@engramx/idl 0.16.0-rc.5 → 0.16.0-rc.7

package/dist/engram.idl.d.ts

@@ -335,7 +335,7 @@ export interface Engram {
    * / test/key-replacement.test.mo runs it; this body names no roster gate, because the caller holds
    * / no role here until the move.
    */
-  acceptAgentKeyNomination: ActorMethod<[Principal], Result_70>;
+  acceptAgentKeyNomination: ActorMethod<[Principal], Result_71>;
   /**
    * / Consensus transform for the alert webhook outcall: collapse the response to status-only so
    * / replicas agree regardless of response headers/body (we only care that the POST landed 2xx).
@@ -370,13 +370,13 @@ export interface Engram {
         ackIrrevocable: boolean;
       },
     ],
-    Result_69
+    Result_70
   >;
   /**
    * / Owner-managed destination allowlist (D7). Additions LOOSEN and wait 24h; removals TIGHTEN
    * / and apply instantly — the ratified asymmetry, applied to the one mutable policy surface.
    */
-  addEvmWithdrawDestination: ActorMethod<[string], Result_68>;
+  addEvmWithdrawDestination: ActorMethod<[string], Result_69>;
   /**
    * / ⟨0.16.0, L1⟩ THE ROLE-CONFLICT ARM, and why three refusals here are not the same refusal.
    * /
@@ -422,7 +422,7 @@ export interface Engram {
    * / is exactly what a guardian pause exists to hold. No action alert is raised: the operation is
    * / owner-initiated, owner-only, and already chained into the audit log.
    */
-  applyCondense: ActorMethod<[bigint], Result_67>;
+  applyCondense: ActorMethod<[bigint], Result_68>;
   /**
    * / Owner-only: activate a guardian who has registered against an invite.
    * /
@@ -502,7 +502,7 @@ export interface Engram {
    * /
    * / The write half also refuses while writes are PAUSED.
    */
-  backupInit: ActorMethod<[string, BackupType, [] | [string], string, [] | [string]], Result_43>;
+  backupInit: ActorMethod<[string, BackupType, [] | [string], string, [] | [string]], Result_44>;
   /**
    * / Read one chunk of a finalized backup, by index.
    * /
@@ -510,7 +510,7 @@ export interface Engram {
    * / `canAppendMemory`. Holding one says nothing about the other, deliberately: taking a backup and
    * / carrying it away are different authorities.
    */
-  backupPullChunk: ActorMethod<[string, bigint], Result_59>;
+  backupPullChunk: ActorMethod<[string, bigint], Result_60>;
   backupPushChunk: ActorMethod<[string, bigint, Uint8Array | number[]], Result_1>;
   /**
    * / The OWNER cancels an agent's pending key nomination; the agent keeps its current key. Refused
@@ -568,7 +568,7 @@ export interface Engram {
    * / A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    * / independent check on agents, so one wallet must not hold both.
    */
-  createAgentInvite: ActorMethod<[string, AgentPermissions], Result_43>;
+  createAgentInvite: ActorMethod<[string, AgentPermissions], Result_44>;
   /**
    * / Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
    * / co-owner and not a recovery agent.
@@ -592,7 +592,7 @@ export interface Engram {
    * / So an invite that fails to redeem for that reason is not a bad code. The rule exists because
    * / a check must be independent of the thing it checks.
    */
-  createGuardianInvite: ActorMethod<[string, GuardianPermissions], Result_43>;
+  createGuardianInvite: ActorMethod<[string, GuardianPermissions], Result_44>;
   /**
    * / OWNER-ONLY deletion of a stored backup.
    * /
@@ -656,7 +656,7 @@ export interface Engram {
    * / ⟨Marker added 2026-08-23; the census row said "L7 mark added per review" and no mark was at
    * / the site.⟩
    */
-  ensureEvmReady: ActorMethod<[], Result_43>;
+  ensureEvmReady: ActorMethod<[], Result_44>;
   /**
    * / Record that log entries [fromSeq, toSeq] were served, and return the root that proves it.
    * /
@@ -671,7 +671,7 @@ export interface Engram {
    * / situation rather than a safety measure. It IS gated on requireMemoryAttached: a store that
    * / failed its integrity check must not attest anything it cannot vouch for.
    */
-  exportMemoryRange: ActorMethod<[bigint, bigint, [] | [Principal]], Result_66>;
+  exportMemoryRange: ActorMethod<[bigint, bigint, [] | [Principal]], Result_67>;
   /**
    * / ⟨0.16.0, L2.2 — renamed from `guardianFreezePayments`⟩ The prefix LIED about who may call it.
    * / The gate is `requireOwnerOrGuardian`, and an owner freezing their own payments is the ordinary
@@ -707,7 +707,7 @@ export interface Engram {
   /**
    * / Delivery status + config readback. Owner-only (the URL is a secret).
    */
-  getActionAlertStatus: ActorMethod<[], Result_57>;
+  getActionAlertStatus: ActorMethod<[], Result_58>;
   /**
    * / Agents need to know what they may revise, so they can read it too. Whole-value config, same
    * / carve-out as getProtectedPaths — and kept a SEPARATE method from it deliberately (L2.2): a
@@ -717,7 +717,7 @@ export interface Engram {
    * / Refusal reason preserved from the trap: a grant is a power, and its absence and its
    * / concealment are different facts.
    */
-  getAgentRevisablePaths: ActorMethod<[], Result_53>;
+  getAgentRevisablePaths: ActorMethod<[], Result_54>;
   /**
    * / OWNER-ONLY: every engagement's seat weeks on this engram, with the agent's root — the day it
    * / paired, the days of its first and last payment signature, a 64-week map whose bit 0 is the week
@@ -730,7 +730,7 @@ export interface Engram {
    * / empty page. Paged; `total` is every engagement ever paired here (a reset keeps the rows).
