@engramx/idl 0.16.0-rc.12 → 0.16.0-rc.14

package/dist/engram.did

@@ -5,8 +5,14 @@ type X402SignOutcome =
  };
 type WriteReceipt = 
  record {
+   atNs: int;
+   contentRoot: blob;
    head: blob;
+   prev: blob;
+   recordId: nat;
+   recordPrev: blob;
    seq: nat;
+   size: nat;
    version: nat;
  };
 type WorldIdRpContext = 
@@ -168,6 +174,12 @@ type Seat =
    produced: nat;
    weeks: nat64;
  };
+type SealedEntry = 
+ record {
+   digest: blob;
+   entryHash: blob;
+   id: nat;
+ };
 type Role = 
  variant {
    Admin;
@@ -213,18 +225,23 @@ type ResyncReport =
 type Result_9 = 
  variant {
    Err: Error;
-   Ok: SignedTransaction;
+   Ok: BackupRetentionReport;
  };
 type Result_8 = 
  variant {
    Err: Error;
-   Ok: nat;
+   Ok: SignedTransaction;
  };
-type Result_71 = 
+type Result_72 = 
  variant {
    Err: Error;
    Ok: AgentRecord;
  };
+type Result_71 = 
+ variant {
+   Err: Error;
+   Ok: record {activatesAtNs: int;};
+ };
 type Result_70 = 
  variant {
    Err: Error;
@@ -238,47 +255,47 @@ type Result_7 =
 type Result_69 = 
  variant {
    Err: Error;
-   Ok: record {activatesAtNs: int;};
+   Ok: CondenseResult;
  };
 type Result_68 = 
  variant {
    Err: Error;
-   Ok: CondenseResult;
+   Ok: MemoryRangeExport;
  };
-type Result_67 = 
+type Result_66 = 
  variant {
    Err: Error;
-   Ok: MemoryRangeExport;
+   Ok: Page_21;
  };
 type Result_65 = 
  variant {
    Err: Error;
-   Ok: Page_21;
+   Ok: AgentWriteReview;
  };
 type Result_64 = 
  variant {
    Err: Error;
-   Ok: AgentWriteReview;
+   Ok: BackupMetadata;
  };
 type Result_63 = 
  variant {
    Err: Error;
-   Ok: BackupMetadata;
+   Ok: ChildAllowanceRow;
  };
 type Result_62 = 
  variant {
    Err: Error;
-   Ok: ChildAllowanceRow;
+   Ok: ChildOpening;
  };
 type Result_61 = 
  variant {
    Err: Error;
-   Ok: ChildOpening;
+   Ok: blob;
  };
 type Result_60 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: EvmAddresses;
  };
 type Result_6 = 
  variant {
@@ -288,52 +305,52 @@ type Result_6 =
 type Result_59 = 
  variant {
    Err: Error;
-   Ok: EvmAddresses;
+   Ok: AlertStatus;
  };
 type Result_58 = 
  variant {
    Err: Error;
-   Ok: AlertStatus;
+   Ok: MemoryHistory;
  };
 type Result_57 = 
  variant {
    Err: Error;
-   Ok: MemoryHistory;
+   Ok: MemoryRetentionPolicy;
  };
 type Result_56 = 
  variant {
    Err: Error;
-   Ok: MemoryRetentionPolicy;
+   Ok: OwnerConsole;
  };
 type Result_55 = 
  variant {
    Err: Error;
-   Ok: OwnerConsole;
+   Ok: record {paths: vec text;};
  };
 type Result_54 = 
  variant {
    Err: Error;
-   Ok: record {paths: vec text;};
+   Ok: SigningFloorStatus;
  };
 type Result_53 = 
  variant {
    Err: Error;
-   Ok: SigningFloorStatus;
+   Ok: SpendCeiling;
  };
 type Result_52 = 
  variant {
    Err: Error;
-   Ok: SpendCeiling;
+   Ok: SpendingPolicy;
  };
 type Result_51 = 
  variant {
    Err: Error;
-   Ok: SpendingPolicy;
+   Ok: StorageReport;
  };
 type Result_50 = 
  variant {
    Err: Error;
-   Ok: StorageReport;
+   Ok: WalletBalances;
  };
 type Result_5 = 
  variant {
@@ -343,47 +360,47 @@ type Result_5 =
 type Result_49 = 
  variant {
    Err: Error;
-   Ok: WalletBalances;
+   Ok: WorldIdConfig;
  };
 type Result_48 = 
  variant {
    Err: Error;
-   Ok: WorldIdConfig;
+   Ok: WorldIdRpContext;
  };
 type Result_47 = 
  variant {
    Err: Error;
-   Ok: WorldIdRpContext;
+   Ok: opt text;
  };
 type Result_46 = 
  variant {
    Err: Error;
-   Ok: opt text;
+   Ok: bool;
  };
 type Result_45 = 
  variant {
    Err: Error;
-   Ok: bool;
+   Ok: text;
  };
 type Result_44 = 
  variant {
    Err: Error;
-   Ok: text;
+   Ok: Page_20;
  };
 type Result_43 = 
  variant {
    Err: Error;
-   Ok: Page_20;
+   Ok: Page_19;
  };
 type Result_42 = 
  variant {
    Err: Error;
-   Ok: Page_19;
+   Ok: Page_18;
  };
 type Result_41 = 
  variant {
    Err: Error;
-   Ok: Page_18;
+   Ok: RecordPage;
  };
 type Result_40 = 
  variant {
@@ -543,17 +560,17 @@ type Result_13 =
 type Result_12 = 
  variant {
    Err: Error;
-   Ok: SessionContext;
+   Ok: nat;
  };
 type Result_11 = 
  variant {
    Err: Error;
-   Ok: MemoryFile;
+   Ok: SessionContext;
  };
 type Result_10 = 
  variant {
    Err: Error;
-   Ok: BackupRetentionReport;
+   Ok: MemoryFile;
  };
 type Result_1 = 
  variant {
@@ -580,27 +597,13 @@ type Repudiation =
    reason: text;
    version: nat;
  };
-type RegisteredType = 
+type RecordPage = 
  record {
-   ackIrrevocable: bool;
-   authorityClass: AuthorityClass;
-   chainId: nat;
-   cooloffEndsAtNs: int;
-   dailySignCap: nat;
-   destinationFields: vec text;
-   domainName: text;
-   domainSeparator: vec nat8;
-   domainVersion: text;
-   encodeTypeString: text;
-   fields: vec record {
-                 text;
-                 text;
-               };
-   primaryType: text;
-   registeredAtNs: int;
-   typeHash: vec nat8;
-   typeId: blob;
-   verifyingContract: text;
+   hashFirstFrom: nat;
+   items: vec AuditEntry;
+   ringFloor: nat;
+   sealed: vec SealedEntry;
+   total: nat;
  };
 type ReceiptPage = 
  record {
@@ -769,16 +772,13 @@ type Page_13 =
  };
 type Page_12 = 
  record {
-   items: vec RegisteredType;
+   items: vec Eip712Destination;
    total: nat;
    withheld: nat;
  };
 type Page_11 = 
  record {
-   items: vec record {
-                activeFromNs: int;
-                address: text;
-              };
+   items: vec Eip712TypeView;
    total: nat;
    withheld: nat;
  };
@@ -1181,7 +1181,7 @@ type Engram =
    /// nomination names. That check compares the caller inside the module, where
    /// test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
    /// no role here until the move.
