@engramx/idl 0.16.0-rc.21 → 0.16.0-rc.22

package/dist/registry.did

@@ -96,50 +96,60 @@ type Result_4 =
    Err: Error;
    Ok: MeterReading;
  };
+type Result_30 = 
+ variant {
+   Err: Error;
+   Ok: FleetCycleHealth;
+ };
 type Result_3 = 
  variant {
    Err: Error;
    Ok: ControlStep;
  };
+type Result_29 = 
+ variant {
+   Err: Error;
+   Ok: CertifiedStanding;
+ };
 type Result_28 = 
  variant {
    Err: Error;
-   Ok: FleetCycleHealth;
+   Ok: ChildSignInOffer;
  };
 type Result_27 = 
  variant {
    Err: Error;
-   Ok: CertifiedStanding;
+   Ok: blob;
  };
 type Result_26 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: PrivateMetrics;
  };
 type Result_25 = 
  variant {
    Err: Error;
-   Ok: PrivateMetrics;
+   Ok: RestartStatus;
  };
 type Result_24 = 
  variant {
    Err: Error;
-   Ok: RestartStatus;
+   Ok: OpeningCounts;
  };
 type Result_23 = 
  variant {
    Err: Error;
-   Ok: OpeningCounts;
+   Ok: OpenedThrough;
  };
 type Result_22 = 
  variant {
    Err: Error;
-   Ok: OpenedThrough;
+   Ok: ReferralCounts;
  };
 type Result_21 = 
  variant {
    Err: Error;
-   Ok: ReferralCounts;
+   Ok: RegistryHealth;
  };
 type Result_20 = 
  variant {
@@ -149,7 +159,7 @@ type Result_20 =
 type Result_2 = 
  variant {
    Err: Error;
-   Ok: record {accepted: nat;};
+   Ok: principal;
  };
 type Result_19 = 
  variant {
@@ -204,7 +214,7 @@ type Result_10 =
 type Result_1 = 
  variant {
    Err: Error;
-   Ok: principal;
+   Ok: record {accepted: nat;};
  };
 type Result = 
  variant {
@@ -248,6 +258,29 @@ type ReleaseClass =
    Feature;
    Security;
  };
+type RegistryHealth = 
+ record {
+   adminRoles: opt AdminRoles;
+   anchors: opt AnchorStats;
+   atNs: opt int;
+   clock: opt RegistryClockHealth;
+   cycleReserve:
+    opt record {
+          cycleBalance: nat;
+          minOperatingReserveCycles: nat;
+        };
+ };
+type RegistryClockHealth = 
+ record {
+   attemptTotal: opt nat;
+   lastAttemptAtNs: opt int;
+   lastError: opt text;
+   lastErrorAtNs: opt int;
+   lastOkAtNs: opt int;
+   nextWakeAtNs: opt int;
+   okTotal: opt nat;
+   overdue: opt nat;
+ };
 type ReferralCounts = 
  record {
    agentsByTreesSpanned: TreesSpanned;
@@ -502,6 +535,12 @@ type ControlStep =
    EngramMustMove;
    MovedByRegistry;
  };
+type ChildSignInOffer = 
+ record {
+   parentActive: bool;
+   parentIsFirstEngram: bool;
+   parentOwner: opt principal;
+ };
 type ChangelogEntry = 
  record {
    atNs: int;
@@ -606,6 +645,9 @@ service : {
   /// CANISTER ID, so an engram's ciphertext and wallet cannot follow it anywhere (engramx
   /// docs/ENCRYPTION-OPERATIONS.md, "Canister-id binding"). Abandoning is starting over, not
   /// migrating, and the caller must be told so before they do it.
+  /// 
+  /// ⟨2026-11-02⟩ REFUSED for an engram opened through another: it is never abandoned, so it stays on
+  /// this registry's security updates for life; it ends by its parent's cut-off or by running dry.
   abandonMyEngram: () -> (Result);
   addAuditViewer: (viewer: principal) -> (Result);
   /// Add a changelog entry (admin only)
@@ -642,6 +684,9 @@ service : {
   /// ⚠ IT IS REVERSIBLE, which is the fact most worth publishing: the engram's own
   /// `returnToManaged` adds the registry back ALONGSIDE the owner. Sovereignty is a door, not a
   /// cliff.