    * / Two rows can name one root: an agent paired again after it left is a second engagement.
    */
-  getAgentSeatWeeks: ActorMethod<[bigint, bigint], Result_64>;
+  getAgentSeatWeeks: ActorMethod<[bigint, bigint], Result_65>;
   /**
    * / Owner: everything written into this engram by someone other than the owner since the last
    * / markAgentWritesReviewed() — agent appends/revisions AND paid-session appends (see
@@ -740,7 +740,7 @@ export interface Engram {
    * / as a total. `earliest` discloses ring eviction — if cursor < earliest, entries between them
    * / aged out of the ring (the CHAIN still proves total count; this view can't show their bodies).
    */
-  getAgentWriteReview: ActorMethod<[], Result_63>;
+  getAgentWriteReview: ActorMethod<[], Result_64>;
   /**
    * / Why anchoring is or is not advancing. PUBLIC: ungated on purpose — detecting a stalled
    * / engram is the point, a gated read would fail-to-empty and hand a third party fabricated zeros,
@@ -763,7 +763,7 @@ export interface Engram {
    * / was signed rather than asserted.
    */
   getAuditHead: ActorMethod<[], AuditHead>;
-  getBackupMetadata: ActorMethod<[string], Result_62>;
+  getBackupMetadata: ActorMethod<[string], Result_63>;
   /**
    * / The cashier this engram recognises as its rent biller — `null` until the registry pushes one.
    * /
@@ -799,13 +799,13 @@ export interface Engram {
    * / recorded nothing while reading as if it did. The refusal is loud in the reply instead. WHAT
    * / WOULD MAKE THIS WRONG: a reason to record who asked — then this becomes an update that says so.
    */
-  getChildAllowance: ActorMethod<[Principal], Result_61>;
+  getChildAllowance: ActorMethod<[Principal], Result_62>;
   /**
    * / Owner-only, Billing-class: what opening an engram costs this engram, the balance below which an
    * / agent's request is refused, the balance now, and every agent's allowance. The console's cost
    * / sentence reads it. Cycles are owner-class information, as on the owner's console read.
    */
-  getChildOpening: ActorMethod<[], Result_60>;
+  getChildOpening: ActorMethod<[], Result_61>;
   /**
    * / Derive the shared memory-encryption key, encrypted under the caller's transport
    * / public key. Gated to owner + read-agents (the same principals allowed to read
@@ -831,7 +831,7 @@ export interface Engram {
    * / cost. Stated here because L7 requires the reason be readable from the interface rather than
    * / inferred by opening the body — which is exactly what had to happen to write this line.
    */
-  getEncryptedMemoryKey: ActorMethod<[[] | [bigint], Uint8Array | number[]], Result_59>;
+  getEncryptedMemoryKey: ActorMethod<[[] | [bigint], Uint8Array | number[]], Result_60>;
   /**
    * / ⟨0.16.0, owner ruling 2026-08-20 — option (a)⟩ `x402Support` REPORTS THE RAIL, not a constant.
    * /
@@ -936,7 +936,7 @@ export interface Engram {
    * / `#Err`, never a record carrying an empty string (ic402's `getEvmAddress` answers `""` on a
    * / failed derivation — that is fail-to-empty on a money surface, and it stops here).
    */
-  getEvmAddress: ActorMethod<[], Result_58>;
+  getEvmAddress: ActorMethod<[], Result_59>;
   /**
    * / The owner's OWN EVM address, if they registered one — distinct from `getEvmAddress`, which is
    * / the address this canister derives for itself.
@@ -955,7 +955,7 @@ export interface Engram {
    * / cost — stated here because L7 requires the reason be readable from the interface rather than
    * / inferred by opening the body.
    */
-  getEvmSignerAddress: ActorMethod<[], Result_43>;
+  getEvmSignerAddress: ActorMethod<[], Result_44>;
   /**
    * / PUBLIC: where this chain begins, for the stranger deciding whether to trust it.
    * /
@@ -968,7 +968,7 @@ export interface Engram {
   /**
    * / A guardian's own channel status (their URL is their secret — each guardian sees only theirs).
    */
-  getGuardianAlertStatus: ActorMethod<[], Result_57>;
+  getGuardianAlertStatus: ActorMethod<[], Result_58>;
   /**
    * / The market this engram will accept signing requests from — `null` until the registry pushes
    * / one at spawn, which is why `requireMarket` refuses fleet-wide today.
@@ -1001,7 +1001,7 @@ export interface Engram {
    * / never renumbered: the next page starts at the last version returned plus one. Defaults
    * / return the whole history of any file a pre-FD engram could have held.
    */
-  getMemoryHistory: ActorMethod<[string, [] | [bigint], [] | [bigint]], Result_56>;
+  getMemoryHistory: ActorMethod<[string, [] | [bigint], [] | [bigint]], Result_57>;
   /**
    * / PUBLIC: the epoch alone, and deliberately nothing else (rotation study D4). A `rotatedAt[]`
    * / history would be a public, fleet-enumerable feed of when each owner terminated a trust
@@ -1050,7 +1050,7 @@ export interface Engram {
    * / forever" — a claim about what this engram will DESTROY — and an empty guard list reads as
    * / "nothing is held back".
    */
-  getMemoryRetentionPolicy: ActorMethod<[], Result_55>;
+  getMemoryRetentionPolicy: ActorMethod<[], Result_56>;
   /**
    * / The metrics reader this engram answers — `null` until the spawning registry names one.
