@engramx/idl 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/registry.did

@@ -24,6 +24,12 @@ type StandingLeaf =
    root: principal;
    version: nat;
  };
+type SealedEntry = 
+ record {
+   digest: blob;
+   entryHash: blob;
+   id: nat;
+ };
 type RowEnding = 
  record {
    day: int;
@@ -57,102 +63,143 @@ type Role =
 type Result_9 = 
  variant {
    Err: Error;
-   Ok: Page_2;
+   Ok: EngramComputeView;
  };
 type Result_8 = 
  variant {
    Err: Error;
-   Ok: Page_1;
+   Ok: RestartReply;
  };
 type Result_7 = 
  variant {
    Err: Error;
-   Ok: Page;
+   Ok: nat;
  };
 type Result_6 = 
  variant {
    Err: Error;
-   Ok: vec text;
+   Ok: record {
+         finishByNs: int;
+         updateWaiting: bool;
+       };
  };
 type Result_5 = 
  variant {
    Err: Error;
-   Ok: CustodyMode;
+   Ok: record {
+         repaid: nat;
+         stillOwed: nat;
+       };
  };
 type Result_4 = 
  variant {
    Err: Error;
-   Ok: nat;
+   Ok: MeterReading;
  };
 type Result_3 = 
  variant {
    Err: Error;
-   Ok: MeterReading;
+   Ok: ControlStep;
  };
-type Result_21 = 
+type Result_28 = 
  variant {
    Err: Error;
    Ok: FleetCycleHealth;
  };
-type Result_20 = 
+type Result_27 = 
  variant {
    Err: Error;
    Ok: CertifiedStanding;
  };
+type Result_26 = 
+ variant {
+   Err: Error;
+   Ok: blob;
+ };
+type Result_25 = 
+ variant {
+   Err: Error;
+   Ok: PrivateMetrics;
+ };
+type Result_24 = 
+ variant {
+   Err: Error;
+   Ok: RestartStatus;
+ };
+type Result_23 = 
+ variant {
+   Err: Error;
+   Ok: OpeningCounts;
+ };
+type Result_22 = 
+ variant {
+   Err: Error;
+   Ok: OpenedThrough;
+ };
+type Result_21 = 
+ variant {
+   Err: Error;
+   Ok: ReferralCounts;
+ };
+type Result_20 = 
+ variant {
+   Err: Error;
+   Ok: opt text;
+ };
 type Result_2 = 
  variant {
    Err: Error;
-   Ok: ControlStep;
+   Ok: record {accepted: nat;};
  };
 type Result_19 = 
  variant {
    Err: Error;
-   Ok: OpenedThrough;
+   Ok: Page_6;
  };
 type Result_18 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: RecordPage;
  };
 type Result_17 = 
  variant {
    Err: Error;
-   Ok: PrivateMetrics;
+   Ok: Page_5;
  };
 type Result_16 = 
  variant {
    Err: Error;
-   Ok: OpeningCounts;
+   Ok: vec OpenedEngram;
  };
 type Result_15 = 
  variant {
    Err: Error;
-   Ok: ReferralCounts;
+   Ok: Page_3;
  };
 type Result_14 = 
  variant {
    Err: Error;
-   Ok: opt text;
+   Ok: Page_2;
  };
 type Result_13 = 
  variant {
    Err: Error;
-   Ok: Page_6;
+   Ok: Page_1;
  };
 type Result_12 = 
  variant {
    Err: Error;
-   Ok: Page_5;
+   Ok: Page;
  };
 type Result_11 = 
  variant {
    Err: Error;
-   Ok: vec OpenedEngram;
+   Ok: vec text;
  };
 type Result_10 = 
  variant {
    Err: Error;
-   Ok: Page_3;
+   Ok: CustodyMode;
  };
 type Result_1 = 
  variant {
@@ -164,6 +211,31 @@ type Result =
    Err: Error;
    Ok;
  };
+type RestartTotals = 
+ record {
+   advanceOutstanding: nat;
+   advancePaid: nat;
+   advanceReturned: nat;
+   advanceWrittenOff: nat;
+   lent: nat;
+   outstanding: nat;
+   repaid: nat;
+   writtenOff: nat;
+ };
+type RestartStatus = 
+ record {
+   loanOwed: nat;
+   nextRestartAtNs: opt int;
+   openUntilNs: opt int;
+ };
+type RestartReply = 
+ record {
+   engramTold: bool;
+   installError: opt text;
+   lentCycles: nat;
+   securityInstalled: bool;
+   updateWaiting: bool;
+ };
 type ReserveGateConfig = 
  record {
    enabled: bool;
@@ -184,6 +256,14 @@ type ReferralCounts =
    openedThroughParentLive: nat;
    throughParent: PairedSoon;
  };
+type RecordPage = 
+ record {
+   hashFirstFrom: nat;
+   items: vec AuditEntry;
+   ringFloor: nat;
+   sealed: vec SealedEntry;
+   total: nat;
+ };
 type PrivateMetrics = 
  record {
    activeEngrams: nat;
@@ -352,6 +432,23 @@ type EngramRecordView =
    owner: principal;
    status: EngramStatus;
  };
+type EngramComputeView = 
+ record {
+   cycles: nat;
+   eraseAboutNs: opt int;
+   frozen: bool;
+   idlePerDay: nat;
+   line: nat;
+   quiet: bool;
+   restartOpenUntilNs: opt int;
+   runState: variant {
+               running;
+               stopped;
+               stopping;
+             };
+   thresholdSecs: nat;
+   updateWaiting: bool;
+ };
 type EngagementRow = 
  record {
    abandonedDay: opt int;
@@ -418,6 +515,11 @@ type CertifiedStanding =
    leaf: StandingLeaf;
    witness: blob;
  };
+type CertifiedBirth = 
+ record {
+   certificate: opt blob;
+   witness: blob;
+ };
 type CertifiedAuditHead = 
  record {
    certificate: opt blob;
@@ -469,9 +571,11 @@ type AnchorView =
  };
 type AnchorStats = 
  record {
+   engramChainsAnchored: opt nat;
    engramsAnchored: nat;
    engramsWithConflicts: nat;
    lastAnchorAtNs: opt int;
+   lastEngramAnchorAtNs: opt int;
    totalAnchors: nat;
  };
 type AnchorConflict = 
@@ -551,7 +655,7 @@ service : {
   /// Contrast `backupFinalize`, which does NOT verify its digest. These two look like the same
   /// protocol and are not, and the difference matters most on this one: it decides what code every
   /// engram in the fleet will run.
-  engramWasmFinalize: (hash: text) -> (Result_4);
+  engramWasmFinalize: (hash: text) -> (Result_7);
   /// Chunked WASM upload — for WASMs that exceed single-call ingress limits.