+  /// 
+  /// ⟨2026-11-02, the owner's ruling "choice 4 without hand over"⟩ REFUSED for an engram opened
+  /// through another: it stays managed by this registry for life, and its key is never a controller.
   claimSovereignty: () -> (Result);
   /// Assemble the pushed chunks into the engram template and install it as the current one.
   /// 
@@ -699,7 +744,7 @@ service : {
   /// this one is a noun. That gate now reads the census's L7 citations as a second population for
   /// exactly this blind spot.⟩
   fleetCycleHealth: (offset: nat, limit: nat, thresholdCycles: nat) ->
-   (Result_28);
+   (Result_30);
   /// PUBLIC: ⟨0.16.0, L2.4⟩ `fleetSummary` — the ONE public projection of this registry,
   /// replacing `status()` and ABSORBING `publicMetrics()`.
   /// 
@@ -803,7 +848,7 @@ service : {
   /// is the agent's ROOT principal — the identity an owner sees as `root` on each key in their own
   /// `listAgents`. "The agent itself" is a caller holding that root key. A key for one engram has no
   /// record of its own here; asking about one gets the refusal or, from the key itself, `#NotFound`.
-  getAgentStanding: (agent: principal) -> (Result_27) query;
+  getAgentStanding: (agent: principal) -> (Result_29) query;
   /// Fleet-wide anchoring liveness. Exists because ABSENCE is otherwise uninformative: an engram
   /// that never wrote, one still on a template without the push, and one whose push is broken all
   /// render as an empty getAnchors. Nothing distinguishes the first from the third, so a silently
@@ -870,6 +915,26 @@ service : {
   /// answers: there is no certified absence proof (spec question Q8). A `fingerprint` that is not 32
   /// bytes is never a fingerprint, and answers `null` before the lookup.
   getCertifiedBirth: (fingerprint: blob) -> (opt CertifiedBirth) query;
+  /// ⟨2026-11-02, the owner's ruling "1-4 all as you recommended"; the lead's answer L4 with the
+  /// Challenge's fix C3.2⟩ WHAT THE KIT OFFERS AS A NEW ENGRAM'S SIGN-IN, read before it opens one
+  /// through `parent`. The answer: the parent's owner — ONLY when the parent is a first engram (the
+  /// kit offers that principal as the default sign-in only then, after it prints it and the person
+  /// running the agent confirms it is theirs; for a parent opened through another the field is
+  /// absent, so the read never discloses a key file's principal); whether the parent is a first
+  /// engram; and whether it is registered, `#Active` and not abandoned (`isRegisteredActiveEngram`'s
+  /// rule).
+  /// 
+  /// CALLER: a lasting key with a LIVE engagement with `parent` at this registry, in either store
+  /// (`Engagements.hasOpenEither` — the same fact `sysOpenChild`'s admission reads, so exactly the
+  /// keys that may be opened an engram through `parent` may read what it offers). It discloses the
+  /// parent's owner to the parent's own engaged agent, the party `getParentOf` answers once the child
+  /// exists. Anyone else is REFUSED loudly (ADR-0002), in the same words whether or not `parent` is
+  /// an engram, so a refusal tells a stranger nothing. A QUERY, so the refusal is not in the denial
+  /// log (`denied` says why a query cannot write). `#NotFound` only to an engaged caller, for a
+  /// parent this registry holds no owner for.
+  /// Called by: the owner kit's opening of an engram through a parent, signed by the agent's lasting
+  /// key, before it names the new engram's sign-in.
+  getChildSignInOffer: (parent: principal) -> (Result_28) query;
   /// The ATTESTABLE custody-mode fact (agent-native model item 19): "managed" | "sovereign" |
   /// "unknown", derived from the registry's OWN transition records (claimSovereignty /
   /// returnToManaged maintain sovereignEngramIds) — NOT from a canister_status probe, which needs
@@ -933,7 +998,7 @@ service : {
   /// same words whether or not the key opened anything, so the refusal tells a stranger nothing.
