@engramx/idl 0.16.0-rc.1

package/dist/market.did

@@ -0,0 +1,1402 @@
+type X402Endpoint = 
+ record {
+   contentId: opt text;
+   createdAtNs: int;
+   createdBy: principal;
+   description: text;
+   enabledAtNs: opt int;
+   enabledBy: opt principal;
+   id: text;
+   name: text;
+   price: nat;
+   status: EndpointStatus;
+   suggestedPrice: nat;
+   totalPurchases: nat;
+   totalRevenue: nat;
+ };
+type VerificationMethod = 
+ variant {
+   AutoSettle;
+   BuyerConfirm: record {disputeWindowSeconds: nat;};
+   HashMatch;
+   ZkGroth16:
+    record {
+      bindResult: bool;
+      verificationKey: blob;
+      verifierCanister: principal;
+    };
+ };
+type TokenAmount = 
+ variant {
+   Ckusdc: nat;
+   Ckusdt: nat;
+   Icp: nat;
+ };
+type SpendingPolicy = 
+ record {
+   allowedCallers: opt vec principal;
+   blockedCallers: opt vec principal;
+   maxConcurrentSessions: opt nat;
+   maxPerDay: opt nat;
+   maxPerTransaction: opt nat;
+   maxSessionDeposit: opt nat;
+   maxSessionDuration: opt int;
+   rateLimitPerMinute: opt nat;
+   sessionIdleTimeout: opt int;
+ };
+type SessionStatus = 
+ variant {
+   closed;
+   closing;
+   expired;
+   open;
+   other: text;
+ };
+type SessionState = 
+ record {
+   consumed: nat;
+   deposited: nat;
+   id: text;
+   lastActivityAtNs: int;
+   openedAtNs: int;
+   payer: Payer;
+   remaining: nat;
+   status: SessionStatus;
+   voucherCount: nat;
+ };
+type SessionIntent = 
+ record {
+   costPerCall: opt nat;
+   description: opt text;
+   expiryNs: int;
+   minDeposit: opt nat;
+   network: text;
+   recipient: text;
+   suggestedDeposit: nat;
+   token: text;
+ };
+type SessionCounts = 
+ record {
+   closed: nat;
+   closing: nat;
+   expired: nat;
+   open: nat;
+   total: nat;
+ };
+type SessionConfig = 
+ record {
+   autoClose: bool;
+   idleTimeout: opt int;
+   maxDeposit: nat;
+ };
+type ServiceType = 
+ variant {
+   Async;
+   Sync;
+ };
+type ServiceRequestResponse = 
+ variant {
+   Accepted: record {jobId: text;};
+   PaymentRequired: vec PaymentRequirement;
+ };
+type ServiceDeliveryMethod = 
+ variant {
+   Both;
+   Callback;
+   Poll;
+ };
+type ServiceDefinition = 
+ record {
+   createdAt: int;
+   delivery: ServiceDeliveryMethod;
+   description: text;
+   enabled: bool;
+   id: text;
+   name: text;
+   operatorId: principal;
+   pricing: PricingScheme;
+   serviceType: ServiceType;
+   timeout: nat;
+   verification: VerificationMethod;
+ };
+type SellerStatus = 
+ record {
+   byteQuota: nat;
+   bytesStored: nat;
+   engramId: principal;
+   expiresAtNs: int;
+   verifiedAtNs: int;
+ };
+type RoleGrant = 
+ record {
+   holder: principal;
+   role: variant {
+           Admin;
+           Other: text;
+           Root;
+           WasmAdmin;
+         };
+ };
+type Role = 
+ variant {
+   Admin;
+   Agent;
+   Anonymous;
+   Buyer;
+   Engram;
+   Guardian;
+   Other;
+   Owner;
+   Root;
+   Seller;
+   Viewer;
+   WasmAdmin;
+ };
+type RevenueSummary = 
+ record {
+   contentPurchases: nat;
+   contentRevenue: nat;
+   endpointBreakdown:
+    vec record {
+          endpointId: text;
+          name: text;
+          purchases: nat;
+          revenue: nat;
+        };
+   owedToYou: nat;
+   serviceJobsSettled: nat;
+   serviceRevenue: nat;
+   unresolvedWithdrawals: nat;
+ };
+type Result_9 = 
+ variant {
+   Err: Error;
+   Ok: Page_7;
+ };
+type Result_8 = 
+ variant {
+   Err: Error;
+   Ok: Page_5;
+ };
+type Result_7 = 
+ variant {
+   Err: Error;
+   Ok: Page_4;
+ };
+type Result_6 = 
+ variant {
+   Err: Error;
+   Ok: Page_2;
+ };
+type Result_5 = 
+ variant {
+   Err: Error;
+   Ok: Page_1;
+ };
+type Result_4 = 
+ variant {
+   Err: Error;
+   Ok: SessionState;
+ };
+type Result_3 = 
+ variant {
+   Err: Error;
+   Ok: PaymentQuote;
+ };
+type Result_2 = 
+ variant {
+   Err: Error;
+   Ok: text;
+ };
+type Result_18 = 
+ variant {
+   Err: Error;
+   Ok: X402Endpoint;
+ };
+type Result_17 = 
+ variant {
+   Err: Error;
+   Ok: ServiceRequestResponse;
+ };
+type Result_16 = 
+ variant {
+   Err: Error;
+   Ok: ContentResponse;
+ };
+type Result_15 = 
+ variant {
+   Err: Error;
+   Ok: opt text;
+ };
+type Result_14 = 
+ variant {
+   Err: Error;
+   Ok: Job;
+ };
+type Result_13 = 
+ variant {
+   Err: Error;
+   Ok: blob;
+ };
+type Result_12 = 
+ variant {
+   Err: Error;
+   Ok: JobStatus;
+ };
+type Result_11 = 
+ variant {
+   Err: Error;
+   Ok: RevenueSummary;
+ };
+type Result_10 = 
+ variant {
+   Err: Error;
+   Ok: SellerStatus;
+ };
+type Result_1 = 
+ variant {
+   Err: Error;
+   Ok;
+ };
+type Result = 
+ variant {
+   Err: Error;
+   Ok: nat;
+ };
+type QuotedRequirement = 
+ record {
+   amount: nat;
+   expiryNs: int;
+   network: text;
+   recipient: text;
+   scheme: text;
+   token: text;
+   tokenName: opt text;
+   tokenVersion: opt text;
+ };
+type PurchaseRecord = 
+ record {
+   amount: nat;
+   buyer: Payer;
+   endpointId: text;
+   id: text;
+   network: text;
+   receiptId: text;
+   timestampNs: int;
+   txHash: opt text;
+ };
+type PricingScheme = 
+ variant {
+   Exact: nat;
+   Session;
+   Upto: nat;
+ };
+type PendingWithdrawal = 
+ record {
+   amountE6s: nat;
+   createdAtTimeNs: nat64;
+   id: nat;
+   parkedAtNs: int;
+   reason: text;
+   seller: principal;
+ };
+type PaymentSignature = 
+ record {
+   asset: opt text;
+   authorization: opt Eip3009Authorization;
+   network: text;
+   nonce: blob;
+   publicKey: opt blob;
+   scheme: text;
+   sender: text;
+   signature: blob;
+ };
+type PaymentRequirement = 
+ record {
+   amount: nat;
+   expiry: int;
+   network: text;
+   nonce: blob;
+   recipient: text;
+   scheme: text;
+   token: text;
+   tokenName: opt text;
+   tokenVersion: opt text;
+ };
+type PaymentQuote = 
+ record {
+   amountE6: nat;
+   requirements: vec QuotedRequirement;
+ };
+type Payer = 
+ variant {
+   Evm: text;
+   Icp: principal;
+ };
+type ParkedTx = 
+ record {
+   chainId: nat;
+   leg: ParkedLeg;
+   parkedAt: int;
+   token: text;
+   txHash: text;
+ };
+type ParkedLeg = 
+ variant {
+   Refund;
+   Settle;
+   UptoRemainder;
+ };
+type Page_7 = 
+ record {
+   items: vec principal;
+   total: nat;
+   withheld: nat;
+ };
+type Page_6 = 
+ record {
+   items: vec ContentEntry;
+   total: nat;
+   withheld: nat;
+ };
+type Page_5 = 
+ record {
+   items: vec AuditEntry;
+   total: nat;
+   withheld: nat;
+ };
+type Page_4 = 
+ record {
+   items: vec PurchaseRecord;
+   total: nat;
+   withheld: nat;
+ };
+type Page_3 = 
+ record {
+   items: vec X402Endpoint;
+   total: nat;
+   withheld: nat;
+ };
+type Page_2 = 
+ record {
+   items: vec Job;
+   total: nat;
+   withheld: nat;
+ };
+type Page_1 = 
+ record {
+   items: vec PendingWithdrawal;
+   total: nat;
+   withheld: nat;
+ };
+type Page = 
+ record {
+   items: vec ServiceDefinition;
+   total: nat;
+   withheld: nat;
+ };
+type JobStatus = 
+ variant {
+   Assigned;
+   Computing;
+   Disputed;
+   Expired;
