@engramx/idl 0.16.0-rc.12 → 0.16.0-rc.14

package/dist/engram.idl.d.ts

@@ -7,7 +7,6 @@ export interface About {
   guardianCount: bigint;
   totalMemoryWrites: bigint;
   lastAgentWriteAtNs: [] | [bigint];
-  distinctReaderPrincipals: bigint;
   lastWriteAtNs: [] | [bigint];
   totalBackupSize: bigint;
   backupCount: bigint;
@@ -24,7 +23,6 @@ export interface About {
   firstAgentWriteAtNs: [] | [bigint];
   lastReadAtNs: [] | [bigint];
   writesPaused: boolean;
-  distinctReaderClients: bigint;
   totalMemoryReads: bigint;
   walletActivatedAtNs: [] | [bigint];
   encryptionEnabled: boolean;
@@ -282,6 +280,11 @@ export interface Eip3009Authorization {
   nonce: Uint8Array | number[];
   validBefore: bigint;
 }
+export interface Eip712Destination {
+  activeFromNs: bigint;
+  value: string;
+}
+export type Eip712FieldRule = { mustEqual: string } | { atMost: { max: bigint; decimals: bigint } };
 export interface Eip712Registration {
   encodeTypeString: string;
   cooloffEndsAtNs: bigint;
@@ -294,6 +297,25 @@ export interface Eip712SignatureOut {
   rendered: string;
   digest: Uint8Array | number[];
 }
+export interface Eip712TypeView {
+  primaryType: string;
+  encodeTypeString: string;
+  cooloffEndsAtNs: bigint;
+  domainName: string;
+  typeId: Uint8Array | number[];
+  verifyingContract: string;
+  dailySignCap: bigint;
+  fields: Array<[string, string]>;
+  domainSeparator: Uint8Array | number[];
+  destinationFields: Array<string>;
+  authorityClass: AuthorityClass;
+  typeHash: Uint8Array | number[];
+  registeredAtNs: bigint;
+  fieldRules: Array<[string, Eip712FieldRule]>;
+  chainId: bigint;
+  domainVersion: string;
+  ackIrrevocable: boolean;
+}
 export type Eip712Value =
   | { string: string }
   | { bool: boolean }
@@ -335,7 +357,7 @@ export interface Engram {
    * / test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
    * / no role here until the move.
    */
-  acceptAgentKeyNomination: ActorMethod<[Principal], Result_71>;
+  acceptAgentKeyNomination: ActorMethod<[Principal], Result_72>;
   /**
    * / Consensus transform for the alert webhook outcall: collapse the response to status-only so
    * / replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
@@ -349,10 +371,35 @@ export interface Engram {
     [{ context: Uint8Array | number[]; response: HttpRequestResult }],
     HttpRequestResult
   >;
+  /**
+   * / Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
+   * / and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
+   * /
+   * / ⟨2026-10-14, the owner's ruling 4A⟩ ONE LIST PER REGISTERED ACTION. `addEvmWithdrawDestination`,
+   * / `removeEvmWithdrawDestination` and `listEvmWithdrawDestinations` — one list for every action —
+   * / are REMOVED; these three take the action's `typeId`. Same rules, per action: the owner only; an
+   * / addition activates after 24 hours and is refused while payments are frozen; a removal is instant
+   * / and works while frozen; a value is 1–128 characters (an address, or a venue value such as an
+   * / account name). The action must be registered: a destination list belongs to an action, and a
+   * / list for no action would be a value nothing checks. The caller is the owner's app.
+   */
+  addEip712Destination: ActorMethod<[Uint8Array | number[], string], Result_71>;
   /**
    * / Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
    * / of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
    * / shape is IMMUTABLE: any change mints a new typeId.
+   * /
+   * / ⟨2026-10-14, the owner's rulings 3A and 5A⟩ ONE BAR FOR EVERY REGISTRATION — the class the owner
+   * / names is stored as a label and decides nothing. Every registration: records the irrevocability
+   * / acknowledgement (`ackIrrevocable = true`); has no opaque field (`bytes`, `bytes1..32`); names at
+   * / least one destination field OR carries a must-equal rule; passes the watchers — an owner alert
+   * / webhook set, enabled AND with its money class on, and an `#Active` guardian holding
+   * / `canFreezePayments`; and waits `Eip712Policy.COOLOFF_NS` (72 hours). It may carry per-field
+   * / rules (`fieldRules`: "at most N" read as a plain decimal with D places, "must equal X"), which
+   * / are part of the registered shape — inside the typeId, stored in `eip712FieldRules`, enforced in
+   * / `eip712SignFor` before the cap reservation. Before this, a withdrawal registered as `#standard`
+   * / needed no webhook, no guardian and no destination field, waited one hour, and signed to any
+   * / address. Intrinsic checks still come first and the watchers last (the 2026-08-06 re-ordering).
    */
   addEip712Type: ActorMethod<
     [
@@ -365,6 +412,7 @@ export interface Engram {
         fields: Array<[string, string]>;
         destinationFields: Array<string>;
         authorityClass: { standingAuthority: null } | { valueBearing: null } | { standard: null };
+        fieldRules: Array<[string, Eip712FieldRule]>;
         chainId: bigint;
         domainVersion: string;
         ackIrrevocable: boolean;
@@ -372,11 +420,6 @@ export interface Engram {
     ],
     Result_70
   >;
-  /**
-   * / Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
-   * / and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
-   */
-  addEvmWithdrawDestination: ActorMethod<[string], Result_69>;
   /**
    * / ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
    * /
@@ -422,7 +465,7 @@ export interface Engram {
    * / is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
    * / owner-initiated, owner-only, and already chained into the audit log.
    */
-  applyCondense: ActorMethod<[bigint], Result_68>;
+  applyCondense: ActorMethod<[bigint], Result_69>;
   /**
    * / Owner-only: activate a guardian who has registered against an invite.
