@engramx/idl 0.16.0-rc.14 → 0.16.0-rc.16

package/dist/engram.did

@@ -133,6 +133,11 @@ type SignatureCounts =
    byCaller: vec CallerSignatureCount;
    total: nat;
  };
+type SignIn = 
+ record {
+   clientName: opt text;
+   token: BearerToken;
+ };
 type SessionIntent = 
  record {
    costPerCall: opt nat;
@@ -195,6 +200,24 @@ type Role =
    Viewer;
    WasmAdmin;
  };
+type RetentionPreviewRule = 
+ record {
+   bytes: nat;
+   copies: nat;
+   files: nat;
+   notBeforeNs: opt int;
+   prefix: text;
+ };
+type RetentionPreview = 
+ record {
+   bytes: nat;
+   complete: bool;
+   copies: nat;
+   files: nat;
+   planned: nat;
+   rules: vec RetentionPreviewRule;
+   storedFiles: nat;
+ };
 type RetentionClassSpec = 
  variant {
    vault;
@@ -227,25 +250,60 @@ type Result_9 =
    Err: Error;
    Ok: BackupRetentionReport;
  };
+type Result_80 = 
+ variant {
+   Err: Error;
+   Ok: AgentRecord;
+ };
 type Result_8 = 
  variant {
    Err: Error;
    Ok: SignedTransaction;
  };
+type Result_79 = 
+ variant {
+   Err: Error;
+   Ok: record {activatesAtNs: int;};
+ };
+type Result_78 = 
+ variant {
+   Err: Error;
+   Ok: Eip712Registration;
+ };
+type Result_77 = 
+ variant {
+   Err: Error;
+   Ok: CondenseResult;
+ };
+type Result_76 = 
+ variant {
+   Err: Error;
+   Ok: MemoryRangeExport;
+ };
+type Result_74 = 
+ variant {
+   Err: Error;
+   Ok: Page_25;
+ };
+type Result_73 = 
+ variant {
+   Err: Error;
+   Ok: AgentWriteReview;
+ };
 type Result_72 = 
  variant {
    Err: Error;
-   Ok: AgentRecord;
+   Ok: BackupMetadata;
  };
 type Result_71 = 
  variant {
    Err: Error;
-   Ok: record {activatesAtNs: int;};
+   Ok: BackupRetention;
  };
 type Result_70 = 
  variant {
    Err: Error;
-   Ok: Eip712Registration;
+   Ok: Brakes;
  };
 type Result_7 = 
  variant {
@@ -255,47 +313,52 @@ type Result_7 =
 type Result_69 = 
  variant {
    Err: Error;
-   Ok: CondenseResult;
+   Ok: ChildAllowanceRow;
  };
 type Result_68 = 
  variant {
    Err: Error;
-   Ok: MemoryRangeExport;
+   Ok: ChildOpening;
+ };
+type Result_67 = 
+ variant {
+   Err: Error;
+   Ok: blob;
  };
 type Result_66 = 
  variant {
    Err: Error;
-   Ok: Page_21;
+   Ok: EvmAddresses;
  };
 type Result_65 = 
  variant {
    Err: Error;
-   Ok: AgentWriteReview;
+   Ok: AlertStatus;
  };
 type Result_64 = 
  variant {
    Err: Error;
-   Ok: BackupMetadata;
+   Ok: MemoryHistory;
  };
 type Result_63 = 
  variant {
    Err: Error;
-   Ok: ChildAllowanceRow;
+   Ok: MemoryRetentionPolicy;
  };
 type Result_62 = 
  variant {
    Err: Error;
-   Ok: ChildOpening;
+   Ok: OwnerConsole;
  };
 type Result_61 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: record {paths: vec text;};
  };
 type Result_60 = 
  variant {
    Err: Error;
-   Ok: EvmAddresses;
+   Ok: SigningFloorStatus;
  };
 type Result_6 = 
  variant {
@@ -305,52 +368,52 @@ type Result_6 =
 type Result_59 = 
  variant {
    Err: Error;
-   Ok: AlertStatus;
+   Ok: SpendCeiling;
  };
 type Result_58 = 
  variant {
    Err: Error;
-   Ok: MemoryHistory;
+   Ok: SpendingPolicy;
  };
 type Result_57 = 
  variant {
    Err: Error;
-   Ok: MemoryRetentionPolicy;
+   Ok: StorageReport;
  };
 type Result_56 = 
  variant {
    Err: Error;
-   Ok: OwnerConsole;
+   Ok: WalletBalances;
  };
 type Result_55 = 
  variant {
    Err: Error;
-   Ok: record {paths: vec text;};
+   Ok: WorldIdConfig;
  };
 type Result_54 = 
  variant {
    Err: Error;
-   Ok: SigningFloorStatus;
+   Ok: WorldIdRpContext;
  };
 type Result_53 = 
  variant {
    Err: Error;
-   Ok: SpendCeiling;
+   Ok: opt text;
  };
 type Result_52 = 
  variant {
    Err: Error;
-   Ok: SpendingPolicy;
+   Ok: bool;
  };
 type Result_51 = 
  variant {
    Err: Error;
-   Ok: StorageReport;
+   Ok: text;
  };
 type Result_50 = 
  variant {
    Err: Error;
-   Ok: WalletBalances;
+   Ok: Page_24;
  };
 type Result_5 = 
  variant {
@@ -360,52 +423,52 @@ type Result_5 =
 type Result_49 = 
  variant {
    Err: Error;
-   Ok: WorldIdConfig;
+   Ok: AgentSpendToday;
  };
 type Result_48 = 
  variant {
    Err: Error;
-   Ok: WorldIdRpContext;
+   Ok: Page_22;
  };
 type Result_47 = 
  variant {
    Err: Error;
-   Ok: opt text;
+   Ok: Page_21;
  };
 type Result_46 = 
  variant {
    Err: Error;
-   Ok: bool;
+   Ok: RecordPage;
  };
 type Result_45 = 
  variant {
    Err: Error;
-   Ok: text;
+   Ok: Page_20;
  };
 type Result_44 = 
  variant {
    Err: Error;
-   Ok: Page_20;
+   Ok: Page_19;
  };
 type Result_43 = 
  variant {
    Err: Error;
-   Ok: Page_19;
+   Ok: CheckpointPage;
  };
 type Result_42 = 
  variant {
    Err: Error;
-   Ok: Page_18;
+   Ok: Page_17;
  };
 type Result_41 = 
  variant {
    Err: Error;
-   Ok: RecordPage;
+   Ok: Page_16;
  };
 type Result_40 = 
  variant {
    Err: Error;
-   Ok: Page_17;
+   Ok: Page_15;
  };
 type Result_4 = 
  variant {
@@ -415,52 +478,52 @@ type Result_4 =
 type Result_39 = 
  variant {
    Err: Error;
-   Ok: Page_16;
+   Ok: Page_14;
  };
 type Result_38 = 
  variant {
    Err: Error;
-   Ok: CheckpointPage;
+   Ok: Page_13;
  };
 type Result_37 = 
  variant {
    Err: Error;
-   Ok: Page_14;
+   Ok: Page_12;
  };
 type Result_36 = 
  variant {
    Err: Error;
-   Ok: Page_13;
+   Ok: ReceiptPage;
  };
 type Result_35 = 
  variant {
    Err: Error;
-   Ok: Page_12;
+   Ok: Page_10;
  };
 type Result_34 = 
  variant {
    Err: Error;
-   Ok: Page_11;
+   Ok: LogPage;
  };
 type Result_33 = 
  variant {
    Err: Error;
-   Ok: Page_10;
+   Ok: Page_8;
  };
 type Result_32 = 
  variant {
    Err: Error;
-   Ok: ReceiptPage;
+   Ok: Page_7;
  };
 type Result_31 = 
  variant {
    Err: Error;
-   Ok: Page_8;
+   Ok: Page_6;
  };
 type Result_30 = 
  variant {
    Err: Error;
-   Ok: LogPage;
+   Ok: PaymentSignatureCounts;
  };
 type Result_3 = 
  variant {
@@ -470,52 +533,52 @@ type Result_3 =
 type Result_29 = 
  variant {
    Err: Error;
-   Ok: Page_6;
+   Ok: Page_4;
  };
 type Result_28 = 
  variant {
    Err: Error;
-   Ok: Page_5;
+   Ok: Page_3;
  };
 type Result_27 = 
  variant {
    Err: Error;
-   Ok: Page_4;
+   Ok: Page_2;
  };
 type Result_26 = 
  variant {
    Err: Error;
-   Ok: PaymentSignatureCounts;
+   Ok: Page_1;
  };
 type Result_25 = 
  variant {
    Err: Error;
-   Ok: Page_2;
+   Ok: Page;
  };
 type Result_24 = 
  variant {
    Err: Error;
-   Ok: Page_1;
+   Ok: AgentGrant;
  };
 type Result_23 = 
  variant {
    Err: Error;
-   Ok: Page;
+   Ok: principal;
  };
 type Result_22 = 
  variant {
    Err: Error;
-   Ok: principal;
+   Ok: EngramSessionState;
  };
 type Result_21 = 
