / Memory maintenance liveness. PUBLIC: ungated on purpose, like the anchor-push status — a stalled
+   * / sweep or a failed storage check is exactly what a third party must be able to observe, and
+   * / a gated read that failed to empty would report a healthy zero to anyone without a role.
+   * / Counts and flags only — the paths involved are in the chained audit entries, where the
+   * / access rules that govern them already apply.
+   */
+  getMemoryMaintainStatus: ActorMethod<[], MemoryMaintainStatus>;
+  /**
+   * / The DECLARED policy. Read it together with getMemoryRetentionGuards — on its own it is not
+   * / what governs eviction.
+   * / ⟨0.16.0⟩ ONE PROJECTION, absorbing what were two methods — and the fold is a correctness fix,
+   * / not tidying.
+   * /
+   * / Declared policy and the guards holding it back were separate reads, and a console rendering
+   * / only the first told an owner their policy was in force while a guard still held it. The old
+   * / `.did` warned in prose that the two had to be read TOGETHER; a comment is not a mechanism, and
+   * / the guard arms on the FIRST policy an owner ever sets — so the surface misled every owner who
+   * / ever touched retention, from first use. Making it one record makes reading half of it
+   * / impossible: the trap becomes structure.
+   * /
+   * / Refusal reasons of both merge: an empty policy reads as "nothing is capped, every version kept
+   * / forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
+   * / "nothing is held back".
+   */
+  getMemoryRetentionPolicy: ActorMethod<[], Result_55>;
+  /**
+   * / The metrics reader this engram answers — `null` until the spawning registry names one.
+   * /
+   * / PUBLIC: an owner deciding whether to switch the read off needs to know who it is, and anyone
+   * / comparing this engram's copy with the reader the registry publishes (`getMetricsReader` there)
+   * / needs the same value. A canister id is not a secret.
+   */
+  getMetricsReaderId: ActorMethod<[], [] | [Principal]>;
+  /**
+   * / A guardian asking about their OWN standing.
+   * /
+   * / #NotFound and not #Refused, deliberately, even though this reads a roster no stranger may
+   * / see: the only row it can ever return is the caller's own, so "you are not a guardian here" is
+   * / a fact about the caller, told to the caller. There is nothing to leak by omission — which is
+   * / the test the #NotFound arm sets.
+   */
+  getMyGuardianStatus: ActorMethod<[], Result_15>;
+  /**
+   * / ⟨0.16.0, NEW⟩ The gated half of the status() split.
+   * /
+   * / Every field is bare — no masking, no `authorized` discriminator — because reaching this record
+   * / AT ALL is the authorization. An unauthorized caller gets `#Err(#Refused …)` and no record.
+   * /
+   * / `cyclesBalance` is a bare `Nat`, and that retires an argument this repo carried for weeks. It
+   * / was `nat`, then widened to `opt nat` so a refusal could be `null`, which broke every published
+   * / client (rule 4) and bought a masked answer nobody had asked for — the census could not even
+   * / find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
+   */
+  getOwnerConsole: ActorMethod<[], Result_54>;
+  /**
+   * / Owner + agents only (agents need it to avoid writing protected paths).
+   * /
+   * / A NAMED RECORD, not a Page: the setter replaces this list wholesale, so there is no window to
+   * / page over and no `total` that could differ from `items.size()`. Forcing the Page shape here
+   * / would be uniformity for its own sake — the census ratified the whole-value-config carve-out
+   * / precisely so L3 does not become a rule applied past its meaning.
+   * /
+   * / The trap's `whyNotEmpty` clause is preserved as the `#Refused` reason: `[]` would read as "no
+   * / path on this engram is protected", and an agent consults this list precisely to avoid
+   * / writing one — so a fabricated empty here does not merely misinform, it invites the write the
+   * / list exists to prevent.
+   */
+  getProtectedPaths: ActorMethod<[], Result_53>;
+  /**
+   * / Whether the metrics reader's read is answered — `true` from birth.
+   * /
+   * / PUBLIC: the promise that an owner can switch this read off can be checked only if the switch
+   * / can be read — the reason the reader pointer is public too. It discloses one setting, never a row.
+   */
+  getSeatWeeksReadEnabled: ActorMethod<[], boolean>;
+  /**
+   * / Owner-only, Billing-class: the signing floor, the balance, one signature's price, and how many
+   * / payment signatures the balance carries above the floor before `signX402Payment` is refused by
+   * / name. The same numbers the check uses, so Billing can say only what the engram enforces.
+   */
+  getSigningFloor: ActorMethod<[], Result_52>;
+  /**
+   * / The registry that spawned this engram, if it recorded one.
+   * /
+   * / PUBLIC: it is the provenance claim. An engram asserting it is part of a fleet, under that
+   * / fleet's attested template and rent rail, is asserting something a stranger must be able to
+   * / check against the registry named here — and a provenance you need permission to read is not
+   * / provenance. `null` says this engram makes no such claim, which is equally worth serving.
+   */
+  getSpawnedBy: ActorMethod<[], [] | [Principal]>;
+  /**
+   * / Read the engram-wide daily ceiling and what has been spent against it today, across every
+   * / caller. ⟨2026-09-28, the owner's decision to add the ceiling⟩
+   * / ⟨CORRECTED 2026-09-29, review finding X-8: "spent" means signed in x402 payments; typed-data
+   * / and the engram's registration signatures are not counted here — see `setSpendCeiling`.⟩
+   * /
+   * / OWNER-ONLY, for the reason `getSpendPolicy` is: the limits are the owner's custody
+   * / configuration, and the engram-wide total would also tell one agent how much the others spent.
+   * / A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
+   * / "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
+   */
+  getSpendCeiling: ActorMethod<[], Result_51>;
+  /**
+   * / Read the caps in force for a caller.
+   * /
+   * / OWNER-ONLY, and this is where it diverges from the market's inbound twin, which is public.
+   * / There the limits ride inside every 402 challenge, so withholding them would hide nothing.
+   * / Here the engram serves no 402s at all: these caps are the owner's private custody
+   * / configuration, and publishing them would tell any caller exactly how large a signing request
+   * / can be before it needs an approval nobody is watching for.
+   */
+  getSpendPolicy: ActorMethod<[[] | [Principal]], Result_50>;
+  getStorageStats: ActorMethod<[], Result_49>;
+  /**
+   * / Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
+   * / and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
+   * / leaks nothing (booleans about our own scheduling).
+   * /
+   * / IDLE STEADY STATE (no webhook, no x402 sessions, no service jobs):
+   * /   alertTimerArmed=false  sessionExpiryArmed=false  jobExpiryArmed=false  jobExpiryFastMode=false
+   * /
+   * / ⚠ CORRECTED 2026-08-19. This said `jobExpiryArmed=TRUE` and that it "stays true by design —
+   * / ic402 keeps an hourly idle POLL because createJobFromReceipt is synchronous and cannot disarm a
+   * / timer itself". Both halves are stale, and an ops reader comparing a live engram against this
+   * / paragraph would have seen `false` and gone looking for a fault that is not there.
+   * /
+   * / The engram sets `setExpiryIdlePollSeconds(0)` in its actor body, and ic402's ServiceRegistry
+   * / CANCELS the timer outright at 0 rather than re-arming it — so the hourly tick this paragraph
+   * / promised has not existed since that line landed. Independently, B1 moved job creation to the
+   * / market: the engram now serves no job method at all, so nothing can arm the timer in the first
+   * / place. `jobExpiryArmed` reads false on an idle engram, and false is CORRECT.
+   * /
+   * / EXPECTED FALSE POSITIVE: for up to one interval after any install or upgrade,
+   * / sessionExpiryArmed reads true with zero sessions. ic402's startTimers arms unconditionally
+   * / because a persistent actor re-runs its init body BEFORE postupgrade restores stable sessions,
+   * / so a predicate-gated arm would skip exactly the canisters that have live ones. The first tick
+   * / disarms it. Still true minutes after an upgrade is a real bug — report it upstream.
+   * / NOT the whole timer story. The hourly CYCLE timer — which also carries audit anchoring — is
+   * / deliberately absent: it is a `transient let` armed unconditionally at init, so an "armed"
+   * / boolean for it would read true forever and tell you nothing, exactly the false-positive the
+   * / paragraph above describes for sessionExpiryArmed. Use getAnchorPushStatus() instead: last-tick
+   * / TIMESTAMPS are evidence where an arm flag is only an intention.
+   * /
+   * / PUBLIC: the same standing as the two liveness reads above. Booleans and timestamps about this
+   * / canister's own timers — nothing about content, callers or money — and a liveness signal only
+   * / its owner can read cannot tell a third party that the engram is still running.
+   */
+  getTimerHealth: ActorMethod<[], TimerHealth>;
+  /**
+   * / PUBLIC: a cap identifies no user, and a caller deserves to know the rule before it stops them.
+   * /
+   * / ⟨0.16.0, L8⟩ Was owner-gated behind a trap. The disclosure law asks what the value reveals, and
+   * / the answer here is nothing about anybody — it is a policy ceiling, not a balance or a history.
+   * / Publishing it removes the trap AND the envelope: an ungated read has no refusal to carry, so
+   * / wrapping it in `Result` would be ceremony that implies a gate exists.
+   * /
+   * / Predictability is itself the honesty posture: a limit that only reveals itself by refusing a
+   * / top-up teaches the caller by failure. `/// PUBLIC:` is the marker the L8 gate greps for.
+   */
+  getTopUpLimits: ActorMethod<[], { cooldownSeconds: bigint; maxCkusdcE6s: bigint }>;
+  /**
+   * / ⟨0.16.0⟩ `walletBalance()` DELETED — a ONE-LETTER trap beside `walletBalances()`, and a strict
+   * / projection of it: it returned `ExperimentalCycles.balance()`, which is `WalletBalances.cycles`.
+   * /
+   * / Two methods whose names differ by a single character, with the same gate and one a subset of
+   * / the other, is a call site waiting to be written wrong — and wrong in the direction that
+   * / silently reads cycles when it meant to read money. Doc callers (CLI-REFERENCE, Docs.vue) sweep
+   * / to the survivor.
+   * / RENAMED from `walletBalances` (L2.1: `get*` for a single value).
+   * /
+   * / Stays an UPDATE, marked per L7: it awaits three ICRC-1 ledgers. The name cannot say that, so
+   * / the declaration does — a caller budgeting round-trips needs to know this is not a query.
+   * /
+   * / The ledger failure is `#Unavailable`, not `#Invalid`: a dependency refused or timed out, the
+   * / request was fine, and retry is the correct response. That is the one arm in the whole set that
+   * / means "try again", and it is the reason `Error` is a closed variant rather than a sentence.
+   * /
+   * / ⟨L7⟩ MARKER ADDED 2026-08-23, reasoning above UNCHANGED — this block already said "Stays an
+   * / UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
+   * / to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
+   */
+  getWalletBalances: ActorMethod<[], Result_48>;
+  /**
+   * / Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
+   * / read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
+   * / engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
+   * / fabrication is indistinguishable from the truth by construction.
+   */
+  getWorldIdConfig: ActorMethod<[], Result_47>;
+  /**
+   * / ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
+   * / `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
+   * / query can do none of them.
+   * /
+   * / Owner-only: produce a World ID 4.0 relying-party context for the frontend's IDKit request.
+   * / Valid iff the derived signer address (getWorldIdRpSignerAddress) is registered for this rp_id in
+   * / the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
+   * / it authorizes opening one verification request, nothing else.
+   */
+  getWorldIdRpContext: ActorMethod<[], Result_46>;
+  /**
+   * / Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
+   * / "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
+   * / Portal — the engram never holds or exports a private key (only threshold shares exist, on the
+   * / subnet). Distinct from the payment/EVM address by construction.
+   * /
+   * / ⟨L7⟩ UPDATE, NOT QUERY, for TWO reasons and the second is the one a reader would miss. It
+   * / awaits `worldIdRpPublicKey()` (management `ecdsa_public_key`), and it calls `denied()` on
+   * / refusal — a state write, which a query cannot perform. So even if the key were cached this
+   * / could not become a query without silently retiring its denial record (ADR-0002's class).
+   */
+  getWorldIdRpSignerAddress: ActorMethod<[], Result_43>;
+  /**
+   * / The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
+   * / artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
+   * / `Result<opt Text>` — and the double wrapper is the entire point, not redundancy.
+   * /
+   * / `#Ok(null)` means HONEST ABSENCE: no verification is on record, and you were entitled to ask.
+   * / `#Err(#Refused …)` means you may not ask. Under the old bare `?Text` those two collapsed into
+   * / one `null`, so a caller lacking a grant was told an unverified human stands behind this engram
+   * / — a false claim about a person, produced by an authorization failure.
+   * /
+   * / The artifact stays role-gated because it carries the NULLIFIER. The public, anonymous answer to
+   * / "is a human behind this engram" is `about().verifiedHuman`, which is a boolean and leaks
+   * / nothing.
+   * /
+   * / ⟨CORRECTED 2026-08-21 — this said `metrics().verifiedHuman`, and `metrics()` no longer exists:
+   * / L2.2 folded it and `status()` into `about()`, which carries the field. The sentence is a
+   * / `///`, so the dead name was PUBLISHED in engram.did and pointed every client at a method the
+   * / canister does not serve. The tombstones below and at `about()` are historical and correct as
+   * / written; this one was present tense, which is the difference that matters.⟩
+   */
+  getWorldIdVerification: ActorMethod<[], Result_45>;
+  /**
+   * / ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
+   * / absence of a `#Conflict` here is the point: these are the calls someone makes while something
+   * / is going wrong, and the only two answers that help are "you may not do this" and "there is
+   * / nothing by that name". A missing PERMISSION is `#Refused` rather than `#Conflict` — the
+   * / guardian's standing is what fell short, and no change to engram state would let them through.
+   */
+  guardianRevokeAgent: ActorMethod<[Principal], Result_1>;
+  /**
+   * / The HTTP surface: canister-info JSON, OAuth discovery documents, and the MCP route's query
+   * / half. See the `http_request_update` twin below for what upgrades and why.
+   * /
+   * / PUBLIC: not a choice. The boundary node invokes this for every inbound HTTP request with no
+   * / caller identity to gate on, so a gate here would refuse the only caller there is. Authorization
+   * / lives INSIDE, per route — `/mcp` demands a bearer token, the discovery documents are meant to
+   * / be world-readable by their own specs, and the canister-info JSON serves only facts already
+   * / published by the queries above it.
+   */
+  http_request: ActorMethod<[HttpRequest], HttpResponse>;
+  /**
+   * / The update twin of the router above — the routes the query half UPGRADES so their responses
+   * / are consensus-certified and served on the certified hostname.
+   * /
+   * / PUBLIC: for the same reason as its twin, and it must match. A route the query half upgrades
+   * / but this half does not handle falls through to the 404 at the end, turning a serving fault
+   * / into what reads as a wrong URL — half a fix being worse than none, as the /oauth/authorize
+   * / arm inside records.
+   */
+  http_request_update: ActorMethod<[HttpRequest], HttpResponse>;
+  /**
+   * / ⟨0.16.0⟩ `isPaidMemoryReadEnabled()` DELETED — folded to `about().paidMemoryReadEnabled`
+   * / (L2.6: one idiom for a boolean feature — a setter plus the flag on its family's projection).
+   * / Its callers are a buyer's pre-check and the market canister, both ANONYMOUS, so the public
+   * / projection is exactly where it belongs.
+   * / PUBLIC: a wallet calls this BEFORE its user has any standing on this engram — that is what the
+   * / call is for — so gating it would make the message unreadable at exactly the moment it is
+   * / needed, and a signature given without it is a signature given blind.
+   */
+  icrc21_canister_call_consent_message: ActorMethod<
+    [
+      {
+        arg: Uint8Array | number[];
+        method: string;
+        user_preferences: {};
+      },
+    ],
+    | {
+        Ok: {
+          metadata: {
+            utc_offset_minutes: [] | [number];
+            language: string;
+          };
+          consent_message: { GenericDisplayMessage: string };
+        };
+      }
+    | { Err: { description: string; error_code: bigint } }
+  >;
+  /**
+   * / Owner-only: is the derived EVM address CACHED right now, without deriving it to find out.
+   * /
+   * / WHY A SEPARATE METHOD AND NOT A FIELD ON `getEvmAddress`. That method cannot answer this
+   * / question by construction: when the cache is null it DERIVES, caches the result and returns it,
+   * / so by the time a caller sees the reply the cache is populated either way. Asking it whether the
+   * / cache had been populated changes the answer.
+   * /
+   * / WHY IT EXISTS AT ALL, since a public surface is never free on a canister meant to go public.
+   * / `evmAddressCache` is money-classed and its annotation says why: derivation is deterministic, so
+   * / a lost cache LOOKS harmless, but until something re-derives, the EVM payment quote advertises
+   * / the fallback — an address that cannot receive. A window in which a live money surface publishes
+   * / an unreceivable address is a money defect, not a cache miss. Nothing else in this canister
+   * / reads that var — one reader and two writers, all in this file — so before this method there was
+   * / no observation anywhere that could tell a survived cache from a rebuilt one, and the upgrade
+   * / coverage gate carried a money-classed var nothing could prove.
+   * /
+   * / ⚠ IT MUST NEVER DERIVE. A version that fell back to deriving would answer `true` always and
+   * / prove nothing — the same trap `getEvmAddress` sets for anyone trying to use it as a witness.
+   * / It reads the var and nothing else, and it is a `query` precisely so that it CANNOT make the
+   * / inter-canister call a derivation requires: the restriction is enforced by the system, not by
+   * / this comment.
+   * /
+   * / Owner-gated because it reports on custody posture, and answered as a Result so that a
+   * / wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
+   */
+  isEvmAddressCached: ActorMethod<[], Result_44>;
+  /**
+   * / Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
+   * / (an `/auth/connector`-style route) after II authentication. The client then
+   * / redirects the user's browser to `redirectUri` with `?code=<this>` so the
+   * / MCP client (e.g. claude.ai) can exchange it for a bearer token at /oauth/token.
+   * /
+   * / Owner-only: only the engram owner can authorize a Connector install.
+   */
+  issueAuthCode: ActorMethod<[string, string, string, [] | [string]], Result_43>;
+  /**
+   * / ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
+   * / ROW. A single label for a whole ring misattributes every row recorded under the other source,
+   * / and the source flips by design (self-call first, balance on fallback). Its documentation of
+   * / what the two values mean lives on the type.
+   * / Hourly (timestamp, totalMemoryReads, totalMemoryWrites) snapshots, ~30 days.
+   * / Same guard + fail-to-empty shape as getCycleHistory. Diff consecutive rows for a
+   * / per-engram activity time-series (retention instrumentation).
+   * / RENAMED from `getActivityHistory` (L2.1); named fields replace a bare 3-tuple whose two Nats
+   * / were positionally indistinguishable.
+   * /
+   * / Refusal reason preserved, and it is the sharpest of this family: a masked `[]` reads as a
+   * / DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
+   * / reader, it feeds a wrong number into a decision about destroying data.
+   */
+  listActivitySnapshots: ActorMethod<[bigint, bigint], Result_42>;
+  /**
+   * / ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
+   * /
+   * / The refusal prose that used to be `gatedTrap`'s `whyNotEmpty` argument is not lost — it is why
+   * / this method could never fail soft, and it now travels ON THE WIRE inside `#Refused` where a
+   * / caller can actually read it, instead of inside a trap message only a log sees.