    * /
@@ -502,7 +545,7 @@ export interface Engram {
    * /
    * / The write half also refuses while writes are PAUSED.
    */
-  backupInit: ActorMethod<[string, BackupType, [] | [string], string, [] | [string]], Result_44>;
+  backupInit: ActorMethod<[string, BackupType, [] | [string], string, [] | [string]], Result_45>;
   /**
    * / Read one chunk of a finalized backup, by index.
    * /
@@ -510,7 +553,7 @@ export interface Engram {
    * / `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
    * / carrying it away are different authorities.
    */
-  backupPullChunk: ActorMethod<[string, bigint], Result_60>;
+  backupPullChunk: ActorMethod<[string, bigint], Result_61>;
   backupPushChunk: ActorMethod<[string, bigint, Uint8Array | number[]], Result_1>;
   /**
    * / The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
@@ -548,7 +591,7 @@ export interface Engram {
    * / pair — e6 base units of the token named first. A name only: Candid passes arguments by
    * / position, so nothing on the wire moved.
    */
-  convertEarningsToCycles: ActorMethod<[string, bigint], Result_8>;
+  convertEarningsToCycles: ActorMethod<[string, bigint], Result_12>;
   /**
    * / Owner-only: mint a single-use invite code an agent redeems with `pairAgent`.
    * /
@@ -568,7 +611,7 @@ export interface Engram {
    * / A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    * / independent check on agents, so one wallet must not hold both.
    */
-  createAgentInvite: ActorMethod<[string, AgentPermissions], Result_44>;
+  createAgentInvite: ActorMethod<[string, AgentPermissions], Result_45>;
   /**
    * / Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
    * / co-owner and not a recovery agent.
@@ -592,7 +635,7 @@ export interface Engram {
    * / So an invite that fails to redeem for that reason is not a bad code. The rule exists because
    * / a check must be independent of the thing it checks.
    */
-  createGuardianInvite: ActorMethod<[string, GuardianPermissions], Result_44>;
+  createGuardianInvite: ActorMethod<[string, GuardianPermissions], Result_45>;
   /**
    * / OWNER-ONLY deletion of a stored backup.
    * /
@@ -626,37 +669,6 @@ export interface Engram {
    * / does not change the policy — the next request over the same limit will be raised again.
    */
   denyRequest: ActorMethod<[string, string], Result_1>;
-  /**
-   * / Force the tECDSA derivation and return the address.
-   * /
-   * / It exists because the gateway's own derivation fires from a timer that is lazy on some
-   * / replicas, and until it lands the EVM quote advertises the `0x0` fallback and settle fails
-   * / closed — a live money surface quoting an address that cannot receive.
-   * /
-   * / ⟨0.16.0, B-2⟩ Derivation now comes from `EvmIdentity`, and the return type carries the
-   * / outcome: this used to answer `""` on failure, which is a Text a caller can and did paste into
-   * / a payment flow. An empty string is not an address, and saying so is the difference between a
-   * / failed derivation and an address of nothing.
-   * /
-   * / ⚠ TRANSITIONAL: it also primes the ic402 gate, because the gate still settles commerce on this
-   * / canister until those 47 methods move. That second call disappears with them — it is listed in
-   * / the move order in the spec's B-2 addendum, not left for someone to find.
-   * /
-   * / PUBLIC: it inherits `getEvmAddress`'s gate rather than choosing one, and could not usefully be
-   * / narrower — it exists so a caller can make the derivation happen BEFORE a payment flow, and the
-   * / derivation itself is ungated. Idempotent and bounded to the same one-derivation-per-lifetime
-   * / work, so an anonymous caller can cause it once and no more.
-   * / ⟨L7⟩ UPDATE, NOT QUERY, and this one does not merely await — it WRITES. The body awaits
-   * / `EvmIdentity.deriveAddress` (the management canister's `ecdsa_public_key`) and
-   * / `gate.deriveEvmRecipientAt` ⟨renamed 2026-09-22 with the path⟩, then caches the result in `evmAddressCache`. So a query is
-   * / impossible twice over: it could not await the derivation, and it could not keep the answer.
-   * / Named `ensure*` rather than `get*` for that reason — the write is the point, and a read verb
-   * / would have promised a cheapness this cannot deliver.
-   * /
-   * / ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
-   * / the site.⟩
-   */
-  ensureEvmReady: ActorMethod<[], Result_44>;
   /**
    * / Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
    * /
@@ -671,7 +683,7 @@ export interface Engram {
    * / situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
    * / failed its integrity check must not attest anything it cannot vouch for.
    */
-  exportMemoryRange: ActorMethod<[bigint, bigint, [] | [Principal]], Result_67>;
+  exportMemoryRange: ActorMethod<[bigint, bigint, [] | [Principal]], Result_68>;
   /**
    * / ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
    * / The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
@@ -688,6 +700,8 @@ export interface Engram {
    * /     individual method's body finds nothing — the check is one level down.⟩
    * /   · `addEip712Type` and `addEvmWithdrawDestination` — pre-staging for a later payout is the
    * /     thing a brake most needs to stop, so the destination list is frozen along with the signing.
+   * /     ⟨2026-10-14, the owner's ruling 4A⟩ `addEvmWithdrawDestination` is removed; its place is
+   * /     `addEip712Destination` (one list per registered action), freeze-gated the same way.
    * /   · `sessionReadMemory` and `sessionAppendMemory` — the paid-memory rail, money coming IN.
    * /
    * / AND WHAT IT DELIBERATELY DOES NOT, stated so the absence is not read as an oversight:
@@ -707,7 +721,7 @@ export interface Engram {
   /**
    * / Delivery status + config readback. Owner-only (the URL is a secret).
    */
-  getActionAlertStatus: ActorMethod<[], Result_58>;
+  getActionAlertStatus: ActorMethod<[], Result_59>;
   /**
    * / Agents need to know what they may revise, so they can read it too. Whole-value config, same
    * / carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
@@ -717,7 +731,7 @@ export interface Engram {
    * / Refusal reason preserved from the trap: a grant is a power, and its absence and its
    * / concealment are different facts.