+   Pending;
+   Refunded;
+   Settled;
+   Settling;
+   Submitted;
+   Verified;
+   other: text;
+ };
+type JobCounts = 
+ record {
+   active: nat;
+   expired: nat;
+   parked: nat;
+   refunded: nat;
+   settled: nat;
+   settling: nat;
+   total: nat;
+ };
+type Job = 
+ record {
+   actualCost: opt nat;
+   amount: nat;
+   buyer: text;
+   completedAtNs: opt int;
+   createdAtNs: int;
+   deliveryCallback: opt text;
+   expiresAtNs: int;
+   id: text;
+   operator: opt principal;
+   params: blob;
+   parkedTx: opt ParkedTx;
+   paymentReceiptId: text;
+   proof: opt blob;
+   result: opt blob;
+   serviceId: text;
+   status: JobStatus;
+ };
+type HttpResponse = 
+ record {
+   body: blob;
+   headers: vec record {
+                  text;
+                  text;
+                };
+   status_code: nat16;
+   upgrade: opt bool;
+ };
+type HttpRequest = 
+ record {
+   body: blob;
+   headers: vec record {
+                  text;
+                  text;
+                };
+   method: text;
+   url: text;
+ };
+type GenesisNote = 
+ record {
+   genesisAtNs: int;
+   note: text;
+   predecessorHeadHash: opt blob;
+   predecessorSize: opt nat;
+   version: text;
+ };
+type Error = 
+ variant {
+   Conflict: text;
+   Invalid: text;
+   NotFound: text;
+   Other: text;
+   Refused: text;
+   Unavailable: text;
+ };
+type EndpointStatus = 
+ variant {
+   Deleted;
+   Disabled;
+   Enabled;
+ };
+type Eip3009Authorization = 
+ record {
+   from: text;
+   nonce: blob;
+   r: blob;
+   s: blob;
+   to: text;
+   v: nat8;
+   validAfter: nat;
+   validBefore: nat;
+   value: nat;
+ };
+type DeliveryMethod = 
+ variant {
+   assetCanister: record {
+                    canisterId: principal;
+                    path: text;
+                  };
+   canisterQuery: record {
+                    chunkCount: nat;
+                    method: text;
+                  };
+   httpUrl: text;
+   inline: blob;
+ };
+type ContentResponse = 
+ variant {
+   Delivered: ContentDelivery;
+   PaymentRequired: vec PaymentRequirement;
+ };
+type ContentRef = 
+ record {
+   id: text;
+   metadata: opt vec record {
+                       text;
+                       text;
+                     };
+   mimeType: opt text;
+   sizeBytes: opt nat;
+ };
+type ContentEntry = 
+ record {
+   chunkCount: nat;
+   createdAt: int;
+   id: text;
+   mimeType: text;
+   totalSize: nat;
+ };
+type ContentDelivery = 
+ record {
+   delivery: DeliveryMethod;
+   grant: AccessGrant;
+   settlementTxHash: opt text;
+ };
+type CertifiedAuditHead = 
+ record {
+   certificate: opt blob;
+   headHash: blob;
+   size: nat;
+   total: nat;
+   witness: opt blob;
+ };
+type AuditHead = 
+ record {
+   headHash: blob;
+   size: nat;
+ };
+type AuditEntry = 
+ record {
+   caller: principal;
+   callerRole: Role;
+   details: text;
+   entryHash: blob;
+   id: nat;
+   operation: text;
+   success: bool;
+   timestampNs: int;
+ };
+type AdminRoles = record {roles: vec RoleGrant;};
+type AccessGrant = 
+ record {
+   contentRef: ContentRef;
+   expiresAt: int;
+   grantId: text;
+   grantee: principal;
+   hmac: blob;
+   issuedAt: int;
+   receiptId: text;
+ };
+service : {
+  addAuditViewer: (viewer: principal) -> (Result_1);
+  /// Push this canister's chain head into the registry's anchor ring — the same thing every engram
+  /// does with its memory head, and the cashier with its treasury head.
+  /// 
+  /// L12's argument applies to escrow with full force: a self-attested commerce ledger sitting
+  /// beside witnessed ones is the asymmetry an auditor finds first. Every chain in this system is
+  /// witnessed by a party that does not control it, or the phrase means nothing.
+  /// 
+  /// Best-effort and isolated: a registry that is slow or down must never take the market with it.
+  /// The FAILURE IS RECORDED rather than swallowed — an anchor push that silently stopped would
+  /// leave the chain looking witnessed while it was not, which is worse than a visibly missing one.
+  /// 
+  /// ⟨RENAMED 2026-10-02 from `sysAnchorNow`, with `setRegistryId` and for the same reason: its
+  /// caller is the market's admin, a person, so it does not belong to the canister-to-canister
+  /// tier the `sys` prefix names.⟩
+  anchorNow: () -> (Result_1);
+  /// A seller takes on a pending job. The CALLER must be the seller of the service the job was
+  /// created against — claiming is not open, and there is no assignment step: whoever registered
+  /// the service claims its work.
+  /// 
+  /// ⚠ EVERY FAILURE ARRIVES AS `#Conflict`, INCLUDING ONES THAT ARE NOT CONFLICTS. The refusals
+  /// come from the vendored ic402 service registry as plain strings, so the arm is already lost
+  /// when this method sees them. `#Conflict` here therefore covers FOUR distinct situations:
+  ///   · the job does not exist        ⟶ properly `#NotFound`
+  ///   · the service does not exist    ⟶ properly `#NotFound`
+  ///   · the job is not pending        ⟶ properly `#Conflict`
+  ///   · **you are not the seller**  ⟶ properly `#Refused`
+  /// 
+  /// **Read the MESSAGE, not the arm, on this method only.** That is the opposite of what L1 asks
+  /// everywhere else, and it is stated here rather than left to be discovered: a caller branching
+  /// on the arm will retry a call that can never succeed for it. Recovering the distinction needs
+  /// the LIBRARY to carry arms — matching its prose here would reintroduce exactly the
+  /// message-branching L1 abolished, and would break silently on an ic402 bump. ⟨Recorded with
+  /// three costed options in the project's backlog, 2026-08-21. This is the market's whole ic402
+  /// seam, not one method: 6 call sites collapse a module error into `#Conflict`.⟩
+  /// ⟨2026-10-02 — counted again, and ruled.⟩ ELEVEN sites on this market collapse an ic402 text
+  /// into `#Conflict`, not 6: `setServiceEnabled`, `claimJob`, `submitJobResult`, `confirmJob`,
+  /// `disputeJob`, `resolveDispute`, `reconcileSession`, `forceResolveSession`, `recoverEscrow`,
+  /// `reconcileJob`, `resolveJob` — each now carries its own audited caveat. Four can carry a
+  /// refusal of the caller's standing — `claimJob`, `confirmJob`, `disputeJob` and `submitJobResult`;
+  /// `setServiceEnabled`, the fourth noted on 2026-08-21, is now gated by this canister before the
+  /// library is called; the other six are state behind this canister's own gate. Read-the-message
+  /// is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
+  /// recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
+  /// not a change made mid-cut.
+  /// 
+  /// It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
+  /// so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
+  /// ungated read that confirms it.
+  claimJob: (jobId: text) -> (Result_1);
+  /// ⟨0.16.0, L2.6⟩ `confirmJob` ABSORBS `confirmJobEvm`. One buyer action, two ways to prove you
+  /// are the buyer.