    * /
@@ -1079,7 +1079,7 @@ export interface Engram {
    * / client (rule 4) and bought a masked answer nobody had asked for — the census could not even
    * / find a consumer that read the masked `0`. Behind a gate there is nobody to mask it from.
    */
-  getOwnerConsole: ActorMethod<[], Result_54>;
+  getOwnerConsole: ActorMethod<[], Result_55>;
   /**
    * / Owner + agents only (agents need it to avoid writing protected paths).
    * /
@@ -1093,7 +1093,7 @@ export interface Engram {
    * / writing one — so a fabricated empty here does not merely misinform, it invites the write the
    * / list exists to prevent.
    */
-  getProtectedPaths: ActorMethod<[], Result_53>;
+  getProtectedPaths: ActorMethod<[], Result_54>;
   /**
    * / Whether the metrics reader's read is answered — `true` from birth.
    * /
@@ -1106,7 +1106,7 @@ export interface Engram {
    * / payment signatures the balance carries above the floor before `signX402Payment` is refused by
    * / name. The same numbers the check uses, so Billing can say only what the engram enforces.
    */
-  getSigningFloor: ActorMethod<[], Result_52>;
+  getSigningFloor: ActorMethod<[], Result_53>;
   /**
    * / The registry that spawned this engram, if it recorded one.
    * /
@@ -1127,7 +1127,7 @@ export interface Engram {
    * / A refusal names this method (`Gated.gatedResult`) rather than answering null/0 — a ceiling of
    * / "none" and a spend of 0 are both real answers, so a fabricated one would be read as fact.
    */
-  getSpendCeiling: ActorMethod<[], Result_51>;
+  getSpendCeiling: ActorMethod<[], Result_52>;
   /**
    * / Read the caps in force for a caller.
    * /
@@ -1137,8 +1137,8 @@ export interface Engram {
    * / configuration, and publishing them would tell any caller exactly how large a signing request
    * / can be before it needs an approval nobody is watching for.
    */
-  getSpendPolicy: ActorMethod<[[] | [Principal]], Result_50>;
-  getStorageStats: ActorMethod<[], Result_49>;
+  getSpendPolicy: ActorMethod<[[] | [Principal]], Result_51>;
+  getStorageStats: ActorMethod<[], Result_50>;
   /**
    * / Timer arm-state. PUBLIC and deliberately so: these timers are self-arming to save cycles,
    * / and an optimisation nobody can verify is an optimisation nobody should trust. Cheap to read,
@@ -1163,6 +1163,10 @@ export interface Engram {
    * / because a persistent actor re-runs its init body BEFORE postupgrade restores stable sessions,
    * / so a predicate-gated arm would skip exactly the canisters that have live ones. The first tick
    * / disarms it. Still true minutes after an upgrade is a real bug — report it upstream.
+   * / ⟨2026-10-07, beside the paragraph above⟩ The session sweep's interval is 300 seconds now (the
+   * / owner's decision of that day; set in the actor body), so "one interval" is up to five minutes,
+   * / and true five minutes after an upgrade is still expected. True ten minutes after, with no session
+   * / open, is the bug.
    * / NOT the whole timer story. The hourly CYCLE timer — which also carries audit anchoring — is
    * / deliberately absent: it is a `transient let` armed unconditionally at init, so an "armed"
    * / boolean for it would read true forever and tell you nothing, exactly the false-positive the
@@ -1207,14 +1211,14 @@ export interface Engram {
    * / UPDATE, marked per L7: it awaits three ICRC-1 ledgers". It was marked in prose and invisible
    * / to any gate; the glyph is what `scripts/check-update-for-read.mjs` matches.
    */
-  getWalletBalances: ActorMethod<[], Result_48>;
+  getWalletBalances: ActorMethod<[], Result_49>;
   /**
    * / Refusal reason preserved, and it is the clearest case of why a masked read is worse than no
    * / read: three empty strings with `configured = false` is a VALID-LOOKING answer meaning "this
    * / engram has no World ID configuration" — handed to a caller who merely lacks a grant. The
    * / fabrication is indistinguishable from the truth by construction.
    */
-  getWorldIdConfig: ActorMethod<[], Result_47>;
+  getWorldIdConfig: ActorMethod<[], Result_48>;
   /**
    * / ⟨L7⟩ UPDATE, NOT QUERY: this awaits THREE system calls — `raw_rand()` for the nonce,
    * / `Call.signWithEcdsa` for the signature, and `worldIdRpPublicKey()` for the derived key. A
@@ -1225,7 +1229,7 @@ export interface Engram {
    * / the World Developer Portal. Short-lived (300s TTL, idkit-server's default) and single-purpose —
    * / it authorizes opening one verification request, nothing else.
    */
-  getWorldIdRpContext: ActorMethod<[], Result_46>;
+  getWorldIdRpContext: ActorMethod<[], Result_47>;
   /**
    * / Owner-only: the EVM address derived from the engram's dedicated World ID RP signing key (the
    * / "worldid-rp" tECDSA path). Register THIS address as the rp_id's signer in the World Developer
@@ -1237,7 +1241,7 @@ export interface Engram {
    * / refusal — a state write, which a query cannot perform. So even if the key were cached this
    * / could not become a query without silently retiring its denial record (ADR-0002's class).
    */
-  getWorldIdRpSignerAddress: ActorMethod<[], Result_43>;
+  getWorldIdRpSignerAddress: ActorMethod<[], Result_44>;
   /**
    * / The verified IDKitResult, verbatim, as World's /api/v4/verify accepted it — the re-checkable
    * / artifact behind verifiedHuman. Role-gated because it carries the NULLIFIER.