    */
-  getAgentRevisablePaths: ActorMethod<[], Result_54>;
+  getAgentRevisablePaths: ActorMethod<[], Result_55>;
   /**
    * / OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
    * / paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
@@ -730,7 +744,7 @@ export interface Engram {
    * / empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
    * / Two rows can name one root: an agent paired again after it left is a second engagement.
    */
-  getAgentSeatWeeks: ActorMethod<[bigint, bigint], Result_65>;
+  getAgentSeatWeeks: ActorMethod<[bigint, bigint], Result_66>;
   /**
    * / Owner: everything written into this engram by someone other than the owner since the last
    * / markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
@@ -740,7 +754,7 @@ export interface Engram {
    * / as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
    * / aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
    */
-  getAgentWriteReview: ActorMethod<[], Result_64>;
+  getAgentWriteReview: ActorMethod<[], Result_65>;
   /**
    * / Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
    * / engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
@@ -763,7 +777,7 @@ export interface Engram {
    * / was signed rather than asserted.
    */
   getAuditHead: ActorMethod<[], AuditHead>;
-  getBackupMetadata: ActorMethod<[string], Result_63>;
+  getBackupMetadata: ActorMethod<[string], Result_64>;
   /**
    * / The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
    * /
@@ -799,13 +813,13 @@ export interface Engram {
    * / recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
    * / WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
    */
-  getChildAllowance: ActorMethod<[Principal], Result_62>;
+  getChildAllowance: ActorMethod<[Principal], Result_63>;
   /**
    * / Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
    * / agent's request is refused, the balance now, and every agent's allowance. The console's cost
    * / sentence reads it. Cycles are owner-class information, as on the owner's console read.
    */
-  getChildOpening: ActorMethod<[], Result_61>;
+  getChildOpening: ActorMethod<[], Result_62>;
   /**
    * / Derive the shared memory-encryption key, encrypted under the caller's transport
    * / public key. Gated to owner + read-agents (the same principals allowed to read
@@ -831,7 +845,7 @@ export interface Engram {
    * / cost. Stated here because L7 requires the reason be readable from the interface rather than
    * / inferred by opening the body — which is exactly what had to happen to write this line.
    */
-  getEncryptedMemoryKey: ActorMethod<[[] | [bigint], Uint8Array | number[]], Result_60>;
+  getEncryptedMemoryKey: ActorMethod<[[] | [bigint], Uint8Array | number[]], Result_61>;
   /**
    * / ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
    * /
@@ -858,12 +872,6 @@ export interface Engram {
    * / be discovered, and the ERC-8004 ecosystem it participates in assumes an open read.
    */
   getEngramCard: ActorMethod<[], AgentCard>;
-  /**
-   * / PUBLIC: the engram's permanent spawn ordinal — a provable, non-sensitive fact. It identifies a
-   * / canister, never a person.
-   * / null = spawned before numbering existed; the owner can backfill via syncEngramNumber().
-   */
-  getEngramNumber: ActorMethod<[], [] | [bigint]>;
   /**
    * / Re-pointed at `EvmIdentity` (B-2): custody derivation no longer routes through the ic402
    * / Gateway, which is leaving for the market canister. Behaviour is unchanged for a caller — same
@@ -936,7 +944,7 @@ export interface Engram {
    * / `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
    * / failed derivation — that is fail-to-empty on a money surface, and it stops here).
    */
-  getEvmAddress: ActorMethod<[], Result_59>;
+  getEvmAddress: ActorMethod<[], Result_60>;
   /**
    * / The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
    * / the address this canister derives for itself.
@@ -955,7 +963,7 @@ export interface Engram {
    * / cost — stated here because L7 requires the reason be readable from the interface rather than
    * / inferred by opening the body.
    */
-  getEvmSignerAddress: ActorMethod<[], Result_44>;
+  getEvmSignerAddress: ActorMethod<[], Result_45>;
   /**
    * / PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
    * /
@@ -968,7 +976,7 @@ export interface Engram {
   /**
    * / A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
    */
-  getGuardianAlertStatus: ActorMethod<[], Result_58>;
+  getGuardianAlertStatus: ActorMethod<[], Result_59>;
   /**
    * / The market this engram will accept signing requests from — `null` until the registry pushes
    * / one at spawn, which is why `requireMarket` refuses fleet-wide today.
@@ -1001,7 +1009,7 @@ export interface Engram {
    * / never renumbered: the next page starts at the last version returned plus one. Defaults
    * / return the whole history of any file a pre-FD engram could have held.
    */
-  getMemoryHistory: ActorMethod<[string, [] | [bigint], [] | [bigint]], Result_57>;
+  getMemoryHistory: ActorMethod<[string, [] | [bigint], [] | [bigint]], Result_58>;
   /**
    * / PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
    * / history would be a public, fleet-enumerable feed of when each owner terminated a trust
@@ -1050,7 +1058,7 @@ export interface Engram {
    * / forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
    * / "nothing is held back".
    */
-  getMemoryRetentionPolicy: ActorMethod<[], Result_56>;
+  getMemoryRetentionPolicy: ActorMethod<[], Result_57>;
   /**
    * / The metrics reader this engram answers — `null` until the spawning registry names one.
    * /
@@ -1079,7 +1087,7 @@ export interface Engram {
    * / client (rule 4) and bought a masked answer nobody had asked for — the census could not even
    * / find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
    */
-  getOwnerConsole: ActorMethod<[], Result_55>;
+  getOwnerConsole: ActorMethod<[], Result_56>;
   /**
    * / Owner + agents only (agents need it to avoid writing protected paths).
    * /
@@ -1093,7 +1101,7 @@ export interface Engram {
    * / writing one — so a fabricated empty here does not merely misinform, it invites the write the
    * / list exists to prevent.