+  /// 
+  /// The pair existed because authorization arrives differently on the two rails, not because the
+  /// ACT differs: both release escrow to the seller. An ICP-rail buyer proves identity by calling
+  /// as their principal; an EVM-rail buyer has no principal here at all, so they prove it with a
+  /// secp256k1 signature over `getBuyerActionMessage`, which ic402 ecRecovers and compares to the job's
+  /// stored 0x buyer. `evmProof = null` means "authorize me as the caller".
+  /// 
+  /// THE HARDENING IS ON THE SIGNATURE BRANCH ONLY, and deliberately so. That branch is
+  /// ANONYMOUS and does real work — an ecRecover plus, on success, an on-chain settle — so it is
+  /// griefable by anyone: it keeps the cycles floor (protect the canister's balance from drain) and
+  /// the per-caller rate limit. Applying the same rate limit to the principal branch would throttle
+  /// identified buyers to defend against a threat that branch does not have.
+  /// 
+  /// ⚠ `#Conflict` HERE ALSO COVERS "NOT THE BUYER", which is a refusal and not a conflict. The
+  /// underlying ic402 registry returns plain strings, so the arm is gone before this method sees
+  /// it: `Job not found` (properly `#NotFound`), `Job not in submitted status` (properly
+  /// `#Conflict`) and **`Not the buyer`** (properly `#Refused`) all arrive as `#Conflict`. On THIS
+  /// method read the MESSAGE rather than the arm — it is terminal money settlement, so a caller
+  /// who reads `#Conflict` as "retry later" will retry a release that can never happen for them.
+  /// Same seam as `claimJob`; three costed fixes in the project's backlog ⟨2026-08-21⟩.
+  confirmJob: (jobId: text, evmProof: opt vec nat8) -> (Result_1);
+  /// Create a content endpoint — a shelf in the storefront. Born DISABLED.
+  /// 
+  /// Born disabled deliberately: a listing that went live at creation would be sellable before its
+  /// price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
+  createEndpoint: (name: text, description: text, contentId: text,
+   suggestedPriceE6: nat) -> (Result_18);
+  /// Submit a paid service request. Returns a job id, or the price.
+  /// 
+  /// ⟨0.16.0⟩ TWO GATES FROM THE ENGRAM DO NOT TRAVEL, and both for the same reason: they were the
+  /// engram protecting ITS OWNER'S money, which is custody, and custody stayed.
+  /// 
+  ///   · `requireAgentOrOwner` — the engram only let its own agents spend its funds. Here the
+  ///     caller is a BUYER paying with their own signature; gating that to a roster would mean a
+  ///     marketplace only its own staff could buy from.
+  ///   · `approvalId` / `#approvalPending` — an approval is the buyer's own spend policy, checked on
+  ///     their engram before they call. Two arms and a parameter disappear because the
+  ///     responsibility moved, not because a check was dropped.
+  /// 
+  /// What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
+  createJob: (serviceId: text, params: blob, paymentSig:
+   opt PaymentSignature) -> (Result_17);
+  /// Delete content.
+  /// 
+  /// ⚠ THE QUOTA IS NOT REFUNDED, and this is the honest part of the design rather than a
+  /// meanness. The memory is not returned to the subnet when the entry goes — enhanced orthogonal
+  /// persistence never shrinks — so crediting the bytes back would let one seller cycle uploads
+  /// forever against a ceiling that only ever rose in reality. The quota tracks bytes CLAIMED, not
+  /// bytes currently held, because claimed is the number that costs money.
+  deleteContent: (id: text) -> (Result_1);
+  /// Delete an endpoint. Terminal — the record stays as #Deleted so purchase history keeps
+  /// resolving, and the id is never reused.
+  deleteEndpoint: (endpointId: text) -> (Result_1);
+  /// ⟨0.16.0, L2.6⟩ `disputeJob` ABSORBS `disputeJobEvm`, exactly as confirmJob does, and for the
+  /// same reason: one act, two proofs of buyership.
+  /// 
+  /// NOT FREEZE-GATED, and that asymmetry with confirmJob is deliberate. Recording a dispute moves
+  /// no money — it marks the job #Disputed, and any refund happens later through resolveDispute or
+  /// a timeout. A buyer must be able to say "this is wrong" DURING an emergency freeze; a freeze
+  /// that silenced complaints would protect the market from its own buyers.
+  /// 
+  /// ⚠ `#Conflict` HERE ALSO COVERS "NOT THE BUYER" — same ic402 seam as `confirmJob` and
+  /// `claimJob`: `Job not found`, `Job not in submitted status` and **`Not the buyer`** all arrive
+  /// as `#Conflict` because the library hands back strings. Read the MESSAGE, not the arm.
+  /// ⟨2026-08-21; the project's backlog carries the three fixes and why none is a one-liner.⟩
+  /// 
+  /// ⚠ AND NOTE WHERE THE DISPUTE GOES: `resolveDispute` is answered by the SERVICE'S OWN SELLER
+  /// — the party being disputed. This market has no admin arbitration and no appeal, deliberately
+  /// and on the record. Filing a dispute is not an escalation to a neutral party.
+  disputeJob: (jobId: text, reason: text, evmProof: opt vec nat8) ->
+   (Result_1);
+  /// Closing refunds the unconsumed deposit to the payer, so it is NOT freeze-gated — the same
+  /// reasoning as disputeJob and forceCloseSession. A halt stops money moving toward sellers; it
+  /// must not strand a buyer's own escrow.
+  endSession: (sessionId: text) -> (Result_1);
+  /// Admin recovery: force a stuck session closed and return the unconsumed deposit to its payer.
+  /// 
+  /// Documented in RECOVERY-RUNBOOK as an owner procedure; on a shared canister the equivalent
+  /// authority is the market admin, because the session's own parties are precisely who cannot
+  /// unstick it. No discretion: the refund destination is the payer recorded on the session.
+  forceCloseSession: (sessionId: text) -> (Result_1);
+  /// Admin recovery: mark a stuck session resolved. STATE ONLY — no funds move.
+  /// 
+  /// Kept distinct from forceCloseSession, which refunds, because the two are different admissions.
+  /// This one says "the accounting is already right and the record is wrong"; that one says "return
+  /// what is left". Merging them would let a state repair silently move money.
+  /// 
+  /// NOT freeze-gated, and the asymmetry is the point: a freeze halts SETTLEMENT, and this settles
+  /// nothing. An admin must be able to repair a record during the halt that made the record wrong.
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (session missing, or not stuck in #closing) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  forceResolveSession: (sessionId: text) -> (Result_1);
+  /// PUBLIC: accountability requires knowing who holds power. This is the shape every canister
+  /// in the system serves, so one reader covers all of them.
+  getAdminRoles: () -> (AdminRoles) query;
+  /// PUBLIC: a head exists to be compared. A head nobody can read witnesses nothing.
+  getAuditHead: () -> (AuditHead) query;
+  /// The exact message an EVM buyer signs (keccak256 of it) to confirm or dispute a job.
+  /// 
+  /// PUBLIC: it must be, since the caller who needs it is by definition unauthenticated here.
+  /// It binds action + job + THIS canister, so a signature cannot be replayed across actions, across
+  /// jobs, or onto another market.
+  getBuyerActionMessage: (action: text, jobId: text) -> (text) query;
+  /// PUBLIC: the subnet-certified head, so a client verifies against the NNS root rather than
+  /// trusting this replica. `witness` is null until this canister grows a certified tree — an
+  /// honest absence, distinct from an empty proof.
+  getCertifiedAuditHead: () -> (CertifiedAuditHead) query;
+  /// Paid content read. `#PaymentRequired` comes back inside `#Ok` — see Types.ContentResponse for
+  /// why a price is an answer rather than an error.
+  /// 
+  /// The `approvalId` parameter is gone, as it is on openSession: an approval is the BUYER's own
+  /// custody policy, checked on their engram before they call here.
+  /// 
+  /// ⟨L7⟩ UPDATE, NOT QUERY: the paid path awaits `gate.settle(sig, ?amount)`, an inter-canister
+  /// settlement. A query cannot await it, and splitting the free and paid halves into two methods
+  /// would put the price and the content behind different names for one buyer act.
