@oneie/sdk 0.15.1 → 0.16.1

package/dist/receivers.js

@@ -226,17 +226,45 @@ export const RECEIVERS = {
         request: z.object({ workspace: z.string() }),
         response: ok, effect: "ask", auth: "manage_workspace",
     }),
+    /**
+     * TWO PATHS, ONE RECEIVER — and the second one is why `slug`/`parent` exist.
+     *
+     * Bare (`name` + `type`, no `groupSlug`, no `parent`): unchanged legacy behaviour —
+     * a random gid in D1 `world_groups`. That is what a campaign or a collection
+     * is, and every existing caller stays on it byte for byte.
+     *
+     * Substrate (`groupSlug` + `parent`, BOTH required together): the real group unit —
+     * a TypeDB `group`, a `hierarchy` edge to the parent, an owner `membership`
+     * for the attested caller, and the D1 `owners` row — written by `createGroup`
+     * in `one.ie/web/src/lib/group-unit.ts`. Measured 2026-09-16: no shipped
+     * receiver could write a group with a PARENT and a chosen slug, so a personal
+     * group under a world root had to be typed by hand.
+     *
+     * The gid's SHAPE differs by path and that is the contract change callers
+     * notice: `generateTraceId()` on the bare path, deterministic `group:<slug>`
+     * on the substrate one.
+     *
+     * `parent` NAMES a target; it never authorizes one. The handler walks the
+     * caller's control of the parent workspace and refuses otherwise, and the
+     * owner it writes is the ATTESTED caller — never a body field.
+     */
     "world:create-group": receiver({
         receiver: "world:create-group",
         surfaces: { mcp: true },
-        summary: "Create a group in the caller's workspace",
+        summary: "Create a group — a D1 campaign/collection row, or (with groupSlug+parent) a substrate group under a parent the caller controls",
         request: z.object({
             name: z.string(),
             // "group" is the D1 group_type for campaigns/collections; absent from the TypeDB enum
-            type: GroupEntitySchema.shape["group-type"].or(z.literal("group")),
+            type: GroupEntitySchema.shape["group-type"].or(z.literal("group"))
+                .describe("One of the nine group-type values in schema/one.tql, or the D1-only \"group\". The substrate path (groupSlug+parent) accepts ONLY the nine — TypeDB's @values constraint refuses anything else and that write would fail silently."),
+            groupSlug: z.string().optional()
+                .describe("Bare slug for a SUBSTRATE group; the gid is always `group:<groupSlug>`. Requires `parent` — a slug with no parent would mint an unparented root workspace and is refused. NOT named `slug`: on the service lane `/api/ask` reads `payload.slug ?? payload.workspace` as the workspace the caller NOMINATES for itself, so a field called `slug` here would silently re-identify the caller as the group it is trying to create."),
+            parent: z.string().optional()
+                .describe("gid of the parent group, e.g. \"group:one\". Requires `groupSlug`. It NAMES a target and never authorizes one: the caller must control the parent workspace or the call is refused."),
             tags: z.array(z.string()).optional(),
         }),
-        response: z.object({ gid: z.string() }), effect: "ask", auth: "manage_groups",
+        response: z.object({ gid: z.string().describe("`group:<groupSlug>` on the substrate path; a random trace id on the bare D1 path") }),
+        effect: "ask", auth: "manage_groups",
     }),
     "world:update-group": receiver({
         receiver: "world:update-group",
@@ -376,6 +404,7 @@ export const RECEIVERS = {
             nickname: z.string().optional(),
             title: z.string().optional(),
             avatar: z.string().optional(),
+            cover: z.string().optional(),
             bio: z.string().optional(),
             // contact
             email: z.string().optional(),
@@ -560,6 +589,278 @@ export const RECEIVERS = {
         version: "1.0.0",
         examples: [{ head: "feat/x", base: "main", title: "feat: x" }],
     }),
+    // ── directory:* — the curated business-directory registry and the submission
+    // run over it. 306 directories, an operator board and a Chrome autofill skill
+    // shipped 2026-07-19 REACHABLE ONLY AS REST: `meta:catalog` listed zero
+    // `directory:*` names, so no agent could discover the capability or drive it,
+    // and a collaborator rebuilt a worse version from scratch rather than find this
+    // one. By-name reachability is the feature these three rows buy.
+    //
+    // `directory:list` is `public` because the registry IS public — every field
+    // ships in the client bundle already. `run` and `update` write tenant rows, so
+    // they carry `manage_integrations`, which AUTH_POLICY resolves to the `tenant`
+    // floor. That label is chosen from the existing table on purpose: an unlisted
+    // label falls through to `authenticated` (bind-receiver.ts), so inventing
+    // `manage_directories` would have shipped these WEAKER and no test would have
+    // said so. The object of the decision is the WORKSPACE, resolved from the
+    // attested `ctx.ownerSlug`, never from a body `actorId`.
+    "directory:list": receiver({
+        receiver: "directory:list",
+        summary: "List the curated business-directory registry (306 entries) — read-only public data, filterable by category, region and paid",
+        request: z.object({
+            category: z.string().optional().describe("Exact category: general | review | b2b | startup | ai-tools | vertical"),
+            region: z.string().optional().describe("Exact region key: global | us | ie | gb | ca | au | in"),
+            paid: z.boolean().optional().describe("true = only directories whose LISTING is paid-only; false = only free ones. A free tier that merely upsells is paid:false. Omit for both."),
+        }),
+        response: z.object({
+            ok: z.literal(true),
+            directories: z.array(z.object({
+                slug: z.string().describe("Stable kebab-case id — this is what directory:run takes"),
+                name: z.string(),
+                category: z.string(),
+                region: z.string(),
+                url: z.string(),
+                submitUrl: z.string().describe("The public submission / claim / add-listing URL a human or an autofill skill drives"),
+                method: z.string().optional().describe("form | email | api | claim; absent means form"),
+                da: z.number().optional().describe("Approximate domain authority 0-100, for ranking only — NOT authoritative"),
+                paid: z.boolean(),
+                fields: z.array(z.object({ key: z.string(), label: z.string(), type: z.string(), required: z.boolean() })),
+                notes: z.string().optional(),
+            })),
+            total: z.number().describe("Rows returned. UNCAPPED — total always equals directories.length; no budget bit, so there is no truncated field to read."),
+        }),
+        effect: "ask",
+        auth: "public",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ category: "review", paid: false }],
+    }),
+    // A run is NOT idempotent: each call mints a fresh runId. What makes a repeat
+    // SAFE is the cross-run duplicate guard — a directory already `submitted` or
+    // `live` for this workspace is never re-queued, and every one it drops is named
+    // in `skipped`. Before that guard, a second run over the same picker selection
+    // re-queued everything and the board (which loads only the latest run) hid it.
+    "directory:run": receiver({
+        receiver: "directory:run",
+        summary: "Start a submission run over selected directories for a workspace — freezes a submission pack per row; directories already submitted or live are SKIPPED and named, never silently re-queued",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's. Authority is derived from the attested context, never from this field alone — a slug you do not control is refused."),
+            directories: z.array(z.string()).min(1).describe("Directory slugs from directory:list. Repeats within one call are collapsed. An unknown slug refuses the WHOLE run (unknown_directory) rather than filing a partial one."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            runId: z.string().optional().describe("Present only on success. Absent on all_duplicates — no empty run is minted, because an empty run would become the board's latest and blank it."),
+            count: z.number().optional().describe("Rows actually queued = directories.length - skipped.length"),
+            skipped: z.array(z.object({
+                directorySlug: z.string(),
+                status: z.string().describe("submitted | live — why it was skipped"),
+                runId: z.string().describe("The earlier run that already carries it"),
+            })).optional().describe("ALWAYS present on success, empty array included — never infer 'nothing was dropped' from a missing key. Also carried on an all_duplicates refusal, naming every one."),
+            unknown: z.array(z.string()).optional().describe("The slugs that are not in the registry, on an unknown_directory refusal"),
+            error: z.string().optional().describe("no_db | workspace required | forbidden | directories required | unknown_directory | all_duplicates"),
+        }),
+        effect: "ask",
+        auth: "manage_integrations",
+        roleAction: "manage_integrations",
+        cost: "free",
+        // Each call mints a new runId, so a retry is a NEW run — not a no-op.
+        idempotent: false,
+        // There is no door that deletes a run or a queued row.
+        reversible: false,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ directories: ["google-business-profile", "bing-places"] }],
+    }),
+    "directory:update": receiver({
+        receiver: "directory:update",
+        summary: "Walk one directory submission to its next status (queued → submitted → live|rejected) — listingUrl is required to mark live",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's. The row is looked up by (id, workspace), so another tenant's id reads as not_found."),
+            id: z.string().describe("The directory_submissions row id, from the run board"),
+            status: z.string().describe("Next status. The walk is queued→submitted, submitted→live|rejected; live and rejected are terminal. Anything else is refused as invalid_transition."),
+            listingUrl: z.string().optional().describe("The published listing URL. REQUIRED when status is live — a live listing nobody can point at is not a listing."),
+            note: z.string().optional().describe("Operator note; COALESCEd, so omitting it never clears an existing one"),
+            filedBy: z.string().optional().describe("PROVENANCE, not authority: 'human' | 'agent', who filed it at the directory. Stamped only on the submitted transition and defaults to 'human'. It can never widen what this caller may touch."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            id: z.string().optional(),
+            status: z.string().optional().describe("The status now held"),
+            from: z.string().optional().describe("On invalid_transition: the status the row is actually in"),
+            to: z.string().optional().describe("On invalid_transition: the status that was asked for"),
+            error: z.string().optional().describe("no_db | workspace required | forbidden | id_and_status_required | not_found | invalid_transition | listing_url_required"),
+        }),
+        effect: "ask",
+        auth: "manage_integrations",
+        roleAction: "manage_integrations",
+        cost: "free",
+        // Re-asserting the status a row already holds is refused as invalid_transition
+        // (live and rejected are terminal, and queued→queued is not in the walk), so a
+        // blind retry is a REFUSAL rather than a silent second write.
+        idempotent: false,
+        // The walk is one-way — there is no un-transition door.
+        reversible: false,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ id: "6f1c...", status: "live", listingUrl: "https://example.com/listing/acme" }],
+    }),
+    // ── crm: · campaign:targeting · analytics:revenue · funnel:def-get ──────────
+    //
+    // The same defect `directory:*` above records, counted: of 133 top-level doors
+    // under `one.ie/web/src/pages/api/`, 75 answered to no receiver name at all
+    // (measured 2026-09-22 against `src/data/api-surface.json`). `crm/`,
+    // `campaigns/` and `analytics/` were three whole product areas with ZERO rows
+    // here, so `meta:catalog` could not name one of them and the only door was a
+    // hand-rolled fetch at an Astro route — the shape an agent cannot discover.
+    //
+    // These five are the ones an external builder reaches for, NOT one row per
+    // route: analytics alone is fifteen route files and exactly one of them is
+    // here, because a receiver per dashboard chart is noise, not discoverability.
+    // The other doors stay REST and are recorded, with their reasons, in
+    // `tests/unit/api-catalog-parity.test.ts`.
+    //
+    // EVERY BODY IS SHARED WITH ITS ROUTE. `lib/combo-read.ts`,
+    // `lib/analytics/revenue.ts` and `lib/funnel/types.ts` hold the one
+    // implementation; the resolver and the route differ ONLY in how the caller is
+    // attested (`callerControlsWorkspace(ctx.ownerSlug, …)` here,
+    // `authorizeWorkspace(locals, …)` there). A `workspace` in a payload NAMES a
+    // target and never authorizes one.
+    //
+    // The `auth` labels are chosen from the EXISTING table, never invented: an
+    // unlisted label falls through to `authenticated` (bind-receiver.ts), which
+    // would ship these weaker than they read. `manage_lifecycle` is the tenant
+    // floor `POST /api/funnels/def` already requires, and the combo cache IS
+    // lifecycle-stage data. `analytics:revenue` pairs the `manage_workspace`
+    // CLASS floor with the `read_revenue` ACTION the role union already names —
+    // the two fields answer two different questions (see `packages/sdk/CLAUDE.md`).