  variant {
    Err: Error;
-   Ok: EngramSessionState;
+   Ok: Pairing;
  };
 type Result_20 = 
  variant {
    Err: Error;
-   Ok: Pairing;
+   Ok: CondensePreview;
  };
 type Result_2 = 
  variant {
@@ -525,7 +588,7 @@ type Result_2 =
 type Result_19 = 
  variant {
    Err: Error;
-   Ok: CondensePreview;
+   Ok: RetentionPreview;
  };
 type Result_18 = 
  variant {
@@ -605,10 +668,17 @@ type RecordPage =
    sealed: vec SealedEntry;
    total: nat;
  };
+type RecordNote = 
+ record {
+   about: nat;
+   atNs: int;
+   auditId: nat;
+   note: text;
+ };
 type ReceiptPage = 
  record {
    firstAvailableSeq: nat;
-   page: Page_9;
+   page: Page_11;
    scannedThroughSeq: nat;
  };
 type RailHealth = 
@@ -639,7 +709,7 @@ type PurgedAgent =
  };
 type PaymentSignatureCounts = 
  record {
-   agents: Page_3;
+   agents: Page_5;
    day: int;
    limit: nat;
    marketplace: opt MarketplacePaymentSignatures;
@@ -655,6 +725,16 @@ type PaymentSignature =
    sender: text;
    signature: blob;
  };
+type PaymentLimits = 
+ record {
+   maxConcurrentSessions: opt nat;
+   maxPerDay: opt nat;
+   maxPerTransaction: opt nat;
+   maxSessionDeposit: opt nat;
+   maxSessionDuration: opt int;
+   rateLimitPerMinute: opt nat;
+   sessionIdleTimeout: opt int;
+ };
 type Pairing = 
  record {
    agent: AgentRecord;
@@ -662,75 +742,71 @@ type Pairing =
  };
 type Page_9 = 
  record {
-   items: vec ExportReceiptRow;
+   items: vec MemoryLogEvent;
    total: nat;
    withheld: nat;
  };
 type Page_8 = 
  record {
-   items: vec record {
-                lastModifiedAtNs: int;
-                path: text;
-                version: nat;
-              };
+   items: vec ApprovalRequest;
    total: nat;
    withheld: nat;
  };
 type Page_7 = 
  record {
-   items: vec MemoryLogEvent;
+   items: vec EngramSessionState;
    total: nat;
    withheld: nat;
  };
 type Page_6 = 
  record {
-   items: vec ApprovalRequest;
+   items: vec OwnershipTransfer;
    total: nat;
    withheld: nat;
  };
 type Page_5 = 
  record {
-   items: vec EngramSessionState;
+   items: vec AgentPaymentSignatures;
    total: nat;
    withheld: nat;
  };
 type Page_4 = 
  record {
-   items: vec OwnershipTransfer;
+   items: vec PurgedAgent;
    total: nat;
    withheld: nat;
  };
 type Page_3 = 
  record {
-   items: vec AgentPaymentSignatures;
+   items: vec AuditEntry;
    total: nat;
    withheld: nat;
  };
-type Page_21 = 
+type Page_25 = 
  record {
    items: vec OwnerRow;
    total: nat;
    withheld: nat;
  };
-type Page_20 = 
+type Page_24 = 
  record {
    items: vec ActivitySnapshot;
    total: nat;
    withheld: nat;
  };
-type Page_2 = 
+type Page_23 = 
  record {
-   items: vec PurgedAgent;
+   items: vec AgentSpendRow;
    total: nat;
    withheld: nat;
  };
-type Page_19 = 
+type Page_22 = 
  record {
    items: vec AgentRecord;
    total: nat;
    withheld: nat;
  };
-type Page_18 = 
+type Page_21 = 
  record {
    items: vec record {
                 name: text;
@@ -740,63 +816,87 @@ type Page_18 =
    total: nat;
    withheld: nat;
  };
-type Page_17 = 
+type Page_20 = 
  record {
    items: vec BackupMetadata;
    total: nat;
    withheld: nat;
  };
-type Page_16 = 
+type Page_2 = 
+ record {
+   items: vec RecordNote;
+   total: nat;
+   withheld: nat;
+ };
+type Page_19 = 
  record {
    items: vec BearerToken;
    total: nat;
    withheld: nat;
  };
-type Page_15 = 
+type Page_18 = 
  record {
    items: vec CondenseCheckpointRow;
    total: nat;
    withheld: nat;
  };
-type Page_14 = 
+type Page_17 = 
  record {
    items: vec CycleSnapshot;
    total: nat;
    withheld: nat;
  };
-type Page_13 = 
+type Page_16 = 
  record {
    items: vec text;
    total: nat;
    withheld: nat;
  };
-type Page_12 = 
+type Page_15 = 
  record {
    items: vec Eip712Destination;
    total: nat;
    withheld: nat;
  };
-type Page_11 = 
+type Page_14 = 
  record {
    items: vec Eip712TypeView;
    total: nat;
    withheld: nat;
  };
-type Page_10 = 
+type Page_13 = 
+ record {
+   items: vec GuardianDispute;
+   total: nat;
+   withheld: nat;
+ };
+type Page_12 = 
  record {
    items: vec GuardianRecord;
    total: nat;
    withheld: nat;
  };
+type Page_11 = 
+ record {
+   items: vec ExportReceiptRow;
+   total: nat;
+   withheld: nat;
+ };
+type Page_10 = 
+ record {
+   items: vec MemoryFileRow;
+   total: nat;
+   withheld: nat;
+ };
 type Page_1 = 
  record {
-   items: vec AuditEntry;
+   items: vec Repudiation;
    total: nat;
    withheld: nat;
  };
 type Page = 
  record {
-   items: vec Repudiation;
+   items: vec SignIn;
    total: nat;
    withheld: nat;
  };
@@ -968,6 +1068,13 @@ type MemoryHistory =
    retainedCount: nat;
    versions: vec MemoryVersionSummary;
  };
+type MemoryFileRow = 
+ record {
+   lastModifiedAtNs: int;
+   lastModifiedBy: opt principal;
+   path: text;
+   version: nat;
+ };
 type MemoryFile = 
  record {
    content: blob;
@@ -1015,7 +1122,7 @@ type LogPage =
  record {
    firstAvailableSeq: nat;
    head: blob;
-   page: Page_7;
+   page: Page_9;
  };
 type KeyNomination = 
  record {
@@ -1079,6 +1186,16 @@ type GuardianPermissions =
    canRevokeAgents: bool;
    scopes: opt vec text;
  };
+type GuardianDispute = 
+ record {
+   about: nat;
+   atNs: int;
+   auditId: nat;
+   guardian: principal;
+   path: opt text;
+   reason: text;
+   version: opt nat;
+ };
 type GenesisNote = 
  record {
    genesisAtNs: int;
@@ -1181,10 +1298,17 @@ type Engram =
    /// nomination names. That check compares the caller inside the module, where
    /// test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
    /// no role here until the move.
-   acceptAgentKeyNomination: (agentKey: principal) -> (Result_72);
+   acceptAgentKeyNomination: (agentKey: principal) -> (Result_80);
    /// Consensus transform for the alert webhook outcall: collapse the response to status-only so
    /// replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
    /// 
+   /// ⟨CORRECTED 2026-10-21⟩ No longer a consensus transform: the alert outcall is non-replicated
+   /// (`is_replicated = ?false` in `scanAndPost`), so ONE node sends the POST and runs this on its
+   /// own response — there are no replicas to agree, and "on every replica" below now means "on that
+   /// node". It stays so the response is collapsed to status-only before the engram reads it. The
+   /// PUBLIC reasoning below is unchanged: the outcall protocol still calls it with no caller identity.
+   /// `worldIdTransform` is still a true consensus transform (World ID stays replicated).
