@engramx/idl 0.16.0-rc.4 → 0.16.0-rc.6

package/dist/market.did

@@ -171,88 +171,93 @@ type RevenueSummary =
 type Result_9 = 
  variant {
    Err: Error;
-   Ok: Page_7;
+   Ok: Page_5;
  };
 type Result_8 = 
  variant {
    Err: Error;
-   Ok: Page_5;
+   Ok: Page_4;
  };
 type Result_7 = 
  variant {
    Err: Error;
-   Ok: Page_4;
+   Ok: Page_2;
  };
 type Result_6 = 
  variant {
    Err: Error;
-   Ok: Page_2;
+   Ok: Page_1;
  };
 type Result_5 = 
  variant {
    Err: Error;
-   Ok: Page_1;
+   Ok: SessionState;
  };
 type Result_4 = 
  variant {
    Err: Error;
-   Ok: SessionState;
+   Ok: PaymentQuote;
  };
 type Result_3 = 
  variant {
    Err: Error;
-   Ok: PaymentQuote;
+   Ok: EscrowRecovery;
  };
 type Result_2 = 
  variant {
    Err: Error;
    Ok: text;
  };
-type Result_18 = 
+type Result_19 = 
  variant {
    Err: Error;
    Ok: X402Endpoint;
  };
-type Result_17 = 
+type Result_18 = 
  variant {
    Err: Error;
    Ok: ServiceRequestResponse;
  };
-type Result_16 = 
+type Result_17 = 
  variant {
    Err: Error;
    Ok: ContentResponse;
  };
-type Result_15 = 
+type Result_16 = 
  variant {
    Err: Error;
    Ok: opt text;
  };
-type Result_14 = 
+type Result_15 = 
  variant {
    Err: Error;
    Ok: Job;
  };
-type Result_13 = 
+type Result_14 = 
  variant {
    Err: Error;
    Ok: blob;
  };
-type Result_12 = 
+type Result_13 = 
  variant {
    Err: Error;
    Ok: JobStatus;
  };
-type Result_11 = 
+type Result_12 = 
  variant {
    Err: Error;
    Ok: RevenueSummary;
  };
-type Result_10 = 
+type Result_11 = 
  variant {
    Err: Error;
    Ok: SellerStatus;
  };
+type Result_10 = 
+ variant {
+   Err: Error;
+   Ok: Page_7;
+ };
 type Result_1 = 
  variant {
    Err: Error;
@@ -466,6 +471,11 @@ type GenesisNote =
    predecessorSize: opt nat;
    version: text;
  };
+type EscrowRecovery = 
+ record {
+   amount: TokenAmount;
+   blockIndex: nat;
+ };
 type Error = 
  variant {
    Conflict: text;
@@ -616,6 +626,9 @@ service : {
   /// is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
   /// recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
   /// not a change made mid-cut.
+  /// ⟨2026-10-07, beside the count above⟩ Twelve: the admin's `retrySellerPayment` (the owner's
+  /// decision of that day) passes the library's settle refusal through as `#Conflict` too — state
+  /// behind this canister's own gate, like the other six.
   /// 
   /// It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
   /// so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
@@ -649,7 +662,7 @@ service : {
   /// Born disabled deliberately: a listing that went live at creation would be sellable before its
   /// price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
   createEndpoint: (name: text, description: text, contentId: text,
-   suggestedPriceE6: nat) -> (Result_18);
+   suggestedPriceE6: nat) -> (Result_19);
   /// Submit a paid service request. Returns a job id, or the price.
   /// 
   /// ⟨0.16.0⟩ TWO GATES FROM THE ENGRAM DO NOT TRAVEL, and both for the same reason: they were the
@@ -664,7 +677,7 @@ service : {
   /// 
   /// What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
   createJob: (serviceId: text, params: blob, paymentSig:
-   opt PaymentSignature) -> (Result_17);
+   opt PaymentSignature) -> (Result_18);
   /// Delete content.