+    "crm:context": receiver({
+        receiver: "crm:context",
+        summary: "Instant prospect context for a contact's tag set — lifecycle stage, recent threads, matched workflows, path strength. The read a sales agent makes on contact lookup, before it writes a word",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's. Authority comes from the attested context — a slug you do not control is refused."),
+            tags: z.array(z.string()).min(1).describe("The contact's tags — lifecycle stage, persona, industry. MAX 8, each matching [a-z0-9_:][a-z0-9_.:-]*; more or malformed is refused by name, never silently truncated."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            tags: z.array(z.string()).optional(),
+            strength: z.number().optional().describe("Max pairwise path strength across the tag set — how hot this combination is"),
+            primaryStage: z.string().nullable().optional().describe("The lifecycle stage to open on, or null when the combo has none"),
+            suggestedAction: z.object({ id: z.string(), name: z.string(), tags: z.array(z.string()) }).nullable().optional(),
+            lastThread: z.object({ id: z.string(), lastMsgAt: z.number() }).nullable().optional(),
+            recentThreads: z.array(z.object({ id: z.string(), lastMsgAt: z.number() })).optional().describe("At most 3"),
+            matchedWorkflows: z.array(z.object({ id: z.string(), name: z.string(), tags: z.array(z.string()) })).optional().describe("At most 3"),
+            cachedAt: z.number().optional().describe("Unix seconds the combo was resolved. A KV hit can be up to its strength-derived TTL old (300s hot / 3600s warm / 86400s cold)."),
+            error: z.string().optional().describe("no_db | workspace required | forbidden | the tag-validation reason"),
+        }),
+        effect: "ask",
+        auth: "manage_lifecycle",
+        roleAction: "manage_lifecycle",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ tags: ["consideration", "saas"] }],
+    }),
+    "crm:starters": receiver({
+        receiver: "crm:starters",
+        summary: "The hottest sales-stage tag combos in a workspace, as ready-to-send conversation openers — SAMPLED from a 200-key scan, and it says when it sampled",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's."),
+            limit: z.number().optional().describe("Openers to return, 1-20, default 5. Values above 20 are clamped, not refused."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            starters: z.array(z.object({
+                tags: z.array(z.string()),
+                strength: z.number(),
+                lifecycles: z.array(z.string()),
+                suggestedOpener: z.string().describe("The opener text, written from the stage — send it or rewrite it"),
+                workflows: z.array(z.object({ id: z.string(), name: z.string(), tags: z.array(z.string()) })),
+                recentThreads: z.array(z.object({ id: z.string(), lastMsgAt: z.number() })),
+            })).optional(),
+            scanned: z.number().optional().describe("Cached combos actually read for this answer. It may be BELOW scanLimit on a truncated read — KV can return a short page with more to come, so this is not the completeness signal."),
+            scanLimit: z.number().optional().describe("The scan ceiling — 200"),
+            truncated: z.boolean().optional().describe("true = the KV listing was NOT complete, so these are the hottest of a SAMPLE and not of the workspace. Read from the store's own list_complete, never from scanned vs scanLimit. Always present on success, false included — never infer completeness from a missing key."),
+            workspace: z.string().optional(),
+            error: z.string().optional().describe("no_db | workspace required | forbidden"),
+        }),
+        effect: "ask",
+        auth: "manage_lifecycle",
+        roleAction: "manage_lifecycle",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ limit: 5 }],
+    }),
+    "campaign:targeting": receiver({
+        receiver: "campaign:targeting",
+        summary: "Size a campaign's audience BEFORE spending on reach — the tag combo plus a distinct-entity count over entity_tags",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's."),
+            tags: z.array(z.string()).min(1).describe("The targeting tags. MAX 8, charset-checked; more or malformed is refused by name."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            tags: z.array(z.string()).optional(),
+            strength: z.number().optional(),
+            audienceSize: z.number().optional().describe("DISTINCT entities holding ANY of the tags — an OR, so it is an UPPER BOUND on a multi-tag segment and never an intersection"),
+            lifecycles: z.array(z.string()).optional().describe("Which stages this audience is actually in"),
+            workflows: z.array(z.object({ id: z.string(), name: z.string(), tags: z.array(z.string()) })).optional(),
+            threads: z.array(z.object({ id: z.string(), lastMsgAt: z.number() })).optional(),
+            ttl: z.number().optional(),
+            cachedAt: z.number().optional().describe("Unix seconds. The combo half may be a KV hit; audienceSize is always counted live."),
+            error: z.string().optional().describe("no_db | workspace required | forbidden | the tag-validation reason"),
+        }),
+        effect: "ask",
+        auth: "manage_lifecycle",
+        roleAction: "manage_lifecycle",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ tags: ["lead", "saas"] }],
+    }),
+    "analytics:revenue": receiver({
+        receiver: "analytics:revenue",
+        summary: "Workspace inference cost and revenue rollup over a date window — cost by model, cost per resolution, and a NAMED list of the figures that are not wired yet",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the attested caller's."),
+            from: z.number().optional().describe("Window start, epoch ms. Default: 30 days before `to`. CLAMPED to at most 366 days before `to` — the window actually read comes back as `from`."),
+            to: z.number().optional().describe("Window end, epoch ms. Default: now."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            from: z.number().optional().describe("The window actually read, after the clamp — compare it against what you asked for"),
+            to: z.number().optional(),
+            totalTokens: z.number().optional(),
+            totalCost: z.number().optional().describe("Inference cost in credits/100000, from credit_burns"),
+            costPerResolution: z.number().optional().describe("totalCost / journey-complete events; 0 when there were none"),
+            revenue: z.number().optional(),
+            ltv: z.number().optional(),
+            tokensByAgent: z.array(z.object({ label: z.string(), tokens: z.number(), cost: z.number() })).optional().describe("By MODEL, ranked by cost, top 30"),
+            tokensBySkill: z.array(z.object({ label: z.string(), tokens: z.number(), cost: z.number() })).optional(),
+            attribution: z.array(z.unknown()).optional(),
+            pending: z.array(z.string()).optional().describe("THE FIELDS WHOSE ZERO IS NOT A MEASUREMENT — no signal carries a skill field and payment events do not reach this rollup yet, so tokensBySkill/revenue/attribution are empty by wiring, not by finding. Read revenue:0 as 'unbuilt', never as 'earned nothing'."),
+            error: z.string().optional().describe("no_db | workspace required | forbidden"),
+        }),
+        effect: "ask",
+        auth: "manage_workspace",
+        roleAction: "read_revenue",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ workspace: "one" }],
+    }),
     "tools:composio": receiver({
         receiver: "tools:composio",
         summary: "Execute one connected Composio tool from a workflow `tool` step (config.composio)",
@@ -568,6 +869,107 @@ export const RECEIVERS = {
         effect: "ask", auth: "manage_integrations", reversible: false, idempotent: false,
         examples: [{ workspace: "acme", tool: "GMAIL_SEND_EMAIL", args: { to: "x@y.com" } }],
     }),
+    // ── endpoint:* — a tenant's OWN https endpoints, entered once, called from a
+    // workflow `tool` step. Four receivers and NO new step kind: `stepBinding`'s
+    // first branch is an explicit `config.receiver`, so a tool step already reaches
+    // any receiver by name. The eight step kinds stay eight.
+    //   config: { receiver: "endpoint:call", args: { endpoint: "thumbs", input: {…} } }
+    //
+    // A registered endpoint is ALSO how an outside agent gets a face: a persona
+    // whose `model:` is `endpoint/<name>` is served as an OpenAI-compatible client
+    // against that row, so it has an actorId and an `AIChatBlock` renders it —
+    // with none of the tenant's code on anyone's machine. That path is
+    // `channels/src/tenant-endpoint.ts` and it needs the service to speak OpenAI
+    // chat completions; `endpoint:call` here takes any request and response shape.
+    // Handlers: one.ie/web/src/lib/resolvers/endpoints.ts — the SSRF guard runs at
+    // registration AND on every call (never cached), `redirect:'manual'` with any
+    // 3xx refused as `redirect_refused` (workerd rejects `redirect:'error'`), a
+    // byte ceiling, a timeout, and only the step's declared input crosses.
+    "endpoint:register": receiver({
+        receiver: "endpoint:register",
+        surfaces: { mcp: true },
+        summary: "Register (or update) one of the workspace's own https endpoints under a handle a workflow step can name. The url is SSRF-checked here and again on every call; a secret is sealed under the worker's envelope key and never returned.",
+        request: z.object({
+            workspace: z.string().optional().describe("Group slug. Omit for your own. A scope REQUEST — refused when the authority walk says no, never swapped for your own."),
+            name: z.string().describe("The handle a workflow step names. Lowercase letters, digits, `-` and `_`, 1–48 chars. Unique per workspace; re-registering the same name updates it in place so a live workflow keeps working."),
+            url: z.string().describe("A public https address. Refused BY NAME — https_required · ip_literal · private_hostname · dns_unresolved · blocked_address — so a retry is informed."),
+            method: z.enum(["GET", "POST", "PUT", "PATCH"]).optional().describe("Default POST. GET folds `input` into the query string; the others send it as a JSON body."),
+            authHeader: z.string().optional().describe("The header NAME the secret travels in, e.g. `Authorization` or `X-Api-Key`. The VALUE is `secret` and is stored sealed."),
+            secret: z.string().optional().describe("Your endpoint's own credential. Sealed AES-256-GCM under the worker's PII_ENVELOPE_KEY, opened into memory for one outbound header, never logged, never returned. Requires `authHeader`. Omitting it on a re-register KEEPS the existing secret rather than disarming it."),
+            returnMode: z.enum(["json", "url", "bytes"]).optional().describe("What the endpoint answers. `json` = the answer itself. `url` = a small JSON body naming a url, which is fetched under the SAME guard and filed to the media library. `bytes` = the asset itself, filed the same way. Default json."),
+            timeoutMs: z.number().optional().describe("Per-call AbortSignal timeout. Default 20000, clamped to 1000–120000."),
+            maxBytes: z.number().optional().describe("Response byte ceiling, enforced while reading — `content-length` is a claim and is not read. Default 5 MiB, clamped to 10 MiB."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            endpoint: z.record(z.string(), z.unknown()).optional().describe("The stored row, minus the sealed secret. `hasSecret` is a boolean; the value has no read door."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true,
+        auth: "manage_integrations", roleAction: "manage_integrations",
+        examples: [{ name: "thumbs", url: "https://api.dave.example/thumbnail", method: "POST", returnMode: "bytes", authHeader: "Authorization", secret: "Bearer …" }],
+    }),
+    "endpoint:list": receiver({
+        receiver: "endpoint:list",
+        surfaces: { mcp: true },
+        summary: "List the workspace's registered endpoints — never the sealed secrets, only whether each has one",
+        request: z.object({ workspace: z.string().optional() }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            total: z.number().optional(),
+            endpoints: z.array(z.record(z.string(), z.unknown())).optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", idempotent: true,
+        auth: "manage_integrations", roleAction: "manage_integrations",
+        examples: [{ workspace: "dave" }],
+    }),
+    "endpoint:remove": receiver({
+        receiver: "endpoint:remove",
+        surfaces: { mcp: true },
+        summary: "Delete one registered endpoint. A delete of something absent answers not_found — gone and never-existed are different answers",
+        request: z.object({ workspace: z.string().optional(), name: z.string() }),
+        response: z.object({
+            ok: z.boolean(), workspace: z.string().optional(), name: z.string().optional(),
+            removed: z.number().optional(), error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: false, idempotent: false,
+        auth: "manage_integrations", roleAction: "manage_integrations",
+        examples: [{ name: "thumbs" }],
+    }),
+    "endpoint:call": receiver({
+        receiver: "endpoint:call",
+        surfaces: { mcp: true },
+        summary: "Call one registered endpoint and return its answer — or, in url/bytes mode, file the asset in the media library and return the reader url. The SSRF guard re-runs on EVERY call because a stored verdict is a fact about the past.",
+        request: z.object({
+            workspace: z.string().optional(),
+            endpoint: z.string().describe("The handle from endpoint:register."),
+            input: z.record(z.string(), z.unknown()).optional().describe("The ONLY thing that crosses to the endpoint, beside its own sealed credential. Never the caller's session, the workspace key, or any ONE secret."),
+            returnMode: z.enum(["json", "url", "bytes"]).optional().describe("Overrides the row's mode for this call."),
+            dryRun: z.boolean().optional().describe("Run the guard and answer its verdict without spending a request. What `one endpoint test` uses."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            endpoint: z.string().optional(),
+            status: z.number().optional(),
+            json: z.unknown().optional(),
+            text: z.string().optional().describe("Present instead of `json` when the endpoint answered something that is not JSON. Named rather than coerced, so a step never branches on an invented shape."),
+            workspace: z.string().optional(),
+            key: z.string().optional(),
+            url: z.string().optional().describe("`/api/product-image/{workspace}/{path}` — the same reader media:generate returns."),
+            kind: z.literal("image").optional(),
+            contentType: z.string().optional().describe("Sniffed from the MAGIC BYTES, never from what the endpoint declared."),
+            size: z.number().optional(),
+            dryRun: z.boolean().optional(),
+            guard: z.string().optional(),
+            error: z.string().optional().describe("Named: not_found · disabled · blocked_url:<reason> · redirect_refused: <the 3xx status> · fetch_failed · endpoint_error · too_large · bad_response · unsupported_type · credential_unreadable · storage_error."),
+        }),
+        effect: "ask", cost: "variable", reversible: false, idempotent: false, settles: "none",
+        auth: "manage_integrations", roleAction: "manage_integrations",
+        examples: [{ endpoint: "thumbs", input: { title: "How we shipped in a week", style: "bold" } }],
+    }),
     "brand:set": receiver({
         receiver: "brand:set",
         summary: "Write up to 6 brand color tokens (primary/secondary/accent/bg/text/border) to a workspace theme",
@@ -752,6 +1154,93 @@ export const RECEIVERS = {
         response: z.object({ uid: z.string(), address: z.string() }),
         effect: "ask", cost: "free", idempotent: true,
     }),
+    // C11 — Verified: soulbound claims per address (text/key.md § Verified).
