@engramx/idl 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/engram.did

@@ -5,8 +5,14 @@ type X402SignOutcome =
  };
 type WriteReceipt = 
  record {
+   atNs: int;
+   contentRoot: blob;
    head: blob;
+   prev: blob;
+   recordId: nat;
+   recordPrev: blob;
    seq: nat;
+   size: nat;
    version: nat;
  };
 type WorldIdRpContext = 
@@ -56,12 +62,21 @@ type TokenAmount =
    Ckusdt: nat;
    Icp: nat;
  };
+type TimersWake = 
+ record {
+   gap: int;
+   needed: nat;
+ };
 type TimerHealth = 
  record {
    alertTimerArmed: bool;
+   checkInsUnfinished: opt nat;
+   ic402Maintenance: opt Ic402Maintenance;
+   ic402MaintenanceTimerArmed: opt bool;
    jobExpiryArmed: bool;
    jobExpiryFastMode: bool;
    sessionExpiryArmed: bool;
+   upkeepRejected: opt nat;
  };
 type StorageReport = 
  record {
@@ -127,6 +142,11 @@ type SignatureCounts =
    byCaller: vec CallerSignatureCount;
    total: nat;
  };
+type SignIn = 
+ record {
+   clientName: opt text;
+   token: BearerToken;
+ };
 type SessionIntent = 
  record {
    costPerCall: opt nat;
@@ -168,6 +188,12 @@ type Seat =
    produced: nat;
    weeks: nat64;
  };
+type SealedEntry = 
+ record {
+   digest: blob;
+   entryHash: blob;
+   id: nat;
+ };
 type Role = 
  variant {
    Admin;
@@ -183,6 +209,24 @@ type Role =
    Viewer;
    WasmAdmin;
  };
+type RetentionPreviewRule = 
+ record {
+   bytes: nat;
+   copies: nat;
+   files: nat;
+   notBeforeNs: opt int;
+   prefix: text;
+ };
+type RetentionPreview = 
+ record {
+   bytes: nat;
+   complete: bool;
+   copies: nat;
+   files: nat;
+   planned: nat;
+   rules: vec RetentionPreviewRule;
+   storedFiles: nat;
+ };
 type RetentionClassSpec = 
  variant {
    vault;
@@ -213,347 +257,412 @@ type ResyncReport =
 type Result_9 = 
  variant {
    Err: Error;
-   Ok: SignedTransaction;
+   Ok: vec Seat;
+ };
+type Result_83 = 
+ variant {
+   Err: Error;
+   Ok: AgentRecord;
+ };
+type Result_82 = 
+ variant {
+   Err: Error;
+   Ok: record {activatesAtNs: int;};
+ };
+type Result_81 = 
+ variant {
+   Err: Error;
+   Ok: Eip712Registration;
+ };
+type Result_80 = 
+ variant {
+   Err: Error;
+   Ok: CondenseResult;
  };
 type Result_8 = 
  variant {
    Err: Error;
-   Ok: nat;
+   Ok: RailHealth;
+ };
+type Result_79 = 
+ variant {
+   Err: Error;
+   Ok: MemoryRangeExport;
+ };
+type Result_77 = 
+ variant {
+   Err: Error;
+   Ok: Page_25;
+ };
+type Result_76 = 
+ variant {
+   Err: Error;
+   Ok: AgentWriteReview;
+ };
+type Result_75 = 
+ variant {
+   Err: Error;
+   Ok: BackupMetadata;
+ };
+type Result_74 = 
+ variant {
+   Err: Error;
+   Ok: BackupRetention;
+ };
+type Result_73 = 
+ variant {
+   Err: Error;
+   Ok: vec BirthRecord;
+ };
+type Result_72 = 
+ variant {
+   Err: Error;
+   Ok: Brakes;
+ };
+type Result_71 = 
+ variant {
+   Err: Error;
+   Ok: ChildAllowanceRow;
  };
 type Result_70 = 
  variant {
    Err: Error;
-   Ok: AgentRecord;
+   Ok: ChildOpening;
  };
 type Result_7 = 
  variant {
    Err: Error;
-   Ok: vec Seat;
+   Ok: SignatureCounts;
  };
 type Result_69 = 
  variant {
    Err: Error;
-   Ok: Eip712Registration;
+   Ok: blob;
  };
 type Result_68 = 
  variant {
    Err: Error;
-   Ok: record {activatesAtNs: int;};
+   Ok: EvmAddresses;
  };
 type Result_67 = 
  variant {
    Err: Error;
-   Ok: CondenseResult;
+   Ok: AlertStatus;
  };
 type Result_66 = 
  variant {
    Err: Error;
-   Ok: MemoryRangeExport;
+   Ok: MemoryHistory;
+ };
+type Result_65 = 
+ variant {
+   Err: Error;
+   Ok: MemoryRetentionPolicy;
  };
 type Result_64 = 
  variant {
    Err: Error;
-   Ok: Page_21;
+   Ok: OwnerConsole;
  };
 type Result_63 = 
  variant {
    Err: Error;
-   Ok: AgentWriteReview;
+   Ok: record {paths: vec text;};
  };
 type Result_62 = 
  variant {
    Err: Error;
-   Ok: BackupMetadata;
+   Ok: SigningFloorStatus;
  };
 type Result_61 = 
  variant {
    Err: Error;
-   Ok: ChildAllowanceRow;
+   Ok: SpendCeiling;
  };
 type Result_60 = 
  variant {
    Err: Error;
-   Ok: ChildOpening;
+   Ok: SpendingPolicy;
  };
 type Result_6 = 
  variant {
    Err: Error;
-   Ok: RailHealth;
+   Ok: record {returned: nat;};
  };
 type Result_59 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: StorageReport;
  };
 type Result_58 = 
  variant {
    Err: Error;
-   Ok: EvmAddresses;
+   Ok: WalletBalances;
  };
 type Result_57 = 
  variant {
    Err: Error;
-   Ok: AlertStatus;
+   Ok: WorldIdConfig;
  };
 type Result_56 = 
  variant {
    Err: Error;
-   Ok: MemoryHistory;
+   Ok: WorldIdRpContext;
  };
 type Result_55 = 
  variant {
    Err: Error;
-   Ok: MemoryRetentionPolicy;
+   Ok: opt text;
  };
 type Result_54 = 
  variant {
    Err: Error;
-   Ok: OwnerConsole;
+   Ok: bool;
  };
 type Result_53 = 
  variant {
    Err: Error;
-   Ok: record {paths: vec text;};
+   Ok: text;
  };
 type Result_52 = 
  variant {
    Err: Error;
-   Ok: SigningFloorStatus;
+   Ok: Page_24;
  };
 type Result_51 = 
  variant {
    Err: Error;
-   Ok: SpendCeiling;
+   Ok: AgentSpendToday;
  };
 type Result_50 = 
  variant {
    Err: Error;
-   Ok: SpendingPolicy;
+   Ok: Page_22;
  };
 type Result_5 = 
  variant {
    Err: Error;
-   Ok: SignatureCounts;
+   Ok: Eip712SignatureOut;
  };
 type Result_49 = 
  variant {
    Err: Error;
-   Ok: StorageReport;
+   Ok: Page_21;
  };
 type Result_48 = 
  variant {
    Err: Error;
-   Ok: WalletBalances;
+   Ok: RecordPage;
  };
 type Result_47 = 
  variant {
    Err: Error;
-   Ok: WorldIdConfig;
+   Ok: Page_20;
  };
 type Result_46 = 
  variant {
    Err: Error;
-   Ok: WorldIdRpContext;
+   Ok: Page_19;
  };
 type Result_45 = 
  variant {
    Err: Error;
-   Ok: opt text;
+   Ok: CheckpointPage;
  };
 type Result_44 = 
  variant {
    Err: Error;
-   Ok: bool;
+   Ok: Page_17;
  };
 type Result_43 = 
  variant {
    Err: Error;
-   Ok: text;
+   Ok: Page_16;
  };
 type Result_42 = 
  variant {
    Err: Error;
-   Ok: Page_20;
+   Ok: Page_15;
  };
 type Result_41 = 
  variant {
    Err: Error;
-   Ok: Page_19;
+   Ok: Page_14;
  };
 type Result_40 = 
  variant {
    Err: Error;
-   Ok: Page_18;
+   Ok: Page_13;
  };
 type Result_4 = 
  variant {
    Err: Error;
-   Ok: Eip712SignatureOut;
+   Ok: X402SignOutcome;
  };
 type Result_39 = 
  variant {
    Err: Error;
-   Ok: Page_17;
+   Ok: Page_12;
  };
 type Result_38 = 
  variant {
    Err: Error;
-   Ok: Page_16;
+   Ok: ReceiptPage;
  };
 type Result_37 = 
  variant {
    Err: Error;
-   Ok: CheckpointPage;
+   Ok: Page_10;
  };
 type Result_36 = 
  variant {
    Err: Error;
-   Ok: Page_14;
+   Ok: LogPage;
  };
 type Result_35 = 
  variant {
    Err: Error;
-   Ok: Page_13;
+   Ok: Page_8;
  };
 type Result_34 = 
  variant {
    Err: Error;
-   Ok: Page_12;
+   Ok: Page_7;
  };
 type Result_33 = 
  variant {
    Err: Error;
-   Ok: Page_11;
+   Ok: Page_6;
  };
 type Result_32 = 
  variant {
    Err: Error;
-   Ok: Page_10;
+   Ok: PaymentSignatureCounts;
  };
 type Result_31 = 
  variant {
    Err: Error;
-   Ok: ReceiptPage;
+   Ok: Page_4;
  };
 type Result_30 = 
  variant {
    Err: Error;
-   Ok: Page_8;
+   Ok: Page_3;
  };
 type Result_3 = 
  variant {
    Err: Error;
-   Ok: X402SignOutcome;
+   Ok: ControlHandover;
  };
 type Result_29 = 
  variant {
    Err: Error;
-   Ok: LogPage;
+   Ok: Page_2;
  };
 type Result_28 = 
  variant {
    Err: Error;
-   Ok: Page_6;
+   Ok: Page_1;
  };
 type Result_27 = 
  variant {
    Err: Error;
-   Ok: Page_5;
+   Ok: Page;
  };
 type Result_26 = 
  variant {
    Err: Error;
-   Ok: Page_4;
+   Ok: AgentGrant;
  };
 type Result_25 = 
  variant {
    Err: Error;
-   Ok: PaymentSignatureCounts;
+   Ok: principal;
  };
 type Result_24 = 
  variant {
    Err: Error;
-   Ok: Page_2;
+   Ok: EngramSessionState;
  };
 type Result_23 = 
  variant {
    Err: Error;
-   Ok: Page_1;
+   Ok: Pairing;
  };
 type Result_22 = 
  variant {
    Err: Error;
-   Ok: Page;
+   Ok: CondensePreview;
  };
 type Result_21 = 
  variant {
    Err: Error;
-   Ok: principal;
+   Ok: RetentionPreview;
  };
 type Result_20 = 
  variant {
    Err: Error;
-   Ok: EngramSessionState;
+   Ok: vec BatchReadItem;
  };
 type Result_2 = 
  variant {
    Err: Error;
-   Ok: ControlHandover;
+   Ok;
  };
 type Result_19 = 
  variant {
    Err: Error;
-   Ok: Pairing;
+   Ok: MemoryByteChunk;
  };
 type Result_18 = 
  variant {
    Err: Error;
-   Ok: CondensePreview;
+   Ok: EngramEscrowRecovery;
  };
 type Result_17 = 
  variant {
    Err: Error;
-   Ok: vec BatchReadItem;
+   Ok: GuardianRecord;
  };
 type Result_16 = 
  variant {
    Err: Error;
-   Ok: MemoryByteChunk;
+   Ok: ResetReport;
  };
 type Result_15 = 
  variant {
    Err: Error;
-   Ok: GuardianRecord;
+   Ok: ResyncReport;
  };
 type Result_14 = 
  variant {
    Err: Error;
-   Ok: ResetReport;
+   Ok: nat;
  };
 type Result_13 = 
  variant {
    Err: Error;
-   Ok: ResyncReport;
+   Ok: SessionContext;
  };
 type Result_12 = 
  variant {
    Err: Error;
-   Ok: SessionContext;
+   Ok: MemoryFile;
  };
 type Result_11 = 
  variant {
    Err: Error;
-   Ok: MemoryFile;
+   Ok: BackupRetentionReport;
  };
 type Result_10 = 
  variant {
    Err: Error;
-   Ok: BackupRetentionReport;
+   Ok: SignedTransaction;
  };
 type Result_1 = 
  variant {
    Err: Error;
-   Ok;
+   Ok: TimersWake;
  };
 type Result = 
  variant {
@@ -575,32 +684,25 @@ type Repudiation =
    reason: text;
    version: nat;
  };
-type RegisteredType = 
+type RecordPage = 
  record {
-   ackIrrevocable: bool;
-   authorityClass: AuthorityClass;
-   chainId: nat;
-   cooloffEndsAtNs: int;
-   dailySignCap: nat;
-   destinationFields: vec text;
-   domainName: text;
-   domainSeparator: vec nat8;
-   domainVersion: text;
-   encodeTypeString: text;
-   fields: vec record {
-                 text;
-                 text;
-               };
-   primaryType: text;
-   registeredAtNs: int;
-   typeHash: vec nat8;
-   typeId: blob;
-   verifyingContract: text;
+   hashFirstFrom: nat;
+   items: vec AuditEntry;
+   ringFloor: nat;
+   sealed: vec SealedEntry;
+   total: nat;
+ };
+type RecordNote = 
+ record {
+   about: nat;
+   atNs: int;
+   auditId: nat;
+   note: text;
  };
 type ReceiptPage = 
  record {
    firstAvailableSeq: nat;
-   page: Page_9;
+   page: Page_11;
    scannedThroughSeq: nat;
  };
 type RailHealth = 
@@ -610,6 +712,7 @@ type RailHealth =
    freezeReservation: nat;
    memoryBytes: nat;
    paidVouchersConsumed: nat;
+   refundOwed: opt nat;
    sendHeadroom: nat;
    sessionsClosed: nat;
    sessionsClosing: nat;
@@ -628,9 +731,20 @@ type PurgedAgent =
    purgedAtNs: int;
    root: principal;
  };
+type PaymentsStop = 
+ variant {
+   dailySignatureLimit;
+   paymentsBrake;
+   signingFloor;
+ };
+type PaymentsNow = 
+ record {
+   largestPayment: opt nat;
+   leftToday: opt nat;
+ };
 type PaymentSignatureCounts = 
  record {
-   agents: Page_3;
+   agents: Page_5;
    day: int;
    limit: nat;
    marketplace: opt MarketplacePaymentSignatures;
@@ -646,6 +760,16 @@ type PaymentSignature =
    sender: text;
    signature: blob;
  };
+type PaymentLimits = 
+ record {
+   maxConcurrentSessions: opt nat;
+   maxPerDay: opt nat;
+   maxPerTransaction: opt nat;
+   maxSessionDeposit: opt nat;
+   maxSessionDuration: opt int;
+   rateLimitPerMinute: opt nat;
+   sessionIdleTimeout: opt int;
+ };
 type Pairing = 
  record {
    agent: AgentRecord;
@@ -653,75 +777,71 @@ type Pairing =
  };
 type Page_9 = 
  record {
-   items: vec ExportReceiptRow;
+   items: vec MemoryLogEvent;
    total: nat;
    withheld: nat;
  };
 type Page_8 = 
  record {
-   items: vec record {
-                lastModifiedAtNs: int;
-                path: text;
-                version: nat;
-              };
+   items: vec ApprovalRequest;
    total: nat;
    withheld: nat;
  };
 type Page_7 = 
  record {
-   items: vec MemoryLogEvent;
+   items: vec EngramSessionState;
    total: nat;
    withheld: nat;
  };
 type Page_6 = 
  record {
-   items: vec ApprovalRequest;
+   items: vec OwnershipTransfer;
    total: nat;
    withheld: nat;
  };
 type Page_5 = 
  record {
-   items: vec EngramSessionState;
+   items: vec AgentPaymentSignatures;
    total: nat;
    withheld: nat;
  };
 type Page_4 = 
  record {
-   items: vec OwnershipTransfer;
+   items: vec PurgedAgent;
    total: nat;
    withheld: nat;
  };
 type Page_3 = 
  record {
-   items: vec AgentPaymentSignatures;
+   items: vec AuditEntry;
    total: nat;
    withheld: nat;
  };
-type Page_21 = 
+type Page_25 = 
  record {
    items: vec OwnerRow;
    total: nat;
    withheld: nat;
  };
-type Page_20 = 
+type Page_24 = 
  record {
    items: vec ActivitySnapshot;
    total: nat;
    withheld: nat;
  };
-type Page_2 = 
+type Page_23 = 
  record {
-   items: vec PurgedAgent;
+   items: vec AgentSpendRow;
    total: nat;
    withheld: nat;
  };
-type Page_19 = 
+type Page_22 = 
  record {
    items: vec AgentRecord;
    total: nat;
    withheld: nat;
  };
-type Page_18 = 
+type Page_21 = 
  record {
    items: vec record {
                 name: text;
@@ -731,66 +851,87 @@ type Page_18 =
    total: nat;
    withheld: nat;
  };
-type Page_17 = 
+type Page_20 = 
  record {
    items: vec BackupMetadata;
    total: nat;
    withheld: nat;
  };
-type Page_16 = 
+type Page_2 = 
+ record {
+   items: vec RecordNote;
+   total: nat;
+   withheld: nat;
+ };
+type Page_19 = 
  record {
    items: vec BearerToken;
    total: nat;
    withheld: nat;
  };
-type Page_15 = 
+type Page_18 = 
  record {
    items: vec CondenseCheckpointRow;
    total: nat;
    withheld: nat;
  };
-type Page_14 = 
+type Page_17 = 
  record {
    items: vec CycleSnapshot;
    total: nat;
    withheld: nat;
  };
-type Page_13 = 
+type Page_16 = 
  record {
    items: vec text;
    total: nat;
    withheld: nat;
  };
+type Page_15 = 
+ record {
+   items: vec Eip712Destination;
+   total: nat;
+   withheld: nat;
+ };
+type Page_14 = 
+ record {
+   items: vec Eip712TypeView;
+   total: nat;
+   withheld: nat;
+ };
+type Page_13 = 
+ record {
+   items: vec GuardianDispute;
+   total: nat;
+   withheld: nat;
+ };
 type Page_12 = 
  record {
-   items: vec RegisteredType;
+   items: vec GuardianRecord;
    total: nat;
    withheld: nat;
  };
 type Page_11 = 
  record {
-   items: vec record {
-                activeFromNs: int;
-                address: text;
-              };
+   items: vec ExportReceiptRow;
    total: nat;
    withheld: nat;
  };
 type Page_10 = 
  record {
-   items: vec GuardianRecord;
+   items: vec MemoryFileRow;
    total: nat;
    withheld: nat;
  };
 type Page_1 = 
  record {
-   items: vec AuditEntry;
+   items: vec Repudiation;
    total: nat;
    withheld: nat;
  };
 type Page = 
  record {
-   items: vec Repudiation;
+   items: vec SignIn;
    total: nat;
    withheld: nat;
  };
@@ -962,6 +1103,13 @@ type MemoryHistory =
    retainedCount: nat;
    versions: vec MemoryVersionSummary;
  };
+type MemoryFileRow = 
+ record {
+   lastModifiedAtNs: int;
+   lastModifiedBy: opt principal;
+   path: text;
+   version: nat;
+ };
 type MemoryFile = 
  record {
    content: blob;
@@ -1009,13 +1157,22 @@ type LogPage =
  record {
    firstAvailableSeq: nat;
    head: blob;
-   page: Page_7;
+   page: Page_9;
  };
 type KeyNomination = 
  record {
    atNs: int;
    key: principal;
  };
+type Ic402Maintenance = 
+ record {
+   dailySpendRemoved: nat;
+   lastRunAtNs: int;
+   more: bool;
+   rateLimitRemoved: nat;
+   revokedGrantsRemoved: nat;
+   runs: nat;
+ };
 type HttpResponse = 
  record {
    body: blob;
@@ -1073,6 +1230,16 @@ type GuardianPermissions =
    canRevokeAgents: bool;
    scopes: opt vec text;
  };
+type GuardianDispute = 
+ record {
+   about: nat;
+   atNs: int;
+   auditId: nat;
+   guardian: principal;
+   path: opt text;
+   reason: text;
+   version: opt nat;
+ };
 type GenesisNote = 
  record {
    genesisAtNs: int;
@@ -1139,6 +1306,11 @@ type EngramSessionState =
    status: EngramSessionStatus;
    voucherCount: nat;
  };
+type EngramEscrowRecovery = 
+ record {
+   amountE6: nat;
+   blockIndex: nat;
+ };
 type Engram = 
  service {
    /// ⟨0.16.0⟩ `about()` — the ONE public projection, replacing `status()` and absorbing `metrics()`.