   /// 
   /// ⚠ THE QUOTA IS NOT REFUNDED, and this is the honest part of the design rather than a
@@ -753,7 +766,7 @@ service : {
   /// before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
   /// ic402's text naming both principals. Pay as the principal that approved the allowance.
   getContent: (contentId: text, paymentSig: opt PaymentSignature) ->
-   (Result_16);
+   (Result_17);
   /// ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
   /// 
   /// The engram's version was:
@@ -778,13 +791,13 @@ service : {
   /// list they scan holds authorization helpers only — so a refusal fabricated behind a payment
   /// check was out of scope by construction rather than by ruling. L11 adds payment gates to that
   /// list; this method is why.
-  getContentChunk: (grant: AccessGrant, index: nat) -> (Result_13) query;
+  getContentChunk: (grant: AccessGrant, index: nat) -> (Result_14) query;
   /// A seller's payout address — THEIRS, or the admin's to read.
   /// 
   /// The engram made this owner-only and TRAPPED at everyone else. Here the answer is a refusal a
   /// caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
   /// distinguishable from "you may not ask", which is the whole point of the envelope.
-  getEvmSellerPayout: (seller: principal) -> (Result_15) query;
+  getEvmSellerPayout: (seller: principal) -> (Result_16) query;
   /// PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
   /// beside a published predecessor head is auditable; a fresh chain with no statement is
   /// indistinguishable from a wipe.
@@ -797,7 +810,7 @@ service : {
   /// collapsed "unknown jobId" and "not authorized", and the product rendered the wrong conclusion
   /// from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
   /// merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
-  getJob: (jobId: text) -> (Result_14) query;
+  getJob: (jobId: text) -> (Result_15) query;
   /// PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
   /// what made `listJobs`' existence-leak justification false.
   getJobCounts: () -> (JobCounts) query;
@@ -810,7 +823,7 @@ service : {
   /// 
   /// Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
   /// only labelling it.
-  getJobResult: (jobId: text) -> (Result_13) query;
+  getJobResult: (jobId: text) -> (Result_14) query;
   /// Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
   /// other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
   /// PUBLIC: a job's state, and nothing else about it.
@@ -825,7 +838,7 @@ service : {
   /// 
   /// The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
   /// a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
-  getJobStatus: (jobId: text) -> (Result_12) query;
+  getJobStatus: (jobId: text) -> (Result_13) query;
   /// PUBLIC: the market's spend limits, with the caller rosters REDACTED.
   /// 
   /// The limits themselves are already public — they are advertised inside every 402 challenge, so
@@ -848,7 +861,7 @@ service : {
   /// Anonymous is refused rather than answered with zeroes. A zero here is a real business fact —
   /// "you have sold nothing" — and returning it to a caller who simply has no identity is the
   /// fabricated-empty defect wearing a number instead of a list.
-  getRevenueSummary: () -> (Result_11) query;
+  getRevenueSummary: () -> (Result_12) query;
   /// PUBLIC: what a buyer can learn about a seller, and the whole of it.
   /// 
   /// The ENGRAM ID is the point of this read. This market runs no reputation system and issues no
@@ -859,7 +872,7 @@ service : {
   /// 
   /// `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
   /// and the field name is the strongest claim it makes.
-  getSellerStatus: (seller: principal) -> (Result_10) query;
+  getSellerStatus: (seller: principal) -> (Result_11) query;
   /// PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
   /// which is also what made `listJobs`' old "no existence leak" defence false.
   getSessionCounts: () -> (SessionCounts) query;
@@ -938,17 +951,17 @@ service : {
   isTradeFrozen: () -> (bool) query;
   /// `total` is the head counter, not the row count: this is a bounded ring, so a page that
   /// reported only what it returned would make a trimmed log look complete.
-  listAuditEntries: (start: nat, limit: nat) -> (Result_8) query;
+  listAuditEntries: (start: nat, limit: nat) -> (Result_9) query;
   /// Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
   /// roster cannot tell whether their own enrolment survived a rotation.