+    //
+    // THE FAMILY IS `identity:`, and the alternative was considered and refused.
+    // `identify` is one of the eight lifecycle words (identify · engage · sell ·
+    // nurture · upsell · share · educate · refine), written as a BARE tag that agents
+    // subscribe to; a receiver family spelled the same way collides with it in
+    // every tag search and becomes the next dead name. `api:` was refused too: it
+    // names how a request ARRIVED, not a thing that is done.
+    //
+    // THE INVARIANT, and it is the whole row: an email, a phone number, a name or
+    // a document number appears in NO field below. What travels is `commitment`
+    // — blake2b(domain ‖ len(salt) ‖ salt ‖ len(identifier) ‖ identifier), 32 bytes
+    // of hex — and the holder keeps the salt. Each request is `.strict()`, which
+    // is the load-bearing choice: zod's DEFAULT is to STRIP an unknown key, so a
+    // caller that puts an email in the payload would be told nothing, logged
+    // nothing, and believe it had been accepted. Strict REFUSES it at the edge.
+    "identity:verify": receiver({
+        receiver: "identity:verify",
+        summary: "Start a verification method for an address and get back a single-use challenge plus the fresh random salt to commit with. Takes no identifier and returns none: the caller proves the contact point to the issuer out of band, and only the salted commitment ever travels.",
+        request: z.object({
+            subject: z.string().min(1).describe("the Sui address being verified — public, never a person"),
+            method: z.enum(["passkey", "google", "phone", "domain", "kyc"]).describe("which rung is being attempted; `key` needs no challenge and `owner-of` is issued by the spawns walk, so neither is startable here"),
+        }).strict(),
+        response: z.object({
+            ok: z.boolean(),
+            challenge: z.string().optional().describe("single-use nonce; the attestation that spends it can never be replayed"),
+            salt: z.string().optional().describe("32 fresh random bytes as hex, for the holder to KEEP — it is what lets them open the commitment later, to one counterparty, off chain"),
+            method: z.string().optional(),
+            level: z.number().optional().describe("the rung this method would confer: 0 key · 1 passkey · 2 google/phone · 3 domain · 4 kyc"),
+            expiresAt: z.number().optional(),
+            error: z.string().optional().describe("a refusal CODE — never quotes an identifier, a salt or a key"),
+        }),
+        effect: "ask", auth: "session", cost: "free", reversible: true,
+    }),
+    "identity:attest": receiver({
+        receiver: "identity:attest",
+        summary: "An issuer writes one soulbound verification claim for an address: method, rung, issuer, salted commitment, expiry. Authorised by an on-chain IssuerCap (ONE's attester holds rung 3; KYC is delegated and ONE deliberately does not carry it), bound to the challenge's subject and method, and single-use — the nonce is spent only once every other check has passed.",
+        request: z.object({
+            subject: z.string().min(1),
+            method: z.enum(["key", "passkey", "google", "phone", "domain", "kyc", "owner-of"]),
+            commitment: z.string().regex(/^[0-9a-f]{64}$/).describe("blake2b-256 hex. A raw identifier fails this pattern at the edge — which is the point"),
+            challenge: z.string().min(1).describe("the nonce from identity:verify; replay is refused"),
+            expiresAt: z.number().int().nonnegative().optional().describe("epoch ms; 0 or absent = never"),
+        }).strict(),
+        response: z.object({
+            ok: z.boolean(),
+            claimId: z.string().optional(),
+            subject: z.string().optional(),
+            method: z.string().optional(),
+            level: z.number().optional(),
+            issuer: z.string().optional().describe("the attesting ADDRESS — the signing key stays server-side and is never returned, logged or thrown"),
+            state: z.number().optional().describe("0 active · 1 revoked"),
+            error: z.string().optional(),
+        }),
+        effect: "ask", auth: "mint_capability", cost: "free", reversible: false, settles: "onchain",
+    }),
+    "identity:proofs": receiver({
+        receiver: "identity:proofs",
+        surfaces: { mcp: true },
+        summary: "Read an address's ACTIVE claims and its level — public, no auth, no PII. Excludes revoked and expired claims; an agent's level is its own key proof plus its verified owner's rungs, walked up spawns, and an unowned agent is said plainly as level 0 with owner null.",
+        request: z.object({
+            subject: z.string().min(1),
+        }).strict(),
+        response: z.object({
+            ok: z.boolean(),
+            subject: z.string().optional(),
+            level: z.number().optional().describe("the MAX active rung, never a sum"),
+            owner: z.string().nullable().optional().describe("the verified human behind an agent when BOTH the owner-of claim and the spawns edge hold; null is a legitimate answer, not a missing one"),
+            claims: z.array(z.object({
+                id: z.string(),
+                method: z.string(),
+                level: z.number(),
+                issuer: z.string(),
+                commitment: z.string(),
+                issuedAt: z.number(),
+                expiresAt: z.number(),
+                state: z.number(),
+            })).optional(),
+            reputation: z.object({
+                kept: z.number(), broken: z.number(),
+                escrowReleased: z.number(), escrowRefunded: z.number(),
+                proven: z.number(), settled: z.number(),
+            }).optional().describe("SETTLED outcomes only — promises kept/broken, escrow released/refunded, UnitProven. Never intent, never activity, never a hand-written score"),
+            error: z.string().optional(),
+        }),
+        effect: "ask", auth: "public", cost: "free", idempotent: true,
+    }),
     // ── auth (human session) ──
     // auth:sign-in killed (C7): Better Auth handles all human auth; signal/ask pipeline returns dissolved
     "auth:sign-out": receiver({
@@ -985,7 +1474,12 @@ export const RECEIVERS = {
             // with the TS type by hand.
             meta: z.record(z.string(), z.unknown()).optional(),
         }),
-        response: z.object({ ok: z.boolean(), taskId: z.string().optional(), matched: z.number().optional(), actors: z.array(z.string()).optional() }),
+        response: z.object({
+            ok: z.boolean(),
+            taskId: z.string().optional(),
+            matched: z.number().optional().describe("REACH, NEVER DELIVERY. This is `actors.length` from the fan-out (`resolvers/subscriptions.ts:1245`) — how many staked actors the tags MATCHED, not how many received it, read it, or acted on it. Each matched actor got an inbox row; whether any of them moved the task is one `tasks:claim` away and this number cannot see it. A digest that quotes this as 'N people are on it' is reporting a fan-out as a delivery."),
+            actors: z.array(z.string()).optional().describe("The actor ids the fan-out reached — the same reach `matched` counts, itemised. Reaching is not acting."),
+        }),
         effect: "ask",
     }),
     "tasks:mine": receiver({
@@ -1767,7 +2261,7 @@ export const RECEIVERS = {
     "tasks:priority": receiver({
         receiver: "tasks:priority",
         surfaces: { mcp: true },
-        summary: "Set a task's priority from the 1–100 slider. Stored as the 0–1 `task-priority` attribute (slider/100), which is what the board's ranking reads",
+        summary: "Set a task's priority. Two scales, no overlap: a value strictly between 0 and 1 is a fraction and is stored as-is; anything else is the 1–100 slider (stored as slider/100, so exactly 1 is the MINIMUM — send 100 or 0.99 for the top). Stored as the 0–1 `task-priority` attribute the board's ranking reads",
         request: z.object({
             tid: z.string(),
             priority: z.number(),
@@ -1954,7 +2448,7 @@ export const RECEIVERS = {
         surfaces: { mcp: true },
         summary: "The whole task board in ONE request: every task in a group (or its whole subtree with scope:'tree'), filtered in RAM, with `total` before paging, a `nextCursor` when there is more, `truncated` naming any budget that bit, and a `summary` over ALL matched rows — counts by status/tag/assignee/workspace, the ready set, the blocked set, overdue, unassigned, orphans, no-notes. Use this to plan; use tasks:bulk to act on what it shows.",
         request: z.object({
-            workspace: z.string().optional().describe("Group slug. Omit for your own. Honoured only if you may read it."),
+            workspace: z.string().optional().describe("Group slug. Omit for your own. A scope REQUEST — refused ({ok:false, error:'forbidden', workspace}) when you may not read it, never swapped for your own."),
             scope: z.enum(["own", "tree"]).optional().describe("tree = this group AND every descendant group (the CEO / agency lens). Default own."),
             status: z.union([z.string(), z.array(z.string())]).optional()
                 .describe("open | blocked | picked | done | verified | failed | dissolved, one or many. 'active' = open+blocked+picked (the default). 'all' = every status."),
@@ -1965,7 +2459,9 @@ export const RECEIVERS = {
             search: z.string().optional().describe("Case-insensitive substring on the task name."),
             ready: z.boolean().optional().describe("true = only rows claimable now (open, and every blocker closed). false = only rows that are NOT claimable now (not open, or at least one blocker still open). Omit for both."),
             include: z.array(z.enum(["notes", "graph", "dates", "thread"])).optional()
-                .describe("Widen each row. notes = the prose goal, CLIPPED to the first 2000 chars per row (read the whole text one task at a time); graph = children + blocks (the reverse edges); dates = startAt/createdAt/closedAt; thread = the task's inbox conversation (id, comment count, last message). Compact rows already carry parent, blockedBy, dueAt."),
+                .describe("Widen each row. notes = the prose goal, WHOLE and unclipped (it was silently cut at 2000 chars until 2026-09-21, mid-word, while `truncated` named the tag budget beside it and stayed silent about this one; the escape hatch its comment named, tasks:get, was never built, so no door returned a longer note at all). Pass `notesClip` for a bound and the response reports `truncated.notes`; graph = children + blocks (the reverse edges); dates = startAt/createdAt/closedAt; thread = the task's inbox conversation (id, comment count, last message). Compact rows already carry parent, blockedBy, dueAt."),
+            notesClip: z.number().optional()
+                .describe("Opt-in per-row ceiling on `include:'notes'` prose. Omitted = WHOLE notes, the default. When it bites, the response carries `truncated.notes` = the number of rows cut, so a clipped board can never read as complete. Values under 200 are ignored rather than honoured — a ceiling that cuts every row is a request for a different field, not a budget."),
             view: z.enum(["rows", "summary", "both"]).optional().describe("summary = counts and sets only, no rows (cheapest way to see a 2,000-row board). Default both."),
             sort: z.enum(["priority", "due-at", "updated-at", "created-at", "name"]).optional().describe("Default priority (desc)."),
             dir: z.enum(["asc", "desc"]).optional(),
@@ -2052,19 +2548,20 @@ export const RECEIVERS = {
     // It reimplements no write: the resolver loops and calls the existing
     // single-tid resolvers with the SAME attested ctx, so authority, the status
     // gates and the D1 tag mirror are all inherited rather than re-derived. The
-    // `workspace` field (envelope or per row) is a REQUEST, exactly as on every
-    // single-tid write — effectiveWorkspace downgrades it when the caller is
-    // neither staff nor in control of it.
