@engramx/idl 0.16.0-rc.21 → 0.16.0-rc.22

package/dist/registry.idl.d.ts

@@ -86,6 +86,11 @@ export interface ChangelogEntry {
   releaseNotes: string;
   version: string;
 }
+export interface ChildSignInOffer {
+  parentActive: boolean;
+  parentIsFirstEngram: boolean;
+  parentOwner: [] | [Principal];
+}
 export type ControlStep = { EngramMustMove: null } | { MovedByRegistry: null };
 export type CustodyMode = { Sovereign: null } | { Managed: null };
 export interface Dispute {
@@ -286,6 +291,23 @@ export interface ReferralCounts {
   throughParent: PairedSoon;
   agentsByTreesSpanned: TreesSpanned;
 }
+export interface RegistryClockHealth {
+  nextWakeAtNs: [] | [bigint];
+  lastAttemptAtNs: [] | [bigint];
+  attemptTotal: [] | [bigint];
+  lastErrorAtNs: [] | [bigint];
+  okTotal: [] | [bigint];
+  overdue: [] | [bigint];
+  lastError: [] | [string];
+  lastOkAtNs: [] | [bigint];
+}
+export interface RegistryHealth {
+  anchors: [] | [AnchorStats];
+  adminRoles: [] | [AdminRoles];
+  atNs: [] | [bigint];
+  clock: [] | [RegistryClockHealth];
+  cycleReserve: [] | [{ cycleBalance: bigint; minOperatingReserveCycles: bigint }];
+}
 export type ReleaseClass = { Security: null } | { Feature: null };
 export interface ReservationView {
   reservedAtNs: bigint;
@@ -318,7 +340,7 @@ export interface RestartTotals {
   advancePaid: bigint;
 }
 export type Result = { Ok: null } | { Err: Error };
-export type Result_1 = { Ok: Principal } | { Err: Error };
+export type Result_1 = { Ok: { accepted: bigint } } | { Err: Error };
 export type Result_10 = { Ok: CustodyMode } | { Err: Error };
 export type Result_11 = { Ok: Array<string> } | { Err: Error };
 export type Result_12 = { Ok: Page } | { Err: Error };
@@ -329,17 +351,19 @@ export type Result_16 = { Ok: Array<OpenedEngram> } | { Err: Error };
 export type Result_17 = { Ok: Page_5 } | { Err: Error };
 export type Result_18 = { Ok: RecordPage } | { Err: Error };
 export type Result_19 = { Ok: Page_6 } | { Err: Error };
-export type Result_2 = { Ok: { accepted: bigint } } | { Err: Error };
+export type Result_2 = { Ok: Principal } | { Err: Error };
 export type Result_20 = { Ok: [] | [string] } | { Err: Error };
-export type Result_21 = { Ok: ReferralCounts } | { Err: Error };
-export type Result_22 = { Ok: OpenedThrough } | { Err: Error };
-export type Result_23 = { Ok: OpeningCounts } | { Err: Error };
-export type Result_24 = { Ok: RestartStatus } | { Err: Error };
-export type Result_25 = { Ok: PrivateMetrics } | { Err: Error };
-export type Result_26 = { Ok: Uint8Array | number[] } | { Err: Error };
-export type Result_27 = { Ok: CertifiedStanding } | { Err: Error };
-export type Result_28 = { Ok: FleetCycleHealth } | { Err: Error };
+export type Result_21 = { Ok: RegistryHealth } | { Err: Error };
+export type Result_22 = { Ok: ReferralCounts } | { Err: Error };
+export type Result_23 = { Ok: OpenedThrough } | { Err: Error };
+export type Result_24 = { Ok: OpeningCounts } | { Err: Error };
+export type Result_25 = { Ok: RestartStatus } | { Err: Error };
+export type Result_26 = { Ok: PrivateMetrics } | { Err: Error };
+export type Result_27 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_28 = { Ok: ChildSignInOffer } | { Err: Error };
+export type Result_29 = { Ok: CertifiedStanding } | { Err: Error };
 export type Result_3 = { Ok: ControlStep } | { Err: Error };
+export type Result_30 = { Ok: FleetCycleHealth } | { Err: Error };
 export type Result_4 = { Ok: MeterReading } | { Err: Error };
 export type Result_5 = { Ok: { repaid: bigint; stillOwed: bigint } } | { Err: Error };
 export type Result_6 =
@@ -407,6 +431,9 @@ export interface _SERVICE {
    * / CANISTER ID, so an engram's ciphertext and wallet cannot follow it anywhere (engramx
    * / docs/ENCRYPTION-OPERATIONS.md, "Canister-id binding"). Abandoning is starting over, not
    * / migrating, and the caller must be told so before they do it.
+   * /
+   * / ⟨2026-11-02⟩ REFUSED for an engram opened through another: it is never abandoned, so it stays on
+   * / this registry's security updates for life; it ends by its parent's cut-off or by running dry.
    */
   abandonMyEngram: ActorMethod<[], Result>;
   addAuditViewer: ActorMethod<[Principal], Result>;
@@ -449,6 +476,9 @@ export interface _SERVICE {
    * / ⚠ IT IS REVERSIBLE, which is the fact most worth publishing: the engram's own
    * / `returnToManaged` adds the registry back ALONGSIDE the owner. Sovereignty is a door, not a
    * / cliff.