   /// Flow: engramWasmInit → engramWasmPushChunk (×N) → engramWasmFinalize(hash)
   /// ⟨0.16.0 — CORRECTED 2026-08-19⟩ This line named all THREE pre-rename methods, none of which
@@ -566,7 +670,7 @@ service : {
   /// and total bytes over the cap. Neither is recoverable by pushing again — call `engramWasmInit`
   /// to clear and begin afresh. The messages say so because a caller who retries a chunk against a
   /// full buffer will retry forever.
-  engramWasmPushChunk: (chunk: blob) -> (Result_4);
+  engramWasmPushChunk: (chunk: blob) -> (Result_7);
   /// Fleet cycle-health scan. Admin or metrics-viewer, PAGINATED with a hard max of 50 per page —
   /// each managed engram costs one `canister_status` await, so pages stay small to bound the
   /// message. A caller must expect to iterate.
@@ -595,7 +699,7 @@ service : {
   /// this one is a noun. That gate now reads the census's L7 citations as a second population for
   /// exactly this blind spot.⟩
   fleetCycleHealth: (offset: nat, limit: nat, thresholdCycles: nat) ->
-   (Result_21);
+   (Result_28);
   /// PUBLIC: ⟨0.16.0, L2.4⟩ `fleetSummary` — the ONE public projection of this registry,
   /// replacing `status()` and ABSORBING `publicMetrics()`.
   /// 
@@ -699,7 +803,7 @@ service : {
   /// is the agent's ROOT principal — the identity an owner sees as `root` on each key in their own
   /// `listAgents`. "The agent itself" is a caller holding that root key. A key for one engram has no
   /// record of its own here; asking about one gets the refusal or, from the key itself, `#NotFound`.
-  getAgentStanding: (agent: principal) -> (Result_20) query;
+  getAgentStanding: (agent: principal) -> (Result_27) query;
   /// Fleet-wide anchoring liveness. Exists because ABSENCE is otherwise uninformative: an engram
   /// that never wrote, one still on a template without the push, and one whose push is broken all
   /// render as an empty getAnchors. Nothing distinguishes the first from the third, so a silently
@@ -709,6 +813,12 @@ service : {
   /// alive SOMEWHERE, which is what makes an individual engram's silence interpretable.
   /// 
   /// PUBLIC: the same reader who needs the anchors needs to know whether to believe their absence.
+  /// 
+  /// ⟨2026-10-11⟩ The ring also holds the TREASURY ANCHORER's chain (`getTreasuryAnchorId`), and
+  /// `engramsAnchored`, `totalAnchors` and `lastAnchorAtNs` count it as one more chain. The
+  /// engram-only pair leaves it out: `engramChainsAnchored` (always present on a registry that
+  /// serves it, 0 when no engram has anchored) and `lastEngramAnchorAtNs`. Read those to ask
+  /// whether ENGRAMS are anchoring — an active money chain must not stand in for them.
   getAnchorStats: () -> (AnchorStats) query;
   /// PUBLIC: the chain head exists to be compared, so an external monitor can detect tampering
   /// without admin access (D3). A head only whoever runs this deployment can read witnesses nothing.
@@ -746,6 +856,20 @@ service : {
   /// instead of trusting this replica, and a proof that requires a role to fetch rests on exactly
   /// the authority it was introduced to remove.
   getCertifiedAuditHead: () -> (CertifiedAuditHead) query;
+  /// The certified proof that a birth record's FINGERPRINT is in this registry's tree ⟨2026-10-26, the
+  /// owner's lineage ruling L3A⟩ — the half of an engram's birth chain the engram cannot give itself.
+  /// 
+  /// PUBLIC: a proof a caller had to hold a role to fetch rests on the authority it was meant to
+  /// replace. It reveals only whether a fingerprint is present: the key is a salted hash (the record's
+  /// random secret is inside it) and the value a constant. Whoever holds the record — the engram's
+  /// owner, or whomever the owner showed it to — already knows the fingerprint; nobody else can ask
+  /// about a record they cannot guess.
+  /// 
+  /// Verify as for `getCertifiedAnchor`, path ["births", <fingerprint>], leaf bytes = [0x01] (the
+  /// client's `verifyBirthChain` does it for a whole chain). `null` when absent, as `getCertifiedAnchor`
+  /// answers: there is no certified absence proof (spec question Q8). A `fingerprint` that is not 32
+  /// bytes is never a fingerprint, and answers `null` before the lookup.
+  getCertifiedBirth: (fingerprint: blob) -> (opt CertifiedBirth) query;
   /// The ATTESTABLE custody-mode fact (agent-native model item 19): "managed" | "sovereign" |
   /// "unknown", derived from the registry's OWN transition records (claimSovereignty /
   /// returnToManaged maintain sovereignEngramIds) — NOT from a canister_status probe, which needs
@@ -768,7 +892,7 @@ service : {
   /// 
   /// Derived from records, never probed: a canister_status call would trap for exactly the
   /// canisters we are not the controller of, i.e. the sovereign ones this read exists to identify.
-  getCustodyMode: (canisterId: principal) -> (Result_5) query;
+  getCustodyMode: (canisterId: principal) -> (Result_10) query;
   /// Cycles-health probe — slim, cycles-only shape; the money fields moved to the cashier's
   /// getCycleReserveStatus. Read by health-alert.mjs in registry mode.
   /// 
@@ -798,6 +922,9 @@ service : {
   /// on two canisters is what a hand-written client cannot tell apart (a structural actor type
   /// matches either target), so it gets the rule `getMarketCanister` already follows: distinct
   /// names on distinct canisters. `…Of` says what the argument is for.
+  /// 
+  /// ⟨2026-10-13⟩ The engram no longer serves `getEngramNumber` at all: its copy of the number went
+  /// with the genesis seed, so this is the one read of an engram's number.
   getEngramNumberOf: (canisterId: principal) -> (opt nat) query;
   /// ⟨2026-10-01, the owner's ruling of that day (2 A)⟩ What a lasting key opened through a parent:
   /// the engram, the engram it was opened from, and the cut-off's time if there is one. GATED:
@@ -806,7 +933,7 @@ service : {
   /// same words whether or not the key opened anything, so the refusal tells a stranger nothing.
   /// `#NotFound` only to a permitted reader, for a key that opened nothing: a true answer, like
   /// `listMyAgentDisputes`'s empty list.
