@greatwait/contracts 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/operations.js

@@ -1,14 +1,20 @@
-import { z } from "zod";
+import { effectiveCustomerLimitsSchema } from "./effective-limits.js";
+import { z } from "./zod.js";
+import { DATA_EXPORT_OPERATIONS } from "./data-export.js";
+import { ORGANIZATION_LIFECYCLE_OPERATIONS } from "./organization-lifecycle.js";
+import { API_UNUSED_RESPONSE_SCHEMA } from "./operation-definitions.js";
 import { credentialContextSchema } from "./authority.js";
-import { callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackSigningKeyRotationRequestSchema, } from "./endpoints.js";
-import { FORECAST_WINDOW_VERSION, forecastRequestSchema, forecastSchema, forecastWindowsSchema, } from "./forecast.js";
+import { callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointSigningSecretsSchema, callbackSigningKeyRotationRequestSchema, } from "./endpoints.js";
+import { FORECAST_WINDOW_VERSION, forecastRequestSchema, forecastSchema, forecastRequestHeadersSchema, forecastWindowsSchema, } from "./forecast.js";
 import { usageRequestSchema, usageSchema } from "./usage.js";
-import { conditionalRequestHeaderSchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, pageRequestSchema, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, versionResponseHeaderSchema, } from "./protocol.js";
+import { deliveryTimingSummarySchema } from "./timing.js";
+import { billingAutoTopUpApplyRequestSchema, billingAutoTopUpPreviewRequestSchema, billingAutoTopUpPreviewSchema, billingCeilingUpdateRequestSchema, billingFundingQuoteRequestSchema, billingFundingQuoteSchema, billingFundingViewSchema, billingNoticePageSchema, billingNotificationSettingsSchema, billingNotificationSettingsUpdateRequestSchema, billingLedgerPageSchema, billingLedgerRequestSchema, billingBudgetUpdateRequestHeadersSchema, billingBudgetUpdateRequestSchema, billingBudgetUpdateResponseSchema, billingPurchaseRequestSchema, billingRefundRequestCreateSchema, billingRefundResolutionRequestSchema, billingRefundRequestViewSchema, billingSummarySchema, projectBillingStateSchema, projectBillingQuoteSchema, projectBillingQuoteRequestSchema, projectBillingChangeRequestSchema, billingPortalSchema, billingInvoiceListSchema, billingPaymentHistoryPageSchema, billingInvoiceHistoryPageSchema, billingPaymentMethodSchema, billingPaymentMethodSetupRequestSchema, billingPaymentMethodConfirmRequestSchema, billingPaymentMethodRemoveRequestSchema, } from "./billing.js";
+import { conditionalRequestHeaderSchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, historyPageRequestSchema, pageRequestSchema, scheduleListRequestSchema, replayedResponseHeaderSchema, requiredConditionalRequestHeaderSchema, requiredIdempotencyRequestHeaderSchema, versionResponseHeaderSchema, } from "./protocol.js";
 import { oauthGrantListSchema, oauthGrantRevokedSchema } from "./oauth.js";
 import { credentialCreatedSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, } from "./secrets.js";
-import { attemptPageSchema, attemptViewSchema, occurrencePageSchema, occurrenceViewSchema, schedulePageSchema, scheduleRequestSchema, scheduleViewSchema, } from "./scheduling.js";
+import { attemptPageSchema, attemptViewSchema, occurrencePageSchema, projectOccurrenceListRequestSchema, projectOccurrencePageSchema, occurrenceViewSchema, schedulePageSchema, scheduleRequestSchema, scheduleViewSchema, } from "./scheduling.js";
 import { testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDeliveryPageSchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, } from "./test-sink.js";
-import { projectCreateRequestSchema, projectListSchema, projectSummarySchema, } from "./tenancy.js";
+import { projectArchiveRequestSchema, projectCreateRequestSchema, projectDeletedSchema, projectListSchema, projectSummarySchema, projectUpdateRequestSchema, } from "./tenancy.js";
 import { mcpConnectionSchema } from "./mcp.js";
 import { scaffoldVersionSchema, workspaceScaffoldSchema } from "./workspace.js";
 import { timestampSchema } from "./time.js";
@@ -49,15 +55,489 @@ export const mockScenarioResponseSchema = z.object({
 export const fixtureListSchema = z.object({
     fixtures: z.array(z.object({ id: z.string().min(1), description: z.string().min(1) })),
 });
+const PROJECT_BILLING_EXAMPLE = {
+    desiredRevision: 2,
+    effectiveRevision: 2,
+    pending: false,
+    recurringProjectFees: { currency: "USD", microdollars: "0", scale: 6 },
+    projects: [],
+    pendingOperations: [],
+};
+const PROJECT_BILLING_QUOTE_EXAMPLE = {
+    action: "add",
+    project: "proj_00000000000000000000000000",
+    quote: "quote-example",
+    expectedRevision: 2,
+    expiresAt: "2026-09-10T12:05:00.000Z",
+    charge: { currency: "USD", microdollars: "5000000", scale: 6 },
+    monthlyProjectFees: { currency: "USD", microdollars: "5000000", scale: 6 },
+    effectiveAt: "2026-09-10T12:00:00.000Z",
+    formerIncludedWillBlock: false,
+};
+const BILLING_SUMMARY_EXAMPLE = {
+    activation: {
+        boundary: "2026-09-01T00:00:00.000Z",
+        mode: "shadow",
+    },
+    blockingReasons: [],
+    budgetPolicy: {
+        desired: { advisoryBudget: null, hardCap: null },
+        desiredRevision: 0,
+        effectiveRevision: 0,
+        pending: false,
+    },
+    credit: {
+        available: { currency: "USD", microdollars: "999980", scale: 6 },
+        consumed: { currency: "USD", microdollars: "10", scale: 6 },
+        reserved: { currency: "USD", microdollars: "10", scale: 6 },
+    },
+    desiredRevision: 2,
+    effectiveRevision: 1,
+    freshness: { kind: "authoritative" },
+    includedProject: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+    period: {
+        automaticExecutionTopUp: {
+            pending: { currency: "USD", microdollars: "0", scale: 6 },
+            settled: { currency: "USD", microdollars: "0", scale: 6 },
+        },
+        subscribedProjectFees: {
+            currency: "USD",
+            microdollars: "0",
+            scale: 6,
+        },
+        reservedUsage: { currency: "USD", microdollars: "10", scale: 6 },
+        settledUsage: { currency: "USD", microdollars: "10", scale: 6 },
+        start: "2026-09-01T00:00:00.000Z",
+        end: "2026-10-01T00:00:00.000Z",
+    },
+    pending: true,
+    priceVersion: "payg-v1",
+    trialExpiresAt: "2026-09-15T00:00:00.000Z",
+};
+const BILLING_FUNDING_QUOTE_EXAMPLE = {
+    credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+    expectedRevision: 3,
+    expiresAt: "2026-09-10T12:05:00.000Z",
+    gross: null,
+    quote: "funding-quote-example",
+    tax: null,
+    taxStatus: "calculated-at-checkout",
+};
+const BILLING_FUNDING_EXAMPLE = {
+    automaticExecutionTopUp: {
+        ceiling: { currency: "USD", microdollars: "50000000", scale: 6 },
+        currentPeriod: {
+            end: "2026-10-01T00:00:00.000Z",
+            pending: { currency: "USD", microdollars: "10830000", scale: 6 },
+            remaining: { currency: "USD", microdollars: "29170000", scale: 6 },
+            settled: { currency: "USD", microdollars: "10000000", scale: 6 },
+            start: "2026-09-01T00:00:00.000Z",
+        },
+        rule: {
+            cooldownUntil: null,
+            desired: {
+                ceiling: { currency: "USD", microdollars: "50000000", scale: 6 },
+                credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+                triggerBelow: {
+                    currency: "USD",
+                    microdollars: "2000000",
+                    scale: 6,
+                },
+            },
+            effective: {
+                ceiling: { currency: "USD", microdollars: "50000000", scale: 6 },
+                credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+                triggerBelow: {
+                    currency: "USD",
+                    microdollars: "2000000",
+                    scale: 6,
+                },
+            },
+            state: "ready",
+            suspension: null,
+        },
+        revision: 3,
+    },
+    credit: {
+        amountOwed: { currency: "USD", microdollars: "0", scale: 6 },
+        available: { currency: "USD", microdollars: "9000000", scale: 6 },
+        reserved: { currency: "USD", microdollars: "10", scale: 6 },
+    },
+    freshness: { kind: "authoritative" },
+    paymentOperations: [
+        {
+            createdAt: "2026-09-10T12:00:00.000Z",
+            credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+            gross: { currency: "USD", microdollars: "10830000", scale: 6 },
+            id: "funding-operation-example",
+            kind: "automatic",
+            paymentUrl: "https://pay.stripe.com/receipts/acct_example/example",
+            reason: "payment-required",
+            state: "pending",
+            tax: { currency: "USD", microdollars: "830000", scale: 6 },
+            taxStatus: "confirmed",
+            updatedAt: "2026-09-10T12:00:01.000Z",
+        },
+    ],
+    subscribedProjectFees: {
+        currency: "USD",
+        microdollars: "5000000",
+        scale: 6,
+    },
+};
+const BILLING_NOTICE_PAGE_EXAMPLE = {
+    data: [
+        {
+            amounts: {
+                available: { currency: "USD", microdollars: "1750000", scale: 6 },
+                threshold: { currency: "USD", microdollars: "2000000", scale: 6 },
+            },
+            detail: "Available execution credit is below the configured USD 2.00 threshold.",
+            email: {
+                attempts: 3,
+                failureCode: "provider-unavailable",
+                lastAttemptAt: "2026-09-10T12:03:00.000Z",
+                state: "failed",
+            },
+            id: "billing-notice-example",
+            kind: "low-credit",
+            occurredAt: "2026-09-10T12:00:00.000Z",
+            payment: null,
+            recoveryPath: "#billing-funding",
+            resolvedAt: null,
+            scope: { kind: "organization" },
+            severity: "warning",
+            state: "active",
+            title: "Execution credit is low",
+            updatedAt: "2026-09-10T12:03:00.000Z",
+        },
+    ],
+    freshness: { kind: "authoritative" },
+};
+const BILLING_NOTIFICATION_SETTINGS_EXAMPLE = {
+    criticalEmail: true,
+    freshness: { kind: "authoritative" },
+    lowCreditThreshold: {
+        currency: "USD",
+        microdollars: "2000000",
+        scale: 6,
+    },
+    noncriticalEmail: true,
+    recipients: {
+        billingContacts: "active-billing-role-members",
+        owners: true,
+    },
+    revision: 1,
+};
+function withBillingFundingContract(operation) {
+    return {
+        ...operation,
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : BILLING_FUNDING_EXAMPLE,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingFundingViewSchema,
+    };
+}
+const BILLING_AUTO_TOP_UP_PREVIEW_EXAMPLE = {
+    action: "enable",
+    after: {
+        ceiling: { currency: "USD", microdollars: "50000000", scale: 6 },
+        credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+        triggerBelow: {
+            currency: "USD",
+            microdollars: "2000000",
+            scale: 6,
+        },
+    },
+    before: null,
+    currentPeriod: {
+        end: "2026-10-01T00:00:00.000Z",
+        pending: { currency: "USD", microdollars: "0", scale: 6 },
+        remaining: null,
+        settled: { currency: "USD", microdollars: "0", scale: 6 },
+        start: "2026-09-01T00:00:00.000Z",
+    },
+    expectedRevision: 3,
+    expandsAuthority: true,
+    expiresAt: "2026-09-10T12:05:00.000Z",
+    preview: "automatic-top-up-preview-example",
+    subscribedProjectFees: {
+        currency: "USD",
+        microdollars: "5000000",
+        scale: 6,
+    },
+};
+const BILLING_NOTICE_LIST_OPERATION = {
+    creates: false,
+    description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+        ? ""
+        : "Lists the verified organization's durable billing notices with exact USD amounts, affected scope, payment state, a fixed same-page recovery path, and visible email delivery failure. Raw provider details, payment credentials, callback data and arbitrary URLs have no field.",
+    example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : BILLING_NOTICE_PAGE_EXAMPLE,
+    id: "billing.notices",
+    idempotent: true,
+    mcp: { destructive: false, kind: "tool", openWorld: false },
+    method: "GET",
+    mutates: false,
+    path: "/v1/billing/notices",
+    principals: ["api-credential", "oauth", "session"],
+    problems: ["invalid_request", "service_unavailable"],
+    query: pageRequestSchema,
+    response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? API_UNUSED_RESPONSE_SCHEMA
+        : billingNoticePageSchema,
+    scopes: ["usage:read"],
+    sessionAuthority: "headers",
+    summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? ""
+        : "List persistent billing notices",
+    surfaces: ["api", "mock"],
+};
+const BILLING_NOTIFICATION_SETTINGS_OPERATION = {
+    creates: false,
+    description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+        ? ""
+        : "Reads the low-credit threshold in effect and the optional-email choice. Unless a threshold was chosen, it is one fifth of the organization's most recent credit purchase or grant, rounded down to a whole cent, and zero before any credit was granted. Critical email remains mandatory for owners and active billing-role members; addresses and contact management are absent.",
+    example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : BILLING_NOTIFICATION_SETTINGS_EXAMPLE,
+    id: "billing.notificationsettings",
+    idempotent: true,
+    mcp: { destructive: false, kind: "tool", openWorld: false },
+    method: "GET",
+    mutates: false,
+    path: "/v1/billing/notification-settings",
+    principals: ["api-credential", "oauth", "session"],
+    problems: ["service_unavailable"],
+    response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? API_UNUSED_RESPONSE_SCHEMA
+        : billingNotificationSettingsSchema,
+    scopes: ["usage:read"],
+    sessionAuthority: "headers",
+    summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? ""
+        : "Read billing notification settings",
+    surfaces: ["api", "mock"],
+};
+const BILLING_NOTIFICATION_SETTINGS_UPDATE_OPERATION = {
+    creates: false,
+    description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+        ? ""
+        : "Replaces the low-credit threshold and noncritical email choice at an expected revision. A null threshold returns to the default of one fifth of the most recent credit purchase or grant; an omitted threshold is left exactly as it is. Critical email stays mandatory; idempotent retries converge and agents require explicit approval.",
+    environments: ["live"],
+    example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : BILLING_NOTIFICATION_SETTINGS_EXAMPLE,
+    id: "billing.notificationsettingsupdate",
+    idempotent: true,
+    mcp: { destructive: false, kind: "tool", openWorld: false },
+    method: "PATCH",
+    mutates: true,
+    path: "/v1/billing/notification-settings",
+    principals: ["api-credential", "oauth", "session"],
+    problems: [
+        "idempotency_key_reused",
+        "invalid_request",
+        "revision_conflict",
+        "service_unavailable",
+        "test_to_live_escalation",
+    ],
+    request: billingNotificationSettingsUpdateRequestSchema,
+    requestExample: globalThis
+        .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : {
+            expectedRevision: 1,
+            lowCreditThreshold: {
+                currency: "USD",
+                microdollars: "2000000",
+                scale: 6,
+            },
+            noncriticalEmail: false,
+        },
+    requestHeaders: requiredIdempotencyRequestHeaderSchema,
+    response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? API_UNUSED_RESPONSE_SCHEMA
+        : billingNotificationSettingsSchema,
+    ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? {}
+        : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+    scopes: ["billing:write"],
+    sessionAuthority: "headers",
+    summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? ""
+        : "Update billing notification settings",
+    surfaces: ["api", "mock"],
+};
+const BILLING_AUTO_TOP_UP_PREVIEW_OPERATION = {
+    creates: false,
+    description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+        ? ""
+        : "Previews one complete automatic execution-credit top-up rule without changing payment authority or contacting the payment provider. Enable and edit replace the fixed credit amount, usable-balance trigger and UTC-month gross ceiling together; disable and resume name those exact intents. The preview reports the current and proposed rule, whether authority expands, existing monthly commitments and separate recurring project fees. USD 10 below USD 2 within USD 50 is a suggested editable rule, not a platform maximum or target-balance refill.",
+    environments: ["live"],
+    example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : BILLING_AUTO_TOP_UP_PREVIEW_EXAMPLE,
+    id: "billing.autotopuppreview",
+    idempotent: false,
+    mcp: { destructive: false, kind: "tool", openWorld: false },
+    method: "POST",
+    mutates: false,
+    path: "/v1/billing/funding/auto-top-up/preview",
+    principals: ["api-credential", "oauth", "session"],
+    problems: [
+        "invalid_request",
+        "revision_conflict",
+        "service_unavailable",
+        "state_conflict",
+        "test_to_live_escalation",
+    ],
+    request: billingAutoTopUpPreviewRequestSchema,
+    requestExample: globalThis
+        .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : {
+            action: "enable",
+            ceiling: {
+                currency: "USD",
+                microdollars: "50000000",
+                scale: 6,
+            },
+            credit: {
+                currency: "USD",
+                microdollars: "10000000",
+                scale: 6,
+            },
+            expectedRevision: 3,
+            triggerBelow: {
+                currency: "USD",
+                microdollars: "2000000",
+                scale: 6,
+            },
+        },
+    response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? API_UNUSED_RESPONSE_SCHEMA
+        : billingAutoTopUpPreviewSchema,
+    scopes: ["billing:write"],
+    sessionAuthority: "headers",
+    summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? ""
+        : "Preview an automatic top-up rule",
+    surfaces: ["api", "mock"],
+};
+const BILLING_AUTO_TOP_UP_APPLY_OPERATION = withBillingFundingContract({
+    creates: false,
+    description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+        ? ""
+        : "Applies the exact unexpired automatic top-up preview a billing owner confirmed. Enable or expanded limits require this explicit approval; edit and disable fence queued unsubmitted work, while submitted or uncertain payments retain their original identity and UTC authorization month. Resume may clear only an authenticated payment-method failure and never an unresolved provider outcome. Applying a rule creates no charge; later low-balance work remains bounded by the approved fixed amount, one outstanding operation, cooldown, usage cap and gross monthly ceiling.",
+    environments: ["live"],
+    id: "billing.autotopup",
+    idempotent: true,
+    mcp: { destructive: false, kind: "tool", openWorld: false },
+    method: "PATCH",
+    mutates: true,
+    path: "/v1/billing/funding/auto-top-up",
+    principals: ["api-credential", "oauth", "session"],
+    problems: [
+        "idempotency_key_reused",
+        "invalid_request",
+        "revision_conflict",
+        "service_unavailable",
+        "state_conflict",
+        "test_to_live_escalation",
+    ],
+    request: billingAutoTopUpApplyRequestSchema,
+    requestExample: globalThis
+        .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : {
+            confirmed: true,
+            expectedRevision: 3,
+            preview: "automatic-top-up-preview-example",
+        },
+    requestHeaders: requiredIdempotencyRequestHeaderSchema,
+    ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? {}
+        : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+    scopes: ["billing:write"],
+    sessionAuthority: "headers",
+    summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? ""
+        : "Apply an automatic top-up rule",
+    surfaces: ["api", "mock"],
+});
 export const OPERATIONS = [
     {
         creates: false,
-        description: "Reports the service, environment, and build the request reached. Unauthenticated: it carries no customer data and is used by canaries and deployment smoke checks.",
-        example: {
-            buildSha: "9f2c1ab",
-            environment: "development",
-            service: "@greatwait/api",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Read the verified organization's execution-credit payments with bounded cursor continuation. Existing recent-history responses remain compatible.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { data: [], freshness: { kind: "authoritative" } },
+        id: "billing.paymenthistory",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/payment-history",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request", "service_unavailable"],
+        query: pageRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPaymentHistoryPageSchema,
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Page execution-credit payments",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Read the verified organization's project subscription invoices with bounded cursor continuation. Existing recent-history responses remain compatible.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { data: [], freshness: { kind: "authoritative" } },
+        id: "billing.invoicehistory",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/invoice-history",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request", "service_unavailable"],
+        query: pageRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingInvoiceHistoryPageSchema,
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Page project subscription invoices",
+        surfaces: ["api", "mock"],
+    },
+    ...DATA_EXPORT_OPERATIONS,
+    ...ORGANIZATION_LIFECYCLE_OPERATIONS,
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reports the service, environment, and build the request reached. Unauthenticated: it carries no customer data and is used by canaries and deployment smoke checks.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                buildSha: "9f2c1ab",
+                environment: "development",