+    // `workspace` field (envelope or per row) is a REQUEST: one the caller is
+    // neither staff for nor in control of REFUSES the whole call before any write
+    // ({ok:false, error:'forbidden', workspace}) — never silently swapped for the
+    // caller's own group, which is where such a write used to land.
     "tasks:bulk": receiver({
         receiver: "tasks:bulk",
         surfaces: { mcp: true },
-        summary: "Plan and act on many tasks in ONE request. Three modes, combinable: `creates` files up to 25 new tasks (with `ref` handles so rows in the same call can parent/block each other — a whole plan tree in one call); `edits` changes up to 25 named rows (title/status/priority/notes/assignee/tags/dates/dependencies/parent/comment — `parent` MOVES a row under another, the one door that writes `containment` after birth, and an empty string makes it a root again); `where`+`set` applies ONE edit to every row a tasks:board filter matches (dryRun defaults TRUE — you see the matched tids before anything moves; applies 25 per call and returns `nextCursor` to continue). Returns a receipt PER ROW (ok, per-field reason, retryable) plus total/attempted/applied/failed — a row never attempted says so by name, so a partial run can never read as a success.",
+        summary: "Plan and act on many tasks in ONE request. Three modes, combinable: `creates` files up to 25 new tasks (with `ref` handles so rows in the same call can parent/block each other — a whole plan tree in one call); `edits` changes up to 25 named rows (title/status/priority/notes/assignee/tags/dates/dependencies/parent/comment — `parent` MOVES a row under another, the one door that writes `containment` after birth, and an empty string makes it a root again); `where`+`set` applies ONE edit to every row a tasks:board filter matches (dryRun defaults TRUE — the preview returns the matched ROWS themselves in `rows`, not just their tids, so you read the ≤25 rows you are about to change and then re-send the identical call with dryRun:false; applies 25 per call and returns `nextCursor` to continue). Returns a receipt PER ROW (ok, per-field reason, retryable) plus total/attempted/applied/failed — a row never attempted says so by name, so a partial run can never read as a success.",
         request: z.object({
             edits: z.array(z.object({
                 tid: z.string(),
                 title: z.string().optional(),
                 status: z.string().optional().describe("open | blocked | picked | done | verified | failed | dissolved"),
-                priority: z.number().optional().describe("1-100 slider, same scale as tasks:priority"),
+                priority: z.number().optional().describe("Same rule as tasks:priority: strictly between 0 and 1 = a fraction stored as-is; otherwise the 1-100 slider (1 is the minimum)"),
                 notes: z.string().optional().describe("Prose goal; empty string clears"),
                 parent: z.string().optional().describe("MOVE this row under another — the only door that writes a `containment` edge AFTER birth (tasks:create and tasks:subtask write one only at birth, which is why a story could never be made a sub-story of another). An existing task id, or a `ref` created EARLIER in `creates`. EMPTY STRING CLEARS: the row becomes a root again, and clearing a row that already had no parent is a silent success. Refused by name, never silently: `cycle` if the new parent is this row or any row beneath it (walked transitively, and a walk that could not FINISH answers `undetermined` and is refused — never guessed at); `not_found` if the parent does not exist, OR the caller lacks operate access to it, OR the row's CURRENT parent is one the caller cannot operate (detaching changes that tree too) — the same rule, and the same word, tasks:create's `parent` uses; `cross_workspace` if the two ends live in different workspaces and the caller is not staff. CLAIM-GATE CONSEQUENCE — this is not only a tree edit: `tasks:claim` refuses `picked` while an OPEN `containment` child exists, so hanging an open row under a claimable parent makes that parent UNCLAIMABLE, and moving the last open child away makes it claimable again. Deliberately absent from `set`: a filter-driven mass re-parent moves whole subtrees at once — and multiplies that claim-gate consequence by the match count — so this is per-row only."),
                 assignee: z.string().optional().describe("Actor slug; empty string unassigns"),
@@ -2075,7 +2572,7 @@ export const RECEIVERS = {
                 addBlockedBy: z.array(z.string()).optional().describe("Task ids (or `ref`s from `creates`) this row must wait for — tasks:depend per id"),
                 removeBlockedBy: z.array(z.string()).optional().describe("tasks:undepend per id"),
                 comment: z.string().optional().describe("Post to the task's inbox thread (tasks:comment) — say WHY you changed it, so the humans watching the thread see the decision"),
-                workspace: z.string().optional().describe("Per-row override of the envelope workspace. A request, never a grant."),
+                workspace: z.string().optional().describe("Per-row override of the envelope workspace. A request, never a grant — one you may not operate refuses the whole call before any write."),
             })).max(25).optional(),
             creates: z.array(z.object({
                 ref: z.string().optional().describe("A local handle, e.g. 'a'. Other rows in THIS call may name it in parent/blockedBy/addBlockedBy; the receipt maps ref → tid."),
@@ -2083,7 +2580,7 @@ export const RECEIVERS = {
                 notes: z.string().optional(),
                 tags: z.array(z.string()).optional(),
                 assignee: z.string().optional(),
-                priority: z.number().optional(),
+                priority: z.number().optional().describe("Same rule as tasks:priority: strictly between 0 and 1 = a fraction stored as-is; otherwise the 1-100 slider"),
                 parent: z.string().optional().describe("Existing task id or a ref created EARLIER in this array"),
                 blockedBy: z.array(z.string()).optional().describe("Existing task ids or refs created earlier in this array"),
                 dueAt: z.string().optional(),
@@ -2107,16 +2604,17 @@ export const RECEIVERS = {
                 removeTags: z.array(z.string()).optional(),
                 dueAt: z.string().nullable().optional(),
                 comment: z.string().optional(),
-            }).optional().describe("The ONE edit applied to every `where` match. title/notes are deliberately absent — those are per-row."),
+            }).optional().describe("The ONE edit applied to every `where` match. title/notes are deliberately absent — those are per-row. TWO ROUTES, AND THIS IS THE NARROWER ONE. `assignee` here is the DIRECT route: you decide the owner, for work whose owner is not in doubt. The DEFAULT is the other route — `tasks:announce` (or `signal(\"world\", {tags})`) walks the weighted tag→receiver paths to whoever STAKED those tags, marks the delivery, and the next route is smarter for it; the CEO is an observer there, not a bottleneck. Prefer the stake route and keep this one for the unambiguous case. And when you read the announce back: its `matched` is reach, never delivery."),
             dryRun: z.boolean().optional().describe("For `where`: defaults TRUE. Pass false to apply. Ignored by edits/creates."),
             cursor: z.string().optional().describe("For `where`: the nextCursor from the previous call"),
-            workspace: z.string().optional().describe("Workspace to act in, for every row. Honoured only if you are staff or control it."),
+            workspace: z.string().optional().describe("Workspace to act in, for every row. Omit for your own. Honoured only if you are staff or control it — otherwise the call is REFUSED ({ok:false, error:'forbidden', workspace}) before any write, never swapped for your own."),
         }).refine((v) => (v.edits?.length ?? 0) + (v.creates?.length ?? 0) > 0 || (!!v.where && !!v.set), {
             message: "send edits, creates, or where+set",
             path: ["edits"],
         }).refine((v) => !v.where === !v.set, { message: "where and set go together", path: ["where"] }),
         response: z.object({
             ok: z.boolean().describe("The CALL's outcome, not the rows'. Read applied/failed."),
+            workspace: z.string().optional().describe("On error:'forbidden' — the requested workspace the caller may not operate."),
             total: z.number().optional(),
             attempted: z.number().optional(),
             applied: z.number().optional(),
@@ -2125,8 +2623,14 @@ export const RECEIVERS = {
             error: z.string().optional(),
             detail: z.string().optional(),
             created: z.record(z.string(), z.string()).optional().describe("ref → tid for every `creates` row that landed"),
-            matched: z.number().optional().describe("`where`: rows the filter matched in total, across all pages"),
+            matched: z.number().optional().describe("`where`: rows the filter matched in total, across all pages. EXACT — unless `truncated` is present, and then it is a FLOOR. Quote it as 'at least N'."),
+            truncated: z.object({
+                rows: z.number().optional().describe("The board snapshot hit its row budget; this many unique rows were read. `matched` is a FLOOR — rows exist that the filter never saw, so the set you are previewing is a subset of the set you asked for."),
+                edges: z.boolean().optional().describe("The dependency branch was capped. `where:{ready:true}` is computed from `blockedBy`, so a row can match as ready while it is in fact blocked."),
+                tags: z.number().optional().describe("The tag branch was capped; this many rows have uncertain tags. A `tags`/`anyTags` filter may have MISSED rows, and the `tags` on the rows returned above may be short."),
+            }).optional().describe("`where`: the budget that bit, named — the same word and the same shape tasks:board serves, because it is the same snapshot. Three budgets, independent, each key present only when THAT one bit. ABSENT MEANS NOTHING WAS CUT — absent and `false` are different answers, so branch on the key's presence and never on its value. This is the field to read rather than the prose in `detail`: `detail` is for a human reading a log, and on an aborted run it is overwritten by the abort reason, while this survives. A receiver that caps, pages or samples names the budget that bit, in the response, every time."),
             matchedIds: z.array(z.string()).optional().describe("`where`: the tids this call covers (the ones it would apply, on dryRun)"),
+            rows: z.array(z.record(z.string(), z.unknown())).optional().describe("`where`, DRY RUN ONLY: the matched rows THEMSELVES — `matchedIds` with its contents attached. Same rows, same order (rows[i].tid === matchedIds[i], element for element), same shape tasks:board serves: tid · name · status · priority · tags · assignee · workspace · parent · blockedBy · dueAt · startAt · createdAt · closedAt · updatedAt · notes. This is what makes the dry run a READ you can judge instead of a count you must take on faith: you see the ≤25 rows you are about to change — their owners, their blockers, their tags — and then re-send the IDENTICAL call with dryRun:false. One filter expression, not two that can disagree about what the set is. Costs nothing: these are the rows the match was computed from, already in hand. ABSENT on an apply — `results` carries a receipt per tid there, and a second copy of the rows is the larger answer to the smaller question. TWO TRAPS. (1) `tags` is the BARE lens — namespaced words (`plan:…`, `cycle:…`, `workspace:…`) and the `@slug` assignee tag are stripped, and `assignee`/`workspace` are DERIVED from the stripped ones. `tags: []` therefore means NO ROUTING WORDS, never 'no tags on this row': measured 2026-09-15, rows carrying six tags each report `tags: []`. (2) A row here is at most `asOf` stale (the 60s board memo) and describes the row BEFORE `set` — never read it back as the result of the write."),
             dryRun: z.boolean().optional(),
             nextCursor: z.string().optional().describe("`where`: present iff more matches remain — resend the same call with this cursor"),
             results: z.array(z.object({
@@ -3265,6 +3769,47 @@ export const RECEIVERS = {
         effect: "signal", cost: "free", reversible: false, idempotent: true, auth: "public",
     }),
     // ── FUNNELS (text/funnels-plan.md) — author + run funnel definitions ──────────
+    // funnel:def-get — READ ONE BACK. The three writers below shipped without it,
+    // so an agent could create, edit and publish a funnel and had no receiver to see
+    // what it had built: the only door was `GET /api/funnels/def`, which
+    // `meta:catalog` cannot name. The row read is `readFunnelDef` in
+    // `lib/funnel/types.ts`, shared verbatim with that route. `manage_lifecycle` is
+    // the label the route's own POST and DELETE already require. The lookup is keyed
+    // on (workspace, id), so another tenant's id reads as not_found — never a leak.