-  listAuditViewers: () -> (Result_9) query;
+  listAuditViewers: () -> (Result_10) query;
   /// PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
   /// anyone who has not already bought is not a shop.
   listContent: (start: nat, limit: nat) -> (Page_6) query;
   /// L11 names this canister's reason for having a denial log at all: the commerce surface is where
   /// the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
   /// alerted on, or disproved.
-  listDenialEntries: (start: nat, limit: nat) -> (Result_8) query;
+  listDenialEntries: (start: nat, limit: nat) -> (Result_9) query;
   /// Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
   /// 
   /// ⟨0.16.0⟩ Two defects close here at once, and they are the same defect wearing two hats.
@@ -962,7 +975,7 @@ service : {
   /// few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
   /// different answers — without naming whose they were.
   listEndpointPurchases: (endpointId: text, start: nat, limit: nat) ->
-   (Result_7) query;
+   (Result_8) query;
   /// PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
   /// unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
   /// none look different, which is the honest answer, without publishing what was withdrawn.
@@ -990,7 +1003,7 @@ service : {
   /// Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
   /// two facts that were one empty list.
   listJobs: (serviceId: text, statusFilter: opt JobStatus, start: nat, limit:
-   nat) -> (Result_6) query;
+   nat) -> (Result_7) query;
   /// The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
   /// rather than something a seller has to already know the id of.
   /// 
@@ -1005,7 +1018,7 @@ service : {
   /// not see, so nothing is ever hidden from them — unlike `listEndpointPurchases`, where a
   /// non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
   /// should know the zero is a fact about this surface, not an unimplemented field.
-  listMyPendingWithdrawals: (start: nat, limit: nat) -> (Result_5) query;
+  listMyPendingWithdrawals: (start: nat, limit: nat) -> (Result_6) query;
   /// ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
   /// 
   /// The engram had two methods because the visibility rule differed: everyone saw enabled
@@ -1055,7 +1068,7 @@ service : {
   /// ⟨2026-09-30, ic402 2.17.0⟩ That future spend path calls `gate.consumeVoucherFrom(msg.caller, …)`,
   /// not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
   /// refuses every voucher, and only the session key calling as itself may spend a session.
-  openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_4);
+  openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_5);
   /// RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
   /// the caller has not opened and is not committed to. `request` read as an action with an effect.
   /// 
@@ -1117,7 +1130,7 @@ service : {
   /// This matters most on the ckUSDC rail, which is where customer payments settle: ICP has no
   /// on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
   /// sends no server nonce at all and is unaffected.
-  quotePayment: (amountE6: nat) -> (Result_3) query;
+  quotePayment: (amountE6: nat) -> (Result_4) query;
   /// Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
   /// this canister never learned. Reads the chain and finishes what the settle started.
   /// 
@@ -1196,7 +1209,15 @@ service : {
   /// refused or rejected: that close already ends the session `closed`, with the remainder still in
   /// its escrow, so it needs no force. Recover it within 24 hours of that close, asking at most the
   /// escrow's ledger balance less one fee.
-  recoverEscrow: (sessionId: text, amount: TokenAmount) -> (Result);
+  /// 
+  /// ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amount` is what
+  /// was transferred to the session's payer, in the token named (the amount asked, capped at the
+  /// session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+  /// `blockIndex` is that ledger's block of the transfer. Until this date it answered a bare `nat`
+  /// that was the block index alone, which read as the amount. If the session's record is removed
+  /// before the amount can be read back — a session closed in the same moment as the recovery and
+  /// cleaned up during its transfer — it answers `#Other` naming the block, never a guessed amount.
+  recoverEscrow: (sessionId: text, amount: TokenAmount) -> (Result_3);
   /// Register as a seller by naming the engram you own.
   /// 
   /// The registry is asked, not trusted from the caller's word: `verifyEngramActiveOwner` confirms
@@ -1284,6 +1305,36 @@ service : {
   /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
   /// dependency work.
   resolveJob: (jobId: text, terminal: JobStatus) -> (Result_1);
+  /// Admin recovery: retry the payment to the seller of a job left `#Verified` by a failed payment.
+  /// NOTHING ELSE. It never refunds the buyer, and it refuses every job that does not read
+  /// `#Verified`, with nothing moved.