+   /// 
    /// PUBLIC: not a choice. The management canister invokes a transform on every replica as part of
    /// the HTTP-outcall protocol, and that invocation carries no caller identity to gate on — a gate
    /// here would refuse the only caller there is and break every alert this canister sends. Safe
@@ -1204,7 +1328,7 @@ type Engram =
    /// and works while frozen; a value is 1–128 characters (an address, or a venue value such as an
    /// account name). The action must be registered: a destination list belongs to an action, and a
    /// list for no action would be a value nothing checks. The caller is the owner's app.
-   addEip712Destination: (typeId: blob, value: text) -> (Result_71);
+   addEip712Destination: (typeId: blob, value: text) -> (Result_79);
    /// Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
    /// of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
    /// shape is IMMUTABLE: any change mints a new typeId.
@@ -1244,7 +1368,7 @@ type Engram =
                   };
       primaryType: text;
       verifyingContract: text;
-    }) -> (Result_70);
+    }) -> (Result_78);
    /// ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
    /// 
    /// This method had five distinct ways to say no through one `text`, and a caller could only tell
@@ -1255,6 +1379,15 @@ type Engram =
    /// or the roster is full. Only the last is worth an agent's time to resolve.
    addGuardian: (guardianPrincipal: principal, name: text, permissions:
     GuardianPermissions) -> (Result_1);
+   /// ⟨2026-10-21, the owner's round-11 answer b⟩ OWNER-ONLY: put a note on any entry of this
+   /// engram's record — words, nothing else. Appends a chained `record.note` entry
+   /// (`about=<id> note=<words>`) and keeps the note for `listRecordNotes`; answers the new entry's
+   /// id. The entry noted may be any entry ever appended (`about` below the head), including one the
+   /// ring no longer holds in full. An agent, a guardian, a stranger and the anonymous caller are
+   /// refused by `requireOwner`'s own words. Empty words, words over `RecordWords.WORDS_MAX` or
+   /// holding a line break are `#Invalid`; an id past the head is `#NotFound`; nothing is recorded
+   /// on any refusal.
+   addRecordNote: (about: nat, note: text) -> (Result_12);
    /// Returns the write RECEIPT, not just the version.
    /// 
    /// The receipt was always computed and then thrown away: MemoryRouter hands back
@@ -1286,7 +1419,7 @@ type Engram =
    /// Gated on requireWritesNotPaused — unlike the export. This one destroys retained entries, which
    /// is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
    /// owner-initiated, owner-only, and already chained into the audit log.
-   applyCondense: (toSeq: nat) -> (Result_69);
+   applyCondense: (toSeq: nat) -> (Result_77);
    /// Owner-only: activate a guardian who has registered against an invite.
    /// 
    /// Until this call the guardian is `#Pending` and can do NOTHING — registering is a claim, this
@@ -1357,13 +1490,13 @@ type Engram =
    /// 
    /// The write half also refuses while writes are PAUSED.
    backupInit: (dbType: text, backupType: BackupType, parentBackupId:
-    opt text, sha256: text, backupLabel: opt text) -> (Result_45);
+    opt text, sha256: text, backupLabel: opt text) -> (Result_51);
    /// Read one chunk of a finalized backup, by index.
    /// 
    /// ⚠ GATED ON `read_backup`, which is NOT the permission the upload half uses — that one is
    /// `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
    /// carrying it away are different authorities.
-   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_61) query;
+   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_67) query;
    backupPushChunk: (backupId: text, chunkIndex: nat, data: blob) ->
     (Result_1);
    /// The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
@@ -1415,7 +1548,7 @@ type Engram =
    /// A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    /// independent check on agents, so one wallet must not hold both.
    createAgentInvite: (name: text, permissions: AgentPermissions) ->
-    (Result_45);
+    (Result_51);
    /// Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
    /// co-owner and not a recovery agent.
    /// 
@@ -1438,7 +1571,7 @@ type Engram =
    /// So an invite that fails to redeem for that reason is not a bad code. The rule exists because
    /// a check must be independent of the thing it checks.
    createGuardianInvite: (name: text, permissions: GuardianPermissions) ->
-    (Result_45);
+    (Result_51);
    /// OWNER-ONLY deletion of a stored backup.
    /// 
    /// ⚠ NOT THE SAME GATE AS THE REST OF THE FAMILY, and the asymmetry is deliberate: `backupInit`,
@@ -1466,6 +1599,22 @@ type Engram =
    /// `#NotFound` for an unknown id and `#Conflict` when the request is no longer pending, and it
    /// does not change the policy — the next request over the same limit will be raised again.
    denyRequest: (requestId: text, reason: text) -> (Result_1);
+   /// ⟨2026-10-21, the owner's round-11 answer c⟩ A NEW GUARDIAN POWER, words only: an ACTIVE
+   /// guardian disputes an agent's write. It never moves money, stops anything or changes a grant.
+   /// Appends a chained `record.dispute` entry (`about=<id> reason=<words>`) and keeps the dispute
+   /// for `listGuardianDisputes`; answers the new entry's id. NOT ALERTED, deliberately: a
+   /// `guardian.*` operation would fall in the alerts' #guardian class, and which entries reach a
+   /// phone is the held alerts round's to decide (`ActionAlerts.classify` answers null for
+   /// `record.*`). The owner sees it on the record's Disputes tab.
+   /// 
+   /// WHO: every active guardian — no grant bit (`RecordWords` header says why). The OWNER is refused
+   /// by name (`RecordWords.OWNER_DISPUTES_ELSEWHERE` — the owner's dispute is
+   /// `repudiateMemoryWrite`); an agent and a stranger get "Not a guardian", a pending guardian "Guardian
+   /// is pending approval", the anonymous caller the anonymous refusal.
+   /// WHAT: an entry the owner's review would show (`qualifiesForReview` — an agent's append or
+   /// revision, or a paid session's append) that succeeded, still held in full by the ring.
+   /// One dispute per guardian per write (`#Conflict`, the first stands).
+   disputeAgentWrite: (about: nat, reason: text) -> (Result_12);
    /// Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
    /// 
    /// This is the receipt ledgerfs Q2 requires before any of those entries may be condensed away.
@@ -1479,7 +1628,7 @@ type Engram =
    /// situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
    /// failed its integrity check must not attest anything it cannot vouch for.
    exportMemoryRange: (fromSeq: nat, toSeq: nat, authorFilter:
-    opt principal) -> (Result_68);
+    opt principal) -> (Result_76);
    /// ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
    /// The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
    /// case — the guardian is the exceptional one. A name that says otherwise sends an owner looking
@@ -1512,8 +1661,16 @@ type Engram =
    /// ⚠ The three exclusions are a reading of intent, not a ruling: no declaration stated the scope
    /// before this one. If any of them is wrong, this comment is where the argument should happen.
    freezePayments: () -> (Result_1);
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ `freezePayments` with a reason the strip and the
+   /// guardian page show ("Sam froze payments: 'a payment I didn't expect'"). A NEW method, not an
+   /// argument on `freezePayments`: a shipped argument tuple is frozen. Same callers, same grant, same
+   /// brake: the owner, or an active guardian holding `canFreezePayments`; an agent, a stranger, a
+   /// pending guardian and the anonymous caller are refused by `requireOwnerOrGuardian`'s own words.
+   /// An empty reason is no reason; a reason too long or holding a line break is `#Invalid` and the
+   /// brake is NOT pulled — the caller pulls it with `freezePayments`, or shortens the words.
+   freezePaymentsWithReason: (reason: text) -> (Result_1);
    /// Delivery status + config readback. Owner-only (the URL is a secret).
-   getActionAlertStatus: () -> (Result_59) query;
+   getActionAlertStatus: () -> (Result_65) query;
    /// Agents need to know what they may revise, so they can read it too. Whole-value config, same
    /// carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
    /// protected path and a revisable path are opposite grants, and one accessor for both would be a
@@ -1521,7 +1678,7 @@ type Engram =
    /// 
    /// Refusal reason preserved from the trap: a grant is a power, and its absence and its
    /// concealment are different facts.
-   getAgentRevisablePaths: () -> (Result_55) query;
+   getAgentRevisablePaths: () -> (Result_61) query;
    /// OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
    /// paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
    /// of the last one, and how many were produced. Never an amount, a recipient or a nonce.
@@ -1532,7 +1689,7 @@ type Engram =
    /// order. Anyone else is refused by name (`#Refused getAgentSeatWeeks: …`), never answered with an
    /// empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
    /// Two rows can name one root: an agent paired again after it left is a second engagement.