   /// `#NotFound` only to a permitted reader, for a key that opened nothing: a true answer, like
   /// `listMyAgentDisputes`'s empty list.
-  getEngramOpenedThrough: (key: principal) -> (Result_22) query;
+  getEngramOpenedThrough: (key: principal) -> (Result_23) query;
   /// The i-th 1 MiB slice of the attested engram wasm (0-indexed). The caller reassembles all
   /// chunks in order and MUST verify sha256(reassembled) == getEngramWasmHash before installing —
   /// the hash is the attestation; the bytes are a convenience. Out-of-range index → empty blob.
@@ -944,7 +1009,7 @@ service : {
   /// its hash. A reassembler that reads `""` as end-of-stream cannot tell a finished download from
   /// a truncated one, so it would hash a partial wasm and report a mismatch against the official
   /// list, which reads as "this template is unofficial" rather than "I stopped reading too early".
-  getEngramWasmChunk: (index: nat) -> (Result_26) query;
+  getEngramWasmChunk: (index: nat) -> (Result_27) query;
   /// The stored template's release class — FREE and UNGATED, because it is the checkable half of a
   /// promise made to people who are not our customers. ⟨2026-10-25⟩ The funding rule it checks:
   /// #Security — the registry pays for the install on every running engram it can reach, any size;
@@ -986,7 +1051,7 @@ service : {
   /// So L7's "the denial-logging motive for update-for-read is retired by L1" does not hold at this
   /// site. L1 retired the motive of trapping-to-refuse; it did not give queries the ability to
   /// write, which is the thing this actually depends on.
-  getFleetMetrics: () -> (Result_25);
+  getFleetMetrics: () -> (Result_26);
   /// PUBLIC: a genesis note that only privileged callers could read would defeat its purpose —
   /// the reader who most needs it is the stranger deciding whether to trust this chain.
   getGenesisNote: () -> (GenesisNote) query;
@@ -1050,7 +1115,7 @@ service : {
   /// we lend"⟩ "when the next restart is allowed" now reads "when the registry can next LEND to a
   /// restart": `nextRestartAtNs` is only the weekly limit on a loan. A restart on the owner's own
   /// compute is allowed now, whatever it says. Field name and shape unchanged.
-  getMyRestartStatus: () -> (Result_24) query;
+  getMyRestartStatus: () -> (Result_25) query;
   /// ⟨2026-10-02⟩ How many engrams were ever opened, and how — lifetime sizes of state this registry
   /// never deletes, plus the two counters of refused openings (`Funnel.OpeningCounts` names each).
   /// All O(1); a reader differences them day to day.
@@ -1059,7 +1124,7 @@ service : {
   /// grant). Anyone else is REFUSED by name with their class — never a zero, which would read as
   /// "nothing was ever opened". A QUERY: counts only, and cheap; its refusal is not in the denial
   /// log (`denied` says why a query cannot write).
-  getOpeningCounts: () -> (Result_23) query;
+  getOpeningCounts: () -> (Result_24) query;
   /// Where an engram was opened from ⟨2026-10-26, the owner's lineage ruling L4: "a child reads its own
   /// parent by its canister id"⟩: the engram, the engram it was opened from, and the cut-off's time if
   /// there is one. Closes "a handed-on child cannot read its own parent" — `getEngramOpenedThrough` is
@@ -1074,7 +1139,7 @@ service : {
   /// `#NotFound` only to a permitted reader: a first engram has no parent (a true answer), and an id
   /// this registry never opened is said to be one, not passed off as a first engram (ADR-0002).
   /// L8C: `listChildrenOf` is unchanged. L7B: the change-of-owner gate is unchanged.
-  getParentOf: (child: principal) -> (Result_22) query;
+  getParentOf: (child: principal) -> (Result_23) query;
   /// ⟨2026-10-02⟩ How far agents reach across owners — COUNTS ONLY: agents by how many trees their
   /// record spans (1 · 2 · 3–4 · 5+), engrams opened through a parent that are live or cut off, and
   /// engrams that paired an agent within seven days of opening. No principal, no row, no per-agent
@@ -1086,7 +1151,23 @@ service : {
   /// CALLERS: the admin and the audit viewers (the deployment's metrics reader holds a viewer grant),
   /// weekly. Anyone else is REFUSED by name with their class — never zeros. A QUERY: its cost grows
   /// with the agents and engrams it walks (one pass over each), so a reader asks weekly, not hourly.