+  /// 
+  /// ⟨2026-10-07, the owner's decision of that day⟩ A job whose work passed verification and whose
+  /// payment to the seller then failed rests in `#Verified`, and only `resolveDispute` moves it — the
+  /// service's SELLER's, by the ruling of 2026-08-17, which stands unchanged. A seller who never acts
+  /// left it there, with no way for anyone else to move it. This is the admin's way: unstick, not
+  /// decide. The job's outcome was decided by its verification; the payment goes where that sent it,
+  /// and the admin names neither a recipient nor an amount. Refunding the buyer, and anything about a
+  /// job not yet verified (`#Submitted`, `#Disputed`), stay the seller's.
+  /// 
+  /// It runs the library's own settle, the one a buyer's confirmation runs: the job reads `#Settling`
+  /// while it pays (so two retries cannot both pay), ends `#Settled`, and a payment the ledger refuses
+  /// leaves it `#Verified` to retry again. For a job priced "up to" an amount, that settle also returns
+  /// to the buyer what the seller did not claim, as every settle does. Past the admin check, the
+  /// freeze and the cycles floor (each of which refuses before anything is read), every outcome is a
+  /// chained record entry naming the admin.
+  /// 
+  /// A NEW METHOD, NOT A WIDER `resolveJob`, ON PURPOSE. `resolveJob` is the one place the admin line
+  /// bends — a STATE assertion, moving no money, for a job stuck in `#Settling`. Widening it to move
+  /// money on a `#Verified` job would give one argument (`#Settled`) two meanings depending on a state
+  /// the admin read a moment earlier: if the job moved to `#Settling` in between (a settle in flight),
+  /// "pay the seller" would become "declare the seller paid". One method per meaning keeps the
+  /// deciding one narrow and named.
+  /// 
+  /// `#Conflict` covers the state refusals: a job that does not read `#Verified`, and the library's
+  /// own (a job that moved on before the retry ran, or a payment that failed). `#NotFound` is a job id
+  /// this market does not have.
+  retrySellerPayment: (jobId: text) -> (Result_1);
   setAdmin: (newAdmin: principal) -> (Result_1);
   /// Override the policy for ONE payer — the market's per-buyer risk control.
   setCallerPolicy: (caller: principal, policy: SpendingPolicy) -> (Result_1);

package/dist/market.idl.d.ts

@@ -79,6 +79,10 @@ export type Error =
   | { Other: string }
   | { Unavailable: string }
   | { Conflict: string };
+export interface EscrowRecovery {
+  blockIndex: bigint;
+  amount: TokenAmount;
+}
 export interface GenesisNote {
   predecessorSize: [] | [bigint];
   predecessorHeadHash: [] | [Uint8Array | number[]];
@@ -242,23 +246,24 @@ export interface QuotedRequirement {
 }
 export type Result = { Ok: bigint } | { Err: Error };
 export type Result_1 = { Ok: null } | { Err: Error };
-export type Result_10 = { Ok: SellerStatus } | { Err: Error };
-export type Result_11 = { Ok: RevenueSummary } | { Err: Error };
-export type Result_12 = { Ok: JobStatus } | { Err: Error };
-export type Result_13 = { Ok: Uint8Array | number[] } | { Err: Error };
-export type Result_14 = { Ok: Job } | { Err: Error };
-export type Result_15 = { Ok: [] | [string] } | { Err: Error };
-export type Result_16 = { Ok: ContentResponse } | { Err: Error };
-export type Result_17 = { Ok: ServiceRequestResponse } | { Err: Error };
-export type Result_18 = { Ok: X402Endpoint } | { Err: Error };
+export type Result_10 = { Ok: Page_7 } | { Err: Error };
+export type Result_11 = { Ok: SellerStatus } | { Err: Error };
+export type Result_12 = { Ok: RevenueSummary } | { Err: Error };
+export type Result_13 = { Ok: JobStatus } | { Err: Error };
+export type Result_14 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_15 = { Ok: Job } | { Err: Error };
+export type Result_16 = { Ok: [] | [string] } | { Err: Error };
+export type Result_17 = { Ok: ContentResponse } | { Err: Error };
+export type Result_18 = { Ok: ServiceRequestResponse } | { Err: Error };
+export type Result_19 = { Ok: X402Endpoint } | { Err: Error };
 export type Result_2 = { Ok: string } | { Err: Error };