    */
-  getProtectedPaths: ActorMethod<[], Result_54>;
+  getProtectedPaths: ActorMethod<[], Result_55>;
   /**
    * / Whether the metrics reader's read is answered — `true` from birth.
    * /
@@ -1106,7 +1114,7 @@ export interface Engram {
    * / payment signatures the balance carries above the floor before `signX402Payment` is refused by
    * / name. The same numbers the check uses, so Billing can say only what the engram enforces.
    */
-  getSigningFloor: ActorMethod<[], Result_53>;
+  getSigningFloor: ActorMethod<[], Result_54>;
   /**
    * / The registry that spawned this engram, if it recorded one.
    * /
@@ -1127,7 +1135,7 @@ export interface Engram {
    * / A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
    * / "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
    */
-  getSpendCeiling: ActorMethod<[], Result_52>;
+  getSpendCeiling: ActorMethod<[], Result_53>;
   /**
    * / Read the caps in force for a caller.
    * /
@@ -1137,8 +1145,8 @@ export interface Engram {
    * / configuration, and publishing them would tell any caller exactly how large a signing request
    * / can be before it needs an approval nobody is watching for.
    */
-  getSpendPolicy: ActorMethod<[[] | [Principal]], Result_51>;
-  getStorageStats: ActorMethod<[], Result_50>;
+  getSpendPolicy: ActorMethod<[[] | [Principal]], Result_52>;
+  getStorageStats: ActorMethod<[], Result_51>;
   /**
    * / Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
    * / and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
@@ -1211,14 +1219,14 @@ export interface Engram {
    * / UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
    * / to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
    */
-  getWalletBalances: ActorMethod<[], Result_49>;
+  getWalletBalances: ActorMethod<[], Result_50>;
   /**
    * / Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
    * / read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
    * / engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
    * / fabrication is indistinguishable from the truth by construction.
    */
-  getWorldIdConfig: ActorMethod<[], Result_48>;
+  getWorldIdConfig: ActorMethod<[], Result_49>;
   /**
    * / ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
    * / `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
@@ -1229,7 +1237,7 @@ export interface Engram {
    * / the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
    * / it authorizes opening one verification request, nothing else.
    */
-  getWorldIdRpContext: ActorMethod<[], Result_47>;
+  getWorldIdRpContext: ActorMethod<[], Result_48>;
   /**
    * / Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
    * / "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
@@ -1241,7 +1249,7 @@ export interface Engram {
    * / refusal — a state write, which a query cannot perform. So even if the key were cached this
    * / could not become a query without silently retiring its denial record (ADR-0002's class).
    */
-  getWorldIdRpSignerAddress: ActorMethod<[], Result_44>;
+  getWorldIdRpSignerAddress: ActorMethod<[], Result_45>;
   /**
    * / The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
    * / artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
@@ -1262,7 +1270,7 @@ export interface Engram {
    * / canister does not serve. The tombstones below and at `about()` are historical and correct as
    * / written; this one was present tense, which is the difference that matters.⟩
    */
-  getWorldIdVerification: ActorMethod<[], Result_46>;
+  getWorldIdVerification: ActorMethod<[], Result_47>;
   /**
    * / ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
    * / absence of a `#Conflict` here is the point: these are the calls someone makes while something
@@ -1346,7 +1354,7 @@ export interface Engram {
    * / Owner-gated because it reports on custody posture, and answered as a Result so that a
    * / wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
    */
-  isEvmAddressCached: ActorMethod<[], Result_45>;
+  isEvmAddressCached: ActorMethod<[], Result_46>;
   /**
    * / Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
    * / (an `/auth/connector`-style route) after II authentication. The client then
@@ -1355,7 +1363,7 @@ export interface Engram {
    * /
    * / Owner-only: only the engram owner can authorize a Connector install.
    */
-  issueAuthCode: ActorMethod<[string, string, string, [] | [string]], Result_44>;
+  issueAuthCode: ActorMethod<[string, string, string, [] | [string]], Result_45>;
   /**
    * / ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
    * / ROW. A single label for a whole ring misattributes every row recorded under the other source,
@@ -1371,7 +1379,7 @@ export interface Engram {
    * / DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
    * / reader, it feeds a wrong number into a decision about destroying data.
    */
-  listActivitySnapshots: ActorMethod<[bigint, bigint], Result_43>;
+  listActivitySnapshots: ActorMethod<[bigint, bigint], Result_44>;
   /**
    * / ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
    * /
@@ -1388,7 +1396,7 @@ export interface Engram {
    * / `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
    * / A method that filters rows by caller sets it — see L1's row-level honesty rule.
    */
-  listAgents: ActorMethod<[bigint, bigint], Result_42>;
+  listAgents: ActorMethod<[bigint, bigint], Result_43>;
   /**
    * / The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
    * /
@@ -1402,7 +1410,7 @@ export interface Engram {
    * / guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
    * / it tells someone acting under emergency powers that there is nothing to act on.
    */
-  listAgentsForGuardian: ActorMethod<[bigint, bigint], Result_41>;
+  listAgentsForGuardian: ActorMethod<[bigint, bigint], Result_42>;
   /**
    * / Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
    * /
@@ -1437,8 +1445,22 @@ export interface Engram {
    * / For the owner and a guardian `withheld` is 0 and the page is the span. WHAT WOULD MAKE THIS
    * / WRONG: a reader who must see the whole record without being the owner or a guardian — the
    * / public certified head is the answer for integrity, and nothing else is.
-   */
-  listAuditEntries: ActorMethod<[bigint, bigint], Result_24>;
+   * /
+   * / ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ PUBLIC NOW, AND THE COUNT BECAME ROWS. The
+   * / reply is a `Wire.RecordPage`: every entry in the span the reader may not see in full comes back
+   * / as a hash-only row in `sealed` (id, SHA-256 of its body, entry hash) instead of being counted in
+   * / `withheld`, so `items.size() + sealed.size()` is the span examined. Each entry is hashed first,
+   * / then chained (`AuditLog`), so those rows are enough to walk from any entry to the certified
+   * / head — which is what lets a stranger check one entry without the owner. A caller with no role,
+   * / the anonymous caller included, is a stranger (`RecordView.readerFrom`) and gets only sealed
+   * / rows; the owner and guardians still see every entry, an agent its own. Nothing here refuses,
+   * / so the read's former refusal ("Anonymous caller not allowed") is gone from it.