@@ -1170,10 +1342,17 @@ type Engram =
    /// nomination names. That check compares the caller inside the module, where
    /// test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
    /// no role here until the move.
-   acceptAgentKeyNomination: (agentKey: principal) -> (Result_70);
+   acceptAgentKeyNomination: (agentKey: principal) -> (Result_83);
    /// Consensus transform for the alert webhook outcall: collapse the response to status-only so
    /// replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
    /// 
+   /// ⟨CORRECTED 2026-10-21⟩ No longer a consensus transform: the alert outcall is non-replicated
+   /// (`is_replicated = ?false` in `scanAndPost`), so ONE node sends the POST and runs this on its
+   /// own response — there are no replicas to agree, and "on every replica" below now means "on that
+   /// node". It stays so the response is collapsed to status-only before the engram reads it. The
+   /// PUBLIC reasoning below is unchanged: the outcall protocol still calls it with no caller identity.
+   /// `worldIdTransform` is still a true consensus transform (World ID stays replicated).
+   /// 
    /// PUBLIC: not a choice. The management canister invokes a transform on every replica as part of
    /// the HTTP-outcall protocol, and that invocation carries no caller identity to gate on — a gate
    /// here would refuse the only caller there is and break every alert this canister sends. Safe
@@ -1183,9 +1362,32 @@ type Engram =
       context: blob;
       response: HttpRequestResult;
     }) -> (HttpRequestResult) query;
+   /// Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
+   /// and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
+   /// 
+   /// ⟨2026-10-14, the owner's ruling 4A⟩ ONE LIST PER REGISTERED ACTION. `addEvmWithdrawDestination`,
+   /// `removeEvmWithdrawDestination` and `listEvmWithdrawDestinations` — one list for every action —
+   /// are REMOVED; these three take the action's `typeId`. Same rules, per action: the owner only; an
+   /// addition activates after 24 hours and is refused while payments are frozen; a removal is instant
+   /// and works while frozen; a value is 1–128 characters (an address, or a venue value such as an
+   /// account name). The action must be registered: a destination list belongs to an action, and a
+   /// list for no action would be a value nothing checks. The caller is the owner's app.
+   addEip712Destination: (typeId: blob, value: text) -> (Result_82);
    /// Register a typed-data shape as signable. Owner-only, freeze-gated (a registration is a grant
    /// of FUTURE authority — a frozen engram must not be able to widen what it can sign), and the
    /// shape is IMMUTABLE: any change mints a new typeId.
+   /// 
+   /// ⟨2026-10-14, the owner's rulings 3A and 5A⟩ ONE BAR FOR EVERY REGISTRATION — the class the owner
+   /// names is stored as a label and decides nothing. Every registration: records the irrevocability
+   /// acknowledgement (`ackIrrevocable = true`); has no opaque field (`bytes`, `bytes1..32`); names at
+   /// least one destination field OR carries a must-equal rule; passes the watchers — an owner alert
+   /// webhook set, enabled AND with its money class on, and an `#Active` guardian holding
+   /// `canFreezePayments`; and waits `Eip712Policy.COOLOFF_NS` (72 hours). It may carry per-field
+   /// rules (`fieldRules`: "at most N" read as a plain decimal with D places, "must equal X"), which
+   /// are part of the registered shape — inside the typeId, stored in `eip712FieldRules`, enforced in
+   /// `eip712SignFor` before the cap reservation. Before this, a withdrawal registered as `#standard`
+   /// needed no webhook, no guardian and no destination field, waited one hour, and signed to any
+   /// address. Intrinsic checks still come first and the watchers last (the 2026-08-06 re-ordering).
    addEip712Type: (spec:
     record {
       ackIrrevocable: bool;
@@ -1200,16 +1402,17 @@ type Engram =
       destinationFields: vec text;
       domainName: text;
       domainVersion: text;
+      fieldRules: vec record {
+                        text;
+                        Eip712FieldRule;
+                      };
       fields: vec record {
                     text;
                     text;
                   };
       primaryType: text;
       verifyingContract: text;
-    }) -> (Result_69);
-   /// Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
-   /// and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
-   addEvmWithdrawDestination: (dest: text) -> (Result_68);
+    }) -> (Result_81);
    /// ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
    /// 
    /// This method had five distinct ways to say no through one `text`, and a caller could only tell
@@ -1219,7 +1422,16 @@ type Engram =
    /// permitted but this engram's state says no — the principal already holds an incompatible role,
    /// or the roster is full. Only the last is worth an agent's time to resolve.
    addGuardian: (guardianPrincipal: principal, name: text, permissions:
-    GuardianPermissions) -> (Result_1);
+    GuardianPermissions) -> (Result_2);
+   /// ⟨2026-10-21, the owner's round-11 answer b⟩ OWNER-ONLY: put a note on any entry of this
+   /// engram's record — words, nothing else. Appends a chained `record.note` entry
+   /// (`about=<id> note=<words>`) and keeps the note for `listRecordNotes`; answers the new entry's
+   /// id. The entry noted may be any entry ever appended (`about` below the head), including one the
+   /// ring no longer holds in full. An agent, a guardian, a stranger and the anonymous caller are
+   /// refused by `requireOwner`'s own words. Empty words, words over `RecordWords.WORDS_MAX` or
+   /// holding a line break are `#Invalid`; an id past the head is `#NotFound`; nothing is recorded
+   /// on any refusal.
+   addRecordNote: (about: nat, note: text) -> (Result_14);
    /// Returns the write RECEIPT, not just the version.
    /// 
    /// The receipt was always computed and then thrown away: MemoryRouter hands back
@@ -1251,7 +1463,7 @@ type Engram =
    /// Gated on requireWritesNotPaused — unlike the export. This one destroys retained entries, which
    /// is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
    /// owner-initiated, owner-only, and already chained into the audit log.
-   applyCondense: (toSeq: nat) -> (Result_67);
+   applyCondense: (toSeq: nat) -> (Result_80);
    /// Owner-only: activate a guardian who has registered against an invite.
    /// 
    /// Until this call the guardian is `#Pending` and can do NOTHING — registering is a claim, this
@@ -1260,7 +1472,7 @@ type Engram =
    /// 
    /// `#Conflict("Guardian is already active")` when there is nothing to do — the refusal says the
    /// state the caller asked for is the state that holds, rather than pretending it acted.
-   approveGuardian: (guardianPrincipal: principal) -> (Result_1);
+   approveGuardian: (guardianPrincipal: principal) -> (Result_2);
    /// Owner-only: approve one pending over-limit request, letting the agent retry the operation
    /// its policy refused.
    /// 
@@ -1281,11 +1493,11 @@ type Engram =
    /// Refuses `#NotFound` for an unknown id, and `#Conflict` NAMING THE STATUS when the request is
    /// no longer pending — already approved, denied or expired. The status is in the message because
    /// "not pending" is the one refusal here an owner acts on differently depending on which it is.
-   approveRequest: (requestId: text) -> (Result_1);
+   approveRequest: (requestId: text) -> (Result_2);
    /// Discard a backup started by `backupInit` and never finalized. The way out of a failed upload,
    /// and the reason a stalled one need not occupy space indefinitely. Same gate as the rest of the
    /// write half: owner, or an agent holding `canAppendMemory`.
-   backupAbort: (backupId: text) -> (Result_1);
+   backupAbort: (backupId: text) -> (Result_2);
    /// Close a backup started by `backupInit` and mark it usable.
    /// 
    /// ⚠ ONLY THE CREATOR MAY FINALIZE — `#Refused("Not the creator of this backup")`. An agent
@@ -1298,7 +1510,7 @@ type Engram =
    /// 
    /// It does NOT verify the `sha256` declared at init; see that method for what the digest is and
    /// is not.
-   backupFinalize: (backupId: text) -> (Result_1);
+   backupFinalize: (backupId: text) -> (Result_2);
    /// Begin a chunked backup upload. Returns the `backupId` every later call in the sequence needs.
    /// 
    /// **THE SEQUENCE**, which no individual signature here conveys:
@@ -1322,24 +1534,24 @@ type Engram =
    /// 
    /// The write half also refuses while writes are PAUSED.
    backupInit: (dbType: text, backupType: BackupType, parentBackupId:
-    opt text, sha256: text, backupLabel: opt text) -> (Result_43);
+    opt text, sha256: text, backupLabel: opt text) -> (Result_53);
    /// Read one chunk of a finalized backup, by index.
    /// 
    /// ⚠ GATED ON `read_backup`, which is NOT the permission the upload half uses — that one is
    /// `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
    /// carrying it away are different authorities.
-   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_59) query;
+   backupPullChunk: (backupId: text, chunkIndex: nat) -> (Result_69) query;
    backupPushChunk: (backupId: text, chunkIndex: nat, data: blob) ->
-    (Result_1);
+    (Result_2);
    /// The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
    /// by name when the agent is unknown or has nothing pending — never a silent success.
-   cancelAgentKeyNomination: (agentKey: principal) -> (Result_1);
+   cancelAgentKeyNomination: (agentKey: principal) -> (Result_2);
    /// Close a session the caller paid for: settle what was consumed, refund the remainder.
    /// 
    /// PAYER-ONLY, enforced inside the gateway. This is the exit that did not exist — `endSession`
    /// and `forceCloseSession` were on the MARKET, which is withheld, and whose escrow subaccount is
    /// under a different principal entirely, so its close could never have reached these funds.
-   closeSession: (sessionId: text) -> (Result_1);
+   closeSession: (sessionId: text) -> (Result_2);
    /// Convert the engram's OWN earned ckUSDC/ckUSDT into its OWN cycles, via the cashier — the
    /// engram-self top-up path. Owner-only; per-call cap + cooldown (irreversible); NOT freeze-gated
    /// (infrastructure funding). Flow: read the engram's deposit address on the cashier, move the
@@ -1361,7 +1573,7 @@ type Engram =
    /// ⟨2026-10-02⟩ The second parameter is NAMED `amountE6` now, as the census row above rules the
    /// pair — e6 base units of the token named first. A name only: Candid passes arguments by
    /// position, so nothing on the wire moved.
-   convertEarningsToCycles: (token: text, amountE6: nat) -> (Result_8);
+   convertEarningsToCycles: (token: text, amountE6: nat) -> (Result_14);
    /// Owner-only: mint a single-use invite code an agent redeems with `pairAgent`.
    /// 
    /// ⚠ READ THIS BEFORE INVITING SOMEONE BACK. Pairing is ONE-SHOT PER PRINCIPAL on
@@ -1379,8 +1591,18 @@ type Engram =
    /// 
    /// A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    /// independent check on agents, so one wallet must not hold both.
+   /// 
+   /// ⟨2026-10-29, the owner's ruling "a"⟩ `name` MAY BE EMPTY (or only whitespace): the agent is then
+   /// named after its key when it pairs — "agent-" and the key's first five characters, e.g.
+   /// "agent-hsffu" (`People.nameAtPairing` says why five, and the first). ⟨2026-10-29, later, beside "its key"⟩ Its
+   /// PERMANENT key (the root it enrolled with), not the key that pairs, so the name stays right across
+   /// a key replacement and matches the app's "Copy permanent key". A name the owner gives
+   /// always wins. Before this an empty name was refused, so an app that wanted no name had to invent
+   /// one ("agent"), and two agents read alike.
+   /// ⟨2026-10-29, review F7⟩ A name the owner gives meets the rule `renameAgent` applies: a line break
+   /// or another control character is `#Invalid` (`People.nameRefusal`), as a rename to it would be.
    createAgentInvite: (name: text, permissions: AgentPermissions) ->
-    (Result_43);
+    (Result_53);
    /// Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
    /// co-owner and not a recovery agent.
    /// 
@@ -1403,7 +1625,7 @@ type Engram =
    /// So an invite that fails to redeem for that reason is not a bad code. The rule exists because
    /// a check must be independent of the thing it checks.
    createGuardianInvite: (name: text, permissions: GuardianPermissions) ->
-    (Result_43);
+    (Result_53);
    /// OWNER-ONLY deletion of a stored backup.
    /// 
    /// ⚠ NOT THE SAME GATE AS THE REST OF THE FAMILY, and the asymmetry is deliberate: `backupInit`,
@@ -1414,7 +1636,7 @@ type Engram =
    /// 
    /// `backupAbort` is the agent's way out of a failed UPLOAD; it discards something never
    /// finalized. This removes a finished backup, which is a different act on a different object.
-   deleteBackup: (backupId: text) -> (Result_1);
+   deleteBackup: (backupId: text) -> (Result_2);
    /// ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>`. The receipt was already
    /// being computed and written into the audit line — `receiptSuffix(r)` — and then discarded, so
    /// a caller could not cite the seq its own delete produced and had to go looking for it in a log
@@ -1430,36 +1652,23 @@ type Engram =
    /// Terminal: a denied request cannot be approved afterwards. Like `approveRequest` it refuses
    /// `#NotFound` for an unknown id and `#Conflict` when the request is no longer pending, and it
    /// does not change the policy — the next request over the same limit will be raised again.
-   denyRequest: (requestId: text, reason: text) -> (Result_1);
-   /// Force the tECDSA derivation and return the address.
-   /// 
-   /// It exists because the gateway's own derivation fires from a timer that is lazy on some
-   /// replicas, and until it lands the EVM quote advertises the `0x0` fallback and settle fails
-   /// closed — a live money surface quoting an address that cannot receive.
-   /// 
-   /// ⟨0.16.0, B-2⟩ Derivation now comes from `EvmIdentity`, and the return type carries the
-   /// outcome: this used to answer `""` on failure, which is a Text a caller can and did paste into
-   /// a payment flow. An empty string is not an address, and saying so is the difference between a
-   /// failed derivation and an address of nothing.