-   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_66) query;
+   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_74) query;
    /// Owner: everything written into this engram by someone other than the owner since the last
    /// markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
    /// qualifiesForReview for why those two families are recognised differently).
@@ -1540,7 +1697,7 @@ type Engram =
    /// them — the UI must page (markAgentWritesReviewed(?lastShownId)) and must NOT present 200
    /// as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
    /// aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
-   getAgentWriteReview: () -> (Result_65) query;
+   getAgentWriteReview: () -> (Result_73) query;
    /// Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
    /// engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
    /// and none of these fields is a secret — `total` is already public via getCertifiedAuditHead.
@@ -1559,7 +1716,18 @@ type Engram =
    /// below serves the same head WITH the subnet certificate for a caller that needs to verify it
    /// was signed rather than asserted.
    getAuditHead: () -> (AuditHead) query;
-   getBackupMetadata: (backupId: text) -> (Result_64) query;
+   getBackupMetadata: (backupId: text) -> (Result_72) query;
+   /// ⟨2026-10-21, the owner's round-11 answer m: a backup-retention getter⟩ How many backups of
+   /// `dbType` each creator keeps, and whether that is the default — the read `setBackupRetention`
+   /// lacked, so "Keeps your newest 3" showed only on the phone that last set it.
+   /// 
+   /// WHO: the OWNER, and an active AGENT holding `canAppendMemory` — the permission that lets it
+   /// upload backups, which are exactly the backups this number bounds (`#perm(#append_memory)`).
+   /// Refused, each by the gate's own words: an agent without that permission ("Permission
+   /// denied"), a revoked or resigned agent, a guardian (guardians take no backups), a stranger and
+   /// the anonymous caller. A kind the setter would refuse is `#Invalid` here too
+   /// (`Backup.getRetention`). Records nothing (a query).
+   getBackupRetention: (dbType: text) -> (Result_71) query;
    /// The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
    /// 
    /// PUBLIC: a payer about to send money needs to know which cashier this engram will accept credit
@@ -1567,6 +1735,15 @@ type Engram =
    /// never become rent. The registry publishes the same fact as `getRentBiller`; publishing it here
    /// too is what lets the two be COMPARED, which is the only way to catch a mismatch.
    getBillerId: () -> (opt principal) query;
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ Each brake: on or off, and while on, who pulled it
+   /// LAST (their key and whether as owner or guardian), since when, and the reason they gave — the
+   /// same person and time as the newest brake entry on the record (`RecordWords.BrakePull`). For the
+   /// owner's status strip and the guardian page. The OWNER and ACTIVE GUARDIANS may read it; an
+   /// agent, a stranger, a pending guardian and the anonymous caller are refused (`#ownerOrGuardian`
+   /// — an agent learns a brake is on from the refusal of what it tried, and needs no more). `pull`
+   /// is null for a brake that is off, and for one carried on across the upgrade that added this
+   /// read (who pulled it was not recorded then) — never a guessed pull.
+   getBrakes: () -> (Result_70) query;
    /// ⟨0.16.0, L9/L10 — census row⟩ `Wire.CertifiedAuditHead`, not an anonymous record. The
    /// registry, market and cashier already served the shared type; the engram — the canister that
    /// IS the evidence product — was the one chain still answering in a shape of its own, missing
@@ -1589,11 +1766,11 @@ type Engram =
    /// query's state writes are discarded when it returns, and the `denied` call first written here
    /// recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
    /// WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
-   getChildAllowance: (agentPrincipal: principal) -> (Result_63) query;
+   getChildAllowance: (agentPrincipal: principal) -> (Result_69) query;
    /// Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
    /// agent's request is refused, the balance now, and every agent's allowance. The console's cost
    /// sentence reads it. Cycles are owner-class information, as on the owner's console read.
-   getChildOpening: () -> (Result_62) query;
+   getChildOpening: () -> (Result_68) query;
    /// Derive the shared memory-encryption key, encrypted under the caller's transport
    /// public key. Gated to owner + read-agents (the same principals allowed to read
    /// memory). The client decrypts it locally with its transport secret key.
@@ -1618,7 +1795,7 @@ type Engram =
    /// cost. Stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body — which is exactly what had to happen to write this line.
    getEncryptedMemoryKey: (epoch: opt nat, transportPublicKey: blob) ->
-    (Result_61);
+    (Result_67);
    /// ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
    /// 
    /// The card's config hardcodes `x402Support = true`, answering a buyer's question with a fact
@@ -1713,7 +1890,7 @@ type Engram =
    /// It refuses rather than half-answers: if either address cannot be derived the reply is
    /// `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
    /// failed derivation — that is fail-to-empty on a money surface, and it stops here).
-   getEvmAddress: () -> (Result_60);
+   getEvmAddress: () -> (Result_66);
    /// The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
    /// the address this canister derives for itself.
    /// 
@@ -1728,7 +1905,7 @@ type Engram =
    /// the management canister's `ecdsa_public_key`. A query cannot await, so the round-trip is the
    /// cost — stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body.
-   getEvmSignerAddress: () -> (Result_45);
+   getEvmSignerAddress: () -> (Result_51);
    /// PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
    /// 
    /// The fourth of the four evidence methods (`getAuditHead`, `getCertifiedAuditHead`,
@@ -1737,7 +1914,7 @@ type Engram =
    /// cannot verify it, and nothing here identifies anybody.
    getGenesisNote: () -> (GenesisNote) query;
    /// A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
-   getGuardianAlertStatus: () -> (Result_59) query;
+   getGuardianAlertStatus: () -> (Result_65) query;
    /// The market this engram will accept signing requests from — `null` until the registry pushes
    /// one at spawn, which is why `requireMarket` refuses fleet-wide today.
    /// 
@@ -1767,7 +1944,7 @@ type Engram =
    /// never renumbered: the next page starts at the last version returned plus one. Defaults
    /// return the whole history of any file a pre-FD engram could have held.
    getMemoryHistory: (path: text, start: opt nat, max: opt nat) ->
-    (Result_58) query;
+    (Result_64) query;
    /// PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
    /// history would be a public, fleet-enumerable feed of when each owner terminated a trust
    /// relationship — readable by, among others, the party just terminated.
@@ -1808,7 +1985,7 @@ type Engram =
    /// Refusal reasons of both merge: an empty policy reads as "nothing is capped, every version kept
    /// forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
    /// "nothing is held back".
-   getMemoryRetentionPolicy: () -> (Result_57) query;
+   getMemoryRetentionPolicy: () -> (Result_63) query;
    /// The metrics reader this engram answers — `null` until the spawning registry names one.
    /// 
    /// PUBLIC: an owner deciding whether to switch the read off needs to know who it is, and anyone
@@ -1831,7 +2008,7 @@ type Engram =
    /// was `nat`, then widened to `opt nat` so a refusal could be `null`, which broke every published
    /// client (rule 4) and bought a masked answer nobody had asked for — the census could not even
    /// find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
-   getOwnerConsole: () -> (Result_56) query;
+   getOwnerConsole: () -> (Result_62) query;
    /// Owner + agents only (agents need it to avoid writing protected paths).
    /// 
    /// A NAMED RECORD, not a Page: the setter replaces this list wholesale, so there is no window to
@@ -1843,7 +2020,7 @@ type Engram =
    /// path on this engram is protected", and an agent consults this list precisely to avoid
    /// writing one — so a fabricated empty here does not merely misinform, it invites the write the
    /// list exists to prevent.
-   getProtectedPaths: () -> (Result_55) query;
+   getProtectedPaths: () -> (Result_61) query;
    /// Whether the metrics reader's read is answered — `true` from birth.
    /// 
    /// PUBLIC: the promise that an owner can switch this read off can be checked only if the switch
@@ -1852,7 +2029,7 @@ type Engram =
    /// Owner-only, Billing-class: the signing floor, the balance, one signature's price, and how many
    /// payment signatures the balance carries above the floor before `signX402Payment` is refused by
    /// name. The same numbers the check uses, so Billing can say only what the engram enforces.
-   getSigningFloor: () -> (Result_54) query;
+   getSigningFloor: () -> (Result_60) query;
    /// The registry that spawned this engram, if it recorded one.
    /// 
    /// PUBLIC: it is the provenance claim. An engram asserting it is part of a fleet, under that
@@ -1869,7 +2046,7 @@ type Engram =
    /// configuration, and the engram-wide total would also tell one agent how much the others spent.