@@ -1258,7 +1262,7 @@ export interface Engram {
    * / canister does not serve. The tombstones below and at `about()` are historical and correct as
    * / written; this one was present tense, which is the difference that matters.⟩
    */
-  getWorldIdVerification: ActorMethod<[], Result_45>;
+  getWorldIdVerification: ActorMethod<[], Result_46>;
   /**
    * / ⟨0.16.0, L1⟩ THE EMERGENCY FAMILY. Every refusal below is `#Refused` or `#NotFound`, and the
    * / absence of a `#Conflict` here is the point: these are the calls someone makes while something
@@ -1342,7 +1346,7 @@ export interface Engram {
    * / Owner-gated because it reports on custody posture, and answered as a Result so that a
    * / wrong-identity caller gets a refusal rather than a bare `false` that reads as "no address yet".
    */
-  isEvmAddressCached: ActorMethod<[], Result_44>;
+  isEvmAddressCached: ActorMethod<[], Result_45>;
   /**
    * / Issue an OAuth authorization code. Called by an OAuth client's sign-in bridge
    * / (an `/auth/connector`-style route) after II authentication. The client then
@@ -1351,7 +1355,7 @@ export interface Engram {
    * /
    * / Owner-only: only the engram owner can authorize a Connector install.
    */
-  issueAuthCode: ActorMethod<[string, string, string, [] | [string]], Result_43>;
+  issueAuthCode: ActorMethod<[string, string, string, [] | [string]], Result_44>;
   /**
    * / ⟨0.16.0⟩ `getCycleSnapshotSource` DELETED — folded into `CycleSnapshot.source`, one label per
    * / ROW. A single label for a whole ring misattributes every row recorded under the other source,
@@ -1367,7 +1371,7 @@ export interface Engram {
    * / DORMANT engram and corrupts retention math — a fabricated empty here does not just misinform a
    * / reader, it feeds a wrong number into a decision about destroying data.
    */
-  listActivitySnapshots: ActorMethod<[bigint, bigint], Result_42>;
+  listActivitySnapshots: ActorMethod<[bigint, bigint], Result_43>;
   /**
    * / ⟨0.16.0⟩ THE PAGE EXEMPLAR. Trap → `#Refused`, bare array → `Result<Page<T>>` (L1 + L3).
    * /
@@ -1384,7 +1388,7 @@ export interface Engram {
    * / `withheld` is 0: this roster is owner-only in whole, so there is no partial-visibility case.
    * / A method that filters rows by caller sets it — see L1's row-level honesty rule.
    */
-  listAgents: ActorMethod<[bigint, bigint], Result_41>;
+  listAgents: ActorMethod<[bigint, bigint], Result_42>;
   /**
    * / The GUARDIAN-audience projection of the agent roster — three fields, not the full record.
    * /
@@ -1398,7 +1402,7 @@ export interface Engram {
    * / guardian consults BEFORE REVOKING ONE. A fabricated empty here does not merely misinform —
    * / it tells someone acting under emergency powers that there is nothing to act on.
    */
-  listAgentsForGuardian: ActorMethod<[bigint, bigint], Result_40>;
+  listAgentsForGuardian: ActorMethod<[bigint, bigint], Result_41>;
   /**
    * / Owner-only: rows carry caller, amount, operation and free-text rationale. The SDK omits it.
    * /
@@ -1412,7 +1416,7 @@ export interface Engram {
    * /
    * / Refusal reason preserved: `[]` reads as "nothing is awaiting the owner's decision".
    */
-  listApprovalRequests: ActorMethod<[[] | [ApprovalStatus], bigint, bigint], Result_28>;
+  listApprovalRequests: ActorMethod<[[] | [ApprovalStatus], bigint, bigint], Result_29>;
   /**
    * / ⟨0.16.0⟩ `total` IS THE HEAD COUNTER, and on this method that is the entire point.
    * /
@@ -1434,7 +1438,7 @@ export interface Engram {
    * / WRONG: a reader who must see the whole record without being the owner or a guardian — the
    * / public certified head is the answer for integrity, and nothing else is.
    */
-  listAuditEntries: ActorMethod<[bigint, bigint], Result_23>;
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_24>;
   /**
    * / ⟨0.16.0, L1 + L3 — census-ruled⟩ THE TWO-MECHANISM EXCEPTION DISSOLVES.
    * /
@@ -1460,7 +1464,7 @@ export interface Engram {
    * / keeps its optional filter and applies it to the page, so no caller loses the ability to ask
    * / "backups of this database" — it stops being a thing the canister has to page around.
    */
-  listBackups: ActorMethod<[bigint, bigint], Result_39>;
+  listBackups: ActorMethod<[bigint, bigint], Result_40>;
   /**
    * / List all bearer tokens — Active, Revoked, and Expired. Owner uses this in
    * / the dashboard to show installed Connectors (claude.ai, Claude Desktop, etc.).
@@ -1472,7 +1476,7 @@ export interface Engram {
    * / merely stopped being used is reported `#Expired`, not a stale `#Active`), so the page carries
    * / the same honesty the store gained on 2026-08-17.
    */
-  listBearerTokens: ActorMethod<[bigint, bigint], Result_38>;
+  listBearerTokens: ActorMethod<[bigint, bigint], Result_39>;
   /**
    * / The condense checkpoints in the retained log at or above `startSeq`, oldest first.
    * /
@@ -1484,7 +1488,7 @@ export interface Engram {
    * / Owner-only like every other archive surface, and for the same structural reason: these rows
    * / carry the chain positions and roots of entries whose paths were inside the hash preimage.
    */
-  listCondenseCheckpoints: ActorMethod<[bigint, bigint], Result_37>;
+  listCondenseCheckpoints: ActorMethod<[bigint, bigint], Result_38>;
   /**
    * / ⟨0.16.0⟩ `metrics()` DELETED — absorbed by `about()`.