+  /// 
+  /// ⟨2026-09-30, ic402 2.17.0⟩ It now awaits `gate.settleFrom(msg.caller, sig, ?amount)`. On the
+  /// ICP rail a signature's `sender` is only a claim — the payer's ICRC-2 allowance is the whole
+  /// authentication — so `settle` would spend the allowance of whoever the signature named and
+  /// deliver the content to the caller. `settleFrom` refuses unless the caller IS the named sender,
+  /// before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
+  /// ic402's text naming both principals. Pay as the principal that approved the allowance.
+  getContent: (contentId: text, paymentSig: opt PaymentSignature) ->
+   (Result_16);
+  /// ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
+  /// 
+  /// The engram's version was:
+  /// 
+  ///     switch (gate.verifyGrant(msg.caller, grant)) {
+  ///       case (#ok) { contentStore.getChunk(grant.contentRef.id, index) };
+  ///       case (_) { null };
+  ///     };
+  /// 
+  /// `AccessGrantResult` has FOUR arms — `#ok`, `#expired`, `#invalidGrant`, `#revoked` — each
+  /// carrying its own explanatory text. All three failures were collapsed into `null`, which is
+  /// ALSO what the content store returns for "that chunk index does not exist". So a buyer whose
+  /// grant had expired, a buyer whose grant was revoked, and a buyer asking for a chunk past the end
+  /// of a file received byte-identical answers. The information existed — the sibling `verifyGrant`
+  /// returned the full result — and was discarded one line later.
+  /// 
+  /// Worse than uninformative: a buyer who PAID and whose grant expired sees "no such chunk" and
+  /// concludes the content is gone, not that their access lapsed. On a paid rail that is a refund
+  /// request and a support ticket generated by a type.
+  /// 
+  /// The honesty gates could not see it. `gate.verifyGrant` is a PAYMENT gate, and the gate-call
+  /// list they scan holds authorization helpers only — so a refusal fabricated behind a payment
+  /// check was out of scope by construction rather than by ruling. L11 adds payment gates to that
+  /// list; this method is why.
+  getContentChunk: (grant: AccessGrant, index: nat) -> (Result_13) query;
+  /// A seller's payout address — THEIRS, or the admin's to read.
+  /// 
+  /// The engram made this owner-only and TRAPPED at everyone else. Here the answer is a refusal a
+  /// caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
+  /// distinguishable from "you may not ask", which is the whole point of the envelope.
+  getEvmSellerPayout: (seller: principal) -> (Result_15) query;
+  /// PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
+  /// beside a published predecessor head is auditable; a fresh chain with no statement is
+  /// indistinguishable from a wipe.
+  getGenesisNote: () -> (GenesisNote) query;
+  /// ⟨0.16.0, L1⟩ The engram TRAPPED here. Trapping was the right fix at the time — it stopped the
+  /// refusal masquerading as a not-found — but it hands the caller no structured reason and cannot
+  /// be told from a genuine fault. Under L1 the refusal is a value.
+  /// 
+  /// The comment the engram carried is worth keeping because it names what went wrong: `null`
+  /// collapsed "unknown jobId" and "not authorized", and the product rendered the wrong conclusion
+  /// from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
+  /// merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
+  getJob: (jobId: text) -> (Result_14) query;
+  /// PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
+  /// what made `listJobs`' existence-leak justification false.
+  getJobCounts: () -> (JobCounts) query;
+  /// The sharpest of the family, and the one in a money path — the engram's own comment said so.
+  /// 
+  /// `null` there collapsed THREE meanings: unknown jobId, not authorized, and NO RESULT SUBMITTED
+  /// YET. So a refusal presented as a claim about the WORK. Combined with the `buyer : Text` defect,
+  /// an EVM-rail buyer was refused permanently, polled, read `null` as "the seller delivered
+  /// nothing", and escalated to dispute — a fabricated refusal manufacturing a commercial conflict.
+  /// 
+  /// Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
+  /// only labelling it.
+  getJobResult: (jobId: text) -> (Result_13) query;
+  /// Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
+  /// other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
+  /// PUBLIC: a job's state, and nothing else about it.
+  /// 
+  /// ⟨0.16.0⟩ THE UNGATED TWIN OF `getJob`, AND IT MUST STAY UNGATED. `getJob` is allowed to refuse
+  /// precisely because this exists: an EVM-rail buyer has NO PRINCIPAL on this canister, so a
+  /// principal-gated read can never authorize them, and without a public status read they would
+  /// have no way to see the state of a job they paid for. `getJob`'s refusal names this method for
+  /// exactly that reason.
+  /// 
+  /// Job existence is not the secret being kept — the payload is. Status and nothing more.
+  /// 
+  /// The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
+  /// a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
+  getJobStatus: (jobId: text) -> (Result_12) query;
+  /// PUBLIC: the market's spend limits, with the caller rosters REDACTED.
+  /// 
+  /// The limits themselves are already public — they are advertised inside every 402 challenge, so
+  /// withholding them here would hide nothing while making the market unquotable. `allowedCallers`
+  /// and `blockedCallers` are different in kind: an access-control roster, and a world-readable
+  /// blocklist tells everyone who has been blocked. Redacted to `null`, which reads as "not
+  /// disclosed" rather than as "empty" — an empty roster and a withheld one are different facts.
+  /// 
+  /// Reads the GLOBAL policy. The engram called `getPolicy(self)`, i.e. the effective policy for
+  /// the canister acting as its own payer — which silently returns a self-override if one exists,
+  /// so the published limits could differ from the ones actually applied to buyers.
+  getPaymentPolicy: () -> (SpendingPolicy) query;
+  /// and nothing is aggregated across sellers.
+  /// 
+  /// THE FIGURES ARE COMPUTED, NOT READ FROM THE CANISTER-WIDE COUNTERS. `payments`' scalars are
+  /// every seller's money added together; handing them to one seller would overstate their revenue
+  /// by the entire market. Service revenue is derived per seller from settled jobs on services they
+  /// operate.
+  /// 
+  /// Anonymous is refused rather than answered with zeroes. A zero here is a real business fact —
+  /// "you have sold nothing" — and returning it to a caller who simply has no identity is the
+  /// fabricated-empty defect wearing a number instead of a list.
+  getRevenueSummary: () -> (Result_11) query;
+  /// PUBLIC: what a buyer can learn about a seller, and the whole of it.
+  /// 
+  /// The ENGRAM ID is the point of this read. This market runs no reputation system and issues no
+  /// badges, so the honest trust signal is not a verdict we invent — it is a pointer to the record
+  /// the seller already keeps. A buyer who wants to know whether this seller is a verified human,
+  /// what their audit chain says, or how long they have existed asks THAT engram directly, and gets
+  /// an answer this market cannot shade.
+  /// 
+  /// `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
+  /// and the field name is the strongest claim it makes.
+  getSellerStatus: (seller: principal) -> (Result_10) query;
+  /// PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
+  /// which is also what made `listJobs`' old "no existence leak" defence false.
+  getSessionCounts: () -> (SessionCounts) query;
+  http_request: (request: HttpRequest) -> (HttpResponse) query;
+  /// ⟨2026-09-30, ic402 2.17.0⟩ THE TWO PAID ROUTES HERE STAY ON `gate.settle`, AND THAT IS WHY NO
+  /// FLOW MAY LEAVE A STANDING ALLOWANCE TO THIS MARKET. An HTTP request arrives with no caller to
+  /// check (the gateway calls anonymously), so `settleFrom` cannot apply and ic402 says to keep
+  /// `settle` on HTTP paths. Such a settle is authenticated only by the payer's ICRC-2 allowance:
+  /// anyone who names a principal holding an unspent allowance to this canister can spend it here.
+  /// The defence is on the paying side — approve exactly the price plus one ledger fee, expiring
+  /// within minutes, immediately before paying (the SDK's `MarketClient` does). WHAT WOULD MAKE
+  /// THIS WRONG: an HTTP route that could authenticate its payer, or a flow of ours that approves
+  /// more than one payment's worth or without an expiry.