    /// A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
    /// "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
-   getSpendCeiling: () -> (Result_53) query;
+   getSpendCeiling: () -> (Result_59) query;
    /// Read the caps in force for a caller.
    /// 
    /// OWNER-ONLY, and this is where it diverges from the market's inbound twin, which is public.
@@ -1877,8 +2054,8 @@ type Engram =
    /// Here the engram serves no 402s at all: these caps are the owner's private custody
    /// configuration, and publishing them would tell any caller exactly how large a signing request
    /// can be before it needs an approval nobody is watching for.
-   getSpendPolicy: (caller: opt principal) -> (Result_52) query;
-   getStorageStats: () -> (Result_51) query;
+   getSpendPolicy: (caller: opt principal) -> (Result_58) query;
+   getStorageStats: () -> (Result_57) query;
    /// Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
    /// and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
    /// leaks nothing (booleans about our own scheduling).
@@ -1949,12 +2126,12 @@ type Engram =
    /// ⟨L7⟩ MARKER ADDED 2026-08-23, reasoning above UNCHANGED — this block already said "Stays an
    /// UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
    /// to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
-   getWalletBalances: () -> (Result_50);
+   getWalletBalances: () -> (Result_56);
    /// Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
    /// read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
    /// engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
    /// fabrication is indistinguishable from the truth by construction.
-   getWorldIdConfig: () -> (Result_49) query;
+   getWorldIdConfig: () -> (Result_55) query;
    /// ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
    /// `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
    /// query can do none of them.
@@ -1963,7 +2140,7 @@ type Engram =
    /// Valid iff the derived signer address (getWorldIdRpSignerAddress) is registered for this rp_id in
    /// the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
    /// it authorizes opening one verification request, nothing else.
-   getWorldIdRpContext: () -> (Result_48);
+   getWorldIdRpContext: () -> (Result_54);
    /// Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
    /// "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
    /// Portal — the engram never holds or exports a private key (only threshold shares exist, on the
@@ -1973,7 +2150,7 @@ type Engram =
    /// awaits `worldIdRpPublicKey()` (management `ecdsa_public_key`), and it calls `denied()` on
    /// refusal — a state write, which a query cannot perform. So even if the key were cached this
    /// could not become a query without silently retiring its denial record (ADR-0002's class).
-   getWorldIdRpSignerAddress: () -> (Result_45);
+   getWorldIdRpSignerAddress: () -> (Result_51);
    /// The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
    /// artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
    /// `Result<opt Text>` — and the double wrapper is the entire point, not redundancy.
@@ -1992,7 +2169,7 @@ type Engram =
    /// `///`, so the dead name was PUBLISHED in engram.did and pointed every client at a method the
    /// canister does not serve. The tombstones below and at `about()` are historical and correct as
    /// written; this one was present tense, which is the difference that matters.⟩
-   getWorldIdVerification: () -> (Result_47) query;
+   getWorldIdVerification: () -> (Result_53) query;
    /// ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
    /// absence of a `#Conflict` here is the point: these are the calls someone makes while something
    /// is going wrong, and the only two answers that help are "you may not do this" and "there is
@@ -2067,7 +2244,7 @@ type Engram =
    /// 
    /// Owner-gated because it reports on custody posture, and answered as a Result so that a
    /// wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
-   isEvmAddressCached: () -> (Result_46) query;
+   isEvmAddressCached: () -> (Result_52) query;
    /// Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
    /// (an `/auth/connector`-style route) after II authentication. The client then
    /// redirects the user's browser to `redirectUri` with `?code=<this>` so the
@@ -2075,7 +2252,7 @@ type Engram =
    /// 
    /// Owner-only: only the engram owner can authorize a Connector install.
    issueAuthCode: (redirectUri: text, scope: text, codeChallenge: text,
-    clientId: opt text) -> (Result_45);
+    clientId: opt text) -> (Result_51);
    /// ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
    /// ROW. A single label for a whole ring misattributes every row recorded under the other source,
    /// and the source flips by design (self-call first, balance on fallback). Its documentation of
@@ -2089,7 +2266,24 @@ type Engram =
    /// Refusal reason preserved, and it is the sharpest of this family: a masked `[]` reads as a
    /// DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
    /// reader, it feeds a wrong number into a decision about destroying data.
-   listActivitySnapshots: (start: nat, limit: nat) -> (Result_44) query;
+   listActivitySnapshots: (start: nat, limit: nat) -> (Result_50) query;
+   /// ⟨2026-10-21, round 11 item l — the owner's answer "round 11: a, b, c, d, e, f, g, h, i, j, k, l,
+   /// m."⟩ OWNER-ONLY: what each agent has spent today, beside the daily limit in force for it, so the
+   /// agent rows can say "$0.50 of $5.00 today" where they said a count of payments. Read from the
+   /// state the payment path already keeps — `outboundSpendToday`, through `SpendCeiling.callerSpentOn`
+   /// (the reader `x402SignFor` uses) — and the limits from `gate.getPolicy(<the agent's key>)`, the
+   /// policy `x402SignFor` checks, on the UTC day it checks (`SpendCeiling.dayIndex`). Amounts are the
+   /// token's minor units, as the record's `amount=` writes them. No new state.
+   /// 
+   /// OWNER-ONLY for `getSpendCeiling`'s reason: one agent's spending is the owner's custody
+   /// information, and would tell another agent how much it spent. Everyone else — an agent, a
+   /// guardian, a stranger, the anonymous caller — is refused by name (`#Refused
+   /// listAgentSpendToday: …`), never answered with zeros. Paged like `listAgents`, in its order, one
+   /// row per agent record; a row's `spentToday` is null, not 0, where no daily limit is in force,
+   /// because the payment path keeps no figure then (`SpendCeiling.AgentSpendRow` says why).
+   /// WHAT WOULD MAKE THIS WRONG: `x402SignFor` keeping the per-caller total by something other than
+   /// the calling key, or under another day boundary.
+   listAgentSpendToday: (start: nat, limit: nat) -> (Result_49) query;
    /// ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
    /// 
    /// The refusal prose that used to be `gatedTrap`'s `whyNotEmpty` argument is not lost — it is why
@@ -2104,7 +2298,7 @@ type Engram =
    /// 
    /// `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
    /// A method that filters rows by caller sets it — see L1's row-level honesty rule.
-   listAgents: (start: nat, limit: nat) -> (Result_43) query;
+   listAgents: (start: nat, limit: nat) -> (Result_48) query;
    /// The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
    /// 
    /// Two audiences, two methods (L1/L8), rather than one method masking fields by caller: a
@@ -2116,7 +2310,7 @@ type Engram =
    /// Refusal reason preserved: `[]` reads as "this engram has no agents", and this is the list a
    /// guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
    /// it tells someone acting under emergency powers that there is nothing to act on.
-   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_42) query;
+   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_47) query;
    /// Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
    /// 
    /// The optional leading filter SURVIVES the L3 reshape — ratified (census tier-2 #8) rather than
@@ -2129,7 +2323,7 @@ type Engram =
    /// 
    /// Refusal reason preserved: `[]` reads as "nothing is awaiting the owner's decision".
    listApprovalRequests: (statusFilter: opt ApprovalStatus, start: nat,
-    limit: nat) -> (Result_29) query;
+    limit: nat) -> (Result_33) query;
    /// ⟨0.16.0⟩ `total` IS THE HEAD COUNTER, and on this method that is the entire point.
    /// 
    /// The audit log is a bounded RING: it trims its tail, so "rows you can read" and "entries that
@@ -2163,7 +2357,7 @@ type Engram =
    /// where this record switched to the hash-first rule. A sealed row costs one SHA-256 of its body
    /// at read time; nothing new is stored. WHAT WOULD MAKE THIS WRONG: a sealed row carrying any part
    /// of a body, or a stranger reaching `items` (test/record-view.test.mo pins both).
-   listAuditEntries: (start: nat, limit: nat) -> (Result_41) query;
+   listAuditEntries: (start: nat, limit: nat) -> (Result_46) query;
    /// ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
    /// 
    /// This method used to answer THREE ways to one question: a list, an `#Err` text, and a trap,
@@ -2187,7 +2381,7 @@ type Engram =
    /// `dbTypeFilter` DIES on the wire (census). The capability does not: `EngramClient.listBackups`
    /// keeps its optional filter and applies it to the page, so no caller loses the ability to ask
    /// "backups of this database" — it stops being a thing the canister has to page around.