-export type Result_3 = { Ok: PaymentQuote } | { Err: Error };
-export type Result_4 = { Ok: SessionState } | { Err: Error };
-export type Result_5 = { Ok: Page_1 } | { Err: Error };
-export type Result_6 = { Ok: Page_2 } | { Err: Error };
-export type Result_7 = { Ok: Page_4 } | { Err: Error };
-export type Result_8 = { Ok: Page_5 } | { Err: Error };
-export type Result_9 = { Ok: Page_7 } | { Err: Error };
+export type Result_3 = { Ok: EscrowRecovery } | { Err: Error };
+export type Result_4 = { Ok: PaymentQuote } | { Err: Error };
+export type Result_5 = { Ok: SessionState } | { Err: Error };
+export type Result_6 = { Ok: Page_1 } | { Err: Error };
+export type Result_7 = { Ok: Page_2 } | { Err: Error };
+export type Result_8 = { Ok: Page_4 } | { Err: Error };
+export type Result_9 = { Ok: Page_5 } | { Err: Error };
 export interface RevenueSummary {
   serviceJobsSettled: bigint;
   owedToYou: bigint;
@@ -438,6 +443,9 @@ export interface _SERVICE {
    * / is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
    * / recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
    * / not a change made mid-cut.
+   * / ⟨2026-10-07, beside the count above⟩ Twelve: the admin's `retrySellerPayment` (the owner's
+   * / decision of that day) passes the library's settle refusal through as `#Conflict` too — state
+   * / behind this canister's own gate, like the other six.
    * /
    * / It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
    * / so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
@@ -475,7 +483,7 @@ export interface _SERVICE {
    * / Born disabled deliberately: a listing that went live at creation would be sellable before its
    * / price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
    */
-  createEndpoint: ActorMethod<[string, string, string, bigint], Result_18>;
+  createEndpoint: ActorMethod<[string, string, string, bigint], Result_19>;
   /**
    * / Submit a paid service request. Returns a job id, or the price.
    * /
@@ -491,7 +499,7 @@ export interface _SERVICE {
    * /
    * / What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
    */
-  createJob: ActorMethod<[string, Uint8Array | number[], [] | [PaymentSignature]], Result_17>;
+  createJob: ActorMethod<[string, Uint8Array | number[], [] | [PaymentSignature]], Result_18>;
   /**
    * / Delete content.
    * /
@@ -600,7 +608,7 @@ export interface _SERVICE {
    * / before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
    * / ic402's text naming both principals. Pay as the principal that approved the allowance.
    */
-  getContent: ActorMethod<[string, [] | [PaymentSignature]], Result_16>;
+  getContent: ActorMethod<[string, [] | [PaymentSignature]], Result_17>;
   /**
    * / ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
    * /
@@ -627,7 +635,7 @@ export interface _SERVICE {
    * / check was out of scope by construction rather than by ruling. L11 adds payment gates to that
    * / list; this method is why.
    */
-  getContentChunk: ActorMethod<[AccessGrant, bigint], Result_13>;
+  getContentChunk: ActorMethod<[AccessGrant, bigint], Result_14>;
   /**
    * / A seller's payout address — THEIRS, or the admin's to read.
    * /
@@ -635,7 +643,7 @@ export interface _SERVICE {
    * / caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
    * / distinguishable from "you may not ask", which is the whole point of the envelope.
    */
-  getEvmSellerPayout: ActorMethod<[Principal], Result_15>;
+  getEvmSellerPayout: ActorMethod<[Principal], Result_16>;
   /**
    * / PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
    * / beside a published predecessor head is auditable; a fresh chain with no statement is
@@ -652,7 +660,7 @@ export interface _SERVICE {
    * / from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
    * / merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
    */
-  getJob: ActorMethod<[string], Result_14>;
+  getJob: ActorMethod<[string], Result_15>;
   /**
    * / PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
    * / what made `listJobs`' existence-leak justification false.