+   * /
+   * / ⟨2026-11-02, the owner's ruling "choice 4 without hand over"⟩ REFUSED for an engram opened
+   * / through another: it stays managed by this registry for life, and its key is never a controller.
    */
   claimSovereignty: ActorMethod<[], Result>;
   /**
@@ -514,7 +544,7 @@ export interface _SERVICE {
    * / this one is a noun. That gate now reads the census's L7 citations as a second population for
    * / exactly this blind spot.⟩
    */
-  fleetCycleHealth: ActorMethod<[bigint, bigint, bigint], Result_28>;
+  fleetCycleHealth: ActorMethod<[bigint, bigint, bigint], Result_30>;
   /**
    * / PUBLIC: ⟨0.16.0, L2.4⟩ `fleetSummary` — the ONE public projection of this registry,
    * / replacing `status()` and ABSORBING `publicMetrics()`.
@@ -627,7 +657,7 @@ export interface _SERVICE {
    * / `listAgents`. "The agent itself" is a caller holding that root key. A key for one engram has no
    * / record of its own here; asking about one gets the refusal or, from the key itself, `#NotFound`.
    */
-  getAgentStanding: ActorMethod<[Principal], Result_27>;
+  getAgentStanding: ActorMethod<[Principal], Result_29>;
   /**
    * / Fleet-wide anchoring liveness. Exists because ABSENCE is otherwise uninformative: an engram
    * / that never wrote, one still on a template without the push, and one whose push is broken all
@@ -704,6 +734,28 @@ export interface _SERVICE {
    * / bytes is never a fingerprint, and answers `null` before the lookup.
    */
   getCertifiedBirth: ActorMethod<[Uint8Array | number[]], [] | [CertifiedBirth]>;
+  /**
+   * / ⟨2026-11-02, the owner's ruling "1-4 all as you recommended"; the lead's answer L4 with the
+   * / Challenge's fix C3.2⟩ WHAT THE KIT OFFERS AS A NEW ENGRAM'S SIGN-IN, read before it opens one
+   * / through `parent`. The answer: the parent's owner — ONLY when the parent is a first engram (the
+   * / kit offers that principal as the default sign-in only then, after it prints it and the person
+   * / running the agent confirms it is theirs; for a parent opened through another the field is
+   * / absent, so the read never discloses a key file's principal); whether the parent is a first
+   * / engram; and whether it is registered, `#Active` and not abandoned (`isRegisteredActiveEngram`'s
+   * / rule).
+   * /
+   * / CALLER: a lasting key with a LIVE engagement with `parent` at this registry, in either store
+   * / (`Engagements.hasOpenEither` — the same fact `sysOpenChild`'s admission reads, so exactly the
+   * / keys that may be opened an engram through `parent` may read what it offers). It discloses the
+   * / parent's owner to the parent's own engaged agent, the party `getParentOf` answers once the child
+   * / exists. Anyone else is REFUSED loudly (ADR-0002), in the same words whether or not `parent` is
+   * / an engram, so a refusal tells a stranger nothing. A QUERY, so the refusal is not in the denial
+   * / log (`denied` says why a query cannot write). `#NotFound` only to an engaged caller, for a
+   * / parent this registry holds no owner for.
+   * / Called by: the owner kit's opening of an engram through a parent, signed by the agent's lasting
+   * / key, before it names the new engram's sign-in.
+   */
+  getChildSignInOffer: ActorMethod<[Principal], Result_28>;
   /**
    * / The ATTESTABLE custody-mode fact (agent-native model item 19): "managed" | "sovereign" |
    * / "unknown", derived from the registry's OWN transition records (claimSovereignty /
@@ -774,7 +826,7 @@ export interface _SERVICE {
    * / `#NotFound` only to a permitted reader, for a key that opened nothing: a true answer, like
    * / `listMyAgentDisputes`'s empty list.
    */
-  getEngramOpenedThrough: ActorMethod<[Principal], Result_22>;
+  getEngramOpenedThrough: ActorMethod<[Principal], Result_23>;
   /**
    * / The i-th 1 MiB slice of the attested engram wasm (0-indexed). The caller reassembles all
    * / chunks in order and MUST verify sha256(reassembled) == getEngramWasmHash before installing —
@@ -787,7 +839,7 @@ export interface _SERVICE {
    * / a truncated one, so it would hash a partial wasm and report a mismatch against the official
    * / list, which reads as "this template is unofficial" rather than "I stopped reading too early".
    */
-  getEngramWasmChunk: ActorMethod<[bigint], Result_26>;
+  getEngramWasmChunk: ActorMethod<[bigint], Result_27>;
   /**
    * / The stored template's release class — FREE and UNGATED, because it is the checkable half of a
    * / promise made to people who are not our customers. ⟨2026-10-25⟩ The funding rule it checks:
@@ -837,7 +889,7 @@ export interface _SERVICE {
    * / site. L1 retired the motive of trapping-to-refuse; it did not give queries the ability to
    * / write, which is the thing this actually depends on.