-   /// 
-   /// ⚠ TRANSITIONAL: it also primes the ic402 gate, because the gate still settles commerce on this
-   /// canister until those 47 methods move. That second call disappears with them — it is listed in
-   /// the move order in the spec's B-2 addendum, not left for someone to find.
-   /// 
-   /// PUBLIC: it inherits `getEvmAddress`'s gate rather than choosing one, and could not usefully be
-   /// narrower — it exists so a caller can make the derivation happen BEFORE a payment flow, and the
-   /// derivation itself is ungated. Idempotent and bounded to the same one-derivation-per-lifetime
-   /// work, so an anonymous caller can cause it once and no more.
-   /// ⟨L7⟩ UPDATE, NOT QUERY, and this one does not merely await — it WRITES. The body awaits
-   /// `EvmIdentity.deriveAddress` (the management canister's `ecdsa_public_key`) and
-   /// `gate.deriveEvmRecipientAt` ⟨renamed 2026-09-22 with the path⟩, then caches the result in `evmAddressCache`. So a query is
-   /// impossible twice over: it could not await the derivation, and it could not keep the answer.
-   /// Named `ensure*` rather than `get*` for that reason — the write is the point, and a read verb
-   /// would have promised a cheapness this cannot deliver.
-   /// 
-   /// ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
-   /// the site.⟩
-   ensureEvmReady: () -> (Result_43);
+   denyRequest: (requestId: text, reason: text) -> (Result_2);
+   /// ⟨2026-10-21, the owner's round-11 answer c⟩ A NEW GUARDIAN POWER, words only: an ACTIVE
+   /// guardian disputes an agent's write. It never moves money, stops anything or changes a grant.
+   /// Appends a chained `record.dispute` entry (`about=<id> reason=<words>`) and keeps the dispute
+   /// for `listGuardianDisputes`; answers the new entry's id. NOT ALERTED, deliberately: a
+   /// `guardian.*` operation would fall in the alerts' #guardian class, and which entries reach a
+   /// phone is the held alerts round's to decide (`ActionAlerts.classify` answers null for
+   /// `record.*`). The owner sees it on the record's Disputes tab.
+   /// 
+   /// WHO: every active guardian — no grant bit (`RecordWords` header says why). The OWNER is refused
+   /// by name (`RecordWords.OWNER_DISPUTES_ELSEWHERE` — the owner's dispute is
+   /// `repudiateMemoryWrite`); an agent and a stranger get "Not a guardian", a pending guardian "Guardian
+   /// is pending approval", the anonymous caller the anonymous refusal.
+   /// WHAT: an entry the owner's review would show (`qualifiesForReview` — an agent's append or
+   /// revision, or a paid session's append) that succeeded, still held in full by the ring.
+   /// One dispute per guardian per write (`#Conflict`, the first stands).
+   disputeAgentWrite: (about: nat, reason: text) -> (Result_14);
    /// Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
    /// 
    /// This is the receipt ledgerfs Q2 requires before any of those entries may be condensed away.
@@ -1473,7 +1682,7 @@ type Engram =
    /// situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
    /// failed its integrity check must not attest anything it cannot vouch for.
    exportMemoryRange: (fromSeq: nat, toSeq: nat, authorFilter:
-    opt principal) -> (Result_66);
+    opt principal) -> (Result_79);
    /// ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
    /// The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
    /// case — the guardian is the exceptional one. A name that says otherwise sends an owner looking
@@ -1489,6 +1698,8 @@ type Engram =
    ///     individual method's body finds nothing — the check is one level down.⟩
    ///   · `addEip712Type` and `addEvmWithdrawDestination` — pre-staging for a later payout is the
    ///     thing a brake most needs to stop, so the destination list is frozen along with the signing.
+   ///     ⟨2026-10-14, the owner's ruling 4A⟩ `addEvmWithdrawDestination` is removed; its place is
+   ///     `addEip712Destination` (one list per registered action), freeze-gated the same way.
    ///   · `sessionReadMemory` and `sessionAppendMemory` — the paid-memory rail, money coming IN.
    /// 
    /// AND WHAT IT DELIBERATELY DOES NOT, stated so the absence is not read as an oversight:
@@ -1503,9 +1714,17 @@ type Engram =
    /// 
    /// ⚠ The three exclusions are a reading of intent, not a ruling: no declaration stated the scope
    /// before this one. If any of them is wrong, this comment is where the argument should happen.
-   freezePayments: () -> (Result_1);
+   freezePayments: () -> (Result_2);
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ `freezePayments` with a reason the strip and the
+   /// guardian page show ("Sam froze payments: 'a payment I didn't expect'"). A NEW method, not an
+   /// argument on `freezePayments`: a shipped argument tuple is frozen. Same callers, same grant, same
+   /// brake: the owner, or an active guardian holding `canFreezePayments`; an agent, a stranger, a
+   /// pending guardian and the anonymous caller are refused by `requireOwnerOrGuardian`'s own words.
+   /// An empty reason is no reason; a reason too long or holding a line break is `#Invalid` and the
+   /// brake is NOT pulled — the caller pulls it with `freezePayments`, or shortens the words.
+   freezePaymentsWithReason: (reason: text) -> (Result_2);
    /// Delivery status + config readback. Owner-only (the URL is a secret).
-   getActionAlertStatus: () -> (Result_57) query;
+   getActionAlertStatus: () -> (Result_67) query;
    /// Agents need to know what they may revise, so they can read it too. Whole-value config, same
    /// carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
    /// protected path and a revisable path are opposite grants, and one accessor for both would be a
@@ -1513,7 +1732,7 @@ type Engram =
    /// 
    /// Refusal reason preserved from the trap: a grant is a power, and its absence and its
    /// concealment are different facts.
-   getAgentRevisablePaths: () -> (Result_53) query;
+   getAgentRevisablePaths: () -> (Result_63) query;
    /// OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
    /// paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
    /// of the last one, and how many were produced. Never an amount, a recipient or a nonce.
@@ -1524,7 +1743,7 @@ type Engram =
    /// order. Anyone else is refused by name (`#Refused getAgentSeatWeeks: …`), never answered with an
    /// empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
    /// Two rows can name one root: an agent paired again after it left is a second engagement.
-   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_64) query;
+   getAgentSeatWeeks: (start: nat, limit: nat) -> (Result_77) query;
    /// Owner: everything written into this engram by someone other than the owner since the last
    /// markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
    /// qualifiesForReview for why those two families are recognised differently).
@@ -1532,7 +1751,7 @@ type Engram =
    /// them — the UI must page (markAgentWritesReviewed(?lastShownId)) and must NOT present 200
    /// as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
    /// aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
-   getAgentWriteReview: () -> (Result_63) query;
+   getAgentWriteReview: () -> (Result_76) query;
    /// Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
    /// engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
    /// and none of these fields is a secret — `total` is already public via getCertifiedAuditHead.
@@ -1551,7 +1770,18 @@ type Engram =
    /// below serves the same head WITH the subnet certificate for a caller that needs to verify it
    /// was signed rather than asserted.
    getAuditHead: () -> (AuditHead) query;
-   getBackupMetadata: (backupId: text) -> (Result_62) query;
+   getBackupMetadata: (backupId: text) -> (Result_75) query;
+   /// ⟨2026-10-21, the owner's round-11 answer m: a backup-retention getter⟩ How many backups of
+   /// `dbType` each creator keeps, and whether that is the default — the read `setBackupRetention`
+   /// lacked, so "Keeps your newest 3" showed only on the phone that last set it.
+   /// 
+   /// WHO: the OWNER, and an active AGENT holding `canAppendMemory` — the permission that lets it
+   /// upload backups, which are exactly the backups this number bounds (`#perm(#append_memory)`).
+   /// Refused, each by the gate's own words: an agent without that permission ("Permission
+   /// denied"), a revoked or resigned agent, a guardian (guardians take no backups), a stranger and
+   /// the anonymous caller. A kind the setter would refuse is `#Invalid` here too
+   /// (`Backup.getRetention`). Records nothing (a query).
+   getBackupRetention: (dbType: text) -> (Result_74) query;
    /// The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
    /// 
    /// PUBLIC: a payer about to send money needs to know which cashier this engram will accept credit
@@ -1559,6 +1789,23 @@ type Engram =
    /// never become rent. The registry publishes the same fact as `getRentBiller`; publishing it here
    /// too is what lets the two be COMPARED, which is the only way to catch a mismatch.
    getBillerId: () -> (opt principal) query;
+   /// This engram's BIRTH CHAIN, root first: its own record last, its parent's before it, and so on
+   /// ⟨2026-10-26, the owner's lineage ruling L3A⟩.
+   /// 
+   /// OWNER ONLY. The owner decides whom to show it to — the chain names the engrams this one descends
+   /// from, which is the owner's to disclose, not the registry's. The certified half is at the registry
+   /// (`getCertifiedBirth`, public, revealing only whether a fingerprint is present); the client's
+   /// `verifyBirthChain` checks both. Refused to anyone else by the combinator (`#ownerOnly`).
+   getBirthChain: () -> (Result_73) query;
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ Each brake: on or off, and while on, who pulled it
+   /// LAST (their key and whether as owner or guardian), since when, and the reason they gave — the
+   /// same person and time as the newest brake entry on the record (`RecordWords.BrakePull`). For the
+   /// owner's status strip and the guardian page. The OWNER and ACTIVE GUARDIANS may read it; an
+   /// agent, a stranger, a pending guardian and the anonymous caller are refused (`#ownerOrGuardian`
+   /// — an agent learns a brake is on from the refusal of what it tried, and needs no more). `pull`
+   /// is null for a brake that is off, and for one carried on across the upgrade that added this
+   /// read (who pulled it was not recorded then) — never a guessed pull.
+   getBrakes: () -> (Result_72) query;
    /// ⟨0.16.0, L9/L10 — census row⟩ `Wire.CertifiedAuditHead`, not an anonymous record. The
    /// registry, market and cashier already served the shared type; the engram — the canister that
    /// IS the evidence product — was the one chain still answering in a shape of its own, missing
@@ -1581,11 +1828,11 @@ type Engram =
    /// query's state writes are discarded when it returns, and the `denied` call first written here
    /// recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
    /// WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
-   getChildAllowance: (agentPrincipal: principal) -> (Result_61) query;
+   getChildAllowance: (agentPrincipal: principal) -> (Result_71) query;
    /// Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
    /// agent's request is refused, the balance now, and every agent's allowance. The console's cost
    /// sentence reads it. Cycles are owner-class information, as on the owner's console read.
-   getChildOpening: () -> (Result_60) query;
+   getChildOpening: () -> (Result_70) query;
    /// Derive the shared memory-encryption key, encrypted under the caller's transport
    /// public key. Gated to owner + read-agents (the same principals allowed to read
    /// memory). The client decrypts it locally with its transport secret key.
@@ -1610,7 +1857,7 @@ type Engram =
    /// cost. Stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body — which is exactly what had to happen to write this line.
    getEncryptedMemoryKey: (epoch: opt nat, transportPublicKey: blob) ->
-    (Result_59);
+    (Result_69);
    /// ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
    /// 
    /// The card's config hardcodes `x402Support = true`, answering a buyer's question with a fact
@@ -1635,10 +1882,6 @@ type Engram =
    /// has never met this engram what it is and how to transact with it. A card behind a gate cannot
    /// be discovered, and the ERC-8004 ecosystem it participates in assumes an open read.
    getEngramCard: () -> (AgentCard) query;
-   /// PUBLIC: the engram's permanent spawn ordinal — a provable, non-sensitive fact. It identifies a
-   /// canister, never a person.
-   /// null = spawned before numbering existed; the owner can backfill via syncEngramNumber().
-   getEngramNumber: () -> (opt nat) query;
    /// Re-pointed at `EvmIdentity` (B-2): custody derivation no longer routes through the ic402
    /// Gateway, which is leaving for the market canister. Behaviour is unchanged for a caller — same
    /// address, same tECDSA key — but the engram no longer needs a marketplace to know its own
@@ -1709,7 +1952,7 @@ type Engram =
    /// It refuses rather than half-answers: if either address cannot be derived the reply is
    /// `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
    /// failed derivation — that is fail-to-empty on a money surface, and it stops here).
-   getEvmAddress: () -> (Result_58);
+   getEvmAddress: () -> (Result_68);
    /// The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
    /// the address this canister derives for itself.
    /// 
@@ -1724,7 +1967,7 @@ type Engram =
    /// the management canister's `ecdsa_public_key`. A query cannot await, so the round-trip is the
    /// cost — stated here because L7 requires the reason be readable from the interface rather than
    /// inferred by opening the body.
-   getEvmSignerAddress: () -> (Result_43);
+   getEvmSignerAddress: () -> (Result_53);
    /// PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
    /// 
    /// The fourth of the four evidence methods (`getAuditHead`, `getCertifiedAuditHead`,
@@ -1733,7 +1976,7 @@ type Engram =
    /// cannot verify it, and nothing here identifies anybody.
    getGenesisNote: () -> (GenesisNote) query;
    /// A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
-   getGuardianAlertStatus: () -> (Result_57) query;
+   getGuardianAlertStatus: () -> (Result_67) query;
    /// The market this engram will accept signing requests from — `null` until the registry pushes
    /// one at spawn, which is why `requireMarket` refuses fleet-wide today.
    /// 
@@ -1763,7 +2006,7 @@ type Engram =
    /// never renumbered: the next page starts at the last version returned plus one. Defaults
    /// return the whole history of any file a pre-FD engram could have held.
    getMemoryHistory: (path: text, start: opt nat, max: opt nat) ->
-    (Result_56) query;
+    (Result_66) query;
    /// PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
    /// history would be a public, fleet-enumerable feed of when each owner terminated a trust
    /// relationship — readable by, among others, the party just terminated.
@@ -1804,7 +2047,7 @@ type Engram =
    /// Refusal reasons of both merge: an empty policy reads as "nothing is capped, every version kept
    /// forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
    /// "nothing is held back".
-   getMemoryRetentionPolicy: () -> (Result_55) query;
+   getMemoryRetentionPolicy: () -> (Result_65) query;
    /// The metrics reader this engram answers — `null` until the spawning registry names one.
    /// 
    /// PUBLIC: an owner deciding whether to switch the read off needs to know who it is, and anyone
@@ -1817,7 +2060,7 @@ type Engram =
    /// see: the only row it can ever return is the caller's own, so "you are not a guardian here" is
    /// a fact about the caller, told to the caller. There is nothing to leak by omission — which is
    /// the test the #NotFound arm sets.
-   getMyGuardianStatus: () -> (Result_15) query;
+   getMyGuardianStatus: () -> (Result_17) query;
    /// ⟨0.16.0, NEW⟩ The gated half of the status() split.
    /// 
    /// Every field is bare — no masking, no `authorized` discriminator — because reaching this record
@@ -1827,7 +2070,7 @@ type Engram =
    /// was `nat`, then widened to `opt nat` so a refusal could be `null`, which broke every published
    /// client (rule 4) and bought a masked answer nobody had asked for — the census could not even
    /// find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
-   getOwnerConsole: () -> (Result_54) query;
+   getOwnerConsole: () -> (Result_64) query;
    /// Owner + agents only (agents need it to avoid writing protected paths).
    /// 
    /// A NAMED RECORD, not a Page: the setter replaces this list wholesale, so there is no window to
@@ -1839,7 +2082,7 @@ type Engram =
    /// path on this engram is protected", and an agent consults this list precisely to avoid
    /// writing one — so a fabricated empty here does not merely misinform, it invites the write the
    /// list exists to prevent.
-   getProtectedPaths: () -> (Result_53) query;
+   getProtectedPaths: () -> (Result_63) query;
    /// Whether the metrics reader's read is answered — `true` from birth.
    /// 
    /// PUBLIC: the promise that an owner can switch this read off can be checked only if the switch
@@ -1848,7 +2091,10 @@ type Engram =
    /// Owner-only, Billing-class: the signing floor, the balance, one signature's price, and how many
    /// payment signatures the balance carries above the floor before `signX402Payment` is refused by
    /// name. The same numbers the check uses, so Billing can say only what the engram enforces.
-   getSigningFloor: () -> (Result_52) query;
+   /// ⟨2026-11-01, "6 fix"⟩ Refused by name (`#Unavailable`) while this engram has not read its own
+   /// freezing setting: there is no floor to serve then, and a 30-day figure would be a made-up one
+   /// (ADR-0002) — the signers refuse in that state too, so the refusal is the truth on Billing.
+   getSigningFloor: () -> (Result_62) query;
    /// The registry that spawned this engram, if it recorded one.
    /// 
    /// PUBLIC: it is the provenance claim. An engram asserting it is part of a fleet, under that
@@ -1865,7 +2111,7 @@ type Engram =
    /// configuration, and the engram-wide total would also tell one agent how much the others spent.
    /// A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
    /// "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
-   getSpendCeiling: () -> (Result_51) query;
+   getSpendCeiling: () -> (Result_61) query;
    /// Read the caps in force for a caller.
    /// 
    /// OWNER-ONLY, and this is where it diverges from the market's inbound twin, which is public.