@@ -669,7 +677,7 @@ export interface _SERVICE {
    * / Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
    * / only labelling it.
    */
-  getJobResult: ActorMethod<[string], Result_13>;
+  getJobResult: ActorMethod<[string], Result_14>;
   /**
    * / Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
    * / other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
@@ -686,7 +694,7 @@ export interface _SERVICE {
    * / The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
    * / a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
    */
-  getJobStatus: ActorMethod<[string], Result_12>;
+  getJobStatus: ActorMethod<[string], Result_13>;
   /**
    * / PUBLIC: the market's spend limits, with the caller rosters REDACTED.
    * /
@@ -713,7 +721,7 @@ export interface _SERVICE {
    * / "you have sold nothing" — and returning it to a caller who simply has no identity is the
    * / fabricated-empty defect wearing a number instead of a list.
    */
-  getRevenueSummary: ActorMethod<[], Result_11>;
+  getRevenueSummary: ActorMethod<[], Result_12>;
   /**
    * / PUBLIC: what a buyer can learn about a seller, and the whole of it.
    * /
@@ -726,7 +734,7 @@ export interface _SERVICE {
    * / `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
    * / and the field name is the strongest claim it makes.
    */
-  getSellerStatus: ActorMethod<[Principal], Result_10>;
+  getSellerStatus: ActorMethod<[Principal], Result_11>;
   /**
    * / PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
    * / which is also what made `listJobs`' old "no existence leak" defence false.
@@ -814,12 +822,12 @@ export interface _SERVICE {
    * / `total` is the head counter, not the row count: this is a bounded ring, so a page that
    * / reported only what it returned would make a trimmed log look complete.
    */
-  listAuditEntries: ActorMethod<[bigint, bigint], Result_8>;
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_9>;
   /**
    * / Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
    * / roster cannot tell whether their own enrolment survived a rotation.
    */
-  listAuditViewers: ActorMethod<[], Result_9>;
+  listAuditViewers: ActorMethod<[], Result_10>;
   /**
    * / PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
    * / anyone who has not already bought is not a shop.
@@ -830,7 +838,7 @@ export interface _SERVICE {
    * / the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
    * / alerted on, or disproved.
    */
-  listDenialEntries: ActorMethod<[bigint, bigint], Result_8>;
+  listDenialEntries: ActorMethod<[bigint, bigint], Result_9>;
   /**
    * / Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
    * /
@@ -845,7 +853,7 @@ export interface _SERVICE {
    * / few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
    * / different answers — without naming whose they were.
    */
-  listEndpointPurchases: ActorMethod<[string, bigint, bigint], Result_7>;
+  listEndpointPurchases: ActorMethod<[string, bigint, bigint], Result_8>;
   /**
    * / PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
    * / unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
@@ -875,7 +883,7 @@ export interface _SERVICE {
    * / Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
    * / two facts that were one empty list.
    */
-  listJobs: ActorMethod<[string, [] | [JobStatus], bigint, bigint], Result_6>;
+  listJobs: ActorMethod<[string, [] | [JobStatus], bigint, bigint], Result_7>;
   /**
    * / The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
    * / rather than something a seller has to already know the id of.
@@ -892,7 +900,7 @@ export interface _SERVICE {
    * / non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
    * / should know the zero is a fact about this surface, not an unimplemented field.
    */
-  listMyPendingWithdrawals: ActorMethod<[bigint, bigint], Result_5>;
+  listMyPendingWithdrawals: ActorMethod<[bigint, bigint], Result_6>;
   /**
    * / ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
    * /
@@ -945,7 +953,7 @@ export interface _SERVICE {
    * / not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
    * / refuses every voucher, and only the session key calling as itself may spend a session.
    */
-  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_4>;
+  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_5>;
   /**
    * / RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
    * / the caller has not opened and is not committed to. `request` read as an action with an effect.