+   * / `ringFloor` says where the ring starts — a `start` below it begins at it — and `hashFirstFrom`
+   * / where this record switched to the hash-first rule. A sealed row costs one SHA-256 of its body
+   * / at read time; nothing new is stored. WHAT WOULD MAKE THIS WRONG: a sealed row carrying any part
+   * / of a body, or a stranger reaching `items` (test/record-view.test.mo pins both).
+   */
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_41>;
   /**
    * / ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
    * /
@@ -1504,15 +1526,6 @@ export interface Engram {
    * / complete one. Counted before slicing, so policy-hidden rows never blur into paging.
    */
   listDeletedMemoryFiles: ActorMethod<[bigint, bigint], Result_36>;
-  /**
-   * / The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
-   * / Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
-   * /
-   * / Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
-   * / AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
-   * / registration remains the audit chain under getCertifiedAuditHead.
-   */
-  listEip712Types: ActorMethod<[bigint, bigint], Result_35>;
   /**
    * / Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
    * /
@@ -1522,8 +1535,26 @@ export interface Engram {
    * / Refusal reason preserved, and it has two halves that matter separately: `[]` reads as "this
    * / engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
    * / opposite security posture. It also erases any pending 24h activation from view.
+   * /
+   * / ⟨2026-10-14, 4A⟩ One action's list: `typeId` names the action, and an unregistered one is
+   * / `#NotFound` rather than an empty page (an empty page means "this action may sign to nothing").
+   * / The item's field is `value`, not `address`: a list may hold a venue value that is no address.
+   * / Readable by the owner, an active agent or an active guardian, as the old list was.
    */
-  listEvmWithdrawDestinations: ActorMethod<[bigint, bigint], Result_34>;
+  listEip712Destinations: ActorMethod<[Uint8Array | number[], bigint, bigint], Result_35>;
+  /**
+   * / The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
+   * / Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
+   * /
+   * / Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
+   * / AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
+   * / registration remains the audit chain under getCertifiedAuditHead.
+   * /
+   * / ⟨2026-10-14, the owner's ruling 3A⟩ Each row carries its per-field rules (`fieldRules`), joined in
+   * / from `eip712FieldRules` — they are part of what the type authorises, so a reader of the list must
+   * / not have to make a second call to learn them. The row type is `Eip712TypeView`.
+   */
+  listEip712Types: ActorMethod<[bigint, bigint], Result_34>;
   /**
    * / Accessible by owner and guardians.
    * /
@@ -1792,7 +1823,7 @@ export interface Engram {
    * / and this never inspects an operation or a role. Widening what the review shows therefore
    * / changes only which ids the console can pass here — it cannot desynchronise the cursor.
    */
-  markAgentWritesReviewed: ActorMethod<[[] | [bigint]], Result_8>;
+  markAgentWritesReviewed: ActorMethod<[[] | [bigint]], Result_12>;
   /**
    * / The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
    * / key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
@@ -1840,7 +1871,7 @@ export interface Engram {
    * / NOT freeze-gated: the owner always controls their own funds.
    * / Guardian freeze only blocks agent/public operations.
    */
-  ownerWithdraw: ActorMethod<[TokenAmount, [] | [ActionAuth]], Result_8>;
+  ownerWithdraw: ActorMethod<[TokenAmount, [] | [ActionAuth]], Result_12>;
   /**
    * / ⟨0.16.0⟩ `payRentFromEarnings` DELETED — ruled TWICE (B1 and B2), and it was the single
    * / clearest violation of the OSS/platform split in this repo.
@@ -1969,7 +2000,7 @@ export interface Engram {
    * / (`sessionReadContext` and the MCP reads). A caller measuring engram usage from this method
    * / will measure nothing.
    */
-  readMemory: ActorMethod<[string], Result_11>;
+  readMemory: ActorMethod<[string], Result_10>;
   /**
    * / Read many paths in one call. Per-path Results are KEPT — partial success is the point, and
    * / one unreadable path must not fail the other nine.
@@ -2089,6 +2120,11 @@ export interface Engram {
    * / following later changes. That makes every override permanent in effect.
    */
   removeCallerSpendPolicy: ActorMethod<[Principal], Result_1>;
+  /**
+   * / ⟨2026-10-14, 4A⟩ Remove a destination from one action's list. Instant, and NOT freeze-gated:
+   * / removal TIGHTENS, and a frozen engram must still be able to shrink what it could sign to.
+   */
+  removeEip712Destination: ActorMethod<[Uint8Array | number[], string], Result_1>;
   /**
    * / De-register a type that has NEVER SIGNED. Exists because of a hazard the first external
    * / validation found within hours (consumer report, 2026-08-06): a bare-name #standard registration —
@@ -2099,9 +2135,10 @@ export interface Engram {
    * / removes only authority that was never exercised, which is removing nothing but the mistake.
    * / NOT freeze-gated, same reasoning as removeEvmWithdrawDestination: this is TIGHTENING, and a
    * / frozen engram must still be able to shrink what it could sign.
+   * / ⟨2026-10-14⟩ `removeEvmWithdrawDestination` is now `removeEip712Destination` (ruling 4A); same
+   * / reasoning. Removing a type now also drops its rules and its own destination list.
    */
   removeEip712Type: ActorMethod<[Uint8Array | number[]], Result_1>;
-  removeEvmWithdrawDestination: ActorMethod<[string], Result_1>;
   /**
    * / Owner-only: remove a guardian from the roster.