@@ -1873,8 +2119,8 @@ type Engram =
    /// Here the engram serves no 402s at all: these caps are the owner's private custody
    /// configuration, and publishing them would tell any caller exactly how large a signing request
    /// can be before it needs an approval nobody is watching for.
-   getSpendPolicy: (caller: opt principal) -> (Result_50) query;
-   getStorageStats: () -> (Result_49) query;
+   getSpendPolicy: (caller: opt principal) -> (Result_60) query;
+   getStorageStats: () -> (Result_59) query;
    /// Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
    /// and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
    /// leaks nothing (booleans about our own scheduling).
@@ -1898,6 +2144,10 @@ type Engram =
    /// because a persistent actor re-runs its init body BEFORE postupgrade restores stable sessions,
    /// so a predicate-gated arm would skip exactly the canisters that have live ones. The first tick
    /// disarms it. Still true minutes after an upgrade is a real bug — report it upstream.
+   /// ⟨2026-10-07, beside the paragraph above⟩ The session sweep's interval is 300 seconds now (the
+   /// owner's decision of that day; set in the actor body), so "one interval" is up to five minutes,
+   /// and true five minutes after an upgrade is still expected. True ten minutes after, with no session
+   /// open, is the bug.
    /// NOT the whole timer story. The hourly CYCLE timer — which also carries audit anchoring — is
    /// deliberately absent: it is a `transient let` armed unconditionally at init, so an "armed"
    /// boolean for it would read true forever and tell you nothing, exactly the false-positive the
@@ -1907,6 +2157,18 @@ type Engram =
    /// PUBLIC: the same standing as the two liveness reads above. Booleans and timestamps about this
    /// canister's own timers — nothing about content, callers or money — and a liveness signal only
    /// its owner can read cannot tell a third party that the engram is still running.
+   /// ⟨2026-10-28, the owner's ruling "1"⟩ The three ic402 flags read FALSE WHILE THE TIMERS ARE PAUSED.
+   /// The pause's id sweep cancels ic402's sweeps, but ic402 keeps their stale ids, so its own
+   /// "armed" reads would answer true for a timer that no longer exists (a fabricated answer,
+   /// ADR-0002). `alertTimerArmed` needs no guard: the sweep nulls `alertTimerId` itself.
+   /// ⟨2026-10-29, the owner's ruling "A", beside the line above⟩ …the sweep zeroes the arm, and an arm
+   /// past its due time reads stale. `alertTimerArmed` is TRUE ONLY WHILE A DELIVERY IS OWED OR RETRYING
+   /// (the alert drain is a one-shot armed per owed delivery); alerts configured on a quiet engram read
+   /// false, and that is correct — the IDLE STEADY STATE line above now holds with a webhook set too.
+   /// It reads the arm's DUE TIME, not only its id (`ActionAlerts.armLive`): a job that traps before its
+   /// first await rolls back its own `alertTimerId := null`, so a bare id would read armed forever.
+   /// ONE BOUNDED UNTRUTH (the spec's critic, F12): for ARM_STALE_NS (120 s) after the due time of such a
+   /// trapped job, the flag reads true although no timer exists.
    getTimerHealth: () -> (TimerHealth) query;
    /// PUBLIC: a cap identifies no user, and a caller deserves to know the rule before it stops them.
    /// 
@@ -1941,12 +2203,12 @@ type Engram =
    /// ⟨L7⟩ MARKER ADDED 2026-08-23, reasoning above UNCHANGED — this block already said "Stays an
    /// UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
    /// to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
-   getWalletBalances: () -> (Result_48);
+   getWalletBalances: () -> (Result_58);
    /// Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
    /// read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
    /// engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
    /// fabrication is indistinguishable from the truth by construction.
-   getWorldIdConfig: () -> (Result_47) query;
+   getWorldIdConfig: () -> (Result_57) query;
    /// ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
    /// `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
    /// query can do none of them.
@@ -1955,7 +2217,7 @@ type Engram =
    /// Valid iff the derived signer address (getWorldIdRpSignerAddress) is registered for this rp_id in
    /// the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
    /// it authorizes opening one verification request, nothing else.
-   getWorldIdRpContext: () -> (Result_46);
+   getWorldIdRpContext: () -> (Result_56);
    /// Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
    /// "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
    /// Portal — the engram never holds or exports a private key (only threshold shares exist, on the
@@ -1965,7 +2227,7 @@ type Engram =
    /// awaits `worldIdRpPublicKey()` (management `ecdsa_public_key`), and it calls `denied()` on
    /// refusal — a state write, which a query cannot perform. So even if the key were cached this
    /// could not become a query without silently retiring its denial record (ADR-0002's class).
-   getWorldIdRpSignerAddress: () -> (Result_43);
+   getWorldIdRpSignerAddress: () -> (Result_53);
    /// The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
    /// artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
    /// `Result<opt Text>` — and the double wrapper is the entire point, not redundancy.
@@ -1984,13 +2246,13 @@ type Engram =
    /// `///`, so the dead name was PUBLISHED in engram.did and pointed every client at a method the
    /// canister does not serve. The tombstones below and at `about()` are historical and correct as
    /// written; this one was present tense, which is the difference that matters.⟩
-   getWorldIdVerification: () -> (Result_45) query;
+   getWorldIdVerification: () -> (Result_55) query;
    /// ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
    /// absence of a `#Conflict` here is the point: these are the calls someone makes while something
    /// is going wrong, and the only two answers that help are "you may not do this" and "there is
    /// nothing by that name". A missing PERMISSION is `#Refused` rather than `#Conflict` — the
    /// guardian's standing is what fell short, and no change to engram state would let them through.
-   guardianRevokeAgent: (agentPrincipal: principal) -> (Result_1);
+   guardianRevokeAgent: (agentPrincipal: principal) -> (Result_2);
    /// The HTTP surface: canister-info JSON, OAuth discovery documents, and the MCP route's query
    /// half. See the `http_request_update` twin below for what upgrades and why.
    /// 
@@ -2059,7 +2321,7 @@ type Engram =
    /// 
    /// Owner-gated because it reports on custody posture, and answered as a Result so that a
    /// wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
-   isEvmAddressCached: () -> (Result_44) query;
+   isEvmAddressCached: () -> (Result_54) query;
    /// Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
    /// (an `/auth/connector`-style route) after II authentication. The client then
    /// redirects the user's browser to `redirectUri` with `?code=<this>` so the
@@ -2067,7 +2329,7 @@ type Engram =
    /// 
    /// Owner-only: only the engram owner can authorize a Connector install.
    issueAuthCode: (redirectUri: text, scope: text, codeChallenge: text,
-    clientId: opt text) -> (Result_43);
+    clientId: opt text) -> (Result_53);
    /// ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
    /// ROW. A single label for a whole ring misattributes every row recorded under the other source,
    /// and the source flips by design (self-call first, balance on fallback). Its documentation of
@@ -2081,7 +2343,24 @@ type Engram =
    /// Refusal reason preserved, and it is the sharpest of this family: a masked `[]` reads as a
    /// DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
    /// reader, it feeds a wrong number into a decision about destroying data.
-   listActivitySnapshots: (start: nat, limit: nat) -> (Result_42) query;
+   listActivitySnapshots: (start: nat, limit: nat) -> (Result_52) query;
+   /// ⟨2026-10-21, round 11 item l — the owner's answer "round 11: a, b, c, d, e, f, g, h, i, j, k, l,
+   /// m."⟩ OWNER-ONLY: what each agent has spent today, beside the daily limit in force for it, so the
+   /// agent rows can say "$0.50 of $5.00 today" where they said a count of payments. Read from the
+   /// state the payment path already keeps — `outboundSpendToday`, through `SpendCeiling.callerSpentOn`
+   /// (the reader `x402SignFor` uses) — and the limits from `gate.getPolicy(<the agent's key>)`, the
+   /// policy `x402SignFor` checks, on the UTC day it checks (`SpendCeiling.dayIndex`). Amounts are the
+   /// token's minor units, as the record's `amount=` writes them. No new state.
+   /// 
+   /// OWNER-ONLY for `getSpendCeiling`'s reason: one agent's spending is the owner's custody
+   /// information, and would tell another agent how much it spent. Everyone else — an agent, a
+   /// guardian, a stranger, the anonymous caller — is refused by name (`#Refused
+   /// listAgentSpendToday: …`), never answered with zeros. Paged like `listAgents`, in its order, one
+   /// row per agent record; a row's `spentToday` is null, not 0, where no daily limit is in force,
+   /// because the payment path keeps no figure then (`SpendCeiling.AgentSpendRow` says why).
+   /// WHAT WOULD MAKE THIS WRONG: `x402SignFor` keeping the per-caller total by something other than
+   /// the calling key, or under another day boundary.
+   listAgentSpendToday: (start: nat, limit: nat) -> (Result_51) query;
    /// ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
    /// 
    /// The refusal prose that used to be `gatedTrap`'s `whyNotEmpty` argument is not lost — it is why
@@ -2096,7 +2375,7 @@ type Engram =
    /// 
    /// `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
    /// A method that filters rows by caller sets it — see L1's row-level honesty rule.
-   listAgents: (start: nat, limit: nat) -> (Result_41) query;
+   listAgents: (start: nat, limit: nat) -> (Result_50) query;
    /// The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
    /// 
    /// Two audiences, two methods (L1/L8), rather than one method masking fields by caller: a
@@ -2108,7 +2387,7 @@ type Engram =
    /// Refusal reason preserved: `[]` reads as "this engram has no agents", and this is the list a
    /// guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
    /// it tells someone acting under emergency powers that there is nothing to act on.
-   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_40) query;
+   listAgentsForGuardian: (start: nat, limit: nat) -> (Result_49) query;
    /// Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
    /// 
    /// The optional leading filter SURVIVES the L3 reshape — ratified (census tier-2 #8) rather than
@@ -2121,7 +2400,7 @@ type Engram =
    /// 
    /// Refusal reason preserved: `[]` reads as "nothing is awaiting the owner's decision".
    listApprovalRequests: (statusFilter: opt ApprovalStatus, start: nat,
-    limit: nat) -> (Result_28) query;
+    limit: nat) -> (Result_35) query;
    /// ⟨0.16.0⟩ `total` IS THE HEAD COUNTER, and on this method that is the entire point.
    /// 
    /// The audit log is a bounded RING: it trims its tail, so "rows you can read" and "entries that
@@ -2141,7 +2420,21 @@ type Engram =
    /// For the owner and a guardian `withheld` is 0 and the page is the span. WHAT WOULD MAKE THIS
    /// WRONG: a reader who must see the whole record without being the owner or a guardian — the
    /// public certified head is the answer for integrity, and nothing else is.
-   listAuditEntries: (start: nat, limit: nat) -> (Result_23) query;
+   /// 
+   /// ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ PUBLIC NOW, AND THE COUNT BECAME ROWS. The
+   /// reply is a `Wire.RecordPage`: every entry in the span the reader may not see in full comes back
+   /// as a hash-only row in `sealed` (id, SHA-256 of its body, entry hash) instead of being counted in
+   /// `withheld`, so `items.size() + sealed.size()` is the span examined. Each entry is hashed first,
+   /// then chained (`AuditLog`), so those rows are enough to walk from any entry to the certified
+   /// head — which is what lets a stranger check one entry without the owner. A caller with no role,
+   /// the anonymous caller included, is a stranger (`RecordView.readerFrom`) and gets only sealed
+   /// rows; the owner and guardians still see every entry, an agent its own. Nothing here refuses,
+   /// so the read's former refusal ("Anonymous caller not allowed") is gone from it.
+   /// `ringFloor` says where the ring starts — a `start` below it begins at it — and `hashFirstFrom`
+   /// where this record switched to the hash-first rule. A sealed row costs one SHA-256 of its body
+   /// at read time; nothing new is stored. WHAT WOULD MAKE THIS WRONG: a sealed row carrying any part
+   /// of a body, or a stranger reaching `items` (test/record-view.test.mo pins both).
+   listAuditEntries: (start: nat, limit: nat) -> (Result_48) query;
    /// ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
    /// 
    /// This method used to answer THREE ways to one question: a list, an `#Err` text, and a trap,
@@ -2165,7 +2458,7 @@ type Engram =
    /// `dbTypeFilter` DIES on the wire (census). The capability does not: `EngramClient.listBackups`
    /// keeps its optional filter and applies it to the page, so no caller loses the ability to ask
    /// "backups of this database" — it stops being a thing the canister has to page around.
-   listBackups: (start: nat, limit: nat) -> (Result_39) query;
+   listBackups: (start: nat, limit: nat) -> (Result_47) query;
    /// List all bearer tokens — Active, Revoked, and Expired. Owner uses this in
    /// the dashboard to show installed Connectors (claude.ai, Claude Desktop, etc.).
    /// Refusal reason preserved from the trap: `[]` reads as "no connector is installed on this
@@ -2175,7 +2468,7 @@ type Engram =
    /// `bearerTokenStore.list()` already resolves each token's status at read time (a token that
    /// merely stopped being used is reported `#Expired`, not a stale `#Active`), so the page carries
    /// the same honesty the store gained on 2026-08-17.
-   listBearerTokens: (start: nat, limit: nat) -> (Result_38) query;
+   listBearerTokens: (start: nat, limit: nat) -> (Result_46) query;
    /// The condense checkpoints in the retained log at or above `startSeq`, oldest first.
    /// 
    /// ⟨0.16.0, NEW⟩ The other half of the split above. A checkpoint is the only surviving record of a
@@ -2185,25 +2478,18 @@ type Engram =
    /// 
    /// Owner-only like every other archive surface, and for the same structural reason: these rows
    /// carry the chain positions and roots of entries whose paths were inside the hash preimage.
-   listCondenseCheckpoints: (startSeq: nat, max: nat) -> (Result_37) query;
+   listCondenseCheckpoints: (startSeq: nat, max: nat) -> (Result_45) query;
    /// ⟨0.16.0⟩ `metrics()` DELETED — absorbed by `about()`.
    /// 
    /// Two public projections of one canister (L2.2): `metrics()` and `status()` both answered "what
    /// is this engram like" and disagreed on which counters they carried, so a consumer had to fetch
    /// both and know which one owned each field. Every field here survives on `about()`, day-flooring
    /// included.
-   listCycleSnapshots: (start: nat, limit: nat) -> (Result_36) query;
+   listCycleSnapshots: (start: nat, limit: nat) -> (Result_44) query;
    /// Same `withheld` treatment as listMemoryFiles — the tombstone listing filtered reserved paths
    /// for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
    /// complete one. Counted before slicing, so policy-hidden rows never blur into paging.
-   listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_35) query;
-   /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
-   /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
-   /// 
-   /// Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
-   /// AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
-   /// registration remains the audit chain under getCertifiedAuditHead.
-   listEip712Types: (start: nat, limit: nat) -> (Result_34) query;
+   listDeletedMemoryFiles: (start: nat, limit: nat) -> (Result_43) query;
    /// Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
    /// 
    /// NAMED item, not a `(Text, Int)` tuple. The Int is an activation time, and a bare Int beside a
@@ -2212,14 +2498,37 @@ type Engram =
    /// Refusal reason preserved, and it has two halves that matter separately: `[]` reads as "this
    /// engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
    /// opposite security posture. It also erases any pending 24h activation from view.
-   listEvmWithdrawDestinations: (start: nat, limit: nat) -> (Result_33) query;
+   /// 
+   /// ⟨2026-10-14, 4A⟩ One action's list: `typeId` names the action, and an unregistered one is
+   /// `#NotFound` rather than an empty page (an empty page means "this action may sign to nothing").
+   /// The item's field is `value`, not `address`: a list may hold a venue value that is no address.
+   /// Readable by the owner, an active agent or an active guardian, as the old list was.
+   listEip712Destinations: (typeId: blob, start: nat, limit: nat) ->
+    (Result_42) query;
+   /// The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
+   /// Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
+   /// 
+   /// Refusal reason preserved: `[]` reads as "this engram can sign nothing" — a claim about SIGNING
+   /// AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
+   /// registration remains the audit chain under getCertifiedAuditHead.
+   /// 
+   /// ⟨2026-10-14, the owner's ruling 3A⟩ Each row carries its per-field rules (`fieldRules`), joined in
+   /// from `eip712FieldRules` — they are part of what the type authorises, so a reader of the list must
+   /// not have to make a second call to learn them. The row type is `Eip712TypeView`.
+   listEip712Types: (start: nat, limit: nat) -> (Result_41) query;
+   /// ⟨2026-10-21, round 11 c⟩ Guardians' disputes, oldest first. Same visibility as
+   /// `listRepudiations` and `listRecordNotes`: the owner and ACTIVE guardians read the rows; an
+   /// agent gets an empty page whose `withheld` counts them (ruling 16 B holds — a dispute is the
+   /// guardian's entry, not the agent's); a stranger, a pending guardian and the anonymous caller are
+   /// refused.
+   listGuardianDisputes: (start: nat, limit: nat) -> (Result_40) query;
    /// Accessible by owner and guardians.
    /// 
    /// Refusal reason carried over from the trap, because it is the sharpest example of why this
    /// surface may not fail soft: `[]` reads as "this engram has nobody who can freeze payments or
    /// pause writes" — a claim about who can STOP it. A caller who cannot tell that from "you may not
    /// see the roster" has been told the engram is unguarded when it may be fully guarded.