-   acceptAgentKeyNomination: (agentKey: principal) -> (Result_71);
+   acceptAgentKeyNomination: (agentKey: principal) -> (Result_72);
    /// Consensus transform for the alert webhook outcall: collapse the response to status-only so
    /// replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
    /// 
@@ -1194,9 +1194,32 @@ type Engram =
       context: blob;
       response: HttpRequestResult;
     }) -> (HttpRequestResult) query;
+   /// Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
+   /// and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
+   /// 
+   /// ⟨2026-10-14, the owner's ruling 4A⟩ ONE LIST PER REGISTERED ACTION. `addEvmWithdrawDestination`,
+   /// `removeEvmWithdrawDestination` and `listEvmWithdrawDestinations` — one list for every action —
+   /// are REMOVED; these three take the action's `typeId`. Same rules, per action: the owner only; an
+   /// addition activates after 24 hours and is refused while payments are frozen; a removal is instant
+   /// and works while frozen; a value is 1–128 characters (an address, or a venue value such as an
+   /// account name). The action must be registered: a destination list belongs to an action, and a
+   /// list for no action would be a value nothing checks. The caller is the owner's app.
+   addEip712Destination: (typeId: blob, value: text) -> (Result_71);
    /// Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
    /// of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
    /// shape is IMMUTABLE: any change mints a new typeId.
+   /// 
+   /// ⟨2026-10-14, the owner's rulings 3A and 5A⟩ ONE BAR FOR EVERY REGISTRATION — the class the owner
+   /// names is stored as a label and decides nothing. Every registration: records the irrevocability
+   /// acknowledgement (`ackIrrevocable = true`); has no opaque field (`bytes`, `bytes1..32`); names at
+   /// least one destination field OR carries a must-equal rule; passes the watchers — an owner alert
+   /// webhook set, enabled AND with its money class on, and an `#Active` guardian holding
+   /// `canFreezePayments`; and waits `Eip712Policy.COOLOFF_NS` (72 hours). It may carry per-field
+   /// rules (`fieldRules`: "at most N" read as a plain decimal with D places, "must equal X"), which
+   /// are part of the registered shape — inside the typeId, stored in `eip712FieldRules`, enforced in
+   /// `eip712SignFor` before the cap reservation. Before this, a withdrawal registered as `#standard`
+   /// needed no webhook, no guardian and no destination field, waited one hour, and signed to any
+   /// address. Intrinsic checks still come first and the watchers last (the 2026-08-06 re-ordering).
    addEip712Type: (spec:
     record {
       ackIrrevocable: bool;
@@ -1211,6 +1234,10 @@ type Engram =
       destinationFields: vec text;
       domainName: text;
       domainVersion: text;
+      fieldRules: vec record {
+                        text;
+                        Eip712FieldRule;
+                      };
       fields: vec record {
                     text;
                     text;
@@ -1218,9 +1245,6 @@ type Engram =
       primaryType: text;
       verifyingContract: text;
     }) -> (Result_70);
-   /// Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
-   /// and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
-   addEvmWithdrawDestination: (dest: text) -> (Result_69);
    /// ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
    /// 
    /// This method had five distinct ways to say no through one `text`, and a caller could only tell
@@ -1262,7 +1286,7 @@ type Engram =
    /// Gated on requireWritesNotPaused — unlike the export. This one destroys retained entries, which
    /// is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
    /// owner-initiated, owner-only, and already chained into the audit log.
-   applyCondense: (toSeq: nat) -> (Result_68);
+   applyCondense: (toSeq: nat) -> (Result_69);
    /// Owner-only: activate a guardian who has registered against an invite.
    /// 
    /// Until this call the guardian is `#Pending` and can do NOTHING — registering is a claim, this
@@ -1333,13 +1357,13 @@ type Engram =
    /// 
    /// The write half also refuses while writes are PAUSED.
    backupInit: (dbType: text, backupType: BackupType, parentBackupId:
-    opt text, sha256: text, backupLabel: opt text) -> (Result_44);
+    opt text, sha256: text, backupLabel: opt text) -> (Result_45);
    /// Read one chunk of a finalized backup, by index.
    /// 
    /// ⚠ GATED ON `read_backup`, which is NOT the permission the upload half uses — that one is
    /// `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
    /// carrying it away are different authorities.
-   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_60) query;
+   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_61) query;
    backupPushChunk: (backupId: text, chunkIndex: nat, data: blob) ->
     (Result_1);
    /// The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
@@ -1372,7 +1396,7 @@ type Engram =
    /// ⟨2026-10-02⟩ The second parameter is NAMED `amountE6` now, as the census row above rules the
    /// pair — e6 base units of the token named first. A name only: Candid passes arguments by
    /// position, so nothing on the wire moved.
-   convertEarningsToCycles: (token: text, amountE6: nat) -> (Result_8);
+   convertEarningsToCycles: (token: text, amountE6: nat) -> (Result_12);
    /// Owner-only: mint a single-use invite code an agent redeems with `pairAgent`.