+   * /
+   * / `total` is the ROSTER SIZE, not `items.size()`. That distinction is the whole reason this
+   * / shape exists here: `MAX_AGENTS` clamps the returned rows, and the old code returned the
+   * / clamped array with nothing saying it had clamped — a caller reading 100 agents could not
+   * / tell whether that was all of them. Now a clamped answer is self-describing, and the previous
+   * / behaviour (silently truncate, look complete) is unrepresentable.
+   * /
+   * / `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
+   * / A method that filters rows by caller sets it — see L1's row-level honesty rule.
+   */
+  listAgents: ActorMethod<[bigint, bigint], Result_41>;
+  /**
+   * / The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
+   * /
+   * / Two audiences, two methods (L1/L8), rather than one method masking fields by caller: a
+   * / guardian needs enough to revoke (who, what they are called, whether they are active) and no
+   * / more. Field-masking would make the same call return different shapes to different callers,
+   * / which is the design L1 abolished — and it would put the decision about what a guardian may see
+   * / inside a build closure where no gate can read it.
+   * /
+   * / Refusal reason preserved: `[]` reads as "this engram has no agents", and this is the list a
+   * / guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
+   * / it tells someone acting under emergency powers that there is nothing to act on.
+   */
+  listAgentsForGuardian: ActorMethod<[bigint, bigint], Result_40>;
+  /**
+   * / Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
+   * /
+   * / The optional leading filter SURVIVES the L3 reshape — ratified (census tier-2 #8) rather than
+   * / assumed, because Billing.vue calls the filtered form live and pushing the filter client-side
+   * / would make the console fetch a queue to discard most of it.
+   * /
+   * / `total` counts the FILTERED set, not the whole queue: with a filter applied, "how many match"
+   * / is the number a pager needs, and reporting the unfiltered count would make every filtered view
+   * / claim more pages than it has.
+   * /
+   * / Refusal reason preserved: `[]` reads as "nothing is awaiting the owner's decision".
+   */
+  listApprovalRequests: ActorMethod<[[] | [ApprovalStatus], bigint, bigint], Result_28>;
+  /**
+   * / ⟨0.16.0⟩ `total` IS THE HEAD COUNTER, and on this method that is the entire point.
+   * /
+   * / The audit log is a bounded RING: it trims its tail, so "rows you can read" and "entries that
+   * / have ever existed" are different numbers. The old bare array published only the first, which
+   * / made a trimmed log indistinguishable from a complete one — and this is the evidence surface,
+   * / where that difference IS the product. `totalAppended()` is monotonic across trims and is the
+   * / same number `getCertifiedAuditHead` publishes, so a caller comparing page against head gets
+   * / agreement by construction rather than by luck.
+   * /
+   * / Refusal reason preserved: for an unauthenticated integrity check the caller wants
+   * / `getCertifiedAuditHead()`, which is public and subnet-certified. The BODIES are role-gated.
+   * /
+   * / ⟨2026-09-29, owner ruling follow-up 16 (B)⟩ AN AGENT READS ONLY THE ENTRIES IT CAUSED; the
+   * / owner and guardians read everything (`RecordView`). So `limit` is a SPAN — how many record ids
+   * / to examine from `start` — and an agent's page holds the entries in that span whose caller is
+   * / its own key, with `withheld` counting the rest: `items.size() + withheld` is the span examined.
+   * / For the owner and a guardian `withheld` is 0 and the page is the span. WHAT WOULD MAKE THIS
+   * / WRONG: a reader who must see the whole record without being the owner or a guardian — the
+   * / public certified head is the answer for integrity, and nothing else is.
+   */
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_23>;
+  /**
+   * / ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
+   * /
+   * / This method used to answer THREE ways to one question: a list, an `#Err` text, and a trap,
+   * / picked by which kind of caller asked. That split existed only because the return type could
+   * / not carry a refusal — with `Result<Page<T>>` it can, so every caller gets one shape and the
+   * / arm says which no it is. A paired agent lacking `canReadBackup` is `#Refused`; so is
+   * / everyone else who may not ask. The trap is gone: `Debug.trap` is for invariant violations,
+   * / never authorization (L1), and a refusal a caller cannot catch is not a better refusal.
+   * /
+   * / ⚠ THE RATIFIED LOCKSTEP EXCEPTION THIS CARRIED IS SUPERSEDED, not quietly dropped.
+   * / `ADR-0002-listBackups-refusal-lockstep/listBackups` existed because published
+   * / @engramx/client 0.15.0 declares `IDL.Vec(BackupMetadata)` here and cannot decode a variant at
+   * / all — it throws — and @engramx/openclaw's dedup probe catches that throw and degrades to
+   * / "skipped", so every database silently stops being backed up while the CLI reports success.
+   * / That analysis was correct and is still correct. What changed is its PREMISE: plan v2 measured
+   * / the installed base at zero external users (prod = two engrams, both ours; npm published
+   * / 2026-08-14), so the population the ceremony protected does not exist. The SDK is republished
+   * / at 0.16.0 in this same campaign. If an outside caller ever appears before that ships,
+   * / this reasoning is void and the lockstep is owed again.
+   * /
+   * / `dbTypeFilter` DIES on the wire (census). The capability does not: `EngramClient.listBackups`
+   * / keeps its optional filter and applies it to the page, so no caller loses the ability to ask
+   * / "backups of this database" — it stops being a thing the canister has to page around.
+   */
+  listBackups: ActorMethod<[bigint, bigint], Result_39>;
+  /**
+   * / List all bearer tokens — Active, Revoked, and Expired. Owner uses this in
+   * / the dashboard to show installed Connectors (claude.ai, Claude Desktop, etc.).
+   * / Refusal reason preserved from the trap: `[]` reads as "no connector is installed on this
+   * / engram" — a claim about what can REACH it. An owner auditing access cannot tell that from
+   * / "you may not see the list", and the two are opposite facts.
+   * /
+   * / `bearerTokenStore.list()` already resolves each token's status at read time (a token that
+   * / merely stopped being used is reported `#Expired`, not a stale `#Active`), so the page carries
+   * / the same honesty the store gained on 2026-08-17.
+   */
+  listBearerTokens: ActorMethod<[bigint, bigint], Result_38>;
+  /**
+   * / The condense checkpoints in the retained log at or above `startSeq`, oldest first.
+   * /
+   * / ⟨0.16.0, NEW⟩ The other half of the split above. A checkpoint is the only surviving record of a
+   * / stretch of chain that no longer exists, so this is the list that accounts for the distance
+   * / between `firstAvailableSeq` and the entries an owner remembers writing — without it, a
+   * / condensed prefix is a gap the owner has to take on trust.
+   * /
+   * / Owner-only like every other archive surface, and for the same structural reason: these rows
+   * / carry the chain positions and roots of entries whose paths were inside the hash preimage.
+   */
+  listCondenseCheckpoints: ActorMethod<[bigint, bigint], Result_37>;
+  /**
+   * / ⟨0.16.0⟩ `metrics()` DELETED — absorbed by `about()`.
+   * /
+   * / Two public projections of one canister (L2.2): `metrics()` and `status()` both answered "what
+   * / is this engram like" and disagreed on which counters they carried, so a consumer had to fetch
+   * / both and know which one owned each field. Every field here survives on `about()`, day-flooring
+   * / included.
+   */
+  listCycleSnapshots: ActorMethod<[bigint, bigint], Result_36>;
+  /**
+   * / Same `withheld` treatment as listMemoryFiles — the tombstone listing filtered reserved paths
+   * / for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
+   * / complete one. Counted before slicing, so policy-hidden rows never blur into paging.
+   */
+  listDeletedMemoryFiles: ActorMethod<[bigint, bigint], Result_35>;
+  /**
+   * / The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
+   * / Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
+   * /
+   * / Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
+   * / AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
+   * / registration remains the audit chain under getCertifiedAuditHead.
+   */
+  listEip712Types: ActorMethod<[bigint, bigint], Result_34>;
+  /**
+   * / Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
+   * /
+   * / NAMED item, not a `(Text, Int)` tuple. The Int is an activation time, and a bare Int beside a
+   * / bare Text told a reader nothing about which was which — the same defect fixed on the purge log.
+   * /
+   * / Refusal reason preserved, and it has two halves that matter separately: `[]` reads as "this
+   * / engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
+   * / opposite security posture. It also erases any pending 24h activation from view.
+   */
+  listEvmWithdrawDestinations: ActorMethod<[bigint, bigint], Result_33>;
+  /**
+   * / Accessible by owner and guardians.
+   * /
+   * / Refusal reason carried over from the trap, because it is the sharpest example of why this
+   * / surface may not fail soft: `[]` reads as "this engram has nobody who can freeze payments or
+   * / pause writes" — a claim about who can STOP it. A caller who cannot tell that from "you may not
+   * / see the roster" has been told the engram is unguarded when it may be fully guarded.
+   */
+  listGuardians: ActorMethod<[bigint, bigint], Result_32>;
+  /**
+   * / The export receipts in the retained log at or above `startSeq`, oldest first.
+   * /
+   * / ⟨0.16.0, L3⟩ ONE LIST, ONE QUESTION. This method used to return receipts AND checkpoints
+   * / together behind a backward `before`/`max` cursor. They answer different questions — what may be
+   * / condensed, and what already was — so a caller wanting one paid to decode the other, and the
+   * / merged shape had to carry two arrays, a truncation flag and an opaque cursor to stay honest
+   * / about a walk that served both. `listCondenseCheckpoints` is the other half.
+   * /
+   * / The cursor dies with it (census R6): paging is by ABSOLUTE SEQ now, forward, so a caller resumes
+   * / at `scannedThroughSeq + 1` and is finished when that passes `page.total`. `scanTruncated` is
+   * / gone because it has nothing left to say — "I stopped at entry N" is the same claim it made, and
+   * / says it as a position rather than a flag a reader has to pair with a second field.
+   * /
+   * / Read `MemoryRouter.ReceiptPage` before reading `page.total` as a receipt count. It is not one;
+   * / it is the chain's length, and the declaration says why.
+   */
+  listMemoryExportReceipts: ActorMethod<[bigint, bigint], Result_31>;
+  /**
+   * / ⟨0.16.0⟩ THE `withheld` EXEMPLAR — L1 names this exact method as the defect it fixes.
+   * /
+   * / A non-owner's answer silently dropped every `config/` and `secrets/` row. Not "refused the
+   * / call" and not "returned a marker" — the rows simply were not there, with nothing in band
+   * / saying so, and the filtering happened INSIDE a combinator closure where neither honesty gate
+   * / could see it. Meanwhile `readMemory` returned an explicit refusal for the very same paths.
+   * / Same policy, same caller, two answers, and the quiet one was the lie.
+   * /
+   * / `withheld` is now the count of rows policy removed. It leaks no names — which is the point:
+   * / the caller learns THAT something is hidden without learning WHAT, so an agent can tell a
+   * / short listing from a complete one and stop inferring the engram is emptier than it is.
+   * /
+   * / Note the count is computed from the unfiltered list before slicing, so it reports rows hidden
+   * / by POLICY, never rows merely off the end of this page — those are `total`'s job. Conflating
+   * / the two would rebuild the ambiguity in a new place.
+   */
+  listMemoryFiles: ActorMethod<[bigint, bigint], Result_30>;
+  /**
+   * / One page of the memory log, seq-ordered, optionally narrowed to one author.
+   * /
+   * / THE WINDOW IS THE CURSOR, and the page now states it. The window is
+   * / `items.size() + withheld` entries starting at `max(startSeq, firstAvailableSeq)`; advance by
+   * / that, never by "last entry returned + 1", which stalls forever on the first empty page. Stop
+   * / when the window passes `total`.
+   * /
+   * / ⟨0.16.0, L3 — CENSUS CONFLICT, RECORDED⟩ The census row says `→R<P<MemoryLogEvent>>` and
+   * / "authorFilter dropped (kills the filtered-window cursor stall)". The stall is real and the
+   * / diagnosis is right; amputating the filter is not the only cure, and it is the expensive one —
+   * / `Archive.vue` ships a working author-filter UI, and "what did this agent write" is a
+   * / question an owner asks of an evidence log. The filter STAYS. What kills the stall instead is
+   * / `withheld`: it carries the count this filter removed from the window, so a short or empty
+   * / filtered page is no longer ambiguous between "nobody wrote here" and "the window was small",
+   * / and the correct cursor advance is computable from the page itself. `pageCap` therefore dies
+   * / with nothing lost — it existed only to disclose a window that `items.size() + withheld` now
+   * / states directly.
+   * /
+   * / `firstAvailableSeq` and `head` sit BESIDE the page rather than in it. They are facts about the
+   * / chain, not this slice: the condense floor tells a caller reading an archived range where the
+   * / log now begins instead of letting them read it as empty, and the head is what a third party
+   * / checks the page against. Flattening to a bare `Page` to satisfy the shape would buy uniformity
+   * / with the disclosures that make the page verifiable — the hidden-bound defect the census itself
+   * / names on previewCondense's row.
+   */
+  listMemoryLog: ActorMethod<[bigint, bigint, [] | [Principal]], Result_29>;
+  /**
+   * / The caller's OWN spend-approval requests. ⟨0.16.0, L1 + L3 — fixed 2026-08-18⟩
+   * /
+   * / Two defects in seven lines, and the first is the one this release exists to remove:
+   * /
+   * /   · `if (Principal.isAnonymous(msg.caller)) return []` is a FABRICATED EMPTY. An anonymous
+   * /     caller was told "you have no approval requests", which is a claim about their queue rather
+   * /     than about their identity, and is indistinguishable from the honest answer. It refuses now.
+   * /   · The reply was uncapped over `pendingApprovals`, which NEVER SHRINKS — the hourly expiry
+   * /     timer flips a row's status to `#Expired` and deletes nothing. So the array grew for the
+   * /     life of the engram, and a caller with enough history would eventually get a reply too
+   * /     large to decode: not a truncated list, no list at all.
+   * /
+   * / The caller-scoping is not `withheld`: rows belonging to someone else were never this caller's
+   * / to see, so `total` over their own rows is the honest count and nothing is hidden FROM them.
+   * / (The unbounded MAP is filed separately — pruning an approval record destroys evidence of what
+   * / was asked, which is a retention ruling rather than a shape fix.)
+   */
+  listMyApprovalRequests: ActorMethod<[bigint, bigint], Result_28>;
+  /**
+   * / The payer's own sessions, live ones first. PAYER-SCOPED: a caller sees only their own, which
+   * / is why this needs no role — a session id is not a secret from the person who paid for it.
+   * /
+   * / ⟨2026-10-02, paged⟩ Takes `(start, limit)` like every other list here, capped at
+   * / `MAX_SESSIONS_PAGE` rows per call; `total` is how many of the caller's sessions still exist.
+   * / It took no arguments, and a cursor added after the freeze is an argument-list change every
+   * / client would break on — the market paged its own pending withdrawals before its cut for the
+   * / same reason. The order is the order sessions were opened.
+   */
+  listMySessions: ActorMethod<[bigint, bigint], Result_27>;
+  /**
+   * /
+   * / ⟨0.16.0, L3⟩ Paged and enveloped like every other `list*`, and the envelope here is uniformity
+   * / rather than gating: this method cannot refuse anybody, so `#Err` is unreachable on it. That is
+   * / deliberate — the off-chain verifier that reads this chain reads several other lists beside it,
+   * / and one shape for all of them is worth more than saving a variant tag on the one that is
+   * / public. `total` is the FULL chain length, so a verifier holding a short page can tell it has
+   * / not seen the whole custody history — the distinction a bare array could not express.
+   * /
+   * / PUBLIC: custody history is the answer to "is this engram what it claims to be", and it is
+   * / asked by strangers. `verifyEngramActiveOwner` on the registry answers only about the owner
+   * / IT recorded, so this chain is what a caller composes with when currency matters — which it
+   * / cannot do if it needs a role here.
+   */
+  listOwnershipTransfers: ActorMethod<[bigint, bigint], Result_26>;
+  /**
+   * / ⟨2026-09-29, the platform's question from the build review⟩ OWNER-ONLY: how many payment
+   * / signatures each agent has obtained today, and the daily limit (200, `PaymentSignCap`). The
+   * / owner's console stated the rule and showed no number, because nothing served one; a number it
+   * / made up would be a fabricated zero. Anyone else is refused by name (`#Refused
+   * / listPaymentSignatureCounts: …`), never answered with zeros. Paged like `listAgents`, in the same
+   * / order, one row per agent in the roster; each count is the agent's, taken by its root as the
+   * / signer takes it, so every key the agent holds here shows the same number. The owner is not
+   * / counted and has no row; the marketplace's count is not an agent's and is not here. WHAT WOULD
+   * / MAKE THIS WRONG: a count kept by something other than the agent's root (`PaymentSignCap.rowFor`
+   * / says so beside it).
+   * /
+   * / ⟨2026-09-30, following the owner's answer 4 of that date⟩ "is not here" no longer holds: the
+   * / marketplace's one shared count today is in the reply's `marketplace` field, with the limit this
+   * / engram enforces for it — beside the agents, never a row among them
+   * / (`PaymentSignCap.marketplaceRow`). Null when no marketplace is set.
+   */
+  listPaymentSignatureCounts: ActorMethod<[bigint, bigint], Result_25>;
+  /**
+   * / Agent records removed by a reset. Each row is a NAMED record with the fields `principal`,
+   * / `name`, `registeredAt` and `purgedAt` — read them BY NAME, never by position.
+   * / ⟨2026-09-29, the vocabulary ruling: pairing is the one verb that admits an agent⟩ The field
+   * / this prose calls `registeredAt` is now `pairedAt`, on the served row and on the agent record
+   * / it is copied from. What is said below about the two timestamps holds for `pairedAt`.
+   * /
+   * / The names are the whole point, not decoration. Both timestamps are a bare Int, so they were
+   * / positionally indistinguishable at the client: a decoder that swapped registeredAt and
+   * / purgedAt would type-check everywhere and show up only as nonsense in a UI. This prose used to
+   * / describe the row as a positional 4-tuple and readers duly destructured it as one — the same
+   * / bug, twice, in two different repos (corrected 2026-08-16). `agentPurgeLog` really is a
+   * / 4-tuple in stable state; the SERVED shape is not, and that seam is where the mistake starts.
+   * /
+   * / resetEngram HARD-DELETES agent records so a purged principal can be invited back
+   * / (owner ruling 2026-08-15). That makes the reset a genuine clear rather than a permanent burn —
+   * / but it also means the `agents` map is no longer evidence that a principal ever held access,
+   * / and the audit chain cannot stand in: it is a bounded ring that trims its oldest entries, so
+   * / agent.pair rows are evicted over the life the rent model assumes. This is that
+   * / evidence, and it is why the tombstone is written rather than the roster simply dropped.
+   * /
+   * / Owner-gated and TRAPS on refusal: an empty list must mean "no reset has removed an agent",
+   * / never "you may not ask".
+   * / ⟨CORRECTED 2026-10-02: it no longer traps. It is gated through `gatedResult`, so a refusal
+   * / comes back as an `Err` VALUE that names this method — still never as an empty page, which is
+   * / the property the sentence above was protecting.⟩
+   * / RENAMED from `getOperatorPurgeLog` (L2.1: `get*` returns one value, `list*` returns a Page —
+   * / the old name promised a scalar and delivered an array).
+   * /
+   * / Refusal reason preserved: an empty list must mean "no reset has removed an agent", never
+   * / "you may not ask". On an evidence trail those are not close.
+   * /
+   * / Named record, not a 4-tuple. Both Ints are timestamps and were positionally indistinguishable
+   * / at the client — swapping registeredAt and purgedAt would have type-checked everywhere and been
+   * / visible only as nonsense in a UI.