+                service: "@greatwait/api",
+            },
         id: "meta.version",
         idempotent: true,
         // A resource, not a tool. It takes no arguments and reports a fact about
@@ -70,19 +550,27 @@ export const OPERATIONS = [
         path: "/__greatwait/version",
         principals: [],
         problems: [],
-        response: scaffoldVersionSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scaffoldVersionSchema,
         scopes: [],
-        summary: "Read the deployed version",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read the deployed version",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reports the workspace layer this service occupies and the layers it may depend on. Exists so the architecture boundary is observable at runtime, not only at build time.",
-        example: {
-            dependsOn: ["application", "contract", "platform"],
-            layer: "adapter",
-            service: "@greatwait/api",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reports the workspace layer this service occupies and the layers it may depend on. Exists so the architecture boundary is observable at runtime, not only at build time.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                dependsOn: ["application", "contract", "platform"],
+                layer: "adapter",
+                service: "@greatwait/api",
+            },
         id: "meta.scaffold",
         idempotent: true,
         mcp: { kind: "resource", uri: "greatwait://meta/scaffold" },
@@ -91,22 +579,30 @@ export const OPERATIONS = [
         path: "/_scaffold",
         principals: [],
         problems: [],
-        response: workspaceScaffoldSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : workspaceScaffoldSchema,
         scopes: [],
-        summary: "Read the workspace scaffold",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read the workspace scaffold",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the committed contract fixtures the mock can serve. Mock-only: the API has no fixtures.",
-        example: {
-            fixtures: [
-                {
-                    description: "The workspace scaffold every service reports.",
-                    id: "workspace-scaffold",
-                },
-            ],
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the committed contract fixtures the mock can serve. Mock-only: the API has no fixtures.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                fixtures: [
+                    {
+                        description: "The workspace scaffold every service reports.",
+                        id: "workspace-scaffold",
+                    },
+                ],
+            },
         id: "mock.listFixtures",
         idempotent: true,
         mcp: {
@@ -118,19 +614,27 @@ export const OPERATIONS = [
         path: "/_contract/fixtures",
         principals: [],
         problems: [],
-        response: fixtureListSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : fixtureListSchema,
         scopes: [],
-        summary: "List contract fixtures",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List contract fixtures",
         surfaces: ["mock"],
     },
     {
         creates: false,
-        description: "Serves one committed fixture, byte-identical on every call. Returns a not_found problem for an unknown identifier.",
-        example: {
-            dependsOn: ["application", "contract", "platform"],
-            layer: "adapter",
-            service: "@greatwait/contract-mock",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Serves one committed fixture, byte-identical on every call. Returns a not_found problem for an unknown identifier.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                dependsOn: ["application", "contract", "platform"],
+                layer: "adapter",
+                service: "@greatwait/contract-mock",
+            },
         id: "mock.getFixture",
         idempotent: true,
         mcp: {
@@ -142,28 +646,36 @@ export const OPERATIONS = [
         path: "/_contract/fixtures/{fixtureId}",
         principals: [],
         problems: ["not_found"],
-        response: workspaceScaffoldSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : workspaceScaffoldSchema,
         scopes: [],
-        summary: "Read a contract fixture",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a contract fixture",
         surfaces: ["mock"],
     },
     {
         creates: true,
-        description: "Creates a reusable callback endpoint in the caller's project and environment. The destination must be HTTPS on effective port 443, contain no URL credentials or fragment, and resolve only to public unicast addresses. The endpoint begins pending. Whether delivery waits for its secret-bound ownership challenge is a deployment policy: where the challenge is not required, which is the default, a pending endpoint is delivered to and answering the challenge only records the instant it proved possession; where it is required, attaching a pending endpoint to a schedule is refused endpoint_unverified until the challenge succeeds. A disabled endpoint is never delivered to under either policy, and a schedule write naming one answers not_found, because disabling is terminal rather than a state to recover from. The per-endpoint secret is returned in this response and nowhere else. The 50-record safety ceiling includes disabled endpoints because they remain readable for audit.",
-        example: {
-            createdAt: "2026-08-05T15:00:00.000Z",
-            environmentKind: "test",
-            id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            secret: "ptsk_test_<the-one-time-endpoint-secret-here>",
-            shownOnce: true,
-            signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-            status: "pending",
-            updatedAt: "2026-08-05T15:00:00.000Z",
-            url: "https://hooks.example.com/greatwait",
-            version: 1,
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a reusable callback endpoint in the caller's project and environment. The destination must be HTTPS on effective port 443, contain no URL credentials or fragment, and resolve only to public unicast addresses. The endpoint is active and usable the moment it exists; there is nothing to verify. A disabled endpoint is never delivered to, and a schedule write naming one answers not_found, because disabling is terminal rather than a state to recover from. The per-endpoint secret is returned to this call and to no other call an API credential or an OAuth token can make; a signed-in member can read it again through endpoints.revealSigningSecret. There is no endpoint-count ceiling. Disabled endpoints remain readable for audit; request and DNS inspection admission bound creation work and reads are paged.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-05T15:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                secret: "ptsk_test_<the-one-time-endpoint-secret-here>",
+                shownOnce: true,
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                status: "active",
+                updatedAt: "2026-08-05T15:00:00.000Z",
+                url: "https://hooks.example.com/greatwait",
+                version: 1,
+            },
         id: "endpoints.create",
         idempotent: false,
         mcp: {
@@ -174,35 +686,50 @@ export const OPERATIONS = [
         mutates: true,
         path: "/v1/endpoints",
         principals: ["api-credential", "oauth", "session"],
-        problems: ["invalid_request", "plan_limit_reached", "rate_limited"],
+        problems: [
+            "state_conflict",
+            "invalid_request",
+            "plan_limit_reached",
+            "rate_limited",
+        ],
         request: callbackEndpointRequestSchema,
-        requestExample: { url: "https://hooks.example.com/greatwait" },
-        response: callbackEndpointCreatedSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { url: "https://hooks.example.com/greatwait" },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointCreatedSchema,
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Create a callback endpoint",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Create a callback endpoint",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the caller's callback endpoints for exactly its own project and environment. The result is authoritative and metadata-only: no signing secret or sealed key material has a field in this shape.",
-        example: {
-            data: [
-                {
-                    createdAt: "2026-08-05T15:00:00.000Z",
-                    environmentKind: "test",
-                    id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-                    status: "verified",
-                    updatedAt: "2026-08-05T15:01:00.000Z",
-                    url: "https://hooks.example.com/greatwait",
-                    verifiedAt: "2026-08-05T15:01:00.000Z",
-                    version: 2,
-                },
-            ],
-            freshness: { kind: "authoritative" },
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the caller's callback endpoints for exactly its own project and environment. The result is authoritative and metadata-only: no signing secret or sealed key material has a field in this shape.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        createdAt: "2026-08-05T15:00:00.000Z",
+                        environmentKind: "test",
+                        id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                        status: "active",
+                        updatedAt: "2026-08-05T15:01:00.000Z",
+                        url: "https://hooks.example.com/greatwait",
+                        version: 2,
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+            },
         id: "endpoints.list",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -212,27 +739,35 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request"],
         query: pageRequestSchema,
-        response: callbackEndpointPageSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointPageSchema,
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "List callback endpoints",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List callback endpoints",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reads one callback endpoint from the caller's own project and environment. A well-formed identifier belonging to another authority is indistinguishable from an absent endpoint, and the response never contains secret material.",
-        example: {
-            createdAt: "2026-08-05T15:00:00.000Z",
-            environmentKind: "test",
-            id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-            status: "verified",
-            updatedAt: "2026-08-05T15:01:00.000Z",
-            url: "https://hooks.example.com/greatwait",
-            verifiedAt: "2026-08-05T15:01:00.000Z",
-            version: 2,
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one callback endpoint from the caller's own project and environment. A well-formed identifier belonging to another authority is indistinguishable from an absent endpoint, and the response never contains secret material.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-05T15:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "https://hooks.example.com/greatwait",
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                status: "active",
+                updatedAt: "2026-08-05T15:01:00.000Z",
+                url: "https://hooks.example.com/greatwait",
+                version: 2,
+            },
         id: "endpoints.read",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -241,30 +776,40 @@ export const OPERATIONS = [
         path: "/v1/endpoints/{endpointId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
-        response: callbackEndpointSchema,
-        // The version a conditional update or verification must send back. Published
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSchema,
+        // The version a conditional update must send back. Published
         // because a caller expected to put a value in `If-Match` needs the operation
         // that hands it out to say so — the same reason `schedules.read` carries it.
-        responseHeaders: versionResponseHeaderSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "Read a callback endpoint",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a callback endpoint",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Replaces an endpoint's destination after applying the complete URL and DNS policy. A changed destination resets verification to pending; the endpoint cannot be used again until ownership of the new URL is proved. Disabled endpoints cannot be updated. Send If-Match with the version the endpoint was read at to be refused rather than overwrite a destination somebody else changed in the meantime.",
-        example: {
-            createdAt: "2026-08-05T15:00:00.000Z",
-            environmentKind: "test",
-            id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-            status: "pending",
-            updatedAt: "2026-08-05T16:00:00.000Z",
-            url: "https://hooks.example.com/replacement",
-            version: 3,
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces an endpoint's destination after applying the complete URL and DNS policy, and renames it when a name is given. Deliveries go to the new destination from the next one on. Disabled endpoints cannot be updated. Send If-Match with the version the endpoint was read at to be refused rather than overwrite a destination somebody else changed in the meantime.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-05T15:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                status: "active",
+                updatedAt: "2026-08-05T16:00:00.000Z",
+                url: "https://hooks.example.com/replacement",
+                version: 3,
+            },
         id: "endpoints.update",
         idempotent: true,
         mcp: { destructive: true, kind: "tool", openWorld: true },
@@ -280,58 +825,98 @@ export const OPERATIONS = [
             "version_conflict",
         ],
         request: callbackEndpointRequestSchema,
-        requestExample: { url: "https://hooks.example.com/replacement" },
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { url: "https://hooks.example.com/replacement" },
         requestHeaders: conditionalRequestHeaderSchema,
-        response: callbackEndpointSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Update a callback endpoint",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Update a callback endpoint",
         surfaces: ["api", "mock"],
     },
     {
-        creates: false,
-        description: "Re-resolves the endpoint immediately before sending one bounded ownership challenge with redirects disabled. The receiver proves possession of the one-time endpoint secret in its response. A successful challenge marks the endpoint verified; a failed challenge records only a safe failure category. Send If-Match with the version the endpoint was read at to be refused rather than challenge a destination somebody else has since changed.",
-        example: {
-            createdAt: "2026-08-05T15:00:00.000Z",
-            environmentKind: "test",
-            id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            lastVerificationAttemptAt: "2026-08-05T15:01:00.000Z",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-            status: "verified",
-            updatedAt: "2026-08-05T15:01:00.000Z",
-            url: "https://hooks.example.com/greatwait",
-            verifiedAt: "2026-08-05T15:01:00.000Z",
-            version: 2,
-        },
-        id: "endpoints.verify",
+        creates: true,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates the next endpoint signing key and selects it immediately for new deliveries while retaining the current key in the receiver acceptance set for a bounded overlap. The overlap defaults to and cannot exceed 24 hours. A second rotation is refused until the current overlap ends. The new secret is returned once to this call, so a call whose answer was never read has rotated a key the caller does not hold. It is recoverable: a signed-in member can read both keys, and the instant the overlap ends, through endpoints.revealSigningSecret. An API credential or an OAuth token cannot, so an integration that loses the answer needs a member to read it back rather than a second rotation, which is refused until the overlap ends. Send If-Match with the version the endpoint was read at to be refused rather than rotate an endpoint that has changed since.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                endpoint: {
+                    createdAt: "2026-08-05T15:00:00.000Z",
+                    environmentKind: "test",
+                    id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    signingKeys: {
+                        current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        next: {
+                            id: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8",
+                            overlapEndsAt: "2026-08-06T15:05:00.000Z",
+                        },
+                    },
+                    status: "active",
+                    updatedAt: "2026-08-05T15:05:00.000Z",
+                    url: "https://hooks.example.com/greatwait",
+                    version: 3,
+                },
+                keyId: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8",
+                secret: "ptsk_test_<the-next-one-time-endpoint-secret-here>",
+                shownOnce: true,
+            },
+        id: "endpoints.rotateSigningKey",
         idempotent: false,
-        mcp: { destructive: false, kind: "tool", openWorld: true },
+        mcp: {
+            kind: "unavailable",
+            reason: "Rotation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history.",
+        },
         method: "POST",
         mutates: true,
-        path: "/v1/endpoints/{endpointId}/verify",
+        path: "/v1/endpoints/{endpointId}/signing-keys/rotate",
         principals: ["api-credential", "oauth", "session"],
         problems: [
             "invalid_request",
             "not_found",
-            "rate_limited",
             "state_conflict",
             "version_conflict",
         ],
+        request: callbackSigningKeyRotationRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { overlapSeconds: 3600 },
         requestHeaders: conditionalRequestHeaderSchema,
-        response: callbackEndpointSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointRotatedSchema,
+        // The endpoint's version after the rotation, so the next conditional write
+        // from the same page has something to send.
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Verify callback endpoint ownership",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Rotate a callback endpoint signing key",
         surfaces: ["api", "mock"],
     },
     {
-        creates: true,
-        description: "Creates the next endpoint signing key and selects it immediately for new deliveries while retaining the current key in the receiver acceptance set for a bounded overlap. The overlap defaults to and cannot exceed 24 hours. A second rotation is refused until the current overlap ends. The new secret is returned once and has no recovery operation, so a call whose answer was never read may have rotated a key nobody holds: read the endpoint and compare its signing keys before repeating one. Send If-Match with the version the endpoint was read at to be refused rather than rotate an endpoint that has changed since.",
-        example: {
-            endpoint: {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Records that a person has updated their server to accept the next signing key during the active overlap. This only marks the reminder done: it does not retire either key, shorten the overlap, or change which key signs new deliveries. Send If-Match with the version the endpoint was read at so an acknowledgement cannot be applied to a different rotation.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
                 createdAt: "2026-08-05T15:00:00.000Z",
                 environmentKind: "test",
                 id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
@@ -339,29 +924,25 @@ export const OPERATIONS = [
                 signingKeys: {
                     current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
                     next: {
+                        acknowledgedAt: "2026-08-05T15:10:00.000Z",
                         id: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8",
                         overlapEndsAt: "2026-08-06T15:05:00.000Z",
                     },
                 },
-                status: "verified",
-                updatedAt: "2026-08-05T15:05:00.000Z",
+                status: "active",
+                updatedAt: "2026-08-05T15:10:00.000Z",
                 url: "https://hooks.example.com/greatwait",
-                verifiedAt: "2026-08-05T15:01:00.000Z",
-                version: 3,
+                version: 4,
             },
-            keyId: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8",
-            secret: "ptsk_test_<the-next-one-time-endpoint-secret-here>",
-            shownOnce: true,
-        },
-        id: "endpoints.rotateSigningKey",
-        idempotent: false,
+        id: "endpoints.acknowledgeSigningKeyRotation",
+        idempotent: true,
         mcp: {
             kind: "unavailable",
-            reason: "Rotation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history.",
+            reason: "This is a human assertion about a server outside GreatWait; an agent cannot observe that the server has accepted the new secret.",
         },
         method: "POST",
         mutates: true,
-        path: "/v1/endpoints/{endpointId}/signing-keys/rotate",
+        path: "/v1/endpoints/{endpointId}/signing-keys/acknowledge",
         principals: ["api-credential", "oauth", "session"],
         problems: [
             "invalid_request",
@@ -369,34 +950,83 @@ export const OPERATIONS = [
             "state_conflict",
             "version_conflict",
         ],
-        request: callbackSigningKeyRotationRequestSchema,
-        requestExample: { overlapSeconds: 3600 },
-        requestHeaders: conditionalRequestHeaderSchema,
-        response: callbackEndpointRotatedSchema,
-        // The endpoint's version after the rotation, so the next conditional write
-        // from the same page has something to send.