    /// 
    /// ⚠ READ THIS BEFORE INVITING SOMEONE BACK. Pairing is ONE-SHOT PER PRINCIPAL on
@@ -1391,7 +1415,7 @@ type Engram =
    /// A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    /// independent check on agents, so one wallet must not hold both.
    createAgentInvite: (name: text, permissions: AgentPermissions) ->
-    (Result_44);
+    (Result_45);
    /// Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
    /// co-owner and not a recovery agent.
    /// 
@@ -1414,7 +1438,7 @@ type Engram =
    /// So an invite that fails to redeem for that reason is not a bad code. The rule exists because
    /// a check must be independent of the thing it checks.
    createGuardianInvite: (name: text, permissions: GuardianPermissions) ->
-    (Result_44);
+    (Result_45);
    /// OWNER-ONLY deletion of a stored backup.
    /// 
    /// ⚠ NOT THE SAME GATE AS THE REST OF THE FAMILY, and the asymmetry is deliberate: `backupInit`,
@@ -1442,35 +1466,6 @@ type Engram =
    /// `#NotFound` for an unknown id and `#Conflict` when the request is no longer pending, and it
    /// does not change the policy — the next request over the same limit will be raised again.
    denyRequest: (requestId: text, reason: text) -> (Result_1);
-   /// Force the tECDSA derivation and return the address.
-   /// 
-   /// It exists because the gateway's own derivation fires from a timer that is lazy on some
-   /// replicas, and until it lands the EVM quote advertises the `0x0` fallback and settle fails
-   /// closed — a live money surface quoting an address that cannot receive.
-   /// 
-   /// ⟨0.16.0, B-2⟩ Derivation now comes from `EvmIdentity`, and the return type carries the
-   /// outcome: this used to answer `""` on failure, which is a Text a caller can and did paste into
-   /// a payment flow. An empty string is not an address, and saying so is the difference between a
-   /// failed derivation and an address of nothing.
-   /// 
-   /// ⚠ TRANSITIONAL: it also primes the ic402 gate, because the gate still settles commerce on this
-   /// canister until those 47 methods move. That second call disappears with them — it is listed in
-   /// the move order in the spec's B-2 addendum, not left for someone to find.
-   /// 
-   /// PUBLIC: it inherits `getEvmAddress`'s gate rather than choosing one, and could not usefully be
-   /// narrower — it exists so a caller can make the derivation happen BEFORE a payment flow, and the
-   /// derivation itself is ungated. Idempotent and bounded to the same one-derivation-per-lifetime
-   /// work, so an anonymous caller can cause it once and no more.
-   /// ⟨L7⟩ UPDATE, NOT QUERY, and this one does not merely await — it WRITES. The body awaits
-   /// `EvmIdentity.deriveAddress` (the management canister's `ecdsa_public_key`) and
-   /// `gate.deriveEvmRecipientAt` ⟨renamed 2026-09-22 with the path⟩, then caches the result in `evmAddressCache`. So a query is
-   /// impossible twice over: it could not await the derivation, and it could not keep the answer.
-   /// Named `ensure*` rather than `get*` for that reason — the write is the point, and a read verb
-   /// would have promised a cheapness this cannot deliver.
-   /// 
-   /// ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
-   /// the site.⟩
-   ensureEvmReady: () -> (Result_44);
    /// Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
    /// 
    /// This is the receipt ledgerfs Q2 requires before any of those entries may be condensed away.
@@ -1484,7 +1479,7 @@ type Engram =
    /// situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
    /// failed its integrity check must not attest anything it cannot vouch for.
    exportMemoryRange: (fromSeq: nat, toSeq: nat, authorFilter:
-    opt principal) -> (Result_67);
+    opt principal) -> (Result_68);
    /// ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
    /// The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
    /// case — the guardian is the exceptional one. A name that says otherwise sends an owner looking
@@ -1500,6 +1495,8 @@ type Engram =
    ///     individual method's body finds nothing — the check is one level down.⟩
    ///   · `addEip712Type` and `addEvmWithdrawDestination` — pre-staging for a later payout is the
    ///     thing a brake most needs to stop, so the destination list is frozen along with the signing.
+   ///     ⟨2026-10-14, the owner's ruling 4A⟩ `addEvmWithdrawDestination` is removed; its place is
+   ///     `addEip712Destination` (one list per registered action), freeze-gated the same way.
    ///   · `sessionReadMemory` and `sessionAppendMemory` — the paid-memory rail, money coming IN.
    /// 
    /// AND WHAT IT DELIBERATELY DOES NOT, stated so the absence is not read as an oversight:
@@ -1516,7 +1513,7 @@ type Engram =
    /// before this one. If any of them is wrong, this comment is where the argument should happen.
    freezePayments: () -> (Result_1);
    /// Delivery status + config readback. Owner-only (the URL is a secret).
-   getActionAlertStatus: () -> (Result_58) query;
+   getActionAlertStatus: () -> (Result_59) query;
    /// Agents need to know what they may revise, so they can read it too. Whole-value config, same
    /// carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
    /// protected path and a revisable path are opposite grants, and one accessor for both would be a
@@ -1524,7 +1521,7 @@ type Engram =
    /// 
    /// Refusal reason preserved from the trap: a grant is a power, and its absence and its
    /// concealment are different facts.
-   getAgentRevisablePaths: () -> (Result_54) query;
+   getAgentRevisablePaths: () -> (Result_55) query;
    /// OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
    /// paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
    /// of the last one, and how many were produced. Never an amount, a recipient or a nonce.
@@ -1535,7 +1532,7 @@ type Engram =
    /// order. Anyone else is refused by name (`#Refused getAgentSeatWeeks: …`), never answered with an
    /// empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
    /// Two rows can name one root: an agent paired again after it left is a second engagement.
-   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_65) query;
+   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_66) query;
    /// Owner: everything written into this engram by someone other than the owner since the last
    /// markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
    /// qualifiesForReview for why those two families are recognised differently).