+   * /
+   * / ⟨2026-09-29, review finding LIFE-2⟩ Each row now also carries the agent's `root`, the
+   * / `invite` its enrolment named, and `ended` — why and on what day its engagement ended (its own
+   * / earlier ending, or the reset) — the facts `resyncAgentEdges` re-sends. The stored rows are
+   * / served as they are.
+   */
+  listPurgedAgents: ActorMethod<[bigint, bigint], Result_24>;
+  /**
+   * / ⟨0.16.0⟩ ONE ACCESSOR, folding `readReadLog` and `getDenialLog` — and the fold only became
+   * / safe because of a change made earlier in this same leg.
+   * /
+   * / They were two methods over the SAME log behind the SAME gate. `getDenialLog`'s own declaration
+   * / explained why the split existed: nothing published this log's head, so a client could only
+   * / reach the OLDEST retained entries, and a "recent refusals" band built on `readReadLog` would
+   * / have rendered the oldest slice of a 10,000-entry ring under those words. That rationale died
+   * / when the Page conversion started publishing `total = totalAppended()` — the head is now a fact
+   * / a caller can read, so paging backward from it is ordinary arithmetic.
+   * /
+   * / The census proposed deleting `readReadLog` outright as a "duplicate accessor". Checked at the
+   * / site, that premise was false: `getDenialLog` filtered `not e.success`, so deleting the other
+   * / would have removed the only way to read SUCCESSFUL entries — and this ring is overwhelmingly
+   * / successful MCP reads. Folded instead, which keeps both capabilities and still ends the pair.
+   * /
+   * / ⚠ `limit` IS A SPAN, NOT A ROW COUNT, and the same in both modes: it is how many log ids to
+   * / EXAMINE starting at `start`. Unfiltered, items == the entries in that span. Filtered, items is
+   * / however many of them matched — fewer, and that is not truncation. This is the one honest
+   * / reading, because the alternative (keep scanning until `limit` rows match) hides how far it
+   * / looked, which is precisely what `getDenialLog` had to disclose with `scannedFrom`/`more`.
+   * / A caller knows exactly which ids were examined: `[start, start + limit)`.
+   * /
+   * / `earliest` is gone as a field and lost nothing: entries carry their own `id`, so a caller
+   * / paging from 0 reads the oldest retained id off the first item. That is L3's stated design —
+   * / items self-identify — rather than a second number to keep in sync.
+   * /
+   * / `withheld` is 0 even when filtering. The filter is CALLER-REQUESTED; `withheld` means rows
+   * / POLICY removed. Overloading it would rebuild the ambiguity this campaign exists to remove.
+   * /
+   * / ⚠ **CORRECTED 2026-08-21, BESIDE the paragraph above because it is what the caller contract
+   * / USED to be: THAT RULE WAS REVERSED ON 2026-08-18 AND THIS COMMENT DID NOT FOLLOW.** The body
+   * / below computes `withheld = examined.size() - kept.size()`, and its own dated note explains
+   * / why: `withheld = 0` beside a filter is the FABRICATED-COMPLETE PAGE, and this is the worst
+   * / method in the file to have it on — `successFilter = ?false` is how the denial band asks "who
+   * / was refused here", and a short page claiming nothing was withheld says the engram examined
+   * / this window and found no refusals, when it examined `span` rows of which most were successes.
+   * /
+   * / So `withheld` now means BOTH policy-removed and filter-removed rows, and a caller can recover
+   * / the examined span as `items.size() + withheld` — which is the successor to the retired
+   * / `scannedFrom`/`head` window, and the number a UI needs to say what it actually looked at
+   * / rather than implying it looked at everything.
+   * /
+   * / This mattered beyond the file: doc comments are emitted into `engram.did`, so every SDK and
+   * / hand-written client has been reading the pre-fix rule off the interface for three days.
+   * /
+   * / Named `listReadLog`, not the census's `listDenialEntries`: that name assumed only the denial
+   * / half survived. A method serving every row must not be named for one of them.
+   * /
+   * / Refusal reason preserved from both: this log has NO public counterpart — no certified head to
+   * / fall back to — so an empty answer would falsely assert nobody has read this record, and an
+   * / empty denial band would assert nobody has ever been refused here.
+   * /
+   * / WHAT "success = false" MEANS, PRECISELY, kept from getDenialLog because it is easy to misread:
+   * / REFUSED-OR-FAILED, not authorization-denied alone. `denied()` writes authz refusals here, and
+   * / so do settle failures, webhook auto-disables, expiry sweeps and MCP rate limits. Do not narrow
+   * / this to a name it does not carry.
+   * /
+   * / ⟨2026-09-29, owner ruling follow-up 16 (B)⟩ An agent reads only the entries it caused, here as
+   * / on the chained record — the same `RecordView` filter, and `withheld` counts what it removed
+   * / together with what `successFilter` removed. WHAT WOULD MAKE THIS WRONG: see `listAuditEntries`.
+   */
+  listReadLog: ActorMethod<[[] | [boolean], bigint, bigint], Result_23>;
+  /**
+   * / Same visibility as listAuditEntries: the owner, this engram's agents, and ACTIVE guardians
+   * / see disputes. An unauthorized read REFUSES — it does not return an empty list, because an
+   * / empty list reads as "no disputes have been filed", which is a claim, not an absence of one.
+   * / RENAMED from `getRepudiations` (L2.1). Refusal reason preserved: an empty list would read as
+   * / "no disputes have been filed" — and a dispute record that can be mistaken for an absence of
+   * / disputes is worse than no record at all. Not public by design.
+   * /
+   * / ⟨CORRECTED 2026-09-29, owner ruling follow-up 16 (B)⟩ "Same visibility as listAuditEntries"
+   * / still holds, and so the first sentence no longer does: an agent reads only the record entries it
+   * / caused, and every dispute here is the owner's own `memory.repudiate` entry. So the owner and
+   * / guardians get the rows; an agent gets an empty page whose `withheld` counts the rows in its
+   * / window — which says disputes exist without showing them, never "none have been filed". WHAT
+   * / WOULD MAKE THIS WRONG: a ruling that an agent may see the disputes of its own writes; this would
+   * / then have to look up each disputed version's writer, which it does not do today.
+   */
+  listRepudiations: ActorMethod<[bigint, bigint], Result_22>;
+  /**
+   * / Owner: advance the review cursor — "I have seen everything up to and including uptoAuditId"
+   * / (null = everything at the current head). Bounded so the attestation can never cover entries
+   * / the console did not render; clamped monotonic (the cursor never moves backward) and to the
+   * / current head (never attests the future). Logged, so the review itself is part of the record.
+   * /
+   * / Deliberately filter-agnostic: the cursor is a plain audit id in the CHAINED log's one id space
+   * / (every family qualifiesForReview admits is written to auditLogger, so they share that space),
+   * / and this never inspects an operation or a role. Widening what the review shows therefore
+   * / changes only which ids the console can pass here — it cannot desynchronise the cursor.
+   */
+  markAgentWritesReviewed: ActorMethod<[[] | [bigint]], Result_8>;
+  /**
+   * / The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
+   * / key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
+   * / nomination per agent — a new one replaces the earlier one, and the record says which. Refused,
+   * / with nothing changed, for a caller that is not an active agent here and for a key that could
+   * / not hold the record (`KeyReplacement.nomineeRefusal`).
+   */
+  nominateAgentKey: ActorMethod<[Principal], Result_1>;
+  /**
+   * / An AGENT paired here asks this engram to open an engram of its own. This engram attaches 1.3 T of
+   * / its own cycles to the registry's `sysSpawnChild`; the agent's lasting key owns what is opened, and
+   * / the engram is recorded as opened through this one. Answers the new engram's canister id.
+   * /
+   * / APPROVING IS GIVING: the owner allowed this with `setChildAllowance`, and what is attached is the
+   * / agent's from the moment that engram exists. Nothing is ever taken back, and the registry never
+   * / funds that engram — its owner (the agent) tops it up.
+   * /
+   * / ORDER, with no await before the allowance is taken: the caller is an active agent; there is a
+   * / registry; payments are not frozen (opening sends this engram's cycles out of it, and a freeze is
+   * / the brake a guardian holds over resources leaving); the balance carries the attachment above this
+   * / engram's own reserve; then one opening is TAKEN from the agent's allowance in this message, and only
+   * / then is the registry called. If the registry refuses or cannot be reached, the opening is GIVEN
+   * / BACK (one added to the current count) and the cycles the call did not use come back by the
+   * / network's refund. Every outcome is written to the record under `agent.openChild` in the message
+   * / that hears the registry's answer, before the reply — in the alerts' money class.
+   * /
+   * / ⟨CORRECTED 2026-10-01, review F1 and F4 — the sentence "If the registry refuses or cannot be
+   * / reached, the opening is GIVEN BACK" above is what was first built.⟩ The opening is given back only
+   * / when the WHOLE attachment came back as the call's refund (the registry accepted none of it) and
+   * / the owner has not set this agent's count since the take (`ChildAllowance.settle`). A refusal after
+   * / the registry accepted the cycles (the template would not install, or the key came to own an
+   * / engram meanwhile) leaves the 1.3 T in a canister the agent's key controls; giving the opening back
+   * / then let an allowance of 1 drain this engram 1.3 T per call. Now that opening is spent and the
+   * / reply says so.
+   * /
+   * / WHAT WOULD MAKE THIS WRONG: an await added between `ChildAllowance.take` and the registry call; the
+   * / registry's `CHILD_MIN_ATTACHED_CYCLES` moving without `CHILD_ATTACH_CYCLES`.
+   */
+  openChildEngram: ActorMethod<[], Result_21>;
+  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_20>;
+  /**
+   * / Withdraw tokens to the owner's principal. This is the ONLY way to
+   * / move tokens out of the engram to an external address, and the
+   * / destination is always hardcoded to the owner.
+   * / NOT freeze-gated: the owner always controls their own funds.
+   * / Guardian freeze only blocks agent/public operations.
+   */
+  ownerWithdraw: ActorMethod<[TokenAmount, [] | [ActionAuth]], Result_8>;
+  /**
+   * / ⟨0.16.0⟩ `payRentFromEarnings` DELETED — ruled TWICE (B1 and B2), and it was the single
+   * / clearest violation of the OSS/platform split in this repo.
+   * /
+   * / It hand-declared four cashier methods inline, read `getFeeSchedule`, computed
+   * / `priceE6 = rentUsdE6PerEngramYear * months / 12`, and deposited `priceE6 + 3 * CKUSDC_FEE`
+   * / under a comment explaining that three is "the three token fees the cashier's rail spends" —
+   * / a PUBLIC canister hardcoding how many ledger fees a PRIVATE one consumes internally. Any
+   * / change to the cashier's rail silently mispriced this call.
+   * /
+   * / It also carried the only RE-ENTRANT cross-canister chain in the system: engram →
+   * / cashier.payRentWithStablecoin → (registry, ledger, CMC …) → back into the SAME engram's
+   * / sysRecordFeeEvent while the originating message was still suspended, both writing the same audit
+   * / ring, with no lock.
+   * /
+   * / Rent is the cashier's entirely (B2). Owners pay through the cashier's rails; the engram keeps
+   * / append-only receipts and no fee math.
+   * / ⟨0.16.0, L1 — census-ruled⟩ THE ONE-SHOT ARM. Re-redemption is `#Err(#Conflict)`, named in
+   * / the census row for this method, and it is the arm the whole guard exists to express: this
+   * / principal HAS held agent access, and no code will give it back. A caller reading
+   * / `#Conflict` knows to pair a fresh key; a caller reading `#Refused` would keep presenting the
+   * / same identity, which is exactly the loop the one-shot rule was written to stop.
+   * / Redeem an invite code minted by `createAgentInvite`. The CALLER becomes the agent, so
+   * / redeem from the wallet that will do the work.
+   * /
+   * / ⚠ IT REFUSES ANY CALLER THAT ALREADY HOLDS A RECORD — `#Active`, `#Revoked` or `#Resigned`.
+   * / The `#Revoked` case is the one that matters: revocation is a soft status change, so allowing
+   * / a revoked principal to redeem a fresh invite would be a self-un-revoke. To CHANGE an existing
+   * / agent's permissions the owner uses `setAgentPermissions`; this method is only ever the
+   * / first admission of a principal.
+   * /
+   * / A GUARDIAN cannot redeem one either. A guardian is an independent check on agents, so one
+   * / wallet must not hold both roles — use a separate wallet.
+   * /
+   * / Anonymous callers are refused, and every refusal above is recorded in the denial log.
+   * /
+   * / ⟨RESHAPED 2026-09-28, owner decision: one lasting identity per agent — one root key per agent,
+   * / with an enrolled key per client⟩ The argument is one record: the invite `code` and an
+   * / `enrolment` statement signed by the agent's ROOT key naming this engram, the calling key and
+   * / this code (`Enrolment.verify`). The root is stored on the record and is what the registry keeps
+   * / the track record under. REQUIRED, not optional: every engram launches on this code (the
+   * / building-phase rule, 2026-09-27), so there is no key without a root and no second path for one.
+   * / Two more refusals, each leaving the invite unconsumed: a statement that does not verify, and a
+   * / root that already holds an ACTIVE key here (`Enrolment.activeKeyOf` — one active key per agent
+   * / per engram). The one-shot rule and the five-active cap are unchanged and still read the KEY.
+   * / ⟨CORRECTED 2026-09-29, the cycle-drain hole measured that day⟩ "each leaving the invite
+   * / unconsumed" holds only until the invite's fifth failed statement check: every failed check
+   * / counts against the invite whoever sends it, the fifth voids it (the refusal says so, and the
+   * / record gets `agent.invite.void`), and after that every attempt with it is refused
+   * / `#Conflict` before any check is made (`InviteFailures`).
+   * /
+   * / ⟨RESHAPED 2026-09-29, review finding LIFE-3⟩ The reply is `Types.Pairing`: the agent
+   * / record AND `trackRecord`, which says plainly when the registry refused or failed to record the
+   * / engagement on the agent's track record, and what to do. Before, the reply was `#Ok` with the
+   * / record alone even when the registry had refused the start, so the agent was never told.
+   */
+  pairAgent: ActorMethod<[{ enrolment: Enrolment; code: string }], Result_19>;
+  /**
+   * / ⟨0.16.0, L2.2 — renamed from `guardianPauseWrites`⟩ Same correction as freezePayments above:
+   * / owner-or-guardian, and `resumeWrites` never carried the prefix either.
+   */
+  pauseWrites: ActorMethod<[], Result_1>;
+  /**
+   * / What condensing through `toSeq` would do, and whether it is unlocked. COMMITS NOTHING — it is
+   * / a query, so it structurally cannot; a preview that wrote would be its own trap.
+   * /
+   * / It does not ask the library, because the library's refusal cannot answer the owner's question.
+   * / `Chain.prepareCondense` reports `lastExported = null` whenever the only receipts present are
+   * / author-FILTERED, since a filtered receipt never satisfies the gate and is never recorded as a
+   * / near-miss — and an owner who exported minutes ago would read that as "you have never
+   * / exported". So `filteredReceiptsSeen` is counted separately, and `maxUnlockableToSeq` says how
+   * / far the receipts already on file reach, so a console can offer that instead of only "no".
+   * /
+   * / `maxUnlockableToSeq` is a maximum over every retained unfiltered receipt, and a NEWER receipt
+   * / may cover a SHORTER range than an older one — so the scan cannot stop at the first hit. It is
+   * / bounded by entry count instead, and `scannedFromSeq` / `scanTruncated` say where it stopped
+   * / and whether the bound was the reason. A bounded scan that hid its bound would report "no
+   * / receipts" for "I did not look far enough", which is this codebase's own defect class.
+   * /
+   * / `unlocked` is the export-receipt gate ONLY. It is not a promise the condense will land: the
+   * / history-budget delta is checked at commit time and can still refuse a short prefix.
+   */
+  previewCondense: ActorMethod<[bigint], Result_18>;
+  /**
+   * / A quote for a session this caller has not opened and is not committed to — the intent a
+   * / buyer signs against. Pure dry run, no state, no funds.
+   * /
+   * / PUBLIC: a price list nobody can read is not a price list. A buyer has to see the deposit
+   * / minimum and per-call cost BEFORE signing anything, and gating the quote behind a role would
+   * / mean the only way to learn this engram's price is to already be permitted to pay it.
+   * /
+   * / ⟨CORRECTED 2026-08-24 — this said "⟨L7⟩ UPDATE, NOT QUERY" and cited a market ruling that
+   * / DEC-107 had already closed.⟩ QUERY, per the ruled quote convention: FAST READS. Both
+   * / `quotePayment` and `previewOpenSession` become queries, and L7's open-ruling exception
+   * / retires with them — so the argument written here for keeping it an update was arguing the
+   * / losing side of a decision already made, and was added the same day by not reading forward
+   * / to the ruling. `gate.offerSession` is pure — it validates the intent and returns it — so
+   * / nothing forced the update in the first place.
+   * /
+   * / ONE-REPLICA CAVEAT, stated here because the ruling requires it at both sites: a query is one
+   * / replica's word and is NOT a settleable challenge. Nothing quoted here can be redeemed. The
+   * / commitment happens in `openSession`, which IS a certified update call, and a buyer who needs
+   * / the price attested rather than quoted takes it from that reply.
+   * /
+   * / ⟨RESTORED 2026-08-24, owner ruling R-A1⟩ Named to match the market's, because it is the
+   * / same act against a different seller and a reader comparing the two should not have to learn
+   * / two verbs for it.
+   * /
+   * / ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
+   * / `expiryNs`. Same value, same meaning; only the name carries the unit now.
+   */
+  previewOpenSession: ActorMethod<[], SessionIntent>;
+  /**
+   * / Read one memory file at its current version.
+   * /
+   * / Gated on the `read_memory` permission, so an agent holding that grant reaches it — unlike
+   * / `writeMemory`, which is owner-only.
+   * /
+   * / ⚠ `config/` AND `secrets/` ARE OWNER-ONLY whatever the grant says, and the refusal is
+   * / `#Refused` rather than `#Invalid` deliberately: the path is well-formed and the file may well
+   * / exist — the caller simply may not have it. Under L1 that distinction is the caller's to branch
+   * / on, which is the whole reason `Error` is a closed variant rather than a sentence.
+   * /
+   * / ⚠ A QUERY, so it does NOT count as a read. The IC discards query-path state changes, so a
+   * / counter here could never persist; read counting lives on the update path
+   * / (`sessionReadContext` and the MCP reads). A caller measuring engram usage from this method
+   * / will measure nothing.
+   */
+  readMemory: ActorMethod<[string], Result_11>;
+  /**
+   * / Read many paths in one call. Per-path Results are KEPT — partial success is the point, and
+   * / one unreadable path must not fail the other nine.
+   * /
+   * / ⟨0.16.0⟩ The OUTER envelope is new, and it fixes two ways this used to answer dishonestly:
+   * /
+   * /   · Over the path cap it returned `[("", #Err(#Invalid …))]` — ONE row, for a path the caller
+   * /     never asked about. A consumer looping rows saw a result for the empty path and no result
+   * /     for any real one. The call as a whole failed; dressing that as a per-path outcome is the
+   * /     fabrication ADR-0002 is about.
+   * /   · An AUTHORIZATION refusal was fanned out across every requested path, so one "no" arrived
+   * /     as N per-path noes and read like N independent permission facts about N files.