+    "funnel:def-get": receiver({
+        receiver: "funnel:def-get",
+        summary: "Read one funnel definition by id — DRAFT OR PUBLISHED, the operator's read. Another tenant's id answers not_found, never their funnel",
+        request: z.object({
+            workspaceSlug: z.string().optional().describe("Workspace slug; defaults to the attested caller's. A slug you do not control is refused."),
+            funnelId: z.string().describe("The funnel_definitions row id returned by funnel:create"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            def: z.object({
+                id: z.string(),
+                slug: z.string(),
+                workspaceSlug: z.string(),
+                name: z.string(),
+                status: z.string().describe("draft | published"),
+                playbookNode: z.string().optional(),
+                steps: z.array(z.unknown()),
+                edges: z.array(z.unknown()),
+                version: z.number(),
+                createdAt: z.number(),
+                updatedAt: z.number(),
+            }).optional(),
+            error: z.string().optional().describe("missing_fields | forbidden | not_found"),
+        }),
+        effect: "ask",
+        auth: "manage_lifecycle",
+        roleAction: "manage_lifecycle",
+        cost: "free",
+        idempotent: true,
+        reversible: true,
+        settles: "none",
+        version: "1.0.0",
+        examples: [{ funnelId: "6f1c9b2e-0000-4000-8000-000000000000" }],
+    }),
     // funnel:create — create a new funnel definition (draft).
     "funnel:create": receiver({
         receiver: "funnel:create",
@@ -3417,7 +3962,10 @@ export const RECEIVERS = {
     "products:list": receiver({
         receiver: "products:list",
         summary: "List a workspace's storefront products with their prices (public)",
-        request: z.object({ slug: z.string().optional() }),
+        request: z.object({
+            slug: z.string().optional(),
+            collection: z.string().optional().describe("Narrow the catalogue to one collection, matched TRIMMED on both sides (the facet label is derived as `(collection ?? '').trim()`, so an untrimmed predicate would match zero rows and filter everything). Empty or unknown returns the whole catalogue, never an error. Public: it can only narrow rows an anonymous caller could already see — unlike includeDrafts, which is honoured only for the attested owner and is deliberately NOT declared here."),
+        }),
         response: z.object({ products: z.array(z.record(z.string(), z.unknown())).optional(), error: z.string().optional() }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
     }),
@@ -3538,6 +4086,93 @@ export const RECEIVERS = {
         response: z.object({ cid: z.string().optional(), cleared: z.number().optional(), error: z.string().optional() }),
         effect: "ask", cost: "free", reversible: false, idempotent: true, auth: "public",
     }),
+    // ── discounts (C6) — ONE coupon system, two rails ────────────────────────────
+    // There is no `discounts` table. These five receivers read and write the
+    // BILLING coupon tables (one.ie/web/migrations/0077_coupons.sql) widened by
+    // 0253_coupons_scope.sql with a `scope` column, so a seller's SAVE10 can
+    // discount a SaaS credit purchase, a shop cart, or both — one validator, one
+    // pricing core (`priceDiscount`, lib/billing/coupon.ts), one redemption ledger
+    // that records WHAT each redemption was applied to. The operator's ruling,
+    // 2026-09-22: "we should offer saas and ecom customers a discount. same."
+    //
+    // `coupons.code` is GLOBALLY unique, so every storefront statement binds
+    // (code, workspace) TOGETHER — a code alone never reaches another seller's
+    // sale, and an unknown code and a foreign one answer the same `not_found`.
+    "discounts:create": receiver({
+        receiver: "discounts:create",
+        summary: "Mint a storefront discount code as a scoped coupon row — the workspace is the attested caller, never a body field",
+        request: z.object({
+            code: z.string().describe("The code a shopper types. Upper-cased and globally unique: a code another seller already owns answers `code_taken`."),
+            name: z.string().optional().describe("Human label for the seller's console. Defaults to the code."),
+            discount_type: z.enum(["percentage", "fixed_cents"]).describe("`percentage` is unitless and prices both rails. `fixed_cents` is MONEY and prices a cart only — `fixed_credits` is the billing unit and this door will not mint it."),
+            discount_value: z.number().positive().describe("Percent (1-100) or whole cents off. Must be finite and positive: a negative value would invert into a surcharge."),
+            currency: z.string().optional().describe("Currency a `fixed_cents` value is denominated in. Defaults to usd; ignored for a percentage."),
+            scope: z.enum(["storefront"]).optional().describe("Storefront only, and the enum is narrow on purpose. This door does NOT mint a coupon the platform-billing rail can redeem: `both` and `billing` are refused BY NAME (`scope_requires_billing_door`), never silently narrowed. The credits rail is minted at POST /api/billing/coupons, behind `requireAgency`/`locals.controls` — one rail, one door. Until 2026-09-22 `both` was accepted here at `auth:\"member\"`, which made this a second, lower-rung door onto the discount that prices a tenant's own ONE invoice (11.4 security review)."),
+            cadence: z.enum(["once", "repeating", "forever"]).optional().describe("Billing-rail redemption cadence, carried on the shared row. Defaults to `forever`."),
+            max_redemptions: z.number().int().positive().optional().describe("Total redemptions across all buyers before the code answers `exhausted`. Absent = unlimited."),
+            valid_until: z.number().int().optional().describe("Unix SECONDS after which the code answers `expired`. Absent = no expiry."),
+        }),
+        response: z.object({ ok: z.boolean().optional(), code: z.string().optional(), scope: z.string().optional(), workspace: z.string().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+    }),
+    "discounts:list": receiver({
+        receiver: "discounts:list",
+        summary: "List the calling workspace's storefront discount codes with their redemption counts",
+        request: z.object({}),
+        response: z.object({
+            discounts: z.array(z.record(z.string(), z.unknown())).optional().describe("Coupon rows scoped `storefront` or `both`, newest first, each with a live `used` count."),
+            cap: z.number().optional().describe("The row ceiling this read applied. Always present: a capped read must say what bit it."),
+            truncated: z.boolean().optional().describe("TRUE when more rows match than were returned — quote `total` as a floor when it is."),
+            total: z.number().nullable().optional().describe("Exact count when `truncated` is false; null when it is true, because the read never saw the rest."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    "discounts:archive": receiver({
+        receiver: "discounts:archive",
+        summary: "Retire a discount code — deactivates, never deletes, because redemption rows reference it",
+        request: z.object({
+            code: z.string().optional().describe("The code to retire. Either this or `cid`."),
+            cid: z.string().optional().describe("The coupon row id. Either this or `code`."),
+        }),
+        response: z.object({ ok: z.boolean().optional(), code: z.string().nullable().optional(), cid: z.string().nullable().optional(), is_active: z.boolean().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    // The two cart doors are `auth: "public"` for the same reason the rest of
+    // `cart:*` is: `cid` is a server-minted bearer capability, so an anonymous
+    // shopper holds a discount the way they hold a basket. NO AMOUNT CROSSES THE
+    // WIRE IN EITHER DIRECTION — the shopper sends a code, the cart stores a code,
+    // and the money comes off at mint from the coupon row against a server-priced
+    // basket. A stored amount would be the stale-price exploit under a new name.
+    "cart:apply-discount": receiver({
+        receiver: "cart:apply-discount",
+        summary: "Apply a discount code to a cart — the code is stored, never a computed amount",
+        request: z.object({
+            slug: z.string().describe("Seller workspace. Bound together with the code, so a cart never reaches another seller's sale."),
+            cid: z.string().describe("Server-minted cart id — the bearer capability that authorizes this call."),
+            code: z.string().describe("What the shopper typed. Upper-cased before lookup."),
+        }),
+        response: z.object({
+            cid: z.string().optional(),
+            code: z.string().nullable().optional().describe("The coupon's own code as stored, never the raw input."),
+            name: z.string().optional(),
+            discount_type: z.string().optional().describe("`percentage` or `fixed_cents` — read from the coupon row so a cart can render the offer."),
+            discount_value: z.number().optional().describe("From the coupon row. A value in the request body is ignored."),
+            currency: z.string().nullable().optional(),
+            error: z.string().optional().describe("A refusal BY NAME: `not_found` (unknown or another seller's), `inactive`, `expired`, `exhausted`, `wrong_scope` (a billing/credits code on a cart), `cart_not_found`."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
+    }),
+    "cart:remove-discount": receiver({
+        receiver: "cart:remove-discount",
+        summary: "Clear the discount code from a cart",
+        request: z.object({
+            slug: z.string().describe("Seller workspace, scoping the cart."),
+            cid: z.string().describe("Server-minted cart id — the bearer capability."),
+        }),
+        response: z.object({ cid: z.string().optional(), code: z.string().nullable().optional().describe("Always null on success."), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
+    }),
     // ── orders (the one operator write door) — handler lands in resolvers (C5) ─────
     // data-bindings.ts:62 marks `order` create/update/archive as null by design:
     // orders are webhook-minted and otherwise read-only. This is the deliberate
@@ -3550,6 +4185,129 @@ export const RECEIVERS = {
         response: z.object({ oid: z.string().optional(), workspace: z.string().optional(), status: z.string().optional(), error: z.string().optional() }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
     }),
+    // ── orders:mine — the buyer's OWN history (handler: resolvers/storefront/orders-mine.ts) ──
+    // The sibling of orders:status and its opposite: that one is the seller's
+    // single write, this one is the buyer's read of their own purchases.
+    //
+    // `auth: "public"` for the same reason order:claim is — no buyer signs in to a
+    // storefront (orders.workspace is the SELLER; 0177 dropped customer_email and
+    // left customer_uid = SHA-256(lower(email))), so the caller is anonymous and
+    // the proof travels with the request. Declaring it is load-bearing, not
+    // documentation: an UNDECLARED receiver skips bind-receiver's envelope guard
+    // and a flat body validates as {}.
+    //
+    // `token` is the whole identity. It is a MAC this server minted over
+    // (domain, workspace, uid, exp) — lib/orders-link-token.ts — and the handler
+    // RECOMPUTES it, so the buyer id is server-derived, never body-supplied.
+    // There is deliberately NO `customer_uid`, `email` or `buyer` field: a
+    // contract that declares one invites a handler to read it.
+    "orders:mine": receiver({
+        receiver: "orders:mine",
+        summary: "List the buyer's own orders at one shop — identity comes from a signed, short-lived link token, never from the body",
+        request: z.object({
+            workspace: z.string().describe("The SELLER's slug — whose shop these orders were placed at. Bound into the token's MAC, so it narrows the read and cannot widen it."),
+            token: z.string().describe("The signed order-history link token (`<uid>.<exp>.<sig>`), minted server-side and emailed to the address that placed the orders. The ONLY source of buyer identity; forged, tampered or cross-shop tokens are refused before D1 is touched."),
+            oid: z.string().optional().describe("Read ONE order instead of the list. An oid belonging to another buyer answers `not_found` — never `forbidden`, which would confirm the row exists."),
+            cursor: z.string().optional().describe("Keyset cursor `<created_at>:<oid>` from a previous page's `nextCursor`. Absent starts at the newest order."),
+            limit: z.number().int().positive().optional().describe("Page size, default 20, clamped to 50."),
+        }),
+        response: z.object({
+            orders: z.array(z.record(z.string(), z.unknown())).optional().describe("Newest first. Each row: oid, status, amountTotal (cents), currency, createdAt, items[{label, quantity, unitAmount}]. No PII and no payment plumbing — pii_ref, payment_intent, stripe_account and session_id are never selected."),
+            order: z.record(z.string(), z.unknown()).optional().describe("Present instead of `orders` when `oid` was supplied."),
+            total: z.number().optional().describe("EXACT count of this buyer's orders at this shop, over all pages — a COUNT(*), not a floor."),
+            nextCursor: z.string().optional().describe("Present if and only if more rows match. Absent means you have them all; absent is not `false`."),
+            error: z.string().optional().describe("`forbidden` (no/forged/cross-shop token), `link_expired` (a real token past its 30-minute life), `not_found` (an oid that is not this buyer's), `link_not_configured` (the signing secret is unset — fails closed), `workspace_required`, `no_db`."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, settles: "none", auth: "public",
+        examples: [{ workspace: "acme", token: "<uid>.<exp>.<sig>" }],
+    }),
+    // ── orders:send-link — the MINT orders:mine named and did not build ──────────
+    // (handler: resolvers/storefront/orders-send-link.ts)
+    //
+    // `orders:mine` is authorised by a signed link and nothing else, so until some
+    // door MAILED that link the feature had no reachable caller. Its own threat
+    // table says exactly this — "the link MINT — NOT BUILT IN C8 … This is a gap,
+    // not a defence" — and names why it was held back: this is where the
+    // address-enumeration oracle and the send-amplification live.