    */
-  getFleetMetrics: ActorMethod<[], Result_25>;
+  getFleetMetrics: ActorMethod<[], Result_26>;
   /**
    * / PUBLIC: a genesis note that only privileged callers could read would defeat its purpose —
    * / the reader who most needs it is the stranger deciding whether to trust this chain.
@@ -915,7 +967,7 @@ export interface _SERVICE {
    * / restart": `nextRestartAtNs` is only the weekly limit on a loan. A restart on the owner's own
    * / compute is allowed now, whatever it says. Field name and shape unchanged.
    */
-  getMyRestartStatus: ActorMethod<[], Result_24>;
+  getMyRestartStatus: ActorMethod<[], Result_25>;
   /**
    * / ⟨2026-10-02⟩ How many engrams were ever opened, and how — lifetime sizes of state this registry
    * / never deletes, plus the two counters of refused openings (`Funnel.OpeningCounts` names each).
@@ -926,7 +978,7 @@ export interface _SERVICE {
    * / "nothing was ever opened". A QUERY: counts only, and cheap; its refusal is not in the denial
    * / log (`denied` says why a query cannot write).
    */
-  getOpeningCounts: ActorMethod<[], Result_23>;
+  getOpeningCounts: ActorMethod<[], Result_24>;
   /**
    * / Where an engram was opened from ⟨2026-10-26, the owner's lineage ruling L4: "a child reads its own
    * / parent by its canister id"⟩: the engram, the engram it was opened from, and the cut-off's time if
@@ -943,7 +995,7 @@ export interface _SERVICE {
    * / this registry never opened is said to be one, not passed off as a first engram (ADR-0002).
    * / L8C: `listChildrenOf` is unchanged. L7B: the change-of-owner gate is unchanged.
    */
-  getParentOf: ActorMethod<[Principal], Result_22>;
+  getParentOf: ActorMethod<[Principal], Result_23>;
   /**
    * / ⟨2026-10-02⟩ How far agents reach across owners — COUNTS ONLY: agents by how many trees their
    * / record spans (1 · 2 · 3–4 · 5+), engrams opened through a parent that are live or cut off, and
@@ -957,7 +1009,25 @@ export interface _SERVICE {
    * / weekly. Anyone else is REFUSED by name with their class — never zeros. A QUERY: its cost grows
    * / with the agents and engrams it walks (one pass over each), so a reader asks weekly, not hourly.
    */
-  getReferralCounts: ActorMethod<[Array<Principal>], Result_21>;
+  getReferralCounts: ActorMethod<[Array<Principal>], Result_22>;
+  /**
+   * / ⟨2026-11-02, the owner's rulings "E ok." and "go ahead with your noticing failures changes"⟩ THE
+   * / REGISTRY'S HEALTH IN ONE READ: its cycle reserve, its roster, its anchoring counts — the same
+   * / answers `getCycleReserveStatus`, `getAdminRoles` and `getAnchorStats` give, which stay served
+   * / unchanged for everyone who reads them one at a time — and the stamps of its clock, which wakes only
+   * / at the deadlines it records (with a six-hour net) and so is silent by design: `clock.nextWakeAtNs`
+   * / more than an hour behind `atNs` is a lost clock. `Types.RegistryHealth` says what each field
+   * / means, and why every field is `opt` and always filled.
+   * /
+   * / CALLER: the deployment's monitor, once an hour, under the audit-viewer grant its daily count-of-use
+   * / reading already holds (ADR-0020 rule 1). Also the admin.
+   * /
+   * / GATED, LIKE THE COUNT-OF-USE READS THAT MONITOR MAKES (`getOpeningCounts`): the admin or an audit
+   * / viewer; anyone else is REFUSED by name — never an empty or zero reading. A QUERY: its refusal is
+   * / not in the denial log (a query cannot write; `denied` says why). One read where there were three
+   * / saves the monitor and this registry two calls an hour each.
+   */
+  getRegistryHealth: ActorMethod<[], Result_21>;
   /**
    * / PUBLIC: the biller identity is an operational fact a
    * / payer's cashier must verify BEFORE taking money (paying into a cashier the registry does not
@@ -1032,7 +1102,7 @@ export interface _SERVICE {
   getSecurityReleaseCount: ActorMethod<[], bigint>;
   /**
    * / ⟨2026-10-01, the owner's ruling of that day (2 A)⟩ Cumulative cycles accepted at the sponsored
-   * / door (`sysSpawnChild`) and forwarded into engrams opened through another — cycles the calling
+   * / door (`sysOpenChild`) and forwarded into engrams opened through another — cycles the calling
    * / engrams attached, never the registry's own. Kept apart from the grant counter
    * / (`totalCyclesAllocated`) so neither figure is inflated by the other.
    * /
@@ -1475,7 +1545,7 @@ export interface _SERVICE {
           },
         ],
     ],
-    Result_1
+    Result_2
   >;
   removeAuditViewer: ActorMethod<[Principal], Result>;
   /**
@@ -1563,6 +1633,8 @@ export interface _SERVICE {
   restartMyStoppedEngram: ActorMethod<[], Result_8>;
   /**
    * / Return to managed: user calls AFTER adding registry back as controller
+   * /
+   * / ⟨2026-11-02⟩ Refused for an engram opened through another, which is never independent.
