@engramx/idl 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/registry.idl.d.ts

@@ -22,8 +22,10 @@ export interface AnchorConflict {
 }
 export interface AnchorStats {
   lastAnchorAtNs: [] | [bigint];
+  lastEngramAnchorAtNs: [] | [bigint];
   engramsAnchored: bigint;
   totalAnchors: bigint;
+  engramChainsAnchored: [] | [bigint];
   engramsWithConflicts: bigint;
 }
 export interface AnchorView {
@@ -69,6 +71,10 @@ export interface CertifiedAuditHead {
   size: bigint;
   witness: [] | [Uint8Array | number[]];
 }
+export interface CertifiedBirth {
+  certificate: [] | [Uint8Array | number[]];
+  witness: Uint8Array | number[];
+}
 export interface CertifiedStanding {
   certificate: [] | [Uint8Array | number[]];
   leaf: StandingLeaf;
@@ -116,6 +122,18 @@ export interface EngagementRow {
   startedDay: bigint;
   engram: Principal;
 }
+export interface EngramComputeView {
+  restartOpenUntilNs: [] | [bigint];
+  idlePerDay: bigint;
+  line: bigint;
+  quiet: boolean;
+  eraseAboutNs: [] | [bigint];
+  cycles: bigint;
+  runState: { stopped: null } | { stopping: null } | { running: null };
+  thresholdSecs: bigint;
+  updateWaiting: boolean;
+  frozen: boolean;
+}
 export interface EngramRecordView {
   status: EngramStatus;
   owner: Principal;
@@ -254,6 +272,13 @@ export interface PrivateMetrics {
   totalEngrams: bigint;
   activeEngrams: bigint;
 }
+export interface RecordPage {
+  ringFloor: bigint;
+  total: bigint;
+  sealed: Array<SealedEntry>;
+  items: Array<AuditEntry>;
+  hashFirstFrom: bigint;
+}
 export interface ReferralCounts {
   firstOrReopened: PairedSoon;
   openedThroughParentLive: bigint;
@@ -270,28 +295,61 @@ export interface ReserveGateConfig {
   inviteIssuer: Principal;
   trustedSigners: Array<Principal>;
 }
+export interface RestartReply {
+  securityInstalled: boolean;
+  lentCycles: bigint;
+  updateWaiting: boolean;
+  installError: [] | [string];
+  engramTold: boolean;
+}
+export interface RestartStatus {
+  nextRestartAtNs: [] | [bigint];
+  loanOwed: bigint;
+  openUntilNs: [] | [bigint];
+}
+export interface RestartTotals {
+  repaid: bigint;
+  advanceOutstanding: bigint;
+  outstanding: bigint;
+  lent: bigint;
+  advanceReturned: bigint;
+  writtenOff: bigint;
+  advanceWrittenOff: bigint;
+  advancePaid: bigint;
+}
 export type Result = { Ok: null } | { Err: Error };
 export type Result_1 = { Ok: Principal } | { Err: Error };
-export type Result_10 = { Ok: Page_3 } | { Err: Error };
-export type Result_11 = { Ok: Array<OpenedEngram> } | { Err: Error };
-export type Result_12 = { Ok: Page_5 } | { Err: Error };
-export type Result_13 = { Ok: Page_6 } | { Err: Error };
-export type Result_14 = { Ok: [] | [string] } | { Err: Error };
-export type Result_15 = { Ok: ReferralCounts } | { Err: Error };
-export type Result_16 = { Ok: OpeningCounts } | { Err: Error };
-export type Result_17 = { Ok: PrivateMetrics } | { Err: Error };
-export type Result_18 = { Ok: Uint8Array | number[] } | { Err: Error };
-export type Result_19 = { Ok: OpenedThrough } | { Err: Error };
-export type Result_2 = { Ok: ControlStep } | { Err: Error };
-export type Result_20 = { Ok: CertifiedStanding } | { Err: Error };
-export type Result_21 = { Ok: FleetCycleHealth } | { Err: Error };
-export type Result_3 = { Ok: MeterReading } | { Err: Error };
-export type Result_4 = { Ok: bigint } | { Err: Error };
-export type Result_5 = { Ok: CustodyMode } | { Err: Error };
-export type Result_6 = { Ok: Array<string> } | { Err: Error };
-export type Result_7 = { Ok: Page } | { Err: Error };
-export type Result_8 = { Ok: Page_1 } | { Err: Error };
-export type Result_9 = { Ok: Page_2 } | { Err: Error };
+export type Result_10 = { Ok: CustodyMode } | { Err: Error };
+export type Result_11 = { Ok: Array<string> } | { Err: Error };
+export type Result_12 = { Ok: Page } | { Err: Error };
+export type Result_13 = { Ok: Page_1 } | { Err: Error };
+export type Result_14 = { Ok: Page_2 } | { Err: Error };
+export type Result_15 = { Ok: Page_3 } | { Err: Error };
+export type Result_16 = { Ok: Array<OpenedEngram> } | { Err: Error };
+export type Result_17 = { Ok: Page_5 } | { Err: Error };
+export type Result_18 = { Ok: RecordPage } | { Err: Error };
+export type Result_19 = { Ok: Page_6 } | { Err: Error };
+export type Result_2 = { Ok: { accepted: bigint } } | { Err: Error };
+export type Result_20 = { Ok: [] | [string] } | { Err: Error };
+export type Result_21 = { Ok: ReferralCounts } | { Err: Error };
+export type Result_22 = { Ok: OpenedThrough } | { Err: Error };
+export type Result_23 = { Ok: OpeningCounts } | { Err: Error };
+export type Result_24 = { Ok: RestartStatus } | { Err: Error };
+export type Result_25 = { Ok: PrivateMetrics } | { Err: Error };
+export type Result_26 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_27 = { Ok: CertifiedStanding } | { Err: Error };
+export type Result_28 = { Ok: FleetCycleHealth } | { Err: Error };
+export type Result_3 = { Ok: ControlStep } | { Err: Error };
+export type Result_4 = { Ok: MeterReading } | { Err: Error };
+export type Result_5 = { Ok: { repaid: bigint; stillOwed: bigint } } | { Err: Error };
+export type Result_6 =
+  | {
+      Ok: { updateWaiting: boolean; finishByNs: bigint };
+    }
+  | { Err: Error };
+export type Result_7 = { Ok: bigint } | { Err: Error };
+export type Result_8 = { Ok: RestartReply } | { Err: Error };
+export type Result_9 = { Ok: EngramComputeView } | { Err: Error };
 export type Role =
   | { Anonymous: null }
   | { Viewer: null }
@@ -313,6 +371,11 @@ export interface RowEnding {
   day: bigint;
   reason: EndReason;
 }
+export interface SealedEntry {
+  id: bigint;
+  entryHash: Uint8Array | number[];
+  digest: Uint8Array | number[];
+}
 export interface StandingLeaf {
   disputes: bigint;
   live: bigint;
@@ -402,7 +465,7 @@ export interface _SERVICE {
    * / protocol and are not, and the difference matters most on this one: it decides what code every
    * / engram in the fleet will run.