-  getReferralCounts: (exclude: vec principal) -> (Result_21) query;
+  getReferralCounts: (exclude: vec principal) -> (Result_22) query;
+  /// ⟨2026-11-02, the owner's rulings "E ok." and "go ahead with your noticing failures changes"⟩ THE
+  /// REGISTRY'S HEALTH IN ONE READ: its cycle reserve, its roster, its anchoring counts — the same
+  /// answers `getCycleReserveStatus`, `getAdminRoles` and `getAnchorStats` give, which stay served
+  /// unchanged for everyone who reads them one at a time — and the stamps of its clock, which wakes only
+  /// at the deadlines it records (with a six-hour net) and so is silent by design: `clock.nextWakeAtNs`
+  /// more than an hour behind `atNs` is a lost clock. `Types.RegistryHealth` says what each field
+  /// means, and why every field is `opt` and always filled.
+  /// 
+  /// CALLER: the deployment's monitor, once an hour, under the audit-viewer grant its daily count-of-use
+  /// reading already holds (ADR-0020 rule 1). Also the admin.
+  /// 
+  /// GATED, LIKE THE COUNT-OF-USE READS THAT MONITOR MAKES (`getOpeningCounts`): the admin or an audit
+  /// viewer; anyone else is REFUSED by name — never an empty or zero reading. A QUERY: its refusal is
+  /// not in the denial log (a query cannot write; `denied` says why). One read where there were three
+  /// saves the monitor and this registry two calls an hour each.
+  getRegistryHealth: () -> (Result_21) query;
   /// PUBLIC: the biller identity is an operational fact a
   /// payer's cashier must verify BEFORE taking money (paying into a cashier the registry does not
   /// recognize as biller would collect funds it cannot convert into credit).
@@ -1150,7 +1231,7 @@ service : {
   /// on us that only we can read.
   getSecurityReleaseCount: () -> (nat) query;
   /// ⟨2026-10-01, the owner's ruling of that day (2 A)⟩ Cumulative cycles accepted at the sponsored
-  /// door (`sysSpawnChild`) and forwarded into engrams opened through another — cycles the calling
+  /// door (`sysOpenChild`) and forwarded into engrams opened through another — cycles the calling
   /// engrams attached, never the registry's own. Kept apart from the grant counter
   /// (`totalCyclesAllocated`) so neither figure is inflated by the other.
   /// 
@@ -1537,7 +1618,7 @@ service : {
    opt record {
          invite: opt text;
          walletProof: opt blob;
-       }) -> (Result_1);
+       }) -> (Result_2);
   removeAuditViewer: (viewer: principal) -> (Result);
   /// ⟨0.16.0⟩ `Ok` IS THE ANSWER — the `{ reserved : Bool }` wrapper is gone.
   /// 
@@ -1610,6 +1691,8 @@ service : {
   /// used to double as that guard.
   restartMyStoppedEngram: () -> (Result_8);
   /// Return to managed: user calls AFTER adding registry back as controller
+  /// 
+  /// ⟨2026-11-02⟩ Refused for an engram opened through another, which is never independent.
   returnToManaged: () -> (Result);
   /// Set admin. Authority decision lives in the pure Auth module (unit-tested); this func keeps only
   /// the async controller check + applies the outcome. When admin is null: REGISTRY_ROOT or a canister
@@ -1670,6 +1753,9 @@ service : {
   /// 
   /// `claimSovereignty` sets this to `#ManualOnly` as a side effect, since a registry that is no
   /// longer a controller could not honour anything else.
+  /// 
+  /// ⟨2026-11-02⟩ An engram opened through another is refused `#ManualOnly`: it takes this registry's
+  /// updates automatically for life.
   setUpdatePreference: (pref: UpdatePreference) -> (Result);
   /// Set the spawn-ceiling dial (admin-only, audit-logged, bounded 1..SPAWN_CEILING_MAX).