-  getEngramOpenedThrough: (key: principal) -> (Result_19) query;
+  getEngramOpenedThrough: (key: principal) -> (Result_22) query;
   /// The i-th 1 MiB slice of the attested engram wasm (0-indexed). The caller reassembles all
   /// chunks in order and MUST verify sha256(reassembled) == getEngramWasmHash before installing —
   /// the hash is the attestation; the bytes are a convenience. Out-of-range index → empty blob.
@@ -817,16 +944,27 @@ service : {
   /// its hash. A reassembler that reads `""` as end-of-stream cannot tell a finished download from
   /// a truncated one, so it would hash a partial wasm and report a mismatch against the official
   /// list, which reads as "this template is unofficial" rather than "I stopped reading too early".
-  getEngramWasmChunk: (index: nat) -> (Result_18) query;
+  getEngramWasmChunk: (index: nat) -> (Result_26) query;
   /// The stored template's release class — FREE and UNGATED, because it is the checkable half of a
-  /// promise made to people who are not our customers. Pair it with getRentStatus to verify the
-  /// funding rule was applied: #Security funds every reachable engram; #Feature funds metered ones.
+  /// promise made to people who are not our customers. ⟨2026-10-25⟩ The funding rule it checks:
+  /// #Security — the registry pays for the install on every running engram it can reach, any size;
+  /// #Feature — the registry pays for no install, and each engram runs it on its own compute. (Was:
+  /// "pair it with getRentStatus … #Feature funds metered ones" — rent no longer enters it.)
   /// PUBLIC: ⟨0.16.0, L3⟩ The release class as a VARIANT, not a stringly-typed enum.
   /// 
   /// It returned "security" or "feature" as `Text`, so every consumer compared strings and no
   /// compiler anywhere could catch a typo or a third class arriving. A variant makes the set closed
   /// and the comparison checked — and this value gates whether an upgrade is funded, so a caller
   /// that silently fails to match "security" funds nothing and reports no error.
+  /// ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A: "pay whenever the engram is
+  /// missing any security release, whatever the latest release is labelled"⟩ "#Feature — the
+  /// registry pays for no install" no longer holds for every engram: an engram still missing an
+  /// earlier security release is paid as a security update even while this reads #Feature, because
+  /// the current template carries that fix (UpgradeFunding.effectiveClass) — unless the current
+  /// template is itself behind a security release (an older build re-uploaded), which cannot deliver
+  /// the fix. An engram missing no security release is still never paid for a #Feature install.
+  /// So this value is the declared label, not the whole funding rule: the `upgrade.topUp` audit line
+  /// says `class=Security declared=Feature` when the two differ.
   getEngramWasmClass: () -> (ReleaseClass) query;
   /// The WASM hash of the engram template this registry will install.
   /// 
@@ -848,7 +986,7 @@ service : {
   /// So L7's "the denial-logging motive for update-for-read is retired by L1" does not hold at this
   /// site. L1 retired the motive of trapping-to-refuse; it did not give queries the ability to
   /// write, which is the thing this actually depends on.
-  getFleetMetrics: () -> (Result_17);
+  getFleetMetrics: () -> (Result_25);
   /// PUBLIC: a genesis note that only privileged callers could read would defeat its purpose —
   /// the reader who most needs it is the stranger deciding whether to trust this chain.
   getGenesisNote: () -> (GenesisNote) query;
@@ -903,6 +1041,16 @@ service : {
   /// so a caller can hold a reservation with no engram. Seeing it here is what tells them to retry
   /// provision rather than reserve again.
   getMyReservation: () -> (opt ReservationView) query;
+  /// CALLER: the app's restart sheet, for the owner (ADR-0020). What the caller's engram owes from a
+  /// restart, when the next restart is allowed, and whether one is open. Refused loudly to anyone
+  /// with no engram here — never "0 owed" to a caller it cannot answer for (ADR-0002).
+  /// ⟨2026-10-26⟩ `openUntilNs` now reads the open restart's `finishByNs` (`restartsOpen`): when the
+  /// call or the sweep will have started the engram. Shape unchanged.
+  /// ⟨CORRECTED 2026-10-26, later — the owner's restart choice 2A: "apply the weekly limit only when
+  /// we lend"⟩ "when the next restart is allowed" now reads "when the registry can next LEND to a
+  /// restart": `nextRestartAtNs` is only the weekly limit on a loan. A restart on the owner's own
+  /// compute is allowed now, whatever it says. Field name and shape unchanged.
+  getMyRestartStatus: () -> (Result_24) query;
   /// ⟨2026-10-02⟩ How many engrams were ever opened, and how — lifetime sizes of state this registry
   /// never deletes, plus the two counters of refused openings (`Funnel.OpeningCounts` names each).
   /// All O(1); a reader differences them day to day.
@@ -911,7 +1059,22 @@ service : {
   /// grant). Anyone else is REFUSED by name with their class — never a zero, which would read as
   /// "nothing was ever opened". A QUERY: counts only, and cheap; its refusal is not in the denial
   /// log (`denied` says why a query cannot write).
-  getOpeningCounts: () -> (Result_16) query;
+  getOpeningCounts: () -> (Result_23) query;
+  /// Where an engram was opened from ⟨2026-10-26, the owner's lineage ruling L4: "a child reads its own
+  /// parent by its canister id"⟩: the engram, the engram it was opened from, and the cut-off's time if
+  /// there is one. Closes "a handed-on child cannot read its own parent" — `getEngramOpenedThrough` is
+  /// keyed by the lasting key that OPENED the engram, which a new owner does not hold.
+  /// 
+  /// CALLER: the engram's CURRENT owner, the current owner of the engram it was opened from, or this
+  /// registry's admin and audit viewers (ADR-0020). Reuses `parentOf`; no new state. The two owners are
+  /// answered first; anyone else goes through the registry's combinator (`#adminOrViewer`), which
+  /// refuses every other caller in the same words whether or not the id is an engram, so a refusal
+  /// tells a stranger nothing. A QUERY, so the refusal is not written to the denial log (`denied`
+  /// says why a query cannot write).
+  /// `#NotFound` only to a permitted reader: a first engram has no parent (a true answer), and an id
+  /// this registry never opened is said to be one, not passed off as a first engram (ADR-0002).
+  /// L8C: `listChildrenOf` is unchanged. L7B: the change-of-owner gate is unchanged.
+  getParentOf: (child: principal) -> (Result_22) query;
   /// ⟨2026-10-02⟩ How far agents reach across owners — COUNTS ONLY: agents by how many trees their
   /// record spans (1 · 2 · 3–4 · 5+), engrams opened through a parent that are live or cut off, and
   /// engrams that paired an agent within seven days of opening. No principal, no row, no per-agent
@@ -923,7 +1086,7 @@ service : {
   /// CALLERS: the admin and the audit viewers (the deployment's metrics reader holds a viewer grant),
   /// weekly. Anyone else is REFUSED by name with their class — never zeros. A QUERY: its cost grows
   /// with the agents and engrams it walks (one pass over each), so a reader asks weekly, not hourly.