    */
-  engramWasmFinalize: ActorMethod<[string], Result_4>;
+  engramWasmFinalize: ActorMethod<[string], Result_7>;
   /**
    * / Chunked WASM upload — for WASMs that exceed single-call ingress limits.
    * / Flow: engramWasmInit → engramWasmPushChunk (×N) → engramWasmFinalize(hash)
@@ -421,7 +484,7 @@ export interface _SERVICE {
    * / to clear and begin afresh. The messages say so because a caller who retries a chunk against a
    * / full buffer will retry forever.
    */
-  engramWasmPushChunk: ActorMethod<[Uint8Array | number[]], Result_4>;
+  engramWasmPushChunk: ActorMethod<[Uint8Array | number[]], Result_7>;
   /**
    * / Fleet cycle-health scan. Admin or metrics-viewer, PAGINATED with a hard max of 50 per page —
    * / each managed engram costs one `canister_status` await, so pages stay small to bound the
@@ -451,7 +514,7 @@ export interface _SERVICE {
    * / this one is a noun. That gate now reads the census's L7 citations as a second population for
    * / exactly this blind spot.⟩
    */
-  fleetCycleHealth: ActorMethod<[bigint, bigint, bigint], Result_21>;
+  fleetCycleHealth: ActorMethod<[bigint, bigint, bigint], Result_28>;
   /**
    * / PUBLIC: ⟨0.16.0, L2.4⟩ `fleetSummary` — the ONE public projection of this registry,
    * / replacing `status()` and ABSORBING `publicMetrics()`.
@@ -564,7 +627,7 @@ export interface _SERVICE {
    * / `listAgents`. "The agent itself" is a caller holding that root key. A key for one engram has no
    * / record of its own here; asking about one gets the refusal or, from the key itself, `#NotFound`.
    */
-  getAgentStanding: ActorMethod<[Principal], Result_20>;
+  getAgentStanding: ActorMethod<[Principal], Result_27>;
   /**
    * / Fleet-wide anchoring liveness. Exists because ABSENCE is otherwise uninformative: an engram
    * / that never wrote, one still on a template without the push, and one whose push is broken all
@@ -575,6 +638,12 @@ export interface _SERVICE {
    * / alive SOMEWHERE, which is what makes an individual engram's silence interpretable.
    * /
    * / PUBLIC: the same reader who needs the anchors needs to know whether to believe their absence.
+   * /
+   * / ⟨2026-10-11⟩ The ring also holds the TREASURY ANCHORER's chain (`getTreasuryAnchorId`), and
+   * / `engramsAnchored`, `totalAnchors` and `lastAnchorAtNs` count it as one more chain. The
+   * / engram-only pair leaves it out: `engramChainsAnchored` (always present on a registry that
+   * / serves it, 0 when no engram has anchored) and `lastEngramAnchorAtNs`. Read those to ask
+   * / whether ENGRAMS are anchoring — an active money chain must not stand in for them.
    */
   getAnchorStats: ActorMethod<[], AnchorStats>;
   /**
@@ -619,6 +688,22 @@ export interface _SERVICE {
    * / the authority it was introduced to remove.
    */
   getCertifiedAuditHead: ActorMethod<[], CertifiedAuditHead>;
+  /**
+   * / The certified proof that a birth record's FINGERPRINT is in this registry's tree ⟨2026-10-26, the
+   * / owner's lineage ruling L3A⟩ — the half of an engram's birth chain the engram cannot give itself.
+   * /
+   * / PUBLIC: a proof a caller had to hold a role to fetch rests on the authority it was meant to
+   * / replace. It reveals only whether a fingerprint is present: the key is a salted hash (the record's
+   * / random secret is inside it) and the value a constant. Whoever holds the record — the engram's
+   * / owner, or whomever the owner showed it to — already knows the fingerprint; nobody else can ask
+   * / about a record they cannot guess.
+   * /
+   * / Verify as for `getCertifiedAnchor`, path ["births", <fingerprint>], leaf bytes = [0x01] (the
+   * / client's `verifyBirthChain` does it for a whole chain). `null` when absent, as `getCertifiedAnchor`
+   * / answers: there is no certified absence proof (spec question Q8). A `fingerprint` that is not 32
+   * / bytes is never a fingerprint, and answers `null` before the lookup.
+   */
+  getCertifiedBirth: ActorMethod<[Uint8Array | number[]], [] | [CertifiedBirth]>;
   /**
    * / The ATTESTABLE custody-mode fact (agent-native model item 19): "managed" | "sovereign" |
    * / "unknown", derived from the registry's OWN transition records (claimSovereignty /
@@ -643,7 +728,7 @@ export interface _SERVICE {
    * / Derived from records, never probed: a canister_status call would trap for exactly the
    * / canisters we are not the controller of, i.e. the sovereign ones this read exists to identify.
    */
-  getCustodyMode: ActorMethod<[Principal], Result_5>;
+  getCustodyMode: ActorMethod<[Principal], Result_10>;
   /**
    * / Cycles-health probe — slim, cycles-only shape; the money fields moved to the cashier's
    * / getCycleReserveStatus. Read by health-alert.mjs in registry mode.
@@ -675,6 +760,9 @@ export interface _SERVICE {
    * / on two canisters is what a hand-written client cannot tell apart (a structural actor type
    * / matches either target), so it gets the rule `getMarketCanister` already follows: distinct
    * / names on distinct canisters. `…Of` says what the argument is for.
+   * /
+   * / ⟨2026-10-13⟩ The engram no longer serves `getEngramNumber` at all: its copy of the number went
+   * / with the genesis seed, so this is the one read of an engram's number.
    */
   getEngramNumberOf: ActorMethod<[Principal], [] | [bigint]>;
   /**
@@ -686,7 +774,7 @@ export interface _SERVICE {
    * / `#NotFound` only to a permitted reader, for a key that opened nothing: a true answer, like
    * / `listMyAgentDisputes`'s empty list.