    */
   returnToManaged: ActorMethod<[], Result>;
   /**
@@ -1643,6 +1715,9 @@ export interface _SERVICE {
    * /
    * / `claimSovereignty` sets this to `#ManualOnly` as a side effect, since a registry that is no
    * / longer a controller could not honour anything else.
+   * /
+   * / ⟨2026-11-02⟩ An engram opened through another is refused `#ManualOnly`: it takes this registry's
+   * / updates automatically for life.
    */
   setUpdatePreference: ActorMethod<[UpdatePreference], Result>;
   /**
@@ -1787,6 +1862,84 @@ export interface _SERVICE {
    * / names). The rules are in `src/shared/ControlHandover.mo`.
    */
   sysNotifyOwnershipTransfer: ActorMethod<[Principal], Result_3>;
+  /**
+   * / ⟨2026-10-01, the owner's ruling of that day: the October concept's decision 1, "build it now"⟩
+   * / THE SPONSORED DOOR. An engram opens an engram for one of its agents: the caller is the engram
+   * / (the engram it is opened from — `parentOf` in code), `ownerKey` is the agent's LASTING key, which
+   * / owns what is opened, and the cycles the opened engram lives on are the ones the caller ATTACHES.
+   * /
+   * / CALLER: a registered engram — `canisterToOwner` membership, checked first, exactly as
+   * / `sysRecordAgentEdge` checks it (ADR-0020: every `sys` method names and checks its caller). The
+   * / engram's own rules (the owner's standing allowance for this agent, its frozen-payments state,
+   * / its balance) are the engram's to check before it calls; this method checks what only the
+   * / registry can know.
+   * /
+   * / NOTHING IS ACCEPTED UNTIL EVERY CHECK HAS PASSED (`ChildDoor.admission`, cheapest first), so
+   * / every refusal before the accept returns the attached cycles to the caller by construction —
+   * / the IC returns unaccepted cycles when the call replies. After the accept:
+   * /   · the network refuses the canister → what it refunded is deposited back to the caller, and
+   * /     the reply says how much came back;
+   * /   · the template will not install after one retry → the cycles are INSIDE the new canister and
+   * /     no canister can withdraw another's cycles. The one honest exception to "returned on every
+   * /     failure": nothing is recorded, and the reply names the canister, its controllers (this
+   * /     registry and the key) and what the key can do with it;
+   * /     ⟨CORRECTED 2026-11-02, beside the line above — the owner's ruling "choice 4 without hand
+   * /     over" (V0)⟩ The controller is THIS REGISTRY ALONE; the key is not one and can install
+   * /     nothing. The reply names the canister and says the cycles sit in it unrecorded, for whoever
+   * /     runs this deployment to decide on;
+   * /   · the key came to own an engram during the awaits → the new canister is named, nothing is
+   * /     recorded (the same third guard `spawnEngramFor` carries).
+   * /
+   * / WHAT IT DOES NOT DO, deliberately: it never attaches the registry's own cycles (the grant stays
+   * / with first engrams); it never writes a predecessor (a key with any record was refused); it never
+   * / consults the reserve gate (the parent owner's approval is this door's admission — the gate's
+   * / arming note stays on `provisionEngram`); it never tells the calling engram anything but this
+   * / reply. No payment AMOUNT reaches it (ADR-0005): it carries cycles and a key, nothing else.
+   * /
+   * / THE RATE LIMIT ⟨2026-10-01, evening — the owner's ruling "1B"; until then this door shared
+   * / first engrams' limiter in full: their 24-hour count, their in-flight count and
+   * / `effectiveDailyCap`⟩. The door shares only the DIAL (`spawnCeiling`) and the WINDOW LENGTH (24
+   * / hours). Its count is its own (`sponsoredCreationTimestampsBuf`, pruned by
+   * / `pruneSponsoredWindow`), its in-flight count is its own (`sponsoredInFlight`), and its cap is
+   * / `spawnCeiling` alone — the reserve-derived term never applies, because the opened engram lives
+   * / on the cycles the caller attached and the registry funds nothing. So an opening never uses up a
+   * / first engram's slot, and is never refused for the registry's own low balance. The per-key
+   * / pending mark (`createEngramPending`) stays shared: it is about ONE key, not a count, and a key
+   * / must not be mid-spawn at both doors at once.
+   * /
+   * / THE CUT-OFF AT BIRTH. If the caller ended the key's engagement while the canister was being
+   * / created (the ending is recorded by `sysRecordAgentEdge` between this method's awaits), the
+   * / opened engram is recorded AND cut off in the same step — the cycles are already in it, so the
+   * / key keeps it, but it starts on nobody's record. Without this the ending's cut-off writer would
+   * / have found no `openedThroughParent` row yet, and the engram would never be cut off.
+   * / WHAT WOULD MAKE THIS WRONG: a second path that writes `parentOf`, or an `await` placed between
+   * / the post-await re-check and the record below.
+   * /
+   * / ⟨2026-11-02, the owner's rulings "choice 4 without hand over" (V0) and "1-4 all as you
+   * / recommended"⟩ CONTROLLED BY THIS REGISTRY ALONE, AND BORN KNOWING ITS PARENT AND ITS SIGN-IN.