+  /// 
+  /// ⟨CORRECTED 2026-09-30 — the owner's answer "1 B"⟩ The paragraph above is history. No web route
+  /// settles an ICP-rail payment any more, so none spends an allowance and none can be used against
+  /// a standing one. The one `gate.settle` left is on /service/, reached only with an EVM (`eip155:`)
+  /// payment carrying the buyer's own EIP-3009 authorization — a signature that names the payment and
+  /// travels privately in the request. An ICP-rail (ckUSDC) payment offered there is refused before
+  /// any settle and pointed at the Candid `createJob`; /content/ sells nothing over the web
+  /// (`contentNotSoldOverHttp`). ckUSDC is taken only by the Candid calls, which check their caller.
+  /// WHAT WOULD MAKE THIS WRONG: a web route that settles a payment whose network is not `eip155:`.
+  http_request_update: (request: HttpRequest) -> (HttpResponse);
+  /// PUBLIC: a wallet calls this BEFORE its user has any standing here — that is the whole point of
+  /// the call — so gating it would make the message unreadable at exactly the moment it is needed,
+  /// and a signature given without it is a signature given blind.
+  /// 
+  /// ICRC-21 consent messages for this market's own state-changing methods.
+  /// 
+  /// Every canister a signer is asked to sign FOR needs this, or the wallet cannot render what it
+  /// is approving. Two shape facts, both learned from live signer failures and both load-bearing:
+  /// 
+  ///   · `user_preferences : {}` accepts ANY record. The spec nests language at
+  ///     user_preferences.metadata.language, and declaring the flat `{ language }` TRAPPED every
+  ///     real signer's request ("did not find field language in record"; OISY, 2026-07-25).
+  ///     `record {}` is a supertype of every record, so it decodes any signer's preferences without
+  ///     trapping and is a widening — therefore compatible — interface.
+  ///   · The reply REQUIRES `metadata` beside `consent_message`. Omitting it made OISY fail to
+  ///     decode the reply ("Cannot find required field metadata", 2026-07-26). language is "en"
+  ///     because the messages ARE English; the field states what they are, not what was asked for.
+  /// 
+  /// The fallback says the method name rather than inventing a description. A wallet showing an
+  /// approving-sounding sentence for a method this canister does not recognise is the signing-time
+  /// version of a fabricated answer.
+  icrc21_canister_call_consent_message: (request:
+   record {
+     arg: blob;
+     method: text;
+     user_preferences: record {};
+   }) ->
+   (variant {
+      Err: record {
+             description: text;
+             error_code: nat;
+           };
+      Ok:
+       record {
+         consent_message: variant {GenericDisplayMessage: text;};
+         metadata: record {
+                     language: text;
+                     utc_offset_minutes: opt int16;
+                   };
+       };
+    }) query;
+  /// PUBLIC: whether this market is trading at all. A buyer whose job creation refuses needs to be
+  /// able to tell "the market is halted" from "my request was wrong", and only this canister can
+  /// say which. Withholding it would turn an announced halt into an unexplained failure, which is
+  /// the fabricate-on-refusal shape read from the other side.
+  /// 
+  /// The market's own freeze — trade halted for everyone here, by this canister's admin.
+  /// 
+  /// DELIBERATELY NOT the engram's freeze, which stops one owner's engram signing at its guardian's
+  /// word. The two were a single field for as long as they shared a struct, and a guardian who
+  /// froze their own engram could not tell they had not also frozen a marketplace. Separate facts,
+  /// separate authorities, separate switches.
+  isTradeFrozen: () -> (bool) query;
+  /// `total` is the head counter, not the row count: this is a bounded ring, so a page that
+  /// reported only what it returned would make a trimmed log look complete.
+  listAuditEntries: (start: nat, limit: nat) -> (Result_8) query;
+  /// Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
+  /// roster cannot tell whether their own enrolment survived a rotation.
+  listAuditViewers: () -> (Result_9) query;
+  /// PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
+  /// anyone who has not already bought is not a shop.
+  listContent: (start: nat, limit: nat) -> (Page_6) query;
+  /// L11 names this canister's reason for having a denial log at all: the commerce surface is where
+  /// the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
+  /// alerted on, or disproved.
+  listDenialEntries: (start: nat, limit: nat) -> (Result_8) query;
+  /// Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
+  /// 
+  /// ⟨0.16.0⟩ Two defects close here at once, and they are the same defect wearing two hats.
+  /// 
+  /// The engram matched a buyer with `buyer == Principal.toText(msg.caller)` — string equality
+  /// against a field that holds a principal on one rail and a `0x` address on the other. So an
+  /// EVM-rail buyer could not see their OWN purchases, ever. `Payer` makes that an arm match.
+  /// 
+  /// And the filtered rows were dropped SILENTLY: a buyer reading someone else's endpoint got a
+  /// short list with nothing saying rows had been removed, indistinguishable from an endpoint with
+  /// few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
+  /// different answers — without naming whose they were.
+  listEndpointPurchases: (endpointId: text, start: nat, limit: nat) ->
+   (Result_7) query;
+  /// PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
+  /// unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
+  /// none look different, which is the honest answer, without publishing what was withdrawn.
+  listEndpoints: (statusFilter: opt EndpointStatus, start: nat, limit:
+   nat) -> (Page_3) query;
+  /// ⟨0.16.0⟩ THE `listJobs` FIX — the second of the two fabricated empties L11 names.
+  /// 
+  /// The engram's version ended its authorization check with `if (not (isOwner or
+  /// isServiceOperator)) { return [] }`, and its own `.did` comment declared the behaviour on the
+  /// wire: "Fails closed to [] for an unknown service or an unauthorized caller (no existence
+  /// leak)." So a refused caller and a service with genuinely no jobs were the same answer, and it
+  /// was documented as a feature.
+  /// 
+  /// THE EXISTENCE-LEAK JUSTIFICATION DOES NOT HOLD, checked at the site rather than argued: the
+  /// sibling `getJobCounts()` is an UNGATED public query over the same registry, so the number of jobs
+  /// is already world-readable. Nothing was being protected — the empty list hid the refusal from
+  /// the person refused, and hid it from every honesty gate too.
+  /// 
+  /// It could not be caught mechanically either, and that is the more interesting half. The gates
+  /// scan for a known set of authorization helpers; this method's check is two LOCAL BOOLEANS
+  /// (`isOwner`, `isServiceOperator`), so the analyzer matched nothing and reported no finding. Its
+  /// siblings `getJob` and `getJobResult` had already been converted to traps for exactly this
+  /// defect; this one survived because it was written differently, not because it was ruled safe.
+  /// 
+  /// Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
+  /// two facts that were one empty list.
+  listJobs: (serviceId: text, statusFilter: opt JobStatus, start: nat, limit:
+   nat) -> (Result_6) query;
+  /// The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
+  /// rather than something a seller has to already know the id of.
+  /// 
+  /// PAGED, and NOT taken as a bounded exemption, though the temptation was real: a seller parks a
+  /// withdrawal only when a ledger call rejects, and each withdrawal zeroes their balance — so the
+  /// list is 0 or 1 in every ordinary history. It is not STRUCTURALLY bounded, which is the test
+  /// the page-shape rule actually applies: a run of ledger outages across a run of sales
+  /// accumulates rows with nothing to stop it. A bare array that silently truncated would be
+  /// indistinguishable from "you have no other unresolved payouts", and this is money.
+  /// 
+  /// `withheld` is always 0 here. The filter is by owner and a caller cannot own a row they may
+  /// not see, so nothing is ever hidden from them — unlike `listEndpointPurchases`, where a
+  /// non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
+  /// should know the zero is a fact about this surface, not an unimplemented field.
+  listMyPendingWithdrawals: (start: nat, limit: nat) -> (Result_5) query;
+  /// ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
+  /// 
+  /// The engram had two methods because the visibility rule differed: everyone saw enabled
+  /// services; the owner and active sellers also saw disabled drafts. On a shared market that
+  /// rule becomes per-seller — you see every enabled service, plus YOUR OWN disabled drafts — which
+  /// is one query with a flag rather than two methods with divergent gates.
+  /// 
+  /// `withheld` counts other sellers' drafts that the flag asked for and the caller may not see. A
+  /// seller can tell "no drafts" from "not yours to see" without learning whose they are.
+  listServices: (includeDisabled: bool, start: nat, limit: nat) ->
+   (Page) query;
+  /// ⟨0.16.0⟩ THE APPROVAL PARAMETER IS GONE, and its absence is the split working.