+    //
+    // `auth: "public"` for the same reason orders:mine and order:claim are: a
+    // storefront buyer holds no ONE session. Declaring it is load-bearing rather
+    // than documentation — an UNDECLARED receiver skips bind-receiver's envelope
+    // guard and a flat body validates as {}.
+    //
+    // TWO FIELDS, AND THE ABSENCES ARE THE CONTRACT. There is no `workspace`, no
+    // `customer_uid`, no `token` and no `actorId`. The token is minted over the
+    // `slug` THIS CALL NAMED — the same string the D1 read was scoped by — so the
+    // credential can never be wider than the query that earned it, and a declared
+    // identity field would be an invitation for a future handler to prefer it.
+    //
+    // `idempotent: true` is the RATE LIMITER's doing, not a no-op's: a repeat
+    // inside the window is refused rather than re-mailed, and the window is keyed
+    // on the submitted address BEFORE any read — a window that only closed after a
+    // match would make the refusal itself the oracle the response shape avoids.
+    "orders:send-link": receiver({
+        receiver: "orders:send-link",
+        summary: "Mail a buyer a signed, short-lived link to their own order history at one shop — the same answer whether or not the address has orders",
+        request: z.object({
+            slug: z.string().describe("The SELLER's slug — whose shop to look in, and the workspace bound into the minted token's MAC. The read and the credential use this one value, so a link can never open a shop this call did not name."),
+            email: z.string().describe("A LOOKUP KEY, never an identity. Lower-cased and SHA-256'd (lib/identity/ladder.ts emailHash) and matched against `orders.customer_uid` — the only buyer-shaped column, since 0177 dropped `customer_email`. Never stored, never echoed, and the PII vault is never opened: the mail goes to the address that was submitted, which IS the matched address by construction."),
+        }),
+        response: z.object({
+            ok: z.boolean().optional().describe("True for every accepted request. Reaching D1 at all means this is true."),
+            sent: z.boolean().optional().describe("ALWAYS true beside `ok:true`, and it is a statement about the REQUEST, never about a message. A match, a miss, a foreign shop, an unsettled order and a dead mail provider all answer identically — a varying field here would be a membership oracle over the seller's whole customer list, one guess per call."),
+            error: z.string().optional().describe("`rate_limited` (one send per address per 15-minute window, counted BEFORE the lookup so the refusal is not an oracle either), `link_not_configured` (the signing secret is unset — fails closed), `no_db`, or the argument refusal, which is the one refusal safe to distinguish because it says nothing about any order."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, settles: "none", auth: "public",
+        examples: [{ slug: "acme", email: "buyer@example.com" }],
+    }),
+    // ── orders:fulfil — the parcel left (handler: resolvers/storefront/fulfilment.ts) ──
+    // The SIBLING of orders:status, and deliberately not a value inside it.
+    // `orders:status` refuses 'shipped' on purpose: nine shipped predicates read
+    // `status IN ('paid','active')` — delivery (api/storefront/download.ts:27,
+    // orderClaim) plus seven revenue rollups — so a fulfilment value in that
+    // column would strand a paid buyer's download AND drop the sale out of
+    // revenue, in one write, silently. Fulfilment therefore gets its own axis
+    // (migration 0254) and its own door. The money axis is never touched here.
+    //
+    // NO `slug` AND NO `workspace` IN THE REQUEST, unlike every sibling above.
+    // That is the contract, not an omission: `oid` is a globally unique PK, so a
+    // body-named workspace would be a second, spoofable answer to "whose order is
+    // this". The handler reads the order by `oid`, takes the workspace OFF THE
+    // ROW, and then walks `callerControlsWorkspace(ctx.ownerSlug, row.workspace)`.
+    // An order the caller does not control answers `not_found` — never
+    // `forbidden`, which would be an existence oracle over every other tenant's
+    // order ids.
+    //
+    // `idempotent: true` is a claim the handler earns rather than asserts: a
+    // repeated UPDATE still reports `changes: 1`, so the re-send check is a
+    // SELECT-then-compare on (carrier, tracking_number, tracking_url) before any
+    // write, and `shipped_at` is stamped once with COALESCE. A corrected tracking
+    // number is a real change and does write — and does re-mail.
+    "orders:fulfil": receiver({
+        receiver: "orders:fulfil",
+        summary: "Mark a paid order shipped with its carrier and tracking, and mail the buyer — the fulfilment axis, never orders.status",
+        request: z.object({
+            oid: z.string().describe("The order's primary key. Globally unique; the workspace is read OFF THE ROW, never from the request — there is deliberately no slug field here."),
+            carrier: z.string().min(1).describe("Carrier as the seller names it, e.g. 'UPS', 'An Post'. Free text: a closed list would refuse a regional courier the seller actually used. Required — an empty carrier in a shipped mail is worse than no mail."),
+            tracking_number: z.string().min(1).describe("The carrier's own tracking number. Required, for the same reason as carrier. Stored verbatim; never normalised, because a corrected number must be distinguishable from the original."),
+            tracking_url: z.string().optional().describe("The carrier's tracking page, if the seller has one. Optional and NEVER synthesised from the carrier name — guessing a URL from 'UPS' is how a buyer lands on the wrong page."),
+        }),
+        response: z.object({
+            ok: z.boolean().optional().describe("True when the order is now recorded shipped, including on an idempotent re-send."),
+            oid: z.string().optional(),
+            workspace: z.string().optional().describe("The order's OWN workspace, echoed from the row — confirmation of which tenant was written, never an input."),
+            fulfilment_status: z.string().optional().describe("'unfulfilled' | 'shipped' | 'delivered'. A separate axis from `status`, which stays 'paid'/'active'."),
+            carrier: z.string().nullable().optional(),
+            tracking_number: z.string().nullable().optional(),
+            tracking_url: z.string().nullable().optional(),
+            shipped_at: z.number().nullable().optional().describe("Unix seconds, stamped ONCE on the first fulfil. A corrected tracking number does not move it."),
+            unchanged: z.boolean().optional().describe("True when this call matched what was already recorded: no row was written and no mail was sent. Absent on a real change."),
+            emailed: z.boolean().optional().describe("Whether a shipped email was ATTEMPTED — not whether it arrived. False when the buyer has no address in the vault (a shredded or never-sealed row), which is a normal state and never fails the fulfilment."),
+            error: z.string().optional().describe("'not_found' covers absent, foreign and unattested alike — a distinguishable refusal would confirm an order id exists in some other shop."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, settles: "none", auth: "member",
+        examples: [{ oid: "ord_1", carrier: "UPS", tracking_number: "1Z999AA10123456784" }],
+    }),
     // ── order:claim — the buyer's delivery door (handler: resolvers/commerce.ts) ──
     // Declared so the route's envelope guard fires: an undeclared receiver skips
     // the `envelope_missing` check, and a flat body silently validates as {}.
@@ -3810,7 +4568,22 @@ export const RECEIVERS = {
             treasury: z.string().optional(),
             receipt: z.object({ id: z.string(), url: z.string() }).optional(),
             claimed: z.boolean().optional(),
-            stage: z.string().optional().describe("Which pay call failed: create | quote | claim"),
+            stage: z.string().optional().describe("Where it stopped. create | quote | claim name the pay call that failed; 'authority' means the two-ledger gate refused BEFORE any pay call ran"),
+            // C10 — ONE AUTHORITY, TWO LEDGERS (resolvers/authority.ts). Before a
+            // transfer is RECORDED, the ONE walk and the on-chain spend-ceiling owner
+            // must agree. These keys are how the response SAYS which of the three
+            // things happened, so no reader has to infer it. All optional: a response
+            // carries the pair that matches its branch, never all of them at once.
+            twoLedgerCheck: z.string().optional().describe("'in_force' = the two-ledger check RAN; twoLedgerVerdict says what it found. 'not_in_force' = the check DID NOT RUN — no SPEND_CEILING_READER is bound, or there is no agent-kind wallet — so nothing here was verified against the chain. Never read 'not_in_force' as a pass"),
+            twoLedgerVerdict: z.string().optional().describe("Only when the check RAN: 'agree' — the ONE walk's key IS the on-chain ceiling owner. 'mismatch' and 'unknown' never reach a success response; both refuse at stage 'authority'"),
+            twoLedgerReason: z.string().optional().describe("Only when twoLedgerCheck is 'not_in_force': why the check did not run — reader_unconfigured | no_agent_wallet"),
+            twoLedgerDetail: z.string().optional().describe("Only when twoLedgerCheck is 'not_in_force': plain-language statement of what was NOT verified, so an absent check can never be mistaken for a passed one"),
+            // The stage 'authority' refusal shape (TwoLedgerRefusal). `cause` is what
+            // tells an operator WHY a transfer was refused; left undeclared, a
+            // response parse would strip exactly that.
+            verdict: z.string().optional().describe("On a stage 'authority' refusal: mismatch | unknown. 'unknown' FAILS CLOSED — an unresolvable read is never 'no objection'"),
+            detail: z.string().optional().describe("On a stage 'authority' refusal: what was refused, and plainly that this refuses to RECORD the transfer — it cannot prevent or reverse an on-chain transfer the caller already signed and broadcast client-side"),
+            cause: z.string().optional().describe("On a stage 'authority' refusal, which read decided it: no_attested_caller | no_snapshot_binding | wallet_read_failed | ceiling_unresolvable | owners_disagree | ceiling_revoked. A public identifier, never a value"),
             error: z.string().optional(),
         }),
         effect: "ask", cost: "variable", reversible: false, idempotent: false, settles: "onchain", auth: "manage_workspace",
@@ -3906,6 +4679,51 @@ export const RECEIVERS = {
         }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
     }),
+    // ── shipping:* — the seller's shipping table (ecommerce-site C5) ───────────
+    // ONE contiguous block, per the plan's collision map. `shipping_rates`
+    // (migration 0252) is the ONLY source of a shipping amount: the mint reads it
+    // and Stripe is handed `shipping_options[].shipping_rate_data.fixed_amount`
+    // built from these rows. No request body — buyer's or seller's — contributes
+    // a number to a checkout, which is pre-mortem 3 of text/ecommerce-site-plan.md.
+    // Both doors are owner-gated by the owners-tree walk: `slug` NAMES the target,
+    // only the walk (callerControlsWorkspace, ctx.ownerSlug, attested) authorizes.