+   * / The canister's controllers are `[this registry]` — the key is not a controller, so it can never
+   * / reinstall, delete or re-control the engram; only this registry installs code on it. Such an
+   * / engram is managed for life: `claimSovereignty`, `returnToManaged`, `abandonMyEngram`, a
+   * / `#ManualOnly` preference and a change of owner (`sysNotifyOwnershipTransfer`) are all refused
+   * / for it, by `parentOf`. `signIn` is the opened engram's second credential, named by the person
+   * / running the agent (`ChildDoor.signInRefusal` refuses the key itself, the anonymous principal and
+   * / a canister); it and the parent travel in the engram's init record, so the engram knows both
+   * / before it answers its first message. `null` = no sign-in: the engram keeps small limits for life.
+   * / An engram built before this argument sends one argument; the missing trailing `opt` decodes as
+   * / `null` (Candid's rule for a missing optional argument), and the engram opens with no sign-in.
+   * / ⟨CORRECTED 2026-11-02, later — the stage-1 review's B1, beside the two lines above, which no
+   * / longer hold⟩ ONE RECORD, A NEW NAME. This door was `sysSpawnChild(ownerKey : Principal)`; giving
+   * / it a second positional argument grew its argument TUPLE, which ADR-0018 rule 0 freezes ("evolution
+   * / happens inside records", ratified R1) and the interface gate reads as ILLEGAL. So the door is
+   * / `sysOpenChild({ ownerKey; signIn })` — later fields are opt fields of this record, never another
+   * / argument — and `sysSpawnChild` is REMOVED (a NOTICE at the gate). An engram built before this
+   * / change still calls `sysSpawnChild`; this registry no longer serves it, so that call is REJECTED
+   * / (IC0536, a reject the engram's `try` catches — ADR-0018 probe 11), the attached cycles come back
+   * / as the call's refund, and nothing is opened. An older engram therefore never opens an engram with
+   * / no sign-in by accident; it opens them again once it runs a template that calls this method.
+   * / (Was: the one-argument call decoded `signIn` as `null` — INFERRED for moc 2.1.0, never witnessed.)
+   */
+  sysOpenChild: ActorMethod<[{ ownerKey: Principal; signIn: [] | [Principal] }], Result_2>;
   /**
    * / ⟨2026-09-28, owner decision: build the full agent track-record design for the launch release⟩
    * / An engram tells this registry that one of its agents started, or ended and WHY.
@@ -1883,7 +2036,7 @@ export interface _SERVICE {
    * / name one of its OWN advances (the caller must match), so the worst it can do is settle its own
    * / other advance early with cycles that are still the registry's.
    */
-  sysRepayUpgradeAdvance: ActorMethod<[{ advanceId: bigint }], Result_2>;
+  sysRepayUpgradeAdvance: ActorMethod<[{ advanceId: bigint }], Result_1>;
   /**
    * / ⟨2026-09-29, owner ruling follow-up 8⟩ A SOVEREIGN engram could not change its own controllers
    * / after this registry moved its record, and asks for the record back so the transfer does not
@@ -1894,56 +2047,6 @@ export interface _SERVICE {
    * / engram then answers its owner with `ControlHandover.stuck`.
    */
   sysRevertOwnershipTransfer: ActorMethod<[Principal], Result>;
-  /**
-   * / ⟨2026-10-01, the owner's ruling of that day: the October concept's decision 1, "build it now"⟩
-   * / THE SPONSORED DOOR. An engram opens an engram for one of its agents: the caller is the engram
-   * / (the engram it is opened from — `parentOf` in code), `ownerKey` is the agent's LASTING key, which
-   * / owns what is opened, and the cycles the opened engram lives on are the ones the caller ATTACHES.
-   * /
-   * / CALLER: a registered engram — `canisterToOwner` membership, checked first, exactly as
-   * / `sysRecordAgentEdge` checks it (ADR-0020: every `sys` method names and checks its caller). The
-   * / engram's own rules (the owner's standing allowance for this agent, its frozen-payments state,
-   * / its balance) are the engram's to check before it calls; this method checks what only the
-   * / registry can know.
-   * /
-   * / NOTHING IS ACCEPTED UNTIL EVERY CHECK HAS PASSED (`ChildDoor.admission`, cheapest first), so
-   * / every refusal before the accept returns the attached cycles to the caller by construction —
-   * / the IC returns unaccepted cycles when the call replies. After the accept:
-   * /   · the network refuses the canister → what it refunded is deposited back to the caller, and
-   * /     the reply says how much came back;
-   * /   · the template will not install after one retry → the cycles are INSIDE the new canister and
-   * /     no canister can withdraw another's cycles. The one honest exception to "returned on every
-   * /     failure": nothing is recorded, and the reply names the canister, its controllers (this
-   * /     registry and the key) and what the key can do with it;
-   * /   · the key came to own an engram during the awaits → the new canister is named, nothing is
-   * /     recorded (the same third guard `spawnEngramFor` carries).
-   * /
-   * / WHAT IT DOES NOT DO, deliberately: it never attaches the registry's own cycles (the grant stays
-   * / with first engrams); it never writes a predecessor (a key with any record was refused); it never
-   * / consults the reserve gate (the parent owner's approval is this door's admission — the gate's
-   * / arming note stays on `provisionEngram`); it never tells the calling engram anything but this
-   * / reply. No payment AMOUNT reaches it (ADR-0005): it carries cycles and a key, nothing else.