    * /
@@ -1493,13 +1497,13 @@ export interface Engram {
    * / both and know which one owned each field. Every field here survives on `about()`, day-flooring
    * / included.
    */
-  listCycleSnapshots: ActorMethod<[bigint, bigint], Result_36>;
+  listCycleSnapshots: ActorMethod<[bigint, bigint], Result_37>;
   /**
    * / Same `withheld` treatment as listMemoryFiles — the tombstone listing filtered reserved paths
    * / for non-owners just as silently, and a caller could not tell a filtered tombstone list from a
    * / complete one. Counted before slicing, so policy-hidden rows never blur into paging.
    */
-  listDeletedMemoryFiles: ActorMethod<[bigint, bigint], Result_35>;
+  listDeletedMemoryFiles: ActorMethod<[bigint, bigint], Result_36>;
   /**
    * / The registered shapes — E3: encodeTypeString is the display artifact, verbatim.
    * / Stays on the engram under B1 (hybrid): EIP-712 signing is custody, and custody does not leave.
@@ -1508,7 +1512,7 @@ export interface Engram {
    * / AUTHORITY, which is not a thing to hand an unauthorized reader. The public trail of every
    * / registration remains the audit chain under getCertifiedAuditHead.
    */
-  listEip712Types: ActorMethod<[bigint, bigint], Result_34>;
+  listEip712Types: ActorMethod<[bigint, bigint], Result_35>;
   /**
    * / Stays on the engram under B1 (hybrid): withdrawal custody does not leave.
    * /
@@ -1519,7 +1523,7 @@ export interface Engram {
    * / engram may withdraw nowhere", OR — worse — as "no allowlist is in force", which is the
    * / opposite security posture. It also erases any pending 24h activation from view.
    */
-  listEvmWithdrawDestinations: ActorMethod<[bigint, bigint], Result_33>;
+  listEvmWithdrawDestinations: ActorMethod<[bigint, bigint], Result_34>;
   /**
    * / Accessible by owner and guardians.
    * /
@@ -1528,7 +1532,7 @@ export interface Engram {
    * / pause writes" — a claim about who can STOP it. A caller who cannot tell that from "you may not
    * / see the roster" has been told the engram is unguarded when it may be fully guarded.
    */
-  listGuardians: ActorMethod<[bigint, bigint], Result_32>;
+  listGuardians: ActorMethod<[bigint, bigint], Result_33>;
   /**
    * / The export receipts in the retained log at or above `startSeq`, oldest first.
    * /
@@ -1546,7 +1550,7 @@ export interface Engram {
    * / Read `MemoryRouter.ReceiptPage` before reading `page.total` as a receipt count. It is not one;
    * / it is the chain's length, and the declaration says why.
    */
-  listMemoryExportReceipts: ActorMethod<[bigint, bigint], Result_31>;
+  listMemoryExportReceipts: ActorMethod<[bigint, bigint], Result_32>;
   /**
    * / ⟨0.16.0⟩ THE `withheld` EXEMPLAR — L1 names this exact method as the defect it fixes.
    * /
@@ -1564,7 +1568,7 @@ export interface Engram {
    * / by POLICY, never rows merely off the end of this page — those are `total`'s job. Conflating
    * / the two would rebuild the ambiguity in a new place.
    */
-  listMemoryFiles: ActorMethod<[bigint, bigint], Result_30>;
+  listMemoryFiles: ActorMethod<[bigint, bigint], Result_31>;
   /**
    * / One page of the memory log, seq-ordered, optionally narrowed to one author.
    * /
@@ -1591,7 +1595,7 @@ export interface Engram {
    * / with the disclosures that make the page verifiable — the hidden-bound defect the census itself
    * / names on previewCondense's row.
    */
-  listMemoryLog: ActorMethod<[bigint, bigint, [] | [Principal]], Result_29>;
+  listMemoryLog: ActorMethod<[bigint, bigint, [] | [Principal]], Result_30>;
   /**
    * / The caller's OWN spend-approval requests. ⟨0.16.0, L1 + L3 — fixed 2026-08-18⟩
    * /
@@ -1610,7 +1614,7 @@ export interface Engram {
    * / (The unbounded MAP is filed separately — pruning an approval record destroys evidence of what
    * / was asked, which is a retention ruling rather than a shape fix.)
    */
-  listMyApprovalRequests: ActorMethod<[bigint, bigint], Result_28>;
+  listMyApprovalRequests: ActorMethod<[bigint, bigint], Result_29>;
   /**
    * / The payer's own sessions, live ones first. PAYER-SCOPED: a caller sees only their own, which
    * / is why this needs no role — a session id is not a secret from the person who paid for it.
@@ -1621,7 +1625,7 @@ export interface Engram {
    * / client would break on — the market paged its own pending withdrawals before its cut for the
    * / same reason. The order is the order sessions were opened.
    */
-  listMySessions: ActorMethod<[bigint, bigint], Result_27>;
+  listMySessions: ActorMethod<[bigint, bigint], Result_28>;
   /**
    * /
    * / ⟨0.16.0, L3⟩ Paged and enveloped like every other `list*`, and the envelope here is uniformity
@@ -1636,7 +1640,7 @@ export interface Engram {
    * / IT recorded, so this chain is what a caller composes with when currency matters — which it
    * / cannot do if it needs a role here.
    */
-  listOwnershipTransfers: ActorMethod<[bigint, bigint], Result_26>;
+  listOwnershipTransfers: ActorMethod<[bigint, bigint], Result_27>;
   /**
    * / ⟨2026-09-29, the platform's question from the build review⟩ OWNER-ONLY: how many payment
    * / signatures each agent has obtained today, and the daily limit (200, `PaymentSignCap`). The
@@ -1654,7 +1658,7 @@ export interface Engram {
    * / engram enforces for it — beside the agents, never a row among them
    * / (`PaymentSignCap.marketplaceRow`). Null when no marketplace is set.