-        responseHeaders: versionResponseHeaderSchema,
+        requestHeaders: requiredConditionalRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Rotate a callback endpoint signing key",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Mark a signing-key server update done",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Disables an endpoint immediately and permanently: there is no operation that re-enables one. It stays readable for audit but is no longer eligible for update, verification or callback send admission, and schedules pointed at it deliver nothing. Repeating the disable is idempotent and does not write a second audit event, which is why it takes no precondition — the outcome does not depend on what else has changed.",
-        example: {
-            createdAt: "2026-08-05T15:00:00.000Z",
-            disabledAt: "2026-08-05T17:00:00.000Z",
-            environmentKind: "test",
-            id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
-            status: "disabled",
-            updatedAt: "2026-08-05T17:00:00.000Z",
-            url: "https://hooks.example.com/greatwait",
-            verifiedAt: "2026-08-05T15:01:00.000Z",
-            version: 3,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reveals an endpoint's signing secret to a signed-in member: the value `endpoints.create` and `endpoints.rotateSigningKey` hand out once, readable again from the endpoint's own page. During a rotation both keys are returned, with the instant the overlap ends. Only a member session is accepted; an API credential or an OAuth token is refused, so an integration that needs the secret keeps the one the create or rotation that minted it returned. A disabled endpoint has nothing to reveal.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                current: {
+                    keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    secret: "ptsk_test_<the-current-endpoint-secret-here>",
+                },
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
+        id: "endpoints.revealSigningSecret",
+        idempotent: true,
+        // The same reason `endpoints.rotateSigningKey` gives, and one more: the
+        // route accepts only a signed-in member, and MCP never carries a session.
+        // The operator chose reveal-later for people (FXO-2244) and no new
+        // machine-callable read; an agent that needs the secret scripts the
+        // create or rotation, which keeps it out of tool history by construction.
+        mcp: {
+            kind: "unavailable",
+            reason: "The response is an endpoint signing secret, which MCP has no secure-result channel for — and the route accepts only a signed-in member, which MCP never carries.",
         },
+        method: "GET",
+        mutates: false,
+        path: "/v1/endpoints/{endpointId}/signing-secret",
+        principals: ["session"],
+        problems: ["invalid_request", "not_found", "state_conflict"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSigningSecretsSchema,
+        // `endpoints:write`, not `endpoints:read`, though nothing is written: it is
+        // the standing the two operations that already hand this value out
+        // require, and a session that may not rotate the key should not be able
+        // to read it either.
+        scopes: ["endpoints:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Reveal a callback endpoint signing secret",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Disables an endpoint immediately. It stays readable for audit but can no longer be updated or delivered to, and schedules pointed at it deliver nothing until `endpoints.enable` turns it back on. Repeating the disable is idempotent and does not write a second audit event, which is why it takes no precondition — the outcome does not depend on what else has changed.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-05T15:00:00.000Z",
+                disabledAt: "2026-08-05T17:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                status: "disabled",
+                updatedAt: "2026-08-05T17:00:00.000Z",
+                url: "https://hooks.example.com/greatwait",
+                version: 3,
+            },
         id: "endpoints.disable",
         idempotent: true,
         mcp: { destructive: true, kind: "tool", openWorld: false },
@@ -405,27 +1035,80 @@ export const OPERATIONS = [
         path: "/v1/endpoints/{endpointId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
-        response: callbackEndpointSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
+        scopes: ["endpoints:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Disable a callback endpoint",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Enables an endpoint that was disabled, so schedules pointed at it deliver again from the next occurrence on. Its address, name, signing keys and history are exactly as they were; nothing has to be created or re-pointed. Repeating the enable is idempotent and does not write a second audit event, so like `endpoints.disable` it takes no precondition. Somebody who disabled an endpoint by mistake, with many schedules pointed at it, gets it back with one call.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-05T15:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "https://hooks.example.com/greatwait",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                status: "active",
+                updatedAt: "2026-08-05T18:00:00.000Z",
+                url: "https://hooks.example.com/greatwait",
+                version: 4,
+            },
+        id: "endpoints.enable",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/endpoints/{endpointId}/enable",
+        principals: ["api-credential", "oauth", "session"],
+        // `state_conflict` when another endpoint took this one's name while it
+        // was off: names are unique among live endpoints, and enabling would make
+        // two.
+        problems: ["invalid_request", "not_found", "state_conflict"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Disable a callback endpoint",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Enable a disabled callback endpoint",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Creates a deterministic receiver for one callback endpoint so failures can be rehearsed before they happen in production. Test environments only: a live principal has no such operation, and there is no request field that could widen the organization, project, or environment the sink belongs to. The sink verifies deliveries with the bound endpoint's own signing keys, so key rotation and a wrong key behave here exactly as they would at the customer's receiver. It receives and never sends: no field names a destination and no configuration makes it forward a delivery. Point the endpoint at the returned url and verify it, and every attempt lands here.",
-        example: {
-            createdAt: "2026-08-07T15:00:00.000Z",
-            deliveryCount: 0,
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            environmentKind: "test",
-            id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            program: { behavior: "success" },
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            updatedAt: "2026-08-07T15:00:00.000Z",
-            url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a deterministic receiver for one callback endpoint so failures can be rehearsed before they happen in production. Test environments only: a live principal has no such operation, and there is no request field that could widen the organization, project, or environment the sink belongs to. The sink verifies deliveries with the bound endpoint's own signing keys, so key rotation and a wrong key behave here exactly as they would at the customer's receiver. It receives and never sends: no field names a destination and no configuration makes it forward a delivery. Point the endpoint at the returned url, and every attempt lands here.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-07T15:00:00.000Z",
+                deliveryCount: 0,
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                environmentKind: "test",
+                id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                program: { behavior: "success" },
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                updatedAt: "2026-08-07T15:00:00.000Z",
+                url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
         environments: ["test"],
         id: "testsinks.create",
         idempotent: false,
@@ -449,35 +1132,50 @@ export const OPERATIONS = [
             "state_conflict",
         ],
         request: testSinkCreateRequestSchema,
-        requestExample: {
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            program: { behavior: "server_error", forDeliveries: 2, then: "success" },
-        },
-        response: testSinkSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                program: {
+                    behavior: "server_error",
+                    forDeliveries: 2,
+                    then: "success",
+                },
+            },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkSchema,
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Create a test sink",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Create a test sink",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the caller's test sinks for exactly its own project and test environment. A live principal receives an empty-handed refusal rather than another environment's sinks.",
-        example: {
-            data: [
-                {
-                    createdAt: "2026-08-07T15:00:00.000Z",
-                    deliveryCount: 3,
-                    endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    environmentKind: "test",
-                    id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    program: { behavior: "success" },
-                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    updatedAt: "2026-08-07T15:02:00.000Z",
-                    url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                },
-            ],
-            freshness: { kind: "authoritative" },
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the caller's test sinks for exactly its own project and test environment. A live principal receives an empty-handed refusal rather than another environment's sinks.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        createdAt: "2026-08-07T15:00:00.000Z",
+                        deliveryCount: 3,
+                        endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        environmentKind: "test",
+                        id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        program: { behavior: "success" },
+                        project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        updatedAt: "2026-08-07T15:02:00.000Z",
+                        url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+            },
         environments: ["test"],
         id: "testsinks.list",
         idempotent: true,
@@ -488,26 +1186,34 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "state_conflict"],
         query: pageRequestSchema,
-        response: testSinkPageSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkPageSchema,
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "List test sinks",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List test sinks",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reads one test sink from the caller's own project and test environment, including how many deliveries it has taken. A well-formed identifier belonging to another authority is indistinguishable from an absent sink.",
-        example: {
-            createdAt: "2026-08-07T15:00:00.000Z",
-            deliveryCount: 3,
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            environmentKind: "test",
-            id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            program: { behavior: "rate_limited", retryAfterSeconds: 5 },
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            updatedAt: "2026-08-07T15:02:00.000Z",
-            url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one test sink from the caller's own project and test environment, including how many deliveries it has taken. A well-formed identifier belonging to another authority is indistinguishable from an absent sink.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-07T15:00:00.000Z",
+                deliveryCount: 3,
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                environmentKind: "test",
+                id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                program: { behavior: "rate_limited", retryAfterSeconds: 5 },
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                updatedAt: "2026-08-07T15:02:00.000Z",
+                url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
         environments: ["test"],
         id: "testsinks.read",
         idempotent: true,
@@ -517,26 +1223,34 @@ export const OPERATIONS = [
         path: "/v1/test-sinks/{sinkId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "state_conflict"],
-        response: testSinkSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkSchema,
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "Read a test sink",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a test sink",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Replaces a sink's behavior program. The program is resolved against the number of deliveries the sink has already taken, so `forDeliveries` counts from the next delivery rather than from the sink's creation. Repeating the identical program is idempotent and changes nothing an integrator can observe.",
-        example: {
-            createdAt: "2026-08-07T15:00:00.000Z",
-            deliveryCount: 3,
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            environmentKind: "test",
-            id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            program: { behavior: "timeout" },
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            updatedAt: "2026-08-07T15:03:00.000Z",
-            url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces a sink's behavior program. The program is resolved against the number of deliveries the sink has already taken, so `forDeliveries` counts from the next delivery rather than from the sink's creation. Repeating the identical program is idempotent and changes nothing an integrator can observe.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-07T15:00:00.000Z",
+                deliveryCount: 3,
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                environmentKind: "test",
+                id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                program: { behavior: "timeout" },
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                updatedAt: "2026-08-07T15:03:00.000Z",
+                url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
         environments: ["test"],
         id: "testsinks.configure",
         idempotent: true,
@@ -547,33 +1261,44 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "state_conflict"],
         request: testSinkProgramSchema,
-        requestExample: { behavior: "timeout" },
-        response: testSinkSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { behavior: "timeout" },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkSchema,
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Set a test sink behavior program",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Set a test sink behavior program",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists what the sink received, most recent first with the record identifier breaking a tie, bounded by the retained-delivery ceiling. Metadata only: the identifiers, the signing key that authenticated the delivery, how the receiver disposed of it, and what it answered. The delivered body is not in this shape.",
-        example: {
-            data: [
-                {
-                    behavior: "success",
-                    delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    disposition: "processed",
-                    id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    receivedAt: "2026-08-07T15:02:00.000Z",
-                    respondedWith: 200,
-                    scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                },
-            ],
-            freshness: { kind: "authoritative" },
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists what the sink received, most recent first with the record identifier breaking a tie, bounded by the retained-delivery ceiling. Metadata only: the identifiers, the signing key that authenticated the delivery, how the receiver disposed of it, and what it answered. The delivered body is not in this shape.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        behavior: "success",
+                        delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        disposition: "processed",
+                        id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        receivedAt: "2026-08-07T15:02:00.000Z",
+                        respondedWith: 200,
+                        scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+            },
         environments: ["test"],
         id: "sinkdeliveries.list",
         idempotent: true,
@@ -584,31 +1309,39 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "state_conflict"],
         query: pageRequestSchema,
-        response: testSinkDeliveryPageSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkDeliveryPageSchema,
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "List test sink deliveries",
-        surfaces: ["api", "mock"],
-    },
-    {
-        creates: false,
-        description: "Reads one recorded delivery including the exact bytes that arrived, truncated at the published cap with the original length stated. This is the one place a callback body is readable, and it is narrow on purpose: a test environment only, the creating authority only, a single record rather than a listing, and never a log. The signature is included because a MAC is not secret and comparing it against a locally computed one is how a body-mutation bug is found; no signing key appears in this shape.",
-        example: {
-            behavior: "success",
-            body: '{"version":"2026-08-08","type":"schedule.occurrence","scheduleId":"sch_01h8xyz9k2m4n6p8r0t2v4w6y8","occurrenceId":"occ_01h8xyz9k2m4n6p8r0t2v4w6y8","plannedFor":"2026-08-07T15:00:00.000Z","attempt":1,"trigger":{"kind":"automatic"},"data":{}}',
-            bodyTruncated: false,
-            delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            disposition: "processed",
-            id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            receivedAt: "2026-08-07T15:02:00.000Z",
-            receivedBytes: 240,
-            respondedWith: 200,
-            scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            signature: "v1=11135fdfc0bc5d49ebcc9d3a0d8df1116179097cefe961c6eca281339e5cfab3",
-            sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-        },
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List test sink deliveries",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one recorded delivery including the exact bytes that arrived, truncated at the published cap with the original length stated. This is the one place a callback body is readable, and it is narrow on purpose: a test environment only, the creating authority only, a single record rather than a listing, and never a log. The signature is included because a MAC is not secret and comparing it against a locally computed one is how a body-mutation bug is found; no signing key appears in this shape.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                behavior: "success",
+                body: '{"version":"2026-08-08","type":"schedule.occurrence","scheduleId":"sch_01h8xyz9k2m4n6p8r0t2v4w6y8","occurrenceId":"occ_01h8xyz9k2m4n6p8r0t2v4w6y8","plannedFor":"2026-08-07T15:00:00.000Z","attempt":1,"trigger":{"kind":"automatic"},"data":{}}',
+                bodyTruncated: false,
+                delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                disposition: "processed",
+                id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                receivedAt: "2026-08-07T15:02:00.000Z",
+                receivedBytes: 240,
+                respondedWith: 200,
+                scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                signature: "v1=11135fdfc0bc5d49ebcc9d3a0d8df1116179097cefe961c6eca281339e5cfab3",
+                sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
         environments: ["test"],
         id: "sinkdeliveries.read",
         idempotent: true,
@@ -621,26 +1354,34 @@ export const OPERATIONS = [
         path: "/v1/test-sinks/{sinkId}/deliveries/{deliveryRecordId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "state_conflict"],
-        response: testSinkDeliveryBodySchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkDeliveryBodySchema,
         scopes: ["endpoints:read"],
         sessionAuthority: "headers",
-        summary: "Read a test sink delivery",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a test sink delivery",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Deletes a sink and every delivery it recorded. The bound callback endpoint is untouched and keeps its signing keys; deliveries sent afterwards find nothing at the url and fail the way an unreachable receiver does.",
-        example: {
-            createdAt: "2026-08-07T15:00:00.000Z",
-            deliveryCount: 3,
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            environmentKind: "test",
-            id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            program: { behavior: "success" },
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            updatedAt: "2026-08-07T15:04:00.000Z",
-            url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Deletes a sink and every delivery it recorded. The bound callback endpoint is untouched and keeps its signing keys; deliveries sent afterwards find nothing at the url and fail the way an unreachable receiver does.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-07T15:00:00.000Z",
+                deliveryCount: 3,
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                environmentKind: "test",
+                id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                program: { behavior: "success" },
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                updatedAt: "2026-08-07T15:04:00.000Z",
+                url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+            },
         environments: ["test"],
         id: "testsinks.delete",
         idempotent: true,
@@ -650,20 +1391,28 @@ export const OPERATIONS = [
         path: "/v1/test-sinks/{sinkId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "state_conflict"],
-        response: testSinkSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : testSinkSchema,
         scopes: ["endpoints:write"],
         sessionAuthority: "headers",
-        summary: "Delete a test sink",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Delete a test sink",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Pins the mock's behavior and clock so an integrator can rehearse success, refusal, retry, timeout, ambiguity, and redelivery deterministically. Mock-only, and never evidence that the real runtime behaves this way.",
-        example: {
-            behavior: "retry",
-            now: "2026-01-01T00:00:00.000Z",
-            scenarioId: "scenario-1",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Pins the mock's behavior and clock so an integrator can rehearse success, refusal, retry, timeout, ambiguity, and redelivery deterministically. Mock-only, and never evidence that the real runtime behaves this way.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                behavior: "retry",
+                now: "2026-01-01T00:00:00.000Z",
+                scenarioId: "scenario-1",
+            },
         id: "mock.setScenario",
         idempotent: false,
         mcp: {
@@ -676,21 +1425,32 @@ export const OPERATIONS = [
         principals: [],
         problems: ["invalid_request"],
         request: mockScenarioRequestSchema,
-        requestExample: { behavior: "retry", failuresBeforeSuccess: 2 },
-        response: mockScenarioResponseSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { behavior: "retry", failuresBeforeSuccess: 2 },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : mockScenarioResponseSchema,
         scopes: [],
-        summary: "Set the mock scenario",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Set the mock scenario",
         surfaces: ["mock"],
     },
     {
         creates: false,
-        description: "Reports the authority the presented credential carries: the project it acts in, which of that project's two environments, and the scopes the service will enforce for it. The answer comes entirely from the verified principal, so there is no parameter that could name another project and no way for the reply to describe anything but the caller itself. It requires a principal and no scope, because every value in it is a property of the credential being presented rather than of anything the credential may reach: a caller that could not read this could still act, and would simply be acting without being able to say where. A signed-in member is not accepted — a session's authority is an organization and it names its project per request, so there is no single answer to give one.",
-        example: {
-            environmentKind: "test",
-            principal: "api-credential",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            scopes: ["schedules:read", "schedules:write"],
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reports the authority the presented credential carries: the project it acts in, which of that project's two environments, and the scopes the service will enforce for it. The answer comes entirely from the verified principal, so there is no parameter that could name another project and no way for the reply to describe anything but the caller itself. It requires a principal and no scope, because every value in it is a property of the credential being presented rather than of anything the credential may reach: a caller that could not read this could still act, and would simply be acting without being able to say where. A signed-in member is not accepted — a session's authority is an organization and it names its project per request, so there is no single answer to give one.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                environmentKind: "test",
+                principal: "api-credential",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                scopes: ["schedules:read", "schedules:write"],
+            },
         id: "context.read",
         idempotent: true,
         // A resource rather than a tool: it takes no arguments, it reports a fact
@@ -707,30 +1467,38 @@ export const OPERATIONS = [
         // No `not_found`: the authority tuple exists by the time a principal is
         // verified, so there is nothing here that can be absent.
         problems: [],
-        response: credentialContextSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : credentialContextSchema,
         // **Empty, and that is the point of the operation.** Every other
         // authenticated operation names the scope it consumes; this one consumes
         // none, so `scope_missing` is a refusal it can never produce and
         // `problemsFor` does not publish one for it.
         scopes: [],
-        summary: "Read this credential's authority",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read this credential's authority",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Issues an API credential bound to one project and environment, with scopes capped by the issuing member's current role. The full secret is in this response and in no other, is not recoverable afterwards, and there is deliberately no reveal endpoint. The value is the sixteen-character display prefix followed immediately by thirty-two more characters; the example below is a visible placeholder rather than that shape, because a realistic credential in a committed file is one the repository's own secret scanner refuses.",
-        example: {
-            createdAt: "2026-07-28T15:00:00.000Z",
-            displayPrefix: "pt_test_a1b2c3d4",
-            environmentKind: "test",
-            id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            scopes: ["schedules:write"],
-            secret: "pt_test_a1b2c3d4<the-32-character-secret-half-here>",
-            shownOnce: true,
-        },
-        id: "credentials.create",
-        idempotent: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Issues an API credential bound to one project and environment, with scopes capped by the issuing member's current role. The full secret is in this response and in no other, is not recoverable afterwards, and there is deliberately no reveal endpoint. The value is the sixteen-character display prefix followed immediately by thirty-two more characters; the example below is a visible placeholder rather than that shape, because a realistic credential in a committed file is one the repository's own secret scanner refuses.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-07-28T15:00:00.000Z",
+                displayPrefix: "pt_test_a1b2c3d4",
+                environmentKind: "test",
+                id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                scopes: ["schedules:write"],
+                secret: "pt_test_a1b2c3d4<the-32-character-secret-half-here>",
+                shownOnce: true,
+            },
+        id: "credentials.create",
+        idempotent: false,
         // The one API-surface operation an agent cannot reach, and the reason is
         // the route's own: issuance is authenticated by a Clerk session and refuses
         // an API credential outright, because a key that can mint keys turns one
@@ -764,42 +1532,53 @@ export const OPERATIONS = [
         // where the refusal becomes reachable and declarable.
         problems: ["invalid_request", "not_found"],
         request: credentialRequestSchema,
-        requestExample: {
-            environmentKind: "test",
-            project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            scopes: ["schedules:write"],
-        },
-        response: credentialCreatedSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                environmentKind: "test",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                scopes: ["schedules:write"],
+            },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : credentialCreatedSchema,
         scopes: ["credentials:write"],
         sessionAuthority: "request-body",
-        summary: "Issue an API credential",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Issue an API credential",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the credentials issued for the caller's own project and environment, oldest first, one page at a time. The authority tuple comes from the verified principal, so there is no parameter that could name another project — a listing is the caller's own book or nothing. Revoked and rotated credentials stay in the listing and carry the fields that say so; a credential nobody can see is a credential nobody can audit. `limit` is bounded by the contract and `cursor` is the opaque value the previous page returned. No page carries a secret: the item is the read shape, which has no field one could be put in.",
-        example: {
-            data: [
-                {
-                    createdAt: "2026-07-28T15:00:00.000Z",
-                    displayPrefix: "pt_test_a1b2c3d4",
-                    environmentKind: "test",
-                    id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    lastUsedAt: "2026-07-28T15:04:00.000Z",
-                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    scopes: ["schedules:write"],
-                },
-            ],
-            // Authoritative rather than projected: credentials are read from the row
-            // that owns them, not from a cross-partition projection. The
-            // discriminator is on every page so a client never has to know which
-            // collections lag.