+   * /
+   * / Both are now what they are: a single `#Err` for the whole call. `#Ok` still carries a row per
+   * / path, each with its own Result — a refused RESERVED path sits beside a readable one, which is
+   * / a genuine per-path fact.
+   */
+  readMemoryBatch: ActorMethod<[Array<string>], Result_17>;
+  /**
+   * / ⟨0.16.0⟩ `getMemoryRetentionGuards` DELETED — folded into `getMemoryRetentionPolicy` above.
+   * / It was the second L2.1 array-returning `get*`, and separating it from the policy it modifies
+   * / was the defect described there. Its own docs are preserved at the fold site.
+   * / One page of a file's content — the paged read the whole-file surfaces point at.
+   * /
+   * / `version = null` reads the live file; a version reads that version as it was recorded.
+   * / The store clamps a page to one chunk, and `more` DISCLOSES the clamp: a caller that cannot
+   * / see it cannot know whether it has the whole range, which is how silent truncation gets
+   * / reintroduced. Loop while `more` is true, advancing by the bytes actually returned.
+   */
+  readMemoryBytes: ActorMethod<[string, bigint, bigint, [] | [bigint]], Result_16>;
+  /**
+   * / The escrow exit for a session whose settle cannot pay.
+   * /
+   * / PAYER-ONLY, enforced inside the gateway, and deliberately not owner-triggered: the payer's own
+   * / deposit is the only thing here, so making them wait for anyone else would be a worse rail than
+   * / the one this replaces. (The market's twin is admin-triggered because a marketplace session has
+   * / a counterparty; a memory session does not.)
+   * /
+   * / WHY IT IS NEEDED AT ALL: `closeSessionInternal` settles only when
+   * / `deposited >= consumed + fee`, and vouchers may consume up to the full deposit — so a payer
+   * / who spends their whole budget makes their own session unsettleable, with no adversary
+   * / involved. Before this, the refusal text told them to call `recoverEscrow`, which existed on no
+   * / canister they could reach. RB2 caps consumable spend so ordinary use cannot reach that state;
+   * / this is the way back for a session that already has.
+   * /
+   * / ⟨CORRECTION 2026-09-30, beside the paragraph above and the first line⟩ No longer true. ic402
+   * / 2.17.0's `closeSessionInternal` settles `min(consumed, deposited − fee)` and skips a refund of
+   * / zero, so a session spent to its whole budget still closes, and under the one-fee reserve a clean
+   * / close leaves the escrow holding nothing or less than one fee, which no transfer can move. The
+   * / way back is for a REFUND LEG THAT FAILED (a transient ledger error): the settle went through,
+   * / ic402 marks the session closed, and the remainder stays in escrow until the payer calls this.
+   * / A failed settle is not this method's case: ic402 puts that session back to open, where this
+   * / method refuses, and the close is retried instead. WHAT WOULD MAKE THIS WRONG: an ic402 whose
+   * / close stops capping the settle, or a live ckUSDC fee above `Env.CKUSDC_FEE`.
+   * /
+   * / ckUSDC only — an engram session's intent names `Env.CKUSDC_LEDGER` and nothing else, so there
+   * / is no token to choose and no wrong one to pass.
+   * /
+   * / ⟨2026-10-02, decided — the twin divergence is deliberate⟩ The market's `recoverEscrow` takes
+   * / `Wire.TokenAmount`; this one takes a bare `nat`, and the two stay different on purpose. The
+   * / market escrows more than one token, so the amount has to say which; this engram's sessions
+   * / escrow ckUSDC only, and a `TokenAmount` here would make an `#Icp` amount representable and then
+   * / refuse it at runtime — the argument `convertEarningsToCycles` makes. What changed is the NAME:
+   * / `amountE6`, ckUSDC base units. Candid passes arguments by position, so nothing on the wire moved.
+   * /
+   * / ⚠ `#Conflict` HERE ALSO COVERS "NOT THE SESSION'S PAYER". ⟨2026-10-02, audited at this site⟩
+   * / The payer check is ic402's (`recoverEscrow` authorizes `caller == session.payer`), and the
+   * / library answers every refusal down one text channel, so "Not authorized: only session payer can
+   * / recover escrow" arrives as `#Conflict`, beside the state refusals (an open session, nothing to
+   * / recover, no such session). Read the MESSAGE, not the arm. This is the 0.16.0 contract as
+   * / ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut dependency
+   * / work. (The payments-frozen refusal in the body is this engram's own, and is state.)
+   * /
+   * / ⟨2026-10-05, ic402 2.17.3 — beside the list above⟩ A fourth state refusal: a session that reads
+   * / `closing` or `expired`, whose close has not finished. Escrow comes back only from a session that
+   * / reads `closed`, and the refusal moves nothing. A close that stopped part-way (its refund call
+   * / rejected, or a trap) leaves the session reading `closing`, and no method on this engram moves it.
+   */
+  recoverEscrow: ActorMethod<[string, bigint], Result_8>;
+  /**
+   * / ⟨0.16.0, L1⟩ A REDEMPTION PATH, where the arm choice is a disclosure decision.
+   * /
+   * / Four of these refusals are about the CODE and one is about the caller. The code arms restate
+   * / exactly what the text already said — an unknown code is `#NotFound`, a used or expired one is
+   * / `#Conflict` — so no fact is newly disclosed by the arms; the anti-enumeration control here is
+   * / the attempt throttle above, not vagueness in the reply. Throttling is itself `#Conflict` (at
+   * / capacity) rather than `#Unavailable`: nothing failed, and the caller's own recent behaviour is
+   * / what closed the door, so "try again" is true only after the stated wait.
+   * /
+   * / ⟨2026-10-02⟩ Answers the `GuardianRecord` it created — `#Pending` until the owner approves —
+   * / rather than `()`. The new guardian learns, in the same reply, the name and permissions the
+   * / owner's invite gave them and that they cannot act until approved; before, that took a second
+   * / read they had no reason to know to make.
+   */
+  registerGuardian: ActorMethod<[string], Result_15>;
+  /**
+   * / Remove a per-caller override so that caller reverts to — and keeps TRACKING — the global caps.
+   * /
+   * / It travels with its pair and is never dropped alone: without it the only way "back" from an
+   * / override is to overwrite it with a frozen copy of the global policy, which then stops
+   * / following later changes. That makes every override permanent in effect.
+   */
+  removeCallerSpendPolicy: ActorMethod<[Principal], Result_1>;
+  /**
+   * / De-register a type that has NEVER SIGNED. Exists because of a hazard the first external
+   * / validation found within hours (consumer report, 2026-08-06): a bare-name #standard registration —
+   * / cheap, no watcher preconditions — permanently blocked the guarded namespaced registration
+   * / via the collision rule, with no way out. An owner typo could brick a venue integration for
+   * / the engram's lifetime. Never-signed is the whole gate: a type that signed even once is part
+   * / of what the audit chain's eip712.sign entries mean, and stays resolvable forever — this
+   * / removes only authority that was never exercised, which is removing nothing but the mistake.
+   * / NOT freeze-gated, same reasoning as removeEvmWithdrawDestination: this is TIGHTENING, and a
+   * / frozen engram must still be able to shrink what it could sign.
+   */
+  removeEip712Type: ActorMethod<[Uint8Array | number[]], Result_1>;
+  removeEvmWithdrawDestination: ActorMethod<[string], Result_1>;
+  /**
+   * / Owner-only: remove a guardian from the roster.
+   * /
+   * / Unlike revoking an agent this is NOT terminal for the principal — the guardian roster does
+   * / not carry the one-shot rule that blocks a revoked agent from ever pairing again, so the
+   * / same wallet can be invited again.
+   * /
+   * / `#NotFound` rather than `#Refused` when there is no such guardian: only the owner reaches this
+   * / line, so the roster is theirs and its contents are not a secret being withheld from them.
+   */
+  removeGuardian: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Owner disavows a specific memory write, in the open. Marks — never deletes: the content and
+   * / the original audit entry stay exactly where they were; this appends a chained
+   * / `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
+   */
+  repudiateMemoryWrite: ActorMethod<[string, bigint, string], Result_8>;
+  /**
+   * / ⚠ OWNER-ONLY BULK RESET. Destructive, and wider than its name suggests.
+   * /
+   * / It severs EVERY grant surface that can outlive a role — agents, guardians, invites and
+   * / connector tokens — clears memory, and returns the operational flags (encryption, writes-paused,
+   * / payments-frozen) to a fresh baseline. Anyone holding access through any of those loses it.
+   * /
+   * / What SURVIVES, deliberately:
+   * /   · the cumulative counters, which never reset — an engram cannot make itself look new;
+   * /   · memory DELETES are soft, so version history is retained and paths stay enumerable via
+   * /     `listDeletedMemoryFiles`;
+   * /   · `agentPurgeLog`, which is the durable record of who was severed;
+   * /   · ⟨2026-09-29⟩ today's spending totals — each caller's and the engram-wide one — and the
+   * /     owner's engram-wide ceiling. A reset severs access; it never gives back a day's allowance
+   * /     already spent, so a key re-admitted after a reset keeps what it spent today (the totals are
+   * /     kept per calling key).
+   * /   · ⟨2026-10-02⟩ the seat weeks of every engagement (`agentSeatWeeks`), with the signature count
+   * /     they sit beside, and the owner's switch over the metrics reader's read and the reader it
+   * /     names — a reset severs access, it does not change who may read what was kept.
+   * /
+   * / ⟨2026-10-02⟩ It tells the spawning registry that it happened (`sysNoteReset`), on every reset.
+   * /
+   * / It is recorded as ONE chained `engram.reset` entry that also names the flag transitions.
+   * /
+   * / ⚠ AND THE LIMIT OF THAT RECORD, because a caller relying on it should know: the audit chain is
+   * / NOT unbounded. It caps at MAX_ENTRIES and trims its oldest tenth on overflow, so on any engram
+   * / long-lived enough for the rent model to apply, the reset entry is not guaranteed to still be
+   * / there. `agentPurgeLog` is the evidence that does not age out — which is why it exists.
+   */
+  resetEngram: ActorMethod<[], Result_14>;
+  /**
+   * / ⟨2026-09-28, owner decision: an agent can resign from an engram, and the resignation is
+   * / recorded⟩ The AGENT ends its own engagement with this engram.
+   * /
+   * / WHY IT EXISTS: before this, every ending was something done TO an agent — revoked by the
+   * / owner, by a guardian, by the kill switch, or by a reset — so an agent that wanted to leave
+   * / cleanly had to wait to be fired, and its track record across engrams could not tell a clean exit
+   * / from a firing. This is the one ending the agent itself chooses, and the registry records it
+   * / under its own reason (`#Resigned`), never folded into a revocation.
+   * /
+   * / TERMINAL for this principal on this engram, exactly like a revocation: the record stays (status
+   * / `#Resigned`, auditable), and `pairAgent` refuses any principal that already holds a
+   * / record, so returning means a different principal and a fresh invite from the owner.
+   * /
+   * / SELF-SERVICE, so the refusals are about the record's state, not the caller's standing:
+   * / `#NotFound` for a caller that is not an agent here, `#Conflict` for one already ended.
+   * / The roster change and its chained audit line commit BEFORE the registry is told, so a registry
+   * / that is down cannot leave the agent half-resigned; a missed notice is logged by
+   * / `notifyRegistryAgentEdge`. WHAT WOULD MAKE THIS WRONG: a second path that sets `#Resigned`.
+   */
+  resignAgent: ActorMethod<[], Result_1>;
+  /**
+   * / OWNER-ONLY release of the write pause, with the same one-way shape as `unfreezePayments`: a
+   * / guardian holding `canPauseWrites` can stop writes without the owner and cannot restart them,
+   * / and the owner can always restart them. A tripwire rather than a lock.
+   */
+  resumeWrites: ActorMethod<[], Result_1>;
+  /**
+   * / Self-heal: re-send every ACTIVE agent's start to the spawning registry (idempotent — the
+   * / registry mints no duplicate for an open engagement), for when a notice was missed. Owner-only.
+   * / Returns how many the registry ACKNOWLEDGED. ⟨2026-09-28: it used to count sends that did not
+   * / throw, against a method that could not say no; it now counts `#Ok` answers.⟩ It re-sends
+   * / starts only: an ending carries a reason this roster does not keep per principal.
+   * /
+   * / ⟨CORRECTED 2026-09-29, review finding LIFE-2 — owner's option A⟩ It now re-sends ENDINGS as
+   * / well as starts, endings first (`AgentEdges.resyncPlan` says why): every ended record on the
+   * / roster and every agent a reset removed keeps its ending's reason and day
+   * / (`Types.AgentEnding`), so an ending the registry never received — the one loss that used to
+   * / show an engram's engagement as live on the agent's record forever and block the agent's later starts here —
+   * / is recorded by one call of this. The registry answers an ending it already holds `#Ok`.
+   * / RESHAPED REPLY: `Types.ResyncReport` in place of a bare count — the endings and starts the
+   * / registry acknowledged, and every notice it did not, with its own words, so the owner can tell
+   * / an expected answer (an ending for a start that was never recorded says so) from a real one.
+   * / The calls leave in batches of `RESYNC_BATCH`, each batch in order and wholly answered before the
+   * / next leaves, so the order above holds at the registry.
+   * / ⟨2026-09-29⟩ WHAT A RESYNC CANNOT DO: record an engagement whose start the registry never
+   * / recorded and which has since ENDED. A start is re-sent only for an agent still active here, so
+   * / all that is left to send is the ending, and the registry has nothing to end. The report lists
+   * / each such engagement under `cannotBeRecorded` (key, root, invite, and how and when it ended),
+   * / apart from `notRecorded`, so the owner sees them rather than silence.
+   */
+  resyncAgentEdges: ActorMethod<[], Result_13>;
+  /**
+   * / Return to managed custody: the engram adds the registry back as a controller ALONGSIDE the
+   * / owner — it does not remove the owner. The inverse of `claimSovereignty`, and the reason
+   * / sovereignty is not a one-way door.
+   */
+  returnToManaged: ActorMethod<[], Result_1>;
+  /**
+   * / Replace the whole content of an EXISTING file.
+   * /
+   * / This is the one thing agents could never do before: every agent write was an append,
+   * / so a file could only ever grow. The ruling that opened it is narrow, and every part of the
+   * / narrowness is enforced below — an agent may replace content only on a path the owner has
+   * / granted, only where retention is not #vault, and only where the file already exists. Vault
+   * / paths stay append-only forever, which is the claim the product makes about them.
+   * /
+   * / Replacing is safe here in a way it was not in the legacy store: the prior version is not
+   * / overwritten, it is superseded. It stays readable, its hash stays committed, and the agent
+   * / floor keeps its bytes for the window a counterparty needs to extract them.
+   * / ⟨0.16.0, L1⟩ FIVE AGENT REFUSALS, ALL `#Refused`, AND THE UNIFORMITY IS THE FINDING.
+   * /
+   * / Reserved path, protected path, missing permission, ungranted revise path, `#vault` class — a
+   * / caller could previously tell these apart only by reading five different sentences, and every
+   * / one of them ends the same way: this agent may not make this write, and no retry by this
+   * / agent changes that. The prose already said "Not operator-retryable" four times over,
+   * / because a text field was the only place to put it. It is an arm now.
+   * /
+   * / The one that could tempt a different arm is `#vault`, which looks like a state fact. It is
+   * / not: the class is an AUTHORIZATION statement about who may replace content there, and it
+   * / resolves to the same "you may not", forever, for everyone but the owner.
+   */
+  reviseMemory: ActorMethod<[string, Uint8Array | number[]], Result>;
+  /**
+   * / Owner-only: revoke one agent.
+   * /
+   * / ⚠ SOFT AND TERMINAL, which sounds contradictory and is not. The record is not deleted — the
+   * / status becomes `#Revoked` and the row survives, which is what makes the revocation auditable.
+   * / And because `pairAgent` refuses any principal that already holds a record of ANY
+   * / status, this is permanent FOR THAT PRINCIPAL: they cannot be re-invited. Re-admitting the same
+   * / human means a different wallet.
+   * /
+   * / To narrow what an agent may do rather than end its access, use `setAgentPermissions`.
+   */
+  revokeAgent: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Owner-only panic button: revoke EVERY active agent at once. Returns how many were revoked.
+   * /
+   * / ⚠ IT REVOKES ONLY AGENTS. Invites and connector bearer tokens are separate surfaces with
+   * / their own buttons (`revokeAllInvites`, `revokeAllBearerTokens`), and an owner reaching for one
+   * / of these in an emergency almost certainly wants all three. Nothing here cascades.
+   * /
+   * / ⚠ AND IT IS IRREVERSIBLE PER PRINCIPAL, which a "revoke all" reads as temporary and is not.
+   * / Each agent's record is set to `#Revoked` rather than deleted, and `pairAgent`
+   * / refuses any principal holding a record of ANY status — so every wallet this touches can never
+   * / be an agent on this engram again. Re-admitting the same agents means new keys. Only
+   * / `resetEngram` clears the records, and it severs everything else with them.
+   * /
+   * / The revocation is committed BEFORE the registry is told: state is cleared, the audit line is
+   * / written, and only then does it await one notification per revoked agent. So a notification
+   * / that fails leaves the agents revoked here regardless — a partial notify is not a partial
+   * / revocation, which is the direction that matters for a panic button.
+   */
+  revokeAllAgents: ActorMethod<[], Result_8>;
+  /**
+   * / Owner-only panic button: revoke every connector bearer token at once. Returns how many.
+   * /
+   * / The THIRD independent surface — hosted connectors authenticate with bearer tokens, not with
+   * / agent records or invites, so neither of the buttons above touches them. An owner cutting
+   * / off access completely needs all three, and this is the one that reaches an AI host already
+   * / holding a live session.
+   * /
+   * / Tokens are re-issuable: revoking them is not permanent the way revoking an agent is.
+   */
+  revokeAllBearerTokens: ActorMethod<[], Result_8>;
+  /**
+   * / ⟨0.16.0⟩ `removeAllGuardians` DELETED — test-only (L6), and verified NOT part of KILL-SWITCH's
+   * / mass-revoke set. The destructive phase-07 suite iterates `removeGuardian` instead, so nothing
+   * / loses a capability: what dies is a bulk spelling no runbook ever invoked.
+   * / Owner-only panic button: void every unredeemed invite. Returns how many were voided.
+   * /
+   * / Separate from `revokeAllAgents`: this stops invites that have NOT been redeemed yet and
+   * / touches no existing agent. An invite already redeemed is an agent, and only the other
+   * / button reaches it.
+   * /
+   * / Unlike revoking an agent, this costs nothing permanently — an invite is a one-time code,
+   * / so voiding it and minting a fresh one is the ordinary path.
+   */
+  revokeAllInvites: ActorMethod<[], Result_8>;
+  /**
+   * / Revoke a bearer token by its public tokenId. Idempotent.
+   * / Subsequent /mcp requests using this token will be rejected.
+   */
+  revokeBearerToken: ActorMethod<[string], Result_1>;
+  /**
+   * / ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>` — same reason as the delete
+   * / above, and sharper here: a rollback WRITES A NEW VERSION, so the caller's next question is
+   * / always "which version am I on now". `r.version` was already read for the audit line.
+   */
+  rollbackMemory: ActorMethod<[string, bigint], Result>;
+  /**
+   * / SELF-SERVICE, and that is the surprising part: the AGENT calls this, not the owner. An
+   * / agent rotates its own CallerKey binding without needing the owner to act.