    */
-  listPaymentSignatureCounts: ActorMethod<[bigint, bigint], Result_25>;
+  listPaymentSignatureCounts: ActorMethod<[bigint, bigint], Result_26>;
   /**
    * / Agent records removed by a reset. Each row is a NAMED record with the fields `principal`,
    * / `name`, `registeredAt` and `purgedAt` — read them BY NAME, never by position.
@@ -1696,7 +1700,7 @@ export interface Engram {
    * / earlier ending, or the reset) — the facts `resyncAgentEdges` re-sends. The stored rows are
    * / served as they are.
    */
-  listPurgedAgents: ActorMethod<[bigint, bigint], Result_24>;
+  listPurgedAgents: ActorMethod<[bigint, bigint], Result_25>;
   /**
    * / ⟨0.16.0⟩ ONE ACCESSOR, folding `readReadLog` and `getDenialLog` — and the fold only became
    * / safe because of a change made earlier in this same leg.
@@ -1759,7 +1763,7 @@ export interface Engram {
    * / on the chained record — the same `RecordView` filter, and `withheld` counts what it removed
    * / together with what `successFilter` removed. WHAT WOULD MAKE THIS WRONG: see `listAuditEntries`.
    */
-  listReadLog: ActorMethod<[[] | [boolean], bigint, bigint], Result_23>;
+  listReadLog: ActorMethod<[[] | [boolean], bigint, bigint], Result_24>;
   /**
    * / Same visibility as listAuditEntries: the owner, this engram's agents, and ACTIVE guardians
    * / see disputes. An unauthorized read REFUSES — it does not return an empty list, because an
@@ -1776,7 +1780,7 @@ export interface Engram {
    * / WOULD MAKE THIS WRONG: a ruling that an agent may see the disputes of its own writes; this would
    * / then have to look up each disputed version's writer, which it does not do today.
    */
-  listRepudiations: ActorMethod<[bigint, bigint], Result_22>;
+  listRepudiations: ActorMethod<[bigint, bigint], Result_23>;
   /**
    * / Owner: advance the review cursor — "I have seen everything up to and including uptoAuditId"
    * / (null = everything at the current head). Bounded so the attestation can never cover entries
@@ -1827,8 +1831,8 @@ export interface Engram {
    * / WHAT WOULD MAKE THIS WRONG: an await added between `ChildAllowance.take` and the registry call; the
    * / registry's `CHILD_MIN_ATTACHED_CYCLES` moving without `CHILD_ATTACH_CYCLES`.
    */
-  openChildEngram: ActorMethod<[], Result_21>;
-  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_20>;
+  openChildEngram: ActorMethod<[], Result_22>;
+  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_21>;
   /**
    * / Withdraw tokens to the owner's principal. This is the ONLY way to
    * / move tokens out of the engram to an external address, and the
@@ -1893,7 +1897,7 @@ export interface Engram {
    * / engagement on the agent's track record, and what to do. Before, the reply was `#Ok` with the
    * / record alone even when the registry had refused the start, so the agent was never told.
    */
-  pairAgent: ActorMethod<[{ enrolment: Enrolment; code: string }], Result_19>;
+  pairAgent: ActorMethod<[{ enrolment: Enrolment; code: string }], Result_20>;
   /**
    * / ⟨0.16.0, L2.2 — renamed from `guardianPauseWrites`⟩ Same correction as freezePayments above:
    * / owner-or-guardian, and `resumeWrites` never carried the prefix either.
@@ -1919,7 +1923,7 @@ export interface Engram {
    * / `unlocked` is the export-receipt gate ONLY. It is not a promise the condense will land: the
    * / history-budget delta is checked at commit time and can still refuse a short prefix.
    */
-  previewCondense: ActorMethod<[bigint], Result_18>;
+  previewCondense: ActorMethod<[bigint], Result_19>;
   /**
    * / A quote for a session this caller has not opened and is not committed to — the intent a
    * / buyer signs against. Pure dry run, no state, no funds.
@@ -1983,7 +1987,7 @@ export interface Engram {
    * / path, each with its own Result — a refused RESERVED path sits beside a readable one, which is
    * / a genuine per-path fact.
    */
-  readMemoryBatch: ActorMethod<[Array<string>], Result_17>;
+  readMemoryBatch: ActorMethod<[Array<string>], Result_18>;
   /**
    * / ⟨0.16.0⟩ `getMemoryRetentionGuards` DELETED — folded into `getMemoryRetentionPolicy` above.
    * / It was the second L2.1 array-returning `get*`, and separating it from the policy it modifies
@@ -1995,7 +1999,7 @@ export interface Engram {
    * / see it cannot know whether it has the whole range, which is how silent truncation gets
    * / reintroduced. Loop while `more` is true, advancing by the bytes actually returned.
    */
-  readMemoryBytes: ActorMethod<[string, bigint, bigint, [] | [bigint]], Result_16>;
+  readMemoryBytes: ActorMethod<[string, bigint, bigint, [] | [bigint]], Result_17>;
   /**
    * / The escrow exit for a session whose settle cannot pay.
    * /
@@ -2051,8 +2055,16 @@ export interface Engram {
    * / the transfer pays its own fee from the escrow. A session still reads `closing` only when its
    * / close trapped after one of its awaits, or an earlier version left it there, and of that one the
    * / line above still holds.