-            freshness: { kind: "authoritative" },
-            // Opaque. Clients pass back exactly what they were given, which is why
-            // this is the whole value rather than an elided one — a truncated example
-            // teaches a reader that a cursor has readable parts.
-            nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYWtfMDFoOHh5ejlrMm00bjZwOHIwdDJ2NHc2eTgiLCJrIjoiOTUxMzU0NmYifQ",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the credentials issued for the caller's own project and environment, oldest first, one page at a time. The authority tuple comes from the verified principal, so there is no parameter that could name another project — a listing is the caller's own book or nothing. Revoked and rotated credentials stay in the listing and carry the fields that say so; a credential nobody can see is a credential nobody can audit. `limit` is bounded by the contract and `cursor` is the opaque value the previous page returned. No page carries a secret: the item is the read shape, which has no field one could be put in.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        createdAt: "2026-07-28T15:00:00.000Z",
+                        displayPrefix: "pt_test_a1b2c3d4",
+                        environmentKind: "test",
+                        id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        lastUsedAt: "2026-07-28T15:04:00.000Z",
+                        project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        scopes: ["schedules:write"],
+                    },
+                ],
+                // Authoritative rather than projected: credentials are read from the row
+                // that owns them, not from a cross-partition projection. The
+                // discriminator is on every page so a client never has to know which
+                // collections lag.
+                freshness: { kind: "authoritative" },
+                // Opaque. Clients pass back exactly what they were given, which is why
+                // this is the whole value rather than an elided one — a truncated example
+                // teaches a reader that a cursor has readable parts.
+                nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYWtfMDFoOHh5ejlrMm00bjZwOHIwdDJ2NHc2eTgiLCJrIjoiOTUxMzU0NmYifQ",
+            },
         id: "credentials.list",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -813,31 +1592,39 @@ export const OPERATIONS = [
         // sometimes empty.
         problems: ["invalid_request"],
         query: pageRequestSchema,
-        response: credentialPageSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : credentialPageSchema,
         scopes: ["credentials:read"],
         sessionAuthority: "headers",
-        summary: "List API credentials",
-        surfaces: ["api", "mock"],
-    },
-    {
-        creates: false,
-        description: "Reads what a key this project issued should be able to do over MCP: the endpoint to point a client at, the discovery document beside it, the scopes fixed into the key when it was made, and the MCP tool names those scopes authorize. It returns no secret and cannot: the transient value is shown once at creation and is never sent here. The credential is addressed by identifier and re-resolved against the signed-in member's own project and environment, so a key belonging to another project answers exactly as one that does not exist. `state` distinguishes a key that still verifies from one that was revoked and one whose rotation overlap has run out, because a client configured with either fails identically and the remedies differ.",
-        example: {
-            discovery: "https://api.greatwait.dev/.well-known/oauth-protected-resource/mcp",
-            displayPrefix: "pt_test_a1b2c3d4",
-            endpoint: "https://api.greatwait.dev/mcp",
-            id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            scopes: ["occurrences:read", "schedules:read", "schedules:write"],
-            state: "usable",
-            tools: [
-                "occurrences_list",
-                "occurrences_read",
-                "schedules_cancel",
-                "schedules_create",
-                "schedules_list",
-                "schedules_read",
-            ],
-        },
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List API credentials",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads what a key this project issued should be able to do over MCP: the endpoint to point a client at, the discovery document beside it, the scopes fixed into the key when it was made, and the MCP tool names those scopes authorize. It returns no secret and cannot: the transient value is shown once at creation and is never sent here. The credential is addressed by identifier and re-resolved against the signed-in member's own project and environment, so a key belonging to another project answers exactly as one that does not exist. `state` distinguishes a key that still verifies from one that was revoked and one whose rotation overlap has run out, because a client configured with either fails identically and the remedies differ.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                discovery: "https://api.greatwait.dev/.well-known/oauth-protected-resource/mcp",
+                displayPrefix: "pt_test_a1b2c3d4",
+                endpoint: "https://api.greatwait.dev/mcp",
+                id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                scopes: ["occurrences:read", "schedules:read", "schedules:write"],
+                state: "usable",
+                tools: [
+                    "occurrences_list",
+                    "occurrences_read",
+                    "schedules_cancel",
+                    "schedules_create",
+                    "schedules_list",
+                    "schedules_read",
+                ],
+            },
         id: "credentials.connection",
         idempotent: true,
         // **Withheld, and the reason is the same one that withholds issuance.** A
@@ -855,24 +1642,42 @@ export const OPERATIONS = [
         path: "/v1/credentials/{credentialId}/connection",
         principals: ["session"],
         problems: ["not_found"],
-        response: mcpConnectionSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : mcpConnectionSchema,
         scopes: ["credentials:read"],
         sessionAuthority: "headers",
-        summary: "Read a credential's MCP connection",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a credential's MCP connection",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the projects in the signed-in member's organization that they may act in, with the environment kinds each one has. This is what a browser asks before it can address anything else: an API credential and an OAuth token each carry one project intrinsically, but a member belongs to an organization and chooses. Archived and deleted projects are omitted, because a member cannot act in one. The result is a display aid rather than an authorization control — naming a project on a later request re-resolves it against the member's own organization, and a project that is not theirs answers exactly as one that does not exist.",
-        example: {
-            data: [
-                {
-                    environmentKinds: ["test", "live"],
-                    id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    name: "Billing reminders",
-                },
-            ],
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the active and archived projects in the signed-in member's organization, with the environment kinds, lifecycle state, version and deletion-preview counts each one has. Active and archived rows both occupy a plan slot; deleted projects are absent. Archived rows are management targets rather than projects work may run inside, so a picker must not offer them as switch targets. The result is a display aid rather than an authorization control — naming a project on a later request re-resolves it against the member's own organization, and a project that is not theirs answers exactly as one that does not exist.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        createdAt: "2026-08-14T11:00:00.000Z",
+                        deletionCounts: {
+                            endpoints: 2,
+                            keys: 4,
+                            runs: 37,
+                            schedules: 5,
+                        },
+                        environmentKinds: ["test", "live"],
+                        id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        name: "Billing reminders",
+                        status: "active",
+                        version: 1,
+                    },
+                ],
+                total: 1,
+            },
         id: "projects.list",
         idempotent: true,
         mcp: {
@@ -886,27 +1691,38 @@ export const OPERATIONS = [
         // No `not_found`: the collection is the member's own organization, so it
         // always exists and is sometimes empty. No paging, so no `invalid_request`.
         problems: [],
-        response: projectListSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectListSchema,
         scopes: ["projects:read"],
         sessionAuthority: "organization",
-        summary: "List the member's projects",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List the member's projects",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Creates a project in the signed-in member's organization, with both of its environments. This is the first call a new customer makes: an organization has no project until somebody makes one, and every other operation on this surface acts inside one. The `test` and `live` environments are provisioned with it in a single transaction rather than asked for, so a project is never observable in a half-provisioned state. The organization comes from the verified session and is never read from the request — a member who belongs to one organization cannot create a project in another. `PROJECT_LIST_LIMIT` bounds how many an organization may hold, and it is the same ceiling the listing publishes: a create that would take an organization past a list it can no longer return is refused rather than silently truncating a later read.",
-        example: {
-            environmentKinds: ["test", "live"],
-            id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            name: "Billing reminders",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a project in the signed-in member's organization, with both of its environments. This is the first call a new customer makes: an organization has no project until somebody makes one, and every other operation on this surface acts inside one. The `test` and `live` environments are provisioned with it in a single transaction rather than asked for, so a project is never observable in a half-provisioned state. The organization comes from the verified session and is never read from the request — a member who belongs to one organization cannot create a project in another. `PROJECT_LIST_LIMIT` bounds how many an organization may hold, and it is the same ceiling the listing publishes: a create that would take an organization past a list it can no longer return is refused rather than silently truncating a later read. A name is unique within the organization, compared ignoring case and surrounding or repeated spaces; a second project with a name already taken is refused with `state_conflict`, and the refusal says nothing about any other organization's names.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: null,
+                deletionCounts: { endpoints: 0, keys: 0, runs: 0, schedules: 0 },
+                environmentKinds: ["test", "live"],
+                id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "Billing reminders",
+                status: "active",
+                version: 1,
+            },
         id: "projects.create",
-        // Not idempotent, and it cannot be made so here: repeating this makes a
-        // second project with the same name, because a name is a label rather than
-        // an identifier — `projectNameSchema` says so, and non-uniqueness is what
-        // lets somebody rename one without breaking a caller's URLs. No route on
-        // this Worker reads an idempotency key for it, so declaring `true` would
-        // publish a promise nothing keeps.
+        // Not idempotent, and it cannot be made so here. Since FXO-2256 a repeat
+        // with the same name is *refused* rather than doubled — the name is unique
+        // in its organization — but a refusal is not the same answer as the first
+        // call's, and no route on this Worker reads an idempotency key for it, so
+        // declaring `true` would publish a promise nothing keeps.
         idempotent: false,
         // Withheld from MCP for `projects.list`'s reason and one of its own. The
         // shared half: this operation accepts only a signed-in member, and MCP
@@ -928,32 +1744,169 @@ export const OPERATIONS = [
         // the same shape of refusal. There is no `not_found`: the organization is
         // the member's own and is created on first use, so it always exists by the
         // time the project is written.
-        problems: ["invalid_request", "plan_limit_reached"],
+        problems: ["invalid_request", "plan_limit_reached", "state_conflict"],
         request: projectCreateRequestSchema,
-        requestExample: { name: "Billing reminders" },
-        response: projectSummarySchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { name: "Billing reminders" },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectSummarySchema,
         scopes: ["projects:write"],
         sessionAuthority: "organization",
-        summary: "Create a project",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Create a project",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the applications this member has connected to their own account, newest first, across every project in their organization — because a person connects an application, not a project. Revoked connections stay in the listing with the instant and the reason they ended: a connection nobody can see is one nobody can audit. This is a signed-in member's view of their own delegations. An application holding a grant cannot read it, which is why the operation accepts no API credential and no access token, and why it is on no agent's tool list.",
-        example: {
-            data: [
-                {
-                    client: { id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8", name: "Flow XO" },
-                    createdAt: "2026-08-14T11:00:00.000Z",
-                    environmentKind: "test",
-                    id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    lastUsedAt: "2026-08-15T09:12:00.000Z",
-                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    scopes: ["schedules:read", "schedules:write"],
-                    status: "active",
-                },
-            ],
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Renames one project in the caller's own organization without changing its opaque identifier. Names remain unique within the organization ignoring ASCII case and surrounding or repeated whitespace. Send If-Match with the project's current version; a stale version is refused rather than silently overwriting somebody else's change. Members and administrators may rename because the change is cosmetic and reversible.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-14T11:00:00.000Z",
+                deletionCounts: { endpoints: 2, keys: 4, runs: 37, schedules: 5 },
+                environmentKinds: ["test", "live"],
+                id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "Customer reminders",
+                status: "active",
+                version: 2,
+            },
+        id: "projects.rename",
+        idempotent: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "PATCH",
+        mutates: true,
+        path: "/v1/projects/{projectId}",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "not_found",
+            "state_conflict",
+            "version_conflict",
+        ],
+        request: projectUpdateRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { name: "Customer reminders" },
+        requestHeaders: requiredConditionalRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectSummarySchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
+        scopes: ["projects:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Rename a project",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Archives or restores the caller's project. Archiving parks the complete project: no new occurrence is dispatched, while schedules, endpoints, keys, grants and retained history remain intact. Restoring clears that project-wide hold without rewriting any schedule; an occurrence whose instant passed while archived becomes due, matching schedule pause and resume. Only organization administrators may make this project-wide change.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                createdAt: "2026-08-14T11:00:00.000Z",
+                deletionCounts: { endpoints: 2, keys: 4, runs: 37, schedules: 5 },
+                environmentKinds: ["test", "live"],
+                id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "Customer reminders",
+                status: "archived",
+                version: 2,
+            },
+        id: "projects.archive",
+        idempotent: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/projects/{projectId}/archive",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "not_found",
+            "state_conflict",
+            "version_conflict",
+        ],
+        request: projectArchiveRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { archived: true },
+        requestHeaders: requiredConditionalRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectSummarySchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
+        scopes: ["projects:administer"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Archive or restore a project",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Permanently deletes an archived project and everything it owns immediately: schedules and encrypted payloads, occurrences and delivery attempts, endpoints and their signing keys, API credentials and their audit events, OAuth grants and tokens, test sinks, and control-plane projections. The operation is refused while the project is active and names archiving as the required first move. Its response reports the schedules, endpoints, keys and runs destroyed. Only organization administrators may perform it, and there is no restore operation.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                deleted: true,
+                destroyed: { endpoints: 2, keys: 4, runs: 37, schedules: 5 },
+            },
+        id: "projects.delete",
+        idempotent: false,
+        mcp: { destructive: true, kind: "tool", openWorld: false },
+        method: "DELETE",
+        mutates: true,
+        path: "/v1/projects/{projectId}",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["not_found", "state_conflict", "version_conflict"],
+        requestHeaders: requiredConditionalRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectDeletedSchema,
+        scopes: ["projects:administer"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Delete an archived project",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the applications this member has connected to their own account, newest first, across every project in their organization — because a person connects an application, not a project. Revoked connections stay in the listing with the instant and the reason they ended: a connection nobody can see is one nobody can audit. This is a signed-in member's view of their own delegations. An application holding a grant cannot read it, which is why the operation accepts no API credential and no access token, and why it is on no agent's tool list.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        client: { id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8", name: "Flow XO" },
+                        createdAt: "2026-08-14T11:00:00.000Z",
+                        environmentKind: "test",
+                        id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        lastUsedAt: "2026-08-15T09:12:00.000Z",
+                        project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        scopes: ["schedules:read", "schedules:write"],
+                        status: "active",
+                    },
+                ],
+            },
         id: "grants.list",
         idempotent: true,
         // **Withheld, and the reason is what the surface is for.** An application
@@ -974,28 +1927,36 @@ export const OPERATIONS = [
         // sometimes empty. Its size is how many applications one person has
         // connected, which is not a number a cursor helps with.
         problems: [],
-        response: oauthGrantListSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : oauthGrantListSchema,
         scopes: ["grants:read"],
         sessionAuthority: "member",
-        summary: "List the member's connected applications",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List the member's connected applications",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Disconnects one application, ending every token that grant ever issued — the access tokens and the refresh token together. The grant stays readable afterwards with the instant and the reason it ended. Only the member who granted it can disconnect it, and a grant belonging to somebody else answers exactly as one that does not exist.",
-        example: {
-            grant: {
-                client: { id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8", name: "Flow XO" },
-                createdAt: "2026-08-14T11:00:00.000Z",
-                environmentKind: "test",
-                id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                revocationReason: "member-revoked",
-                revokedAt: "2026-08-15T10:00:00.000Z",
-                scopes: ["schedules:read", "schedules:write"],
-                status: "revoked",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Disconnects one application, ending every token that grant ever issued — the access tokens and the refresh token together. The grant stays readable afterwards with the instant and the reason it ended. Only the member who granted it can disconnect it, and a grant belonging to somebody else answers exactly as one that does not exist.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                grant: {
+                    client: { id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8", name: "Flow XO" },
+                    createdAt: "2026-08-14T11:00:00.000Z",
+                    environmentKind: "test",
+                    id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    revocationReason: "member-revoked",
+                    revokedAt: "2026-08-15T10:00:00.000Z",
+                    scopes: ["schedules:read", "schedules:write"],
+                    status: "revoked",
+                },
             },
-        },
         id: "grants.revoke",
         // Repeating it is safe: the grant is already revoked, and the second call
         // reports the first one's instant rather than moving it. That is
@@ -1010,37 +1971,45 @@ export const OPERATIONS = [
         path: "/v1/grants/{grantId}",
         principals: ["session"],
         problems: ["not_found"],
-        response: oauthGrantRevokedSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : oauthGrantRevokedSchema,
         scopes: ["grants:write"],
         sessionAuthority: "member",
-        summary: "Disconnect an application",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Disconnect an application",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Replaces a credential with a new one and gives the original a deadline, so consumers can pick up the new secret before the old stops working. The replacement is a new credential with its own identifier and the same authority and scopes; the original keeps working until it expires, then refuses with `credential_expired` rather than `credential_revoked`. `overlapSeconds` may only shorten the window — the default is also the maximum — and zero retires the original immediately. The new secret is in this response and in no other.",
-        example: {
-            credential: {
-                createdAt: "2026-07-28T15:00:00.000Z",
-                displayPrefix: "pt_test_e5f6g7h8",
-                environmentKind: "test",
-                id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9",
-                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                scopes: ["schedules:write"],
-                secret: "pt_test_e5f6g7h8<the-32-character-secret-half-here>",
-                shownOnce: true,
-            },
-            retired: {
-                createdAt: "2026-07-28T15:00:00.000Z",
-                displayPrefix: "pt_test_a1b2c3d4",
-                environmentKind: "test",
-                expiresAt: "2026-07-29T15:00:00.000Z",
-                id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                scopes: ["schedules:write"],
-                supersededBy: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces a credential with a new one and gives the original a deadline, so consumers can pick up the new secret before the old stops working. The replacement is a new credential with its own identifier and the same authority and scopes; the original keeps working until it expires, then refuses with `credential_expired` rather than `credential_revoked`. `overlapSeconds` may only shorten the window — the default is also the maximum — and zero retires the original immediately. The new secret is in this response and in no other.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                credential: {
+                    createdAt: "2026-07-28T15:00:00.000Z",
+                    displayPrefix: "pt_test_e5f6g7h8",
+                    environmentKind: "test",
+                    id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9",
+                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    scopes: ["schedules:write"],
+                    secret: "pt_test_e5f6g7h8<the-32-character-secret-half-here>",
+                    shownOnce: true,
+                },
+                retired: {
+                    createdAt: "2026-07-28T15:00:00.000Z",
+                    displayPrefix: "pt_test_a1b2c3d4",
+                    environmentKind: "test",
+                    expiresAt: "2026-07-29T15:00:00.000Z",
+                    id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    scopes: ["schedules:write"],
+                    supersededBy: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9",
+                },
             },
-        },
         id: "credentials.rotate",
         // Destructive: the original credential is given a deadline it did not have,
         // and whatever is still using it stops working when that deadline passes.