+    "shipping:set": receiver({
+        receiver: "shipping:set",
+        summary: "Create or update one shipping rate for a workspace — the only writer of a shipping amount",
+        request: z.object({
+            slug: z.string().describe("The workspace that OWNS the rate. Names the target only; the attested caller must control it or the call is refused `forbidden`."),
+            srid: z.string().optional().describe("Update this rate. Absent mints a new one."),
+            name: z.string().optional().describe("Displayed to the buyer in Checkout (Stripe caps display_name at 100 chars). Required when minting."),
+            amountCents: z.number().int().min(0).optional().describe("The shipping charge in cents. Server truth — this is the number that reaches Stripe. Required when minting."),
+            currency: z.string().optional().describe("Three-letter ISO code, lowercased. Defaults to 'usd'."),
+            countries: z.array(z.string()).optional().describe("ISO-3166-1 alpha-2 codes this rate serves. EMPTY = everywhere, and one everywhere-rate unconstrains the session's allowed_countries entirely."),
+            freeOverCents: z.number().int().min(0).nullable().optional().describe("Subtotal in cents at or above which this rate costs 0. null = never free. This is also the threshold FreeShippingProgress renders against."),
+            sort: z.number().int().optional().describe("Display order. Stripe shows at most 5 options per session, so the first five by sort are what a buyer sees."),
+            active: z.boolean().optional().describe("false archives the rate without deleting the row an old order settled against."),
+        }),
+        response: z.object({
+            srid: z.string().optional().describe("The rate written."),
+            rates: z.array(z.record(z.string(), z.unknown())).optional().describe("Every active rate for the workspace after the write, in sort order."),
+            error: z.string().optional().describe("`forbidden` (the caller does not control the workspace), `not_found` (no such srid in this workspace), or a named validation refusal."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+        examples: [{ slug: "acme", name: "Standard", amountCents: 599, freeOverCents: 5000 }],
+    }),
+    "shipping:list": receiver({
+        receiver: "shipping:list",
+        summary: "List a workspace's shipping rates — the seller's own table, owner-gated",
+        request: z.object({
+            slug: z.string().describe("The workspace whose rates to read. Names the target only; the attested caller must control it."),
+            includeArchived: z.boolean().optional().describe("Include rows with active = 0. Default false."),
+        }),
+        response: z.object({
+            rates: z.array(z.record(z.string(), z.unknown())).optional().describe("Rates in sort order: { srid, name, amount_cents, currency, countries, free_over_cents, sort, active }."),
+            taxEnabled: z.boolean().optional().describe("Whether this seller has switched Stripe Tax on (owners.storefront_tax_enabled). OFF by default — automatic_tax on an account whose tax setup is incomplete errors or calculates zero."),
+            error: z.string().optional().describe("`forbidden` when the attested caller does not control the workspace."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+        examples: [{ slug: "acme" }],
+    }),
     // ── view:* — saved views (custom-views C1). A view is a workspace-scoped Thing (world_things type 'view'). ──
     "view:create": receiver({
         receiver: "view:create",
@@ -3944,21 +4762,195 @@ export const RECEIVERS = {
         response: z.object({ ok: z.boolean(), id: z.string().optional(), error: z.string().optional() }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
     }),
-    // ── pages + workspace settings — handlers in resolvers/pages.ts ────────────────
-    "pages:create": receiver({
-        receiver: "pages:create",
+    // ══════════════════════════════════════════════════════════════════════════
+    // blocks: — the BLOCK VOCABULARY. Handlers in resolvers/blocks.ts.
+    //
+    // `pages:*` could always DELIVER a page; nothing could say what a page may be
+    // made of. Measured 2026-09-21: `blocks:`, `puck:` and `component:` were all
+    // absent from the 361-receiver catalog, so a client with the whole page rail
+    // still had to guess a component name out of 278 and a prop name out of that
+    // member's own spelling. Both guesses fail SILENTLY — an unknown component is
+    // stored and paints nothing, and a prop from the wrong family member survives
+    // every filter and renders nothing (`@oneie/sdk/blocks`, the 2026-08-19
+    // measurement: six model-written hero fields, zero visible).
+    //
+    // Both doors are PURE PROJECTIONS over `block-manifest.json`, the artifact
+    // `.claude/scripts/blocks-manifest.mjs` generates from the live Puck registry.
+    // Nothing is hand-declared here — a count this door states is a count it
+    // walked, which is why `total` is the entries seen and never the manifest's
+    // own header claim.
+    //
+    // No `auth` label, matching `meta:types`: the registry is first-party code,
+    // identical for every caller, and an omitted label is not the same as a
+    // mis-spelled one (an UNRECOGNISED label falls to `authenticated` — see the
+    // `git:pr` note). Scope is still read off the attested `ctx.ownerSlug` and
+    // never a body field, so the tenant axis is additive rather than a re-auth.
+    // ══════════════════════════════════════════════════════════════════════════
+    "blocks:list": receiver({
+        receiver: "blocks:list",
         surfaces: { mcp: true },
-        summary: "Create a workspace page (draft) from a title + sections",
-        request: z.object({ slug: z.string(), title: z.string(), sections: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })), pageSlug: z.string().optional() }),
-        response: z.object({ ok: z.boolean(), slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(), error: z.string().optional() }),
-        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
-    }),
-    "pages:edit": receiver({
-        receiver: "pages:edit",
-        summary: "Edit a workspace page's title or sections",
-        request: z.object({ slug: z.string(), page: z.string(), title: z.string().optional(), sections: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })).optional() }),
-        response: z.object({ ok: z.boolean(), slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(), error: z.string().optional() }),
-        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+        summary: "Discover the page blocks that exist — name, category, surface, description and variant list, filterable and paged",
+        request: z.object({
+            category: z.string().optional().describe("Exact category filter: ai · app · auth · content · data · ecommerce · email · learning · marketing · social · wallet. Read `facets.categories` for the live list."),
+            surface: z.string().optional().describe("Exact surface filter: section · container · atomic · app · social-preview — how much chrome the block may carry."),
+            search: z.string().optional().describe("Case-insensitive substring over name + description + category."),
+            limit: z.number().optional().describe("Rows per page. Default 50, max 200."),
+            cursor: z.string().optional().describe("Opaque offset from a previous response's `nextCursor`. The order is by name, so a cursor is stable."),
+        }),
+        response: z.object({
+            ok: z.literal(true),
+            workspace: z.string().nullable().describe("The attested caller's slug, or null when anonymous. Never echoed from the request."),
+            blocks: z.array(z.object({
+                name: z.string(),
+                source: z.enum(["registry", "tenant"]).describe("`registry` is ONE's first-party Puck registry; `tenant` is a composition THIS workspace declared with `blocks:declare`. A tenant key can never shadow a registry name — the declare door refuses one that does."),
+                category: z.string(),
+                surface: z.string(),
+                description: z.string(),
+                icon: z.string(),
+                chatFit: z.string(),
+                pagesUsing: z.number().describe("How many stored pages hold an instance, at the manifest's `measuredAt`. A popularity signal, not a live count — always 0 for a tenant block."),
+                canonicalVariant: z.string().optional().describe("The variant that renders when none is sent. Absent on a block that is not a collapsed family, and on a tenant block."),
+                variants: z.array(z.string()).optional().describe("The variant values this family accepts. Absent on a non-family block."),
+                composedOf: z.array(z.string()).optional().describe("TENANT ONLY — the registry components this composition expands into, in render order."),
+            })),
+            total: z.number().describe("Rows matching the filters BEFORE paging — exact. Tenant rows are counted in it and sort first."),
+            returned: z.number().describe("Rows in this response."),
+            registryTotal: z.number().describe("Every block in the registry, ignoring filters."),
+            tenantTotal: z.number().describe("The caller's own declared blocks matching the filters. 0 for an anonymous caller — this axis is read off the attested slug, never a body field."),
+            measuredAt: z.string().describe("When the manifest this projects was generated."),
+            nextCursor: z.string().optional().describe("Present ⟺ more rows match. Absent means you have them all."),
+            truncated: z.object({
+                rows: z.number().describe("How many matching rows are NOT in this response."),
+                limit: z.number().describe("The budget that bit."),
+                reason: z.literal("page"),
+            }).optional().describe("Present ⟺ rows were cut. ABSENT IS NOT FALSE — an uncut answer carries no `truncated` key."),
+            stale: z.object({ declared: z.number(), actual: z.number() }).optional()
+                .describe("Present ⟺ the manifest's own header count disagrees with its contents. Regenerate with `node .claude/scripts/blocks-manifest.mjs`."),
+            facets: z.object({ categories: z.array(z.string()), surfaces: z.array(z.string()) })
+                .describe("Every value the filters accept, read off the registry — never hand-listed."),
+        }),
+        effect: "ask", cost: "free", idempotent: true, reversible: true,
+        examples: [{ category: "marketing", limit: 20 }],
+    }),
+    "blocks:schema": receiver({
+        receiver: "blocks:schema",
+        surfaces: { mcp: true },
+        summary: "Read one block's full prop contract — per-variant fields, the block's own heading/body/cta/image mapping, and the props the render reads that the editor cannot express",
+        request: z.object({
+            block: z.union([z.string(), z.array(z.string())])
+                .describe("One block name, or up to 10. A retired or family-member name (HeroCentered, Wallet) resolves to its canonical and is reported in `aliasOf` — it is NOT unknown."),
+        }),
+        response: z.object({
+            ok: z.literal(true),
+            workspace: z.string().nullable(),
+            blocks: z.array(z.object({
+                name: z.string().describe("The name as asked."),
+                source: z.enum(["registry", "tenant"]),
+                component: z.string().describe("The REGISTERED component this name draws. Differs from `name` only for an alias, and for a tenant block it is the FIRST member."),
+                aliasOf: z.string().optional().describe("Present ⟺ `name` is a retired or collapsed member name that the render path rewrites."),
+                aliasVariant: z.string().optional(),
+                label: z.string().optional().describe("TENANT ONLY."),
+                composedOf: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })).optional()
+                    .describe("TENANT ONLY — the registry blocks this composition expands into, with the props bound to each. There is no synthetic field table for a tenant block: ask `blocks:schema` for `propsLandOn` to learn what a placement may set."),
+                propsLandOn: z.string().optional().describe("TENANT ONLY — the member a placement's own props merge onto (always the first). Stored-wins."),
+                category: z.string().optional().describe("Absent on a tenant block."),
+                surface: z.string().optional().describe("Absent on a tenant block."),
+                description: z.string().optional(),
+                canonicalVariant: z.string().nullable().optional().describe("REGISTRY ONLY — the member that renders when no `variant` prop is sent."),
+                declaredProps: z.array(z.string()).optional().describe("REGISTRY ONLY. Every prop name the collapsed registration accepts. A SUPERSET of what any one variant reads — a prop from the wrong member is accepted and renders nothing, which is why `variants` below is the real answer."),
+                options: z.record(z.string(), z.array(z.unknown())).optional().describe("REGISTRY ONLY — legal values for each enum-shaped prop."),
+                variants: z.record(z.string(), z.object({
+                    fields: z.record(z.string(), z.object({
+                        type: z.string().optional(),
+                        of: z.array(z.string()).optional().describe("For an array field — the keys each ITEM object takes."),
+                        options: z.array(z.unknown()).optional(),
+                    })).describe("The props the member that renders THIS variant actually reads. Write to these names."),
+                    semantics: z.record(z.string(), z.string()).describe("This block's own role → prop map: heading · body · cta · image. `{}` is honest for a Spacer."),
+                    renders: z.record(z.string(), z.array(z.string())).optional().describe("Props the render reads that the editor's fields cannot express — nested array item keys, mostly."),
+                })).optional().describe("REGISTRY ONLY — keyed by variant value; the single key '' for a block that is not a collapsed family."),
+            })),
+            unknown: z.array(z.string()).describe("Names the registry does not know, in the caller's own spelling. ALWAYS PRESENT, empty when every name resolved — a caller must be able to branch on this rather than infer it from a short list."),
+            total: z.number().describe("Distinct names asked for."),
+            returned: z.number().describe("Rows in `blocks` — registry and tenant together."),
+            truncated: z.object({
+                rows: z.number(),
+                limit: z.number(),
+                reason: z.literal("names").describe("More than 10 names were asked for; the rest were not read."),
+            }).optional().describe("Present ⟺ names were cut. Absent is not false."),
+            stale: z.object({ declared: z.number(), actual: z.number() }).optional(),
+        }),
+        effect: "ask", cost: "free", idempotent: true, reversible: true,
+        examples: [{ block: "Hero" }, { block: ["Faq", "Pricing"] }],
+    }),
+    // blocks:declare — a TENANT BLOCK is a named composition of existing registry
+    // blocks with bound props. Declarative data, never uploaded code: the manifest
+    // can name only components `classifyBlockName` already knows, so every tenant
+    // block inherits `withChrome`, the 6-token palette and the R2 image field for
+    // free — those are properties of the components it composes.