+   * /
+   * / ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amountE6` is
+   * / the ckUSDC base units transferred to the payer's own account (the amount asked, capped at the
+   * / session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+   * / `blockIndex` is the ledger block of that transfer. Until this date it answered a bare `nat` that
+   * / was the block index alone, which read as the amount. If the session's record is removed before
+   * / the amount can be read back — a session closed in the same moment as the recovery and cleaned up
+   * / during its transfer — it answers `#Other` naming the block, never a guessed amount.
    */
-  recoverEscrow: ActorMethod<[string, bigint], Result_8>;
+  recoverEscrow: ActorMethod<[string, bigint], Result_16>;
   /**
    * / ⟨0.16.0, L1⟩ A REDEMPTION PATH, where the arm choice is a disclosure decision.
    * /
@@ -2809,7 +2821,10 @@ export interface Engram {
    * / The metrics reader the registry designated reads this engram's paid-rail health, in one call:
    * / the balance and the line it must stay above, the memory that line is computed from, the sessions
    * / by state, the escrow open sessions hold, the vouchers spent and the refused ones
-   * / (`RailHealth.RailHealth` says what each is, and what is never in it).
+   * / (`RailHealth.RailHealth` says what each is, and what is never in it). ⟨2026-10-08, ic402 2.18.0⟩
+   * / And `refundOwed`: the closed sessions whose refund failed and whose payer has not yet recovered
+   * / it — counted from the close, never read from the ledger; `opt` from birth, and null (an engram
+   * / that does not count) is never 0.
    * /
    * / CALLER: the metrics reader the spawning registry named on this engram (`metricsReaderId`), and
    * / nobody else — the owner reads its balance through `getOwnerConsole`. Answered only while the
@@ -3131,6 +3146,10 @@ export interface Engram {
    */
   writeMemory: ActorMethod<[string, Uint8Array | number[]], Result>;
 }
+export interface EngramEscrowRecovery {
+  amountE6: bigint;
+  blockIndex: bigint;
+}
 export interface EngramSessionState {
   id: string;
   status: EngramSessionStatus;
@@ -3558,6 +3577,7 @@ export interface RailHealth {
   paidVouchersConsumed: bigint;
   escrowOpen: [] | [bigint];
   sessionsOpen: bigint;
+  refundOwed: [] | [bigint];
   sessionsClosing: bigint;
   cycles: bigint;
   sendHeadroom: bigint;
@@ -3609,66 +3629,67 @@ export type Result_12 = { Ok: SessionContext } | { Err: Error };
 export type Result_13 = { Ok: ResyncReport } | { Err: Error };
 export type Result_14 = { Ok: ResetReport } | { Err: Error };
 export type Result_15 = { Ok: GuardianRecord } | { Err: Error };
-export type Result_16 = { Ok: MemoryByteChunk } | { Err: Error };
-export type Result_17 = { Ok: Array<BatchReadItem> } | { Err: Error };
-export type Result_18 = { Ok: CondensePreview } | { Err: Error };
-export type Result_19 = { Ok: Pairing } | { Err: Error };
+export type Result_16 = { Ok: EngramEscrowRecovery } | { Err: Error };
+export type Result_17 = { Ok: MemoryByteChunk } | { Err: Error };
+export type Result_18 = { Ok: Array<BatchReadItem> } | { Err: Error };
+export type Result_19 = { Ok: CondensePreview } | { Err: Error };
 export type Result_2 = { Ok: ControlHandover } | { Err: Error };
-export type Result_20 = { Ok: EngramSessionState } | { Err: Error };
-export type Result_21 = { Ok: Principal } | { Err: Error };
-export type Result_22 = { Ok: Page } | { Err: Error };
-export type Result_23 = { Ok: Page_1 } | { Err: Error };
-export type Result_24 = { Ok: Page_2 } | { Err: Error };
-export type Result_25 = { Ok: PaymentSignatureCounts } | { Err: Error };
-export type Result_26 = { Ok: Page_4 } | { Err: Error };
-export type Result_27 = { Ok: Page_5 } | { Err: Error };
-export type Result_28 = { Ok: Page_6 } | { Err: Error };
-export type Result_29 = { Ok: LogPage } | { Err: Error };
+export type Result_20 = { Ok: Pairing } | { Err: Error };
+export type Result_21 = { Ok: EngramSessionState } | { Err: Error };
+export type Result_22 = { Ok: Principal } | { Err: Error };
+export type Result_23 = { Ok: Page } | { Err: Error };
+export type Result_24 = { Ok: Page_1 } | { Err: Error };
+export type Result_25 = { Ok: Page_2 } | { Err: Error };
+export type Result_26 = { Ok: PaymentSignatureCounts } | { Err: Error };
+export type Result_27 = { Ok: Page_4 } | { Err: Error };
+export type Result_28 = { Ok: Page_5 } | { Err: Error };
+export type Result_29 = { Ok: Page_6 } | { Err: Error };
 export type Result_3 = { Ok: X402SignOutcome } | { Err: Error };
-export type Result_30 = { Ok: Page_8 } | { Err: Error };
-export type Result_31 = { Ok: ReceiptPage } | { Err: Error };
-export type Result_32 = { Ok: Page_10 } | { Err: Error };
-export type Result_33 = { Ok: Page_11 } | { Err: Error };
-export type Result_34 = { Ok: Page_12 } | { Err: Error };
-export type Result_35 = { Ok: Page_13 } | { Err: Error };
-export type Result_36 = { Ok: Page_14 } | { Err: Error };
-export type Result_37 = { Ok: CheckpointPage } | { Err: Error };