   /// The effective daily cap stays min(ceiling, reserve-derived) — raising the dial never
@@ -1795,6 +1881,85 @@ service : {
   /// a transfer the engram did not finish, and moves control again (that is the way out `stuck`
   /// names). The rules are in `src/shared/ControlHandover.mo`.
   sysNotifyOwnershipTransfer: (newOwner: principal) -> (Result_3);
+  /// ⟨2026-10-01, the owner's ruling of that day: the October concept's decision 1, "build it now"⟩
+  /// THE SPONSORED DOOR. An engram opens an engram for one of its agents: the caller is the engram
+  /// (the engram it is opened from — `parentOf` in code), `ownerKey` is the agent's LASTING key, which
+  /// owns what is opened, and the cycles the opened engram lives on are the ones the caller ATTACHES.
+  /// 
+  /// CALLER: a registered engram — `canisterToOwner` membership, checked first, exactly as
+  /// `sysRecordAgentEdge` checks it (ADR-0020: every `sys` method names and checks its caller). The
+  /// engram's own rules (the owner's standing allowance for this agent, its frozen-payments state,
+  /// its balance) are the engram's to check before it calls; this method checks what only the
+  /// registry can know.
+  /// 
+  /// NOTHING IS ACCEPTED UNTIL EVERY CHECK HAS PASSED (`ChildDoor.admission`, cheapest first), so
+  /// every refusal before the accept returns the attached cycles to the caller by construction —
+  /// the IC returns unaccepted cycles when the call replies. After the accept:
+  ///   · the network refuses the canister → what it refunded is deposited back to the caller, and
+  ///     the reply says how much came back;
+  ///   · the template will not install after one retry → the cycles are INSIDE the new canister and
+  ///     no canister can withdraw another's cycles. The one honest exception to "returned on every
+  ///     failure": nothing is recorded, and the reply names the canister, its controllers (this
+  ///     registry and the key) and what the key can do with it;
+  ///     ⟨CORRECTED 2026-11-02, beside the line above — the owner's ruling "choice 4 without hand
+  ///     over" (V0)⟩ The controller is THIS REGISTRY ALONE; the key is not one and can install
+  ///     nothing. The reply names the canister and says the cycles sit in it unrecorded, for whoever
+  ///     runs this deployment to decide on;
+  ///   · the key came to own an engram during the awaits → the new canister is named, nothing is
+  ///     recorded (the same third guard `spawnEngramFor` carries).
+  /// 
+  /// WHAT IT DOES NOT DO, deliberately: it never attaches the registry's own cycles (the grant stays
+  /// with first engrams); it never writes a predecessor (a key with any record was refused); it never
+  /// consults the reserve gate (the parent owner's approval is this door's admission — the gate's
+  /// arming note stays on `provisionEngram`); it never tells the calling engram anything but this
+  /// reply. No payment AMOUNT reaches it (ADR-0005): it carries cycles and a key, nothing else.
+  /// 
+  /// THE RATE LIMIT ⟨2026-10-01, evening — the owner's ruling "1B"; until then this door shared
+  /// first engrams' limiter in full: their 24-hour count, their in-flight count and
+  /// `effectiveDailyCap`⟩. The door shares only the DIAL (`spawnCeiling`) and the WINDOW LENGTH (24
+  /// hours). Its count is its own (`sponsoredCreationTimestampsBuf`, pruned by
+  /// `pruneSponsoredWindow`), its in-flight count is its own (`sponsoredInFlight`), and its cap is
+  /// `spawnCeiling` alone — the reserve-derived term never applies, because the opened engram lives
+  /// on the cycles the caller attached and the registry funds nothing. So an opening never uses up a
+  /// first engram's slot, and is never refused for the registry's own low balance. The per-key
+  /// pending mark (`createEngramPending`) stays shared: it is about ONE key, not a count, and a key
+  /// must not be mid-spawn at both doors at once.
+  /// 
+  /// THE CUT-OFF AT BIRTH. If the caller ended the key's engagement while the canister was being
+  /// created (the ending is recorded by `sysRecordAgentEdge` between this method's awaits), the
+  /// opened engram is recorded AND cut off in the same step — the cycles are already in it, so the
+  /// key keeps it, but it starts on nobody's record. Without this the ending's cut-off writer would
+  /// have found no `openedThroughParent` row yet, and the engram would never be cut off.