    */
-  getEngramOpenedThrough: ActorMethod<[Principal], Result_19>;
+  getEngramOpenedThrough: ActorMethod<[Principal], Result_22>;
   /**
    * / The i-th 1 MiB slice of the attested engram wasm (0-indexed). The caller reassembles all
    * / chunks in order and MUST verify sha256(reassembled) == getEngramWasmHash before installing —
@@ -699,17 +787,28 @@ export interface _SERVICE {
    * / a truncated one, so it would hash a partial wasm and report a mismatch against the official
    * / list, which reads as "this template is unofficial" rather than "I stopped reading too early".
    */
-  getEngramWasmChunk: ActorMethod<[bigint], Result_18>;
+  getEngramWasmChunk: ActorMethod<[bigint], Result_26>;
   /**
    * / The stored template's release class — FREE and UNGATED, because it is the checkable half of a
-   * / promise made to people who are not our customers. Pair it with getRentStatus to verify the
-   * / funding rule was applied: #Security funds every reachable engram; #Feature funds metered ones.
+   * / promise made to people who are not our customers. ⟨2026-10-25⟩ The funding rule it checks:
+   * / #Security — the registry pays for the install on every running engram it can reach, any size;
+   * / #Feature — the registry pays for no install, and each engram runs it on its own compute. (Was:
+   * / "pair it with getRentStatus … #Feature funds metered ones" — rent no longer enters it.)
    * / PUBLIC: ⟨0.16.0, L3⟩ The release class as a VARIANT, not a stringly-typed enum.
    * /
    * / It returned "security" or "feature" as `Text`, so every consumer compared strings and no
    * / compiler anywhere could catch a typo or a third class arriving. A variant makes the set closed
    * / and the comparison checked — and this value gates whether an upgrade is funded, so a caller
    * / that silently fails to match "security" funds nothing and reports no error.
+   * / ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A: "pay whenever the engram is
+   * / missing any security release, whatever the latest release is labelled"⟩ "#Feature — the
+   * / registry pays for no install" no longer holds for every engram: an engram still missing an
+   * / earlier security release is paid as a security update even while this reads #Feature, because
+   * / the current template carries that fix (UpgradeFunding.effectiveClass) — unless the current
+   * / template is itself behind a security release (an older build re-uploaded), which cannot deliver
+   * / the fix. An engram missing no security release is still never paid for a #Feature install.
+   * / So this value is the declared label, not the whole funding rule: the `upgrade.topUp` audit line
+   * / says `class=Security declared=Feature` when the two differ.
    */
   getEngramWasmClass: ActorMethod<[], ReleaseClass>;
   /**
@@ -738,7 +837,7 @@ export interface _SERVICE {
    * / site. L1 retired the motive of trapping-to-refuse; it did not give queries the ability to
    * / write, which is the thing this actually depends on.
    */
-  getFleetMetrics: ActorMethod<[], Result_17>;
+  getFleetMetrics: ActorMethod<[], Result_25>;
   /**
    * / PUBLIC: a genesis note that only privileged callers could read would defeat its purpose —
    * / the reader who most needs it is the stranger deciding whether to trust this chain.
@@ -805,6 +904,18 @@ export interface _SERVICE {
    * / provision rather than reserve again.
    */
   getMyReservation: ActorMethod<[], [] | [ReservationView]>;
+  /**
+   * / CALLER: the app's restart sheet, for the owner (ADR-0020). What the caller's engram owes from a
+   * / restart, when the next restart is allowed, and whether one is open. Refused loudly to anyone
+   * / with no engram here — never "0 owed" to a caller it cannot answer for (ADR-0002).
+   * / ⟨2026-10-26⟩ `openUntilNs` now reads the open restart's `finishByNs` (`restartsOpen`): when the
+   * / call or the sweep will have started the engram. Shape unchanged.
+   * / ⟨CORRECTED 2026-10-26, later — the owner's restart choice 2A: "apply the weekly limit only when
+   * / we lend"⟩ "when the next restart is allowed" now reads "when the registry can next LEND to a
+   * / restart": `nextRestartAtNs` is only the weekly limit on a loan. A restart on the owner's own
+   * / compute is allowed now, whatever it says. Field name and shape unchanged.
+   */
+  getMyRestartStatus: ActorMethod<[], Result_24>;
   /**
    * / ⟨2026-10-02⟩ How many engrams were ever opened, and how — lifetime sizes of state this registry
    * / never deletes, plus the two counters of refused openings (`Funnel.OpeningCounts` names each).
@@ -815,7 +926,24 @@ export interface _SERVICE {
    * / "nothing was ever opened". A QUERY: counts only, and cheap; its refusal is not in the denial
    * / log (`denied` says why a query cannot write).
    */
-  getOpeningCounts: ActorMethod<[], Result_16>;
+  getOpeningCounts: ActorMethod<[], Result_23>;
+  /**
+   * / Where an engram was opened from ⟨2026-10-26, the owner's lineage ruling L4: "a child reads its own
+   * / parent by its canister id"⟩: the engram, the engram it was opened from, and the cut-off's time if
+   * / there is one. Closes "a handed-on child cannot read its own parent" — `getEngramOpenedThrough` is
+   * / keyed by the lasting key that OPENED the engram, which a new owner does not hold.
+   * /
+   * / CALLER: the engram's CURRENT owner, the current owner of the engram it was opened from, or this
+   * / registry's admin and audit viewers (ADR-0020). Reuses `parentOf`; no new state. The two owners are
+   * / answered first; anyone else goes through the registry's combinator (`#adminOrViewer`), which
+   * / refuses every other caller in the same words whether or not the id is an engram, so a refusal
+   * / tells a stranger nothing. A QUERY, so the refusal is not written to the denial log (`denied`
+   * / says why a query cannot write).
+   * / `#NotFound` only to a permitted reader: a first engram has no parent (a true answer), and an id
+   * / this registry never opened is said to be one, not passed off as a first engram (ADR-0002).
+   * / L8C: `listChildrenOf` is unchanged. L7B: the change-of-owner gate is unchanged.
+   */
+  getParentOf: ActorMethod<[Principal], Result_22>;
   /**
    * / ⟨2026-10-02⟩ How far agents reach across owners — COUNTS ONLY: agents by how many trees their
    * / record spans (1 · 2 · 3–4 · 5+), engrams opened through a parent that are live or cut off, and
@@ -829,7 +957,7 @@ export interface _SERVICE {
    * / weekly. Anyone else is REFUSED by name with their class — never zeros. A QUERY: its cost grows
    * / with the agents and engrams it walks (one pass over each), so a reader asks weekly, not hourly.