@@ -1543,7 +1540,7 @@ type Engram =
    /// them — the UI must page (markAgentWritesReviewed(?lastShownId)) and must NOT present 200
    /// as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
    /// aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
-   getAgentWriteReview: () -> (Result_64) query;
+   getAgentWriteReview: () -> (Result_65) query;
    /// Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
    /// engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
    /// and none of these fields is a secret — `total` is already public via getCertifiedAuditHead.
@@ -1562,7 +1559,7 @@ type Engram =
    /// below serves the same head WITH the subnet certificate for a caller that needs to verify it
    /// was signed rather than asserted.
    getAuditHead: () -> (AuditHead) query;
-   getBackupMetadata: (backupId: text) -> (Result_63) query;
+   getBackupMetadata: (backupId: text) -> (Result_64) query;
    /// The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
    /// 
    /// PUBLIC: a payer about to send money needs to know which cashier this engram will accept credit
@@ -1592,11 +1589,11 @@ type Engram =
    /// query's state writes are discarded when it returns, and the `denied` call first written here
    /// recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
    /// WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
-   getChildAllowance: (agentPrincipal: principal) -> (Result_62) query;
+   getChildAllowance: (agentPrincipal: principal) -> (Result_63) query;
    /// Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
    /// agent's request is refused, the balance now, and every agent's allowance. The console's cost
    /// sentence reads it. Cycles are owner-class information, as on the owner's console read.
-   getChildOpening: () -> (Result_61) query;
+   getChildOpening: () -> (Result_62) query;
    /// Derive the shared memory-encryption key, encrypted under the caller's transport
    /// public key. Gated to owner + read-agents (the same principals allowed to read
    /// memory). The client decrypts it locally with its transport secret key.
@@ -1621,7 +1618,7 @@ type Engram =
    /// cost. Stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body — which is exactly what had to happen to write this line.
    getEncryptedMemoryKey: (epoch: opt nat, transportPublicKey: blob) ->
-    (Result_60);
+    (Result_61);
    /// ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
    /// 
    /// The card's config hardcodes `x402Support = true`, answering a buyer's question with a fact
@@ -1646,10 +1643,6 @@ type Engram =
    /// has never met this engram what it is and how to transact with it. A card behind a gate cannot
    /// be discovered, and the ERC-8004 ecosystem it participates in assumes an open read.
    getEngramCard: () -> (AgentCard) query;
-   /// PUBLIC: the engram's permanent spawn ordinal — a provable, non-sensitive fact. It identifies a
-   /// canister, never a person.
-   /// null = spawned before numbering existed; the owner can backfill via syncEngramNumber().
-   getEngramNumber: () -> (opt nat) query;
    /// Re-pointed at `EvmIdentity` (B-2): custody derivation no longer routes through the ic402
    /// Gateway, which is leaving for the market canister. Behaviour is unchanged for a caller — same
    /// address, same tECDSA key — but the engram no longer needs a marketplace to know its own
@@ -1720,7 +1713,7 @@ type Engram =
    /// It refuses rather than half-answers: if either address cannot be derived the reply is
    /// `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
    /// failed derivation — that is fail-to-empty on a money surface, and it stops here).
-   getEvmAddress: () -> (Result_59);
+   getEvmAddress: () -> (Result_60);
    /// The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
    /// the address this canister derives for itself.
    /// 
@@ -1735,7 +1728,7 @@ type Engram =
    /// the management canister's `ecdsa_public_key`. A query cannot await, so the round-trip is the
    /// cost — stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body.
-   getEvmSignerAddress: () -> (Result_44);
+   getEvmSignerAddress: () -> (Result_45);
    /// PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
    /// 
    /// The fourth of the four evidence methods (`getAuditHead`, `getCertifiedAuditHead`,
@@ -1744,7 +1737,7 @@ type Engram =
    /// cannot verify it, and nothing here identifies anybody.
    getGenesisNote: () -> (GenesisNote) query;
    /// A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
-   getGuardianAlertStatus: () -> (Result_58) query;
+   getGuardianAlertStatus: () -> (Result_59) query;
    /// The market this engram will accept signing requests from — `null` until the registry pushes
    /// one at spawn, which is why `requireMarket` refuses fleet-wide today.
    /// 
@@ -1774,7 +1767,7 @@ type Engram =
    /// never renumbered: the next page starts at the last version returned plus one. Defaults
    /// return the whole history of any file a pre-FD engram could have held.
    getMemoryHistory: (path: text, start: opt nat, max: opt nat) ->
-    (Result_57) query;
+    (Result_58) query;
    /// PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
    /// history would be a public, fleet-enumerable feed of when each owner terminated a trust
    /// relationship — readable by, among others, the party just terminated.
@@ -1815,7 +1808,7 @@ type Engram =
    /// Refusal reasons of both merge: an empty policy reads as "nothing is capped, every version kept
    /// forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
    /// "nothing is held back".
-   getMemoryRetentionPolicy: () -> (Result_56) query;
+   getMemoryRetentionPolicy: () -> (Result_57) query;
    /// The metrics reader this engram answers — `null` until the spawning registry names one.
    /// 
    /// PUBLIC: an owner deciding whether to switch the read off needs to know who it is, and anyone
@@ -1838,7 +1831,7 @@ type Engram =
    /// was `nat`, then widened to `opt nat` so a refusal could be `null`, which broke every published
    /// client (rule 4) and bought a masked answer nobody had asked for — the census could not even
    /// find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
-   getOwnerConsole: () -> (Result_55) query;
+   getOwnerConsole: () -> (Result_56) query;
    /// Owner + agents only (agents need it to avoid writing protected paths).
    /// 
    /// A NAMED RECORD, not a Page: the setter replaces this list wholesale, so there is no window to
@@ -1850,7 +1843,7 @@ type Engram =
    /// path on this engram is protected", and an agent consults this list precisely to avoid
    /// writing one — so a fabricated empty here does not merely misinform, it invites the write the
    /// list exists to prevent.
-   getProtectedPaths: () -> (Result_54) query;
+   getProtectedPaths: () -> (Result_55) query;
    /// Whether the metrics reader's read is answered — `true` from birth.