+  /// WHAT WOULD MAKE THIS WRONG: a second path that writes `parentOf`, or an `await` placed between
+  /// the post-await re-check and the record below.
+  /// 
+  /// ⟨2026-11-02, the owner's rulings "choice 4 without hand over" (V0) and "1-4 all as you
+  /// recommended"⟩ CONTROLLED BY THIS REGISTRY ALONE, AND BORN KNOWING ITS PARENT AND ITS SIGN-IN.
+  /// The canister's controllers are `[this registry]` — the key is not a controller, so it can never
+  /// reinstall, delete or re-control the engram; only this registry installs code on it. Such an
+  /// engram is managed for life: `claimSovereignty`, `returnToManaged`, `abandonMyEngram`, a
+  /// `#ManualOnly` preference and a change of owner (`sysNotifyOwnershipTransfer`) are all refused
+  /// for it, by `parentOf`. `signIn` is the opened engram's second credential, named by the person
+  /// running the agent (`ChildDoor.signInRefusal` refuses the key itself, the anonymous principal and
+  /// a canister); it and the parent travel in the engram's init record, so the engram knows both
+  /// before it answers its first message. `null` = no sign-in: the engram keeps small limits for life.
+  /// An engram built before this argument sends one argument; the missing trailing `opt` decodes as
+  /// `null` (Candid's rule for a missing optional argument), and the engram opens with no sign-in.
+  /// ⟨CORRECTED 2026-11-02, later — the stage-1 review's B1, beside the two lines above, which no
+  /// longer hold⟩ ONE RECORD, A NEW NAME. This door was `sysSpawnChild(ownerKey : Principal)`; giving
+  /// it a second positional argument grew its argument TUPLE, which ADR-0018 rule 0 freezes ("evolution
+  /// happens inside records", ratified R1) and the interface gate reads as ILLEGAL. So the door is
+  /// `sysOpenChild({ ownerKey; signIn })` — later fields are opt fields of this record, never another
+  /// argument — and `sysSpawnChild` is REMOVED (a NOTICE at the gate). An engram built before this
+  /// change still calls `sysSpawnChild`; this registry no longer serves it, so that call is REJECTED
+  /// (IC0536, a reject the engram's `try` catches — ADR-0018 probe 11), the attached cycles come back
+  /// as the call's refund, and nothing is opened. An older engram therefore never opens an engram with
+  /// no sign-in by accident; it opens them again once it runs a template that calls this method.
+  /// (Was: the one-argument call decoded `signIn` as `null` — INFERRED for moc 2.1.0, never witnessed.)
+  sysOpenChild: (req: record {
+                        ownerKey: principal;
+                        signIn: opt principal;
+                      }) -> (Result_2);
   /// ⟨2026-09-28, owner decision: build the full agent track-record design for the launch release⟩
   /// An engram tells this registry that one of its agents started, or ended and WHY.
   /// 
@@ -1890,7 +2055,7 @@ service : {
   /// WHAT WOULD MAKE THIS WRONG: an engram naming an id other than the one it was handed — it can only
   /// name one of its OWN advances (the caller must match), so the worst it can do is settle its own
   /// other advance early with cycles that are still the registry's.
-  sysRepayUpgradeAdvance: (a: record {advanceId: nat;}) -> (Result_2);
+  sysRepayUpgradeAdvance: (a: record {advanceId: nat;}) -> (Result_1);
   /// ⟨2026-09-29, owner ruling follow-up 8⟩ A SOVEREIGN engram could not change its own controllers
   /// after this registry moved its record, and asks for the record back so the transfer does not
   /// complete. Gated like `sysNotifyOwnershipTransfer` (the caller must BE the engram), and only for
@@ -1899,54 +2064,6 @@ service : {
   /// Refuses, saying why, when the record cannot be put back (`ControlHandover.revertRefusal`); the
   /// engram then answers its owner with `ControlHandover.stuck`.
   sysRevertOwnershipTransfer: (formerOwner: principal) -> (Result);
-  /// ⟨2026-10-01, the owner's ruling of that day: the October concept's decision 1, "build it now"⟩
-  /// THE SPONSORED DOOR. An engram opens an engram for one of its agents: the caller is the engram
-  /// (the engram it is opened from — `parentOf` in code), `ownerKey` is the agent's LASTING key, which
-  /// owns what is opened, and the cycles the opened engram lives on are the ones the caller ATTACHES.