-   listBackups: (start: nat, limit: nat) -> (Result_40) query;
+   listBackups: (start: nat, limit: nat) -> (Result_45) query;
    /// List all bearer tokens — Active, Revoked, and Expired. Owner uses this in
    /// the dashboard to show installed Connectors (claude.ai, Claude Desktop, etc.).
    /// Refusal reason preserved from the trap: `[]` reads as "no connector is installed on this
@@ -2197,7 +2391,7 @@ type Engram =
    /// `bearerTokenStore.list()` already resolves each token's status at read time (a token that
    /// merely stopped being used is reported `#Expired`, not a stale `#Active`), so the page carries
    /// the same honesty the store gained on 2026-08-17.
-   listBearerTokens: (start: nat, limit: nat) -> (Result_39) query;
+   listBearerTokens: (start: nat, limit: nat) -> (Result_44) query;
    /// The condense checkpoints in the retained log at or above `startSeq`, oldest first.
    /// 
    /// ⟨0.16.0, NEW⟩ The other half of the split above. A checkpoint is the only surviving record of a
@@ -2207,18 +2401,18 @@ type Engram =
    /// 
    /// Owner-only like every other archive surface, and for the same structural reason: these rows
    /// carry the chain positions and roots of entries whose paths were inside the hash preimage.
-   listCondenseCheckpoints: (startSeq: nat, max: nat) -> (Result_38) query;
+   listCondenseCheckpoints: (startSeq: nat, max: nat) -> (Result_43) query;
    /// ⟨0.16.0⟩ `metrics()` DELETED — absorbed by `about()`.
    /// 
    /// Two public projections of one canister (L2.2): `metrics()` and `status()` both answered "what
    /// is this engram like" and disagreed on which counters they carried, so a consumer had to fetch
    /// both and know which one owned each field. Every field here survives on `about()`, day-flooring
    /// included.
-   listCycleSnapshots: (start: nat, limit: nat) -> (Result_37) query;
+   listCycleSnapshots: (start: nat, limit: nat) -> (Result_42) query;
    /// Same `withheld` treatment as listMemoryFiles — the tombstone listing filtered reserved paths
    /// for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
    /// complete one. Counted before slicing, so policy-hidden rows never blur into paging.
-   listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_36) query;
+   listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_41) query;
    /// Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
    /// 
    /// NAMED item, not a `(Text, Int)` tuple. The Int is an activation time, and a bare Int beside a
@@ -2233,7 +2427,7 @@ type Engram =
    /// The item's field is `value`, not `address`: a list may hold a venue value that is no address.
    /// Readable by the owner, an active agent or an active guardian, as the old list was.
    listEip712Destinations: (typeId: blob, start: nat, limit: nat) ->
-    (Result_35) query;
+    (Result_40) query;
    /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
    /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
    /// 
@@ -2244,14 +2438,20 @@ type Engram =
    /// ⟨2026-10-14, the owner's ruling 3A⟩ Each row carries its per-field rules (`fieldRules`), joined in
    /// from `eip712FieldRules` — they are part of what the type authorises, so a reader of the list must
    /// not have to make a second call to learn them. The row type is `Eip712TypeView`.
-   listEip712Types: (start: nat, limit: nat) -> (Result_34) query;
+   listEip712Types: (start: nat, limit: nat) -> (Result_39) query;
+   /// ⟨2026-10-21, round 11 c⟩ Guardians' disputes, oldest first. Same visibility as
+   /// `listRepudiations` and `listRecordNotes`: the owner and ACTIVE guardians read the rows; an
+   /// agent gets an empty page whose `withheld` counts them (ruling 16 B holds — a dispute is the
+   /// guardian's entry, not the agent's); a stranger, a pending guardian and the anonymous caller are
+   /// refused.
+   listGuardianDisputes: (start: nat, limit: nat) -> (Result_38) query;
    /// Accessible by owner and guardians.
    /// 
    /// Refusal reason carried over from the trap, because it is the sharpest example of why this
    /// surface may not fail soft: `[]` reads as "this engram has nobody who can freeze payments or
    /// pause writes" — a claim about who can STOP it. A caller who cannot tell that from "you may not
    /// see the roster" has been told the engram is unguarded when it may be fully guarded.
-   listGuardians: (start: nat, limit: nat) -> (Result_33) query;
+   listGuardians: (start: nat, limit: nat) -> (Result_37) query;
    /// The export receipts in the retained log at or above `startSeq`, oldest first.
    /// 
    /// ⟨0.16.0, L3⟩ ONE LIST, ONE QUESTION. This method used to return receipts AND checkpoints
@@ -2267,7 +2467,7 @@ type Engram =
    /// 
    /// Read `MemoryRouter.ReceiptPage` before reading `page.total` as a receipt count. It is not one;
    /// it is the chain's length, and the declaration says why.
-   listMemoryExportReceipts: (startSeq: nat, max: nat) -> (Result_32) query;
+   listMemoryExportReceipts: (startSeq: nat, max: nat) -> (Result_36) query;
    /// ⟨0.16.0⟩ THE `withheld` EXEMPLAR — L1 names this exact method as the defect it fixes.
    /// 
    /// A non-owner's answer silently dropped every `config/` and `secrets/` row. Not "refused the
@@ -2283,7 +2483,16 @@ type Engram =
    /// Note the count is computed from the unfiltered list before slicing, so it reports rows hidden
    /// by POLICY, never rows merely off the end of this page — those are `total`'s job. Conflating
    /// the two would rebuild the ambiguity in a new place.
-   listMemoryFiles: (start: nat, limit: nat) -> (Result_31) query;
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answer k: an author on every file row⟩ Each row also
+   /// carries `lastModifiedBy` (`Types.MemoryFileRow`): the key that wrote the file's current
+   /// version, so a phone's file list can say "changed 2 h ago by Recorder" without a read per
+   /// file. It is what `readMemory` already serves to the same callers under the same gate, so it
+   /// tells no caller anything it could not read. Born `opt` (ADR-0018 rule 1). Looked up only for
+   /// the rows of THIS page (`MemoryRouter.info`), after the slice, so the cost is one lookup per
+   /// row served, never one per file stored. A WIDENED REPLY: a reader that decodes the row by
+   /// position rather than by field name breaks — none in this repository does.
+   listMemoryFiles: (start: nat, limit: nat) -> (Result_35) query;
    /// One page of the memory log, seq-ordered, optionally narrowed to one author.
    /// 
    /// THE WINDOW IS THE CURSOR, and the page now states it. The window is
@@ -2309,7 +2518,7 @@ type Engram =
    /// with the disclosures that make the page verifiable — the hidden-bound defect the census itself
    /// names on previewCondense's row.
    listMemoryLog: (startSeq: nat, max: nat, authorFilter: opt principal) ->
-    (Result_30) query;
+    (Result_34) query;
    /// The caller's OWN spend-approval requests. ⟨0.16.0, L1 + L3 — fixed 2026-08-18⟩
    /// 
    /// Two defects in seven lines, and the first is the one this release exists to remove:
@@ -2326,7 +2535,7 @@ type Engram =
    /// to see, so `total` over their own rows is the honest count and nothing is hidden FROM them.
    /// (The unbounded MAP is filed separately — pruning an approval record destroys evidence of what
    /// was asked, which is a retention ruling rather than a shape fix.)
-   listMyApprovalRequests: (start: nat, limit: nat) -> (Result_29) query;
+   listMyApprovalRequests: (start: nat, limit: nat) -> (Result_33) query;
    /// The payer's own sessions, live ones first. PAYER-SCOPED: a caller sees only their own, which
    /// is why this needs no role — a session id is not a secret from the person who paid for it.
    /// 
@@ -2335,7 +2544,7 @@ type Engram =
    /// It took no arguments, and a cursor added after the freeze is an argument-list change every
    /// client would break on — the market paged its own pending withdrawals before its cut for the
    /// same reason. The order is the order sessions were opened.
-   listMySessions: (start: nat, limit: nat) -> (Result_28) query;
+   listMySessions: (start: nat, limit: nat) -> (Result_32) query;
    /// 
    /// ⟨0.16.0, L3⟩ Paged and enveloped like every other `list*`, and the envelope here is uniformity
    /// rather than gating: this method cannot refuse anybody, so `#Err` is unreachable on it. That is
@@ -2348,7 +2557,7 @@ type Engram =
    /// asked by strangers. `verifyEngramActiveOwner` on the registry answers only about the owner
    /// IT recorded, so this chain is what a caller composes with when currency matters — which it
    /// cannot do if it needs a role here.