@@ -1061,305 +2030,1284 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found", "scope_missing"],
         request: credentialRotationRequestSchema,
-        requestExample: { overlapSeconds: 3600 },
-        response: credentialRotatedSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { overlapSeconds: 3600 },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : credentialRotatedSchema,
+        scopes: ["credentials:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Rotate an API credential",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Revokes a credential immediately, with no overlap. The credential stops verifying on the next request and refuses with `credential_revoked`. The row survives its revocation so the credential's history remains answerable, and revoking a credential that is already revoked reports the original revocation rather than moving it. A credential belonging to another project is indistinguishable from one that does not exist.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                credential: {
+                    createdAt: "2026-07-28T15:00:00.000Z",
+                    displayPrefix: "pt_test_a1b2c3d4",
+                    environmentKind: "test",
+                    id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    revokedAt: "2026-07-28T16:00:00.000Z",
+                    scopes: ["schedules:write"],
+                },
+            },
+        id: "credentials.revoke",
+        mcp: { destructive: true, kind: "tool", openWorld: false },
+        // Repeating this leaves the same credential revoked at the same instant, so
+        // it is idempotent in the sense the field means — no key required, because
+        // there is no second effect to suppress.
+        idempotent: true,
+        method: "DELETE",
+        mutates: true,
+        path: "/v1/credentials/{credentialId}",
+        conditionalScopes: ["credentials:administer"],
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request", "not_found", "scope_missing"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : credentialRevokedSchema,
         scopes: ["credentials:write"],
         sessionAuthority: "headers",
-        summary: "Rotate an API credential",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Revoke an API credential",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: true,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a schedule and returns it together with its first planned occurrence. Give exactly one of `at`, `delaySeconds`, `everySeconds` and `cron`. An optional `partitionKey` selects a fairness lane inside this project and environment; it is fixed after create. Add a verified `endpoint` to deliver each occurrence there; optional JSON `data` is encrypted before PostgreSQL persistence, placed in the signed callback, and returned as given by a schedule read. `at` and `delaySeconds` fire once; a delay is converted to an absolute instant when the request is accepted, so a schedule created either way reads back the same afterwards. `everySeconds` is a fixed duration and its first occurrence falls one interval after acceptance — it stays the same length across a daylight-saving change, and takes no timezone for that reason. `cron` is a wall clock: it is read against the IANA `timeZone` sent with it, `UTC` when none is, and the first occurrence is the first instant the expression names after acceptance. Where the clocks go forward and the wall time named does not exist that day, the occurrence falls at the first instant after the gap; where they go back and it happens twice, it falls once, at the earlier of the two. A recurring schedule is materialized one occurrence at a time: the next one is planned once the current one is due, so a read always shows one occurrence still to come. `lateness.policy` decides what happens when an occurrence reaches its first attempt after its planned instant: `skipAhead` never carries a recurring arrival across its next scheduled instant (and a shorter custom window may retire it earlier), while `catchUp` admits one arrival within `maxStalenessSeconds` even after later recurrence instants passed. A one-shot has no next recurrence, so either explicit policy uses its window and the default is `catchUp` with 24 hours; recurring schedules default to `skipAhead`, and a `catchUp` without an override has a one-interval window. A retry already in progress is exempt because it arrived and failed; its retry and give-up policy still decide the outcome. The organization, project and environment come from the verified principal; a body cannot name them, and the endpoint must belong to the same tuple, so a credential issued for one project can only ever create schedules in that project. Send an `Idempotency-Key` to make a retry safe: the identical request returns the schedule that key already created, marked `Idempotency-Replayed: true`, and creates nothing further; the same key with a different request is refused `idempotency_key_reused`. A replay reports the schedule **as it stands now**, not a frozen copy of the first response — if it was paused in between, the replay says so.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    state: "planned",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    partitionKey: "campaign.spring",
+                    recurrence: { kind: "at" },
+                    status: "active",
+                    updatedAt: "2026-07-28T14:59:00.000Z",
+                    version: 1,
+                },
+            },
+        id: "schedules.create",
+        // Additive: it brings a schedule into existence and takes nothing away.
+        // A callback schedule causes a future request to the verified external
+        // endpoint. It does not destructively modify that system, but it does act
+        // beyond Greatwait, so MCP clients must receive the open-world hint.
+        mcp: { destructive: false, kind: "tool", openWorld: true },
+        // False even though this operation reads `Idempotency-Key`, because the
+        // header is optional and this flag is what a client reads before deciding
+        // whether a blind retry is safe. It is not: a retry without the key creates
+        // a second schedule. What says the protection is available is
+        // `requestHeaders`, which publishes the key rather than promising it was
+        // used.
+        idempotent: false,
+        method: "POST",
+        mutates: true,
+        path: "/v1/schedules",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "idempotency_key_reused",
+            "invalid_request",
+            "not_found",
+            // The organization ceiling, the same code and the same shape
+            // `projects.create` and `endpoints.create` use. A plan may bound the
+            // distinct partition keys an organization has live and how large a
+            // `data` body it may carry; both refuse here rather than truncating,
+            // because a schedule created without the body the caller sent is not
+            // the schedule they asked for. How many schedules an organization holds
+            // is not bounded (FXO-2556).
+            "plan_limit_reached",
+            "service_unavailable",
+            // A schedule against a disabled endpoint. Refused rather than accepted
+            // and never fired, and refused by its state rather than as `not_found`,
+            // because the endpoint exists and one call turns it back on.
+            "state_conflict",
+        ],
+        request: scheduleRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                cron: "0 9 * * 1-5",
+                data: { report: "daily" },
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                lateness: { maxStalenessSeconds: 3_600, policy: "catchUp" },
+                partitionKey: "campaign.spring",
+                timeZone: "Europe/London",
+            },
+        requestHeaders: idempotencyRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: replayedResponseHeaderSchema }),
+        scopes: ["schedules:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Create a schedule",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one schedule and its next occurrence from the partition that owns it. A schedule belonging to another organization, project or environment answers not_found rather than a refusal that would confirm it exists. The response carries the schedule's version as a strong ETag; send it back in `If-Match` to make a later write conditional on nothing having changed in between. The response carries the schedule's `data` when it has one, exactly as it was given; the listing leaves it off.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    state: "planned",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    data: { report: "daily" },
+                    endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    partitionKey: "campaign.spring",
+                    recurrence: { kind: "at" },
+                    status: "active",
+                    updatedAt: "2026-07-28T14:59:00.000Z",
+                    version: 1,
+                },
+            },
+        id: "schedules.read",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/schedules/{scheduleId}",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request", "not_found"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
+        scopes: ["schedules:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a schedule",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the caller's own schedules, oldest first, one page at a time. Archived schedules are left out: archiving is how a schedule leaves the working set, and a listing that still carried them would make the operation pointless. Give `endpoint` to keep the page to the schedules that deliver to that endpoint — the way back from a destination to everything pointed at it, which is what somebody who disabled or is about to move an endpoint needs to see. Items are schedules rather than schedules-with-occurrences, because a cross-partition listing is served from a projection that holds a summary; read a schedule to get its authoritative next occurrence. Every page states whether it is authoritative or projected.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        createdAt: "2026-07-28T14:59:00.000Z",
+                        endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        generation: 1,
+                        id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        latencyClass: "realtime",
+                        lateness: { policy: "catchUp" },
+                        recurrence: { kind: "at" },
+                        status: "active",
+                        updatedAt: "2026-07-28T14:59:00.000Z",
+                        version: 1,
+                    },
+                ],
+                // `projected` since W2-06 served this listing from the control-plane
+                // directory. `asOf` is the instant the projection was last known to hold
+                // everything every partition had handed over, and `lagSeconds` is how long
+                // ago that was — so a page states how far behind it may be rather than
+                // implying it is current.
+                freshness: {
+                    asOf: "2026-07-28T15:00:00.000Z",
+                    kind: "projected",
+                    lagSeconds: 0,
+                },
+                nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoic2NoXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
+            },
+        id: "schedules.list",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/schedules",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request"],
+        query: scheduleListRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : schedulePageSchema,
+        scopes: ["schedules:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List schedules",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Counts the occurrences this project and environment expect to fire, in epoch-aligned time buckets, with a latency-class split on every bucket and an optional customer partition-key breakdown. A recurring series contributes every instant it fires inside the window rather than only its next one, and `nextFireCount` reports how many of a bucket's occurrences are a schedule's next firing. The answer states freshness and explicit coverage. Clients sending X-Greatwait-Accept-Partial-Forecast: true receive bounded lower-bound counts when a book reaches a row, cell or recurrence-work bound, with coverage.complete false and the exact bounds reached. Without this capability header the previous refusal behavior remains safe for clients that only read totals. Unavailable or stale sources still refuse. Coverage identifies the selected recurring schedule range but never includes destinations, payload or endpoint detail.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                buckets: [
+                    {
+                        byLatencyClass: { bulk: 12, realtime: 3 },
+                        byPartitionKey: { "campaign.spring": 9, "campaign.winter": 4 },
+                        count: 15,
+                        nextFireCount: 4,
+                        otherPartitionKeyCount: 2,
+                        start: "2026-07-28T15:00:00.000Z",
+                    },
+                ],
+                freshness: {
+                    asOf: "2026-07-28T14:58:30.000Z",
+                    kind: "projected",
+                    lagSeconds: 90,
+                },
+                window: {
+                    bucketSeconds: 1800,
+                    from: "2026-07-28T15:00:00.000Z",
+                    to: "2026-07-29T15:00:00.000Z",
+                },
+            },
+        requestHeaders: forecastRequestHeadersSchema,
+        id: "forecast.read",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/forecast",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request"],
+        query: forecastRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : forecastSchema,
+        scopes: ["forecast:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Forecast upcoming occurrences",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads the verified principal's organization-wide prepaid execution position from the authoritative PostgreSQL ledger. Desired and effective revisions remain distinct, and pending stays true until the control plane records PostgreSQL confirmation. Amounts are exact integer microdollars encoded as decimal strings; currency is USD and scale is six. Reserved credit has already been committed to a logical attempt but is not yet a settled debit. A missing hard cap means the customer elected no execution spending cap, never zero room. Shadow mode records what enforcement would have done without charging or blocking, and the activation boundary prevents retroactive charges.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : BILLING_SUMMARY_EXAMPLE,
+        id: "billing.summary",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/summary",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["billing_not_ready", "service_unavailable"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingSummarySchema,
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read exact execution-credit state",
+        surfaces: ["api", "mock"],
+    },
+    BILLING_NOTICE_LIST_OPERATION,
+    BILLING_NOTIFICATION_SETTINGS_OPERATION,
+    BILLING_NOTIFICATION_SETTINGS_UPDATE_OPERATION,
+    withBillingFundingContract({
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads the verified principal's authoritative execution-funding position, including available and reserved credit, amount owed, recurring project fees, the current UTC month's automatic-charge ceiling and its settled, pending and remaining gross authority, and bounded payment history. Manual purchases and project subscriptions are separately authorized and never consume the automatic ceiling. Pending gross charges include applicable tax; refunds never restore monthly automatic purchasing authority. Receipt and payment links are limited to supported provider-hosted HTTPS URLs.",
+        id: "billing.funding",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/funding",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["service_unavailable"],
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read execution funding and payments",
+        surfaces: ["api", "mock"],
+    }),
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Previews an execution-credit purchase of at least USD 10 without creating a provider payment or granting credit. The quote binds its exact credit and current funding revision; tax and gross remain null with calculated-at-checkout status until an idempotent confirmed purchase creates authenticated hosted Checkout. This manual purchase has separate authority and never consumes the automatic execution top-up ceiling.",
+        environments: ["live"],
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : BILLING_FUNDING_QUOTE_EXAMPLE,
+        id: "billing.fundingquote",
+        idempotent: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: false,
+        path: "/v1/billing/funding/quote",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "revision_conflict",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingFundingQuoteRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                credit: { currency: "USD", microdollars: "10000000", scale: 6 },
+            },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingFundingQuoteSchema,
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Preview manual execution funding",
+        surfaces: ["api", "mock"],
+    },
+    withBillingFundingContract({
+        creates: true,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Confirms one exact manual execution-credit quote and creates or replays its durable payment operation. Billing-owner authority and explicit agent approval apply; the Idempotency-Key preserves one payment identity across retries. Manual funding stays outside the automatic-charge ceiling. A browser redirect never grants credit: only authenticated provider reconciliation can move the operation to paid and grant its exact execution credit once, while the operation reports provider-confirmed tax and gross when known.",
+        environments: ["live"],
+        id: "billing.purchase",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/funding/purchase",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "idempotency_key_reused",
+            "invalid_request",
+            "not_found",
+            "revision_conflict",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingPurchaseRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                confirmed: true,
+                expectedRevision: 3,
+                quote: "funding-quote-example",
+            },
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Confirm manual execution funding",
+        surfaces: ["api", "mock"],
+    }),
+    withBillingFundingContract({
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Confirms one execution-credit payment or saved-payment-method setup now, typically when the customer returns from hosted Checkout, instead of waiting for the provider's notification or the scheduled repair. It reads that one operation from the payment provider under the caller organization's authenticated account and applies what the provider reports: a paid Checkout grants its exact credit once, an open or unpaid one stays pending, and an operation already settled is answered without reading the provider. Nothing in the request can claim a payment succeeded — it names only which operation to read. Repeating the call is safe and converges on the same state. Returns the same execution-funding position as billing.funding.",
+        environments: ["live"],
+        id: "billing.fundingconfirm",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/funding/{paymentOperation}/confirm",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "not_found",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Confirm one payment with the provider now",
+        surfaces: ["api", "mock"],
+    }),
+    withBillingFundingContract({
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces the billing owner's exact calendar-month ceiling for automatic execution-credit charges, or turns automatic payment authority off with null. The expected revision prevents stale authority changes, and the Idempotency-Key makes retries converge. This command requires explicit agent approval because it changes payment authority. Tax and pending gross commitments consume the ceiling; manual purchases and project subscriptions do not. Refunds do not restore authority already used in that UTC month. USD 50 is the suggested editable default, not a platform maximum.",
+        environments: ["live"],
+        id: "billing.ceiling",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "PATCH",
+        mutates: true,
+        path: "/v1/billing/funding/ceiling",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "idempotency_key_reused",
+            "invalid_request",
+            "revision_conflict",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingCeilingUpdateRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                automaticExecutionTopUpCeiling: {
+                    currency: "USD",
+                    microdollars: "50000000",
+                    scale: 6,
+                },
+                expectedRevision: 3,
+            },
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Set the automatic payment ceiling",
+        surfaces: ["api", "mock"],
+    }),
+    BILLING_AUTO_TOP_UP_PREVIEW_OPERATION,
+    BILLING_AUTO_TOP_UP_APPLY_OPERATION,
+    {
+        creates: true,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reserves unused purchased execution credit against one original payment, with the billing owner's explicit confirmation. Purchased credit is not refundable except where a charge is refunded because the service did not work as described, so this records no promise of a refund: it never calls Stripe, cashes out credit or grants an MCP cash-out path. A Stripe refund of that payment settles the reservation when it carries the same credit and supersedes it otherwise; the Idempotency-Key preserves one reservation across retries. Trial credit has no cash value, and a refund does not restore automatic purchasing authority used in the month.",
+        environments: ["live"],
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                amount: { currency: "USD", microdollars: "5000000", scale: 6 },
+                id: "refund-request-example",
+                paymentOperation: "funding-operation-example",
+                requestedAt: "2026-09-10T12:10:00.000Z",
+                state: "operator-review-pending",
+            },
+        id: "billing.refundrequest",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/funding/refunds",
+        // **No browser session** (W9-09). The dashboard's refund request and
+        // refund review forms were an operator's procedure rendered on a customer's
+        // home screen, and they are gone; refunds are a conversation with support.
+        // The operation is unchanged for an API credential and OAuth — the CLI's
+        // `billing refund-request` — and a session write nothing calls is an
+        // authorization path nobody exercises, which `workspace-mutations.test.ts`
+        // exists to refuse.