-   listGuardians: (start: nat, limit: nat) -> (Result_32) query;
+   listGuardians: (start: nat, limit: nat) -> (Result_39) query;
    /// The export receipts in the retained log at or above `startSeq`, oldest first.
    /// 
    /// ⟨0.16.0, L3⟩ ONE LIST, ONE QUESTION. This method used to return receipts AND checkpoints
@@ -2235,7 +2544,7 @@ type Engram =
    /// 
    /// Read `MemoryRouter.ReceiptPage` before reading `page.total` as a receipt count. It is not one;
    /// it is the chain's length, and the declaration says why.
-   listMemoryExportReceipts: (startSeq: nat, max: nat) -> (Result_31) query;
+   listMemoryExportReceipts: (startSeq: nat, max: nat) -> (Result_38) query;
    /// ⟨0.16.0⟩ THE `withheld` EXEMPLAR — L1 names this exact method as the defect it fixes.
    /// 
    /// A non-owner's answer silently dropped every `config/` and `secrets/` row. Not "refused the
@@ -2251,7 +2560,16 @@ type Engram =
    /// Note the count is computed from the unfiltered list before slicing, so it reports rows hidden
    /// by POLICY, never rows merely off the end of this page — those are `total`'s job. Conflating
    /// the two would rebuild the ambiguity in a new place.
-   listMemoryFiles: (start: nat, limit: nat) -> (Result_30) query;
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answer k: an author on every file row⟩ Each row also
+   /// carries `lastModifiedBy` (`Types.MemoryFileRow`): the key that wrote the file's current
+   /// version, so a phone's file list can say "changed 2 h ago by Recorder" without a read per
+   /// file. It is what `readMemory` already serves to the same callers under the same gate, so it
+   /// tells no caller anything it could not read. Born `opt` (ADR-0018 rule 1). Looked up only for
+   /// the rows of THIS page (`MemoryRouter.info`), after the slice, so the cost is one lookup per
+   /// row served, never one per file stored. A WIDENED REPLY: a reader that decodes the row by
+   /// position rather than by field name breaks — none in this repository does.
+   listMemoryFiles: (start: nat, limit: nat) -> (Result_37) query;
    /// One page of the memory log, seq-ordered, optionally narrowed to one author.
    /// 
    /// THE WINDOW IS THE CURSOR, and the page now states it. The window is
@@ -2277,7 +2595,7 @@ type Engram =
    /// with the disclosures that make the page verifiable — the hidden-bound defect the census itself
    /// names on previewCondense's row.
    listMemoryLog: (startSeq: nat, max: nat, authorFilter: opt principal) ->
-    (Result_29) query;
+    (Result_36) query;
    /// The caller's OWN spend-approval requests. ⟨0.16.0, L1 + L3 — fixed 2026-08-18⟩
    /// 
    /// Two defects in seven lines, and the first is the one this release exists to remove:
@@ -2294,7 +2612,7 @@ type Engram =
    /// to see, so `total` over their own rows is the honest count and nothing is hidden FROM them.
    /// (The unbounded MAP is filed separately — pruning an approval record destroys evidence of what
    /// was asked, which is a retention ruling rather than a shape fix.)
-   listMyApprovalRequests: (start: nat, limit: nat) -> (Result_28) query;
+   listMyApprovalRequests: (start: nat, limit: nat) -> (Result_35) query;
    /// The payer's own sessions, live ones first. PAYER-SCOPED: a caller sees only their own, which
    /// is why this needs no role — a session id is not a secret from the person who paid for it.
    /// 
@@ -2303,7 +2621,7 @@ type Engram =
    /// It took no arguments, and a cursor added after the freeze is an argument-list change every
    /// client would break on — the market paged its own pending withdrawals before its cut for the
    /// same reason. The order is the order sessions were opened.
-   listMySessions: (start: nat, limit: nat) -> (Result_27) query;
+   listMySessions: (start: nat, limit: nat) -> (Result_34) query;
    /// 
    /// ⟨0.16.0, L3⟩ Paged and enveloped like every other `list*`, and the envelope here is uniformity
    /// rather than gating: this method cannot refuse anybody, so `#Err` is unreachable on it. That is
@@ -2316,7 +2634,7 @@ type Engram =
    /// asked by strangers. `verifyEngramActiveOwner` on the registry answers only about the owner
    /// IT recorded, so this chain is what a caller composes with when currency matters — which it
    /// cannot do if it needs a role here.
-   listOwnershipTransfers: (start: nat, limit: nat) -> (Result_26) query;
+   listOwnershipTransfers: (start: nat, limit: nat) -> (Result_33) query;
    /// ⟨2026-09-29, the platform's question from the build review⟩ OWNER-ONLY: how many payment
    /// signatures each agent has obtained today, and the daily limit (200, `PaymentSignCap`). The
    /// owner's console stated the rule and showed no number, because nothing served one; a number it
@@ -2332,7 +2650,7 @@ type Engram =
    /// marketplace's one shared count today is in the reply's `marketplace` field, with the limit this
    /// engram enforces for it — beside the agents, never a row among them
    /// (`PaymentSignCap.marketplaceRow`). Null when no marketplace is set.
-   listPaymentSignatureCounts: (start: nat, limit: nat) -> (Result_25) query;
+   listPaymentSignatureCounts: (start: nat, limit: nat) -> (Result_32) query;
    /// Agent records removed by a reset. Each row is a NAMED record with the fields `principal`,
    /// `name`, `registeredAt` and `purgedAt` — read them BY NAME, never by position.
    /// ⟨2026-09-29, the vocabulary ruling: pairing is the one verb that admits an agent⟩ The field
@@ -2372,7 +2690,7 @@ type Engram =
    /// `invite` its enrolment named, and `ended` — why and on what day its engagement ended (its own
    /// earlier ending, or the reset) — the facts `resyncAgentEdges` re-sends. The stored rows are
    /// served as they are.
-   listPurgedAgents: (start: nat, limit: nat) -> (Result_24) query;
+   listPurgedAgents: (start: nat, limit: nat) -> (Result_31) query;
    /// ⟨0.16.0⟩ ONE ACCESSOR, folding `readReadLog` and `getDenialLog` — and the fold only became
    /// safe because of a change made earlier in this same leg.
    /// 
@@ -2434,7 +2752,13 @@ type Engram =
    /// on the chained record — the same `RecordView` filter, and `withheld` counts what it removed
    /// together with what `successFilter` removed. WHAT WOULD MAKE THIS WRONG: see `listAuditEntries`.
    listReadLog: (successFilter: opt bool, start: nat, limit: nat) ->
-    (Result_23) query;
+    (Result_30) query;
+   /// ⟨2026-10-21, round 11 b⟩ The owner's notes, oldest first. Same visibility as
+   /// `listRepudiations`, for the same reason: the owner and ACTIVE guardians read the rows; an agent
+   /// reads only the entries it caused (follow-up 16 B), and every note is the owner's, so an agent
+   /// gets an empty page whose `withheld` counts the notes in its window — never "there are none". A
+   /// stranger, a pending guardian and the anonymous caller are refused.
+   listRecordNotes: (start: nat, limit: nat) -> (Result_29) query;
    /// Same visibility as listAuditEntries: the owner, this engram's agents, and ACTIVE guardians
    /// see disputes. An unauthorized read REFUSES — it does not return an empty list, because an
    /// empty list reads as "no disputes have been filed", which is a claim, not an absence of one.
@@ -2449,7 +2773,16 @@ type Engram =
    /// window — which says disputes exist without showing them, never "none have been filed". WHAT
    /// WOULD MAKE THIS WRONG: a ruling that an agent may see the disputes of its own writes; this would
    /// then have to look up each disputed version's writer, which it does not do today.
-   listRepudiations: (start: nat, limit: nat) -> (Result_22) query;
+   listRepudiations: (start: nat, limit: nat) -> (Result_28) query;
+   /// ⟨2026-10-21, the owner's round-11 answer f⟩ OWNER-ONLY: the sign-ins, each with the name its app
+   /// registered. The same tokens, in the same order and paged the same way, as `listBearerTokens`,
+   /// each beside `clientName` — the RFC 7591 `client_name` the app registered when the token was
+   /// issued (`People.SignIn` says when it is null, and that it is the app's own claim). A phone
+   /// owner read "localhost" for every app signed in through a local bridge and could not tell two
+   /// apps apart. A NEW method rather than a field on `BearerToken`: that record is stored (M0170)
+   /// and `listBearerTokens`' reply is shipped (never widened). An agent, a guardian, a stranger and
+   /// the anonymous caller are refused, by `listBearerTokens`' own gate and for its reason.
+   listSignIns: (start: nat, limit: nat) -> (Result_27) query;
    /// Owner: advance the review cursor — "I have seen everything up to and including uptoAuditId"
    /// (null = everything at the current head). Bounded so the attestation can never cover entries
    /// the console did not render; clamped monotonic (the cursor never moves backward) and to the
@@ -2459,13 +2792,31 @@ type Engram =
    /// (every family qualifiesForReview admits is written to auditLogger, so they share that space),
    /// and this never inspects an operation or a role. Widening what the review shows therefore
    /// changes only which ids the console can pass here — it cannot desynchronise the cursor.
-   markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_8);
+   markAgentWritesReviewed: (uptoAuditId: opt nat) -> (Result_14);
+   /// ⟨2026-10-21, the owner's round-11 answer g⟩ AN AGENT READS ITS OWN GRANT — to the calling key
+   /// only (`People.AgentGrant`): what it may read, where it may write, its rate, and the payment
+   /// limits enforced against that key. It reveals nothing a refusal does not already say, and lets
+   /// an agent correct itself before it writes rather than after the owner explains a refusal by
+   /// hand. `getSpendPolicy` and `listAgents` stay owner-only; this answers one row, the caller's.
+   /// 
+   /// WHO: an ACTIVE agent (`Gated.authorize(#agentOrOwner)`). Refused, each by its own text: the
+   /// owner by name (`People.OWNER_HAS_NO_GRANT`), a revoked or resigned agent ("Agent is revoked" /
+   /// "Agent has resigned" — an ended agent may do nothing, and its old grant would read as powers),
+   /// a guardian and a stranger ("Not authorized"), the anonymous caller. A query: it writes nothing.
+   /// 
+   /// ⟨2026-10-29, the owner's ruling "b: fix"⟩ It also says whether the payments brake is on and what
+   /// the key could pay now (`paymentsFrozen`, `paymentsNow`), read from the values `x402SignFor`
+   /// checks — the brake, the key's policy and stored total, the engram-wide ceiling and total — so
+   /// the caps alone no longer read as money an agent can spend. `People.SpendState` names each one.
+   /// ⟨2026-10-29, review F2⟩ And which whole-key refusal stops every payment now, if one does
+   /// (`paymentsStoppedBy`: the brake, the signing floor, the daily count of payment signatures).
+   myGrant: () -> (Result_26) query;
    /// The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
    /// key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
    /// nomination per agent — a new one replaces the earlier one, and the record says which. Refused,
    /// with nothing changed, for a caller that is not an active agent here and for a key that could
    /// not hold the record (`KeyReplacement.nomineeRefusal`).
-   nominateAgentKey: (newKey: principal) -> (Result_1);
+   nominateAgentKey: (newKey: principal) -> (Result_2);
    /// An AGENT paired here asks this engram to open an engram of its own. This engram attaches 1.3 T of
    /// its own cycles to the registry's `sysSpawnChild`; the agent's lasting key owns what is opened, and
    /// the engram is recorded as opened through this one. Answers the new engram's canister id.
@@ -2494,15 +2845,15 @@ type Engram =
    /// 
    /// WHAT WOULD MAKE THIS WRONG: an await added between `ChildAllowance.take` and the registry call; the
    /// registry's `CHILD_MIN_ATTACHED_CYCLES` moving without `CHILD_ATTACH_CYCLES`.
-   openChildEngram: () -> (Result_21);
-   openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_20);
+   openChildEngram: () -> (Result_25);
+   openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_24);
    /// Withdraw tokens to the owner's principal. This is the ONLY way to
    /// move tokens out of the engram to an external address, and the
    /// destination is always hardcoded to the owner.
    /// NOT freeze-gated: the owner always controls their own funds.
    /// Guardian freeze only blocks agent/public operations.
    ownerWithdraw: (amount: TokenAmount, ownerAuth: opt ActionAuth) ->
-    (Result_8);
+    (Result_14);
    /// ⟨0.16.0⟩ `payRentFromEarnings` DELETED — ruled TWICE (B1 and B2), and it was the single
    /// clearest violation of the OSS/platform split in this repo.
    /// 
@@ -2560,10 +2911,13 @@ type Engram =
    pairAgent: (arg: record {
                       code: text;
                       enrolment: Enrolment;
-                    }) -> (Result_19);
+                    }) -> (Result_23);
    /// ⟨0.16.0, L2.2 — renamed from `guardianPauseWrites`⟩ Same correction as freezePayments above:
    /// owner-or-guardian, and `resumeWrites` never carried the prefix either.
-   pauseWrites: () -> (Result_1);
+   pauseWrites: () -> (Result_2);
+   /// ⟨2026-10-21, the owner's round-11 answer d⟩ `pauseWrites` with a reason; everything said of
+   /// `freezePaymentsWithReason` holds, with `canPauseWrites` as the guardian's grant.
+   pauseWritesWithReason: (reason: text) -> (Result_2);
    /// What condensing through `toSeq` would do, and whether it is unlocked. COMMITS NOTHING — it is
    /// a query, so it structurally cannot; a preview that wrote would be its own trap.
    /// 
@@ -2582,7 +2936,7 @@ type Engram =
    /// 
    /// `unlocked` is the export-receipt gate ONLY. It is not a promise the condense will land: the
    /// history-budget delta is checked at commit time and can still refuse a short prefix.
-   previewCondense: (toSeq: nat) -> (Result_18) query;
+   previewCondense: (toSeq: nat) -> (Result_22) query;
    /// A quote for a session this caller has not opened and is not committed to — the intent a
    /// buyer signs against. Pure dry run, no state, no funds.
    /// 
@@ -2610,6 +2964,27 @@ type Engram =
    /// ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
    /// `expiryNs`. Same value, same meaning; only the name carries the unit now.
    previewOpenSession: () -> (SessionIntent) query;
+   /// ⟨2026-10-21, the owner's round-11 answer k: a trim preview⟩ What a PROPOSED history policy
+   /// would remove from the store as it stands — "about N old copies in F files would be removed" —
+   /// asked BEFORE the owner saves it. A query: nothing is saved, armed or evicted.
+   /// 
+   /// WHO: the OWNER only (`#ownerOnly`). An agent, a guardian, a stranger and the anonymous caller
+   /// are each refused with `requireOwner`'s words; the setter it previews is owner-only too.
+   /// 
+   /// HOW: the proposal must pass the setter's own checks (`retentionEntriesRefusal`), so the preview
+   /// never answers for a policy the setter would refuse. The guards a save would arm are computed
+   /// exactly as the setter computes them (`RetentionPolicy.armGuards`), and each file is planned by
+   /// the planner the sweep executes (`MemoryRouter.previewEviction` → `Retention.plan`), as the
+   /// owner (the sweep's `maintainPrincipal`), AT THE INSTANT its guard lets go — so a rule that
+   /// waits 14 days is counted as it will stand then, when the agent floor has released more. Per
+   /// rule: copies, files, bytes and `notBeforeNs`. The count is "about": writes before the rule
+   /// takes effect change it.
+   /// HONEST WHEN CUT SHORT: `complete = false` when the planning budget
+   /// (`MemoryRouter.PREVIEW_MAX_DROPS`) ran out — the totals are then a floor, and say so.
+   previewRetention: (entries: vec record {
+                                     text;
+                                     RetentionClassSpec;
+                                   }) -> (Result_21) query;
    /// Read one memory file at its current version.
    /// 
    /// Gated on the `read_memory` permission, so an agent holding that grant reaches it — unlike
@@ -2624,7 +2999,7 @@ type Engram =
    /// counter here could never persist; read counting lives on the update path
    /// (`sessionReadContext` and the MCP reads). A caller measuring engram usage from this method
    /// will measure nothing.
-   readMemory: (path: text) -> (Result_11) query;
+   readMemory: (path: text) -> (Result_12) query;
    /// Read many paths in one call. Per-path Results are KEPT — partial success is the point, and
    /// one unreadable path must not fail the other nine.
    /// 
@@ -2640,7 +3015,7 @@ type Engram =
    /// Both are now what they are: a single `#Err` for the whole call. `#Ok` still carries a row per
    /// path, each with its own Result — a refused RESERVED path sits beside a readable one, which is
    /// a genuine per-path fact.
-   readMemoryBatch: (paths: vec text) -> (Result_17) query;
+   readMemoryBatch: (paths: vec text) -> (Result_20) query;
    /// ⟨0.16.0⟩ `getMemoryRetentionGuards` DELETED — folded into `getMemoryRetentionPolicy` above.
    /// It was the second L2.1 array-returning `get*`, and separating it from the policy it modifies
    /// was the defect described there. Its own docs are preserved at the fold site.