-   listOwnershipTransfers: (start: nat, limit: nat) -> (Result_27) query;
+   listOwnershipTransfers: (start: nat, limit: nat) -> (Result_31) query;
    /// ⟨2026-09-29, the platform's question from the build review⟩ OWNER-ONLY: how many payment
    /// signatures each agent has obtained today, and the daily limit (200, `PaymentSignCap`). The
    /// owner's console stated the rule and showed no number, because nothing served one; a number it
@@ -2364,7 +2573,7 @@ type Engram =
    /// marketplace's one shared count today is in the reply's `marketplace` field, with the limit this
    /// engram enforces for it — beside the agents, never a row among them
    /// (`PaymentSignCap.marketplaceRow`). Null when no marketplace is set.
-   listPaymentSignatureCounts: (start: nat, limit: nat) -> (Result_26) query;
+   listPaymentSignatureCounts: (start: nat, limit: nat) -> (Result_30) query;
    /// Agent records removed by a reset. Each row is a NAMED record with the fields `principal`,
    /// `name`, `registeredAt` and `purgedAt` — read them BY NAME, never by position.
    /// ⟨2026-09-29, the vocabulary ruling: pairing is the one verb that admits an agent⟩ The field
@@ -2404,7 +2613,7 @@ type Engram =
    /// `invite` its enrolment named, and `ended` — why and on what day its engagement ended (its own
    /// earlier ending, or the reset) — the facts `resyncAgentEdges` re-sends. The stored rows are
    /// served as they are.
-   listPurgedAgents: (start: nat, limit: nat) -> (Result_25) query;
+   listPurgedAgents: (start: nat, limit: nat) -> (Result_29) query;
    /// ⟨0.16.0⟩ ONE ACCESSOR, folding `readReadLog` and `getDenialLog` — and the fold only became
    /// safe because of a change made earlier in this same leg.
    /// 
@@ -2466,7 +2675,13 @@ type Engram =
    /// on the chained record — the same `RecordView` filter, and `withheld` counts what it removed
    /// together with what `successFilter` removed. WHAT WOULD MAKE THIS WRONG: see `listAuditEntries`.
    listReadLog: (successFilter: opt bool, start: nat, limit: nat) ->
-    (Result_24) query;
+    (Result_28) query;
+   /// ⟨2026-10-21, round 11 b⟩ The owner's notes, oldest first. Same visibility as
+   /// `listRepudiations`, for the same reason: the owner and ACTIVE guardians read the rows; an agent
+   /// reads only the entries it caused (follow-up 16 B), and every note is the owner's, so an agent
+   /// gets an empty page whose `withheld` counts the notes in its window — never "there are none". A
+   /// stranger, a pending guardian and the anonymous caller are refused.
+   listRecordNotes: (start: nat, limit: nat) -> (Result_27) query;
    /// Same visibility as listAuditEntries: the owner, this engram's agents, and ACTIVE guardians
    /// see disputes. An unauthorized read REFUSES — it does not return an empty list, because an
    /// empty list reads as "no disputes have been filed", which is a claim, not an absence of one.
@@ -2481,7 +2696,16 @@ type Engram =
    /// window — which says disputes exist without showing them, never "none have been filed". WHAT
    /// WOULD MAKE THIS WRONG: a ruling that an agent may see the disputes of its own writes; this would
    /// then have to look up each disputed version's writer, which it does not do today.
-   listRepudiations: (start: nat, limit: nat) -> (Result_23) query;
+   listRepudiations: (start: nat, limit: nat) -> (Result_26) query;
+   /// ⟨2026-10-21, the owner's round-11 answer f⟩ OWNER-ONLY: the sign-ins, each with the name its app
+   /// registered. The same tokens, in the same order and paged the same way, as `listBearerTokens`,
+   /// each beside `clientName` — the RFC 7591 `client_name` the app registered when the token was
+   /// issued (`People.SignIn` says when it is null, and that it is the app's own claim). A phone
+   /// owner read "localhost" for every app signed in through a local bridge and could not tell two
+   /// apps apart. A NEW method rather than a field on `BearerToken`: that record is stored (M0170)
+   /// and `listBearerTokens`' reply is shipped (never widened). An agent, a guardian, a stranger and
+   /// the anonymous caller are refused, by `listBearerTokens`' own gate and for its reason.
+   listSignIns: (start: nat, limit: nat) -> (Result_25) query;
    /// Owner: advance the review cursor — "I have seen everything up to and including uptoAuditId"
    /// (null = everything at the current head). Bounded so the attestation can never cover entries
    /// the console did not render; clamped monotonic (the cursor never moves backward) and to the
@@ -2492,6 +2716,17 @@ type Engram =
    /// and this never inspects an operation or a role. Widening what the review shows therefore
    /// changes only which ids the console can pass here — it cannot desynchronise the cursor.
    markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_12);
+   /// ⟨2026-10-21, the owner's round-11 answer g⟩ AN AGENT READS ITS OWN GRANT — to the calling key
+   /// only (`People.AgentGrant`): what it may read, where it may write, its rate, and the payment
+   /// limits enforced against that key. It reveals nothing a refusal does not already say, and lets
+   /// an agent correct itself before it writes rather than after the owner explains a refusal by
+   /// hand. `getSpendPolicy` and `listAgents` stay owner-only; this answers one row, the caller's.
+   /// 
+   /// WHO: an ACTIVE agent (`Gated.authorize(#agentOrOwner)`). Refused, each by its own text: the
+   /// owner by name (`People.OWNER_HAS_NO_GRANT`), a revoked or resigned agent ("Agent is revoked" /
+   /// "Agent has resigned" — an ended agent may do nothing, and its old grant would read as powers),
+   /// a guardian and a stranger ("Not authorized"), the anonymous caller. A query: it writes nothing.
+   myGrant: () -> (Result_24) query;
    /// The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
    /// key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
    /// nomination per agent — a new one replaces the earlier one, and the record says which. Refused,
@@ -2526,8 +2761,8 @@ type Engram =
    /// 
    /// WHAT WOULD MAKE THIS WRONG: an await added between `ChildAllowance.take` and the registry call; the
    /// registry's `CHILD_MIN_ATTACHED_CYCLES` moving without `CHILD_ATTACH_CYCLES`.
-   openChildEngram: () -> (Result_22);
-   openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_21);
+   openChildEngram: () -> (Result_23);
+   openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_22);
    /// Withdraw tokens to the owner's principal. This is the ONLY way to
    /// move tokens out of the engram to an external address, and the
    /// destination is always hardcoded to the owner.
@@ -2592,10 +2827,13 @@ type Engram =
    pairAgent: (arg: record {
                       code: text;
                       enrolment: Enrolment;
-                    }) -> (Result_20);
+                    }) -> (Result_21);
    /// ⟨0.16.0, L2.2 — renamed from `guardianPauseWrites`⟩ Same correction as freezePayments above:
    /// owner-or-guardian, and `resumeWrites` never carried the prefix either.
    pauseWrites: () -> (Result_1);
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ `pauseWrites` with a reason; everything said of
+   /// `freezePaymentsWithReason` holds, with `canPauseWrites` as the guardian's grant.
+   pauseWritesWithReason: (reason: text) -> (Result_1);
    /// What condensing through `toSeq` would do, and whether it is unlocked. COMMITS NOTHING — it is
    /// a query, so it structurally cannot; a preview that wrote would be its own trap.
    /// 
@@ -2614,7 +2852,7 @@ type Engram =
    /// 
    /// `unlocked` is the export-receipt gate ONLY. It is not a promise the condense will land: the
    /// history-budget delta is checked at commit time and can still refuse a short prefix.
-   previewCondense: (toSeq: nat) -> (Result_19) query;
+   previewCondense: (toSeq: nat) -> (Result_20) query;
    /// A quote for a session this caller has not opened and is not committed to — the intent a
    /// buyer signs against. Pure dry run, no state, no funds.
    /// 
@@ -2642,6 +2880,27 @@ type Engram =
    /// ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
    /// `expiryNs`. Same value, same meaning; only the name carries the unit now.
    previewOpenSession: () -> (SessionIntent) query;
+   /// ⟨2026-10-21, the owner's round-11 answer k: a trim preview⟩ What a PROPOSED history policy
+   /// would remove from the store as it stands — "about N old copies in F files would be removed" —
+   /// asked BEFORE the owner saves it. A query: nothing is saved, armed or evicted.