    /// 
    /// PUBLIC: the promise that an owner can switch this read off can be checked only if the switch
@@ -1859,7 +1852,7 @@ type Engram =
    /// Owner-only, Billing-class: the signing floor, the balance, one signature's price, and how many
    /// payment signatures the balance carries above the floor before `signX402Payment` is refused by
    /// name. The same numbers the check uses, so Billing can say only what the engram enforces.
-   getSigningFloor: () -> (Result_53) query;
+   getSigningFloor: () -> (Result_54) query;
    /// The registry that spawned this engram, if it recorded one.
    /// 
    /// PUBLIC: it is the provenance claim. An engram asserting it is part of a fleet, under that
@@ -1876,7 +1869,7 @@ type Engram =
    /// configuration, and the engram-wide total would also tell one agent how much the others spent.
    /// A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
    /// "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
-   getSpendCeiling: () -> (Result_52) query;
+   getSpendCeiling: () -> (Result_53) query;
    /// Read the caps in force for a caller.
    /// 
    /// OWNER-ONLY, and this is where it diverges from the market's inbound twin, which is public.
@@ -1884,8 +1877,8 @@ type Engram =
    /// Here the engram serves no 402s at all: these caps are the owner's private custody
    /// configuration, and publishing them would tell any caller exactly how large a signing request
    /// can be before it needs an approval nobody is watching for.
-   getSpendPolicy: (caller: opt principal) -> (Result_51) query;
-   getStorageStats: () -> (Result_50) query;
+   getSpendPolicy: (caller: opt principal) -> (Result_52) query;
+   getStorageStats: () -> (Result_51) query;
    /// Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
    /// and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
    /// leaks nothing (booleans about our own scheduling).
@@ -1956,12 +1949,12 @@ type Engram =
    /// ⟨L7⟩ MARKER ADDED 2026-08-23, reasoning above UNCHANGED — this block already said "Stays an
    /// UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
    /// to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
-   getWalletBalances: () -> (Result_49);
+   getWalletBalances: () -> (Result_50);
    /// Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
    /// read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
    /// engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
    /// fabrication is indistinguishable from the truth by construction.
-   getWorldIdConfig: () -> (Result_48) query;
+   getWorldIdConfig: () -> (Result_49) query;
    /// ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
    /// `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
    /// query can do none of them.
@@ -1970,7 +1963,7 @@ type Engram =
    /// Valid iff the derived signer address (getWorldIdRpSignerAddress) is registered for this rp_id in
    /// the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
    /// it authorizes opening one verification request, nothing else.
-   getWorldIdRpContext: () -> (Result_47);
+   getWorldIdRpContext: () -> (Result_48);
    /// Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
    /// "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
    /// Portal — the engram never holds or exports a private key (only threshold shares exist, on the
@@ -1980,7 +1973,7 @@ type Engram =
    /// awaits `worldIdRpPublicKey()` (management `ecdsa_public_key`), and it calls `denied()` on
    /// refusal — a state write, which a query cannot perform. So even if the key were cached this
    /// could not become a query without silently retiring its denial record (ADR-0002's class).
-   getWorldIdRpSignerAddress: () -> (Result_44);
+   getWorldIdRpSignerAddress: () -> (Result_45);
    /// The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
    /// artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
    /// `Result<opt Text>` — and the double wrapper is the entire point, not redundancy.
@@ -1999,7 +1992,7 @@ type Engram =
    /// `///`, so the dead name was PUBLISHED in engram.did and pointed every client at a method the
    /// canister does not serve. The tombstones below and at `about()` are historical and correct as
    /// written; this one was present tense, which is the difference that matters.⟩
-   getWorldIdVerification: () -> (Result_46) query;
+   getWorldIdVerification: () -> (Result_47) query;
    /// ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
    /// absence of a `#Conflict` here is the point: these are the calls someone makes while something
    /// is going wrong, and the only two answers that help are "you may not do this" and "there is
@@ -2074,7 +2067,7 @@ type Engram =
    /// 
    /// Owner-gated because it reports on custody posture, and answered as a Result so that a
    /// wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
-   isEvmAddressCached: () -> (Result_45) query;
+   isEvmAddressCached: () -> (Result_46) query;
    /// Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
    /// (an `/auth/connector`-style route) after II authentication. The client then
    /// redirects the user's browser to `redirectUri` with `?code=<this>` so the
@@ -2082,7 +2075,7 @@ type Engram =
    /// 
    /// Owner-only: only the engram owner can authorize a Connector install.
    issueAuthCode: (redirectUri: text, scope: text, codeChallenge: text,
-    clientId: opt text) -> (Result_44);
+    clientId: opt text) -> (Result_45);
    /// ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
    /// ROW. A single label for a whole ring misattributes every row recorded under the other source,
    /// and the source flips by design (self-call first, balance on fallback). Its documentation of
@@ -2096,7 +2089,7 @@ type Engram =
    /// Refusal reason preserved, and it is the sharpest of this family: a masked `[]` reads as a
    /// DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
    /// reader, it feeds a wrong number into a decision about destroying data.
-   listActivitySnapshots: (start: nat, limit: nat) -> (Result_43) query;
+   listActivitySnapshots: (start: nat, limit: nat) -> (Result_44) query;
    /// ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
    /// 
    /// The refusal prose that used to be `gatedTrap`'s `whyNotEmpty` argument is not lost — it is why
@@ -2111,7 +2104,7 @@ type Engram =
    /// 
    /// `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
    /// A method that filters rows by caller sets it — see L1's row-level honesty rule.
-   listAgents: (start: nat, limit: nat) -> (Result_42) query;
+   listAgents: (start: nat, limit: nat) -> (Result_43) query;
    /// The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
    /// 
    /// Two audiences, two methods (L1/L8), rather than one method masking fields by caller: a
@@ -2123,7 +2116,7 @@ type Engram =
    /// Refusal reason preserved: `[]` reads as "this engram has no agents", and this is the list a
    /// guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
    /// it tells someone acting under emergency powers that there is nothing to act on.
-   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_41) query;
+   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_42) query;
    /// Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
    /// 
    /// The optional leading filter SURVIVES the L3 reshape — ratified (census tier-2 #8) rather than
@@ -2156,7 +2149,21 @@ type Engram =
    /// For the owner and a guardian `withheld` is 0 and the page is the span. WHAT WOULD MAKE THIS
    /// WRONG: a reader who must see the whole record without being the owner or a guardian — the
    /// public certified head is the answer for integrity, and nothing else is.