    */
-  getReferralCounts: ActorMethod<[Array<Principal>], Result_15>;
+  getReferralCounts: ActorMethod<[Array<Principal>], Result_21>;
   /**
    * / PUBLIC: the biller identity is an operational fact a
    * / payer's cashier must verify BEFORE taking money (paying into a cashier the registry does not
@@ -853,6 +981,33 @@ export interface _SERVICE {
    * / prospective user can act on.
    */
   getReserveGateConfig: ActorMethod<[], ReserveGateConfig>;
+  /**
+   * / PUBLIC: CALLER: the status page (ADR-0020). What the registry has lent to restart stopped engrams
+   * / — lent, repaid, written off, outstanding — and what engrams gave back of the compute a paid
+   * / security update advanced them (returned, written off). Ungated, because a subsidy we would not
+   * / publish is one we should not spend. `getUpgradeSubsidyTotal` stays the gross figure.
+   * / ⟨2026-10-26, the owner's ruling "write it off, but accounting should be exact"⟩ Two exact
+   * / identities hold between any two messages: lent = repaid + writtenOff + outstanding, and
+   * / advancePaid = advanceReturned + advanceWrittenOff + advanceOutstanding.
+   * / ⟨2026-10-26, later — the owner's restart choice 4A: "add the release name to each write-off
+   * / record. This needs no new storage."⟩ These totals are fleet-wide. PER RELEASE, read the audit
+   * / chain: every line that moves an advance names the release it was paid for, `template=<module
+   * / hash>` (and `version=` when the release history names one) — `upgrade.topUp` (paid, `added=`),
+   * / `upgrade.advance.returned` (`returned=`, `writtenOff=`) and `upgrade.advance.writtenOff`
+   * / (`writtenOff=`, including the 90-day write-off of an advance left outstanding, restart choice 5A).
+   * / Summed by `template=`, they give each release's paid, returned and written-off figures exactly;
+   * / what is still out per release is paid − returned − written off. Restart-loan lines are not per
+   * / release (a loan pays for no release).
+   * / ⟨CORRECTED 2026-10-26, later — the fix pass (the ledger review)⟩ "exactly" holds only over a
+   * / COMPLETE copy of the audit chain. The registry keeps the most recent 10,000 audit entries
+   * / (AuditLog's `MAX_ENTRIES`; on overflow it drops back to 9,000, oldest first), and a give-back or
+   * / a 90-day write-off can land long after its `upgrade.topUp` line was dropped. A per-release sum
+   * / read from the registry alone can therefore miss lines. Exact per-release figures need an archive
+   * / of the chain kept from the first line on (scripts/audit-chain/monitor.mjs `--archive`); whether
+   * / such an archive is kept durably is an operator's choice, not this registry's. The fleet totals
+   * / this method answers are exact regardless.
+   */
+  getRestartTotals: ActorMethod<[], RestartTotals>;
   /**
    * / PUBLIC: transparency without a doxx — how many principals the deployment currently screens (0 = seam
    * / disarmed, the shipped default). The list itself is never enumerable publicly.
@@ -860,7 +1015,8 @@ export interface _SERVICE {
   getScreeningDenylistSize: ActorMethod<[], bigint>;
   /**
    * / How many engram template releases this registry has declared `#Security` — the class that
-   * / skips any delay and is funded for every engram. ⟨2026-09-28, owner decision: publish the
+   * / skips any delay and whose install the registry pays for on every running engram (⟨2026-10-25⟩
+   * / was "is funded for every engram"). ⟨2026-09-28, owner decision: publish the
    * / count only; the status page shows the number.⟩ It moves only when a template's class is
    * / declared INTO `#Security` (`setEngramWasmClass`), never on `#Feature`, never down.
    * / ⟨CORRECTED 2026-09-29⟩ It counts TEMPLATES, not declarations: each distinct template (by its
@@ -926,10 +1082,15 @@ export interface _SERVICE {
    * / — and the second is a claim about OUR OWN SPEND, not an absence of one. `#Ok(null)` now means
    * / never funded, `#Err(#Refused)` means not your business, and no caller has to guess which.
    */
-  getUpgradeFundedTemplate: ActorMethod<[Principal], Result_14>;
+  getUpgradeFundedTemplate: ActorMethod<[Principal], Result_20>;
   /**
-   * / Cumulative cycles the registry has granted to engrams for upgrades — the meter on the
-   * / never-gated pull path.
+   * / Cumulative cycles the registry has granted to engrams for upgrades — ⟨2026-10-25⟩ the meter on
+   * / security-update funding: the registry pays only for security updates on running engrams (was:
+   * / "the meter on the never-gated pull path"; the pull is still never refused, and a feature update
+   * / it installs is not paid for).
+   * / ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A⟩ "a feature update it installs is
+   * / not paid for" now excepts an engram still missing an earlier security release: that install is
+   * / paid as a security update and counted here (UpgradeFunding.effectiveClass).
    * /
    * / PUBLIC: a subsidy we would not publish is one we should not spend. Free and ungated.
    */
@@ -989,7 +1150,7 @@ export interface _SERVICE {
    * / nowhere" — handed to a caller who merely lacks a grant. Readable by an admin, an audit viewer,
    * / or that agent about itself.
    */
-  listAgentEngrams: ActorMethod<[Principal], Result_12>;
+  listAgentEngrams: ActorMethod<[Principal], Result_17>;
   /**
    * / Contradictory submissions, oldest-first. Empty is the normal case. Never trimmed.
    * /
@@ -1018,7 +1179,7 @@ export interface _SERVICE {
    * / while keeping the evidence that two of them disagree — the fabricate-on-refusal shape aimed at
    * / the one reader the anchors exist for.
    */
-  listAnchorConflicts: ActorMethod<[Principal, bigint, bigint], Result_13>;
+  listAnchorConflicts: ActorMethod<[Principal, bigint, bigint], Result_19>;
   /**
    * / Witnessed heads for an engram, oldest-first. PUBLIC and ungated — an anchor a stranger cannot
    * / read is not an anchor (ratified: "recorded where counterparties can check them").