+   /// 
+   /// WHO: the OWNER only (`#ownerOnly`). An agent, a guardian, a stranger and the anonymous caller
+   /// are each refused with `requireOwner`'s words; the setter it previews is owner-only too.
+   /// 
+   /// HOW: the proposal must pass the setter's own checks (`retentionEntriesRefusal`), so the preview
+   /// never answers for a policy the setter would refuse. The guards a save would arm are computed
+   /// exactly as the setter computes them (`RetentionPolicy.armGuards`), and each file is planned by
+   /// the planner the sweep executes (`MemoryRouter.previewEviction` → `Retention.plan`), as the
+   /// owner (the sweep's `maintainPrincipal`), AT THE INSTANT its guard lets go — so a rule that
+   /// waits 14 days is counted as it will stand then, when the agent floor has released more. Per
+   /// rule: copies, files, bytes and `notBeforeNs`. The count is "about": writes before the rule
+   /// takes effect change it.
+   /// HONEST WHEN CUT SHORT: `complete = false` when the planning budget
+   /// (`MemoryRouter.PREVIEW_MAX_DROPS`) ran out — the totals are then a floor, and say so.
+   previewRetention: (entries: vec record {
+                                     text;
+                                     RetentionClassSpec;
+                                   }) -> (Result_19) query;
    /// Read one memory file at its current version.
    /// 
    /// Gated on the `read_memory` permission, so an agent holding that grant reaches it — unlike
@@ -2791,6 +3050,17 @@ type Engram =
    /// `#NotFound` rather than `#Refused` when there is no such guardian: only the owner reaches this
    /// line, so the roster is theirs and its contents are not a secret being withheld from them.
    removeGuardian: (guardianPrincipal: principal) -> (Result_1);
+   /// ⟨2026-10-21, the owner's round-11 answer a⟩ OWNER-ONLY: give an agent a new name. A name was
+   /// fixed at the invite, and two agents both called "agent" is how the 2026-10-20 session started.
+   /// Only the VALUE of the stored `AgentRecord.name` changes — no new state, no reshaped record —
+   /// and the change is on the record as `agent.rename` (`principal=<key> name=<new name>`, the name
+   /// last). An ended agent may be renamed too (`People.renameTarget` says why).
+   /// Refused: an agent (itself included), a guardian and a stranger by `requireOwner`'s "Not owner",
+   /// the anonymous caller by its own text; a name that is empty, over `MAX_NAME_LENGTH` or holds a
+   /// line break is `#Invalid` (`People.nameRefusal`); an unknown key is `#NotFound`; the agent's
+   /// current name is `#Conflict`. Nothing changes on any refusal. Not alerted: the owner is the one
+   /// renaming (`ActionAlerts.classify` answers null for `agent.rename`).
+   renameAgent: (agentPrincipal: principal, name: text) -> (Result_1);
    /// Owner disavows a specific memory write, in the open. Marks — never deletes: the content and
    /// the original audit entry stay exactly where they were; this appends a chained
    /// `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
@@ -3084,6 +3354,12 @@ type Engram =
    /// called it an "ops floor: retention enforcement deletes owner backup data silently", mitigated
    /// by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
    /// they are told how many, in the reply and in the audit line.
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answers h and m⟩ The number now bounds EACH creator's
+   /// backups of the kind (`Backup.enforceRetention`): an agent's finalize prunes only that agent's
+   /// own, and this setter applies the number to every creator's set, so `prunedBackups` counts
+   /// across all of them. "The write is the read" above went stale for a second phone, which never
+   /// made the write: `getBackupRetention` is the read.
    setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_9);
    /// Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
    setCallerSpendPolicy: (caller: principal, policy: SpendingPolicy) ->
@@ -3138,7 +3414,12 @@ type Engram =
    /// the guardian honesty rail: integrity, not content). Active guardians only. Arming starts
    /// from NOW (no history replay); url = null disarms and frees the slot.
    setGuardianAlertConfig: (cfg: AlertConfig) -> (Result_1);
-   /// Per-prefix retention policy. Longest prefix wins; anything unmatched keeps everything.
+   /// Per-prefix retention policy. The longest rule that covers a path wins; anything uncovered
+   /// keeps everything.
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answer i⟩ "Covers" is the folder matcher
+   /// (`AgentPaths.covers`, through `RetentionPolicy.resolve`): a rule ending in "/" governs
+   /// everything beneath it, any other rule exactly one path. It was bare text prefix until that day.
    /// 
    /// A CHANGE does not take effect immediately, in EITHER direction: every prefix whose EFFECTIVE
    /// class moves is guarded for the same window as the agent floor, so history cannot be
@@ -3347,6 +3628,26 @@ type Engram =
       tokenName: text;
       tokenVersion: text;
     }) -> (Result_3);
+   /// ⟨2026-10-21, the owner's round-11 answer e⟩ A GUARDIAN STEPS DOWN: the caller ends their own
+   /// guardianship of this engram. It removes a power from the one who holds it and grants none.
+   /// Before, only the owner could remove a guardian, so one who wanted out could only stop watching
+   /// without anyone knowing — worse than an honest exit on the record.
+   /// 
+   /// WHO: anyone holding a guardian record here, `#Pending` or `#Active`; never refused for the
+   /// record's state. The owner is refused by name (`People.OWNER_IS_NO_GUARDIAN`: their way is
+   /// `removeGuardian`); an agent or a stranger is `#NotFound` (`People.NOT_A_GUARDIAN`, a fact about
+   /// the caller told to the caller, as `resignAgent` does); the anonymous caller is refused.
+   /// 
+   /// WHAT IT RECORDS: one `guardian.stepDown` entry under `#Guardian`
+   /// (`principal=<key> was=active|pending name=<name>`). Being a `guardian.*` operation it reaches
+   /// the owner's and the other guardians' alerts in the #guardian class, on by default, and the
+   /// guardian who left gets one farewell delivery before their channel goes (the drain's lazy
+   /// cleanup in `drainActionAlerts`, as for a removed guardian).
+   /// 
+   /// WHAT IT LEAVES: a brake this guardian pulled stays on — lifting one is the owner's; their
+   /// disputes stay on the record. Like `removeGuardian`, it is not terminal: the owner may invite
+   /// the same person again.
+   stepDownAsGuardian: () -> (Result_1);
    /// OWNER force-close, for a session the payer abandoned.
    /// 
    /// ⟨R1b, ruled 2026-08-26: owner-gated, NO guardian.⟩ It moves someone else's money, and only ever
@@ -3828,7 +4129,7 @@ type ChildAllowanceRow =
 type CheckpointPage = 
  record {
    firstAvailableSeq: nat;
-   page: Page_15;
+   page: Page_18;
    scannedThroughSeq: nat;
  };
 type CertifiedAuditHead = 
@@ -3846,6 +4147,28 @@ type CallerSignatureCount =
    role: Role;
    root: opt principal;
  };
+type Brakes = 
+ record {
+   payments: BrakeState;
+   writes: BrakeState;
+ };
+type BrakeState = 
+ record {
+   on: bool;
+   pull: opt BrakePull;
+ };
+type BrakeRole = 
+ variant {
+   Guardian;
+   Owner;
+ };
+type BrakePull = 
+ record {
+   atNs: int;
+   by: principal;
+   reason: opt text;
+   role: BrakeRole;
+ };
 type BearerTokenStatus = 
  variant {
    Active;
@@ -3890,6 +4213,12 @@ type BackupRetentionReport =
    maxBackups: nat;
    prunedBackups: nat;
  };
+type BackupRetention = 
+ record {
+   dbType: text;
+   isDefault: bool;
+   maxBackups: nat;
+ };
 type BackupMetadata = 
  record {
    backupId: text;
@@ -4008,6 +4337,18 @@ type AgentStatus =
    Resigned;
    Revoked;
  };
+type AgentSpendToday = 
+ record {
+   agents: Page_23;
+   dayStartNs: int;
+ };
+type AgentSpendRow = 
+ record {
+   agent: principal;
+   maxPerDay: opt nat;
+   root: principal;
+   spentToday: opt nat;
+ };
 type AgentRecord = 
  record {
    earlierKeys: vec HeldKey;
@@ -4041,6 +4382,13 @@ type AgentPaymentSignatures =
    root: principal;
    signedToday: nat;
  };
+type AgentGrant = 
+ record {
+   key: principal;
+   name: text;
+   paymentLimits: PaymentLimits;
+   permissions: AgentPermissions;
+ };
 type AgentEnding = 
  record {
    day: int;