@@ -1011,7 +1019,7 @@ export interface _SERVICE {
    * / on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
    * / sends no server nonce at all and is unaffected.
    */
-  quotePayment: ActorMethod<[bigint], Result_3>;
+  quotePayment: ActorMethod<[bigint], Result_4>;
   /**
    * / Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
    * / this canister never learned. Reads the chain and finishes what the settle started.
@@ -1097,8 +1105,16 @@ export interface _SERVICE {
    * / refused or rejected: that close already ends the session `closed`, with the remainder still in
    * / its escrow, so it needs no force. Recover it within 24 hours of that close, asking at most the
    * / escrow's ledger balance less one fee.
+   * /
+   * / ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amount` is what
+   * / was transferred to the session's payer, in the token named (the amount asked, capped at the
+   * / session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+   * / `blockIndex` is that ledger's block of the transfer. Until this date it answered a bare `nat`
+   * / that was the block index alone, which read as the amount. If the session's record is removed
+   * / before the amount can be read back — a session closed in the same moment as the recovery and
+   * / cleaned up during its transfer — it answers `#Other` naming the block, never a guessed amount.
    */
-  recoverEscrow: ActorMethod<[string, TokenAmount], Result>;
+  recoverEscrow: ActorMethod<[string, TokenAmount], Result_3>;
   /**
    * / Register as a seller by naming the engram you own.
    * /
@@ -1207,6 +1223,38 @@ export interface _SERVICE {
    * / dependency work.
    */
   resolveJob: ActorMethod<[string, JobStatus], Result_1>;
+  /**
+   * / Admin recovery: retry the payment to the seller of a job left `#Verified` by a failed payment.
+   * / NOTHING ELSE. It never refunds the buyer, and it refuses every job that does not read
+   * / `#Verified`, with nothing moved.
+   * /
+   * / ⟨2026-10-07, the owner's decision of that day⟩ A job whose work passed verification and whose
+   * / payment to the seller then failed rests in `#Verified`, and only `resolveDispute` moves it — the
+   * / service's SELLER's, by the ruling of 2026-08-17, which stands unchanged. A seller who never acts
+   * / left it there, with no way for anyone else to move it. This is the admin's way: unstick, not
+   * / decide. The job's outcome was decided by its verification; the payment goes where that sent it,
+   * / and the admin names neither a recipient nor an amount. Refunding the buyer, and anything about a
+   * / job not yet verified (`#Submitted`, `#Disputed`), stay the seller's.
+   * /
+   * / It runs the library's own settle, the one a buyer's confirmation runs: the job reads `#Settling`
+   * / while it pays (so two retries cannot both pay), ends `#Settled`, and a payment the ledger refuses
+   * / leaves it `#Verified` to retry again. For a job priced "up to" an amount, that settle also returns
+   * / to the buyer what the seller did not claim, as every settle does. Past the admin check, the
+   * / freeze and the cycles floor (each of which refuses before anything is read), every outcome is a
+   * / chained record entry naming the admin.
+   * /
+   * / A NEW METHOD, NOT A WIDER `resolveJob`, ON PURPOSE. `resolveJob` is the one place the admin line
+   * / bends — a STATE assertion, moving no money, for a job stuck in `#Settling`. Widening it to move
+   * / money on a `#Verified` job would give one argument (`#Settled`) two meanings depending on a state
+   * / the admin read a moment earlier: if the job moved to `#Settling` in between (a settle in flight),
+   * / "pay the seller" would become "declare the seller paid". One method per meaning keeps the
+   * / deciding one narrow and named.
+   * /
+   * / `#Conflict` covers the state refusals: a job that does not read `#Verified`, and the library's
+   * / own (a job that moved on before the retry ran, or a payment that failed). `#NotFound` is a job id
+   * / this market does not have.
+   */
+  retrySellerPayment: ActorMethod<[string], Result_1>;
   setAdmin: ActorMethod<[Principal], Result_1>;
   /**
    * / Override the policy for ONE payer — the market's per-buyer risk control.