+        principals: ["api-credential", "oauth"],
+        problems: [
+            "idempotency_key_reused",
+            "invalid_request",
+            "not_found",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingRefundRequestCreateSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                amount: { currency: "USD", microdollars: "5000000", scale: 6 },
+                confirmed: true,
+                paymentOperation: "funding-operation-example",
+                reason: "Duplicate manual purchase",
+            },
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingRefundRequestViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+        scopes: ["billing:write"],
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Reserve credit against a payment for refund",
+        surfaces: ["api", "mock"],
+    },
+    withBillingFundingContract({
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Completes or declines a pending refund reservation. Completion verifies an existing Stripe refund by authenticated provider read before applying the exact credit, tax and gross adjustment, and converges on the recorded adjustment when that refund already settled the reservation; it never creates a provider refund. Decline releases the reserved credit without contacting the provider, and a reservation a Stripe refund superseded is refused as a state conflict. The Idempotency-Key makes either outcome converge across retries.",
+        environments: ["live"],
+        id: "billing.refundresolution",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "PATCH",
+        mutates: true,
+        path: "/v1/billing/funding/refunds/{refundRequest}",
+        // **No browser session** (W9-09). The dashboard's refund request and
+        // refund review forms were an operator's procedure rendered on a customer's
+        // home screen, and they are gone; refunds are a conversation with support.
+        // The operation is unchanged for an API credential and OAuth — the CLI's
+        // `billing refund-request` — and a session write nothing calls is an
+        // authorization path nobody exercises, which `workspace-mutations.test.ts`
+        // exists to refuse.
+        principals: ["api-credential", "oauth"],
+        problems: [
+            "idempotency_key_reused",
+            "invalid_request",
+            "not_found",
+            "service_unavailable",
+            "state_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingRefundResolutionRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                confirmed: true,
+                decision: "declined",
+            },
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+        scopes: ["billing:write"],
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Complete or decline a refund reservation",
+        surfaces: ["api", "mock"],
+    }),
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads named included and subscribed project access, paid-through and grace deadlines, separate monthly fees, pending provider actions and desired/effective revisions.",
+        id: "billing.projects",
+        method: "GET",
+        path: "/v1/billing/projects",
+        idempotent: true,
+        mutates: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        principals: ["api-credential", "oauth", "session"],
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        surfaces: ["api", "mock"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectBillingStateSchema,
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : PROJECT_BILLING_EXAMPLE,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read named project billing access",
+        problems: [
+            "service_unavailable",
+            "state_conflict",
+            "not_found",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Previews one named project addition, paid-through cancellation or included-slot transfer without authorizing a charge. Quotes expire after five minutes and bind the current commercial revision. Amounts describe project fees; Stripe Checkout shows any applicable tax before confirmation.",
+        id: "billing.quote",
+        method: "POST",
+        path: "/v1/billing/projects/quote",
+        idempotent: false,
+        mutates: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        principals: ["api-credential", "oauth", "session"],
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        surfaces: ["api", "mock"],
+        environments: ["live"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectBillingQuoteSchema,
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : PROJECT_BILLING_QUOTE_EXAMPLE,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Preview a named project billing change",
+        problems: [
+            "service_unavailable",
+            "state_conflict",
+            "not_found",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+        request: projectBillingQuoteRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                action: "add",
+                project: "proj_00000000000000000000000000",
+            },
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Confirms the exact named-project quote and recurring commitment. Additional access activates only after authenticated successful provider payment; cancellation preserves paid-through access without a refund or renewal grace. Included transfer never subscribes the formerly included project. Retries retain the same operation and payment identity.",
+        id: "billing.change",
+        method: "POST",
+        path: "/v1/billing/projects/change",
+        idempotent: true,
+        mutates: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        principals: ["api-credential", "oauth", "session"],
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        surfaces: ["api", "mock"],
+        environments: ["live"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectBillingStateSchema,
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : PROJECT_BILLING_EXAMPLE,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Confirm a quoted project billing change",
+        problems: [
+            "service_unavailable",
+            "idempotency_key_reused",
+            "state_conflict",
+            "not_found",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+        request: projectBillingChangeRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                quote: "quote-example",
+                expectedRevision: 2,
+                confirmed: true,
+            },
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a short-lived Stripe-hosted payment-method and invoice recovery session for the verified organization. It does not grant execution credit or additional project access.",
+        id: "billing.portal",
+        method: "POST",
+        path: "/v1/billing/portal",
+        idempotent: false,
+        mutates: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        principals: ["api-credential", "oauth", "session"],
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        surfaces: ["api", "mock"],
+        environments: ["live"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPortalSchema,
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { url: "https://billing.stripe.com/p/session/example" },
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Open hosted payment recovery",
+        problems: [
+            "service_unavailable",
+            "state_conflict",
+            "not_found",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads the verified organization's saved payment method: the one method automatic execution top-ups and project subscriptions charge. It is the payment provider's default payment method for the organization, read by authenticated provider call. method says what it is — type card with brand, last four digits and expiry; type link with the email Link reports, when it reports one; or type other with the provider's type name (cashapp, amazon_pay, klarna and the like) — and every variant carries label, the name to show a person. card repeats the card details when the method is a card and is null otherwise; it is kept for clients written before other payment methods were accepted. A method the organization already authorized for automatic top-up or a project subscription is adopted as the saved method, so an existing customer is not told they have none. method and card are null when the organization has none.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                card: { brand: "visa", expMonth: 12, expYear: 2030, last4: "4242" },
+                method: {
+                    brand: "visa",
+                    expMonth: 12,
+                    expYear: 2030,
+                    label: "Visa ending in 4242",
+                    last4: "4242",
+                    type: "card",
+                },
+            },
+        id: "billing.paymentmethod",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/payment-method",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["service_unavailable"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPaymentMethodSchema,
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read the saved payment method",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the verified organization's project subscription charges: the payment provider's invoices for its project subscription, read by authenticated provider call, most recent first and at most 24. Execution-credit purchases are not listed here; billing.funding reports them. Draft and zero-amount invoices are omitted. Each amount is the invoice total including tax, and the receipt link, when present, is the provider-hosted invoice page. An organization that has never been billed has an empty list; reading it creates nothing and changes nothing.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        amount: {
+                            currency: "USD",
+                            microdollars: "5000000",
+                            scale: 6,
+                        },
+                        createdAt: "2026-09-01T12:00:00.000Z",
+                        id: "in_example_project_charge",
+                        receiptUrl: "https://invoice.stripe.com/i/acct_example/example",
+                        state: "paid",
+                    },
+                ],
+            },
+        id: "billing.invoices",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/billing/invoices",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["service_unavailable"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingInvoiceListSchema,
+        scopes: ["usage:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List project subscription charges",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates a short-lived provider-hosted payment-method setup session for the verified organization and returns its address. It offers every payment method the provider account enables that can be charged later without the customer present — cards, Link and others. Saving one there charges nothing; it becomes the saved payment method only once billing.paymentmethodconfirm (when the browser returns) or the provider's notification reads the completed setup by authenticated provider call. An optional return address must share the origin of the configured billing page.",
+        environments: ["live"],
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { url: "https://checkout.stripe.com/c/pay/example-card-setup" },
+        id: "billing.paymentmethodsetup",
+        idempotent: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/payment-method/setup",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "service_unavailable",
+            "state_conflict",
+            "not_found",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingPaymentMethodSetupRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {},
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPortalSchema,
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Start saving a payment method",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Makes the payment method saved in one completed hosted setup the organization's saved payment method, typically when the browser returns from it. The session is read by authenticated provider call and must belong to the verified organization's own customer; a session of another organization is answered not found. It becomes the provider default for invoices, the default of the organization's project subscription, and the automatic top-up payment method — readying a top-up rule that was waiting for one. The response has the shape billing.paymentmethod returns. When the previous method was removed (billing.paymentmethodremove) and the paid period it let run out has not ended, renewal resumes for the projects that removal stopped; a project the customer cancelled themselves stays cancelled. Nothing in the request can claim a setup succeeded, and repeating the call is safe.",
+        environments: ["live"],
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                card: { brand: "visa", expMonth: 12, expYear: 2030, last4: "4242" },
+                method: {
+                    brand: "visa",
+                    expMonth: 12,
+                    expYear: 2030,
+                    label: "Visa ending in 4242",
+                    last4: "4242",
+                    type: "card",
+                },
+            },
+        id: "billing.paymentmethodconfirm",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/payment-method/confirm",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "not_found",
+            "service_unavailable",
+            "state_conflict",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingPaymentMethodConfirmRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { checkoutSession: "cs_example_card_setup" },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPaymentMethodSchema,
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Confirm a saved payment method",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Removes the verified organization's saved payment method, and with it everything that charges it. Removing it stops renewal: every project subscription is set to end at the end of the period already paid for, so paid projects keep running until then and then stop, with nothing refunded and nothing more charged; billing.projects shows each one's cancellationAt. The included free project is unaffected. Automatic top-up turns off immediately and forgets its payment method. A pending or declined project addition is ended, so nothing later starts a checkout or a charge, and no project can be added until a payment method is saved again. The method stops being the provider default and is detached from the organization's customer. The request must carry confirmed: true. Repeating the call is safe: with nothing on file it answers a null method and card and still makes sure nothing is left that could charge one. Saving a payment method through billing.paymentmethodsetup before the period ends keeps those projects: renewal resumes on the new method, except for any project the customer cancelled themselves. After the period ends, a paid project must be added again.",
+        environments: ["live"],
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { card: null, method: null },
+        id: "billing.paymentmethodremove",
+        idempotent: true,
+        mcp: { destructive: true, kind: "tool", openWorld: false },
+        method: "POST",
+        mutates: true,
+        path: "/v1/billing/payment-method/remove",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "invalid_request",
+            "not_found",
+            "service_unavailable",
+            "state_conflict",
+            "revision_conflict",
+            "test_to_live_escalation",
+        ],
+        request: billingPaymentMethodRemoveRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { confirmed: true },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingPaymentMethodSchema,
+        scopes: ["billing:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Remove the saved payment method",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Revokes a credential immediately, with no overlap. The credential stops verifying on the next request and refuses with `credential_revoked`. The row survives its revocation so the credential's history remains answerable, and revoking a credential that is already revoked reports the original revocation rather than moving it. A credential belonging to another project is indistinguishable from one that does not exist.",
-        example: {
-            credential: {
-                createdAt: "2026-07-28T15:00:00.000Z",
-                displayPrefix: "pt_test_a1b2c3d4",
-                environmentKind: "test",
-                id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                revokedAt: "2026-07-28T16:00:00.000Z",
-                scopes: ["schedules:write"],
-            },
-        },
-        id: "credentials.revoke",
-        mcp: { destructive: true, kind: "tool", openWorld: false },
-        // Repeating this leaves the same credential revoked at the same instant, so
-        // it is idempotent in the sense the field means — no key required, because
-        // there is no second effect to suppress.
-        idempotent: true,
-        method: "DELETE",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Advances at most one due, already-authorized desired billing-policy revision for the caller's organization into PostgreSQL, then returns the same exact desired/effective summary as billing.summary. The command never changes the desired document. A transport failure is recorded for bounded retry and remains pending. Repeating the command may advance the next queued revision, so each call requires approval.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : BILLING_SUMMARY_EXAMPLE,
+        environments: ["live"],
+        id: "billing.reconcile",
+        idempotent: false,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "POST",
         mutates: true,
-        path: "/v1/credentials/{credentialId}",
-        conditionalScopes: ["credentials:administer"],
+        path: "/v1/billing/reconcile",
         principals: ["api-credential", "oauth", "session"],
-        problems: ["invalid_request", "not_found", "scope_missing"],
-        response: credentialRevokedSchema,
-        scopes: ["credentials:write"],
+        // `billing.reconcile` answers from the same summary read as
+        // `billing.summary`, so it reaches the same not-provisioned refusal. It is
+        // declared here because an integrator reading the published OpenAPI would
+        // otherwise be told a 503 on this operation can only ever be
+        // `service_unavailable`.
+        problems: [
+            "billing_not_ready",
+            "service_unavailable",
+            "test_to_live_escalation",
+        ],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingSummarySchema,
+        scopes: ["billing:write"],
         sessionAuthority: "headers",
-        summary: "Revoke an API credential",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Advance one pending billing policy",
         surfaces: ["api", "mock"],
     },
     {
-        creates: true,
-        description: "Creates a schedule and returns it together with its first planned occurrence. Give exactly one of `at`, `delaySeconds`, `everySeconds` and `cron`. An optional `partitionKey` selects a fairness lane inside this project and environment; it is fixed after create. Add a verified `endpoint` to deliver each occurrence there; optional JSON `data` is encrypted before PostgreSQL persistence and is placed in the signed callback, never returned by schedule reads. `at` and `delaySeconds` fire once; a delay is converted to an absolute instant when the request is accepted, so a schedule created either way reads back the same afterwards. `everySeconds` is a fixed duration and its first occurrence falls one interval after acceptance — it stays the same length across a daylight-saving change, and takes no timezone for that reason. `cron` is a wall clock: it is read against the IANA `timeZone` sent with it, `UTC` when none is, and the first occurrence is the first instant the expression names after acceptance. Where the clocks go forward and the wall time named does not exist that day, the occurrence falls at the first instant after the gap; where they go back and it happens twice, it falls once, at the earlier of the two. A recurring schedule is materialized one occurrence at a time: the next one is planned once the current one is due, so a read always shows one occurrence still to come. The organization, project and environment come from the verified principal; a body cannot name them, and the endpoint must belong to the same tuple, so a credential issued for one project can only ever create schedules in that project. Send an `Idempotency-Key` to make a retry safe: the identical request returns the schedule that key already created, marked `Idempotency-Replayed: true`, and creates nothing further; the same key with a different request is refused `idempotency_key_reused`. A replay reports the schedule **as it stands now**, not a frozen copy of the first response — if it was paused in between, the replay says so.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                state: "planned",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                partitionKey: "campaign.spring",
-                recurrence: { kind: "at" },
-                status: "active",
-                updatedAt: "2026-07-28T14:59:00.000Z",
-                version: 1,
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces the caller organization's advisory execution budget and optional hard execution-spend cap for the current UTC month. Values are exact whole cents encoded as integer microdollars. The expected budget-policy revision prevents a stale editor overwriting a newer choice, and Idempotency-Key makes retrying one intent safe. Null turns that setting off. This command records desired state durably; billing.reconcile advances it to PostgreSQL, and reads remain pending until PostgreSQL confirms it. It never changes automatic top-up authority, purchases credit, or counts subscription payments as execution usage.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                budgetPolicy: {
+                    desired: {
+                        advisoryBudget: {
+                            currency: "USD",
+                            microdollars: "25000000",
+                            scale: 6,
+                        },
+                        hardCap: {
+                            currency: "USD",
+                            microdollars: "50000000",
+                            scale: 6,
+                        },
+                    },
+                    desiredRevision: 2,
+                    effectiveRevision: 1,
+                    pending: true,
+                },
+                freshness: { kind: "authoritative" },
             },
-        },
-        id: "schedules.create",
-        // Additive: it brings a schedule into existence and takes nothing away.
-        // A callback schedule causes a future request to the verified external
-        // endpoint. It does not destructively modify that system, but it does act
-        // beyond Greatwait, so MCP clients must receive the open-world hint.
-        mcp: { destructive: false, kind: "tool", openWorld: true },
-        // False even though this operation reads `Idempotency-Key`, because the
-        // header is optional and this flag is what a client reads before deciding
-        // whether a blind retry is safe. It is not: a retry without the key creates
-        // a second schedule. What says the protection is available is
-        // `requestHeaders`, which publishes the key rather than promising it was
-        // used.
-        idempotent: false,
-        method: "POST",
+        environments: ["live"],
+        id: "billing.budgets",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "PATCH",
         mutates: true,
-        path: "/v1/schedules",
+        path: "/v1/billing/budgets",
         principals: ["api-credential", "oauth", "session"],
         problems: [
-            // **Reachable in every deployment, and undeclared until W9-03.** The
-            // route refuses here when the endpoint's status is not one this
-            // deployment will send to — under the default `not-required` ownership
-            // policy that still covers a `disabled` destination, and under
-            // `required` it covers a `pending` one as well. An operation that can
-            // refuse for a code it never mentions is a document that lies, and a
-            // published quickstart could not tell a reader what to do about a
-            // refusal the contract said was impossible.
-            "endpoint_unverified",
             "idempotency_key_reused",
             "invalid_request",
-            "not_found",
-            // The organization ceiling, the same code and the same shape
-            // `projects.create` and `endpoints.create` use. A plan may bound the
-            // live schedules an organization holds, the distinct partition keys it
-            // has live, and how large a `data` body it may carry; all three refuse
-            // here rather than truncating, because a schedule created without the
-            // body the caller sent is not the schedule they asked for.
-            "plan_limit_reached",
+            "revision_conflict",
             "service_unavailable",
+            "test_to_live_escalation",
         ],
-        request: scheduleRequestSchema,
-        requestExample: {
-            cron: "0 9 * * 1-5",
-            data: { report: "daily" },
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            partitionKey: "campaign.spring",
-            timeZone: "Europe/London",
-        },
-        requestHeaders: idempotencyRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: replayedResponseHeaderSchema,
-        scopes: ["schedules:write"],
+        request: billingBudgetUpdateRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                advisoryBudget: {
+                    currency: "USD",
+                    microdollars: "25000000",
+                    scale: 6,
+                },
+                expectedRevision: 1,
+                hardCap: {
+                    currency: "USD",
+                    microdollars: "50000000",
+                    scale: 6,
+                },
+            },
+        requestHeaders: billingBudgetUpdateRequestHeadersSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingBudgetUpdateResponseSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
+        scopes: ["billing:write"],
         sessionAuthority: "headers",
-        summary: "Create a schedule",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Set execution budgets",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reads one schedule and its next occurrence from the partition that owns it. A schedule belonging to another organization, project or environment answers not_found rather than a refusal that would confirm it exists. The response carries the schedule's version as a strong ETag; send it back in `If-Match` to make a later write conditional on nothing having changed in between.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                state: "planned",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                partitionKey: "campaign.spring",
-                recurrence: { kind: "at" },
-                status: "active",
-                updatedAt: "2026-07-28T14:59:00.000Z",
-                version: 1,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the verified principal's organization ledger in immutable sequence order. Each entry is one exact signed microdollar fact with safe attempt, lot, payment-operation and event references. Raw callback data, card data, internal causal keys and ledger detail have no field in the response. The opaque cursor is bound to the principal's organization, project and environment and cannot widen authority.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        amount: { currency: "USD", microdollars: "-10", scale: 6 },
+                        kind: "attempt_debited",
+                        period: "2026-09-01T00:00:00.000Z",
+                        recordedAt: "2026-09-09T14:00:00.000Z",
+                        reference: {
+                            attempt: "att_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                            event: "billing-attempt-debited-1",
+                        },
+                        sequence: "42",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+                nextCursor: "eyJhIjowLCJpIjoiNDIiLCJrIjoiOTUxMzU0NmYifQ",
             },
-        },
-        id: "schedules.read",
+        id: "billing.ledger",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
         method: "GET",
         mutates: false,
-        path: "/v1/schedules/{scheduleId}",
+        path: "/v1/billing/ledger",
         principals: ["api-credential", "oauth", "session"],
-        problems: ["invalid_request", "not_found"],
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
-        scopes: ["schedules:read"],
+        problems: ["invalid_request"],
+        query: billingLedgerRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : billingLedgerPageSchema,
+        scopes: ["usage:read"],
         sessionAuthority: "headers",
-        summary: "Read a schedule",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List immutable billing entries",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the caller's own schedules, oldest first, one page at a time. Archived schedules are left out: archiving is how a schedule leaves the working set, and a listing that still carried them would make the operation pointless. Items are schedules rather than schedules-with-occurrences, because a cross-partition listing is served from a projection that holds a summary; read a schedule to get its authoritative next occurrence. Every page states whether it is authoritative or projected.",
-        example: {
-            data: [
-                {
-                    createdAt: "2026-07-28T14:59:00.000Z",
-                    endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    generation: 1,
-                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    latencyClass: "realtime",
-                    recurrence: { kind: "at" },
-                    status: "active",
-                    updatedAt: "2026-07-28T14:59:00.000Z",
-                    version: 1,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Read effective customer allowances for the verified organization. Deployment and organization revisions identify the policy used; infrastructure and other organizations' settings are excluded.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                limits: {
+                    inlinePayloadBytes: 65536,
+                    forecastHorizonSeconds: 90000,
+                    usageWindowDays: 366,
                 },
-            ],
-            // `projected` since W2-06 served this listing from the control-plane
-            // directory. `asOf` is the instant the projection was last known to hold
-            // everything every partition had handed over, and `lagSeconds` is how long
-            // ago that was — so a page states how far behind it may be rather than
-            // implying it is current.