+   * /
+   * / ⚠ IT ROTATES THE KEY, NOT THE PRINCIPAL. Only `publicKeyHash` changes; the agent record
+   * / stays keyed on the same principal, keeps its permissions, and keeps its place against the
+   * / one-shot registration rule. So this is the answer to "my key is compromised", and it is NOT a
+   * / way to move an agent seat to a different wallet — that is a new invite, and only if the
+   * / old principal was never revoked.
+   * / ⟨CORRECTED 2026-09-29, the owner's ruling of that date (follow-up 10, option A)⟩ Two sentences
+   * / above are no longer true. An agent's record CAN now move to a different key, in one step and
+   * / with no new invite: `nominateAgentKey` from the current key, then `acceptAgentKeyNomination`
+   * / from the new one. And a compromised key is answered by that move — this method only changes a
+   * / recorded hash, and the compromised principal keeps calling as the agent. This method still
+   * / does what it says; the move is the one that changes which key the engram answers.
+   * /
+   * / `#Conflict` rather than `#Refused` for a `#Revoked` or `#Resigned` record: the caller IS the
+   * / agent on that record, so its standing is not the problem — the record's state is. An
+   * / agent reading `#Refused` would go looking for a permission that was never missing.
+   */
+  rotateAgentKeyHash: ActorMethod<[string], Result_1>;
+  /**
+   * / One-time onboarding seed: writes a starter file so the first read-back is non-empty.
+   * /
+   * / Owner-only, and it REFUSES once any memory exists — so it can only ever add the initial
+   * / placeholder and can never overwrite real content. Deliberately NOT counted as a write (no
+   * / `totalMemoryWrites`, no `firstWriteAt`): it is a system seed rather than activity, and
+   * / counting it would corrupt both the write metrics and time-to-first-write for every engram.
+   */
+  seedMemory: ActorMethod<[string, Uint8Array | number[]], Result>;
+  /**
+   * / Append to a memory file against a PAID x402 session voucher — the write half of the paid rail,
+   * / authorized by the voucher rather than by a role.
+   * / ⟨2026-09-30, ic402 2.17.0⟩ Authorized by the payer's own call with the voucher: only the
+   * / principal that opened the session, calling as that key, can spend it (see `sessionReadMemory`).
+   * / ⟨CORRECTED 2026-09-30, the owner's answer "2 fresh key"⟩ Authorized by the session KEY's own
+   * / call: the fresh key the payer named at open. The write is attributed to the payer, who paid;
+   * / the record row also names the key that made it.
+   * /
+   * / ⚠ AS WITH `sessionReadMemory`, EVERY REFUSAL FIRES BEFORE THE VOUCHER IS CONSUMED — nothing is
+   * / written and no funds move. It refuses when payments are frozen, when writes are PAUSED, and
+   * / when the engram is client-side encrypted: a paid session appending plaintext to an encrypted
+   * / store would CORRUPT it, so that refusal is protecting the owner's data rather than gating
+   * / access. Append through the EngramX client/SDK instead.
+   * / ⟨API-101/DEC-101, 2026-08-24 — v3 phase X3⟩ RETURNS THE SAME RECEIPT THE FREE WRITER DOES.
+   * / It answered `Wire.Result<Nat>`: the version, and nothing else. The free `writeMemory` returns
+   * / `{ version; seq; head }`, so a PAYING writer got strictly LESS evidence than a caller who paid
+   * / nothing — on the one rail a stranger can buy, where the receipt is the whole product. The head
+   * / is what makes an append verifiable by someone who was not there; a bare version number is not
+   * / checkable against anything.
+   * /
+   * / It cost nothing to fix: `r` was already in scope and already being read — the old body did
+   * / `let v = r.version` and passed `r` to `receiptSuffix(r)` for the audit line, then discarded
+   * / everything but the version on the way out. Free until the cut, breaking forever after, which
+   * / is why it lands now rather than after the test migration (ruling R-A2).
+   */
+  sessionAppendMemory: ActorMethod<[Voucher, string, Uint8Array | number[]], Result>;
+  /**
+   * / The whole engram in one call — newest-first, byte-capped — for an AI host to inject at session
+   * / start. The "read me back" that continuity is built on. `clientLabel` names the reading host
+   * / (e.g. "openclaw", "claude.ai") for the distinct-reader set.
+   * /
+   * / ⚠ AN UPDATE, NOT A QUERY, AND ON PURPOSE (L7). `readMemory`/`readMemoryBatch` are queries and
+   * / therefore CANNOT persist a read count; this runs on the update path and bumps the reuse
+   * / counters, so a builder whose SDK calls `startSession()` registers a weekly-reused engram as a
+   * / byproduct of normal use rather than through an elective, separate read. Callers should expect
+   * / update latency and consensus cost here, and get a recorded read in exchange.
+   * /
+   * / ⚠ IT DOES NOT RETURN EVERYTHING, and the omission is deliberate: `config/` and `secrets/` are
+   * / SKIPPED. Those are operational, not agent memory, and must never be blindly spilled into a
+   * / model's context window — so a caller must not treat this as a complete listing of the engram.
+   * /
+   * / ⚠ RAW STORED BYTES, like `readMemoryBatch`. On a Private (encrypted) engram the content is
+   * / CIPHERTEXT; the key-holding SDK decrypts it. A caller without the key gets bytes it cannot
+   * / read, not an error.
+   */
+  sessionReadContext: ActorMethod<[string], Result_12>;
+  /**
+   * / Read one memory file against a PAID x402 session voucher. No role, no invite — the voucher is
+   * / the authorization, which is what makes this the engram's one rail a stranger can pay to use.
+   * /
+   * / ⟨2026-09-30, ic402 2.17.0⟩ WHO MAY SPEND A SESSION: only its payer, calling as the same raw
+   * / Ed25519 key that opened it. The voucher still carries the amount and the sequence; the
+   * / authorization is now the call itself, and the canister no longer checks a voucher signature.
+   * / A stranger can still pay to use this rail — by opening a session of their own.
+   * / ⟨CORRECTED 2026-09-30, the owner's answer "2 fresh key"⟩ Not the payer: the session's own key
+   * / — the fresh Ed25519 key the payer named at open — calling as itself. The payer, who opened
+   * / the session and closes it, is refused here like anyone else who is not that key.
+   * / ⟨CORRECTED 2026-09-30, review⟩ …unless the payer named their own identity key at open, which
+   * / nothing refuses: then the payer IS that key and spends.
+   * /
+   * / ⚠ EVERY REFUSAL BELOW HAPPENS BEFORE THE VOUCHER IS CONSUMED, so **no funds move on any of
+   * / them**. That is the property a payer most needs and the one a signature cannot express: a
+   * / refusal here costs nothing, and retrying after the owner changes something costs nothing extra.
+   * /
+   * / It refuses when:
+   * /   · **Paid reads are not enabled — and they are OFF BY DEFAULT.** Selling the owner's memory to
+   * /     any voucher-bearer is a deliberate choice, not a default posture, so on a fresh engram this
+   * /     is the refusal you will get. `getEngramCard`'s `x402Support` reports this same flag, so a
+   * /     buyer can check before paying rather than discover it here.
+   * /   · **The engram is Private (client-side encrypted).** A paid session holds no key and the
+   * /     canister never decrypts, so it could only return ciphertext. Read through the EngramX
+   * /     client/SDK instead — this is not a permission problem and no setting fixes it.
+   * /   · **The path is `config/` or `secrets/`.** Owner-only on every other surface, and a paid
+   * /     session must not be the side door: without this guard a stranger holding a fraction-of-a-
+   * /     cent voucher could read `secrets/*`.
+   * /   · Payments are frozen on this engram.
+   */
+  sessionReadMemory: ActorMethod<[Voucher, string], Result_11>;
+  /**
+   * / Configure action alerts: an https webhook that receives new chained-audit entries matching the
+   * / enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
+   * / POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
+   * / details) — never memory file contents. Setting a URL (re)arms delivery FROM NOW: the cursor
+   * / jumps to the current end of the log so history is not replayed. Passing url = null disables.
+   * / The URL itself is never written to the audit log (webhook URLs often embed secret tokens).
+   */
+  setActionAlertConfig: ActorMethod<[AlertConfig], Result_1>;
+  /**
+   * / Owner-only: replace an existing agent's permission set. The way to NARROW what an agent
+   * / may do without ending their access — `revokeAgent` is terminal for that principal, this is
+   * / not.
+   * /
+   * / ⚠ ONE GRANT IS REFUSED OUTRIGHT: memory-read to the EngramX PLATFORM principal while this
+   * / engram is Private (encrypted), because that principal could then derive the decryption key and
+   * / Private mode would be a claim rather than a property. It is the mirror of the guard on
+   * / `setEncryptionEnabled`, which refuses to ENABLE Private while that grant already exists —
+   * / between them the invariant holds whichever order an owner works in.
+   * /
+   * / That refusal is `#Refused` ABOUT THE SUBJECT, not about the caller: the owner is authorized
+   * / and the grantee is not eligible. It is standing rather than a conflict to resolve, so the way
+   * / forward is to grant read to your own agents instead, or to switch to Connected mode first —
+   * / both of which the message says.
+   */
+  setAgentPermissions: ActorMethod<[Principal, AgentPermissions], Result_1>;
+  /**
+   * / Paths an agent holding a grant may REVISE rather than only append to.
+   * /
+   * / Matching is EXACT, except that an entry ending in "/" grants everything beneath it. A grant
+   * / is a power, so the default reading is the narrow one; the directory form exists because the
+   * / real use case is rotating dated files under a prefix, and per-file grants would be unusable
+   * / for that. What a bare prefix would do — "MEMORY.md" also matching "MEMORY.md.bak" — is the
+   * / kind of accident a permission surface must not have.
+   */
+  setAgentRevisablePaths: ActorMethod<[Array<string>], Result_1>;
+  /**
+   * / ⟨0.16.0 — census row⟩ Returns the APPLIED config, which is how this closes the
+   * / setter-without-a-getter gap without adding a method: the write is the read.
+   * /
+   * / `prunedBackups` is the part that matters. Enforcing a retention cap DELETES finalized backups
+   * / beyond it, and this method used to answer `#Ok(())` over that — the module's own comment
+   * / called it an "ops floor: retention enforcement deletes owner backup data silently", mitigated
+   * / by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
+   * / they are told how many, in the reply and in the audit line.
+   */
+  setBackupRetention: ActorMethod<[string, bigint], Result_10>;
+  /**
+   * / Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
+   */
+  setCallerSpendPolicy: ActorMethod<[Principal, SpendingPolicy], Result_1>;
+  /**
+   * / Owner-only: set how many engrams `agentPrincipal`'s agent may open of its own through this
+   * / engram. Kept by the agent's lasting key, so it carries over a key replacement. Any count is
+   * / accepted; the registry lets a lasting key open one engram through a parent, ever, so 1 or more
+   * / behaves as 1. 0 withdraws it.
+   * /
+   * / APPROVING IS GIVING: what this engram attaches to open an engram (1.3 T cycles) is the agent's
+   * / from the moment that engram exists — the agent's lasting key owns it, and nothing is ever taken
+   * / back. The change is written to the record under `agent.childAllowance.set`, which is in the
+   * / alerts' money class (`ActionAlerts.classify`), so an owner or guardian with an alert channel
+   * / hears of it.
+   */
+  setChildAllowance: ActorMethod<[Principal, bigint], Result_1>;
+  /**
+   * / ⟨0.16.0⟩ `getEncryptedMemoryKeyForEpoch` DELETED — folded into `getEncryptedMemoryKey`'s epoch
+   * / argument — see that method for the fold and the `null`-means-CURRENT rule.
+   * / Owner-only: turn client-side memory encryption (Private mode) on or off for FUTURE writes.
+   * /
+   * / ⚠ IT DOES NOT TOUCH EXISTING FILES, and this is the fact that decides whether calling it alone
+   * / is safe. Verified at the site 2026-08-21: the body sets the flag and writes an audit line —
+   * / there is no migration pass. So
+   * /   · turning it ON leaves everything already stored as PLAINTEXT at rest, and
+   * /   · turning it OFF leaves everything already stored as CIPHERTEXT, which the hosted connector
+   * /     cannot read.
+   * / Either direction leaves a MIXED store that the flag alone misdescribes. The owner console
+   * / pairs this call with a migration (`useMemoryEncryption`'s `migrate` / `migrateToPlaintext`)
+   * / for exactly that reason; a caller reaching this method directly gets the flag and nothing else.
+   * /
+   * / ⚠ ENABLING IS REFUSED while the EngramX platform principal holds memory-read access as an
+   * / agent — it could derive the decryption key, which would make Private mode a claim rather
+   * / than a property. Revoke that agent's read access first. The refusal says so, and it is a
+   * / `#Conflict` rather than a `#Refused` because the caller IS the owner and the problem is the
+   * / engram's state, not their standing.
+   * /
+   * / Private mode also closes the paid read rail by construction: a paid session holds no key, so
+   * / `sessionReadMemory` refuses on an encrypted engram whatever `setPaidMemoryReadEnabled` says.
+   */
+  setEncryptionEnabled: ActorMethod<[boolean], Result_1>;
+  /**
+   * / Register the owner's EVM address for withdrawals.
+   * /
+   * / First set: immediate — no guardian needed.
+   * / Change: only allowed if an active guardian exists (proving the owner
+   * / has a safety net). Without a guardian, the address is locked after
+   * / first set — this prevents a compromised II from silently redirecting
+   * / EVM withdrawals when no one is watching.
+   * /
+   * / The guardian doesn't approve the change — the owner is sovereign.
+   * / The guardian's existence is the gate, not their active consent.
+   */
+  setEvmOwnerAddress: ActorMethod<[string], Result_1>;
+  /**
+   * / A guardian arms their OWN webhook over the guarded engram's audit stream (same event
+   * / classes and payload as the owner channel — audit metadata, never memory file contents;
+   * / the guardian honesty rail: integrity, not content). Active guardians only. Arming starts
+   * / from NOW (no history replay); url = null disarms and frees the slot.
+   */
+  setGuardianAlertConfig: ActorMethod<[AlertConfig], Result_1>;
+  /**
+   * / Per-prefix retention policy. Longest prefix wins; anything unmatched keeps everything.
+   * /
+   * / A CHANGE does not take effect immediately, in EITHER direction: every prefix whose EFFECTIVE
+   * / class moves is guarded for the same window as the agent floor, so history cannot be
+   * / thinned in the same sweep as the decision to thin it. Loosening waits too — distinguishing
+   * / "tightened" from "loosened" precisely would mean comparing two cap lattices, so armGuards
+   * / (RetentionPolicy.mo) guards any change it sees. That is the conservative reading, and its
+   * / only cost is a delay on keeping MORE, which destroys nothing.
+   */
+  setMemoryRetentionPolicy: ActorMethod<[Array<[string, RetentionClassSpec]>], Result_1>;
+  /**
+   * / Owner-only: open or close the monetized read rail. When disabled (the default), sessionReadMemory
+   * / fails closed for every voucher-bearer — selling the owner's memory is opt-in, not the default.
+   * /
+   * / ⚠ ENABLING IT IS NOT SUFFICIENT. On a Private (encrypted) engram `sessionReadMemory` still
+   * / refuses, because a paid session holds no key and the canister never decrypts — see
+   * / `setEncryptionEnabled`. An owner who turns this on and still sees refusals should check that
+   * / flag before looking anywhere else.
+   * /
+   * / `getEngramCard`'s `x402Support` reports THIS flag, so a buyer can read the rail's state before
+   * / paying rather than discovering it in a refusal.
+   */
+  setPaidMemoryReadEnabled: ActorMethod<[boolean], Result_1>;
+  /**
+   * / Open or close the paid-memory WRITE rail (RB4). Owner-only, like its read twin.
+   * /
+   * / Kept as a SEPARATE flag rather than widening `setPaidMemoryReadEnabled` into one switch: an
+   * / owner selling read access has not thereby agreed to sell write access, and a single flag makes
+   * / the larger permission ride in on the smaller one. Two flags is the shape that lets an owner
+   * / say yes to one and no to the other, which is the common case.
+   */
+  setPaidMemoryWriteEnabled: ActorMethod<[boolean], Result_1>;
+  /**
+   * / ⟨0.16.0, L1⟩ Every validation refusal here is `#Invalid` and the cap is `#Conflict`, and the
+   * / split is worth stating once for the whole whole-value-config family below: a malformed path is
+   * / the CALLER'S to fix and retrying with a corrected list works, while "max 20" is a property of
+   * / this engram that no argument gets around. A caller that cannot tell those apart either edits
+   * / forever or gives up on a request that was one character from valid.
+   */
+  setProtectedPaths: ActorMethod<[Array<string>], Result_1>;
+  /**
+   * / OWNER-ONLY: switch the metrics reader's read of the seat weeks off (`false`) or back on (`true`).
+   * / On from birth, by the owner's ruling of 2026-10-02. Off, `sysGetAgentSeatWeeks` refuses the
+   * / reader by name, naming this switch; the rows are still kept and the owner still reads them. Each
+   * / call is a chained record entry (`metrics.setSeatWeeksReadEnabled`, the new and the old value), so
+   * / when the read was on or off is part of the record. Anyone else is refused by name.
+   */
+  setSeatWeeksReadEnabled: ActorMethod<[boolean], Result_1>;
+  /**
+   * / Set the most this engram may spend per day ACROSS EVERY CALLER — five agents, the owner and the
+   * / marketplace together. `null` removes the ceiling. ⟨2026-09-28⟩
+   * / ⟨CORRECTED 2026-09-29, review finding X-8: "spend" was too wide. The ceiling covers the x402
+   * / payments this engram signs (`signX402Payment` and the marketplace's `sysSignX402Payment`) and
+   * / nothing else: it is the most this engram may sign in x402 payments per day. Two other signing
+   * / paths are NOT counted against it — typed-data signatures (`signEip712` / `sysSignEip712`),
+   * / bounded instead by each registered type's daily count and destination list; and agent-
+   * / registration transactions (`signEngramRegistration`), bounded by three per caller per day and
+   * / the 500-gwei gas ceiling. Whether the ceiling should cover them is a separate owner question.⟩
+   * /
+   * / WHY: the owner decided on 2026-09-28 to add one daily spending ceiling across all callers on an
+   * / engram and keep the limit of five agents. Every other spending limit is per caller, so without
+   * / this the engram's daily exposure was the SUM of up to seven allowances ($35.00 at the defaults)
+   * / and nobody could see it. The amount is in the same minor units the per-caller caps compare
+   * / (USDC's six decimals: 5_000_000 = $5.00), and like them it does not distinguish tokens.
+   * /
+   * / A payment that would take today's engram-wide total past this number is not signed: the caller
+   * / gives a reason and it becomes a row in the approval queue, exactly as over a per-caller cap.
+   * / `0` is allowed and means every payment needs the owner's approval.
+   * / ⟨CORRECTED 2026-09-29, review finding X-2: not every payment — a payment of amount 0 crosses no
+   * / limit, so it is signed under a ceiling of 0 too. Whether amount-0 payments should be refused is
+   * / an open owner question.⟩ ⟨CORRECTED 2026-09-29, later — the owner ruled (follow-up 15, option A):
+   * / a payment of amount 0 is now refused by name before any limit is read (`X402Input.refusal`), so
+   * / under a ceiling of 0 every payment that can be signed at all does need the owner's approval.
+   * / And a new engram no longer starts with no ceiling: it starts at `SpendCeiling.DEFAULT_ENGRAM_DAY`
+   * / ($10.00 a day; follow-up 9, option A).⟩ Takes effect on the next
+   * / payment, counted against what was ALREADY spent today (the total is kept whether or not a
+   * / ceiling is set), so setting a ceiling at noon does not grant a fresh day.