-   * /
-   * / THE RATE LIMIT ⟨2026-10-01, evening — the owner's ruling "1B"; until then this door shared
-   * / first engrams' limiter in full: their 24-hour count, their in-flight count and
-   * / `effectiveDailyCap`⟩. The door shares only the DIAL (`spawnCeiling`) and the WINDOW LENGTH (24
-   * / hours). Its count is its own (`sponsoredCreationTimestampsBuf`, pruned by
-   * / `pruneSponsoredWindow`), its in-flight count is its own (`sponsoredInFlight`), and its cap is
-   * / `spawnCeiling` alone — the reserve-derived term never applies, because the opened engram lives
-   * / on the cycles the caller attached and the registry funds nothing. So an opening never uses up a
-   * / first engram's slot, and is never refused for the registry's own low balance. The per-key
-   * / pending mark (`createEngramPending`) stays shared: it is about ONE key, not a count, and a key
-   * / must not be mid-spawn at both doors at once.
-   * /
-   * / THE CUT-OFF AT BIRTH. If the caller ended the key's engagement while the canister was being
-   * / created (the ending is recorded by `sysRecordAgentEdge` between this method's awaits), the
-   * / opened engram is recorded AND cut off in the same step — the cycles are already in it, so the
-   * / key keeps it, but it starts on nobody's record. Without this the ending's cut-off writer would
-   * / have found no `openedThroughParent` row yet, and the engram would never be cut off.
-   * / WHAT WOULD MAKE THIS WRONG: a second path that writes `parentOf`, or an `await` placed between
-   * / the post-await re-check and the record below.
-   */
-  sysSpawnChild: ActorMethod<[Principal], Result_1>;
   /**
    * / Admin: upgrade one engram to the current template. RESPECTS the owner's update preference —
    * / an engram set to `#ManualOnly` is not moved by this method, which is what makes the preference

package/dist/registry.idl.js

@@ -21,7 +21,7 @@ export const idlFactory = ({ IDL }) => {
     sovereignSkipped: IDL.Nat,
     lowCycles: IDL.Nat,
   });
-  const Result_28 = IDL.Variant({ Ok: FleetCycleHealth, Err: Error });
+  const Result_30 = IDL.Variant({ Ok: FleetCycleHealth, Err: Error });
   const FleetSummary = IDL.Record({
     registrySinceNs: IDL.Opt(IDL.Int),
     uniqueOwners: IDL.Nat,
@@ -69,7 +69,7 @@ export const idlFactory = ({ IDL }) => {
     leaf: StandingLeaf,
     witness: IDL.Vec(IDL.Nat8),
   });
-  const Result_27 = IDL.Variant({ Ok: CertifiedStanding, Err: Error });
+  const Result_29 = IDL.Variant({ Ok: CertifiedStanding, Err: Error });
   const AnchorStats = IDL.Record({
     lastAnchorAtNs: IDL.Opt(IDL.Int),
     lastEngramAnchorAtNs: IDL.Opt(IDL.Int),
@@ -109,6 +109,12 @@ export const idlFactory = ({ IDL }) => {
     certificate: IDL.Opt(IDL.Vec(IDL.Nat8)),
     witness: IDL.Vec(IDL.Nat8),
   });
+  const ChildSignInOffer = IDL.Record({
+    parentActive: IDL.Bool,
+    parentIsFirstEngram: IDL.Bool,
+    parentOwner: IDL.Opt(IDL.Principal),
+  });
+  const Result_28 = IDL.Variant({ Ok: ChildSignInOffer, Err: Error });
   const CustodyMode = IDL.Variant({
     Sovereign: IDL.Null,
     Managed: IDL.Null,
@@ -119,8 +125,8 @@ export const idlFactory = ({ IDL }) => {
     child: IDL.Principal,
     parent: IDL.Principal,
   });
-  const Result_22 = IDL.Variant({ Ok: OpenedThrough, Err: Error });
-  const Result_26 = IDL.Variant({ Ok: IDL.Vec(IDL.Nat8), Err: Error });
+  const Result_23 = IDL.Variant({ Ok: OpenedThrough, Err: Error });
+  const Result_27 = IDL.Variant({ Ok: IDL.Vec(IDL.Nat8), Err: Error });
   const ReleaseClass = IDL.Variant({
     Security: IDL.Null,
     Feature: IDL.Null,
@@ -143,7 +149,7 @@ export const idlFactory = ({ IDL }) => {
     totalEngrams: IDL.Nat,
     activeEngrams: IDL.Nat,
   });
-  const Result_25 = IDL.Variant({ Ok: PrivateMetrics, Err: Error });
+  const Result_26 = IDL.Variant({ Ok: PrivateMetrics, Err: Error });
   const GenesisNote = IDL.Record({
     predecessorSize: IDL.Opt(IDL.Nat),