    * /
@@ -2118,7 +2155,7 @@ export interface Engram {
    * / the original audit entry stay exactly where they were; this appends a chained
    * / `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
    */
-  repudiateMemoryWrite: ActorMethod<[string, bigint, string], Result_8>;
+  repudiateMemoryWrite: ActorMethod<[string, bigint, string], Result_12>;
   /**
    * / ⚠ OWNER-ONLY BULK RESET. Destructive, and wider than its name suggests.
    * /
@@ -2262,7 +2299,7 @@ export interface Engram {
    * / that fails leaves the agents revoked here regardless — a partial notify is not a partial
    * / revocation, which is the direction that matters for a panic button.
    */
-  revokeAllAgents: ActorMethod<[], Result_8>;
+  revokeAllAgents: ActorMethod<[], Result_12>;
   /**
    * / Owner-only panic button: revoke every connector bearer token at once. Returns how many.
    * /
@@ -2273,7 +2310,7 @@ export interface Engram {
    * /
    * / Tokens are re-issuable: revoking them is not permanent the way revoking an agent is.
    */
-  revokeAllBearerTokens: ActorMethod<[], Result_8>;
+  revokeAllBearerTokens: ActorMethod<[], Result_12>;
   /**
    * / ⟨0.16.0⟩ `removeAllGuardians` DELETED — test-only (L6), and verified NOT part of KILL-SWITCH's
    * / mass-revoke set. The destructive phase-07 suite iterates `removeGuardian` instead, so nothing
@@ -2287,7 +2324,7 @@ export interface Engram {
    * / Unlike revoking an agent, this costs nothing permanently — an invite is a one-time code,
    * / so voiding it and minting a fresh one is the ordinary path.
    */
-  revokeAllInvites: ActorMethod<[], Result_8>;
+  revokeAllInvites: ActorMethod<[], Result_12>;
   /**
    * / Revoke a bearer token by its public tokenId. Idempotent.
    * / Subsequent /mcp requests using this token will be rejected.
@@ -2320,15 +2357,6 @@ export interface Engram {
    * / agent reading `#Refused` would go looking for a permission that was never missing.
    */
   rotateAgentKeyHash: ActorMethod<[string], Result_1>;
-  /**
-   * / One-time onboarding seed: writes a starter file so the first read-back is non-empty.
-   * /
-   * / Owner-only, and it REFUSES once any memory exists — so it can only ever add the initial
-   * / placeholder and can never overwrite real content. Deliberately NOT counted as a write (no
-   * / `totalMemoryWrites`, no `firstWriteAt`): it is a system seed rather than activity, and
-   * / counting it would corrupt both the write metrics and time-to-first-write for every engram.
-   */
-  seedMemory: ActorMethod<[string, Uint8Array | number[]], Result>;
   /**
    * / Append to a memory file against a PAID x402 session voucher — the write half of the paid rail,
    * / authorized by the voucher rather than by a role.
@@ -2375,7 +2403,7 @@ export interface Engram {
    * / CIPHERTEXT; the key-holding SDK decrypts it. A caller without the key gets bytes it cannot
    * / read, not an error.
    */
-  sessionReadContext: ActorMethod<[string], Result_12>;
+  sessionReadContext: ActorMethod<[string], Result_11>;
   /**
    * / Read one memory file against a PAID x402 session voucher. No role, no invite — the voucher is
    * / the authorization, which is what makes this the engram's one rail a stranger can pay to use.
@@ -2407,7 +2435,7 @@ export interface Engram {
    * /     cent voucher could read `secrets/*`.
    * /   · Payments are frozen on this engram.
    */
-  sessionReadMemory: ActorMethod<[Voucher, string], Result_11>;
+  sessionReadMemory: ActorMethod<[Voucher, string], Result_10>;
   /**
    * / Configure action alerts: an https webhook that receives new chained-audit entries matching the
    * / enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
@@ -2454,7 +2482,7 @@ export interface Engram {
    * / by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
    * / they are told how many, in the reply and in the audit line.
    */
-  setBackupRetention: ActorMethod<[string, bigint], Result_10>;
+  setBackupRetention: ActorMethod<[string, bigint], Result_9>;
   /**
    * / Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
    */
@@ -2576,6 +2604,10 @@ export interface Engram {
    * / bounded instead by each registered type's daily count and destination list; and agent-
    * / registration transactions (`signEngramRegistration`), bounded by three per caller per day and
    * / the 500-gwei gas ceiling. Whether the ceiling should cover them is a separate owner question.⟩
+   * / ⟨2026-10-14, the owner's rulings 3A, 4A and 5A⟩ Typed-data signatures are now bounded by each
+   * / registered type's daily count, its per-field rules ("at most N", "must equal X") and ITS OWN
+   * / destination list, and the signing floor (`SigningFloor`) guards them as it guards x402 payments.
+   * / They are still not counted against this ceiling.
    * /
    * / WHY: the owner decided on 2026-09-28 to add one daily spending ceiling across all callers on an
    * / engram and keep the limit of five agents. Every other spending limit is per caller, so without
@@ -2706,7 +2738,7 @@ export interface Engram {
         maxPriorityFeePerGas: bigint;
       },
     ],
-    Result_9
+    Result_8
   >;
   /**
    * / Sign an EIP-3009 authorization for x402 payment. Agent-accessible.
@@ -2745,37 +2777,6 @@ export interface Engram {
     ],
     Result_3
   >;
-  /**
-   * / Self-heal: if the registry's spawn-time push was missed, the owner pulls the number from
-   * / the spawning registry. Idempotent; fails closed if the registry has no record.
-   */
-  syncEngramNumber: ActorMethod<[], Result_8>;
-  /**
-   * / Genesis seed — the atomic "spawn only when there's real content" primitive. The spawning
-   * / REGISTRY pushes the owner's first real memory immediately after install, so a canister is
-   * / never spawned holding nothing (see the registry's `provisionEngram` optional genesis).