@@ -1074,8 +1235,18 @@ export interface _SERVICE {
    * /
    * / The inline record dies for a `Page`: `earliestId` was redundant with the ring's own paging,
    * / and `size`/`headHash` are `getAuditHead`'s answer, published free to everyone.
+   * /
+   * / ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ The reply is the shared `Wire.RecordPage`,
+   * / the shape every chain canister's record read now serves, so one checker reads all of them. A
+   * / viewer sees every entry, so `sealed` is always empty here; what the page adds is `ringFloor`
+   * / (where the ring starts — a `start` below it begins at it) and `hashFirstFrom` (where this
+   * / record switched to the hash-first rule: entries below it were hashed SHA-256(prev ‖ body)).
+   * / `total` is now the head counter, as everywhere else — it was the size of the 1,000-entry window
+   * / this read sliced, which is not a number about the record. The gate is unchanged: hash-only rows
+   * / for strangers were ruled for the engram's record, and the status console decides a signed-in
+   * / visitor's tier by whether this read refuses.
    */
-  listAuditEntries: ActorMethod<[bigint, bigint], Result_10>;
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_18>;
   /**
    * / ⟨0.16.0, L2.2⟩ RENAMED from `getMetricsViewers` — the viewer triple unifies on "audit viewer"
    * / across every canister, because a roster that grants audit reads should not be named after
@@ -1085,7 +1256,7 @@ export interface _SERVICE {
    * / on 2026-08-11 while viewers existed. An empty vec reads as "nobody holds read-only ops access"
    * / when the truth was "you are not on the roster".
    */
-  listAuditViewers: ActorMethod<[], Result_12>;
+  listAuditViewers: ActorMethod<[], Result_17>;
   /**
    * / PUBLIC: the release history, paged.
    * /
@@ -1107,7 +1278,7 @@ export interface _SERVICE {
    * / Built by a pass over `parentOf` rather than from a second, reverse index: one stored fact and a
    * / pass bounded by the number of opened engrams, instead of two facts to keep in step.
    */
-  listChildrenOf: ActorMethod<[Principal], Result_11>;
+  listChildrenOf: ActorMethod<[Principal], Result_16>;
   /**
    * / ⟨0.16.0⟩ RENAMED from `readDenialLog`; the refusal becomes a value.
    * /
@@ -1115,7 +1286,7 @@ export interface _SERVICE {
    * / this log exists to record — so "empty" was never an acceptable answer to a caller who simply
    * / lacks the grant. The old trap said so; this says the same thing as data.
    */
-  listDenialEntries: ActorMethod<[bigint, bigint], Result_10>;
+  listDenialEntries: ActorMethod<[bigint, bigint], Result_15>;
   /**
    * / ⟨2026-10-02⟩ ONE ROW PER ENGAGEMENT, for the deployment's own count of use — DAYS, never
    * / instants, and NEVER the agent's root, enrolled key or invite.
@@ -1141,7 +1312,7 @@ export interface _SERVICE {
    * / and a query cannot write (the reason `listEngrams` is an update). This is the most sensitive of
    * / the three reads — one row per engagement — so who was turned away is worth a record.
    */
-  listEngagementRows: ActorMethod<[bigint, bigint, bigint, Array<Principal>], Result_9>;
+  listEngagementRows: ActorMethod<[bigint, bigint, bigint, Array<Principal>], Result_14>;
   /**
    * / ⟨0.16.0, L1⟩ THE `authorized : ?Bool` FLAG IS GONE, AND SO IS EVERYTHING BUILT AROUND IT.
    * /
@@ -1174,7 +1345,7 @@ export interface _SERVICE {
    * / own text had to be corrected for — the forcing call is not a system API at all, it is
    * / `denied()`, a state write. See `scripts/check-update-for-read.mjs`.
    */
-  listEngrams: ActorMethod<[bigint, bigint], Result_8>;
+  listEngrams: ActorMethod<[bigint, bigint], Result_13>;
   /**
    * / ⟨2026-09-28, owner decision: an agent may read its own record⟩ The caller's OWN dispute
    * / statements, oldest first, verbatim. Keyed by `msg.caller`, so it cannot be pointed at anyone
@@ -1229,12 +1400,12 @@ export interface _SERVICE {
    * / choice in the fleet. That is the consequence this refusal exists to prevent, and it belongs in
    * / the message a caller actually receives.
    */
-  listUpdatePrefs: ActorMethod<[bigint, bigint], Result_7>;
+  listUpdatePrefs: ActorMethod<[bigint, bigint], Result_12>;
   /**
    * / Mint one-shot reserve invites (invite-issuer or admin). Codes use IC-secure randomness over a
    * / 32-symbol no-ambiguous alphabet (8 chars ≈ 40 bits). Batch-capped; table hard-capped.
    */
-  mintReserveInvites: ActorMethod<[bigint], Result_6>;
+  mintReserveInvites: ActorMethod<[bigint], Result_11>;
   /**
    * / The PROBED twin of `getCustodyMode`: same question, asked of the IC rather than of our
    * / records — hence the `probe` verb rather than a second noun.
@@ -1262,13 +1433,37 @@ export interface _SERVICE {
    * / LIVE from the management canister rather than from a stored transition record, so a query
    * / could not produce it at all, not merely more cheaply.
    */
-  probeCustodyMode: ActorMethod<[], Result_5>;
+  probeCustodyMode: ActorMethod<[], Result_10>;
+  /**
+   * / What YOUR OWN engram's compute is, read by the registry — the one read that works while it is
+   * / frozen.
+   * /
+   * / CALLER: the owner, from the app's status strip, Billing and System pages (ADR-0020).
+   * / ⟨2026-10-26, the owner's ruling 1A: tell the owner, using signals that work while frozen⟩ The
+   * / registry is a controller, and the network answers a controller canister's status call for a
+   * / frozen engram where it refuses the owner's own (IC0207, the stopped-engram study's network read
+   * / §6). UPDATE, not query: it awaits the management canister (the `probe` verb, as
+   * / `probeCustodyMode`).
+   * / ⟨L7⟩ ⟨marker added 2026-10-26, Finish phase; the reason above unchanged⟩ The system call that
+   * / forces the update is `canister_status` on the management canister: a query cannot make an
+   * / inter-canister call, so a query could not read the engram's network status at all — and that
+   * / status is the only signal that still answers while the engram is frozen.
+   * / No rate limit (the do-less): each call costs the registry one management
+   * / call — INFERRED a few million cycles, not measured. `eraseAboutNs` is "about" and never invented:
+   * / null when the network reports no idle burn.