-            freshness: {
-                asOf: "2026-07-28T15:00:00.000Z",
-                kind: "projected",
-                lagSeconds: 0,
-            },
-            nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoic2NoXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
-        },
-        id: "schedules.list",
+                provenance: {
+                    inlinePayloadBytes: "default",
+                    forecastHorizonSeconds: "default",
+                    usageWindowDays: "default",
+                },
+                revision: { global: 0, organization: 0 },
+            },
+        id: "limits.read",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
         method: "GET",
         mutates: false,
-        path: "/v1/schedules",
+        path: "/v1/limits",
         principals: ["api-credential", "oauth", "session"],
-        problems: ["invalid_request"],
-        query: pageRequestSchema,
-        response: schedulePageSchema,
+        problems: ["service_unavailable"],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : effectiveCustomerLimitsSchema,
         scopes: ["schedules:read"],
         sessionAuthority: "headers",
-        summary: "List schedules",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read effective customer limits",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Counts the occurrences this project and environment expect to fire, in epoch-aligned time buckets, with a latency-class split on every bucket and an optional customer partition-key breakdown. A recurring series contributes every instant it fires inside the window rather than only its next one, and `nextFireCount` reports how many of a bucket's occurrences are a schedule's next firing. The answer states its own freshness and is refused rather than shortened when a partition cannot complete it. It carries counts only: no schedule identifier, callback destination, payload or endpoint detail has a field in the response.",
-        example: {
-            buckets: [
-                {
-                    byLatencyClass: { bulk: 12, realtime: 3 },
-                    byPartitionKey: { "campaign.spring": 9, "campaign.winter": 4 },
-                    count: 15,
-                    nextFireCount: 4,
-                    otherPartitionKeyCount: 2,
-                    start: "2026-07-28T15:00:00.000Z",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Legacy terminal-occurrence volume by UTC day from the authoritative scheduling model. This is an operational outcome aggregate retained for compatibility; it is not the PAYG invoice meter. Billing is per logical delivery attempt, including retries and redeliveries, and is exposed exactly by billing.summary and billing.ledger. Days with no terminal occurrence are absent rather than zero, and the window states which days the answer covers. `from` and `to` are snapped outward to UTC midnight, so an answer always covers whole days.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                bucketSeconds: 86_400,
+                days: [
+                    {
+                        billableOccurrences: 42,
+                        byTerminalState: { succeeded: 40, terminal_failed: 2 },
+                        start: "2026-07-28T00:00:00.000Z",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+                totalBillableOccurrences: 42,
+                window: {
+                    from: "2026-07-28T00:00:00.000Z",
+                    to: "2026-07-29T00:00:00.000Z",
                 },
-            ],
-            freshness: {
-                asOf: "2026-07-28T14:58:30.000Z",
-                kind: "projected",
-                lagSeconds: 90,
             },
-            window: {
-                bucketSeconds: 1800,
-                from: "2026-07-28T15:00:00.000Z",
-                to: "2026-07-29T15:00:00.000Z",
-            },
-        },
-        id: "forecast.read",
+        id: "usage.read",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
         method: "GET",
         mutates: false,
-        path: "/v1/forecast",
+        path: "/v1/usage",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request"],
-        query: forecastRequestSchema,
-        response: forecastSchema,
-        scopes: ["forecast:read"],
+        query: usageRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : usageSchema,
+        scopes: ["usage:read"],
         sessionAuthority: "headers",
-        summary: "Forecast upcoming occurrences",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read terminal occurrence volume by day",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "What this project was charged for, by UTC day, from the authoritative scheduling model. One terminal occurrence is one billable unit however many attempts it took, so a schedule that failed four times and succeeded on the fifth appears here once; the attempts it cost are on that occurrence's own attempt history. Days with no billable occurrence are absent rather than zero, and the window states which days the answer covers. `from` and `to` are snapped outward to UTC midnight, so an answer always covers whole days.",
-        example: {
-            days: [
-                {
-                    billableOccurrences: 42,
-                    byTerminalState: { succeeded: 40, terminal_failed: 2 },
-                    start: "2026-07-28T00:00:00.000Z",
-                },
-            ],
-            freshness: { kind: "authoritative" },
-            totalBillableOccurrences: 42,
-            window: {
-                from: "2026-07-28T00:00:00.000Z",
-                to: "2026-07-29T00:00:00.000Z",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads the verified principal's project timing cohort over the authoritative rolling 24-hour due-time window. Exact 5,000ms and 15,000ms counters include eligible work that has not fired; customer blocks, platform blocks, skipped work and missing evidence stay visible beside the verdict. Values equal to a target meet it, and a threshold with no matured population is unknown. Delivered-sample p95 and p99 lateness are separate observations, including negative early-delivery defects. These are internal operating objectives, not a contractual SLA or service-credit promise.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                customerBlockedCount: 2,
+                deliveredSampleCount: 98,
+                freshness: { kind: "authoritative" },
+                missingEvidenceCount: 1,
+                p95LatenessMs: 4_200,
+                p99LatenessMs: 12_000,
+                platformBlockedCount: 1,
+                policyVersion: "timing-v1",
+                skippedCount: 3,
+                targets: [
+                    {
+                        breachCount: 5,
+                        customerBlockedCount: 2,
+                        eligibleOutstandingBreachCount: 1,
+                        maturedCount: 100,
+                        targetMs: 5_000,
+                        verdict: "met",
+                        withinTargetCount: 95,
+                    },
+                    {
+                        breachCount: 1,
+                        customerBlockedCount: 2,
+                        eligibleOutstandingBreachCount: 1,
+                        maturedCount: 100,
+                        targetMs: 15_000,
+                        verdict: "met",
+                        withinTargetCount: 99,
+                    },
+                ],
+                windowEnd: "2026-09-09T12:00:00.000Z",
+                windowStart: "2026-09-08T12:00:00.000Z",
             },
-        },
-        id: "usage.read",
+        id: "timing.summary",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
         method: "GET",
         mutates: false,
-        path: "/v1/usage",
+        path: "/v1/timing/summary",
         principals: ["api-credential", "oauth", "session"],
-        problems: ["invalid_request"],
-        query: usageRequestSchema,
-        response: usageSchema,
+        problems: [],
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : deliveryTimingSummarySchema,
         scopes: ["usage:read"],
         sessionAuthority: "headers",
-        summary: "Read billable usage by day",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read rolling delivery timing",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "The same forecast in the window shape the legacy scheduler's autoscaler already parses, published under a dated version so a consumer can pin it. It exists for one migration and is expected to be withdrawn once that migration completes; `forecast.read` is the shape this product publishes. `byTenant` is the customer partition-key breakdown under its legacy name, and `count` is always the bucket total rather than the named subtotal.",
-        example: {
-            bucketSeconds: 600,
-            buckets: [
-                {
-                    byTenant: { "campaign.spring": 9, "campaign.winter": 4 },
-                    count: 15,
-                    nextFireCount: 4,
-                    otherCount: 2,
-                    start: "2026-07-28T15:00:00.000Z",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "The same forecast in the window shape the legacy scheduler's autoscaler already parses, published under a dated version so a consumer can pin it. It exists for one migration and is expected to be withdrawn once that migration completes; `forecast.read` is the shape this product publishes. `byTenant` is the customer partition-key breakdown under its legacy name, and `count` is always the bucket total rather than the named subtotal.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                bucketSeconds: 600,
+                buckets: [
+                    {
+                        byTenant: { "campaign.spring": 9, "campaign.winter": 4 },
+                        count: 15,
+                        nextFireCount: 4,
+                        otherCount: 2,
+                        start: "2026-07-28T15:00:00.000Z",
+                    },
+                ],
+                freshness: {
+                    asOf: "2026-07-28T14:58:30.000Z",
+                    kind: "projected",
+                    lagSeconds: 90,
                 },
-            ],
-            freshness: {
-                asOf: "2026-07-28T14:58:30.000Z",
-                kind: "projected",
-                lagSeconds: 90,
+                version: FORECAST_WINDOW_VERSION,
             },
-            version: FORECAST_WINDOW_VERSION,
-        },
         id: "forecast.windows",
         idempotent: true,
         // Withheld from MCP rather than published as a tool. It is a compatibility
@@ -1369,7 +3317,7 @@ export const OPERATIONS = [
         // scheduled for removal, which is the opposite of what a tool list is for.
         mcp: {
             kind: "unavailable",
-            reason: "A transitional shape for the autoscaler migration, scheduled for withdrawal once W6-02 has cut over. forecast.read is the same data in the shape this product publishes, and it is the tool an agent should reach for.",
+            reason: "A transitional shape for the autoscaler migration, withdrawn after its cutover. forecast.read is the same data in the shape this product publishes, and it is the tool an agent should reach for.",
         },
         method: "GET",
         mutates: false,
@@ -1377,30 +3325,38 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request"],
         query: forecastRequestSchema,
-        response: forecastWindowsSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : forecastWindowsSchema,
         scopes: ["forecast:read"],
         sessionAuthority: "headers",
-        summary: "Forecast in the transitional window shape",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Forecast in the transitional window shape",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the retained occurrences of one schedule from its authoritative Scheduler Partition, ordered by durable creation instant and occurrence identifier so tied timestamps never duplicate or omit a row. The cursor is opaque and scoped to the verified principal's organization, project and environment. Each item is metadata only: callback payloads, destinations, response bodies and signing material have no field in the response.",
-        example: {
-            data: [
-                {
-                    attemptCount: 1,
-                    generation: 1,
-                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    plannedFor: "2026-07-28T15:00:00.000Z",
-                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    sequence: 1,
-                    state: "retry_wait",
-                },
-            ],
-            freshness: { kind: "authoritative" },
-            nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoib2NjXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the retained occurrences of one schedule from its authoritative Scheduler Partition, ordered by durable creation instant and occurrence identifier so tied timestamps never duplicate or omit a row — oldest first unless `order=newest`, which walks from the most recent. A run that an edit replaced before it ran is left out; a run skipped because the previous one was still going is listed. The cursor is opaque, scoped to the verified principal's organization, project and environment, and to the order it was issued under. Each item is metadata only: callback payloads, destinations, response bodies and signing material have no field in the response.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        attemptCount: 1,
+                        generation: 1,
+                        id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        plannedFor: "2026-07-28T15:00:00.000Z",
+                        schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        sequence: 1,
+                        state: "retry_wait",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+                nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoib2NjXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
+            },
         id: "occurrences.list",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -1409,29 +3365,83 @@ export const OPERATIONS = [
         path: "/v1/schedules/{scheduleId}/occurrences",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
-        query: pageRequestSchema,
-        response: occurrencePageSchema,
+        query: historyPageRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : occurrencePageSchema,
+        scopes: ["occurrences:read"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List retained occurrences",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists every retained occurrence in the verified principal's project and environment, newest first by planned instant with the occurrence identifier breaking millisecond ties. Optional endpoint, schedule, half-open date-range and outcome filters may be combined; the endpoint is resolved through the schedules that belong to the same authority. The opaque cursor belongs to this operation and the exact normalized filters that issued it, so it cannot be replayed under another view. Every page publishes the authoritative earliest retained instant for the caller's effective plan. Each item is metadata only: callback payloads, destinations, response bodies and signing material have no field in the response.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        attemptCount: 1,
+                        generation: 1,
+                        id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        plannedFor: "2026-07-28T15:00:00.000Z",
+                        schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        sequence: 1,
+                        settledAt: "2026-07-28T15:00:01.000Z",
+                        state: "succeeded",
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+                retention: { from: "2026-07-21T15:00:00.000Z" },
+            },
+        id: "executions.list",
+        idempotent: true,
+        mcp: { destructive: false, kind: "tool", openWorld: false },
+        method: "GET",
+        mutates: false,
+        path: "/v1/occurrences",
+        principals: ["api-credential", "oauth", "session"],
+        problems: ["invalid_request"],
+        query: projectOccurrenceListRequestSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectOccurrencePageSchema,
         scopes: ["occurrences:read"],
         sessionAuthority: "headers",
-        summary: "List retained occurrences",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List project executions",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reads one retained occurrence from the Scheduler Partition that owns its schedule. The response explicitly states that it is authoritative; a stale D1 directory or schedule projection is used only to find the partition and never as occurrence truth. An identifier outside the verified principal's organization, project or environment is indistinguishable from an absent occurrence.",
-        example: {
-            freshness: { kind: "authoritative" },
-            occurrence: {
-                attemptCount: 2,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                settledAt: "2026-07-28T15:02:00.000Z",
-                state: "terminal_failed",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one retained occurrence from the PostgreSQL authority that owns its schedule. Trusted first-outbound timing is optional for records that predate substantiation; when present, firstAttemptLatenessMs is signed and a negative value exposes an early-delivery defect rather than being clamped to zero. Timing eligibility states whether a customer restriction excluded the occurrence from the internal target cohort. An identifier outside the verified principal's organization, project or environment is indistinguishable from an absent occurrence.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                freshness: { kind: "authoritative" },
+                occurrence: {
+                    attemptCount: 2,
+                    firstAttemptLatenessMs: 0,
+                    firstAttemptStartedAt: "2026-07-28T15:00:00.000Z",
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    settledAt: "2026-07-28T15:02:00.000Z",
+                    state: "terminal_failed",
+                    timingEligibility: "eligible",
+                    timingPolicyVersion: "payg-v1",
+                },
             },
-        },
         id: "occurrences.read",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -1440,35 +3450,49 @@ export const OPERATIONS = [
         path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
-        response: occurrenceViewSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : occurrenceViewSchema,
         scopes: ["occurrences:read"],
         sessionAuthority: "headers",
-        summary: "Read an occurrence",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read an occurrence",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Lists the immutable attempts retained under one occurrence, ordered by start instant and attempt identifier so equal timestamps have a stable position. The owning Scheduler Partition is authoritative and every page says so. Results expose only bounded outcome, response-status, duration, diagnostic, remediation and redelivery-cause metadata; callback payloads, response bodies, destinations, signing material, secrets and transport traces are structurally absent.",
-        example: {
-            data: [
-                {
-                    attemptNumber: 1,
-                    classifiedAt: "2026-07-28T15:00:00.071Z",
-                    delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    diagnostic: "http_retryable",
-                    durationMs: 71,
-                    id: "att_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                    remediation: "review_retry_policy",
-                    responseStatus: 503,
-                    startedAt: "2026-07-28T15:00:00.000Z",
-                    state: "retryable_failure",
-                    trigger: { kind: "automatic" },
-                },
-            ],
-            freshness: { kind: "authoritative" },
-            nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYXR0XzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
-        },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Lists the immutable attempts retained under one occurrence, ordered by start instant and attempt identifier so equal timestamps have a stable position. The PostgreSQL authority answers every page. Optional first-outbound fields carry trusted occurrence timing and its pinned policy; absence means unknown, never zero. Results expose only bounded outcome, response-status, duration, timing, diagnostic, remediation and redelivery-cause metadata; callback payloads, response bodies, destinations, signing material, secrets and transport traces are structurally absent.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: [
+                    {
+                        attemptNumber: 1,
+                        classifiedAt: "2026-07-28T15:00:00.071Z",
+                        dispatchRecoveries: 0,
+                        localReceiptRecoveries: 0,
+                        delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        diagnostic: "http_retryable",
+                        durationMs: 71,
+                        firstAttemptLatenessMs: 0,
+                        firstAttemptStartedAt: "2026-07-28T15:00:00.000Z",
+                        id: "att_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                        remediation: "review_retry_policy",
+                        responseStatus: 503,
+                        startedAt: "2026-07-28T15:00:00.000Z",
+                        state: "retryable_failure",
+                        timingEligibility: "eligible",
+                        timingPolicyVersion: "payg-v1",
+                        trigger: { kind: "automatic" },
+                    },
+                ],
+                freshness: { kind: "authoritative" },
+                nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYXR0XzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0",
+            },
         id: "attempts.list",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -1478,31 +3502,45 @@ export const OPERATIONS = [
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
         query: pageRequestSchema,
-        response: attemptPageSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : attemptPageSchema,
         scopes: ["occurrences:read"],
         sessionAuthority: "headers",
-        summary: "List delivery attempts",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List delivery attempts",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Reads one immutable delivery attempt from its occurrence's authoritative Scheduler Partition. Ambiguous means the receiver may have acted and is never rewritten into certainty without durable result evidence. The bounded response omits callback payloads, response bodies, destinations, signing material, secrets and raw transport failures by construction.",
-        example: {
-            attempt: {
-                attemptNumber: 2,
-                classifiedAt: "2026-07-28T15:02:00.000Z",
-                delivery: "dlv_11h8xyz9k2m4n6p8r0t2v4w6y8",
-                diagnostic: "network_ambiguous",
-                durationMs: 10_000,
-                id: "att_11h8xyz9k2m4n6p8r0t2v4w6y8",
-                occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                remediation: "review_before_redelivery",
-                startedAt: "2026-07-28T15:01:50.000Z",
-                state: "ambiguous",
-                trigger: { kind: "automatic" },