+  /// 
+  /// The engram's openSession took an `approvalId` and could answer `#approvalPending` — because
+  /// there, opening a session was THE ENGRAM SPENDING ITS OWNER'S MONEY, so the owner's approval
+  /// queue gated it.
+  /// 
+  /// Here the caller is a BUYER. If that buyer is an engram, its owner's approval was checked on
+  /// the engram before it ever called this canister — approvals stayed with custody, and so did the
+  /// signing they gate. The market receives a payment signature that someone already authorised;
+  /// asking it to also adjudicate whose approval backs that signature would put one owner's custody
+  /// policy on a canister shared with everyone else's.
+  /// 
+  /// So a whole return arm disappears rather than moving. That is what a correct seam looks like:
+  /// the market got simpler because the responsibility went where it belonged, not because anything
+  /// was dropped.
+  /// 
+  /// ⚠ ⟨2026-09-02 — OWNER-RULED: MARKET SESSIONS ARE NOT REQUIRED FOR NOW. The interfaces stay;
+  /// this note is what makes them honest.⟩ THE SESSION LIFECYCLE HERE IS INERT: a session can be
+  /// opened, and it can be closed or refunded, but it can never be SPENT. `gate.consumeVoucher` has
+  /// **zero call sites in this canister** — the only two in the estate are on the ENGRAM, which
+  /// runs its own separate paid-memory rail with its own gateway, `sess-N` counter and escrow
+  /// subaccount. So a market session is deposit-in and full-refund-out, and a buyer who opens one
+  /// gets their money back minus two ckUSDC ledger fees, having bought nothing.
+  /// 
+  /// WHY THE METHODS ARE KEPT RATHER THAN DELETED: they are a complete, reviewable lifecycle
+  /// (open / end / forceClose / forceResolve / recoverEscrow / getSessionCounts) against a real
+  /// escrow, and the ruling is "not required for now", not "never". Deleting them would mean
+  /// re-deriving the seam when session billing is wanted, and the market is WITHHELD at 0.16.0 —
+  /// in neither environment — so nothing here is reachable by a customer today regardless.
+  /// 
+  /// WHAT WOULD MAKE THIS SAFE TO ENABLE: a voucher-spend path — something on this canister that
+  /// calls `gate.consumeVoucher` and delivers what the voucher paid for. Until that exists, the
+  /// two `#Session` billing refusals say session billing is UNAVAILABLE rather than pointing
+  /// buyers at `openSession`, which is what they used to do.
+  /// 
+  /// ⟨2026-09-30, ic402 2.17.0⟩ That future spend path calls `gate.consumeVoucherFrom(msg.caller, …)`,
+  /// not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
+  /// refuses every voucher, and only the session key calling as itself may spend a session.
+  openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_4);
+  /// RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
+  /// the caller has not opened and is not committed to. `request` read as an action with an effect.
+  /// 
+  /// PUBLIC: a price list nobody can read is not a price list, and this is the market's. ⟨The
+  /// sentence was already here as "Ungated:"; only the marker the L8 gate greps for was missing,
+  /// which is why this method read as undefended when it was not.⟩
+  /// ⟨CORRECTED 2026-08-24 — this said "⟨L7⟩ UPDATE, NOT QUERY" and cited a market ruling that
+  /// DEC-107 had already closed.⟩ QUERY, per the ruled quote convention: FAST READS. Both
+  /// `quotePayment` and `previewOpenSession` become queries, and L7's open-ruling exception
+  /// retires with them — so the argument written here for keeping it an update was arguing the
+  /// losing side of a decision already made, and was added the same day by not reading forward
+  /// to the ruling. `gate.offerSession` is pure — it validates the intent and returns it — so
+  /// nothing forced the update in the first place.
+  /// 
+  /// ONE-REPLICA CAVEAT, stated here because the ruling requires it at both sites: a query is one
+  /// replica's word and is NOT a settleable challenge. Nothing quoted here can be redeemed. The
+  /// commitment happens in `openSession`, which IS a certified update call, and a buyer who needs
+  /// the price attested rather than quoted takes it from that reply.
+  /// 
+  /// ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
+  /// `expiryNs`. `openSession` hands ic402 its own record, from `sessionIntent()` below.
+  previewOpenSession: () -> (SessionIntent) query;
+  /// PUBLIC: what it costs to pay this market a given amount, on every rail it settles.
+  /// 
+  /// ⟨0.16.0⟩ Reshaped from `getPaymentRequirements(amount) : [PaymentRequirement]`. A bare array
+  /// was a `get*` returning a list, which reads like a collection to page through; this is a QUOTE,
+  /// a single answer to a single question, and it now says so in its name and its type.
+  /// 
+  /// The quote ECHOES the amount it priced. A caller comparing this to a later 402 challenge is
+  /// then comparing two stated numbers instead of assuming the one they sent came back unchanged.
+  /// 
+  /// Zero is refused. ic402's requirement builder traps on a zero amount, and a quote for nothing
+  /// is not a question this canister can answer — better a legible refusal than a trap in the
+  /// caller's own callback.
+  /// 
+  /// ⟨CORRECTED 2026-10-02 — the nonce is GONE from the quote; the two paragraphs below are kept as
+  /// the record of why.⟩ Each requirement is now a `QuotedRequirement`: ic402's requirement without
+  /// its `nonce` (and with `expiry` spelled `expiryNs`). The paragraphs below describe the throwaway
+  /// that was published until this date; the pre-cut review recommended dropping it over ratifying
+  /// it, and it was dropped. "Do not pay against it" is now enforced by there being nothing to pay
+  /// against.
+  /// 
+  /// ⚠ THE NONCE IN EACH REQUIREMENT IS A THROWAWAY — DO NOT PAY AGAINST IT. `requireAll` mints a
+  /// server nonce with a HashMap put, and this is a QUERY, so the write is discarded on return.
+  /// The nonce is published and does not exist. Signing a payment against it settles as
+  /// `#expired("Server nonce expired, already used, or bound to a different network/token")`,
+  /// which is wrong on every clause and points a caller back here for another dead one.
+  /// 
+  /// That is by design, not an oversight now excused: a quote is a PRICE LIST, not a settleable
+  /// challenge. The HTTP surface of this same canister already draws the line in the same place —
+  /// `/discovery/resources` is a catalog with a throwaway nonce, while `/content` and `/service`
+  /// return `httpUpgrade()` so the challenge is minted in an UPDATE and persists. This is the
+  /// Candid twin of `/discovery/resources`, and it was the only one of the pair not saying so.
+  /// ⟨CORRECTED 2026-09-30⟩ Only `/service` upgrades now; `/content` sells nothing over the web and
+  /// answers 410 from the query. And unlike this quote, the web catalog lists EVM requirements only.
+  /// 
+  /// TO GET A PAYABLE CHALLENGE, call the resource: `getContent(contentId, null)` or
+  /// `createJob(serviceId, params, null)`. Both are updates, so the nonce they mint survives.
+  /// This matters most on the ckUSDC rail, which is where customer payments settle: ICP has no
+  /// on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
+  /// sends no server nonce at all and is unaffected.
+  quotePayment: (amountE6: nat) -> (Result_3) query;
+  /// Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
+  /// this canister never learned. Reads the chain and finishes what the settle started.
+  /// 
+  /// Unstick, not decide: it does not choose an outcome, it discovers one. When it cannot, it says
+  /// so and points at resolveJob, which is where a human decision belongs.
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (job missing, no parked tx, no confirm hook wired, the chain's answer) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  reconcileJob: (jobId: text) -> (Result_2);
+  /// Admin recovery for a session whose settlement was interrupted mid-flight. Same line as
+  /// forceCloseSession: it completes what was already decided, it does not decide anything.
+  /// 
+  /// Freeze-gated, unlike forceClose — reconciliation can PAY a seller, and a halt must stop money
+  /// moving outward. Force-close only returns a buyer's own deposit, which a freeze must not trap
+  /// (the same reasoning that leaves disputeJob un-gated).
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (session missing, not parked in #closing, no parked tx, no EVM deposit or sender configured, the chain's answer) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  reconcileSession: (sessionId: text) -> (Result_2);
+  /// Settle a parked withdrawal by asking the ledger what happened, rather than assuming.