+   */
+  probeMyEngramCompute: ActorMethod<[], Result_9>;
   /**
    * / ⟨0.16.0⟩ `Ok` CARRIES THE PRINCIPAL DIRECTLY, not a one-field record wrapping it.
    * /
    * / `#Ok : { canisterId : Principal }` was a record with nothing to disambiguate: the success of a
    * / spawn IS the canister it produced. The wrapper cost every caller a field access to reach the
    * / only thing the call returns, and invited a second field later that would belong somewhere else.
+   * /
+   * / ⟨2026-10-13, the owner's 6A⟩ `opts.genesis` (an optional first file, written as the canister
+   * / spawned) is retired: the console creates an engram with no content (decision 2 B(b),
+   * / 2026-09-30), the owner kit never calls this, and only test harnesses passed one. A caller still
+   * / sending the field is unaffected — Candid ignores a record field the receiver does not declare.
    */
   provisionEngram: ActorMethod<
     [
@@ -1277,7 +1472,6 @@ export interface _SERVICE {
           {
             walletProof: [] | [Uint8Array | number[]];
             invite: [] | [string];
-            genesis: [] | [{ content: Uint8Array | number[]; path: string }];
           },
         ],
     ],
@@ -1303,6 +1497,70 @@ export interface _SERVICE {
     ],
     Result
   >;
+  /**
+   * / Admin (the wasm admin): give one grown engram's working memory back, in place. The engram's
+   * / stable graph is copied into its stable memory and the SAME module is reinstalled with
+   * / `wasm_memory_persistence = ?#replace`, so the engram restarts in a fresh, small wasm memory with
+   * / every file, version, record entry, setting and key it had (MemoryReset.mo).
+   * /
+   * / REFUSES, and changes nothing, when: the caller is not the wasm admin; the registry does not know
+   * / the engram; a change of owner or a restart is open; its status cannot be read (a sovereign engram);
+   * / it is not running; it is not on the current template; its wasm memory is under
+   * / `MemoryReset.WASM_FLOOR_BYTES` (nothing to give back — and so a second reset straight after a
+   * / first); its balance is short of the install hold above its own freezing line (no dip, no deposit);
+   * / or one of its own calls is in flight ("Busy, try again").
+   * /
+   * / WHO PAYS: the engram, as for any install — `install_code` is charged to the canister it installs
+   * / on, and the stabilise / rebuild steps are the engram's own messages. The registry deposits
+   * / nothing; it pays only for its own calls. Two installs run: an ordinary one of the same module
+   * / first, which is the network's test for a call in flight while nothing is yet at stake, then the
+   * / replace.
+   * /
+   * / ONCE STARTED it finishes or says the engram is HELD: between the stabilise call and the replace
+   * / install the engram refuses every message, so a failure there answers `#Unavailable` naming the
+   * / step, and running this method again picks up where it stopped (it reads the held state from the
+   * / engram itself). Do not publish a new template while a reset is held.
+   * /
+   * / Never run on production engrams (the owner's ruling). On the staging network, as the wasm admin,
+   * / with the engram's canister id in ENGRAM:
+   * /     icp canister call registry-staging resetEngramMemory "(principal \"$ENGRAM\")" -e ic
+   */
+  resetEngramMemory: ActorMethod<[Principal], Result>;
+  /**
+   * / Restart YOUR OWN stopped engram.
+   * /
+   * / CALLER: the owner, from the app's restart sheet (ADR-0020). Afterwards the app runs the engram's
+   * / own `convertEarningsToCycles` as the owner, which pays any loan back FIRST.
+   * /
+   * / ⟨REWRITTEN 2026-10-26, the owner's ruling 2A of that day⟩ What it does, in this order: stops the
+   * / engram; adds compute — the owner's own (already added through `stopMyEngramForRestart` and a
+   * / top-up from their account), or a loan of what it still lacks to run at its OWN setting (at most
+   * / 0.25T, only after the biller confirms the wallet holds enough to repay it); installs the waiting
+   * / security release if the engram is behind one and the owner allows automatic updates (paid as a
+   * / security update — we pay because we do not want security incidents); puts the owner's freezing
+   * / setting back; and only then starts it. It never lowers the setting on a running engram. A step
+   * / that fails never leaves the engram stopped: the registry's sweep finishes it within minutes.
+   * /
+   * / Refused BEFORE anything is stopped, saying why: not your engram; sovereign; a change of owner
+   * / unfinished; restarted in the last 7 days; a loan still owed; an update installing; a restart
+   * / already running; code the registry never published; running (nothing to restart); needing more
+   * / than one loan; a waiting security update that this restart could not cover (it would start old
+   * / code); an engram opened through another engram that would need a loan; the fleet-wide ceiling;
+   * / no biller, or a wallet too low to repay. A restart that lent nothing does not spend the week.
+   * / ⟨CORRECTED 2026-10-26, later — the owner's restart choices 1A and 2A of that day⟩ The list above is
+   * / the record of the build before them. Now: "restarted in the last 7 days" and "a loan still owed"
+   * / refuse ONLY a restart that would LEND (2A: "apply the weekly limit only when we lend") — asked
+   * / once the plan knows the loan, and again after every await before the loan is made
+   * / (`RestartLoan.lendGate`); a restart on the owner's own compute is never refused by them and never
+   * / spends the week, which is taken only in the step that records a loan. "An engram opened through
+   * / another engram that would need a loan" is GONE (1A: "lend to children like any other engram") —
+   * / such an engram is lent to under the same ceiling, wallet check and repay-first as any other: the
+   * / biller reads the engram's OWN wallet by its own id, and the engram's own Convert repays. New: a
+   * / second call while one is still running for the same engram (`restartCallsRunning`), which is
+   * / what now keeps two interleaved calls from both lending or both stopping and starting — the week
+   * / used to double as that guard.
+   */
+  restartMyStoppedEngram: ActorMethod<[], Result_8>;
   /**
    * / Return to managed: user calls AFTER adding registry back as controller
    */
@@ -1372,7 +1630,7 @@ export interface _SERVICE {
    */
   setReserveGateEnabled: ActorMethod<[boolean], Result>;
   setScreeningDenylist: ActorMethod<[Array<Principal>], Result>;
-  setSpawnCeiling: ActorMethod<[bigint], Result_4>;
+  setSpawnCeiling: ActorMethod<[bigint], Result_7>;
   setTreasuryAnchorId: ActorMethod<[[] | [Principal]], Result>;
   /**
    * / Set the wallet-canister allowlist for the wallet-rooted exemption (admin-only). Small by
@@ -1394,11 +1652,23 @@ export interface _SERVICE {
    * / Admin dial for the upgrade top-up floor (0 = disabled). Capped at one endowment so the dial
    * / itself cannot turn upgrades into an unbounded drain.