+   * /
+   * / Unlike `setSpendPolicy`, this does NOT auto-approve pending requests it now covers — a request
+   * / held by the ceiling waits for `approveRequest`, or the caller retries against the new ceiling.
+   * / The auto-approval exists for per-caller raises and is kept away from the ceiling on purpose
+   * / (see `resolvePendingOnPolicyRaise`).
+   * /
+   * / The record entry `spend.setCeiling` carries the new AND the previous value, so a widening is
+   * / distinguishable from a tightening afterwards — the reason `spend.setPolicy` records its limits.
+   * / Not blocked by a payments freeze, like `setSpendPolicy`: setting a limit moves no money.
+   */
+  setSpendCeiling: ActorMethod<[[] | [bigint]], Result_1>;
+  /**
+   * / Set this engram's spending caps.
+   * /
+   * / The audit row records the LIMITS, not merely that a change happened, so a WIDENING is
+   * / distinguishable from a tightening afterwards. A quiet policy raise is the shape most custody
+   * / incidents take, and "policy changed" alone cannot tell an investigator which way it moved.
+   * /
+   * / Raising a cap RESOLVES pending approval requests it now covers — that is the second half of
+   * / the escalation an agent starts when it hits a limit, and without it the queue is a place
+   * / requests go to expire.
+   */
+  setSpendPolicy: ActorMethod<[SpendingPolicy], Result_1>;
+  /**
+   * / Owner-only: set YOUR OWN safety rails on the funding path — a per-top-up ckUSDC ceiling and a
+   * / minimum gap between top-ups. Read them back with `getTopUpLimits`.
+   * /
+   * / ⚠ THESE ARE THE OWNER'S LIMITS, NOT THE PLATFORM'S. "Limits" reads like something imposed;
+   * / nothing outside this engram sets them, and an owner may raise them at will. They exist so a
+   * / compromised agent key or a runaway agent cannot drain a wallet in one call or in a fast loop,
+   * / which is a bound on YOUR OWN blast radius rather than on what you are permitted to spend.
+   * /
+   * / The cooldown defaults to five minutes. `cooldownSeconds = 0` removes the gap entirely, which
+   * / is a real choice and not an error.
+   * / ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE RECORD, NOT TWO ADJACENT NATS. This took
+   * / `(newMaxCkusdcE6s : Nat, cooldownSeconds : Nat)` — the documented swap class, and a live one:
+   * / the suite calls `setTopUpLimits(10_000_000n, 300n)`, and a caller who transposes those gets a
+   * / 300-e6 cap with a 116-DAY cooldown. Candid matches positionally and both are `nat`, so the
+   * / wire accepts it, the types accept it, and the engram is quietly unable to top itself up.
+   * /
+   * / The field names are NOT a new vocabulary — they are `getTopUpLimits`'s, which already answers
+   * / `{ cooldownSeconds; maxCkusdcE6s }`. Setter and getter now share one shape, so read-modify-
+   * / write is expressible and neither side can drift from the other without the compiler saying so.
+   */
+  setTopUpLimits: ActorMethod<[{ cooldownSeconds: bigint; maxCkusdcE6s: bigint }], Result_1>;
+  /**
+   * / Owner sets the World ID app_id + action + rp_id from their World Developer Portal (rp_id appears
+   * / after "Enable World ID 4.0" on a production app). The action MUST be configured there with
+   * / max_verifications = Unlimited (idempotent /verify → survives IC consensus). After setting this,
+   * / register getWorldIdRpSignerAddress() as the rp_id's signer address in the Portal.
+   */
+  setWorldIdConfig: ActorMethod<[string, string, string], Result_1>;
+  /**
+   * / Submit a verified-human proof: the IDKitResult from the frontend's World ID flow, forwarded
+   * / VERBATIM (compact JSON, as JSON.stringify emits) to World's /api/v4/verify/{rp_id} over an HTTPS
+   * / outcall (never trust the client). The v4 endpoint verifies both 4.0 proofs and legacy 3.0 proofs,
+   * / so the OrbLegacy migration path and the 4.0 endgame ride the same method. Owner-only. `nullifier`
+   * / is the claimed unique-human pseudonym; it must appear verbatim inside resultJson, binding what we
+   * / store to the payload the verifier actually accepted. Only proof_of_human credentials are accepted
+   * / (selfie is farmable, passport/mnc are document identity — a different tier). Sets worldIdVerified
+   * / and stores the result ONLY on a real verification success — never self-asserted.
+   */
+  setWorldIdProof: ActorMethod<[string, string], Result_1>;
+  /**
+   * / Sign a registered type. ONE call, owner-only, freeze-gated — the delay lives on registration
+   * / (D2), never here: an emergency withdrawal must not need two owner round-trips.
+   * /
+   * / ⟨0.16.0⟩ PERSISTS beside the market's `sysSignEip712` (census row 177, ruled). The owner does
+   * / not lose the ability to sign because a marketplace gained it, and the two share every control
+   * / below the caller gate.
+   */
+  signEip712: ActorMethod<[Uint8Array | number[], Array<[string, Eip712Value]>], Result_4>;
+  /**
+   * / Sign the engram's own ERC-8004 registration tx for client-side broadcast: the engram signs, the client
+   * / broadcasts and keeps the resulting registration id.
+   * /
+   * / Agent-accessible. The comment here claimed "saves ~55-85M cycles vs registerAgent" until
+   * / 2026-08-17; `registerAgent` — the engram method that broadcast the registration itself — left
+   * / the candid surface in commit d25b53b, so the comparison had outlived its other term. The
+   * / saving was real and is now simply the shape of this method: no RPC outcall, no receipt poll.
+   * / ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE REQUEST RECORD, not three adjacent nats.
+   * /
+   * / ⟨Ruling R-B3⟩ This method KEEPS. Census row 309 dispositions it `die` ("test-only; folds into
+   * / signEip712 + registered type") and row 311 records the owner's answer: RULED 2026-08-20 —
+   * / KEEP, ERC-8004 stays. Both halves of the `die` rationale fail at the site: it is not
+   * / test-only (a downstream web client's billing page calls it), and it is not a shipped customer
+   * / capability either — that panel sits behind `evmBilling: { mode: 'off' }` in both the flag
+   * / defaults and the shipped config, and its own dialog says the signature is dormant and not
+   * / broadcastable. It is a real surface in a disabled state, which is neither thing the census
+   * / row claimed.
+   * /
+   * / THE SWAP CLASS, and here it is three-deep: `nonce`, `maxFeePerGas` and `maxPriorityFeePerGas`
+   * / were adjacent and all `Nat`. Transposing the two gas fields type-checks, decodes, and signs a
+   * / transaction whose priority fee exceeds its max fee — invalid on chain, and the 500-gwei
+   * / ceiling below cannot see it because both values are individually under the cap. Named fields
+   * / remove the class.
+   * /
+   * / ⟨2026-09-28⟩ LIMITED PER CALLER PER DAY. The owner decided to cap this signature rather than
+   * / delete it: each caller (the owner, or an active agent) may obtain
+   * / `EngramRegCap.MAX_PER_CALLER_PER_DAY` registration signatures per UTC day; the next is refused
+   * / with `#Conflict` naming this method. A signature that fails does not count. The `nonce` must
+   * / be the REGISTRATION address's nonce — `getEvmAddress().engramRegistration` — below 2^64 − 1.
+   */
+  signEngramRegistration: ActorMethod<
+    [
+      {
+        maxFeePerGas: bigint;
+        nonce: bigint;
+        maxPriorityFeePerGas: bigint;
+      },
+    ],
+    Result_9
+  >;
+  /**
+   * / Sign an EIP-3009 authorization for x402 payment. Agent-accessible.
+   * / Client probes the URL, extracts chain/token/recipient/amount from the 402, and calls this.
+   * / Canister signs → returns header → client retries with header.
+   * /
+   * / ⟨0.16.0⟩ PERSISTS beside the market's `sysSignX402Payment` (census row 177, ruled). An agent
+   * / with an x402 rail does not lose it because a marketplace gained one, and both run the same body.
+   * / ⟨API-105, 2026-08-24 — v3 phase X3⟩ ONE REQUEST RECORD, not eight positional arguments.
+   * /
+   * / THE HAZARD IS FUNDS MISDIRECTION, and it is the sharpest case in this batch. `tokenAddress`
+   * / and `recipient` were ADJACENT and both `Text`. Candid matches positionally, so transposing
+   * / them type-checks, decodes, and signs a payment whose payee is the TOKEN CONTRACT rather than
+   * / the intended one — an irreversible outbound signature spending the engram's own key, with
+   * / nothing between the mistake and the money. `tokenName`/`tokenVersion` are a second adjacent
+   * / Text pair; that one only corrupts the EIP-712 domain, so it fails loudly instead.
+   * /
+   * / Named fields remove the class outright: a transposition is now a decode error at the edge.
+   * /
+   * / The body is UNCHANGED. Each parameter was referenced exactly once below, so the record is
+   * / destructured on entry rather than threaded through — the diff is the signature and this line,
+   * / which is what makes a reshape of a money path reviewable.
+   */
+  signX402Payment: ActorMethod<
+    [
+      {
+        tokenVersion: string;
+        tokenAddress: string;
+        approvalId: [] | [string];
+        recipient: string;
+        rationale: [] | [string];
+        tokenName: string;
+        chainId: bigint;
+        amount: bigint;
+      },
+    ],
+    Result_3
+  >;
+  /**
+   * / Self-heal: if the registry's spawn-time push was missed, the owner pulls the number from
+   * / the spawning registry. Idempotent; fails closed if the registry has no record.
+   */
+  syncEngramNumber: ActorMethod<[], Result_8>;
+  /**
+   * / Genesis seed — the atomic "spawn only when there's real content" primitive. The spawning
+   * / REGISTRY pushes the owner's first real memory immediately after install, so a canister is
+   * / never spawned holding nothing (see the registry's `provisionEngram` optional genesis).
+   * /
+   * / Gated `spawnedBy`-only and ONE-SHOT: it refuses once any file exists, so it can seed and never
+   * / overwrite. Unlike the owner-only `seedMemory` placeholder this is REAL owner content, so it
+   * / IS counted as an owner write (`firstWriteAt`, `totalMemoryWrites`) and is authored by the
+   * / OWNER rather than by the registry principal that called it. It never touches the
+   * / agent metrics.
+   * /
+   * / ⚠ THE PAYLOAD IS `Nat` AND MUST STAY `Nat`, which is a constraint on any client of this
+   * / method rather than an internal detail. Its only caller is the registry, over an
+   * / inter-canister boundary, through a hand-declared actor type — and the registry is ROUTINELY a
+   * / different version from the engram template it is seeding: it upgrades before the fleet does,
+   * / and during a transition it can serve a template older than itself. A return-type change here
+   * / breaks genesis provisioning across that skew. That is measured, not predicted: the registry
+   * / trapped with "IDL error: unexpected IDL type when parsing Nat" while seeding an engram built
+   * / at the staging tag. A receipt would buy nothing anyway — the caller does `ignore await`.
+   * /
+   * / ⚠ ORDERING: upload the engram TEMPLATE first, then upgrade the registry. The reverse leaves a
+   * / window where a spawn seeds an old-shape engram with a new-shape expectation; the reply fails
+   * / to decode and `provisionEngram` dies on a trap its own `try/catch` cannot reach (ADR-0001),
+   * / failing the WHOLE SPAWN rather than just the seed.
+   */
+  sysApplyGenesisSeed: ActorMethod<[string, Uint8Array | number[]], Result_8>;
+  /**
+   * / OWNER force-close, for a session the payer abandoned.
+   * /
+   * / ⟨R1b, ruled 2026-08-26: owner-gated, NO guardian.⟩ It moves someone else's money, and only ever
+   * / BACK TO THEM — the destination is the session's own payer and is not caller-influenced, so the
+   * / guardian ceremony that guards destination changes buys nothing here and would strand payers on
+   * / engrams that have no guardian.
+   * /
+   * / Calls the gateway's NO-AUTH variant deliberately. `gate.closeSession` is payer-only, which is
+   * / why the market's admin-gated `forceCloseSession` could never work: it authorised an admin and
+   * / then delegated to a method that rejects everyone but the payer.
+   * /
+   * / ⟨NOTE 2026-10-02 — NOT RENAMED, deliberately, and this is the one `sys` method that still has a
+   * / human caller.⟩ The sys-tier retier (ruled 2026-08-24, executed 2026-10-02 on the registry and
+   * / the market) named FOUR admin-called methods; this one became owner-gated two days after that
+   * / list was made, so the ruling never named it. Its caller is the OWNER, a person, which is the
+   * / exact thing the retier removes from the `sys` tier — so "a `sys` method has no human caller"
+   * / stays false here until it is renamed too. Left for the owner: the rename is free until the cut
+   * / and a break after it, and it also moves `packages/client/README.md` and
+   * / `docs/AGENT-ONBOARDING.md`, which name it.
+   */
+  sysForceCloseSession: ActorMethod<[string], Result_1>;
+  /**
+   * / The metrics reader the registry designated reads every engagement's seat weeks, in one call.
+   * /
+   * / CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
+   * / nobody else — not the owner (who reads `getAgentSeatWeeks`), an agent, a guardian, the registry,
+   * / the biller or the market (ADR-0020: a `sys` method names its caller). Answered only while the
+   * / owner leaves it on (`seatWeeksReadEnabled`, on from birth by the owner's ruling of 2026-10-02).
+   * /
+   * / WHAT LEAVES: per engagement, the pairing day, the first and last payment-signature days, the
+   * / 64-week map and the count — NO root, NO invite, NO amount, recipient or nonce. The reader matches
+   * / rows to the registry's engagements by day, so no agent's identity leaves this engram here.
+   * /
+   * / ⟨L7⟩ UPDATE, NOT QUERY, so a refusal leaves its `sysGetAgentSeatWeeks.denied` row naming the
+   * / caller's class, and an answered read leaves a `sysGetAgentSeatWeeks` row in the read log — the
+   * / owner can see every time the reader read. A refusal is `#Refused` naming this method and the
+   * / class (`SeatWeeks.readRefusal`), never an empty list: an empty list is a real answer ("no agent
+   * / has paired here"), and a fabricated one would be counted as one.
+   */
+  sysGetAgentSeatWeeks: ActorMethod<[], Result_7>;
+  /**
+   * / The metrics reader the registry designated reads this engram's paid-rail health, in one call:
+   * / the balance and the line it must stay above, the memory that line is computed from, the sessions
+   * / by state, the escrow open sessions hold, the vouchers spent and the refused ones
+   * / (`RailHealth.RailHealth` says what each is, and what is never in it).
+   * /
+   * / CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
+   * / nobody else — the owner reads its balance through `getOwnerConsole`. Answered only while the
+   * / owner leaves that reader's read on (`seatWeeksReadEnabled`): the SAME gate and the SAME switch
+   * / as `sysGetAgentSeatWeeks`, because it is the same reader and the owner has one switch over it.
+   * /
+   * / A QUERY, AND A DEPARTURE FROM THE SYS METHODS BESIDE IT, ON PURPOSE ⟨2026-10-02⟩. It is read
+   * / every hour, and as an update it would leave a row in this engram's read log every hour — about
+   * / 720 a month in a record whose rows are what its owner reads. What a query cannot do is write the
+   * / denial row of a refusal (a query's writes are discarded) — the trade `getOwnerConsole` makes. A
+   * / refusal is still `#Err(#Refused …)` naming this method and the caller's class
+   * / (`RailHealth.readRefusal`), never a zero balance: a made-up zero would read as an engram about
+   * / to freeze. Called by another canister, a query runs replicated and this engram pays for it —
+   * / a few million cycles an hour, the cost of being watched.
+   */
+  sysGetRailHealth: ActorMethod<[], Result_6>;
+  /**
+   * / The cashier reads how many signatures this engram has produced, per caller and in total.
+   * / ⟨2026-09-28⟩ The owner's decision of that date: a running counter on the engram, exported to
+   * / the cashier — and to nobody else (`AccessControl.requireCashierForSignatureCounts`).
+   * /
+   * / ONE NEW METHOD ON THE ENGRAM, not a field on the registry's `sysMeterEngram` reply. The study
+   * / ruled out widening that reply to protect deployed clients, and that reason is gone (nothing is
+   * / launched; the next release reinstalls every canister). The deciding fact is a different one,
+   * / read at the site: `sysMeterEngram` is the REGISTRY's method and answers from the management
+   * / canister's `canister_status` — the registry holds no signature count. Carrying the count in its
+   * / reply would add a registry-to-engram call inside the meter and a second trust hop between the
+   * / counter and the biller. The cashier is already the engram's recognised biller (`cashierId`) and
+   * / already calls it directly (`sysRecordFeeEvent`), so it reads the count at the source.
+   * /
+   * / UPDATE, NOT QUERY, so that a refusal leaves its `sysGetSignatureCounts.denied` row: a refused
+   * / query cannot write one (see `Gated.mo`'s header). A refusal is `#Refused` naming this method,
+   * / never an empty list or a zero — a zero is a real answer, and a fabricated one would be billed.
+   * /
+   * / ⟨2026-09-29⟩ Each row names the key, the agent it was enrolled under (none for the owner and
+   * / the marketplace) and the role, so one agent's keys can be added up. And a limit for whoever
+   * / bills from this: the number comes from a canister its owner controls and can reinstall, so bill
+   * / only engrams the registry confirms run published code, and read a lower count than last time as
+   * / a reinstall — the reasoning is at `signaturesByCaller`.
+   */
+  sysGetSignatureCounts: ActorMethod<[], Result_5>;
+  /**
+   * / Rent lifecycle notice — how the OWNER (not the agent) learns their subscription lapsed. D6
+   * / shipped the handoff but every alarm it added talks to the operating service's watchdog; the
+   * / doc named the debt plainly: "an owner learns of their own lapse only by looking." This closes
+   * / it through the channel the owner already has: the entry lands in the audit log under `rent.*`,
+   * / ActionAlerts classifies that as #money (default ON), and the drain delivers it to the owner's
+   * / webhook. No new channel, no new config — an owner who armed alerts gets told.
+   * /
+   * / Gated exactly like sysRecordFeeEvent (spawnedBy or cashierId): the sweep is the only thing that
+   * / OBSERVES the transition, so it is the only thing that can report it. The state whitelist is
+   * / closed — this is a lifecycle feed, not a free-text push surface into the owner's audit chain.
+   */
+  sysNotifyRentLifecycle: ActorMethod<[string, string], Result_1>;
+  /**
+   * / ⟨0.16.0⟩ `getWalletActivation()` DELETED — folded to `about().walletActivatedAtNs`, with its
+   * / custody-posture rationale carried onto the field. "Can this thing hold money" is a question a
+   * / counterparty is entitled to ask before dealing with an engram, which is why it stays public.
+   * / ⟨0.16.0, sys tier⟩ THE MARKET TELLING CUSTODY, which is the half of the wallet-activation
+   * / story the engram cannot see for itself.
+   * /
+   * / B1 moved the storefront to the market, so listing an endpoint — a seller offering to be paid —
+   * / happens on a canister this one does not observe. `walletActivatedAt` exists to raise a custody
+   * / decision (a wallet-bearing engram is sovereign-by-default and its owner has a claimSovereignty
+   * / still to complete), and a seller who has never derived an EVM address would have gone
+   * / unstamped forever. That is the under-reporting direction, which is the harmful one: a missing
+   * / flag retires a decision that is still pending.