-export type Result_38 = { Ok: Page_16 } | { Err: Error };
-export type Result_39 = { Ok: Page_17 } | { Err: Error };
+export type Result_30 = { Ok: LogPage } | { Err: Error };
+export type Result_31 = { Ok: Page_8 } | { Err: Error };
+export type Result_32 = { Ok: ReceiptPage } | { Err: Error };
+export type Result_33 = { Ok: Page_10 } | { Err: Error };
+export type Result_34 = { Ok: Page_11 } | { Err: Error };
+export type Result_35 = { Ok: Page_12 } | { Err: Error };
+export type Result_36 = { Ok: Page_13 } | { Err: Error };
+export type Result_37 = { Ok: Page_14 } | { Err: Error };
+export type Result_38 = { Ok: CheckpointPage } | { Err: Error };
+export type Result_39 = { Ok: Page_16 } | { Err: Error };
 export type Result_4 = { Ok: Eip712SignatureOut } | { Err: Error };
-export type Result_40 = { Ok: Page_18 } | { Err: Error };
-export type Result_41 = { Ok: Page_19 } | { Err: Error };
-export type Result_42 = { Ok: Page_20 } | { Err: Error };
-export type Result_43 = { Ok: string } | { Err: Error };
-export type Result_44 = { Ok: boolean } | { Err: Error };
-export type Result_45 = { Ok: [] | [string] } | { Err: Error };
-export type Result_46 = { Ok: WorldIdRpContext } | { Err: Error };
-export type Result_47 = { Ok: WorldIdConfig } | { Err: Error };
-export type Result_48 = { Ok: WalletBalances } | { Err: Error };
-export type Result_49 = { Ok: StorageReport } | { Err: Error };
+export type Result_40 = { Ok: Page_17 } | { Err: Error };
+export type Result_41 = { Ok: Page_18 } | { Err: Error };
+export type Result_42 = { Ok: Page_19 } | { Err: Error };
+export type Result_43 = { Ok: Page_20 } | { Err: Error };
+export type Result_44 = { Ok: string } | { Err: Error };
+export type Result_45 = { Ok: boolean } | { Err: Error };
+export type Result_46 = { Ok: [] | [string] } | { Err: Error };
+export type Result_47 = { Ok: WorldIdRpContext } | { Err: Error };
+export type Result_48 = { Ok: WorldIdConfig } | { Err: Error };
+export type Result_49 = { Ok: WalletBalances } | { Err: Error };
 export type Result_5 = { Ok: SignatureCounts } | { Err: Error };
-export type Result_50 = { Ok: SpendingPolicy } | { Err: Error };
-export type Result_51 = { Ok: SpendCeiling } | { Err: Error };
-export type Result_52 = { Ok: SigningFloorStatus } | { Err: Error };
-export type Result_53 = { Ok: { paths: Array<string> } } | { Err: Error };
-export type Result_54 = { Ok: OwnerConsole } | { Err: Error };
-export type Result_55 = { Ok: MemoryRetentionPolicy } | { Err: Error };
-export type Result_56 = { Ok: MemoryHistory } | { Err: Error };
-export type Result_57 = { Ok: AlertStatus } | { Err: Error };
-export type Result_58 = { Ok: EvmAddresses } | { Err: Error };
-export type Result_59 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_50 = { Ok: StorageReport } | { Err: Error };
+export type Result_51 = { Ok: SpendingPolicy } | { Err: Error };
+export type Result_52 = { Ok: SpendCeiling } | { Err: Error };
+export type Result_53 = { Ok: SigningFloorStatus } | { Err: Error };
+export type Result_54 = { Ok: { paths: Array<string> } } | { Err: Error };
+export type Result_55 = { Ok: OwnerConsole } | { Err: Error };
+export type Result_56 = { Ok: MemoryRetentionPolicy } | { Err: Error };
+export type Result_57 = { Ok: MemoryHistory } | { Err: Error };
+export type Result_58 = { Ok: AlertStatus } | { Err: Error };
+export type Result_59 = { Ok: EvmAddresses } | { Err: Error };
 export type Result_6 = { Ok: RailHealth } | { Err: Error };
-export type Result_60 = { Ok: ChildOpening } | { Err: Error };
-export type Result_61 = { Ok: ChildAllowanceRow } | { Err: Error };
-export type Result_62 = { Ok: BackupMetadata } | { Err: Error };
-export type Result_63 = { Ok: AgentWriteReview } | { Err: Error };
-export type Result_64 = { Ok: Page_21 } | { Err: Error };
-export type Result_66 = { Ok: MemoryRangeExport } | { Err: Error };
-export type Result_67 = { Ok: CondenseResult } | { Err: Error };
-export type Result_68 = { Ok: { activatesAtNs: bigint } } | { Err: Error };
-export type Result_69 = { Ok: Eip712Registration } | { Err: Error };
+export type Result_60 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_61 = { Ok: ChildOpening } | { Err: Error };
+export type Result_62 = { Ok: ChildAllowanceRow } | { Err: Error };
+export type Result_63 = { Ok: BackupMetadata } | { Err: Error };
+export type Result_64 = { Ok: AgentWriteReview } | { Err: Error };
+export type Result_65 = { Ok: Page_21 } | { Err: Error };
+export type Result_67 = { Ok: MemoryRangeExport } | { Err: Error };
+export type Result_68 = { Ok: CondenseResult } | { Err: Error };
+export type Result_69 = { Ok: { activatesAtNs: bigint } } | { Err: Error };
 export type Result_7 = { Ok: Array<Seat> } | { Err: Error };
-export type Result_70 = { Ok: AgentRecord } | { Err: Error };
+export type Result_70 = { Ok: Eip712Registration } | { Err: Error };
+export type Result_71 = { Ok: AgentRecord } | { Err: Error };
 export type Result_8 = { Ok: bigint } | { Err: Error };
 export type Result_9 = { Ok: SignedTransaction } | { Err: Error };
 export interface ResyncReport {