+  /// 
+  /// Re-sends the IDENTICAL transfer — same amount, same fee, same `created_at_time`. Within
+  /// ICRC-1's 24h deduplication window there are exactly two outcomes and both are conclusive:
+  ///   · `#Err(#Duplicate)` — the original DID execute. The seller has been paid; discard the
+  ///     parked record.
+  ///   · `#Ok` — the original did NOT execute, and this call has now paid it. Discard.
+  /// Anything else leaves the record parked and retryable; it is never guessed at.
+  /// 
+  /// Callable by the SELLER it belongs to. This pays only ever to the recorded seller, so a
+  /// stranger calling it could not misdirect funds — but it is still scoped, because a parked
+  /// withdrawal is the seller's business and its existence is a fact about their balance.
+  /// 
+  /// The precedent is the cashier's `recoverPendingClaim`: same saga, same rail, same reason.
+  recoverContentWithdrawal: (withdrawalId: nat) -> (Result);
+  /// Admin recovery: return unconsumed escrow from a stuck or terminal session's own subaccount.
+  /// THE ONE RECOVERY METHOD THAT MOVES REAL MONEY.
+  /// 
+  /// It is on the right side of "an admin may unstick, and may not decide" for one structural
+  /// reason, not by policy: THE DESTINATION IS NOT A PARAMETER. ic402 hardcodes the refund to
+  /// `session.payer`, and the admin's principal appears nowhere in the transfer. The admin supplies
+  /// the session, the token and an amount; they cannot supply a recipient. An admin can unstick a
+  /// refund and cannot redirect one, and that is enforced by the shape of the call rather than by
+  /// this comment.
+  /// 
+  /// ic402 authorizes `caller == session.payer`, so the payer is read from the session and passed
+  /// through — the same pattern the engram used, and NOT the seller-impersonation defect, because
+  /// here the identity being passed is the one that RECEIVES the money rather than one being
+  /// presented as the actor. The audit row records the real admin who forced it.
+  /// 
+  /// Idempotent through the ledger: the first refund drains the subaccount, so a second call fails
+  /// with insufficient funds rather than paying twice.
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (`requireAdmin`; the library's own only-the-payer check cannot fire, because the payer is read from the session and passed through) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (an open session, nothing left to recover, the ledger's refusal) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  /// 
+  /// ⟨2026-10-05, ic402 2.17.3 — beside the first line and the list above⟩ Escrow comes back only
+  /// from a session that reads `closed`. A session that reads `closing` or `expired` is refused, with
+  /// nothing moved — a fourth state refusal — so a "stuck" session here means one that
+  /// `forceResolveSession` has closed first; recover it within 24 hours of that force.
+  recoverEscrow: (sessionId: text, amount: TokenAmount) -> (Result);
+  /// Register as a seller by naming the engram you own.
+  /// 
+  /// The registry is asked, not trusted from the caller's word: `verifyEngramActiveOwner` confirms
+  /// that THIS caller owns THAT engram and that it is #Active — which also means an abandoned
+  /// engram cannot back a listing, since abandonment is terminal there and this market has no
+  /// business inheriting a claim its owner walked away from.
+  /// 
+  /// Re-registering is how a seller refreshes an expiring binding, and it is idempotent apart from
+  /// the timestamp. The byte count SURVIVES re-registration — otherwise the quota would reset every
+  /// thirty days, which is a quota in name only.
+  registerSeller: (engramId: principal) -> (Result_1);
+  /// Register a paid service. Born DISABLED, like an endpoint and for the same reason: a listing
+  /// that went live at creation would be sellable before its seller had checked it.
+  /// 
+  /// ⚠ THIS NEARLY DID NOT MAKE THE MOVE. It was deleted from the engram with the rest of the
+  /// commerce graft and was not written here until a downstream web client failed to compile
+  /// against a market that had no way to create a service at all — sellers could enable, disable
+  /// and list services, and could never make one. Recorded because the gap was invisible to every
+  /// gate: the canisters compiled, the .did was well formed, and check-client-idls only sees names
+  /// that ARE declared.
+  /// 
+  /// `verificationMethod` stays a STRING with a parsed tail, exactly as the engram had it, because
+  /// #BuyerConfirm carries a window ("BuyerConfirm:3600") and a bare variant cannot. The parse is
+  /// total: an unrecognised method falls back to #AutoSettle rather than refusing, which is the
+  /// engram's behaviour preserved deliberately — a seller mistyping a verification mode should get
+  /// the safe default, not a service they cannot create.
+  registerService: (name: text, description: text, serviceType: ServiceType,
+   pricing: PricingScheme, verificationMethod: text, verifierCanisterId:
+   opt text, verificationKey: opt blob, delivery: ServiceDeliveryMethod,
+   timeout: nat, bindResult: opt bool) -> (Result_2);
+  removeAuditViewer: (viewer: principal) -> (Result_1);
+  /// Remove a per-payer override so that payer reverts to — and keeps TRACKING — the global policy.
+  /// 
+  /// Its pair's only other "undo" was overwriting the override with a frozen copy of the global
+  /// policy, which then stops following later global changes. That is why the two never travel
+  /// apart: without this one, every override is permanent in effect.
+  removeCallerPolicy: (caller: principal) -> (Result_1);
+  /// ⟨0.16.0⟩ RULED 2026-08-17: THE SELLER RESOLVES. Not the market admin.
+  /// 
+  /// The engram's `requireOwner` was coherent there because the engram's owner IS the seller — a
+  /// dispute was between that owner and their buyer. Transcribing it here would have made the
+  /// market admin the arbiter of commercial disputes between independent parties, moving their
+  /// money: a business and probably a legal position, inherited by accident from a canister where
+  /// "owner" meant something else.
+  /// 
+  /// The ruling keeps the power where it already was rather than quietly relocating it to us.
+  /// 
+  /// ⚠ THE ASYMMETRY IS REAL AND IS STATED, HERE AND ON THE WIRE. The accused judges. A seller can
+  /// refuse a refund to a buyer who has already paid, and nothing on this canister overrides that:
+  /// there is no admin override, no appeal, and no reputation system yet to price the behaviour.
+  /// That is an honest description of who holds power in this market today, and a buyer is entitled
+  /// to know it BEFORE they buy — which is why it is in the refusal text a buyer actually sees, not
+  /// only in a comment they never will.
+  /// 
+  /// Writing it down is also what makes it revisitable: when a reputation system or an escrow
+  /// timeout arrives, this method is where the change lands and this comment is the argument it has
+  /// to answer.
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (the service's seller, checked above the library call) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (job missing, not in a resolvable state, a refund parked or failed) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  resolveDispute: (jobId: text, refundBuyer: bool) -> (Result_1);
+  /// Admin LAST RESORT: force a job to a terminal status when reconcileJob cannot determine one —
+  /// a reverted or dead transaction that the chain will never resolve either way.
+  /// 
+  /// ⚠ THIS IS THE ONE PLACE THE ADMIN LINE BENDS, AND IT IS NAMED SO IT CANNOT BE USED CASUALLY.
+  /// Elsewhere on this canister an admin may unstick and may not decide; here the whole point is
+  /// that no discoverable answer exists, so someone must choose whether the seller was paid or
+  /// the buyer refunded. The narrowness is the safeguard: ic402 rejects any non-terminal target, so
+  /// the choice is between #Settled, #Refunded and #Expired and cannot be used to reopen a job or
+  /// move it sideways. Every use is a chained audit row naming the admin and the status they chose.
+  /// 
+  /// `#other` fails closed. It is a placeholder for a job state this canister cannot name, and
+  /// forcing a job into a state we cannot name is not a recovery.
+  /// 
+  /// ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+  /// carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+  /// this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+  /// text the library returns here is a STATE refusal (job missing, not stuck in #Settling, a target that is not terminal) — including "not found", which
+  /// arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+  /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+  /// dependency work.
+  resolveJob: (jobId: text, terminal: JobStatus) -> (Result_1);
+  setAdmin: (newAdmin: principal) -> (Result_1);
+  /// Override the policy for ONE payer — the market's per-buyer risk control.
+  setCallerPolicy: (caller: principal, policy: SpendingPolicy) -> (Result_1);
+  /// ⟨0.16.0, L2.6⟩ `enableEndpoint` and `disableEndpoint` FOLD into one setter.