@@ -2651,7 +3026,7 @@ type Engram =
    /// see it cannot know whether it has the whole range, which is how silent truncation gets
    /// reintroduced. Loop while `more` is true, advancing by the bytes actually returned.
    readMemoryBytes: (path: text, offset: nat, len: nat, version: opt nat) ->
-    (Result_16) query;
+    (Result_19) query;
    /// The escrow exit for a session whose settle cannot pay.
    /// 
    /// PAYER-ONLY, enforced inside the gateway, and deliberately not owner-triggered: the payer's own
@@ -2706,7 +3081,15 @@ type Engram =
    /// the transfer pays its own fee from the escrow. A session still reads `closing` only when its
    /// close trapped after one of its awaits, or an earlier version left it there, and of that one the
    /// line above still holds.
-   recoverEscrow: (sessionId: text, amountE6: nat) -> (Result_8);
+   /// 
+   /// ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amountE6` is
+   /// the ckUSDC base units transferred to the payer's own account (the amount asked, capped at the
+   /// session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+   /// `blockIndex` is the ledger block of that transfer. Until this date it answered a bare `nat` that
+   /// was the block index alone, which read as the amount. If the session's record is removed before
+   /// the amount can be read back — a session closed in the same moment as the recovery and cleaned up
+   /// during its transfer — it answers `#Other` naming the block, never a guessed amount.
+   recoverEscrow: (sessionId: text, amountE6: nat) -> (Result_18);
    /// ⟨0.16.0, L1⟩ A REDEMPTION PATH, where the arm choice is a disclosure decision.
    /// 
    /// Four of these refusals are about the CODE and one is about the caller. The code arms restate
@@ -2720,13 +3103,16 @@ type Engram =
    /// rather than `()`. The new guardian learns, in the same reply, the name and permissions the
    /// owner's invite gave them and that they cannot act until approved; before, that took a second
    /// read they had no reason to know to make.
-   registerGuardian: (code: text) -> (Result_15);
+   registerGuardian: (code: text) -> (Result_17);
    /// Remove a per-caller override so that caller reverts to — and keeps TRACKING — the global caps.
    /// 
    /// It travels with its pair and is never dropped alone: without it the only way "back" from an
    /// override is to overwrite it with a frozen copy of the global policy, which then stops
    /// following later changes. That makes every override permanent in effect.
-   removeCallerSpendPolicy: (caller: principal) -> (Result_1);
+   removeCallerSpendPolicy: (caller: principal) -> (Result_2);
+   /// ⟨2026-10-14, 4A⟩ Remove a destination from one action's list. Instant, and NOT freeze-gated:
+   /// removal TIGHTENS, and a frozen engram must still be able to shrink what it could sign to.
+   removeEip712Destination: (typeId: blob, value: text) -> (Result_2);
    /// De-register a type that has NEVER SIGNED. Exists because of a hazard the first external
    /// validation found within hours (consumer report, 2026-08-06): a bare-name #standard registration —
    /// cheap, no watcher preconditions — permanently blocked the guarded namespaced registration
@@ -2736,8 +3122,9 @@ type Engram =
    /// removes only authority that was never exercised, which is removing nothing but the mistake.
    /// NOT freeze-gated, same reasoning as removeEvmWithdrawDestination: this is TIGHTENING, and a
    /// frozen engram must still be able to shrink what it could sign.
-   removeEip712Type: (typeId: blob) -> (Result_1);
-   removeEvmWithdrawDestination: (dest: text) -> (Result_1);
+   /// ⟨2026-10-14⟩ `removeEvmWithdrawDestination` is now `removeEip712Destination` (ruling 4A); same
+   /// reasoning. Removing a type now also drops its rules and its own destination list.
+   removeEip712Type: (typeId: blob) -> (Result_2);
    /// Owner-only: remove a guardian from the roster.
    /// 
    /// Unlike revoking an agent this is NOT terminal for the principal — the guardian roster does
@@ -2746,12 +3133,23 @@ type Engram =
    /// 
    /// `#NotFound` rather than `#Refused` when there is no such guardian: only the owner reaches this
    /// line, so the roster is theirs and its contents are not a secret being withheld from them.
-   removeGuardian: (guardianPrincipal: principal) -> (Result_1);
+   removeGuardian: (guardianPrincipal: principal) -> (Result_2);
+   /// ⟨2026-10-21, the owner's round-11 answer a⟩ OWNER-ONLY: give an agent a new name. A name was
+   /// fixed at the invite, and two agents both called "agent" is how the 2026-10-20 session started.
+   /// Only the VALUE of the stored `AgentRecord.name` changes — no new state, no reshaped record —
+   /// and the change is on the record as `agent.rename` (`principal=<key> name=<new name>`, the name
+   /// last). An ended agent may be renamed too (`People.renameTarget` says why).
+   /// Refused: an agent (itself included), a guardian and a stranger by `requireOwner`'s "Not owner",
+   /// the anonymous caller by its own text; a name that is empty, over `MAX_NAME_LENGTH` or holds a
+   /// line break is `#Invalid` (`People.nameRefusal`); an unknown key is `#NotFound`; the agent's
+   /// current name is `#Conflict`. Nothing changes on any refusal. Not alerted: the owner is the one
+   /// renaming (`ActionAlerts.classify` answers null for `agent.rename`).
+   renameAgent: (agentPrincipal: principal, name: text) -> (Result_2);
    /// Owner disavows a specific memory write, in the open. Marks — never deletes: the content and
    /// the original audit entry stay exactly where they were; this appends a chained
    /// `memory.repudiate` entry and lists the (path, version) so readers can see the dispute.
    repudiateMemoryWrite: (path: text, version: nat, reason: text) ->
-    (Result_8);
+    (Result_14);
    /// ⚠ OWNER-ONLY BULK RESET. Destructive, and wider than its name suggests.
    /// 
    /// It severs EVERY grant surface that can outlive a role — agents, guardians, invites and
@@ -2779,7 +3177,7 @@ type Engram =
    /// NOT unbounded. It caps at MAX_ENTRIES and trims its oldest tenth on overflow, so on any engram
    /// long-lived enough for the rent model to apply, the reset entry is not guaranteed to still be
    /// there. `agentPurgeLog` is the evidence that does not age out — which is why it exists.
-   resetEngram: () -> (Result_14);
+   resetEngram: () -> (Result_16);
    /// ⟨2026-09-28, owner decision: an agent can resign from an engram, and the resignation is
    /// recorded⟩ The AGENT ends its own engagement with this engram.
    /// 
@@ -2798,11 +3196,11 @@ type Engram =
    /// The roster change and its chained audit line commit BEFORE the registry is told, so a registry
    /// that is down cannot leave the agent half-resigned; a missed notice is logged by
    /// `notifyRegistryAgentEdge`. WHAT WOULD MAKE THIS WRONG: a second path that sets `#Resigned`.
-   resignAgent: () -> (Result_1);
+   resignAgent: () -> (Result_2);
    /// OWNER-ONLY release of the write pause, with the same one-way shape as `unfreezePayments`: a
    /// guardian holding `canPauseWrites` can stop writes without the owner and cannot restart them,
    /// and the owner can always restart them. A tripwire rather than a lock.
-   resumeWrites: () -> (Result_1);
+   resumeWrites: () -> (Result_2);
    /// Self-heal: re-send every ACTIVE agent's start to the spawning registry (idempotent — the
    /// registry mints no duplicate for an open engagement), for when a notice was missed. Owner-only.
    /// Returns how many the registry ACKNOWLEDGED. ⟨2026-09-28: it used to count sends that did not
@@ -2825,11 +3223,11 @@ type Engram =
    /// all that is left to send is the ending, and the registry has nothing to end. The report lists
    /// each such engagement under `cannotBeRecorded` (key, root, invite, and how and when it ended),
    /// apart from `notRecorded`, so the owner sees them rather than silence.
-   resyncAgentEdges: () -> (Result_13);
+   resyncAgentEdges: () -> (Result_15);
    /// Return to managed custody: the engram adds the registry back as a controller ALONGSIDE the
    /// owner — it does not remove the owner. The inverse of `claimSovereignty`, and the reason
    /// sovereignty is not a one-way door.
-   returnToManaged: () -> (Result_1);
+   returnToManaged: () -> (Result_2);
    /// Replace the whole content of an EXISTING file.
    /// 
    /// This is the one thing agents could never do before: every agent write was an append,
@@ -2862,7 +3260,7 @@ type Engram =
    /// human means a different wallet.
    /// 
    /// To narrow what an agent may do rather than end its access, use `setAgentPermissions`.
-   revokeAgent: (agentPrincipal: principal) -> (Result_1);
+   revokeAgent: (agentPrincipal: principal) -> (Result_2);
    /// Owner-only panic button: revoke EVERY active agent at once. Returns how many were revoked.
    /// 
    /// ⚠ IT REVOKES ONLY AGENTS. Invites and connector bearer tokens are separate surfaces with
@@ -2879,7 +3277,7 @@ type Engram =
    /// written, and only then does it await one notification per revoked agent. So a notification
    /// that fails leaves the agents revoked here regardless — a partial notify is not a partial
    /// revocation, which is the direction that matters for a panic button.
-   revokeAllAgents: () -> (Result_8);
+   revokeAllAgents: () -> (Result_14);
    /// Owner-only panic button: revoke every connector bearer token at once. Returns how many.
    /// 
    /// The THIRD independent surface — hosted connectors authenticate with bearer tokens, not with
@@ -2888,7 +3286,7 @@ type Engram =
    /// holding a live session.
    /// 
    /// Tokens are re-issuable: revoking them is not permanent the way revoking an agent is.
-   revokeAllBearerTokens: () -> (Result_8);
+   revokeAllBearerTokens: () -> (Result_14);
    /// ⟨0.16.0⟩ `removeAllGuardians` DELETED — test-only (L6), and verified NOT part of KILL-SWITCH's
    /// mass-revoke set. The destructive phase-07 suite iterates `removeGuardian` instead, so nothing
    /// loses a capability: what dies is a bulk spelling no runbook ever invoked.
@@ -2900,10 +3298,10 @@ type Engram =
    /// 
    /// Unlike revoking an agent, this costs nothing permanently — an invite is a one-time code,
    /// so voiding it and minting a fresh one is the ordinary path.
-   revokeAllInvites: () -> (Result_8);
+   revokeAllInvites: () -> (Result_14);
    /// Revoke a bearer token by its public tokenId. Idempotent.
    /// Subsequent /mcp requests using this token will be rejected.
-   revokeBearerToken: (tokenId: text) -> (Result_1);
+   revokeBearerToken: (tokenId: text) -> (Result_2);
    /// ⟨0.16.0, census §10 item 16⟩ RETURNS A REAL RECEIPT, not `R<()>` — same reason as the delete
    /// above, and sharper here: a rollback WRITES A NEW VERSION, so the caller's next question is
    /// always "which version am I on now". `r.version` was already read for the audit line.
@@ -2926,14 +3324,7 @@ type Engram =
    /// `#Conflict` rather than `#Refused` for a `#Revoked` or `#Resigned` record: the caller IS the
    /// agent on that record, so its standing is not the problem — the record's state is. An
    /// agent reading `#Refused` would go looking for a permission that was never missing.
-   rotateAgentKeyHash: (newPublicKeyHash: text) -> (Result_1);
-   /// One-time onboarding seed: writes a starter file so the first read-back is non-empty.
-   /// 
-   /// Owner-only, and it REFUSES once any memory exists — so it can only ever add the initial
-   /// placeholder and can never overwrite real content. Deliberately NOT counted as a write (no
-   /// `totalMemoryWrites`, no `firstWriteAt`): it is a system seed rather than activity, and
-   /// counting it would corrupt both the write metrics and time-to-first-write for every engram.
-   seedMemory: (path: text, content: blob) -> (Result);
+   rotateAgentKeyHash: (newPublicKeyHash: text) -> (Result_2);
    /// Append to a memory file against a PAID x402 session voucher — the write half of the paid rail,
    /// authorized by the voucher rather than by a role.
    /// ⟨2026-09-30, ic402 2.17.0⟩ Authorized by the payer's own call with the voucher: only the
@@ -2977,7 +3368,7 @@ type Engram =
    /// ⚠ RAW STORED BYTES, like `readMemoryBatch`. On a Private (encrypted) engram the content is
    /// CIPHERTEXT; the key-holding SDK decrypts it. A caller without the key gets bytes it cannot
    /// read, not an error.
-   sessionReadContext: (clientLabel: text) -> (Result_12);
+   sessionReadContext: (clientLabel: text) -> (Result_13);
    /// Read one memory file against a PAID x402 session voucher. No role, no invite — the voucher is
    /// the authorization, which is what makes this the engram's one rail a stranger can pay to use.
    /// 
@@ -3007,14 +3398,15 @@ type Engram =
    ///     session must not be the side door: without this guard a stranger holding a fraction-of-a-
    ///     cent voucher could read `secrets/*`.
    ///   · Payments are frozen on this engram.
-   sessionReadMemory: (voucher: Voucher, path: text) -> (Result_11);
+   sessionReadMemory: (voucher: Voucher, path: text) -> (Result_12);
    /// Configure action alerts: an https webhook that receives new chained-audit entries matching the
    /// enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
-   /// POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
+   /// POST per minute. ⟨2026-10-29⟩ Delivered within seconds of the action (a 5 s batch window), and
+   /// nothing runs while nothing is owed. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
    /// details) — never memory file contents. Setting a URL (re)arms delivery FROM NOW: the cursor
    /// jumps to the current end of the log so history is not replayed. Passing url = null disables.
    /// The URL itself is never written to the audit log (webhook URLs often embed secret tokens).
-   setActionAlertConfig: (cfg: AlertConfig) -> (Result_1);
+   setActionAlertConfig: (cfg: AlertConfig) -> (Result_2);
    /// Owner-only: replace an existing agent's permission set. The way to NARROW what an agent
    /// may do without ending their access — `revokeAgent` is terminal for that principal, this is
    /// not.
@@ -3030,7 +3422,7 @@ type Engram =
    /// forward is to grant read to your own agents instead, or to switch to Connected mode first —
    /// both of which the message says.
    setAgentPermissions: (agentPrincipal: principal, permissions:
-    AgentPermissions) -> (Result_1);
+    AgentPermissions) -> (Result_2);
    /// Paths an agent holding a grant may REVISE rather than only append to.
    /// 
    /// Matching is EXACT, except that an entry ending in "/" grants everything beneath it. A grant
@@ -3038,7 +3430,7 @@ type Engram =
    /// real use case is rotating dated files under a prefix, and per-file grants would be unusable
    /// for that. What a bare prefix would do — "MEMORY.md" also matching "MEMORY.md.bak" — is the
    /// kind of accident a permission surface must not have.
-   setAgentRevisablePaths: (paths: vec text) -> (Result_1);
+   setAgentRevisablePaths: (paths: vec text) -> (Result_2);
    /// ⟨0.16.0 — census row⟩ Returns the APPLIED config, which is how this closes the
    /// setter-without-a-getter gap without adding a method: the write is the read.
    /// 
@@ -3047,10 +3439,16 @@ type Engram =
    /// called it an "ops floor: retention enforcement deletes owner backup data silently", mitigated
    /// by a `Debug.print` nobody reads. An owner lowering the cap is destroying their own backups;
    /// they are told how many, in the reply and in the audit line.
-   setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_10);
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answers h and m⟩ The number now bounds EACH creator's
+   /// backups of the kind (`Backup.enforceRetention`): an agent's finalize prunes only that agent's
+   /// own, and this setter applies the number to every creator's set, so `prunedBackups` counts
+   /// across all of them. "The write is the read" above went stale for a second phone, which never
+   /// made the write: `getBackupRetention` is the read.
+   setBackupRetention: (dbType: text, maxBackups: nat) -> (Result_11);
    /// Override the caps for ONE caller — an agent this owner trusts more, or less, than the rest.
    setCallerSpendPolicy: (caller: principal, policy: SpendingPolicy) ->
-    (Result_1);
+    (Result_2);
    /// Owner-only: set how many engrams `agentPrincipal`'s agent may open of its own through this
    /// engram. Kept by the agent's lasting key, so it carries over a key replacement. Any count is
    /// accepted; the registry lets a lasting key open one engram through a parent, ever, so 1 or more
@@ -3061,7 +3459,7 @@ type Engram =
    /// back. The change is written to the record under `agent.childAllowance.set`, which is in the
    /// alerts' money class (`ActionAlerts.classify`), so an owner or guardian with an alert channel
    /// hears of it.
-   setChildAllowance: (agentPrincipal: principal, allowed: nat) -> (Result_1);
+   setChildAllowance: (agentPrincipal: principal, allowed: nat) -> (Result_2);
    /// ⟨0.16.0⟩ `getEncryptedMemoryKeyForEpoch` DELETED — folded into `getEncryptedMemoryKey`'s epoch
    /// argument — see that method for the fold and the `null`-means-CURRENT rule.
    /// Owner-only: turn client-side memory encryption (Private mode) on or off for FUTURE writes.
@@ -3084,7 +3482,7 @@ type Engram =
    /// 
    /// Private mode also closes the paid read rail by construction: a paid session holds no key, so
    /// `sessionReadMemory` refuses on an encrypted engram whatever `setPaidMemoryReadEnabled` says.