-   listAuditEntries: (start: nat, limit: nat) -> (Result_24) query;
+   /// 
+   /// ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ PUBLIC NOW, AND THE COUNT BECAME ROWS. The
+   /// reply is a `Wire.RecordPage`: every entry in the span the reader may not see in full comes back
+   /// as a hash-only row in `sealed` (id, SHA-256 of its body, entry hash) instead of being counted in
+   /// `withheld`, so `items.size() + sealed.size()` is the span examined. Each entry is hashed first,
+   /// then chained (`AuditLog`), so those rows are enough to walk from any entry to the certified
+   /// head — which is what lets a stranger check one entry without the owner. A caller with no role,
+   /// the anonymous caller included, is a stranger (`RecordView.readerFrom`) and gets only sealed
+   /// rows; the owner and guardians still see every entry, an agent its own. Nothing here refuses,
+   /// so the read's former refusal ("Anonymous caller not allowed") is gone from it.
+   /// `ringFloor` says where the ring starts — a `start` below it begins at it — and `hashFirstFrom`
+   /// where this record switched to the hash-first rule. A sealed row costs one SHA-256 of its body
+   /// at read time; nothing new is stored. WHAT WOULD MAKE THIS WRONG: a sealed row carrying any part
+   /// of a body, or a stranger reaching `items` (test/record-view.test.mo pins both).
+   listAuditEntries: (start: nat, limit: nat) -> (Result_41) query;
    /// ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
    /// 
    /// This method used to answer THREE ways to one question: a list, an `#Err` text, and a trap,
@@ -2212,13 +2219,6 @@ type Engram =
    /// for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
    /// complete one. Counted before slicing, so policy-hidden rows never blur into paging.
    listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_36) query;
-   /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
-   /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
-   /// 
-   /// Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
-   /// AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
-   /// registration remains the audit chain under getCertifiedAuditHead.
-   listEip712Types: (start: nat, limit: nat) -> (Result_35) query;
    /// Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
    /// 
    /// NAMED item, not a `(Text, Int)` tuple. The Int is an activation time, and a bare Int beside a
@@ -2227,7 +2227,24 @@ type Engram =
    /// Refusal reason preserved, and it has two halves that matter separately: `[]` reads as "this
    /// engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
    /// opposite security posture. It also erases any pending 24h activation from view.
-   listEvmWithdrawDestinations: (start: nat, limit: nat) -> (Result_34) query;
+   /// 
+   /// ⟨2026-10-14, 4A⟩ One action's list: `typeId` names the action, and an unregistered one is
+   /// `#NotFound` rather than an empty page (an empty page means "this action may sign to nothing").
+   /// The item's field is `value`, not `address`: a list may hold a venue value that is no address.
+   /// Readable by the owner, an active agent or an active guardian, as the old list was.
+   listEip712Destinations: (typeId: blob, start: nat, limit: nat) ->
+    (Result_35) query;
+   /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
+   /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
+   /// 
+   /// Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
+   /// AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
+   /// registration remains the audit chain under getCertifiedAuditHead.
+   /// 
+   /// ⟨2026-10-14, the owner's ruling 3A⟩ Each row carries its per-field rules (`fieldRules`), joined in
+   /// from `eip712FieldRules` — they are part of what the type authorises, so a reader of the list must
+   /// not have to make a second call to learn them. The row type is `Eip712TypeView`.
+   listEip712Types: (start: nat, limit: nat) -> (Result_34) query;
    /// Accessible by owner and guardians.
    /// 
    /// Refusal reason carried over from the trap, because it is the sharpest example of why this
@@ -2474,7 +2491,7 @@ type Engram =
    /// (every family qualifiesForReview admits is written to auditLogger, so they share that space),
    /// and this never inspects an operation or a role. Widening what the review shows therefore
    /// changes only which ids the console can pass here — it cannot desynchronise the cursor.
-   markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_8);
+   markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_12);
    /// The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
    /// key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
    /// nomination per agent — a new one replaces the earlier one, and the record says which. Refused,
@@ -2517,7 +2534,7 @@ type Engram =
    /// NOT freeze-gated: the owner always controls their own funds.
    /// Guardian freeze only blocks agent/public operations.
    ownerWithdraw: (amount: TokenAmount, ownerAuth: opt ActionAuth) ->
-    (Result_8);
+    (Result_12);
    /// ⟨0.16.0⟩ `payRentFromEarnings` DELETED — ruled TWICE (B1 and B2), and it was the single
    /// clearest violation of the OSS/platform split in this repo.
    /// 
@@ -2639,7 +2656,7 @@ type Engram =
    /// counter here could never persist; read counting lives on the update path
    /// (`sessionReadContext` and the MCP reads). A caller measuring engram usage from this method
    /// will measure nothing.
-   readMemory: (path: text) -> (Result_11) query;
+   readMemory: (path: text) -> (Result_10) query;
    /// Read many paths in one call. Per-path Results are KEPT — partial success is the point, and
    /// one unreadable path must not fail the other nine.
    /// 
@@ -2750,6 +2767,9 @@ type Engram =
    /// override is to overwrite it with a frozen copy of the global policy, which then stops
    /// following later changes. That makes every override permanent in effect.
    removeCallerSpendPolicy: (caller: principal) -> (Result_1);
+   /// ⟨2026-10-14, 4A⟩ Remove a destination from one action's list. Instant, and NOT freeze-gated:
+   /// removal TIGHTENS, and a frozen engram must still be able to shrink what it could sign to.
+   removeEip712Destination: (typeId: blob, value: text) -> (Result_1);
    /// De-register a type that has NEVER SIGNED. Exists because of a hazard the first external
    /// validation found within hours (consumer report, 2026-08-06): a bare-name #standard registration —
    /// cheap, no watcher preconditions — permanently blocked the guarded namespaced registration
@@ -2759,8 +2779,9 @@ type Engram =
    /// removes only authority that was never exercised, which is removing nothing but the mistake.