     predecessorHeadHash: IDL.Opt(IDL.Vec(IDL.Nat8)),
@@ -174,7 +180,7 @@ export const idlFactory = ({ IDL }) => {
     loanOwed: IDL.Nat,
     openUntilNs: IDL.Opt(IDL.Int),
   });
-  const Result_24 = IDL.Variant({ Ok: RestartStatus, Err: Error });
+  const Result_25 = IDL.Variant({ Ok: RestartStatus, Err: Error });
   const OpeningCounts = IDL.Record({
     reopened: IDL.Nat,
     openedThroughParent: IDL.Nat,
@@ -184,7 +190,7 @@ export const idlFactory = ({ IDL }) => {
     reservationAttemptsRefusedAtCapacity: IDL.Nat,
     spawnAttemptsRefusedAtCap: IDL.Nat,
   });
-  const Result_23 = IDL.Variant({ Ok: OpeningCounts, Err: Error });
+  const Result_24 = IDL.Variant({ Ok: OpeningCounts, Err: Error });
   const PairedSoon = IDL.Record({
     opened: IDL.Nat,
     pairedWithin7Days: IDL.Nat,
@@ -202,7 +208,30 @@ export const idlFactory = ({ IDL }) => {
     throughParent: PairedSoon,
     agentsByTreesSpanned: TreesSpanned,
   });
-  const Result_21 = IDL.Variant({ Ok: ReferralCounts, Err: Error });
+  const Result_22 = IDL.Variant({ Ok: ReferralCounts, Err: Error });
+  const RegistryClockHealth = IDL.Record({
+    nextWakeAtNs: IDL.Opt(IDL.Int),
+    lastAttemptAtNs: IDL.Opt(IDL.Int),
+    attemptTotal: IDL.Opt(IDL.Nat),
+    lastErrorAtNs: IDL.Opt(IDL.Int),
+    okTotal: IDL.Opt(IDL.Nat),
+    overdue: IDL.Opt(IDL.Nat),
+    lastError: IDL.Opt(IDL.Text),
+    lastOkAtNs: IDL.Opt(IDL.Int),
+  });
+  const RegistryHealth = IDL.Record({
+    anchors: IDL.Opt(AnchorStats),
+    adminRoles: IDL.Opt(AdminRoles),
+    atNs: IDL.Opt(IDL.Int),
+    clock: IDL.Opt(RegistryClockHealth),
+    cycleReserve: IDL.Opt(
+      IDL.Record({
+        cycleBalance: IDL.Nat,
+        minOperatingReserveCycles: IDL.Nat,
+      }),
+    ),
+  });
+  const Result_21 = IDL.Variant({ Ok: RegistryHealth, Err: Error });
   const ReserveGateConfig = IDL.Record({
     enabled: IDL.Bool,
     inviteIssuer: IDL.Principal,
@@ -373,7 +402,7 @@ export const idlFactory = ({ IDL }) => {
     frozen: IDL.Bool,
   });
   const Result_9 = IDL.Variant({ Ok: EngramComputeView, Err: Error });
-  const Result_1 = IDL.Variant({ Ok: IDL.Principal, Err: Error });
+  const Result_2 = IDL.Variant({ Ok: IDL.Principal, Err: Error });
   const RestartReply = IDL.Record({
     securityInstalled: IDL.Bool,
     lentCycles: IDL.Nat,
@@ -415,7 +444,7 @@ export const idlFactory = ({ IDL }) => {
     inviteCode: IDL.Text,
   });
   const EdgeEvent = IDL.Variant({ Ended: Ending, Added: EnrolmentProof });
-  const Result_2 = IDL.Variant({
+  const Result_1 = IDL.Variant({
     Ok: IDL.Record({ accepted: IDL.Nat }),
     Err: Error,
   });
@@ -428,7 +457,7 @@ export const idlFactory = ({ IDL }) => {
     engramWasmFinalize: IDL.Func([IDL.Text], [Result_7], []),
     engramWasmInit: IDL.Func([], [Result], []),
     engramWasmPushChunk: IDL.Func([IDL.Vec(IDL.Nat8)], [Result_7], []),
-    fleetCycleHealth: IDL.Func([IDL.Nat, IDL.Nat, IDL.Nat], [Result_28], []),
+    fleetCycleHealth: IDL.Func([IDL.Nat, IDL.Nat, IDL.Nat], [Result_30], []),
     fleetSummary: IDL.Func([], [FleetSummary], ['query']),
     getAbandonedAtNs: IDL.Func([IDL.Principal], [IDL.Opt(IDL.Int)], ['query']),
     getActivationFunnel: IDL.Func([], [ActivationFunnel], ['query']),
@@ -438,12 +467,13 @@ export const idlFactory = ({ IDL }) => {
       [IDL.Record({ agents: IDL.Nat, liveEngagements: IDL.Nat })],
       ['query'],
     ),
-    getAgentStanding: IDL.Func([IDL.Principal], [Result_27], ['query']),
+    getAgentStanding: IDL.Func([IDL.Principal], [Result_29], ['query']),
     getAnchorStats: IDL.Func([], [AnchorStats], ['query']),
     getAuditHead: IDL.Func([], [AuditHead], ['query']),
     getCertifiedAnchor: IDL.Func([IDL.Principal], [IDL.Opt(CertifiedAnchor)], ['query']),
     getCertifiedAuditHead: IDL.Func([], [CertifiedAuditHead], ['query']),
     getCertifiedBirth: IDL.Func([IDL.Vec(IDL.Nat8)], [IDL.Opt(CertifiedBirth)], ['query']),
+    getChildSignInOffer: IDL.Func([IDL.Principal], [Result_28], ['query']),