-  getReferralCounts: (exclude: vec principal) -> (Result_15) query;
+  getReferralCounts: (exclude: vec principal) -> (Result_21) query;
   /// PUBLIC: the biller identity is an operational fact a
   /// payer's cashier must verify BEFORE taking money (paying into a cashier the registry does not
   /// recognize as biller would collect funds it cannot convert into credit).
@@ -943,11 +1106,37 @@ service : {
   /// stranger can sign up at all. An admission rule only the admitted can read is not a rule a
   /// prospective user can act on.
   getReserveGateConfig: () -> (ReserveGateConfig) query;
+  /// PUBLIC: CALLER: the status page (ADR-0020). What the registry has lent to restart stopped engrams
+  /// — lent, repaid, written off, outstanding — and what engrams gave back of the compute a paid
+  /// security update advanced them (returned, written off). Ungated, because a subsidy we would not
+  /// publish is one we should not spend. `getUpgradeSubsidyTotal` stays the gross figure.
+  /// ⟨2026-10-26, the owner's ruling "write it off, but accounting should be exact"⟩ Two exact
+  /// identities hold between any two messages: lent = repaid + writtenOff + outstanding, and
+  /// advancePaid = advanceReturned + advanceWrittenOff + advanceOutstanding.
+  /// ⟨2026-10-26, later — the owner's restart choice 4A: "add the release name to each write-off
+  /// record. This needs no new storage."⟩ These totals are fleet-wide. PER RELEASE, read the audit
+  /// chain: every line that moves an advance names the release it was paid for, `template=<module
+  /// hash>` (and `version=` when the release history names one) — `upgrade.topUp` (paid, `added=`),
+  /// `upgrade.advance.returned` (`returned=`, `writtenOff=`) and `upgrade.advance.writtenOff`
+  /// (`writtenOff=`, including the 90-day write-off of an advance left outstanding, restart choice 5A).
+  /// Summed by `template=`, they give each release's paid, returned and written-off figures exactly;
+  /// what is still out per release is paid − returned − written off. Restart-loan lines are not per
+  /// release (a loan pays for no release).
+  /// ⟨CORRECTED 2026-10-26, later — the fix pass (the ledger review)⟩ "exactly" holds only over a
+  /// COMPLETE copy of the audit chain. The registry keeps the most recent 10,000 audit entries
+  /// (AuditLog's `MAX_ENTRIES`; on overflow it drops back to 9,000, oldest first), and a give-back or
+  /// a 90-day write-off can land long after its `upgrade.topUp` line was dropped. A per-release sum
+  /// read from the registry alone can therefore miss lines. Exact per-release figures need an archive
+  /// of the chain kept from the first line on (scripts/audit-chain/monitor.mjs `--archive`); whether
+  /// such an archive is kept durably is an operator's choice, not this registry's. The fleet totals
+  /// this method answers are exact regardless.
+  getRestartTotals: () -> (RestartTotals) query;
   /// PUBLIC: transparency without a doxx — how many principals the deployment currently screens (0 = seam
   /// disarmed, the shipped default). The list itself is never enumerable publicly.
   getScreeningDenylistSize: () -> (nat) query;
   /// How many engram template releases this registry has declared `#Security` — the class that
-  /// skips any delay and is funded for every engram. ⟨2026-09-28, owner decision: publish the
+  /// skips any delay and whose install the registry pays for on every running engram (⟨2026-10-25⟩
+  /// was "is funded for every engram"). ⟨2026-09-28, owner decision: publish the
   /// count only; the status page shows the number.⟩ It moves only when a template's class is
   /// declared INTO `#Security` (`setEngramWasmClass`), never on `#Feature`, never down.
   /// ⟨CORRECTED 2026-09-29⟩ It counts TEMPLATES, not declarations: each distinct template (by its
@@ -1004,9 +1193,14 @@ service : {
   /// `?Text` had to carry both "you may not ask" and "this engram was never funded for an upgrade"
   /// — and the second is a claim about OUR OWN SPEND, not an absence of one. `#Ok(null)` now means
   /// never funded, `#Err(#Refused)` means not your business, and no caller has to guess which.
-  getUpgradeFundedTemplate: (canisterId: principal) -> (Result_14) query;
-  /// Cumulative cycles the registry has granted to engrams for upgrades — the meter on the
-  /// never-gated pull path.
+  getUpgradeFundedTemplate: (canisterId: principal) -> (Result_20) query;
+  /// Cumulative cycles the registry has granted to engrams for upgrades — ⟨2026-10-25⟩ the meter on
+  /// security-update funding: the registry pays only for security updates on running engrams (was:
+  /// "the meter on the never-gated pull path"; the pull is still never refused, and a feature update
+  /// it installs is not paid for).
+  /// ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A⟩ "a feature update it installs is
+  /// not paid for" now excepts an engram still missing an earlier security release: that install is
+  /// paid as a security update and counted here (UpgradeFunding.effectiveClass).
   /// 
   /// PUBLIC: a subsidy we would not publish is one we should not spend. Free and ungated.
   getUpgradeSubsidyTotal: () -> (nat) query;
@@ -1056,7 +1250,7 @@ service : {
   /// `[]` here is a SUBSTANTIVE CLAIM ABOUT ANOTHER PRINCIPAL'S FLEET — "this agent works
   /// nowhere" — handed to a caller who merely lacks a grant. Readable by an admin, an audit viewer,
   /// or that agent about itself.
-  listAgentEngrams: (agent: principal) -> (Result_12) query;
+  listAgentEngrams: (agent: principal) -> (Result_17) query;
   /// Contradictory submissions, oldest-first. Empty is the normal case. Never trimmed.
   /// 
   /// ⟨0.16.0, L3 — PAGED 2026-08-18⟩ This returned the WHOLE list, and the list is one an engram
@@ -1084,7 +1278,7 @@ service : {
   /// while keeping the evidence that two of them disagree — the fabricate-on-refusal shape aimed at
   /// the one reader the anchors exist for.
   listAnchorConflicts: (canisterId: principal, start: nat, limit: nat) ->
-   (Result_13) query;
+   (Result_19) query;
   /// Witnessed heads for an engram, oldest-first. PUBLIC and ungated — an anchor a stranger cannot
   /// read is not an anchor (ratified: "recorded where counterparties can check them").
   /// 
@@ -1137,7 +1331,17 @@ service : {
   /// 
   /// The inline record dies for a `Page`: `earliestId` was redundant with the ring's own paging,
   /// and `size`/`headHash` are `getAuditHead`'s answer, published free to everyone.