    /// NOT freeze-gated, same reasoning as removeEvmWithdrawDestination: this is TIGHTENING, and a
    /// frozen engram must still be able to shrink what it could sign.
+   /// ⟨2026-10-14⟩ `removeEvmWithdrawDestination` is now `removeEip712Destination` (ruling 4A); same
+   /// reasoning. Removing a type now also drops its rules and its own destination list.
    removeEip712Type: (typeId: blob) -> (Result_1);
-   removeEvmWithdrawDestination: (dest: text) -> (Result_1);
    /// Owner-only: remove a guardian from the roster.
    /// 
    /// Unlike revoking an agent this is NOT terminal for the principal — the guardian roster does
@@ -2774,7 +2795,7 @@ type Engram =
    /// the original audit entry stay exactly where they were; this appends a chained
    /// `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
    repudiateMemoryWrite: (path: text, version: nat, reason: text) ->
-    (Result_8);
+    (Result_12);
    /// ⚠ OWNER-ONLY BULK RESET. Destructive, and wider than its name suggests.
    /// 
    /// It severs EVERY grant surface that can outlive a role — agents, guardians, invites and
@@ -2902,7 +2923,7 @@ type Engram =
    /// written, and only then does it await one notification per revoked agent. So a notification
    /// that fails leaves the agents revoked here regardless — a partial notify is not a partial
    /// revocation, which is the direction that matters for a panic button.
-   revokeAllAgents: () -> (Result_8);
+   revokeAllAgents: () -> (Result_12);
    /// Owner-only panic button: revoke every connector bearer token at once. Returns how many.
    /// 
    /// The THIRD independent surface — hosted connectors authenticate with bearer tokens, not with
@@ -2911,7 +2932,7 @@ type Engram =
    /// holding a live session.
    /// 
    /// Tokens are re-issuable: revoking them is not permanent the way revoking an agent is.
-   revokeAllBearerTokens: () -> (Result_8);
+   revokeAllBearerTokens: () -> (Result_12);
    /// ⟨0.16.0⟩ `removeAllGuardians` DELETED — test-only (L6), and verified NOT part of KILL-SWITCH's
    /// mass-revoke set. The destructive phase-07 suite iterates `removeGuardian` instead, so nothing
    /// loses a capability: what dies is a bulk spelling no runbook ever invoked.
@@ -2923,7 +2944,7 @@ type Engram =
    /// 
    /// Unlike revoking an agent, this costs nothing permanently — an invite is a one-time code,
    /// so voiding it and minting a fresh one is the ordinary path.
-   revokeAllInvites: () -> (Result_8);
+   revokeAllInvites: () -> (Result_12);
    /// Revoke a bearer token by its public tokenId. Idempotent.
    /// Subsequent /mcp requests using this token will be rejected.
    revokeBearerToken: (tokenId: text) -> (Result_1);
@@ -2950,13 +2971,6 @@ type Engram =
    /// agent on that record, so its standing is not the problem — the record's state is. An
    /// agent reading `#Refused` would go looking for a permission that was never missing.
    rotateAgentKeyHash: (newPublicKeyHash: text) -> (Result_1);
-   /// One-time onboarding seed: writes a starter file so the first read-back is non-empty.
-   /// 
-   /// Owner-only, and it REFUSES once any memory exists — so it can only ever add the initial
-   /// placeholder and can never overwrite real content. Deliberately NOT counted as a write (no
-   /// `totalMemoryWrites`, no `firstWriteAt`): it is a system seed rather than activity, and
-   /// counting it would corrupt both the write metrics and time-to-first-write for every engram.
-   seedMemory: (path: text, content: blob) -> (Result);
    /// Append to a memory file against a PAID x402 session voucher — the write half of the paid rail,
    /// authorized by the voucher rather than by a role.
    /// ⟨2026-09-30, ic402 2.17.0⟩ Authorized by the payer's own call with the voucher: only the
@@ -3000,7 +3014,7 @@ type Engram =
    /// ⚠ RAW STORED BYTES, like `readMemoryBatch`. On a Private (encrypted) engram the content is
    /// CIPHERTEXT; the key-holding SDK decrypts it. A caller without the key gets bytes it cannot
    /// read, not an error.
-   sessionReadContext: (clientLabel: text) -> (Result_12);
+   sessionReadContext: (clientLabel: text) -> (Result_11);
    /// Read one memory file against a PAID x402 session voucher. No role, no invite — the voucher is
    /// the authorization, which is what makes this the engram's one rail a stranger can pay to use.
    /// 
@@ -3030,7 +3044,7 @@ type Engram =
    ///     session must not be the side door: without this guard a stranger holding a fraction-of-a-
    ///     cent voucher could read `secrets/*`.
    ///   · Payments are frozen on this engram.
-   sessionReadMemory: (voucher: Voucher, path: text) -> (Result_11);
+   sessionReadMemory: (voucher: Voucher, path: text) -> (Result_10);
    /// Configure action alerts: an https webhook that receives new chained-audit entries matching the
    /// enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
    /// POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
@@ -3070,7 +3084,7 @@ type Engram =
    /// called it an "ops floor: retention enforcement deletes owner backup data silently", mitigated
    /// by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
    /// they are told how many, in the reply and in the audit line.
-   setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_10);
+   setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_9);
    /// Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
    setCallerSpendPolicy: (caller: principal, policy: SpendingPolicy) ->
     (Result_1);
@@ -3176,6 +3190,10 @@ type Engram =
    /// bounded instead by each registered type's daily count and destination list; and agent-
    /// registration transactions (`signEngramRegistration`), bounded by three per caller per day and
    /// the 500-gwei gas ceiling. Whether the ceiling should cover them is a separate owner question.⟩
+   /// ⟨2026-10-14, the owner's rulings 3A, 4A and 5A⟩ Typed-data signatures are now bounded by each
+   /// registered type's daily count, its per-field rules ("at most N", "must equal X") and ITS OWN
+   /// destination list, and the signing floor (`SigningFloor`) guards them as it guards x402 payments.
+   /// They are still not counted against this ceiling.