    */
-  setUpgradeTopUpFloor: ActorMethod<[bigint], Result_4>;
+  setUpgradeTopUpFloor: ActorMethod<[bigint], Result_7>;
   /**
    * / Root admin assigns the role key (pass null to clear, reverting the role to the root admin).
    */
   setWasmAdmin: ActorMethod<[[] | [Principal]], Result>;
+  /**
+   * / Stop YOUR OWN stopped-or-starving engram so you can add compute from your account and restart it.
+   * /
+   * / CALLER: the owner, from the app's "Add compute from my account" when the engram has stopped and a
+   * / security update is waiting (ADR-0020). ⟨2026-10-26, the owner's ruling 2A⟩ Stops the engram so
+   * / that compute the owner adds next cannot wake its old code; the owner then adds compute through
+   * / the biller's own top-up and calls `restartMyStoppedEngram`, which installs the waiting update and
+   * / starts it. If the owner walks away, the sweep finishes it after 30 minutes: install if covered,
+   * / restore, start. Never left stopped. It lends nothing, so it takes no week; it refuses an engram
+   * / that is not stuck, so a healthy engram is never taken offline (spec question Q15).
+   */
+  stopMyEngramForRestart: ActorMethod<[], Result_6>;
   /**
    * / An engram witnesses its own audit head. Callable ONLY by a registered engram — msg.caller is
    * / the engram principal, so attribution needs no signature and cannot be forged by a third party.
@@ -1422,6 +1692,17 @@ export interface _SERVICE {
    * / hand-written client IDL type-checks against a method that does not exist.
    */
   sysAnchorHead: ActorMethod<[Uint8Array | number[], bigint], Result>;
+  /**
+   * / CALLER: an engram, from inside its owner's `convertEarningsToCycles`, once the conversion landed
+   * / (ADR-0020). Attach up to what is owed: the registry accepts no more than the outstanding loan
+   * / (the network returns the rest) and records it. `#NotFound` when nothing is owed (the loan was
+   * / written off, or repaid): the engram then clears its own record.
+   * / ⟨CHANGED 2026-10-26, the owner's ruling 2A⟩ REPAY-ONLY. It no longer puts a freezing setting back
+   * / (the restart restores it before the start) and no longer queues a security push (the restart
+   * / installs it before the start; the wake watcher covers other wakes). The name and reply are
+   * / unchanged, so the engram's hand client still matches.
+   */
+  sysCloseRestart: ActorMethod<[], Result_5>;
   /**
    * / ⟨2026-09-29, review PR-3: a half-finished change of owner⟩ A SOVEREIGN engram reports that it
    * / moved control of its code to `newOwner`, which ends the change of owner this registry marked
@@ -1444,7 +1725,7 @@ export interface _SERVICE {
    * / cycles-attached like the sweep; same row semantics, one engram, no heartbeat stamp
    * / (a single probe is not a completed round).
    */
-  sysMeterEngram: ActorMethod<[Principal], Result_3>;
+  sysMeterEngram: ActorMethod<[Principal], Result_4>;
   /**
    * / ⟨2026-10-02⟩ An engram tells this registry that its owner reset it.
    * /
@@ -1505,7 +1786,7 @@ export interface _SERVICE {
    * / a transfer the engram did not finish, and moves control again (that is the way out `stuck`
    * / names). The rules are in `src/shared/ControlHandover.mo`.
    */
-  sysNotifyOwnershipTransfer: ActorMethod<[Principal], Result_2>;
+  sysNotifyOwnershipTransfer: ActorMethod<[Principal], Result_3>;
   /**
    * / ⟨2026-09-28, owner decision: build the full agent track-record design for the launch release⟩
    * / An engram tells this registry that one of its agents started, or ended and WHY.
@@ -1566,6 +1847,43 @@ export interface _SERVICE {
    * / engagement never recorded here is refused `#NotFound` (`Engagements.closeVerdict`).⟩
    */
   sysRecordAgentEdge: ActorMethod<[{ root: Principal; event: EdgeEvent }], Result>;
+  /**
+   * / CALLER: an engram, from inside its `sysReturnUpgradeAdvance` (ADR-0020). Attach what is being
+   * / given back of the compute a paid security update advanced it. The registry accepts no more than
+   * / the outstanding advance (the network returns the rest) and writes off whatever was not returned
+   * / — what the install used and what the engram had to keep — never carried as a debt.
+   * / ⟨2026-10-26, the owner's ruling "accounting should be exact"⟩ The write-off here is the exact
+   * / figure advance − accepted, from the ledger entry and the cycles actually accepted, and the audit
+   * / line carries advance, returned and writtenOff.
+   * / ⟨2026-10-26, later — the owner's restart choices 4A and 5A⟩ The engram may have more than one
+   * / advance out (one per release paid; RestartLoan.repayAdvances): the cycles are accepted up to their
+   * / sum and settled OLDEST FIRST, and each advance gets its own audit line naming the release it was
+   * / paid for (`template=`), with its own returned and written-off parts — the lines sum exactly to
+   * / `accepted` and to the write-off. AN ADVANCE ALREADY WRITTEN OFF (the 90-day sweep) IS NOT ON THE
+   * / LEDGER, so nothing sent for it is accepted — the network returns those cycles to the engram — and
+   * / `advanceReturned` never counts a written-off cycle: no double count. When nothing at all is out,
+   * / the reply is `#NotFound` and nothing is accepted (as before).
+   * / ⟨CORRECTED 2026-10-26, later — the fix pass on 4A⟩ NEWEST first, not oldest first: the engram can
+   * / give back only what it holds above its balance before the latest deposit, so the cycles are the
+   * / newest advance's (RestartLoan.repayAdvances says why, and when that reading is wrong).