+  /// 
+  /// They were byte-identical apart from the status they wrote and the word in their name, which is
+  /// the definition of a boolean expressed as two methods. L2.6 rules one idiom for a boolean
+  /// feature, and the fold also removes a real hazard: two methods meant two authorization checks
+  /// to keep in step, and a divergence between them would have been invisible to a reader looking at
+  /// either one alone.
+  /// 
+  /// `#Deleted` stays a refusal in both directions and stays `#Conflict`, not `#Invalid`: the
+  /// request is well-formed and permitted, the endpoint is simply in a terminal state — and calling
+  /// that `#Invalid` would tell a caller to fix their request when nothing about it is wrong.
+  setEndpointEnabled: (endpointId: text, enabled: bool) -> (Result_1);
+  /// Set an endpoint's price. THE SELLER'S, not the admin's.
+  /// 
+  /// requireEndpointOwner admits the market admin for the enable/disable pair, because a listing an
+  /// admin cannot take down is a moderation problem. PRICE IS DIFFERENT: changing what a seller
+  /// charges is trading on their behalf, and no recovery story needs it.
+  setEndpointPrice: (endpointId: text, priceE6: nat) -> (Result_1);
+  /// A seller registers the EVM address their EVM-paid settlements are sent to.
+  /// 
+  /// SELF-SCOPED: the address is keyed by `msg.caller`, so the only account a caller can change is
+  /// their own — there is no gate to get wrong, because there is nothing to gate. The engram's
+  /// `requireAgentOrOwner` here was protecting a canister-level roster that a shared market does
+  /// not have. Anonymous is refused: an anonymous payout address is an address nobody can be paid at.
+  /// 
+  /// Without one, an EVM-paid job's settlement FAILS CLOSED and rolls back — the market does not
+  /// cross rails and pay an EVM seller out of the ICP pool.
+  setEvmSellerPayout: (address: text) -> (Result_1);
+  /// Set the market's global spending policy.
+  /// 
+  /// The audit row records the LIMITS, not just the fact of a change, so a WIDENING is
+  /// distinguishable from a tightening after the fact. A policy raise is the quiet half of most
+  /// money incidents, and "policy changed" alone cannot tell an investigator which way.
+  setPaymentPolicy: (policy: SpendingPolicy) -> (Result_1);
+  /// Whom this canister anchors to. Set by the admin at deploy; `sys` because it is protocol
+  /// configuration, not a product surface.
+  /// 
+  /// ⟨RENAMED 2026-10-02 from `sysSetRegistryId` — the sys-tier retier ruled 2026-08-24, executed
+  /// under the owner's 2026-10-02 ruling to carry out the pre-cut interface decisions as
+  /// recommended.⟩ The sentence above is why it was sys-named, and the retier is why it no longer
+  /// is: the `sys` prefix names the canister-to-canister tier, whose callers are other canisters,
+  /// and this method's only caller is a PERSON — the market's admin, at deploy. Keeping it there
+  /// made "a `sys` method has no human caller" false, and so uncheckable. A plain admin setter
+  /// (`setAdmin`'s sibling) is what it always was.
+  setRegistryId: (id: principal) -> (Result_1);
+  /// ⟨0.16.0, L2.6⟩ enableService + disableService FOLD, same as the endpoint pair.
+  /// 
+  /// Deliberately NOT admin-overridable, unlike endpoints. Disabling a seller's service is a
+  /// commercial act against that seller, and an admin who needs to remove a listing should do it
+  /// through a recorded moderation path rather than by silently flipping a flag that looks like the
+  /// seller did it. Endpoints allow the admin override because a deleted endpoint is already
+  /// terminal and visible; a disabled service looks like the seller's own choice.
+  /// 
+  /// ⚠ `#Conflict` HERE ALSO COVERS "NOT THE SELLER" — the same ic402 seam as `claimJob`,
+  /// `confirmJob` and `disputeJob`. `enableService`/`disableService` return `Service not found`
+  /// (properly `#NotFound`) and **`Not the seller`** (properly `#Refused`) as plain strings, so
+  /// the arm is gone before this method sees it. Read the MESSAGE, not the arm.
+  /// ⟨2026-08-21; the project's backlog carries the three costed fixes and why none is a
+  /// one-liner.⟩
+  /// ⟨CORRECTED 2026-10-02, audited at this site — the paragraph above no longer holds here.⟩
+  /// `requireServiceSeller` now runs BEFORE the library: a missing service is refused `#NotFound`
+  /// and another seller `#Refused`, by this canister, with its own sentences. The library is then
+  /// called with the caller already proven to be the seller, so its "Not the seller" and "Service
+  /// not found" texts cannot reach the `#Conflict` arm below except across a race with a deletion.
+  /// The seam is closed on this method by the gate, not by the library; the others keep their
+  /// caveats.
+  setServiceEnabled: (id: text, enabled: bool) -> (Result_1);
+  /// A seller submits a finished job's result.
+  /// 
+  /// AUTHORITY IS THE JOB'S SELLER, checked by ic402 against the claim — not "a seller of this
+  /// canister", which on a shared market would mean any seller could submit results for any other
+  /// seller's jobs. The engram's `requireAgentOrOwner` was a canister-level gate that made sense
+  /// only while one canister meant one seller.
+  /// 
+  /// FREEZE-GATED because it can MOVE MONEY: the auto-settling verification modes (#AutoSettle /
+  /// #HashMatch / #ZkGroth16) pay the seller inside submitResult. Only #BuyerConfirm defers to
+  /// confirmJob. A reader who assumes "submitting a result is not a payment" is wrong for three of
+  /// the four modes.
+  /// 
+  /// ⚠ `#Conflict` HERE ALSO COVERS "NOT THE ASSIGNED OPERATOR" — a refusal of the caller's
+  /// STANDING, not of the job's state. ⟨2026-10-02, audited at this site⟩ ic402's `submitResult`
+  /// checks the caller against the job's operator itself and answers with one text channel, so
+  /// "Not the assigned operator" and "Job not assigned" arrive here exactly as "Cannot submit result
+  /// in status: …" does. A caller that branches on the arm retries a submission that can never be
+  /// theirs. Read the MESSAGE, not the arm. This is the 0.16.0 contract as ratified on 2026-10-02;
+  /// giving the library one arm per kind of refusal is post-cut dependency work.
+  submitJobResult: (jobId: text, result: blob, proof: opt blob, actualCost:
+   opt nat) -> (Result_1);
+  /// Upload a whole file in one call.
+  uploadContent: (id: text, mimeType: text, data: blob) -> (Result_1);
+  /// Push one chunk of a started upload. NOT charged — uploadContentInit already reserved the
+  /// declared total, so charging again here would bill the same bytes twice.
+  uploadContentChunk: (id: text, index: nat, data: blob) -> (Result_1);
+  /// Begin a chunked upload. The WHOLE declared size is charged here, up front.
+  /// 
+  /// Charging at init rather than per chunk is the point: a per-chunk charge would let a seller
+  /// begin an upload that cannot finish, and discover it only after claiming most of the memory.
+  /// Reserving the declared total means an over-quota upload is refused before its first byte lands.
+  uploadContentInit: (id: text, mimeType: text, totalSize: nat, chunkCount:
+   nat) -> (Result_1);
+  /// The buyer-facing half of the same check, kept because it answers a different question: "is my
+  /// grant still good", asked BEFORE spending a round trip on a chunk. Documented in ACCESS-CONTROL
+  /// as the buyer's pre-flight.
+  verifyGrant: (grant: AccessGrant) -> (Result_1) query;
+  /// Withdraw everything this caller has earned from content sales, to their own principal.
+  /// 
+  /// NO DESTINATION ARGUMENT, and that is the security property rather than a missing feature: the
+  /// funds go to `msg.caller` and nowhere else, so a stolen or mis-signed call cannot redirect a
+  /// seller's balance to an attacker's account. A seller who wants the money elsewhere moves it
+  /// from their own account, where they are the only signer.
+  /// 
+  /// NOT GATED ON `requireSeller`. A seller binding expires and can be revoked; earnings do not.
+  /// Gating withdrawal on current seller status would strand the balance of anyone whose engram
+  /// lapsed after they sold — money owed, permanently unreachable, for a reason unrelated to the
+  /// debt. The gate is the debt itself: you may withdraw exactly what you are owed.
+  withdrawContentRevenue: () -> (Result);
+}