-  listAuditEntries: (start: nat, limit: nat) -> (Result_10) query;
+  /// 
+  /// ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ The reply is the shared `Wire.RecordPage`,
+  /// the shape every chain canister's record read now serves, so one checker reads all of them. A
+  /// viewer sees every entry, so `sealed` is always empty here; what the page adds is `ringFloor`
+  /// (where the ring starts — a `start` below it begins at it) and `hashFirstFrom` (where this
+  /// record switched to the hash-first rule: entries below it were hashed SHA-256(prev ‖ body)).
+  /// `total` is now the head counter, as everywhere else — it was the size of the 1,000-entry window
+  /// this read sliced, which is not a number about the record. The gate is unchanged: hash-only rows
+  /// for strangers were ruled for the engram's record, and the status console decides a signed-in
+  /// visitor's tier by whether this read refuses.
+  listAuditEntries: (start: nat, limit: nat) -> (Result_18) query;
   /// ⟨0.16.0, L2.2⟩ RENAMED from `getMetricsViewers` — the viewer triple unifies on "audit viewer"
   /// across every canister, because a roster that grants audit reads should not be named after
   /// metrics on one canister and audit on another.
@@ -1145,7 +1349,7 @@ service : {
   /// MEASURED FABRICATION, kept in the record: this arm answered `(vec {})` to an ANONYMOUS caller
   /// on 2026-08-11 while viewers existed. An empty vec reads as "nobody holds read-only ops access"
   /// when the truth was "you are not on the roster".
-  listAuditViewers: () -> (Result_12) query;
+  listAuditViewers: () -> (Result_17) query;
   /// PUBLIC: the release history, paged.
   /// 
   /// ⟨0.16.0, L2.1⟩ A `Page`, not a bare vec. The old shape returned the WHOLE changelog on every
@@ -1163,13 +1367,13 @@ service : {
   /// 
   /// Built by a pass over `parentOf` rather than from a second, reverse index: one stored fact and a
   /// pass bounded by the number of opened engrams, instead of two facts to keep in step.
-  listChildrenOf: (engram: principal) -> (Result_11) query;
+  listChildrenOf: (engram: principal) -> (Result_16) query;
   /// ⟨0.16.0⟩ RENAMED from `readDenialLog`; the refusal becomes a value.
   /// 
   /// An empty denial log reads as NOBODY HAS EVER BEEN REFUSED HERE, which is the opposite of what
   /// this log exists to record — so "empty" was never an acceptable answer to a caller who simply
   /// lacks the grant. The old trap said so; this says the same thing as data.
-  listDenialEntries: (start: nat, limit: nat) -> (Result_10) query;
+  listDenialEntries: (start: nat, limit: nat) -> (Result_15) query;
   /// ⟨2026-10-02⟩ ONE ROW PER ENGAGEMENT, for the deployment's own count of use — DAYS, never
   /// instants, and NEVER the agent's root, enrolled key or invite.
   /// 
@@ -1194,7 +1398,7 @@ service : {
   /// and a query cannot write (the reason `listEngrams` is an update). This is the most sensitive of
   /// the three reads — one row per engagement — so who was turned away is worth a record.
   listEngagementRows: (sinceDay: int, start: nat, limit: nat, companyList:
-   vec principal) -> (Result_9);
+   vec principal) -> (Result_14);
   /// ⟨0.16.0, L1⟩ THE `authorized : ?Bool` FLAG IS GONE, AND SO IS EVERYTHING BUILT AROUND IT.
   /// 
   /// The flag was the most carefully-argued compromise in this canister, and every word of that
@@ -1225,7 +1429,7 @@ service : {
   /// written and correct; what it lacked was the glyph a gate can see. Its case is the one L7's
   /// own text had to be corrected for — the forcing call is not a system API at all, it is
   /// `denied()`, a state write. See `scripts/check-update-for-read.mjs`.
-  listEngrams: (offset: nat, limit: nat) -> (Result_8);
+  listEngrams: (offset: nat, limit: nat) -> (Result_13);
   /// ⟨2026-09-28, owner decision: an agent may read its own record⟩ The caller's OWN dispute
   /// statements, oldest first, verbatim. Keyed by `msg.caller`, so it cannot be pointed at anyone
   /// else, and an empty list is a true answer about the caller ("you have appended none"), never a
@@ -1272,10 +1476,10 @@ service : {
   /// that zero applies the SHIPPED DEFAULT — silently reversing every explicit ManualOnly consent
   /// choice in the fleet. That is the consequence this refusal exists to prevent, and it belongs in
   /// the message a caller actually receives.
-  listUpdatePrefs: (start: nat, limit: nat) -> (Result_7) query;
+  listUpdatePrefs: (start: nat, limit: nat) -> (Result_12) query;
   /// Mint one-shot reserve invites (invite-issuer or admin). Codes use IC-secure randomness over a
   /// 32-symbol no-ambiguous alphabet (8 chars ≈ 40 bits). Batch-capped; table hard-capped.
-  mintReserveInvites: (count: nat) -> (Result_6);
+  mintReserveInvites: (count: nat) -> (Result_11);
   /// The PROBED twin of `getCustodyMode`: same question, asked of the IC rather than of our
   /// records — hence the `probe` verb rather than a second noun.
   /// 
@@ -1301,22 +1505,39 @@ service : {
   /// `ic.canister_status`. That is also the whole point of the `probe` verb — the value is read
   /// LIVE from the management canister rather than from a stored transition record, so a query
   /// could not produce it at all, not merely more cheaply.
-  probeCustodyMode: () -> (Result_5);
+  probeCustodyMode: () -> (Result_10);
+  /// What YOUR OWN engram's compute is, read by the registry — the one read that works while it is
+  /// frozen.
+  /// 
+  /// CALLER: the owner, from the app's status strip, Billing and System pages (ADR-0020).
+  /// ⟨2026-10-26, the owner's ruling 1A: tell the owner, using signals that work while frozen⟩ The
+  /// registry is a controller, and the network answers a controller canister's status call for a
+  /// frozen engram where it refuses the owner's own (IC0207, the stopped-engram study's network read
+  /// §6). UPDATE, not query: it awaits the management canister (the `probe` verb, as
+  /// `probeCustodyMode`).
+  /// ⟨L7⟩ ⟨marker added 2026-10-26, Finish phase; the reason above unchanged⟩ The system call that
+  /// forces the update is `canister_status` on the management canister: a query cannot make an
+  /// inter-canister call, so a query could not read the engram's network status at all — and that
+  /// status is the only signal that still answers while the engram is frozen.