+   * /
+   * / ONE METHOD, NOT A FAMILY (L6). The other surface the old comment named — opening a payment
+   * / session — is NOT here and is not an omission: measured at the market 2026-08-20, `openSession`'s
+   * / caller is a BUYER, and a buying engram signs with a key it derived through `getEvmAddress`,
+   * / which stamps. It is already marked before it can pay. Adding a case for it would be surface
+   * / bought for a gap that does not exist.
+   * /
+   * / THE SURFACE WHITELIST IS CLOSED, exactly as `sysNotifyRentLifecycle`'s state whitelist is, and
+   * / for the same reason: this is a lifecycle feed, not a free-text push into the owner's audit
+   * / chain. The market is trusted to REPORT, never to compose what the owner reads.
+   * /
+   * / IDEMPOTENT AND SILENT WHEN ALREADY STAMPED. `markWalletActivated` returns early once the var is
+   * / set, so a second notice writes nothing and still answers `#Ok` — a retry learns it succeeded
+   * / rather than that it failed. The stamp keeps the FIRST wallet-bearing moment, which is the one a
+   * / custody audit wants; a later notice must not overwrite it with its own time.
+   * /
+   * / The audit line records this engram as the subject, and `surface=endpoint-listed` is what names
+   * / the origin: only the configured market can pass that value, so the line cannot be produced by
+   * / any other caller.
+   */
+  sysNotifyWalletActivity: ActorMethod<[string], Result_1>;
+  /**
+   * / The rent RECEIPT seam (B2): the cashier tells this engram that money moved on its behalf, and
+   * / the engram appends a `fee.recorded` line to its own audit chain. It computes nothing.
+   * /
+   * / ⚠ GATED TO TWO PRINCIPALS AND NEITHER IS THE OWNER — the SPAWNING REGISTRY or the CONFIGURED
+   * / CASHIER. An owner cannot write their own fee receipts, which is the point: a receipt an owner
+   * / could forge is not evidence. `getBillerId` publishes which cashier this engram accepts, so the
+   * / same fact is checkable from outside.
+   * /
+   * / This is the whole of what B2 left on the engram. Entitlement, custody and fee math live on the
+   * / cashier; here there is an append-only record and no arithmetic — so a disagreement between the
+   * / two is visible rather than reconciled silently.
+   * / ⟨API-105/ARCH-108, 2026-08-24 — v3 phase X3⟩ ONE FEE-EVENT RECORD, not three positional
+   * / arguments. ARCH-108 records that the census prescribed this fold and it "was refused for a
+   * / wire-break reason the ruling voids", with the instruction to execute it or ratify
+   * / positional-forever with a dated note — "silence spends the window". Executed.
+   * /
+   * / The argument for a record here is EVOLUTION, not transposition: unlike `setTopUpLimits`'s two
+   * / adjacent nats, these three types differ, so a swap would not type-check. What positional
+   * / arguments cost is the next field. A fee event is exactly the shape that grows one — token,
+   * / amount, rate — and ADR-0018's rule is that an INBOUND record gains optional fields forever
+   * / while an argument LIST cannot gain anything without breaking every caller at once.
+   * /
+   * / ⚠ ALL FOUR CALLERS MOVE IN THE SAME CHANGE, and this is ADR-0001's fatal direction: three
+   * / inline hand-IDLs in the cashier and one in the registry declare this method's argument shape
+   * / structurally. Every one of them sits inside `try { … } catch (_e) {}`, which reads as
+   * / containment and is not: a reply-decode mismatch calls `ic0.trap` INSIDE the caller's own
+   * / callback, and Motoko's `catch` sees rejects, never traps. That is the failure that took
+   * / production monitoring dark for ~33h. The ENGRAM WASM MUST SHIP BEFORE its callers, and
+   * / `check-didc-compat` is suspended for the cut, so nothing mechanical will catch a wrong order.
+   */
+  sysRecordFeeEvent: ActorMethod<
+    [
+      {
+        paidThroughNs: [] | [bigint];
+        cycles: bigint;
+        scheduleVersion: [] | [string];
+      },
+    ],
+    Result_1
+  >;
+  /**
+   * / Point this engram at the biller that converts its tokens → cycles. Settable, not hardcoded:
+   * / coupling is by principal id, so the same wasm runs against any deployment's biller.
+   * /
+   * / ⟨0.16.0, B2⟩ Renamed from `setCashierId`, and NARROWED to the spawning registry (census row
+   * / 266, ruled). Two changes, for two reasons:
+   * /   · "cashier" is a PLATFORM word and this is the OSS wire. `biller` names the role, not the
+   * /     product that fills it.
+   * /   · The write is now sys-tier. It previously accepted the OWNER as well, and that second
+   * /     writer is what the ruling removed — three writers for one field (owner, spawner, and the
+   * /     frontend acting for the owner) is a last-write-wins race over a money-routing target.
+   * /
+   * / ⚠ THE COST, RULED AND ACCEPTED: an engram whose registry never set this has NO owner remedy.
+   * / `convertEarningsToCycles` fails closed against a null biller, and with the owner leg gone
+   * / nobody but the spawning registry can fix it. That refusal therefore names the real remedy
+   * / rather than telling an owner to run a call they can no longer make.
+   */
+  sysSetBillerId: ActorMethod<[Principal], Result_1>;
+  /**
+   * / One-shot assignment of the spawn ordinal — callable ONLY by the spawning registry, ONLY
+   * / while unset. Neither the owner nor any later registry can change an assigned number.
+   */
+  sysSetEngramNumber: ActorMethod<[bigint], Result_1>;
+  /**
+   * / Point this engram at the commerce satellite allowed to ask it for signatures. ⟨0.16.0, B1⟩
+   * /
+   * / SAME AUTHORITY AS `sysSetBillerId`, and for a stronger reason. That one routes money; this one
+   * / confers the capability to ask this canister to sign with its own tECDSA key. Three writers for
+   * / one field would be a last-write-wins race over a SIGNING target — so the spawning registry is
+   * / the only writer, and an engram with no registry has no market to be pointed at.
+   * /
+   * / The same accepted cost applies, one notch sharper: an engram whose registry never set this can
+   * / never be sold through the market, and no owner action fixes it. Both `sysSign*` methods refuse
+   * / against a null pointer and their refusals name the registry as the remedy rather than telling
+   * / an owner to run a call they cannot make.
+   */
+  sysSetMarketId: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Name the metrics reader allowed to read this engram's seat weeks (`sysGetAgentSeatWeeks`).
+   * / ⟨2026-10-02, the owner's ruling of that day⟩
+   * /
+   * / CALLER: the registry that spawned this engram, and nobody else (ADR-0020) — the same authority
+   * / as `sysSetBillerId` and `sysSetMarketId`. The registry calls it once, at spawn, last of its
+   * / pushes, with exactly this interface: `sysSetMetricsReaderId : (Principal) -> async
+   * / Wire.Result<()>`. ⚠ THAT CLIENT DECLARATION IS HAND-WRITTEN AT THE REGISTRY: a different NAME
+   * / here leaves every newborn with no reader, silently (the push is best-effort and its reject is
+   * / caught), and a different REPLY type traps inside the registry's callback. Rename neither without
+   * / the registry; test/seat-weeks-wiring.test.ts compares the two.
+   * /
+   * / A CANISTER ONLY: a person's principal, the anonymous principal or the management canister is
+   * / refused `#Invalid` and nothing changes — a person named here would be handed this engram's seat
+   * / counts. Set or replaced, never cleared: the owner's control is the switch
+   * / (`setSeatWeeksReadEnabled`), not the pointer. The chained record entry
+   * / (`metrics.sysSetMetricsReaderId`) is the evidence of when the read was granted, and to whom.
+   */
+  sysSetMetricsReaderId: ActorMethod<[Principal], Result_1>;
+  /**
+   * / The market asks this engram to sign a registered type — B1's seam, settlement leg. ⟨0.16.0⟩
+   * /
+   * / THE ENGRAM DOES NOT TRUST THE MARKET WITH ANYTHING BEYOND "ask". Every control that bounds
+   * / what may be signed stays here and is unchanged: the type must already be OWNER-REGISTERED
+   * / (the market cannot introduce a shape), its cool-off must have elapsed, its per-type daily cap
+   * / still binds, the destination allowlist still fails closed, and a payments freeze still stops
+   * / it. What the market supplies is the request; what the engram supplies is the whole policy.
+   * /
+   * / That is what "signatures only" means in code, and it is why this method needs no new authority
+   * / model: an unregistered typeId is refused for the market exactly as it is for the owner.
+   */
+  sysSignEip712: ActorMethod<[Uint8Array | number[], Array<[string, Eip712Value]>], Result_4>;
+  /**
+   * / The market asks this engram to sign an x402 payment — B1's seam, the paid-request leg. ⟨0.16.0⟩
+   * /
+   * / THE MARKET SUPPLIES THE REQUEST; THE ENGRAM SUPPLIES THE POLICY. Every control below the caller
+   * / gate is unchanged and still binds: a payments freeze stops it, the recipient must be on the
+   * / owner's EVM allowlist if the owner has set one, the per-transaction and per-day caps hold, and
+   * / an over-policy request goes to the OWNER'S approval queue rather than through.
+   * /
+   * / `#ApprovalPending` is a real answer here, not an error, exactly as it is for an agent: the
+   * / market is told the spend needs the owner and can retry with the `approvalId` once granted. A
+   * / caller that treats it as a failure will simply never complete a spend the owner would have
+   * / allowed — which is the safe direction, and the reason it rides inside `Ok` (L5).
+   * /
+   * / READ `x402SignFor`'s declaration before setting a policy for this caller. The cap is ONE bucket
+   * / for ALL market traffic; per-seller limits are not expressible in the store it reads.
+   */
+  sysSignX402Payment: ActorMethod<
+    [bigint, string, string, bigint, string, string, [] | [string], [] | [string]],
+    Result_3
+  >;
+  /**
+   * / Write an `alerts.test` entry into the audit log; the drain timer delivers it to the webhook
+   * / within ~60s. Owner-only; requires a configured URL so the test can actually go somewhere.
+   */
+  testActionAlert: ActorMethod<[], Result_1>;
+  /**
+   * / Guardian test alert — an audited guardian action (`alerts.test`, role Guardian) that every
+   * / armed channel (owner + guardians) receives within ~60s. Requires the caller's own channel
+   * / to be armed so the test has somewhere to land for them.
+   */
+  testGuardianAlert: ActorMethod<[], Result_1>;
+  /**
+   * / RENAMED from `init` (L2.4). This is the OWNERSHIP-TRANSFER method — the most consequential
+   * / owner-facing operation on the canister — and it was named for first-time setup, colliding with
+   * / the actor's own `service : (initArgs)`. A reader scanning for "how does ownership move" found
+   * / nothing; a reader scanning for `init` found a constructor.
+   * /
+   * / Its read counterpart is `listOwnershipTransfers` (was `getOwnershipHistory`), which now shares
+   * / the stem — the pair was previously unfindable from either half.
+   * / ⟨0.16.0, L1⟩ TWO OF THESE REFUSALS ARE THE FIRST-CLAIM PATH, and they are not authorization.
+   * /
+   * / On an unowned engram there is no owner to refuse anyone, so "caller must set themselves as
+   * / owner" is a rule about the ARGUMENT — pass your own principal and it succeeds. `#Invalid` says
+   * / retrying with a different argument can work; `#Refused` would tell a first claimant their
+   * / standing was the problem, on the one call where nobody has standing yet.
+   * /
+   * / ⟨2026-09-29, owner ruling follow-up 8 (option A)⟩ A CHANGE OF OWNER HANDS OVER CONTROL OF THE
+   * / CODE. The new owner becomes a controller of this canister and the former owner stops being one;
+   * / the answer says who moved it (`ControlHandover`). Managed: the registry moves it while it
+   * / accepts the transfer. Sovereign: the registry answers `#EngramMustMove` and this engram sets
+   * / its own controllers. THE OWNER CHANGES HERE ONLY AFTER CONTROL HAS MOVED — if it cannot move,
+   * / the registry's record is put back and nothing is transferred; if even that fails, the refusal
+   * / says who the registry now records and that the same call again finishes it. A standalone
+   * / engram (no registry) cannot know who controls it and changes the owner only, answering
+   * / `#NotHeldHere`. The rules are `src/shared/ControlHandover.mo`'s.
+   * /
+   * / ⟨2026-09-29, review PR-3: a half-finished change of owner⟩ The registry now MARKS a change of
+   * / owner as unfinished from the moment it moves its record until it sees control move. A sovereign
+   * / engram therefore reports the move (`sysConfirmOwnershipTransfer`) after setting its own
+   * / controllers; until the registry hears it, the registry refuses the new owner's
+   * / `claimSovereignty`, `returnToManaged`, `abandonMyEngram` and `upgradeMyEngram` for this engram.
+   * / While a transfer is marked unfinished, a transfer to anyone but its would-be owner is refused by
+   * / the registry, by name; calling this again with that owner finishes it.
+   * /
+   * / ⟨2026-09-29, review finding RV-4⟩ THE OWNER NAMING THEMSELVES IS A REPORT, NOT A HAND-ON. It is
+   * / the way out when the registry did not hear that a sovereign engram moved control: it moves
+   * / control to the same owner again and reports it, and it writes NO entry to
+   * / `listOwnershipTransfers` (until this day it wrote one from the owner to themselves, a hand-on
+   * / that did not happen). The record entry says it was a report. `ControlHandover.isReport`.
+   */
+  transferOwnership: ActorMethod<[Principal], Result_2>;
+  /**
+   * / OWNER-ONLY release of the payment freeze — and the asymmetry with `freezePayments` is the
+   * / governance design, not an oversight.
+   * /
+   * / ⚠ A GUARDIAN CAN PULL THIS BRAKE AND CANNOT RELEASE IT. `freezePayments` accepts the owner OR
+   * / a guardian holding `canFreezePayments`; only the owner reaches this method. Two consequences,
+   * / and both parties should know them before the role is accepted:
+   * /   · a guardian can stop payments in an emergency WITHOUT the owner, which is the point;
+   * /   · a guardian cannot hold the engram hostage, because the owner releases it immediately and
+   * /     unilaterally.
+   * / So a guardian's freeze is a TRIPWIRE, not a lock — it buys the time it takes the owner to
+   * / look, and no more.
+   */
+  unfreezePayments: ActorMethod<[], Result_1>;
+  /**
+   * / Consensus transform for the World ID /verify outcall. Replicas each call independently, so the raw
+   * / response (timestamps, `uses`, request-id headers) is non-deterministic. Collapse it to a single
+   * / canonical byte — "1" iff HTTP 200 AND the body asserts success — with no headers, so every replica
+   * / agrees. The caller keys off this byte, never the raw body.
+   * /
+   * / PUBLIC: not a choice, exactly as `actionAlertTransform` above — the management canister calls
+   * / it on every replica with no caller identity attached. Stateless and total, so being callable
+   * / by anyone grants nothing: an outsider invoking it learns only what they already passed in.
+   */
+  worldIdTransform: ActorMethod<
+    [{ context: Uint8Array | number[]; response: HttpRequestResult }],
+    HttpRequestResult
+  >;
+  /**
+   * / Write a memory file, creating it or adding a version to it. Returns a write receipt — the new
+   * / `version`, the audit `seq`, and the chain `head` after the write — so a caller can prove what
+   * / it wrote without a second read.
+   * /
+   * / ⚠ OWNER-ONLY, and this is the one most likely to surprise: an agent holding `write_memory`
+   * / does NOT reach this method. Agent writes go through the agent surface, which applies the
+   * / grant and the protected-path rules on top. `#Refused` here means the caller is not the owner,
+   * / not that a permission is missing.
+   * /
+   * / It also refuses while writes are PAUSED and while memory is not attached — both are states an
+   * / owner can be in without knowing, so they answer as themselves rather than as a generic failure.
+   * /
+   * / ⚠ THE FILE-COUNT CAP BLOCKS NEW FILES ONLY. At the cap, creating a new path is refused and
+   * / APPENDING TO AN EXISTING FILE STILL WORKS — the refusal says so, because "you are full" and
+   * / "you cannot write at all" lead to different next actions. A TOMBSTONED path counts as absent,
+   * / so writing to a deleted path is a new file and is capped like one; the delete record survives
+   * / either way.
+   * /
+   * / Path and content are validated before the caller is even checked, so a malformed request gets
+   * / `#Invalid` rather than a refusal it would waste time investigating.