    /// 
    /// WHY: the owner decided on 2026-09-28 to add one daily spending ceiling across all callers on an
    /// engram and keep the limit of five agents. Every other spending limit is per caller, so without
@@ -3297,7 +3315,7 @@ type Engram =
       maxFeePerGas: nat;
       maxPriorityFeePerGas: nat;
       nonce: nat;
-    }) -> (Result_9);
+    }) -> (Result_8);
    /// Sign an EIP-3009 authorization for x402 payment. Agent-accessible.
    /// Client probes the URL, extracts chain/token/recipient/amount from the 402, and calls this.
    /// Canister signs → returns header → client retries with header.
@@ -3329,33 +3347,6 @@ type Engram =
       tokenName: text;
       tokenVersion: text;
     }) -> (Result_3);
-   /// Self-heal: if the registry's spawn-time push was missed, the owner pulls the number from
-   /// the spawning registry. Idempotent; fails closed if the registry has no record.
-   syncEngramNumber: () -> (Result_8);
-   /// Genesis seed — the atomic "spawn only when there's real content" primitive. The spawning
-   /// REGISTRY pushes the owner's first real memory immediately after install, so a canister is
-   /// never spawned holding nothing (see the registry's `provisionEngram` optional genesis).
-   /// 
-   /// Gated `spawnedBy`-only and ONE-SHOT: it refuses once any file exists, so it can seed and never
-   /// overwrite. Unlike the owner-only `seedMemory` placeholder this is REAL owner content, so it
-   /// IS counted as an owner write (`firstWriteAt`, `totalMemoryWrites`) and is authored by the
-   /// OWNER rather than by the registry principal that called it. It never touches the
-   /// agent metrics.
-   /// 
-   /// ⚠ THE PAYLOAD IS `Nat` AND MUST STAY `Nat`, which is a constraint on any client of this
-   /// method rather than an internal detail. Its only caller is the registry, over an
-   /// inter-canister boundary, through a hand-declared actor type — and the registry is ROUTINELY a
-   /// different version from the engram template it is seeding: it upgrades before the fleet does,
-   /// and during a transition it can serve a template older than itself. A return-type change here
-   /// breaks genesis provisioning across that skew. That is measured, not predicted: the registry
-   /// trapped with "IDL error: unexpected IDL type when parsing Nat" while seeding an engram built
-   /// at the staging tag. A receipt would buy nothing anyway — the caller does `ignore await`.
-   /// 
-   /// ⚠ ORDERING: upload the engram TEMPLATE first, then upgrade the registry. The reverse leaves a
-   /// window where a spawn seeds an old-shape engram with a new-shape expectation; the reply fails
-   /// to decode and `provisionEngram` dies on a trap its own `try/catch` cannot reach (ADR-0001),
-   /// failing the WHOLE SPAWN rather than just the seed.
-   sysApplyGenesisSeed: (path: text, content: blob) -> (Result_8);
    /// OWNER force-close, for a session the payer abandoned.
    /// 
    /// ⟨R1b, ruled 2026-08-26: owner-gated, NO guardian.⟩ It moves someone else's money, and only ever
@@ -3532,9 +3523,6 @@ type Engram =
    /// nobody but the spawning registry can fix it. That refusal therefore names the real remedy
    /// rather than telling an owner to run a call they can no longer make.
    sysSetBillerId: (id: principal) -> (Result_1);
-   /// One-shot assignment of the spawn ordinal — callable ONLY by the spawning registry, ONLY
-   /// while unset. Neither the owner nor any later registry can change an assigned number.
-   sysSetEngramNumber: (n: nat) -> (Result_1);
    /// Point this engram at the commerce satellite allowed to ask it for signatures. ⟨0.16.0, B1⟩
    /// 
    /// SAME AUTHORITY AS `sysSetBillerId`, and for a stronger reason. That one routes money; this one
@@ -3571,6 +3559,9 @@ type Engram =
    /// (the market cannot introduce a shape), its cool-off must have elapsed, its per-type daily cap
    /// still binds, the destination allowlist still fails closed, and a payments freeze still stops
    /// it. What the market supplies is the request; what the engram supplies is the whole policy.
+   /// ⟨2026-10-14⟩ And the type's per-field rules, its own destination list (ruling 4A) and the
+   /// signing floor (ruling 5A) — all in `eip712SignFor`, so they bind the market as they bind the
+   /// owner; a refusal here is on the chained record under the market's caller and role.
    /// 
    /// That is what "signatures only" means in code, and it is why this method needs no new authority
    /// model: an unregistered typeId is refused for the market exactly as it is for the owner.
@@ -3696,6 +3687,32 @@ type Eip712Value =
    string: text;
    uint: nat;
  };
+type Eip712TypeView = 
+ record {
+   ackIrrevocable: bool;
+   authorityClass: AuthorityClass;
+   chainId: nat;
+   cooloffEndsAtNs: int;
+   dailySignCap: nat;
+   destinationFields: vec text;
+   domainName: text;
+   domainSeparator: vec nat8;
+   domainVersion: text;
+   encodeTypeString: text;
+   fieldRules: vec record {
+                     text;
+                     Eip712FieldRule;
+                   };
+   fields: vec record {
+                 text;
+                 text;
+               };
+   primaryType: text;
+   registeredAtNs: int;
+   typeHash: vec nat8;
+   typeId: blob;
+   verifyingContract: text;
+ };
 type Eip712SignatureOut = 
  record {
    digest: blob;
@@ -3710,6 +3727,19 @@ type Eip712Registration =
    encodeTypeString: text;
    typeId: blob;
  };
+type Eip712FieldRule = 
+ variant {
+   atMost: record {
+             decimals: nat;
+             max: nat;
+           };
+   mustEqual: text;
+ };
+type Eip712Destination = 
+ record {
+   activeFromNs: int;
+   value: text;
+ };
 type Eip3009Authorization = 
  record {
    from: text;
@@ -4050,8 +4080,6 @@ type About =
    agentMemoryWrites: nat;
    auditLogSize: nat;
    backupCount: nat;
-   distinctReaderClients: nat;
-   distinctReaderPrincipals: nat;
    encryptionEnabled: bool;
    firstAgentWriteAtNs: opt int;
    firstWriteAtNs: opt int;