+  /// No rate limit (the do-less): each call costs the registry one management
+  /// call — INFERRED a few million cycles, not measured. `eraseAboutNs` is "about" and never invented:
+  /// null when the network reports no idle burn.
+  probeMyEngramCompute: () -> (Result_9);
   /// ⟨0.16.0⟩ `Ok` CARRIES THE PRINCIPAL DIRECTLY, not a one-field record wrapping it.
   /// 
   /// `#Ok : { canisterId : Principal }` was a record with nothing to disambiguate: the success of a
   /// spawn IS the canister it produced. The wrapper cost every caller a field access to reach the
   /// only thing the call returns, and invited a second field later that would belong somewhere else.
+  /// 
+  /// ⟨2026-10-13, the owner's 6A⟩ `opts.genesis` (an optional first file, written as the canister
+  /// spawned) is retired: the console creates an engram with no content (decision 2 B(b),
+  /// 2026-09-30), the owner kit never calls this, and only test harnesses passed one. A caller still
+  /// sending the field is unaffected — Candid ignores a record field the receiver does not declare.
   provisionEngram: (opts:
-   opt
-    record {
-      genesis: opt record {
-                     content: blob;
-                     path: text;
-                   };
-      invite: opt text;
-      walletProof: opt blob;
-    }) -> (Result_1);
+   opt record {
+         invite: opt text;
+         walletProof: opt blob;
+       }) -> (Result_1);
   removeAuditViewer: (viewer: principal) -> (Result);
   /// ⟨0.16.0⟩ `Ok` IS THE ANSWER — the `{ reserved : Bool }` wrapper is gone.
   /// 
@@ -1328,6 +1549,66 @@ service : {
          invite: opt text;
          walletProof: opt blob;
        }) -> (Result);
+  /// Admin (the wasm admin): give one grown engram's working memory back, in place. The engram's
+  /// stable graph is copied into its stable memory and the SAME module is reinstalled with
+  /// `wasm_memory_persistence = ?#replace`, so the engram restarts in a fresh, small wasm memory with
+  /// every file, version, record entry, setting and key it had (MemoryReset.mo).
+  /// 
+  /// REFUSES, and changes nothing, when: the caller is not the wasm admin; the registry does not know
+  /// the engram; a change of owner or a restart is open; its status cannot be read (a sovereign engram);
+  /// it is not running; it is not on the current template; its wasm memory is under
+  /// `MemoryReset.WASM_FLOOR_BYTES` (nothing to give back — and so a second reset straight after a
+  /// first); its balance is short of the install hold above its own freezing line (no dip, no deposit);
+  /// or one of its own calls is in flight ("Busy, try again").
+  /// 
+  /// WHO PAYS: the engram, as for any install — `install_code` is charged to the canister it installs
+  /// on, and the stabilise / rebuild steps are the engram's own messages. The registry deposits
+  /// nothing; it pays only for its own calls. Two installs run: an ordinary one of the same module
+  /// first, which is the network's test for a call in flight while nothing is yet at stake, then the
+  /// replace.
+  /// 
+  /// ONCE STARTED it finishes or says the engram is HELD: between the stabilise call and the replace
+  /// install the engram refuses every message, so a failure there answers `#Unavailable` naming the
+  /// step, and running this method again picks up where it stopped (it reads the held state from the
+  /// engram itself). Do not publish a new template while a reset is held.
+  /// 
+  /// Never run on production engrams (the owner's ruling). On the staging network, as the wasm admin,
+  /// with the engram's canister id in ENGRAM:
+  ///     icp canister call registry-staging resetEngramMemory "(principal \"$ENGRAM\")" -e ic
+  resetEngramMemory: (canisterId: principal) -> (Result);
+  /// Restart YOUR OWN stopped engram.
+  /// 
+  /// CALLER: the owner, from the app's restart sheet (ADR-0020). Afterwards the app runs the engram's
+  /// own `convertEarningsToCycles` as the owner, which pays any loan back FIRST.
+  /// 
+  /// ⟨REWRITTEN 2026-10-26, the owner's ruling 2A of that day⟩ What it does, in this order: stops the
+  /// engram; adds compute — the owner's own (already added through `stopMyEngramForRestart` and a
+  /// top-up from their account), or a loan of what it still lacks to run at its OWN setting (at most
+  /// 0.25T, only after the biller confirms the wallet holds enough to repay it); installs the waiting
+  /// security release if the engram is behind one and the owner allows automatic updates (paid as a
+  /// security update — we pay because we do not want security incidents); puts the owner's freezing
+  /// setting back; and only then starts it. It never lowers the setting on a running engram. A step
+  /// that fails never leaves the engram stopped: the registry's sweep finishes it within minutes.
+  /// 
+  /// Refused BEFORE anything is stopped, saying why: not your engram; sovereign; a change of owner
+  /// unfinished; restarted in the last 7 days; a loan still owed; an update installing; a restart
+  /// already running; code the registry never published; running (nothing to restart); needing more
+  /// than one loan; a waiting security update that this restart could not cover (it would start old
+  /// code); an engram opened through another engram that would need a loan; the fleet-wide ceiling;
+  /// no biller, or a wallet too low to repay. A restart that lent nothing does not spend the week.
+  /// ⟨CORRECTED 2026-10-26, later — the owner's restart choices 1A and 2A of that day⟩ The list above is
+  /// the record of the build before them. Now: "restarted in the last 7 days" and "a loan still owed"
+  /// refuse ONLY a restart that would LEND (2A: "apply the weekly limit only when we lend") — asked
+  /// once the plan knows the loan, and again after every await before the loan is made
+  /// (`RestartLoan.lendGate`); a restart on the owner's own compute is never refused by them and never
+  /// spends the week, which is taken only in the step that records a loan. "An engram opened through
+  /// another engram that would need a loan" is GONE (1A: "lend to children like any other engram") —
+  /// such an engram is lent to under the same ceiling, wallet check and repay-first as any other: the
+  /// biller reads the engram's OWN wallet by its own id, and the engram's own Convert repays. New: a
+  /// second call while one is still running for the same engram (`restartCallsRunning`), which is
+  /// what now keeps two interleaved calls from both lending or both stopping and starting — the week
+  /// used to double as that guard.