-   * /
-   * / Gated `spawnedBy`-only and ONE-SHOT: it refuses once any file exists, so it can seed and never
-   * / overwrite. Unlike the owner-only `seedMemory` placeholder this is REAL owner content, so it
-   * / IS counted as an owner write (`firstWriteAt`, `totalMemoryWrites`) and is authored by the
-   * / OWNER rather than by the registry principal that called it. It never touches the
-   * / agent metrics.
-   * /
-   * / ⚠ THE PAYLOAD IS `Nat` AND MUST STAY `Nat`, which is a constraint on any client of this
-   * / method rather than an internal detail. Its only caller is the registry, over an
-   * / inter-canister boundary, through a hand-declared actor type — and the registry is ROUTINELY a
-   * / different version from the engram template it is seeding: it upgrades before the fleet does,
-   * / and during a transition it can serve a template older than itself. A return-type change here
-   * / breaks genesis provisioning across that skew. That is measured, not predicted: the registry
-   * / trapped with "IDL error: unexpected IDL type when parsing Nat" while seeding an engram built
-   * / at the staging tag. A receipt would buy nothing anyway — the caller does `ignore await`.
-   * /
-   * / ⚠ ORDERING: upload the engram TEMPLATE first, then upgrade the registry. The reverse leaves a
-   * / window where a spawn seeds an old-shape engram with a new-shape expectation; the reply fails
-   * / to decode and `provisionEngram` dies on a trap its own `try/catch` cannot reach (ADR-0001),
-   * / failing the WHOLE SPAWN rather than just the seed.
-   */
-  sysApplyGenesisSeed: ActorMethod<[string, Uint8Array | number[]], Result_8>;
   /**
    * / OWNER force-close, for a session the payer abandoned.
    * /
@@ -2972,11 +2973,6 @@ export interface Engram {
    * / rather than telling an owner to run a call they can no longer make.
    */
   sysSetBillerId: ActorMethod<[Principal], Result_1>;
-  /**
-   * / One-shot assignment of the spawn ordinal — callable ONLY by the spawning registry, ONLY
-   * / while unset. Neither the owner nor any later registry can change an assigned number.
-   */
-  sysSetEngramNumber: ActorMethod<[bigint], Result_1>;
   /**
    * / Point this engram at the commerce satellite allowed to ask it for signatures. ⟨0.16.0, B1⟩
    * /
@@ -3018,6 +3014,9 @@ export interface Engram {
    * / (the market cannot introduce a shape), its cool-off must have elapsed, its per-type daily cap
    * / still binds, the destination allowlist still fails closed, and a payments freeze still stops
    * / it. What the market supplies is the request; what the engram supplies is the whole policy.
+   * / ⟨2026-10-14⟩ And the type's per-field rules, its own destination list (ruling 4A) and the
+   * / signing floor (ruling 5A) — all in `eip712SignFor`, so they bind the market as they bind the
+   * / owner; a refusal here is on the chained record under the market's caller and role.
    * /
    * / That is what "signatures only" means in code, and it is why this method needs no new authority
    * / model: an unregistered typeId is refused for the market exactly as it is for the owner.
@@ -3449,12 +3448,12 @@ export interface Page_10 {
 export interface Page_11 {
   total: bigint;
   withheld: bigint;
-  items: Array<{ activeFromNs: bigint; address: string }>;
+  items: Array<Eip712TypeView>;
 }
 export interface Page_12 {
   total: bigint;
   withheld: bigint;
-  items: Array<RegisteredType>;
+  items: Array<Eip712Destination>;
 }
 export interface Page_13 {
   total: bigint;
@@ -3590,23 +3589,12 @@ export interface ReceiptPage {
   page: Page_9;
   scannedThroughSeq: bigint;
 }
-export interface RegisteredType {
-  primaryType: string;
-  encodeTypeString: string;
-  cooloffEndsAtNs: bigint;
-  domainName: string;
-  typeId: Uint8Array | number[];
-  verifyingContract: string;
-  dailySignCap: bigint;
-  fields: Array<[string, string]>;
-  domainSeparator: Uint8Array | number[];
-  destinationFields: Array<string>;
-  authorityClass: AuthorityClass;
-  typeHash: Uint8Array | number[];
-  registeredAtNs: bigint;
-  chainId: bigint;
-  domainVersion: string;
-  ackIrrevocable: boolean;
+export interface RecordPage {
+  ringFloor: bigint;
+  total: bigint;
+  sealed: Array<SealedEntry>;
+  items: Array<AuditEntry>;
+  hashFirstFrom: bigint;
 }
 export interface Repudiation {
   atNs: bigint;
@@ -3623,9 +3611,9 @@ export interface ResetReport {
 }
 export type Result = { Ok: WriteReceipt } | { Err: Error };
 export type Result_1 = { Ok: null } | { Err: Error };
-export type Result_10 = { Ok: BackupRetentionReport } | { Err: Error };
-export type Result_11 = { Ok: MemoryFile } | { Err: Error };
-export type Result_12 = { Ok: SessionContext } | { Err: Error };
+export type Result_10 = { Ok: MemoryFile } | { Err: Error };
+export type Result_11 = { Ok: SessionContext } | { Err: Error };
+export type Result_12 = { Ok: bigint } | { Err: Error };
 export type Result_13 = { Ok: ResyncReport } | { Err: Error };
 export type Result_14 = { Ok: ResetReport } | { Err: Error };
 export type Result_15 = { Ok: GuardianRecord } | { Err: Error };
@@ -3657,41 +3645,42 @@ export type Result_38 = { Ok: CheckpointPage } | { Err: Error };
 export type Result_39 = { Ok: Page_16 } | { Err: Error };
 export type Result_4 = { Ok: Eip712SignatureOut } | { Err: Error };