+   */
+  writeMemory: ActorMethod<[string, Uint8Array | number[]], Result>;
+}
+export interface EngramSessionState {
+  id: string;
+  status: EngramSessionStatus;
+  deposited: bigint;
+  openedAtNs: bigint;
+  lastActivityAtNs: bigint;
+  consumed: bigint;
+  voucherCount: bigint;
+  remaining: bigint;
+  payer: Principal;
+}
+export type EngramSessionStatus =
+  { closed: null } | { expired: null } | { other: string } | { open: null } | { closing: null };
+export interface Enrolment {
+  signature: Uint8Array | number[];
+  enrolledKey: Principal;
+  rootPubkey: Uint8Array | number[];
+  engram: Principal;
+}
+export interface EnrolmentProof {
+  signature: Uint8Array | number[];
+  enrolledKey: Principal;
+  rootPubkey: Uint8Array | number[];
+  inviteCode: string;
+}
+export type Error =
+  | { Invalid: string }
+  | { NotFound: string }
+  | { Refused: string }
+  | { Other: string }
+  | { Unavailable: string }
+  | { Conflict: string };
+export interface EvmAddresses {
+  pay: string;
+  engramRegistration: string;
+}
+export interface ExportReceiptRow {
+  by: Principal;
+  seq: bigint;
+  toSeq: bigint;
+  opsRoot: Uint8Array | number[];
+  atNs: bigint;
+  fromSeq: bigint;
+  authorFilter: [] | [Principal];
+}
+export interface GenesisNote {
+  predecessorSize: [] | [bigint];
+  predecessorHeadHash: [] | [Uint8Array | number[]];
+  note: string;
+  version: string;
+  genesisAtNs: bigint;
+}
+export interface GuardianPermissions {
+  canFreezePayments: boolean;
+  canRevokeAgents: boolean;
+  scopes: [] | [Array<string>];
+  canPauseWrites: boolean;
+}
+export interface GuardianRecord {
+  status: GuardianStatus;
+  permissions: GuardianPermissions;
+  principal: Principal;
+  name: string;
+  addedAtNs: bigint;
+}
+export type GuardianStatus = { Active: null } | { Pending: null };
+export interface HeldKey {
+  key: Principal;
+  from: LogPosition;
+  until: LogPosition;
+}
+export interface HttpHeader {
+  value: string;
+  name: string;
+}
+export interface HttpRequest {
+  url: string;
+  method: string;
+  body: Uint8Array | number[];
+  headers: Array<[string, string]>;
+}
+export interface HttpRequestResult {
+  status: bigint;
+  body: Uint8Array | number[];
+  headers: Array<HttpHeader>;
+}
+export interface HttpResponse {
+  body: Uint8Array | number[];
+  headers: Array<[string, string]>;
+  upgrade: [] | [boolean];
+  status_code: number;
+}
+export interface KeyNomination {
+  key: Principal;
+  atNs: bigint;
+}
+export interface LogPage {
+  firstAvailableSeq: bigint;
+  head: Uint8Array | number[];
+  page: Page_7;
+}
+export interface LogPosition {
+  reads: bigint;
+  record: bigint;
+}
+export interface MarketplacePaymentSignatures {
+  marketplace: Principal;
+  sharedSignedToday: bigint;
+  limit: bigint;
+}
+export interface MemoryByteChunk {
+  more: boolean;
+  fileSize: bigint;
+  bytes: Uint8Array | number[];
+}
+export interface MemoryEviction {
+  evictSeq: bigint;
+  fromVersion: bigint;
+  evictedRoot: Uint8Array | number[];
+  trigger:
+    | { globalCap: null }
+    | { thinTail: null }
+    | { perFileCap: null }
+    | { thinLogSpaced: null }
+    | { policy: null };
+  cause: { maxVersions: null } | { maxBytes: null };
+  toVersion: bigint;
+}
+export interface MemoryFile {
+  content: Uint8Array | number[];
+  path: string;
+  version: bigint;
+  lastModifiedBy: Principal;
+  lastModifiedAtNs: bigint;
+}
+export interface MemoryHistory {
+  evictions: Array<MemoryEviction>;
+  oldestRetainedVersion: bigint;
+  everCount: bigint;
+  retainedCount: bigint;
+  versions: Array<MemoryVersionSummary>;
+  evictedCount: bigint;
+}
+export interface MemoryLogChunkRef {
+  hash: Uint8Array | number[];
+  size: bigint;
+  birthSeq: bigint;
+}
+export interface MemoryLogEvent {
+  by: Principal;
+  op: MemoryLogOp;
+  seq: bigint;
+  contentRoot: Uint8Array | number[];
+  atNs: bigint;
+  path: string;
+  prev: Uint8Array | number[];
+  size: bigint;
+  version: bigint;
+}
+export type MemoryLogImportNote =
+  | { legacyDelete: null }
+  | {
+      legacyTruncated: {
+        prefixHash: Uint8Array | number[];
+        storedBytes: bigint;
+      };
+    }
+  | { legacyGap: { firstSurviving: bigint } }
+  | {
+      legacyUnreconstructable: {
+        contentHash: Uint8Array | number[];
+        reason: string;
+      };
+    }
+  | { genesis: { boundTo: [] | [Uint8Array | number[]] } };
+export interface MemoryLogManifest {
+  contentRoot: Uint8Array | number[];
+  totalSize: bigint;
+  chunks: Array<MemoryLogChunkRef>;
+}
+export type MemoryLogOp =
+  | { set: { manifest: MemoryLogManifest } }
+  | {
+      exported: {
+        toSeq: bigint;
+        opsRoot: Uint8Array | number[];
+        fromSeq: bigint;
+        authorFilter: [] | [Principal];
+      };
+    }
+  | { imported: MemoryLogImportNote }
+  | { restore: { toVersion: bigint; manifest: MemoryLogManifest } }
+  | {
+      evict: {
+        fromVersion: bigint;
+        evictedRoot: Uint8Array | number[];
+        toVersion: bigint;
+        chunkCount: bigint;
+        byteCount: bigint;
+      };
+    }
+  | {
+      append: {
+        deltaHash: Uint8Array | number[];
+        deltaSize: bigint;
+        newSize: bigint;
+      };
+    }
+  | { tombstone: null }
+  | {
+      condense: {
+        toSeq: bigint;
+        opsRoot: Uint8Array | number[];
+        fromSeq: bigint;
+        headAtBoundary: Uint8Array | number[];
+        opCount: bigint;
+      };
+    };
+export interface MemoryMaintainStatus {
+  attachOk: boolean;
+  attachDetail: string;
+  totalEvictions: bigint;
+  refusedQuota: string;
+  more: boolean;
+  lastEvictions: bigint;
+  lastScrubbed: bigint;
+  lastMaintainAtNs: [] | [bigint];
+  totalFindings: bigint;
+  refused: boolean;
+}
+export interface MemoryRangeExport {
+  seq: bigint;
+  toSeq: bigint;
+  opsRoot: Uint8Array | number[];
+  atNs: bigint;
+  head: Uint8Array | number[];
+  fromSeq: bigint;
+  authorFilter: [] | [Principal];
+}
+export interface MemoryRetentionPolicy {
+  entries: Array<[string, RetentionClassSpec]>;
+  guards: Array<{ notBeforeNs: bigint; prefix: string }>;
+}
+export type MemorySource =
+  | { sessionTranscript: null }
+  | { human: null }
+  | { fileSync: null }
+  | { agentDerived: null }
+  | { deterministic: null };
+export interface MemoryVersionSummary {
+  by: Principal;
+  seq: bigint;
+  contentRoot: Uint8Array | number[];
+  atNs: bigint;
+  kind: { set: null } | { restore: null } | { append: null } | { tombstone: null };
+  size: bigint;
+  version: bigint;
+}
+export interface OwnerConsole {
+  pendingApprovalCount: bigint;
+  memoryKeyEpoch: bigint;
+  owner: [] | [Principal];
+  agentRevisablePathCount: bigint;
+  protectedPathCount: bigint;
+  cyclesBalance: bigint;
+  unknownSessionRefusals: bigint;
+}
+export interface OwnerRow {
+  pairedDay: bigint;
+  lastPaymentDay: [] | [bigint];
+  root: Principal;
+  weeks: bigint;
+  produced: bigint;
+  firstPaymentDay: [] | [bigint];
+}
+export interface OwnershipTransfer {
+  to: Principal;
+  atNs: bigint;
+  from: [] | [Principal];
+  authorizedBy: Principal;
+}
+export interface Page {
+  total: bigint;
+  withheld: bigint;
+  items: Array<Repudiation>;
+}
+export interface Page_1 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<AuditEntry>;
+}
+export interface Page_10 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<GuardianRecord>;
+}
+export interface Page_11 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<{ activeFromNs: bigint; address: string }>;
+}
+export interface Page_12 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<RegisteredType>;
+}
+export interface Page_13 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<string>;
+}
+export interface Page_14 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<CycleSnapshot>;
+}
+export interface Page_15 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<CondenseCheckpointRow>;
+}
+export interface Page_16 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<BearerToken>;
+}
+export interface Page_17 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<BackupMetadata>;
+}
+export interface Page_18 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<{ status: AgentStatus; principal: Principal; name: string }>;
+}
+export interface Page_19 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<AgentRecord>;
+}
+export interface Page_2 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<PurgedAgent>;
+}
+export interface Page_20 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<ActivitySnapshot>;
+}
+export interface Page_21 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<OwnerRow>;
+}
+export interface Page_3 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<AgentPaymentSignatures>;
+}
+export interface Page_4 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<OwnershipTransfer>;
+}
+export interface Page_5 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<EngramSessionState>;
+}
+export interface Page_6 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<ApprovalRequest>;
+}
+export interface Page_7 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<MemoryLogEvent>;
+}
+export interface Page_8 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<{ path: string; version: bigint; lastModifiedAtNs: bigint }>;
+}
+export interface Page_9 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<ExportReceiptRow>;
+}
+export interface Pairing {
+  agent: AgentRecord;
+  trackRecord: TrackRecordNotice;
+}
+export interface PaymentSignature {
+  signature: Uint8Array | number[];
+  asset: [] | [string];
+  publicKey: [] | [Uint8Array | number[]];
+  scheme: string;
+  network: string;
+  sender: string;
+  nonce: Uint8Array | number[];
+  authorization: [] | [Eip3009Authorization];
+}
+export interface PaymentSignatureCounts {
+  day: bigint;
+  marketplace: [] | [MarketplacePaymentSignatures];
+  agents: Page_3;
+  limit: bigint;
+}
+export interface PurgedAgent {
+  principal: Principal;
+  pairedAtNs: bigint;
+  name: string;
+  root: Principal;
+  enrolledKey: Principal;
+  ended: AgentEnding;
+  invite: string;
+  purgedAtNs: bigint;
+}
+export interface RailHealth {
+  sessionsExpired: bigint;
+  sessionsClosed: bigint;
+  paidVouchersConsumed: bigint;
+  escrowOpen: [] | [bigint];
+  sessionsOpen: bigint;
+  sessionsClosing: bigint;
+  cycles: bigint;
+  sendHeadroom: bigint;
+  memoryBytes: bigint;
+  freezeReservation: bigint;
+  unknownSessionRefusals: bigint;
+}
+export interface ReceiptPage {
+  firstAvailableSeq: bigint;
+  page: Page_9;
+  scannedThroughSeq: bigint;
+}
+export interface RegisteredType {
+  primaryType: string;
+  encodeTypeString: string;
+  cooloffEndsAtNs: bigint;
+  domainName: string;
+  typeId: Uint8Array | number[];
+  verifyingContract: string;
+  dailySignCap: bigint;
+  fields: Array<[string, string]>;
+  domainSeparator: Uint8Array | number[];
+  destinationFields: Array<string>;
+  authorityClass: AuthorityClass;
+  typeHash: Uint8Array | number[];
+  registeredAtNs: bigint;
+  chainId: bigint;
+  domainVersion: string;
+  ackIrrevocable: boolean;
+}
+export interface Repudiation {
+  atNs: bigint;
+  path: string;
+  auditId: bigint;
+  version: bigint;
+  reason: string;
+}
+export interface ResetReport {
+  agentsRemoved: bigint;
+  agentsPurged: bigint;
+  guardiansRemoved: bigint;
+  filesCleared: bigint;
+}
+export type Result = { Ok: WriteReceipt } | { Err: Error };
+export type Result_1 = { Ok: null } | { Err: Error };
+export type Result_10 = { Ok: BackupRetentionReport } | { Err: Error };
+export type Result_11 = { Ok: MemoryFile } | { Err: Error };
+export type Result_12 = { Ok: SessionContext } | { Err: Error };
+export type Result_13 = { Ok: ResyncReport } | { Err: Error };
+export type Result_14 = { Ok: ResetReport } | { Err: Error };
+export type Result_15 = { Ok: GuardianRecord } | { Err: Error };
+export type Result_16 = { Ok: MemoryByteChunk } | { Err: Error };
+export type Result_17 = { Ok: Array<BatchReadItem> } | { Err: Error };
+export type Result_18 = { Ok: CondensePreview } | { Err: Error };
+export type Result_19 = { Ok: Pairing } | { Err: Error };
+export type Result_2 = { Ok: ControlHandover } | { Err: Error };
+export type Result_20 = { Ok: EngramSessionState } | { Err: Error };
+export type Result_21 = { Ok: Principal } | { Err: Error };
+export type Result_22 = { Ok: Page } | { Err: Error };
+export type Result_23 = { Ok: Page_1 } | { Err: Error };
+export type Result_24 = { Ok: Page_2 } | { Err: Error };
+export type Result_25 = { Ok: PaymentSignatureCounts } | { Err: Error };
+export type Result_26 = { Ok: Page_4 } | { Err: Error };
+export type Result_27 = { Ok: Page_5 } | { Err: Error };
+export type Result_28 = { Ok: Page_6 } | { Err: Error };
+export type Result_29 = { Ok: LogPage } | { Err: Error };
+export type Result_3 = { Ok: X402SignOutcome } | { Err: Error };
+export type Result_30 = { Ok: Page_8 } | { Err: Error };
+export type Result_31 = { Ok: ReceiptPage } | { Err: Error };
+export type Result_32 = { Ok: Page_10 } | { Err: Error };
+export type Result_33 = { Ok: Page_11 } | { Err: Error };
+export type Result_34 = { Ok: Page_12 } | { Err: Error };
+export type Result_35 = { Ok: Page_13 } | { Err: Error };
+export type Result_36 = { Ok: Page_14 } | { Err: Error };
+export type Result_37 = { Ok: CheckpointPage } | { Err: Error };
+export type Result_38 = { Ok: Page_16 } | { Err: Error };
+export type Result_39 = { Ok: Page_17 } | { Err: Error };
+export type Result_4 = { Ok: Eip712SignatureOut } | { Err: Error };
+export type Result_40 = { Ok: Page_18 } | { Err: Error };
+export type Result_41 = { Ok: Page_19 } | { Err: Error };
+export type Result_42 = { Ok: Page_20 } | { Err: Error };
+export type Result_43 = { Ok: string } | { Err: Error };
+export type Result_44 = { Ok: boolean } | { Err: Error };
+export type Result_45 = { Ok: [] | [string] } | { Err: Error };
+export type Result_46 = { Ok: WorldIdRpContext } | { Err: Error };
+export type Result_47 = { Ok: WorldIdConfig } | { Err: Error };
+export type Result_48 = { Ok: WalletBalances } | { Err: Error };
+export type Result_49 = { Ok: StorageReport } | { Err: Error };
+export type Result_5 = { Ok: SignatureCounts } | { Err: Error };
+export type Result_50 = { Ok: SpendingPolicy } | { Err: Error };
+export type Result_51 = { Ok: SpendCeiling } | { Err: Error };
+export type Result_52 = { Ok: SigningFloorStatus } | { Err: Error };
+export type Result_53 = { Ok: { paths: Array<string> } } | { Err: Error };
+export type Result_54 = { Ok: OwnerConsole } | { Err: Error };
+export type Result_55 = { Ok: MemoryRetentionPolicy } | { Err: Error };
+export type Result_56 = { Ok: MemoryHistory } | { Err: Error };
+export type Result_57 = { Ok: AlertStatus } | { Err: Error };
+export type Result_58 = { Ok: EvmAddresses } | { Err: Error };
+export type Result_59 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_6 = { Ok: RailHealth } | { Err: Error };
+export type Result_60 = { Ok: ChildOpening } | { Err: Error };
+export type Result_61 = { Ok: ChildAllowanceRow } | { Err: Error };
+export type Result_62 = { Ok: BackupMetadata } | { Err: Error };
+export type Result_63 = { Ok: AgentWriteReview } | { Err: Error };
+export type Result_64 = { Ok: Page_21 } | { Err: Error };
+export type Result_66 = { Ok: MemoryRangeExport } | { Err: Error };
+export type Result_67 = { Ok: CondenseResult } | { Err: Error };
+export type Result_68 = { Ok: { activatesAtNs: bigint } } | { Err: Error };
+export type Result_69 = { Ok: Eip712Registration } | { Err: Error };
+export type Result_7 = { Ok: Array<Seat> } | { Err: Error };
+export type Result_70 = { Ok: AgentRecord } | { Err: Error };
+export type Result_8 = { Ok: bigint } | { Err: Error };
+export type Result_9 = { Ok: SignedTransaction } | { Err: Error };
+export interface ResyncReport {
+  startsAcknowledged: bigint;
+  cannotBeRecorded: Array<UnrecordableEngagement>;
+  endingsAcknowledged: bigint;
+  notRecorded: Array<{
+    why: string;
+    principal: Principal;
+    root: Principal;
+    event: string;
+  }>;
+}
+export type RetentionClassSpec =
+  | { vault: null }
+  | {
+      working: {
+        maxVersions: [] | [bigint];
+        maxBytes: [] | [bigint];
+        thinning: { tail: null } | { logSpaced: { denseTail: bigint } };
+      };
+    };
+export type Role =
+  | { Anonymous: null }
+  | { Viewer: null }
+  | { Engram: null }
+  | { Root: null }
+  | { Buyer: null }
+  | { WasmAdmin: null }
+  | { Guardian: null }
+  | { Seller: null }
+  | { Admin: null }
+  | { Agent: null }
+  | { Other: null }
+  | { Owner: null };
+export interface Seat {
+  pairedDay: bigint;
+  lastPaymentDay: [] | [bigint];
+  weeks: bigint;
+  produced: bigint;
+  firstPaymentDay: [] | [bigint];
+}
+export interface ServiceEntry {
+  endpoint: string;
+  name: string;
+  version: string;
+  domains: Array<string>;
+  skills: Array<string>;
+}
+export interface SessionConfig {
+  autoClose: boolean;
+  idleTimeout: [] | [bigint];
+  maxDeposit: bigint;
+}
+export interface SessionContext {
+  files: Array<MemoryFile>;
+  totalFiles: bigint;
+  truncated: boolean;
+  includedFiles: bigint;
+  totalBytes: bigint;
+}
+export interface SessionIntent {
+  token: string;
+  costPerCall: [] | [bigint];
+  minDeposit: [] | [bigint];
+  recipient: string;
+  network: string;
+  description: [] | [string];
+  expiryNs: bigint;
+  suggestedDeposit: bigint;
+}
+export interface SignatureCounts {
+  total: bigint;
+  byCaller: Array<CallerSignatureCount>;
+}
+export interface SignedAuthorization {
+  paidAmount: bigint;
+  authorization: {
+    to: string;
+    signature: string;
+    value: bigint;
+    from: string;
+    validAfter: bigint;
+    nonce: string;
+    validBefore: bigint;
+  };
+  header: string;
+}
+export interface SignedTransaction {
+  txHash: string;
+  rawTx: string;
+}
+export interface SigningFloorStatus {
+  floor: bigint;
+  signaturesAboveFloor: bigint;
+  balance: bigint;
+  perSignature: bigint;
+}
+export interface SpendCeiling {
+  spentToday: bigint;
+  maxPerDay: [] | [bigint];
+}
+export interface SpendingPolicy {
+  maxSessionDeposit: [] | [bigint];
+  blockedCallers: [] | [Array<Principal>];
+  maxPerDay: [] | [bigint];
+  maxSessionDuration: [] | [bigint];
+  sessionIdleTimeout: [] | [bigint];
+  rateLimitPerMinute: [] | [bigint];
+  maxPerTransaction: [] | [bigint];
+  allowedCallers: [] | [Array<Principal>];
+  maxConcurrentSessions: [] | [bigint];
+}
+export interface StorageReport {
+  sessionFilesSize: bigint;
+  totalFiles: bigint;
+  memoryFilesSize: bigint;
+  totalContentSize: bigint;
+  backupCount: bigint;
+  memoryFilesCount: bigint;
+  versionHistorySize: bigint;
+  fileLimit: bigint;
+  backupSize: bigint;
+  auditLogSize: bigint;
+  versionHistoryCount: bigint;
+  sessionFilesCount: bigint;
+}
+export interface TimerHealth {
+  jobExpiryFastMode: boolean;
+  jobExpiryArmed: boolean;
+  alertTimerArmed: boolean;
+  sessionExpiryArmed: boolean;
+}
+export type TokenAmount = { Icp: bigint } | { Ckusdc: bigint } | { Ckusdt: bigint };
+export type TrackRecordNotice = { Recorded: null } | { NotRecorded: string };
+export interface UnrecordableEngagement {
+  principal: Principal;
+  root: Principal;
+  ended: AgentEnding;
+  invite: string;
+}
+export interface Voucher {
+  signature: Uint8Array | number[];
+  sessionId: string;
+  sequence: bigint;
+  cumulativeAmount: bigint;
+}
+export interface WalletBalances {
+  icpE8s: bigint;
+  ckusdcE6s: bigint;
+  ckusdtE6s: bigint;
+  cycles: bigint;
+}
+export interface WorldIdConfig {
+  action: string;
+  appId: string;
+  rpId: string;
+  configured: boolean;
+}
+export interface WorldIdRpContext {
+  signature: string;
+  expiresAt: bigint;
+  createdAt: bigint;
+  rpId: string;
+  nonce: string;
+}
+export interface WriteReceipt {
+  seq: bigint;
+  head: Uint8Array | number[];
+  version: bigint;
+}
+export type X402SignOutcome =
+  { ApprovalPending: ApprovalRequest } | { Signed: SignedAuthorization };
+export interface _SERVICE extends Engram {}
+export declare const idlFactory: IDL.InterfaceFactory;
+export declare const init: (args: { IDL: typeof IDL }) => IDL.Type[];