+  restartMyStoppedEngram: () -> (Result_8);
   /// Return to managed: user calls AFTER adding registry back as controller
   returnToManaged: () -> (Result);
   /// Set admin. Authority decision lives in the pure Auth module (unit-tested); this func keeps only
@@ -1379,7 +1660,7 @@ service : {
   /// Flip the reserve gate (admin-only; audit-logged). OFF restores fully-open admission.
   setReserveGateEnabled: (enabled: bool) -> (Result);
   setScreeningDenylist: (list: vec principal) -> (Result);
-  setSpawnCeiling: (n: nat) -> (Result_4);
+  setSpawnCeiling: (n: nat) -> (Result_7);
   setTreasuryAnchorId: (p: opt principal) -> (Result);
   /// Set the wallet-canister allowlist for the wallet-rooted exemption (admin-only). Small by
   /// design — these are identity ISSUERS (e.g. Internet Identity), not users.
@@ -1395,9 +1676,19 @@ service : {
   /// bypasses the funding constraint.
   /// Admin dial for the upgrade top-up floor (0 = disabled). Capped at one endowment so the dial
   /// itself cannot turn upgrades into an unbounded drain.
-  setUpgradeTopUpFloor: (n: nat) -> (Result_4);
+  setUpgradeTopUpFloor: (n: nat) -> (Result_7);
   /// Root admin assigns the role key (pass null to clear, reverting the role to the root admin).
   setWasmAdmin: (p: opt principal) -> (Result);
+  /// Stop YOUR OWN stopped-or-starving engram so you can add compute from your account and restart it.
+  /// 
+  /// CALLER: the owner, from the app's "Add compute from my account" when the engram has stopped and a
+  /// security update is waiting (ADR-0020). ⟨2026-10-26, the owner's ruling 2A⟩ Stops the engram so
+  /// that compute the owner adds next cannot wake its old code; the owner then adds compute through
+  /// the biller's own top-up and calls `restartMyStoppedEngram`, which installs the waiting update and
+  /// starts it. If the owner walks away, the sweep finishes it after 30 minutes: install if covered,
+  /// restore, start. Never left stopped. It lends nothing, so it takes no week; it refuses an engram
+  /// that is not stuck, so a healthy engram is never taken offline (spec question Q15).
+  stopMyEngramForRestart: () -> (Result_6);
   /// An engram witnesses its own audit head. Callable ONLY by a registered engram — msg.caller is
   /// the engram principal, so attribution needs no signature and cannot be forged by a third party.
   /// 
@@ -1419,6 +1710,15 @@ service : {
   /// The market already calls it under this name, which is how the rename got its urgency: a
   /// hand-written client IDL type-checks against a method that does not exist.
   sysAnchorHead: (head: blob, total: nat) -> (Result);
+  /// CALLER: an engram, from inside its owner's `convertEarningsToCycles`, once the conversion landed
+  /// (ADR-0020). Attach up to what is owed: the registry accepts no more than the outstanding loan
+  /// (the network returns the rest) and records it. `#NotFound` when nothing is owed (the loan was
+  /// written off, or repaid): the engram then clears its own record.
+  /// ⟨CHANGED 2026-10-26, the owner's ruling 2A⟩ REPAY-ONLY. It no longer puts a freezing setting back
+  /// (the restart restores it before the start) and no longer queues a security push (the restart
+  /// installs it before the start; the wake watcher covers other wakes). The name and reply are
+  /// unchanged, so the engram's hand client still matches.
+  sysCloseRestart: () -> (Result_5);
   /// ⟨2026-09-29, review PR-3: a half-finished change of owner⟩ A SOVEREIGN engram reports that it
   /// moved control of its code to `newOwner`, which ends the change of owner this registry marked
   /// when it moved its record (`ControlHandover.Pending`). Until this arrives the registry refuses the
@@ -1437,7 +1737,7 @@ service : {
   /// Single-engram metering probe — the push-on-payment sizing read. Biller-gated and
   /// cycles-attached like the sweep; same row semantics, one engram, no heartbeat stamp
   /// (a single probe is not a completed round).
-  sysMeterEngram: (canisterId: principal) -> (Result_3);
+  sysMeterEngram: (canisterId: principal) -> (Result_4);
   /// ⟨2026-10-02⟩ An engram tells this registry that its owner reset it.
   /// 
   /// CALLER: a registered engram, about itself — `canisterToOwner` membership, checked first
@@ -1494,7 +1794,7 @@ service : {
   /// moved record and is refused. A report of the owner the registry already records is a RETRY of
   /// a transfer the engram did not finish, and moves control again (that is the way out `stuck`
   /// names). The rules are in `src/shared/ControlHandover.mo`.
-  sysNotifyOwnershipTransfer: (newOwner: principal) -> (Result_2);
+  sysNotifyOwnershipTransfer: (newOwner: principal) -> (Result_3);
   /// ⟨2026-09-28, owner decision: build the full agent track-record design for the launch release⟩
   /// An engram tells this registry that one of its agents started, or ended and WHY.
   /// 
@@ -1556,6 +1856,41 @@ service : {
                              event: EdgeEvent;
                              root: principal;
                            }) -> (Result);
+  /// CALLER: an engram, from inside its `sysReturnUpgradeAdvance` (ADR-0020). Attach what is being
+  /// given back of the compute a paid security update advanced it. The registry accepts no more than
+  /// the outstanding advance (the network returns the rest) and writes off whatever was not returned
+  /// — what the install used and what the engram had to keep — never carried as a debt.
+  /// ⟨2026-10-26, the owner's ruling "accounting should be exact"⟩ The write-off here is the exact
+  /// figure advance − accepted, from the ledger entry and the cycles actually accepted, and the audit
+  /// line carries advance, returned and writtenOff.
+  /// ⟨2026-10-26, later — the owner's restart choices 4A and 5A⟩ The engram may have more than one
+  /// advance out (one per release paid; RestartLoan.repayAdvances): the cycles are accepted up to their
+  /// sum and settled OLDEST FIRST, and each advance gets its own audit line naming the release it was
+  /// paid for (`template=`), with its own returned and written-off parts — the lines sum exactly to
+  /// `accepted` and to the write-off. AN ADVANCE ALREADY WRITTEN OFF (the 90-day sweep) IS NOT ON THE
+  /// LEDGER, so nothing sent for it is accepted — the network returns those cycles to the engram — and
+  /// `advanceReturned` never counts a written-off cycle: no double count. When nothing at all is out,
+  /// the reply is `#NotFound` and nothing is accepted (as before).
+  /// ⟨CORRECTED 2026-10-26, later — the fix pass on 4A⟩ NEWEST first, not oldest first: the engram can
+  /// give back only what it holds above its balance before the latest deposit, so the cycles are the
+  /// newest advance's (RestartLoan.repayAdvances says why, and when that reading is wrong).