 export type Result_40 = { Ok: Page_17 } | { Err: Error };
-export type Result_41 = { Ok: Page_18 } | { Err: Error };
-export type Result_42 = { Ok: Page_19 } | { Err: Error };
-export type Result_43 = { Ok: Page_20 } | { Err: Error };
-export type Result_44 = { Ok: string } | { Err: Error };
-export type Result_45 = { Ok: boolean } | { Err: Error };
-export type Result_46 = { Ok: [] | [string] } | { Err: Error };
-export type Result_47 = { Ok: WorldIdRpContext } | { Err: Error };
-export type Result_48 = { Ok: WorldIdConfig } | { Err: Error };
-export type Result_49 = { Ok: WalletBalances } | { Err: Error };
+export type Result_41 = { Ok: RecordPage } | { Err: Error };
+export type Result_42 = { Ok: Page_18 } | { Err: Error };
+export type Result_43 = { Ok: Page_19 } | { Err: Error };
+export type Result_44 = { Ok: Page_20 } | { Err: Error };
+export type Result_45 = { Ok: string } | { Err: Error };
+export type Result_46 = { Ok: boolean } | { Err: Error };
+export type Result_47 = { Ok: [] | [string] } | { Err: Error };
+export type Result_48 = { Ok: WorldIdRpContext } | { Err: Error };
+export type Result_49 = { Ok: WorldIdConfig } | { Err: Error };
 export type Result_5 = { Ok: SignatureCounts } | { Err: Error };
-export type Result_50 = { Ok: StorageReport } | { Err: Error };
-export type Result_51 = { Ok: SpendingPolicy } | { Err: Error };
-export type Result_52 = { Ok: SpendCeiling } | { Err: Error };
-export type Result_53 = { Ok: SigningFloorStatus } | { Err: Error };
-export type Result_54 = { Ok: { paths: Array<string> } } | { Err: Error };
-export type Result_55 = { Ok: OwnerConsole } | { Err: Error };
-export type Result_56 = { Ok: MemoryRetentionPolicy } | { Err: Error };
-export type Result_57 = { Ok: MemoryHistory } | { Err: Error };
-export type Result_58 = { Ok: AlertStatus } | { Err: Error };
-export type Result_59 = { Ok: EvmAddresses } | { Err: Error };
+export type Result_50 = { Ok: WalletBalances } | { Err: Error };
+export type Result_51 = { Ok: StorageReport } | { Err: Error };
+export type Result_52 = { Ok: SpendingPolicy } | { Err: Error };
+export type Result_53 = { Ok: SpendCeiling } | { Err: Error };
+export type Result_54 = { Ok: SigningFloorStatus } | { Err: Error };
+export type Result_55 = { Ok: { paths: Array<string> } } | { Err: Error };
+export type Result_56 = { Ok: OwnerConsole } | { Err: Error };
+export type Result_57 = { Ok: MemoryRetentionPolicy } | { Err: Error };
+export type Result_58 = { Ok: MemoryHistory } | { Err: Error };
+export type Result_59 = { Ok: AlertStatus } | { Err: Error };
 export type Result_6 = { Ok: RailHealth } | { Err: Error };
-export type Result_60 = { Ok: Uint8Array | number[] } | { Err: Error };
-export type Result_61 = { Ok: ChildOpening } | { Err: Error };
-export type Result_62 = { Ok: ChildAllowanceRow } | { Err: Error };
-export type Result_63 = { Ok: BackupMetadata } | { Err: Error };
-export type Result_64 = { Ok: AgentWriteReview } | { Err: Error };
-export type Result_65 = { Ok: Page_21 } | { Err: Error };
-export type Result_67 = { Ok: MemoryRangeExport } | { Err: Error };
-export type Result_68 = { Ok: CondenseResult } | { Err: Error };
-export type Result_69 = { Ok: { activatesAtNs: bigint } } | { Err: Error };
+export type Result_60 = { Ok: EvmAddresses } | { Err: Error };
+export type Result_61 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_62 = { Ok: ChildOpening } | { Err: Error };
+export type Result_63 = { Ok: ChildAllowanceRow } | { Err: Error };
+export type Result_64 = { Ok: BackupMetadata } | { Err: Error };
+export type Result_65 = { Ok: AgentWriteReview } | { Err: Error };
+export type Result_66 = { Ok: Page_21 } | { Err: Error };
+export type Result_68 = { Ok: MemoryRangeExport } | { Err: Error };
+export type Result_69 = { Ok: CondenseResult } | { Err: Error };
 export type Result_7 = { Ok: Array<Seat> } | { Err: Error };
 export type Result_70 = { Ok: Eip712Registration } | { Err: Error };
-export type Result_71 = { Ok: AgentRecord } | { Err: Error };
-export type Result_8 = { Ok: bigint } | { Err: Error };
-export type Result_9 = { Ok: SignedTransaction } | { Err: Error };
+export type Result_71 = { Ok: { activatesAtNs: bigint } } | { Err: Error };
+export type Result_72 = { Ok: AgentRecord } | { Err: Error };
+export type Result_8 = { Ok: SignedTransaction } | { Err: Error };
+export type Result_9 = { Ok: BackupRetentionReport } | { Err: Error };
 export interface ResyncReport {
   startsAcknowledged: bigint;
   cannotBeRecorded: Array<UnrecordableEngagement>;
@@ -3725,6 +3714,11 @@ export type Role =
   | { Agent: null }
   | { Other: null }
   | { Owner: null };
+export interface SealedEntry {
+  id: bigint;
+  entryHash: Uint8Array | number[];
+  digest: Uint8Array | number[];
+}
 export interface Seat {
   pairedDay: bigint;
   lastPaymentDay: [] | [bigint];
@@ -3858,8 +3852,14 @@ export interface WorldIdRpContext {
 }
 export interface WriteReceipt {
   seq: bigint;
+  contentRoot: Uint8Array | number[];
+  atNs: bigint;
   head: Uint8Array | number[];
+  prev: Uint8Array | number[];
+  size: bigint;
+  recordPrev: Uint8Array | number[];
   version: bigint;
+  recordId: bigint;
 }
 export type X402SignOutcome =
   { ApprovalPending: ApprovalRequest } | { Signed: SignedAuthorization };