+   * / ⟨CHANGED 2026-10-26, the owner's review choice 1B: "take back only what we added; anything left
+   * / over goes to the 90-day write-off"⟩ The engram now names THE ADVANCE it is giving back
+   * / (`advanceId`, which the registry handed it in `sysReturnUpgradeAdvance` — the one this install's
+   * / deposit put on the ledger). The registry accepts AT MOST THAT ADVANCE'S AMOUNT, settles THAT
+   * / entry alone (returned + written off = its amount, one `upgrade.advance.returned` line naming its
+   * / release and id) and leaves every other advance of the engram on the ledger, for its own
+   * / give-back or the 90-day write-off. The paragraphs above about "the sum", "settled OLDEST FIRST"
+   * / and "NEWEST first" describe the shape this replaces. An id that is not on the ledger for this
+   * / caller (already settled, written off after 90 days, or never its own) accepts nothing — the
+   * / network returns the attached cycles to the engram — and answers `#NotFound`; when a recorded
+   * / engram attached cycles, an `upgrade.advance.notOut` line in the registry's unchained refusal log
+   * / says so (never the chained audit log: it moves nothing, and any engram can send it). Nothing is
+   * / ever counted twice.
+   * / WHAT WOULD MAKE THIS WRONG: an engram naming an id other than the one it was handed — it can only
+   * / name one of its OWN advances (the caller must match), so the worst it can do is settle its own
+   * / other advance early with cycles that are still the registry's.
+   */
+  sysRepayUpgradeAdvance: ActorMethod<[{ advanceId: bigint }], Result_2>;
   /**
    * / ⟨2026-09-29, owner ruling follow-up 8⟩ A SOVEREIGN engram could not change its own controllers
    * / after this registry moved its record, and asks for the record back so the transfer does not
@@ -1630,33 +1948,43 @@ export interface _SERVICE {
    * / Admin: upgrade one engram to the current template. RESPECTS the owner's update preference —
    * / an engram set to `#ManualOnly` is not moved by this method, which is what makes the preference
    * / meaningful rather than advisory. The owner's own `upgradeMyEngram` is unaffected either way.
+   * /
+   * / ⟨2026-10-25, the owner's ruling of that day⟩ Same funding decision and dip as the owner's pull:
+   * / paid only for a #Security update on a running engram. A push is the registry's own initiative,
+   * / so where the engram cannot hold the install even with its setting lowered, the push is SKIPPED
+   * / with `#Conflict` and not attempted — the owner can still pull it, and the pull is never refused.
    */
   upgradeEngram: ActorMethod<[Principal], Result>;
   /**
    * / Upgrade YOUR OWN engram to the registry's current template. Self-service — no admin, no
    * / queue, no approval.
    * /
-   * / ⚠ THE PULL IS ALWAYS FUNDED, regardless of release class or rent state, and that is a
-   * / commitment rather than an implementation detail: `install_code` needs the balance to cover the
-   * / install ABOVE the freezing threshold, so the registry lifts the engram over that bar if cycles
-   * / are what is stopping it. Refusing an owner their own fix for nonpayment is the ransom the
-   * / continuity-rent model forbids, and withholding a security fix would be worse than anything
-   * / that model gates. The lift is best-effort: if it fails, the install still runs and returns the
-   * / REAL error, so a top-up problem can never masquerade as an upgrade problem or hide one.
-   * / ⟨2026-09-28, owner decision: the registry only pays for upgrades of engrams running our
-   * / published code⟩ One exception to "always funded": an engram whose installed module is not one
-   * / this registry published is not lifted (`fundUpgradeIfNeeded`, audit
-   * / `upgrade.topUp.unpublishedCode`). The install is still attempted — the owner is never refused
-   * / their fix, only our cycles for it.
-   * / ⟨2026-09-29⟩ And when that install then FAILS, the reply says why the registry did not pay and
-   * / what the owner can do (`TemplatePolicy.unfundedUpgradeFailure`) — before, the refusal was only
-   * / in the registry's own log and the owner saw a bare out-of-cycles error. Same reply type.
-   * / ⟨2026-10-01, the owner's ruling of that day (2 A)⟩ A second exception beside the first: an
-   * / engram opened through a parent (`parentOf`, written by `sysSpawnChild`) is funded by the
-   * / registry never — not at birth, not at an upgrade (`fundUpgradeIfNeeded`, audit
-   * / `upgrade.topUp.childEngram`). The install is still attempted; the owner is never refused their
-   * / fix, only our cycles for it, and a failed install says so
-   * / (`TemplatePolicy.childUnfundedUpgradeFailure`).
+   * / ⟨2026-10-25, the owner's ruling of that day⟩ THE INSTALL IS ALWAYS ATTEMPTED. Refusing an owner
+   * / their own update for nonpayment is the ransom the continuity model forbids, so this method never
+   * / refuses for compute or payment. What the registry PAYS for is narrower: a #Security update on a
+   * / running engram, any size — paid because we do not want security incidents (the owner,
+   * / 2026-10-25). A #Feature update runs on the engram's own compute. Four standing exclusions are
+   * / never paid for: an engram that has stopped (below its running line — it runs nothing, so its old
+   * / code is not exposed while stopped), one opened through a parent (the ruling of 2026-10-01), one
+   * / running a module the registry never published (2026-09-28), and a second deposit for the same
+   * / release.
+   * / ⟨CORRECTED 2026-10-26, the owner's rulings of that day⟩ THREE standing exclusions: an engram
+   * / opened through a parent is now paid for a security update like any other ("including child
+   * / engrams, but not including engrams running unofficial code"), and a #Feature update is never
+   * / paid, rent or no rent ("where rent is paid, feature upgrades are paid by the engram").
+   * / ⟨CORRECTED 2026-10-26, later — the owner's restart choice 3A: "pay whenever the engram is
+   * / missing any security release, whatever the latest release is labelled"⟩ "a #Feature update is
+   * / never paid" now excepts an engram still missing an earlier security release: its install of a
+   * / #Feature template is paid as a security update, because the template carries that fix
+   * / (UpgradeFunding.effectiveClass) — unless the template is itself behind a security release.
+   * / When it helps, the registry lowers the engram's freezing setting to one hour for the
+   * / install and puts the owner's value back after (the dip), so an install needs only ~0.32T above
+   * / an hour's burn rather than the hold above the whole 30-day line.
+   * /
+   * / When the install FAILS after the registry declined to pay, the reply says why and what to do
+   * / (UpgradeFunding.pullFailure): `#Conflict` when the engram needs more compute (the owner's
+   * / action — add compute), `#Unavailable` when the registry could not pay this time (retryable).
+   * / A failure after a paid or unneeded deposit answers `#Unavailable` with the network's reply.
    * /
    * / An engram already on the current template is a silent no-op. A SOVEREIGN engram gets
    * / "registry is no longer a controller" — accurate, because it is no longer ours to install on.