+  /// ⟨CHANGED 2026-10-26, the owner's review choice 1B: "take back only what we added; anything left
+  /// over goes to the 90-day write-off"⟩ The engram now names THE ADVANCE it is giving back
+  /// (`advanceId`, which the registry handed it in `sysReturnUpgradeAdvance` — the one this install's
+  /// deposit put on the ledger). The registry accepts AT MOST THAT ADVANCE'S AMOUNT, settles THAT
+  /// entry alone (returned + written off = its amount, one `upgrade.advance.returned` line naming its
+  /// release and id) and leaves every other advance of the engram on the ledger, for its own
+  /// give-back or the 90-day write-off. The paragraphs above about "the sum", "settled OLDEST FIRST"
+  /// and "NEWEST first" describe the shape this replaces. An id that is not on the ledger for this
+  /// caller (already settled, written off after 90 days, or never its own) accepts nothing — the
+  /// network returns the attached cycles to the engram — and answers `#NotFound`; when a recorded
+  /// engram attached cycles, an `upgrade.advance.notOut` line in the registry's unchained refusal log
+  /// says so (never the chained audit log: it moves nothing, and any engram can send it). Nothing is
+  /// ever counted twice.
+  /// WHAT WOULD MAKE THIS WRONG: an engram naming an id other than the one it was handed — it can only
+  /// name one of its OWN advances (the caller must match), so the worst it can do is settle its own
+  /// other advance early with cycles that are still the registry's.
+  sysRepayUpgradeAdvance: (a: record {advanceId: nat;}) -> (Result_2);
   /// ⟨2026-09-29, owner ruling follow-up 8⟩ A SOVEREIGN engram could not change its own controllers
   /// after this registry moved its record, and asks for the record back so the transfer does not
   /// complete. Gated like `sysNotifyOwnershipTransfer` (the caller must BE the engram), and only for
@@ -1615,31 +1950,41 @@ service : {
   /// Admin: upgrade one engram to the current template. RESPECTS the owner's update preference —
   /// an engram set to `#ManualOnly` is not moved by this method, which is what makes the preference
   /// meaningful rather than advisory. The owner's own `upgradeMyEngram` is unaffected either way.
+  /// 
+  /// ⟨2026-10-25, the owner's ruling of that day⟩ Same funding decision and dip as the owner's pull:
+  /// paid only for a #Security update on a running engram. A push is the registry's own initiative,
+  /// so where the engram cannot hold the install even with its setting lowered, the push is SKIPPED
+  /// with `#Conflict` and not attempted — the owner can still pull it, and the pull is never refused.
   upgradeEngram: (canisterId: principal) -> (Result);
   /// Upgrade YOUR OWN engram to the registry's current template. Self-service — no admin, no
   /// queue, no approval.
   /// 
-  /// ⚠ THE PULL IS ALWAYS FUNDED, regardless of release class or rent state, and that is a
-  /// commitment rather than an implementation detail: `install_code` needs the balance to cover the
-  /// install ABOVE the freezing threshold, so the registry lifts the engram over that bar if cycles
-  /// are what is stopping it. Refusing an owner their own fix for nonpayment is the ransom the
-  /// continuity-rent model forbids, and withholding a security fix would be worse than anything
-  /// that model gates. The lift is best-effort: if it fails, the install still runs and returns the
-  /// REAL error, so a top-up problem can never masquerade as an upgrade problem or hide one.
-  /// ⟨2026-09-28, owner decision: the registry only pays for upgrades of engrams running our
-  /// published code⟩ One exception to "always funded": an engram whose installed module is not one
-  /// this registry published is not lifted (`fundUpgradeIfNeeded`, audit
-  /// `upgrade.topUp.unpublishedCode`). The install is still attempted — the owner is never refused
-  /// their fix, only our cycles for it.
-  /// ⟨2026-09-29⟩ And when that install then FAILS, the reply says why the registry did not pay and
-  /// what the owner can do (`TemplatePolicy.unfundedUpgradeFailure`) — before, the refusal was only
-  /// in the registry's own log and the owner saw a bare out-of-cycles error. Same reply type.
-  /// ⟨2026-10-01, the owner's ruling of that day (2 A)⟩ A second exception beside the first: an
-  /// engram opened through a parent (`parentOf`, written by `sysSpawnChild`) is funded by the
-  /// registry never — not at birth, not at an upgrade (`fundUpgradeIfNeeded`, audit
-  /// `upgrade.topUp.childEngram`). The install is still attempted; the owner is never refused their
-  /// fix, only our cycles for it, and a failed install says so
-  /// (`TemplatePolicy.childUnfundedUpgradeFailure`).
+  /// ⟨2026-10-25, the owner's ruling of that day⟩ THE INSTALL IS ALWAYS ATTEMPTED. Refusing an owner
+  /// their own update for nonpayment is the ransom the continuity model forbids, so this method never
+  /// refuses for compute or payment. What the registry PAYS for is narrower: a #Security update on a
+  /// running engram, any size — paid because we do not want security incidents (the owner,
+  /// 2026-10-25). A #Feature update runs on the engram's own compute. Four standing exclusions are
+  /// never paid for: an engram that has stopped (below its running line — it runs nothing, so its old
+  /// code is not exposed while stopped), one opened through a parent (the ruling of 2026-10-01), one
+  /// running a module the registry never published (2026-09-28), and a second deposit for the same
+  /// release.
+  /// ⟨CORRECTED 2026-10-26, the owner's rulings of that day⟩ THREE standing exclusions: an engram
+  /// opened through a parent is now paid for a security update like any other ("including child
+  /// engrams, but not including engrams running unofficial code"), and a #Feature update is never
+  /// paid, rent or no rent ("where rent is paid, feature upgrades are paid by the engram").
+  /// ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A: "pay whenever the engram is
+  /// missing any security release, whatever the latest release is labelled"⟩ "a #Feature update is
+  /// never paid" now excepts an engram still missing an earlier security release: its install of a
+  /// #Feature template is paid as a security update, because the template carries that fix
+  /// (UpgradeFunding.effectiveClass) — unless the template is itself behind a security release.
+  /// When it helps, the registry lowers the engram's freezing setting to one hour for the
+  /// install and puts the owner's value back after (the dip), so an install needs only ~0.32T above
+  /// an hour's burn rather than the hold above the whole 30-day line.
+  /// 
+  /// When the install FAILS after the registry declined to pay, the reply says why and what to do
+  /// (UpgradeFunding.pullFailure): `#Conflict` when the engram needs more compute (the owner's
+  /// action — add compute), `#Unavailable` when the registry could not pay this time (retryable).
+  /// A failure after a paid or unneeded deposit answers `#Unavailable` with the network's reply.
   /// 
   /// An engram already on the current template is a silent no-op. A SOVEREIGN engram gets
   /// "registry is no longer a controller" — accurate, because it is no longer ours to install on.