-   setEncryptionEnabled: (enabled: bool) -> (Result_1);
+   setEncryptionEnabled: (enabled: bool) -> (Result_2);
    /// Register the owner's EVM address for withdrawals.
    /// 
    /// First set: immediate — no guardian needed.
@@ -3095,13 +3493,18 @@ type Engram =
    /// 
    /// The guardian doesn't approve the change — the owner is sovereign.
    /// The guardian's existence is the gate, not their active consent.
-   setEvmOwnerAddress: (evmAddress: text) -> (Result_1);
+   setEvmOwnerAddress: (evmAddress: text) -> (Result_2);
    /// A guardian arms their OWN webhook over the guarded engram's audit stream (same event
    /// classes and payload as the owner channel — audit metadata, never memory file contents;
    /// the guardian honesty rail: integrity, not content). Active guardians only. Arming starts
    /// from NOW (no history replay); url = null disarms and frees the slot.
-   setGuardianAlertConfig: (cfg: AlertConfig) -> (Result_1);
-   /// Per-prefix retention policy. Longest prefix wins; anything unmatched keeps everything.
+   setGuardianAlertConfig: (cfg: AlertConfig) -> (Result_2);
+   /// Per-prefix retention policy. The longest rule that covers a path wins; anything uncovered
+   /// keeps everything.
+   /// 
+   /// ⟨2026-10-21, the owner's round-11 answer i⟩ "Covers" is the folder matcher
+   /// (`AgentPaths.covers`, through `RetentionPolicy.resolve`): a rule ending in "/" governs
+   /// everything beneath it, any other rule exactly one path. It was bare text prefix until that day.
    /// 
    /// A CHANGE does not take effect immediately, in EITHER direction: every prefix whose EFFECTIVE
    /// class moves is guarded for the same window as the agent floor, so history cannot be
@@ -3113,7 +3516,7 @@ type Engram =
     vec record {
           text;
           RetentionClassSpec;
-        }) -> (Result_1);
+        }) -> (Result_2);
    /// Owner-only: open or close the monetized read rail. When disabled (the default), sessionReadMemory
    /// fails closed for every voucher-bearer — selling the owner's memory is opt-in, not the default.
    /// 
@@ -3124,26 +3527,26 @@ type Engram =
    /// 
    /// `getEngramCard`'s `x402Support` reports THIS flag, so a buyer can read the rail's state before
    /// paying rather than discovering it in a refusal.
-   setPaidMemoryReadEnabled: (enabled: bool) -> (Result_1);
+   setPaidMemoryReadEnabled: (enabled: bool) -> (Result_2);
    /// Open or close the paid-memory WRITE rail (RB4). Owner-only, like its read twin.
    /// 
    /// Kept as a SEPARATE flag rather than widening `setPaidMemoryReadEnabled` into one switch: an
    /// owner selling read access has not thereby agreed to sell write access, and a single flag makes
    /// the larger permission ride in on the smaller one. Two flags is the shape that lets an owner
    /// say yes to one and no to the other, which is the common case.
-   setPaidMemoryWriteEnabled: (enabled: bool) -> (Result_1);
+   setPaidMemoryWriteEnabled: (enabled: bool) -> (Result_2);
    /// ⟨0.16.0, L1⟩ Every validation refusal here is `#Invalid` and the cap is `#Conflict`, and the
    /// split is worth stating once for the whole whole-value-config family below: a malformed path is
    /// the CALLER'S to fix and retrying with a corrected list works, while "max 20" is a property of
    /// this engram that no argument gets around. A caller that cannot tell those apart either edits
    /// forever or gives up on a request that was one character from valid.
-   setProtectedPaths: (paths: vec text) -> (Result_1);
+   setProtectedPaths: (paths: vec text) -> (Result_2);
    /// OWNER-ONLY: switch the metrics reader's read of the seat weeks off (`false`) or back on (`true`).
    /// On from birth, by the owner's ruling of 2026-10-02. Off, `sysGetAgentSeatWeeks` refuses the
    /// reader by name, naming this switch; the rows are still kept and the owner still reads them. Each
    /// call is a chained record entry (`metrics.setSeatWeeksReadEnabled`, the new and the old value), so
    /// when the read was on or off is part of the record. Anyone else is refused by name.
-   setSeatWeeksReadEnabled: (enabled: bool) -> (Result_1);
+   setSeatWeeksReadEnabled: (enabled: bool) -> (Result_2);
    /// Set the most this engram may spend per day ACROSS EVERY CALLER — five agents, the owner and the
    /// marketplace together. `null` removes the ceiling. ⟨2026-09-28⟩
    /// ⟨CORRECTED 2026-09-29, review finding X-8: "spend" was too wide. The ceiling covers the x402
@@ -3153,6 +3556,10 @@ type Engram =
    /// bounded instead by each registered type's daily count and destination list; and agent-
    /// registration transactions (`signEngramRegistration`), bounded by three per caller per day and
    /// the 500-gwei gas ceiling. Whether the ceiling should cover them is a separate owner question.⟩
+   /// ⟨2026-10-14, the owner's rulings 3A, 4A and 5A⟩ Typed-data signatures are now bounded by each
+   /// registered type's daily count, its per-field rules ("at most N", "must equal X") and ITS OWN
+   /// destination list, and the signing floor (`SigningFloor`) guards them as it guards x402 payments.
+   /// They are still not counted against this ceiling.
    /// 
    /// WHY: the owner decided on 2026-09-28 to add one daily spending ceiling across all callers on an
    /// engram and keep the limit of five agents. Every other spending limit is per caller, so without
@@ -3181,7 +3588,7 @@ type Engram =
    /// The record entry `spend.setCeiling` carries the new AND the previous value, so a widening is
    /// distinguishable from a tightening afterwards — the reason `spend.setPolicy` records its limits.
    /// Not blocked by a payments freeze, like `setSpendPolicy`: setting a limit moves no money.
-   setSpendCeiling: (maxPerDay: opt nat) -> (Result_1);
+   setSpendCeiling: (maxPerDay: opt nat) -> (Result_2);
    /// Set this engram's spending caps.
    /// 
    /// The audit row records the LIMITS, not merely that a change happened, so a WIDENING is
@@ -3191,7 +3598,7 @@ type Engram =
    /// Raising a cap RESOLVES pending approval requests it now covers — that is the second half of
    /// the escalation an agent starts when it hits a limit, and without it the queue is a place
    /// requests go to expire.
-   setSpendPolicy: (policy: SpendingPolicy) -> (Result_1);
+   setSpendPolicy: (policy: SpendingPolicy) -> (Result_2);
    /// Owner-only: set YOUR OWN safety rails on the funding path — a per-top-up ckUSDC ceiling and a
    /// minimum gap between top-ups. Read them back with `getTopUpLimits`.
    /// 
@@ -3215,12 +3622,12 @@ type Engram =
     record {
       cooldownSeconds: nat;
       maxCkusdcE6s: nat;
-    }) -> (Result_1);
+    }) -> (Result_2);
    /// Owner sets the World ID app_id + action + rp_id from their World Developer Portal (rp_id appears
    /// after "Enable World ID 4.0" on a production app). The action MUST be configured there with
    /// max_verifications = Unlimited (idempotent /verify → survives IC consensus). After setting this,
    /// register getWorldIdRpSignerAddress() as the rp_id's signer address in the Portal.
-   setWorldIdConfig: (appId: text, action: text, rpId: text) -> (Result_1);
+   setWorldIdConfig: (appId: text, action: text, rpId: text) -> (Result_2);
    /// Submit a verified-human proof: the IDKitResult from the frontend's World ID flow, forwarded
    /// VERBATIM (compact JSON, as JSON.stringify emits) to World's /api/v4/verify/{rp_id} over an HTTPS
    /// outcall (never trust the client). The v4 endpoint verifies both 4.0 proofs and legacy 3.0 proofs,
@@ -3229,7 +3636,7 @@ type Engram =
    /// store to the payload the verifier actually accepted. Only proof_of_human credentials are accepted
    /// (selfie is farmable, passport/mnc are document identity — a different tier). Sets worldIdVerified
    /// and stores the result ONLY on a real verification success — never self-asserted.
-   setWorldIdProof: (resultJson: text, nullifier: text) -> (Result_1);
+   setWorldIdProof: (resultJson: text, nullifier: text) -> (Result_2);
    /// Sign a registered type. ONE call, owner-only, freeze-gated — the delay lives on registration
    /// (D2), never here: an emergency withdrawal must not need two owner round-trips.
    /// 
@@ -3239,7 +3646,7 @@ type Engram =
    signEip712: (typeId: blob, values: vec record {
                                             text;
                                             Eip712Value;
-                                          }) -> (Result_4);
+                                          }) -> (Result_5);
    /// Sign the engram's own ERC-8004 registration tx for client-side broadcast: the engram signs, the client
    /// broadcasts and keeps the resulting registration id.
    /// 
@@ -3274,7 +3681,7 @@ type Engram =
       maxFeePerGas: nat;
       maxPriorityFeePerGas: nat;
       nonce: nat;
-    }) -> (Result_9);
+    }) -> (Result_10);
    /// Sign an EIP-3009 authorization for x402 payment. Agent-accessible.
    /// Client probes the URL, extracts chain/token/recipient/amount from the 402, and calls this.
    /// Canister signs → returns header → client retries with header.
@@ -3305,34 +3712,27 @@ type Engram =
       tokenAddress: text;
       tokenName: text;
       tokenVersion: text;
-    }) -> (Result_3);
-   /// Self-heal: if the registry's spawn-time push was missed, the owner pulls the number from
-   /// the spawning registry. Idempotent; fails closed if the registry has no record.
-   syncEngramNumber: () -> (Result_8);
-   /// Genesis seed — the atomic "spawn only when there's real content" primitive. The spawning
-   /// REGISTRY pushes the owner's first real memory immediately after install, so a canister is
-   /// never spawned holding nothing (see the registry's `provisionEngram` optional genesis).
-   /// 
-   /// Gated `spawnedBy`-only and ONE-SHOT: it refuses once any file exists, so it can seed and never
-   /// overwrite. Unlike the owner-only `seedMemory` placeholder this is REAL owner content, so it
-   /// IS counted as an owner write (`firstWriteAt`, `totalMemoryWrites`) and is authored by the
-   /// OWNER rather than by the registry principal that called it. It never touches the
-   /// agent metrics.
-   /// 
-   /// ⚠ THE PAYLOAD IS `Nat` AND MUST STAY `Nat`, which is a constraint on any client of this
-   /// method rather than an internal detail. Its only caller is the registry, over an
-   /// inter-canister boundary, through a hand-declared actor type — and the registry is ROUTINELY a
-   /// different version from the engram template it is seeding: it upgrades before the fleet does,
-   /// and during a transition it can serve a template older than itself. A return-type change here
-   /// breaks genesis provisioning across that skew. That is measured, not predicted: the registry
-   /// trapped with "IDL error: unexpected IDL type when parsing Nat" while seeding an engram built
-   /// at the staging tag. A receipt would buy nothing anyway — the caller does `ignore await`.
-   /// 
-   /// ⚠ ORDERING: upload the engram TEMPLATE first, then upgrade the registry. The reverse leaves a
-   /// window where a spawn seeds an old-shape engram with a new-shape expectation; the reply fails
-   /// to decode and `provisionEngram` dies on a trap its own `try/catch` cannot reach (ADR-0001),
-   /// failing the WHOLE SPAWN rather than just the seed.
-   sysApplyGenesisSeed: (path: text, content: blob) -> (Result_8);
+    }) -> (Result_4);
+   /// ⟨2026-10-21, the owner's round-11 answer e⟩ A GUARDIAN STEPS DOWN: the caller ends their own
+   /// guardianship of this engram. It removes a power from the one who holds it and grants none.
+   /// Before, only the owner could remove a guardian, so one who wanted out could only stop watching
+   /// without anyone knowing — worse than an honest exit on the record.
+   /// 
+   /// WHO: anyone holding a guardian record here, `#Pending` or `#Active`; never refused for the
+   /// record's state. The owner is refused by name (`People.OWNER_IS_NO_GUARDIAN`: their way is
+   /// `removeGuardian`); an agent or a stranger is `#NotFound` (`People.NOT_A_GUARDIAN`, a fact about
+   /// the caller told to the caller, as `resignAgent` does); the anonymous caller is refused.
+   /// 
+   /// WHAT IT RECORDS: one `guardian.stepDown` entry under `#Guardian`
+   /// (`principal=<key> was=active|pending name=<name>`). Being a `guardian.*` operation it reaches
+   /// the owner's and the other guardians' alerts in the #guardian class, on by default, and the
+   /// guardian who left gets one farewell delivery before their channel goes (the drain's lazy
+   /// cleanup in `drainActionAlerts`, as for a removed guardian).
+   /// 
+   /// WHAT IT LEAVES: a brake this guardian pulled stays on — lifting one is the owner's; their
+   /// disputes stay on the record. Like `removeGuardian`, it is not terminal: the owner may invite
+   /// the same person again.
+   stepDownAsGuardian: () -> (Result_2);
    /// OWNER force-close, for a session the payer abandoned.
    /// 
    /// ⟨R1b, ruled 2026-08-26: owner-gated, NO guardian.⟩ It moves someone else's money, and only ever
@@ -3352,7 +3752,7 @@ type Engram =
    /// stays false here until it is renamed too. Left for the owner: the rename is free until the cut
    /// and a break after it, and it also moves `packages/client/README.md` and
    /// `docs/AGENT-ONBOARDING.md`, which name it.
-   sysForceCloseSession: (sessionId: text) -> (Result_1);
+   sysForceCloseSession: (sessionId: text) -> (Result_2);
    /// The metrics reader the registry designated reads every engagement's seat weeks, in one call.
    /// 
    /// CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
@@ -3369,11 +3769,14 @@ type Engram =
    /// owner can see every time the reader read. A refusal is `#Refused` naming this method and the
    /// class (`SeatWeeks.readRefusal`), never an empty list: an empty list is a real answer ("no agent
    /// has paired here"), and a fabricated one would be counted as one.
-   sysGetAgentSeatWeeks: () -> (Result_7);
+   sysGetAgentSeatWeeks: () -> (Result_9);
    /// The metrics reader the registry designated reads this engram's paid-rail health, in one call:
    /// the balance and the line it must stay above, the memory that line is computed from, the sessions
    /// by state, the escrow open sessions hold, the vouchers spent and the refused ones
-   /// (`RailHealth.RailHealth` says what each is, and what is never in it).
+   /// (`RailHealth.RailHealth` says what each is, and what is never in it). ⟨2026-10-08, ic402 2.18.0⟩
+   /// And `refundOwed`: the closed sessions whose refund failed and whose payer has not yet recovered
+   /// it — counted from the close, never read from the ledger; `opt` from birth, and null (an engram
+   /// that does not count) is never 0.
    /// 
    /// CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
    /// nobody else — the owner reads its balance through `getOwnerConsole`. Answered only while the
@@ -3388,7 +3791,7 @@ type Engram =
    /// (`RailHealth.readRefusal`), never a zero balance: a made-up zero would read as an engram about
    /// to freeze. Called by another canister, a query runs replicated and this engram pays for it —
    /// a few million cycles an hour, the cost of being watched.
-   sysGetRailHealth: () -> (Result_6) query;
+   sysGetRailHealth: () -> (Result_8) query;
    /// The cashier reads how many signatures this engram has produced, per caller and in total.
    /// ⟨2026-09-28⟩ The owner's decision of that date: a running counter on the engram, exported to
    /// the cashier — and to nobody else (`AccessControl.requireCashierForSignatureCounts`).
@@ -3411,7 +3814,20 @@ type Engram =
    /// bills from this: the number comes from a canister its owner controls and can reinstall, so bill
    /// only engrams the registry confirms run published code, and read a lower count than last time as
    /// a reinstall — the reasoning is at `signaturesByCaller`.
-   sysGetSignatureCounts: () -> (Result_5);
+   sysGetSignatureCounts: () -> (Result_7);
+   /// Note a restart the registry just made: what this engram owes for it, the floor a repayment may
+   /// not go under, and until when to keep its timers quiet.
+   /// 
+   /// CALLER: the registry that spawned this engram, from inside its owner's `restartMyStoppedEngram`,
+   /// and nobody else (ADR-0020) — the same authority as `sysSetBillerId`. The owner's next conversion
+   /// that lands pays the loan back first. The loan is capped at `RestartRepay.LOAN_MAX_CYCLES` and
+   /// the quiet window at 30 minutes, whatever the registry says.
+   sysNoteRestart: (r:
+    record {
+      keepCycles: nat;
+      loan: nat;
+      quietUntilNs: int;
+    }) -> (Result_2);
    /// Rent lifecycle notice — how the OWNER (not the agent) learns their subscription lapsed. D6
    /// shipped the handoff but every alarm it added talks to the operating service's watchdog; the
    /// doc named the debt plainly: "an owner learns of their own lapse only by looking." This closes
@@ -3422,7 +3838,7 @@ type Engram =
    /// Gated exactly like sysRecordFeeEvent (spawnedBy or cashierId): the sweep is the only thing that
    /// OBSERVES the transition, so it is the only thing that can report it. The state whitelist is
    /// closed — this is a lifecycle feed, not a free-text push surface into the owner's audit chain.