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads one immutable delivery attempt from its occurrence's PostgreSQL authority. Ambiguous means the receiver may have acted and is never rewritten into certainty without durable result evidence. Optional first-outbound fields come only from trusted transport evidence and absence means unknown, never zero. The bounded response omits callback payloads, response bodies, destinations, signing material, secrets and raw transport failures by construction.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                attempt: {
+                    attemptNumber: 2,
+                    classifiedAt: "2026-07-28T15:02:00.000Z",
+                    dispatchRecoveries: 2,
+                    localReceiptRecoveries: 1,
+                    delivery: "dlv_11h8xyz9k2m4n6p8r0t2v4w6y8",
+                    diagnostic: "network_ambiguous",
+                    durationMs: 10_000,
+                    firstAttemptLatenessMs: 0,
+                    firstAttemptStartedAt: "2026-07-28T15:00:00.000Z",
+                    id: "att_11h8xyz9k2m4n6p8r0t2v4w6y8",
+                    occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    remediation: "review_before_redelivery",
+                    startedAt: "2026-07-28T15:01:50.000Z",
+                    state: "ambiguous",
+                    timingEligibility: "eligible",
+                    timingPolicyVersion: "payg-v1",
+                    trigger: { kind: "automatic" },
+                },
+                freshness: { kind: "authoritative" },
             },
-            freshness: { kind: "authoritative" },
-        },
         id: "attempts.read",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -1511,29 +3549,39 @@ export const OPERATIONS = [
         path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}/attempts/{attemptId}",
         principals: ["api-credential", "oauth", "session"],
         problems: ["invalid_request", "not_found"],
-        response: attemptViewSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : attemptViewSchema,
         scopes: ["occurrences:read"],
         sessionAuthority: "headers",
-        summary: "Read a delivery attempt",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read a delivery attempt",
         surfaces: ["api", "mock"],
     },
     {
         creates: true,
-        description: "Creates one new immutable attempt under the same retained terminal occurrence and dispatches it through the ordinary delivery boundary. The required Idempotency-Key makes an identical replay converge on the same attempt and conflicting reuse is refused. The new attempt names the retained attempt that caused the redelivery; no earlier identity or outcome is changed. MCP marks this outbound mutation for explicit approval even though it is non-destructive.",
-        example: {
-            attempt: {
-                attemptNumber: 3,
-                delivery: "dlv_21h8xyz9k2m4n6p8r0t2v4w6y8",
-                id: "att_21h8xyz9k2m4n6p8r0t2v4w6y8",
-                occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                startedAt: "2026-07-28T15:05:00.000Z",
-                trigger: {
-                    kind: "redelivery",
-                    sourceAttemptId: "att_11h8xyz9k2m4n6p8r0t2v4w6y8",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Creates one new immutable attempt under the same retained terminal occurrence and dispatches it through the ordinary delivery boundary. The required Idempotency-Key makes an identical replay converge on the same attempt and conflicting reuse is refused. The new attempt names the retained attempt that caused the redelivery; no earlier identity or outcome is changed. MCP marks this outbound mutation for explicit approval even though it is non-destructive.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                attempt: {
+                    attemptNumber: 3,
+                    dispatchRecoveries: 0,
+                    localReceiptRecoveries: 0,
+                    delivery: "dlv_21h8xyz9k2m4n6p8r0t2v4w6y8",
+                    id: "att_21h8xyz9k2m4n6p8r0t2v4w6y8",
+                    occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    startedAt: "2026-07-28T15:05:00.000Z",
+                    trigger: {
+                        kind: "redelivery",
+                        sourceAttemptId: "att_11h8xyz9k2m4n6p8r0t2v4w6y8",
+                    },
                 },
+                freshness: { kind: "authoritative" },
             },
-            freshness: { kind: "authoritative" },
-        },
         id: "occurrences.redeliver",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: true },
@@ -1549,39 +3597,50 @@ export const OPERATIONS = [
             "state_conflict",
         ],
         requestHeaders: requiredIdempotencyRequestHeaderSchema,
-        response: attemptViewSchema,
-        responseHeaders: idempotencyReplayResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : attemptViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: idempotencyReplayResponseHeaderSchema }),
         scopes: ["occurrences:redeliver"],
         sessionAuthority: "headers",
-        summary: "Redeliver an occurrence",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Redeliver an occurrence",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Replaces a schedule's definition, starting a new generation. Takes the same four ways of saying when as a create, so a one-shot can be replaced by a recurring definition and the other way round. An omitted callback endpoint/data pair preserves the stored callback; sending `data` alone replaces the encrypted data for the current endpoint, and sending `endpoint` selects a verified endpoint in the same authority tuple. The occurrence planned under the old definition is settled `skipped_stale` and can never fire unless it was already in flight, in which case its immutable attempt is allowed to settle honestly; a fresh occurrence is planned under the new definition, and the old definition's series stops advancing. Send `If-Match` with the version you read to make this conditional; without it the replace is unconditional and the last writer wins. A cancelled or completed schedule cannot be replaced. `partitionKey` is fixed when the schedule is created: omit it to preserve the stored value or echo that exact value in a GET → modify → PUT flow. Adding, changing, or clearing it is refused as `invalid_request` with `/partitionKey` identified. `latencyClass` remains derived from the replacement recurrence when the caller omits it.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 2,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y9",
-                plannedFor: "2026-07-28T16:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                state: "planned",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                generation: 2,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                partitionKey: "campaign.spring",
-                recurrence: { kind: "at" },
-                status: "active",
-                updatedAt: "2026-07-28T15:10:00.000Z",
-                version: 2,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Replaces a schedule's definition, starting a new generation. Takes the same four ways of saying when as a create, so a one-shot can be replaced by a recurring definition and the other way round. An omitted callback endpoint/data pair preserves the stored callback; sending `data` alone replaces the encrypted data for the current endpoint, and sending `endpoint` selects a verified endpoint in the same authority tuple. The occurrence planned under the old definition is settled `skipped_stale` and can never fire unless it was already in flight, in which case its immutable attempt is allowed to settle honestly; a fresh occurrence is planned under the new definition, and the old definition's series stops advancing. `lateness` is resolved afresh against the replacement recurrence: omit it for that kind's default, or state `skipAhead`, `catchUp`, and an optional `maxStalenessSeconds` override. The policy applies only before an occurrence's first attempt; a retry already in progress remains on its retry and give-up ladder. Send `If-Match` with the version you read to make this conditional; without it the replace is unconditional and the last writer wins. A cancelled or completed schedule cannot be replaced. `partitionKey` is fixed when the schedule is created: omit it to preserve the stored value or echo that exact value in a GET → modify → PUT flow. Adding, changing, or clearing it is refused as `invalid_request` with `/partitionKey` identified. `latencyClass` remains derived from the replacement recurrence when the caller omits it.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 2,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y9",
+                    plannedFor: "2026-07-28T16:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    state: "planned",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    generation: 2,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    partitionKey: "campaign.spring",
+                    recurrence: { kind: "at" },
+                    status: "active",
+                    updatedAt: "2026-07-28T15:10:00.000Z",
+                    version: 2,
+                },
             },
-        },
         id: "schedules.replace",
         idempotent: true,
         // Destructive: the occurrence planned under the old definition is settled
@@ -1593,10 +3652,6 @@ export const OPERATIONS = [
         path: "/v1/schedules/{scheduleId}",
         principals: ["api-credential", "oauth", "session"],
         problems: [
-            // The same undeclared refusal `schedules.create` carried, for the same
-            // reason: a replacement may attach a different endpoint and resolves it
-            // through the same status rule.
-            "endpoint_unverified",
             "invalid_request",
             "not_found",
             // Only the payload ceiling can produce this here. A replacement adds no
@@ -1611,48 +3666,63 @@ export const OPERATIONS = [
         // The other arm of the same schema, deliberately: the create example shows
         // `at` and this one shows `delaySeconds`, so a reader of the published
         // document meets both ways of naming an instant.
-        requestExample: {
-            data: { report: "weekly" },
-            everySeconds: 86_400,
-            endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
-            partitionKey: "campaign.spring",
-        },
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                data: { report: "weekly" },
+                everySeconds: 86_400,
+                endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                lateness: { maxStalenessSeconds: 7_200, policy: "catchUp" },
+                partitionKey: "campaign.spring",
+            },
         requestHeaders: conditionalRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["schedules:write"],
         sessionAuthority: "headers",
-        summary: "Replace a schedule",
-        surfaces: ["api", "mock"],
-    },
-    {
-        creates: false,
-        description: "Suspends a schedule without discarding it: its occurrence stays planned, its timer is released, and resume re-arms the original planned instant so elapsed work becomes due rather than being silently moved. A schedule with a dispatching or ambiguous callback is refused until that attempt settles, because pausing cannot strand its watchdog or turn a proven success into an unreachable completed state. Pausing an already paused schedule changes nothing and returns the same version, so a retry is free. A cancelled or completed schedule cannot be paused.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                state: "planned",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                recurrence: { kind: "at" },
-                status: "paused",
-                updatedAt: "2026-07-28T15:10:00.000Z",
-                version: 2,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Replace a schedule",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Suspends a schedule without discarding it: its occurrence stays planned, its timer is released, and resume re-arms the original planned instant rather than silently moving it. If that instant has passed, the schedule's lateness policy decides whether the first arrival becomes due or settles `skipped_stale`; a pause defers the decision, it does not promise delivery. A schedule with a dispatching or ambiguous callback is refused until that attempt settles, because pausing cannot strand its watchdog or turn a proven success into an unreachable completed state. Pausing an already paused schedule changes nothing and returns the same version, so a retry is free. A cancelled or completed schedule cannot be paused.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    state: "planned",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    recurrence: { kind: "at" },
+                    status: "paused",
+                    updatedAt: "2026-07-28T15:10:00.000Z",
+                    version: 2,
+                },
             },
-        },
         id: "schedules.pause",
         idempotent: true,
         // Not destructive: the occurrence stays planned and the timer stays armed.
-        // A pause defers work; resuming delivers it.
+        // A pause defers the first-arrival decision; the lateness policy resolves it.
         mcp: { destructive: false, kind: "tool", openWorld: false },
         method: "POST",
         mutates: true,
@@ -1665,37 +3735,48 @@ export const OPERATIONS = [
             "version_conflict",
         ],
         requestHeaders: conditionalRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["schedules:write"],
         sessionAuthority: "headers",
-        summary: "Pause a schedule",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Pause a schedule",
         surfaces: ["api", "mock"],
     },
     {
         creates: false,
-        description: "Returns a paused schedule to active. An occurrence whose instant passed while the schedule was paused becomes due at once rather than being skipped — a pause defers work, it does not discard it. Resuming an already active schedule changes nothing and returns the same version.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                state: "planned",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                recurrence: { kind: "at" },
-                status: "active",
-                updatedAt: "2026-07-28T15:20:00.000Z",
-                version: 3,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Returns a paused schedule to active and re-arms its original planned instant. When that instant passed during the pause, the schedule's lateness policy applies exactly as it does after an outage: `catchUp` makes an occurrence inside its window due, while `skipAhead` or an expired window settles it `skipped_stale`. An occurrence already on its retry ladder is exempt from this first-arrival decision. Resuming an already active schedule changes nothing and returns the same version.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    state: "planned",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    recurrence: { kind: "at" },
+                    status: "active",
+                    updatedAt: "2026-07-28T15:20:00.000Z",
+                    version: 3,
+                },
             },
-        },
         id: "schedules.resume",
         idempotent: true,
         mcp: { destructive: false, kind: "tool", openWorld: false },
@@ -1710,38 +3791,49 @@ export const OPERATIONS = [
             "version_conflict",
         ],
         requestHeaders: conditionalRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["schedules:write"],
         sessionAuthority: "headers",
-        summary: "Resume a schedule",
-        surfaces: ["api", "mock"],
-    },
-    {
-        creates: false,
-        description: "Cancels a schedule and settles its occurrence `cancelled`, releasing the timer. Terminal: a cancelled schedule cannot be resumed or replaced, and cancelling one that is already cancelled changes nothing and returns the same version. A cancel that races its own occurrence becoming due still wins — the occurrence settles cancelled and no work is delivered — which is why this is a refusal-free retry rather than a race a client has to reason about. The schedule stays readable; archive it to take it out of the listing.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                settledAt: "2026-07-28T15:10:00.000Z",
-                state: "cancelled",
-            },
-            schedule: {
-                createdAt: "2026-07-28T14:59:00.000Z",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                recurrence: { kind: "at" },
-                status: "cancelled",
-                updatedAt: "2026-07-28T15:10:00.000Z",
-                version: 2,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Resume a schedule",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Cancels a schedule and settles its occurrence `cancelled`, releasing the timer. Terminal: a cancelled schedule cannot be resumed or replaced, and cancelling one that is already cancelled changes nothing and returns the same version. A cancel that races its own occurrence becoming due still wins — the occurrence settles cancelled and no work is delivered — which is why this is a refusal-free retry rather than a race a client has to reason about. The schedule stays readable; archive it to take it out of the listing.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    settledAt: "2026-07-28T15:10:00.000Z",
+                    state: "cancelled",
+                },
+                schedule: {
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    recurrence: { kind: "at" },
+                    status: "cancelled",
+                    updatedAt: "2026-07-28T15:10:00.000Z",
+                    version: 2,
+                },
             },
-        },
         id: "schedules.cancel",
         idempotent: true,
         // Destructive and terminal: the occurrence settles `cancelled`, no work is
@@ -1758,39 +3850,50 @@ export const OPERATIONS = [
             "version_conflict",
         ],
         requestHeaders: conditionalRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["schedules:write"],
         sessionAuthority: "headers",
-        summary: "Cancel a schedule",
-        surfaces: ["api", "mock"],
-    },
-    {
-        creates: false,
-        description: "Files a finished schedule away: it leaves the default listing and stays readable by identifier, carrying the instant it was archived. Only a cancelled or completed schedule can be archived — archiving is filing, not stopping, so cancel it first. Archiving an already archived schedule changes nothing and returns the same version.",
-        example: {
-            occurrence: {
-                attemptCount: 0,
-                generation: 1,
-                id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                plannedFor: "2026-07-28T15:00:00.000Z",
-                schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                sequence: 1,
-                settledAt: "2026-07-28T15:10:00.000Z",
-                state: "cancelled",
-            },
-            schedule: {
-                archivedAt: "2026-07-28T15:30:00.000Z",
-                createdAt: "2026-07-28T14:59:00.000Z",
-                generation: 1,
-                id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
-                latencyClass: "realtime",
-                recurrence: { kind: "at" },
-                status: "cancelled",
-                updatedAt: "2026-07-28T15:30:00.000Z",
-                version: 3,
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Cancel a schedule",
+        surfaces: ["api", "mock"],
+    },
+    {
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Files a finished schedule away: it leaves the default listing and stays readable by identifier, carrying the instant it was archived. Only a cancelled or completed schedule can be archived — archiving is filing, not stopping, so cancel it first. Archiving an already archived schedule changes nothing and returns the same version.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                occurrence: {
+                    attemptCount: 0,
+                    generation: 1,
+                    id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    plannedFor: "2026-07-28T15:00:00.000Z",
+                    schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    sequence: 1,
+                    settledAt: "2026-07-28T15:10:00.000Z",
+                    state: "cancelled",
+                },
+                schedule: {
+                    archivedAt: "2026-07-28T15:30:00.000Z",
+                    createdAt: "2026-07-28T14:59:00.000Z",
+                    generation: 1,
+                    id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                    latencyClass: "realtime",
+                    lateness: { policy: "catchUp" },
+                    recurrence: { kind: "at" },
+                    status: "cancelled",
+                    updatedAt: "2026-07-28T15:30:00.000Z",
+                    version: 3,
+                },
             },
-        },
         id: "schedules.archive",
         idempotent: true,
         // Not destructive: archiving is filing. The schedule stays readable by
@@ -1808,11 +3911,17 @@ export const OPERATIONS = [
             "version_conflict",
         ],
         requestHeaders: conditionalRequestHeaderSchema,
-        response: scheduleViewSchema,
-        responseHeaders: versionResponseHeaderSchema,
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : scheduleViewSchema,
+        ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? {}
+            : { responseHeaders: versionResponseHeaderSchema }),
         scopes: ["schedules:write"],
         sessionAuthority: "headers",
-        summary: "Archive a schedule",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Archive a schedule",
         surfaces: ["api", "mock"],
     },
 ];
@@ -1894,6 +4003,16 @@ export function successStatusFor(operation) {
  * so an operation's own `problems` list stays about that operation.
  */
 export const UNIVERSAL_PROBLEMS = [
+    // **Universal rather than per-operation, because its earliest raise sites
+    // are before any operation exists.** Request admission runs as pre-route
+    // middleware on every `/v1/*`, `/oauth/*` and `/mcp` path, and the Worker
+    // refuses an unconfigured PostgreSQL authority before it builds an app at
+    // all. Declaring it operation by operation would leave the published
+    // contract, the mock and the SDK telling an integrator that a 503 on those
+    // paths can only be `service_unavailable` — which is the mistake a review
+    // round caught when `billing_not_ready` was declared on one of its two
+    // operations and not the other.
+    "capability_not_configured",
     "rate_limited",
     "service_unavailable",
 ];
@@ -1927,6 +4046,16 @@ export const AUTHENTICATED_PROBLEMS = [
  * operation could ever produce.
  */
 export const SCOPED_PROBLEMS = ["scope_missing"];
+/** Whether an authenticated operation needs a project that accepts work. */
+function canMeetArchivedProject(operation) {
+    if (operation.principals.length === 0)
+        return false;
+    if (operation.sessionAuthority === "organization" ||
+        operation.sessionAuthority === "member") {
+        return false;
+    }
+    return !["projects.archive", "projects.delete", "projects.rename"].includes(operation.id);
+}
 export function problemsFor(operation) {
     return [
         ...new Set([
@@ -1934,6 +4063,9 @@ export function problemsFor(operation) {
             ...UNIVERSAL_PROBLEMS,
             ...(operation.principals.length > 0 ? AUTHENTICATED_PROBLEMS : []),
             ...(operation.scopes.length > 0 ? SCOPED_PROBLEMS : []),
+            ...(canMeetArchivedProject(operation)
+                ? ["project_archived"]
+                : []),
         ]),
     ].sort();
 }