     getCustodyMode: IDL.Func([IDL.Principal], [Result_10], ['query']),
     getCycleReserveStatus: IDL.Func(
       [],
@@ -456,22 +486,23 @@ export const idlFactory = ({ IDL }) => {
       ['query'],
     ),
     getEngramNumberOf: IDL.Func([IDL.Principal], [IDL.Opt(IDL.Nat)], ['query']),
-    getEngramOpenedThrough: IDL.Func([IDL.Principal], [Result_22], ['query']),
-    getEngramWasmChunk: IDL.Func([IDL.Nat], [Result_26], ['query']),
+    getEngramOpenedThrough: IDL.Func([IDL.Principal], [Result_23], ['query']),
+    getEngramWasmChunk: IDL.Func([IDL.Nat], [Result_27], ['query']),
     getEngramWasmClass: IDL.Func([], [ReleaseClass], ['query']),
     getEngramWasmHash: IDL.Func([], [IDL.Text], ['query']),
     getEngramWasmInfo: IDL.Func([], [EngramWasmInfo], ['query']),
-    getFleetMetrics: IDL.Func([], [Result_25], []),
+    getFleetMetrics: IDL.Func([], [Result_26], []),
     getGenesisNote: IDL.Func([], [GenesisNote], ['query']),
     getLastUpgrade: IDL.Func([IDL.Principal], [IDL.Opt(LastUpgrade)], ['query']),
     getMarketCanister: IDL.Func([], [IDL.Opt(IDL.Principal)], ['query']),
     getMetricsReader: IDL.Func([], [IDL.Opt(IDL.Principal)], ['query']),
     getMyEngram: IDL.Func([], [IDL.Opt(EngramRecordView)], ['query']),
     getMyReservation: IDL.Func([], [IDL.Opt(ReservationView)], ['query']),
-    getMyRestartStatus: IDL.Func([], [Result_24], ['query']),
-    getOpeningCounts: IDL.Func([], [Result_23], ['query']),
-    getParentOf: IDL.Func([IDL.Principal], [Result_22], ['query']),
-    getReferralCounts: IDL.Func([IDL.Vec(IDL.Principal)], [Result_21], ['query']),
+    getMyRestartStatus: IDL.Func([], [Result_25], ['query']),
+    getOpeningCounts: IDL.Func([], [Result_24], ['query']),
+    getParentOf: IDL.Func([IDL.Principal], [Result_23], ['query']),
+    getReferralCounts: IDL.Func([IDL.Vec(IDL.Principal)], [Result_22], ['query']),
+    getRegistryHealth: IDL.Func([], [Result_21], ['query']),
     getRentBiller: IDL.Func([], [IDL.Opt(IDL.Principal)], ['query']),
     getReserveGateConfig: IDL.Func([], [ReserveGateConfig], ['query']),
     getRestartTotals: IDL.Func([], [RestartTotals], ['query']),
@@ -542,7 +573,7 @@ export const idlFactory = ({ IDL }) => {
           }),
         ),
       ],
-      [Result_1],
+      [Result_2],
       [],
     ),
     removeAuditViewer: IDL.Func([IDL.Principal], [Result], []),
@@ -585,14 +616,23 @@ export const idlFactory = ({ IDL }) => {
     sysMeterEngram: IDL.Func([IDL.Principal], [Result_4], []),
     sysNoteReset: IDL.Func([], [Result], []),
     sysNotifyOwnershipTransfer: IDL.Func([IDL.Principal], [Result_3], []),
+    sysOpenChild: IDL.Func(
+      [
+        IDL.Record({
+          ownerKey: IDL.Principal,
+          signIn: IDL.Opt(IDL.Principal),
+        }),
+      ],
+      [Result_2],
+      [],
+    ),
     sysRecordAgentEdge: IDL.Func(
       [IDL.Record({ root: IDL.Principal, event: EdgeEvent })],
       [Result],
       [],
     ),
-    sysRepayUpgradeAdvance: IDL.Func([IDL.Record({ advanceId: IDL.Nat })], [Result_2], []),
+    sysRepayUpgradeAdvance: IDL.Func([IDL.Record({ advanceId: IDL.Nat })], [Result_1], []),
     sysRevertOwnershipTransfer: IDL.Func([IDL.Principal], [Result], []),
-    sysSpawnChild: IDL.Func([IDL.Principal], [Result_1], []),
     upgradeEngram: IDL.Func([IDL.Principal], [Result], []),
     upgradeMyEngram: IDL.Func([], [Result], []),
     verifyEngramActiveOwner: IDL.Func([IDL.Principal, IDL.Principal], [IDL.Bool], ['query']),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@engramx/idl",
-  "version": "0.16.0-rc.21",
+  "version": "0.16.0-rc.22",
   "description": "The Candid interfaces of the EngramX canisters (engram, registry, market) — the .did files and the JS/TS IDL factories generated from them, published with every release so code that calls them pins the interface by version.",
   "license": "Apache-2.0",
   "author": "EngramX <developer@engramx.ai>",