-   sysNotifyRentLifecycle: (state: text, detail: text) -> (Result_1);
+   sysNotifyRentLifecycle: (state: text, detail: text) -> (Result_2);
    /// ⟨0.16.0⟩ `getWalletActivation()` DELETED — folded to `about().walletActivatedAtNs`, with its
    /// custody-posture rationale carried onto the field. "Can this thing hold money" is a question a
    /// counterparty is entitled to ask before dealing with an engram, which is why it stays public.
@@ -3454,7 +3870,7 @@ type Engram =
    /// The audit line records this engram as the subject, and `surface=endpoint-listed` is what names
    /// the origin: only the configured market can pass that value, so the line cannot be produced by
    /// any other caller.
-   sysNotifyWalletActivity: (surface: text) -> (Result_1);
+   sysNotifyWalletActivity: (surface: text) -> (Result_2);
    /// The rent RECEIPT seam (B2): the cashier tells this engram that money moved on its behalf, and
    /// the engram appends a `fee.recorded` line to its own audit chain. It computes nothing.
    /// 
@@ -3489,7 +3905,32 @@ type Engram =
       cycles: nat;
       paidThroughNs: opt int;
       scheduleVersion: opt text;
-    }) -> (Result_1);
+    }) -> (Result_2);
+   /// Give back what a paid security update advanced this engram and the install did not use.
+   /// 
+   /// CALLER: the registry that spawned this engram, right after it installed a security update it
+   /// paid for, and nobody else (ADR-0020). Sends the smallest of: the advance, what this engram holds
+   /// above its balance before the update, and what sits above its 30-day reserve plus send headroom
+   /// (`RestartRepay.giveBack`) — attached to the registry's `sysRepayUpgradeAdvance`, which accepts no
+   /// more than it advanced. The registry writes off what is not returned; nothing is owed after.
+   /// ⟨CORRECTED 2026-10-28, beside "its 30-day reserve" above — the owner's ruling "1"⟩ The reserve is
+   /// this engram's freezing reserve at its own setting (`freezeReservation` = `lineEstimate`), not a
+   /// 30-day figure: about 430B more at a ~305-day setting.
+   /// ⟨2026-10-26, the owner's review choice 1B: "take back only what we added; anything left over goes
+   /// to the 90-day write-off"⟩ The registry now names the ONE advance it is asking for (`advanceId`,
+   /// the one its deposit for this install put on its ledger) and `advance` is that advance's amount
+   /// alone — never the sum of every advance this engram has out. The engram passes the id back to
+   /// `sysRepayUpgradeAdvance` unchanged, and the registry settles that advance only. The engram's own
+   /// caps are unchanged (`RestartRepay.giveBack`). HONEST LIMIT, unchanged by 1B: the engram cannot
+   /// tell its owner's top-up from the unused advance, so when the install used part of the advance and
+   /// the owner added compute meanwhile, up to the part the install used can still come from the
+   /// owner's top-up (the cap is the advance, not its unused part).
+   sysReturnUpgradeAdvance: (a:
+    record {
+      advance: nat;
+      advanceId: nat;
+      balanceBefore: nat;
+    }) -> (Result_6);
    /// Point this engram at the biller that converts its tokens → cycles. Settable, not hardcoded:
    /// coupling is by principal id, so the same wasm runs against any deployment's biller.
    /// 
@@ -3505,10 +3946,22 @@ type Engram =
    /// `convertEarningsToCycles` fails closed against a null biller, and with the owner leg gone
    /// nobody but the spawning registry can fix it. That refusal therefore names the real remedy
    /// rather than telling an owner to run a call they can no longer make.
-   sysSetBillerId: (id: principal) -> (Result_1);
-   /// One-shot assignment of the spawn ordinal — callable ONLY by the spawning registry, ONLY
-   /// while unset. Neither the owner nor any later registry can change an assigned number.
-   sysSetEngramNumber: (n: nat) -> (Result_1);
+   sysSetBillerId: (id: principal) -> (Result_2);
+   /// Give this engram its BIRTH CHAIN: its ancestors' birth records and its own, root first, its own
+   /// last ⟨2026-10-26, the owner's lineage rulings L2C-lite and L3A⟩.
+   /// 
+   /// CALLER: the registry that spawned this engram, from its birth push or its sweep's retry, and
+   /// nobody else (ADR-0020) — the same authority as `sysSetBillerId`, through the named gate
+   /// `AccessControl.requireSpawningRegistry`. ⚠ THE REGISTRY'S CLIENT DECLARATION IS HAND-WRITTEN
+   /// (`sysSetBirthChain : ([BirthRecord.BirthRecord]) -> async Wire.Result<()>`, in `mintAndPush`): a
+   /// different reply type here traps inside the registry's callback, and a different name leaves every
+   /// newborn without its record, silently retried. test/lineage-wiring.test.ts holds the two equal.
+   /// 
+   /// SET ONCE: the same chain again answers `#Ok` and changes nothing (the registry's sweep may re-send
+   /// a push whose reply was lost); a different one is refused `#Conflict`. THE ENGRAM DOES NOT HASH:
+   /// it checks only that the chain ends with its own record. The fingerprints are the registry's to
+   /// certify and the client's `verifyBirthChain` to check.
+   sysSetBirthChain: (chain: vec BirthRecord) -> (Result_2);
    /// Point this engram at the commerce satellite allowed to ask it for signatures. ⟨0.16.0, B1⟩
    /// 
    /// SAME AUTHORITY AS `sysSetBillerId`, and for a stronger reason. That one routes money; this one
@@ -3520,7 +3973,7 @@ type Engram =
    /// never be sold through the market, and no owner action fixes it. Both `sysSign*` methods refuse
    /// against a null pointer and their refusals name the registry as the remedy rather than telling
    /// an owner to run a call they cannot make.
-   sysSetMarketId: (id: principal) -> (Result_1);
+   sysSetMarketId: (id: principal) -> (Result_2);
    /// Name the metrics reader allowed to read this engram's seat weeks (`sysGetAgentSeatWeeks`).
    /// ⟨2026-10-02, the owner's ruling of that day⟩
    /// 
@@ -3535,9 +3988,12 @@ type Engram =
    /// A CANISTER ONLY: a person's principal, the anonymous principal or the management canister is
    /// refused `#Invalid` and nothing changes — a person named here would be handed this engram's seat
    /// counts. Set or replaced, never cleared: the owner's control is the switch
-   /// (`setSeatWeeksReadEnabled`), not the pointer. The chained record entry
+   /// (`setSeatWeeksReadEnabled`), not the pointer.
+   /// ⟨CORRECTED 2026-10-26, the owner's lineage ruling L6A⟩ "Set or replaced" is no longer true: it is
+   /// SET ONCE. The same reader again answers `#Ok` and changes nothing; another is refused `#Conflict`
+   /// (`AccessControl.setOnce` says why). Still never cleared. The chained record entry
    /// (`metrics.sysSetMetricsReaderId`) is the evidence of when the read was granted, and to whom.
-   sysSetMetricsReaderId: (reader: principal) -> (Result_1);
+   sysSetMetricsReaderId: (reader: principal) -> (Result_2);
    /// The market asks this engram to sign a registered type — B1's seam, settlement leg. ⟨0.16.0⟩
    /// 
    /// THE ENGRAM DOES NOT TRUST THE MARKET WITH ANYTHING BEYOND "ask". Every control that bounds
@@ -3545,13 +4001,16 @@ type Engram =
    /// (the market cannot introduce a shape), its cool-off must have elapsed, its per-type daily cap
    /// still binds, the destination allowlist still fails closed, and a payments freeze still stops
    /// it. What the market supplies is the request; what the engram supplies is the whole policy.
+   /// ⟨2026-10-14⟩ And the type's per-field rules, its own destination list (ruling 4A) and the
+   /// signing floor (ruling 5A) — all in `eip712SignFor`, so they bind the market as they bind the
+   /// owner; a refusal here is on the chained record under the market's caller and role.
    /// 
    /// That is what "signatures only" means in code, and it is why this method needs no new authority
    /// model: an unregistered typeId is refused for the market exactly as it is for the owner.
    sysSignEip712: (typeId: blob, values: vec record {
                                                text;
                                                Eip712Value;
-                                             }) -> (Result_4);
+                                             }) -> (Result_5);
    /// The market asks this engram to sign an x402 payment — B1's seam, the paid-request leg. ⟨0.16.0⟩
    /// 
    /// THE MARKET SUPPLIES THE REQUEST; THE ENGRAM SUPPLIES THE POLICY. Every control below the caller
@@ -3568,14 +4027,16 @@ type Engram =
    /// for ALL market traffic; per-seller limits are not expressible in the store it reads.
    sysSignX402Payment: (chainId: nat, tokenAddress: text, recipient: 
     text, amount: nat, tokenName: text, tokenVersion: text, rationale:
-    opt text, approvalId: opt text) -> (Result_3);
+    opt text, approvalId: opt text) -> (Result_4);
    /// Write an `alerts.test` entry into the audit log; the drain timer delivers it to the webhook
-   /// within ~60s. Owner-only; requires a configured URL so the test can actually go somewhere.
-   testActionAlert: () -> (Result_1);
+   /// within ~60s. ⟨2026-10-29, beside "within ~60s"⟩ Within seconds (a minute if a delivery was just
+   /// made). Owner-only; requires a configured URL so the test can actually go somewhere.
+   testActionAlert: () -> (Result_2);
    /// Guardian test alert — an audited guardian action (`alerts.test`, role Guardian) that every
-   /// armed channel (owner + guardians) receives within ~60s. Requires the caller's own channel
+   /// armed channel (owner + guardians) receives within ~60s (⟨2026-10-29⟩ within seconds; a minute if
+   /// a delivery was just made). Requires the caller's own channel
    /// to be armed so the test has somewhere to land for them.
-   testGuardianAlert: () -> (Result_1);
+   testGuardianAlert: () -> (Result_2);
    /// RENAMED from `init` (L2.4). This is the OWNERSHIP-TRANSFER method — the most consequential
    /// owner-facing operation on the canister — and it was named for first-time setup, colliding with
    /// the actor's own `service : (initArgs)`. A reader scanning for "how does ownership move" found
@@ -3613,7 +4074,7 @@ type Engram =
    /// control to the same owner again and reports it, and it writes NO entry to
    /// `listOwnershipTransfers` (until this day it wrote one from the owner to themselves, a hand-on
    /// that did not happen). The record entry says it was a report. `ControlHandover.isReport`.
-   transferOwnership: (newOwner: principal) -> (Result_2);
+   transferOwnership: (newOwner: principal) -> (Result_3);
    /// OWNER-ONLY release of the payment freeze — and the asymmetry with `freezePayments` is the
    /// governance design, not an oversight.
    /// 
@@ -3625,7 +4086,18 @@ type Engram =
    ///     unilaterally.
    /// So a guardian's freeze is a TRIPWIRE, not a lock — it buys the time it takes the owner to
    /// look, and no more.
-   unfreezePayments: () -> (Result_1);
+   unfreezePayments: () -> (Result_2);
+   /// Wake this engram's timers after it paused them to save compute near its freezing line. Owner
+   /// only. Refused, by name, below the room the hourly check-in needs; then nothing is armed.
+   /// 
+   /// CALLER: the engram's owner, from the owner's app (its status line and its compute page), and
+   /// nobody else (ADR-0020). ⟨2026-10-28, the owner's ruling "1": "it wakes on the next payment, agent
+   /// request or your Wake"⟩ The automatic doors (the biller's receipt, Convert, an agent's MCP request)
+   /// wake it when compute lands with room; this is the owner's door, for compute that arrived with no
+   /// receipt (a bare top-up). It always reads the engram's own balance (no rate limit, no free filter),
+   /// so a refusal states what the engram measured. Both figures in a refusal are its own READING above
+   /// its line, which runs ~82B below the true figure, so the engram never calls it the gap.
+   wakeTimers: () -> (Result_1);
    /// Consensus transform for the World ID /verify outcall. Replicas each call independently, so the raw
    /// response (timestamps, `uses`, request-id headers) is non-deterministic. Collapse it to a single
    /// canonical byte — "1" iff HTTP 200 AND the body asserts success — with no headers, so every replica
@@ -3670,6 +4142,32 @@ type Eip712Value =
    string: text;
    uint: nat;
  };
+type Eip712TypeView = 
+ record {
+   ackIrrevocable: bool;
+   authorityClass: AuthorityClass;
+   chainId: nat;
+   cooloffEndsAtNs: int;
+   dailySignCap: nat;
+   destinationFields: vec text;
+   domainName: text;
+   domainSeparator: vec nat8;
+   domainVersion: text;
+   encodeTypeString: text;
+   fieldRules: vec record {
+                     text;
+                     Eip712FieldRule;
+                   };
+   fields: vec record {
+                 text;
+                 text;
+               };
+   primaryType: text;
+   registeredAtNs: int;
+   typeHash: vec nat8;
+   typeId: blob;
+   verifyingContract: text;
+ };
 type Eip712SignatureOut = 
  record {
    digest: blob;
@@ -3684,6 +4182,19 @@ type Eip712Registration =
    encodeTypeString: text;
    typeId: blob;
  };
+type Eip712FieldRule = 
+ variant {
+   atMost: record {
+             decimals: nat;
+             max: nat;
+           };
+   mustEqual: text;
+ };
+type Eip712Destination = 
+ record {
+   activeFromNs: int;
+   value: text;
+ };
 type Eip3009Authorization = 
  record {
    from: text;
@@ -3772,7 +4283,7 @@ type ChildAllowanceRow =
 type CheckpointPage = 
  record {
    firstAvailableSeq: nat;
-   page: Page_15;
+   page: Page_18;
    scannedThroughSeq: nat;
  };
 type CertifiedAuditHead = 
@@ -3790,6 +4301,38 @@ type CallerSignatureCount =
    role: Role;
    root: opt principal;
  };
+type Brakes = 
+ record {
+   payments: BrakeState;
+   writes: BrakeState;
+ };
+type BrakeState = 
+ record {
+   on: bool;
+   pull: opt BrakePull;
+ };
+type BrakeRole = 
+ variant {
+   Guardian;
+   Owner;
+ };
+type BrakePull = 
+ record {
+   atNs: int;
+   by: principal;
+   reason: opt text;
+   role: BrakeRole;
+ };
+type BirthRecord = 
+ record {
+   bornAtNs: int;
+   child: principal;
+   number: nat;
+   parent: opt principal;
+   parentFingerprint: opt blob;
+   secret: blob;
+   version: nat;
+ };
 type BearerTokenStatus = 
  variant {
    Active;
@@ -3834,6 +4377,12 @@ type BackupRetentionReport =
    maxBackups: nat;
    prunedBackups: nat;
  };
+type BackupRetention = 
+ record {
+   dbType: text;
+   isDefault: bool;
+   maxBackups: nat;
+ };
 type BackupMetadata = 
  record {
    backupId: text;
@@ -3902,12 +4451,17 @@ type AnchorPushStatus =
    attemptTotal: nat;
    cadenceSeconds: nat;
    carrierArmedAtNs: int;
+   checkInIntervalSeconds: opt nat;
    currentTotal: nat;
    lastError: text;
+   nextAnchorAttemptAtNs: opt int;
+   nextCheckInDueAtNs: opt int;
    okAtNs: opt int;
    okTotal: nat;
    skipCursor: nat;
    timerTickAtNs: opt int;
+   timersPauseReason: opt text;
+   timersPausedAtNs: opt int;
  };
 type AlertStatus = 
  record {
@@ -3952,6 +4506,18 @@ type AgentStatus =
    Resigned;
    Revoked;
  };
+type AgentSpendToday = 
+ record {
+   agents: Page_23;
+   dayStartNs: int;
+ };
+type AgentSpendRow = 
+ record {
+   agent: principal;
+   maxPerDay: opt nat;
+   root: principal;
+   spentToday: opt nat;
+ };
 type AgentRecord = 
  record {
    earlierKeys: vec HeldKey;
@@ -3985,6 +4551,16 @@ type AgentPaymentSignatures =
    root: principal;
    signedToday: nat;
  };
+type AgentGrant = 
+ record {
+   key: principal;
+   name: text;
+   paymentLimits: PaymentLimits;
+   paymentsFrozen: opt bool;
+   paymentsNow: opt PaymentsNow;
+   paymentsStoppedBy: opt PaymentsStop;
+   permissions: AgentPermissions;
+ };
 type AgentEnding = 
  record {
    day: int;
@@ -4019,14 +4595,14 @@ type ActionAuth =
  };
 type About = 
  record {
+   activeAgentCount: opt nat;
    agentCount: nat;
    agentMemoryReads: nat;
    agentMemoryWrites: nat;
    auditLogSize: nat;
    backupCount: nat;
-   distinctReaderClients: nat;
-   distinctReaderPrincipals: nat;
    encryptionEnabled: bool;
+   endedAgentCount: opt nat;
    firstAgentWriteAtNs: opt int;
    firstWriteAtNs: opt int;
    guardianCount: nat;
@@ -4038,6 +4614,7 @@ type About =
    paidMemoryReadEnabled: bool;
    paidMemoryWriteEnabled: bool;
    paymentsFrozen: bool;
+   timersPausedSinceDayNs: opt int;
    totalBackupSize: nat;
    totalMemoryReads: nat;
    totalMemoryWrites: nat;