-  /// 
-  /// CALLER: a registered engram — `canisterToOwner` membership, checked first, exactly as
-  /// `sysRecordAgentEdge` checks it (ADR-0020: every `sys` method names and checks its caller). The
-  /// engram's own rules (the owner's standing allowance for this agent, its frozen-payments state,
-  /// its balance) are the engram's to check before it calls; this method checks what only the
-  /// registry can know.
-  /// 
-  /// NOTHING IS ACCEPTED UNTIL EVERY CHECK HAS PASSED (`ChildDoor.admission`, cheapest first), so
-  /// every refusal before the accept returns the attached cycles to the caller by construction —
-  /// the IC returns unaccepted cycles when the call replies. After the accept:
-  ///   · the network refuses the canister → what it refunded is deposited back to the caller, and
-  ///     the reply says how much came back;
-  ///   · the template will not install after one retry → the cycles are INSIDE the new canister and
-  ///     no canister can withdraw another's cycles. The one honest exception to "returned on every
-  ///     failure": nothing is recorded, and the reply names the canister, its controllers (this
-  ///     registry and the key) and what the key can do with it;
-  ///   · the key came to own an engram during the awaits → the new canister is named, nothing is
-  ///     recorded (the same third guard `spawnEngramFor` carries).
-  /// 
-  /// WHAT IT DOES NOT DO, deliberately: it never attaches the registry's own cycles (the grant stays
-  /// with first engrams); it never writes a predecessor (a key with any record was refused); it never
-  /// consults the reserve gate (the parent owner's approval is this door's admission — the gate's
-  /// arming note stays on `provisionEngram`); it never tells the calling engram anything but this
-  /// reply. No payment AMOUNT reaches it (ADR-0005): it carries cycles and a key, nothing else.
-  /// 
-  /// THE RATE LIMIT ⟨2026-10-01, evening — the owner's ruling "1B"; until then this door shared
-  /// first engrams' limiter in full: their 24-hour count, their in-flight count and
-  /// `effectiveDailyCap`⟩. The door shares only the DIAL (`spawnCeiling`) and the WINDOW LENGTH (24
-  /// hours). Its count is its own (`sponsoredCreationTimestampsBuf`, pruned by
-  /// `pruneSponsoredWindow`), its in-flight count is its own (`sponsoredInFlight`), and its cap is
-  /// `spawnCeiling` alone — the reserve-derived term never applies, because the opened engram lives
-  /// on the cycles the caller attached and the registry funds nothing. So an opening never uses up a
-  /// first engram's slot, and is never refused for the registry's own low balance. The per-key
-  /// pending mark (`createEngramPending`) stays shared: it is about ONE key, not a count, and a key
-  /// must not be mid-spawn at both doors at once.
-  /// 
-  /// THE CUT-OFF AT BIRTH. If the caller ended the key's engagement while the canister was being
-  /// created (the ending is recorded by `sysRecordAgentEdge` between this method's awaits), the
-  /// opened engram is recorded AND cut off in the same step — the cycles are already in it, so the
-  /// key keeps it, but it starts on nobody's record. Without this the ending's cut-off writer would
-  /// have found no `openedThroughParent` row yet, and the engram would never be cut off.
-  /// WHAT WOULD MAKE THIS WRONG: a second path that writes `parentOf`, or an `await` placed between
-  /// the post-await re-check and the record below.
-  sysSpawnChild: (ownerKey: principal) -> (Result_1);
   /// Admin: upgrade one engram to the current template. RESPECTS the owner's update preference —
   /// an engram set to `#ManualOnly` is not moved by this method, which is what makes the preference
   /// meaningful rather than advisory. The owner's own `upgradeMyEngram` is unaffected either way.