+    //
+    // No new entity and no new `thing-type`. The manifest rides
+    // `workspace_settings.blocks`, the same JSON-column idiom `world:declare-types`
+    // uses for `manifest` and `theme`/`mcp_settings`/`lenses`/`sources` use beside
+    // it, and it is the precedent this door copies down to the authority rule:
+    // the row is keyed on the ATTESTED caller (`ctx.ownerSlug`), a `group` in the
+    // body is an ADDITIONAL gate that must be a workspace the caller controls, and
+    // it is never the destination. A body slug names a target; it never authorizes
+    // one.
+    //
+    // REPLACE, not patch — read your manifest from `blocks:list` and send the
+    // whole array back. And the write is ALL OR NOTHING: one unknown component
+    // refuses the manifest and names every offender, because a half-landed
+    // vocabulary is a vocabulary that lies about what it can render.
+    //
+    // Expansion happens at the PAGE WRITE boundary (`pages:create`,
+    // `pages:add-block`), not at render, so a stored page holds ordinary registry
+    // blocks and no page render pays a tenant read. The cost is that expansion is
+    // a SNAPSHOT: editing a composition later does not rewrite pages already built
+    // from it.
+    "blocks:declare": receiver({
+        receiver: "blocks:declare",
+        surfaces: { mcp: true },
+        summary: "Declare this workspace's own named block compositions — each one an ordered list of existing registry blocks with bound props. Replaces the whole manifest",
+        request: z.object({
+            blocks: z.array(z.object({
+                key: z.string().describe("The name a page will use. Letters and digits, 2-64 chars, starting with a letter. MUST NOT be a registry or alias name — `Hero` means Hero in every workspace."),
+                label: z.string().optional(),
+                description: z.string().optional(),
+                blocks: z.array(z.object({
+                    component: z.string().describe("A registry block name (or an alias, which is stored resolved to its canonical). Anything else refuses the whole write."),
+                    props: z.record(z.string(), z.unknown()).describe("The props bound to this member. Write to the names `blocks:schema` reports for the variant that renders."),
+                })).describe("1-8 registry blocks, in render order."),
+            })).describe("The whole manifest, max 50. An empty array clears it."),
+            group: z.string().optional().describe("OPTIONAL extra gate — a workspace the caller must control. It is NEVER the destination: the manifest is always written to the attested caller's own row."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional().describe("The row that was written — the ATTESTED caller, never `group`."),
+            count: z.number().optional().describe("Tenant blocks now declared."),
+            error: z.string().optional(),
+            errors: z.array(z.string()).optional().describe("Every reason the manifest was refused, each naming the offending key or component. Present ⟺ `error` is `invalid_manifest`; nothing was written."),
+        }),
+        effect: "ask", auth: "manage_things", cost: "free", idempotent: true, reversible: true,
+        examples: [{ blocks: [{ key: "AcmeHero", label: "Acme hero", blocks: [{ component: "Hero", props: { variant: "centered", heading: "Move with confidence" } }] }] }],
+    }),
+    // ── pages + workspace settings — handlers in resolvers/pages.ts ────────────────
+    "pages:create": receiver({
+        receiver: "pages:create",
+        surfaces: { mcp: true },
+        summary: "Create a workspace page (draft) from a title + sections",
+        request: z.object({ slug: z.string(), title: z.string(), sections: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })), pageSlug: z.string().optional() }),
+        response: z.object({
+            ok: z.boolean(), slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(), error: z.string().optional(),
+            unknownBlocks: z.array(z.string()).optional().describe("Block names in this page that the renderer CANNOT DRAW, in your own spelling. The page was still created — the names are stored and will paint nothing. PRESENT ⟺ at least one name was unknown; absent means every name resolved (absent is not an empty array). A retired or collapsed family member name (HeroCentered, Wallet) is NOT listed: the render path rewrites it. Repair with `pages:update-block`, and read `blocks:list` / `blocks:schema` for the names that exist."),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+    }),
+    "pages:edit": receiver({
+        receiver: "pages:edit",
+        summary: "Edit a workspace page's title or sections",
+        request: z.object({ slug: z.string(), page: z.string(), title: z.string().optional(), sections: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })).optional() }),
+        response: z.object({ ok: z.boolean(), slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
     }),
     "pages:list": receiver({
         receiver: "pages:list",
@@ -3985,8 +4977,20 @@ export const RECEIVERS = {
     'pages:publish-pack': receiver({
         receiver: "pages:publish-pack",
         summary: "Publish all (or a listed subset of) a workspace's draft pack pages in one call — the go-live step. Reuses pages:publish's exact UPDATE, looped once, gated once.",
-        request: z.object({ slug: z.string(), pages: z.array(z.union([z.string(), z.object({ slug: z.string() })])).optional() }),
-        response: z.object({ ok: z.boolean(), published: z.number().optional(), error: z.string().optional() }),
+        request: z.object({
+            slug: z.string(),
+            pages: z.array(z.union([z.string(), z.object({ slug: z.string() })])).optional(),
+            shopPack: z
+                .boolean()
+                .optional()
+                .describe("C9.6 — publish only the pages carrying a shop_role, the storefront go-live in one action. SCOPES the bare call rather than widening it: without it an unrelated half-written draft in the same workspace would go live too. Ignored when `pages` names a subset."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            published: z.number().optional(),
+            scope: z.string().optional().describe('"shop" when shopPack narrowed the set; absent means every draft was in scope'),
+            error: z.string().optional(),
+        }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
     }),
     // WHY THIS IS DECLARED. `pages:delete` shipped as a resolver with no registry
@@ -4038,6 +5042,123 @@ export const RECEIVERS = {
         // envelope cannot be conditional. publish/unpublish are each other's undo.
         effect: "ask", cost: "free", reversible: false, idempotent: true, auth: "member",
     }),
+    // ── C9 · the shop pack's fill doors (text/ecommerce-site-todo.md § C9) ──
+    // ONE contiguous block, per the plan's collision map: six cycles write to this
+    // file and each owns a block it can rebase whole.
+    //
+    // `pages:instantiate-shop-pack` — the seeder these two fill — IS NOW DECLARED,
+    // immediately below. C9 left it out and said why: declaring it would newly
+    // subject `api/billing/stripe/connect/status.ts:119` to edge zod and an auth
+    // floor. The 11.4 security review measured the cost of leaving it out, which is
+    // larger: an anonymous Origin-only POST to /api/ask/pages:instantiate-shop-pack
+    // reached the RESOLVER (`{"ok":false,"error":"not authorized for \"shop-demo\""}`)
+    // where every declared sibling was stopped at the ENVELOPE with
+    // `required:member, callerRole:anonymous`. An undeclared receiver has no request
+    // schema and no auth label, so `requiresAttestedCaller(undefined)` is false and
+    // the edge waves the call through — one resolver-side check was the whole
+    // defence, and its refusal echoed the target workspace slug back to a caller who
+    // had proved nothing.
+    //
+    // THE LIVE CALLER IS UNAFFECTED, and that is measured rather than hoped.
+    // `auth: "member"` resolves through AUTH_POLICY to the `authenticated` class,
+    // and `applyAuth` (one.ie/web/src/lib/bind-receiver.ts) returns early for any
+    // ctx carrying an ownerSlug; status.ts dispatches with
+    // `{ ownerSlug: slug, viewer: 'owner' }`. Only the `tenant` class throws, and no
+    // label used here is in it. Request validation in the binder is WARN-ONLY, so an
+    // in-process caller is not newly parsed either. Pinned by §5.2 of
+    // tests/unit/pages/instantiate-shop-pack.test.ts, which runs that exact body and
+    // that exact ctx through `bindReceiver` and asserts twelve pages still seed.
+    "pages:instantiate-shop-pack": receiver({
+        receiver: "pages:instantiate-shop-pack",
+        summary: "Seed the whole storefront anatomy as twelve draft pages in one call, each stamped with the job it does. Idempotent by the DATABASE, not by this call: a partial unique index on (workspace, shop_role) holds the at-most-one, so a second call creates nothing and a renamed page is still recognised.",
+        request: z.object({
+            slug: z
+                .string()
+                .optional()
+                .describe("which workspace. NOT an authority claim — the caller is authorized by the attested ctx through the same callerControlsWorkspace walk every pages:* receiver uses. Absent = the caller's own workspace."),
+        }),
+        response: z.object({
+            ok: z.boolean().optional().describe("Describes THE CALL. `false` with a named `error` is the only refusal shape; a partial seed answers false AND carries the pages it managed."),
+            pages: z
+                .array(z.object({
+                pageSlug: z.string().describe("The pack's own id for the page — the proposal, not the stored row."),
+                slug: z.string().describe("The slug the row ACTUALLY carries, read back from the table. On a second call this is the existing `home`, never the `home-2` the minter proposed."),
+                shopRole: z.string().describe("What the page IS (`home`, `faq`, `terms` …). The title is what it is called this week; the role is the identity the index is unique on."),
+                title: z.string(),
+                url: z.string().describe("`/p/<slug>`, built from the read-back slug."),
+                created: z.boolean().describe("TRUE only when THIS call inserted the row. False = it was already there."),
+            }))
+                .optional()
+                .describe("One entry per pack page, in pack order — present even on a partial failure, so a caller can see how far the seed got."),
+            created: z.number().optional().describe("How many rows this call inserted. 0 on every call after the first."),
+            existing: z.number().optional().describe("pages.length - created — the rows that were already there."),
+            slug: z.string().optional().describe("The `home` role page's slug, kept because the live Stripe-Connect caller predates the per-page rows."),
+            url: z.string().optional().describe("The `home` role page's url."),
+            error: z.string().optional().describe("`missing slug`, `no_db`, `no_pack`, `seed_failed:<role>`, or the authority walk's own reason."),
+        }),
+        effect: "ask", cost: "free", reversible: false, idempotent: true, auth: "member",
+    }),
+    "pages:fill-shop-pack": receiver({
+        receiver: "pages:fill-shop-pack",
+        summary: "Write a seller's real business facts into their twelve seeded shop pages. Fills the LIVE rows, so an edit made between seeding and filling survives. A fact not supplied keeps its visible placeholder — never an invented threshold, address or returns window.",
+        request: z.object({
+            slug: z
+                .string()
+                .optional()
+                .describe("which workspace. NOT an authority claim — the caller is authorized by the attested ctx through the same callerControlsWorkspace walk every pages:* receiver uses. Absent = the caller's own workspace."),
+            facts: z
+                .object({
+                identity: z.object({
+                    businessName: z.string().describe("the shop's name — the one required fact; everything else may be withheld"),
+                    whatYouSell: z.string().optional().describe('"Hand-thrown stoneware" — the noun phrase the home hero is built around'),
+                    heroImage: z.string().optional().describe("URL of the photograph the home hero is built around — fills the `[Hero image]` token. Withheld = no hero image, never a stock photo of somebody else's product"),
+                    founderName: z.string().optional(),
+                    foundedYear: z.number().optional(),
+                }),
+                commerce: z.object({
+                    currency: z.string().describe("ISO 4217, e.g. EUR. Rendered as a symbol where one is known, else as the code — never a guessed symbol"),
+                    freeShippingOver: z.number().optional().describe("order value above which delivery is free. 0 is a REAL answer (free on everything), not 'unknown'"),
+                    returnDays: z.number().optional().describe("days a buyer has to return. 0 is a REAL answer (no window), not 'unknown'"),
+                }),
+                contact: z.object({
+                    email: z.string().optional(),
+                    postalAddress: z.string().optional(),
+                    phone: z.string().optional(),
+                    openingHours: z.string().optional().describe('"9–17" — rendered inside the pack\'s own "Mon-Fri …" copy'),
+                    responseWindow: z.string().optional().describe('"two working days" — how fast a privacy request is answered'),
+                }),
+                policies: z
+                    .object({
+                    jurisdiction: z.string().optional().describe("whose law governs, and whose data authority a buyer may complain to"),
+                    effectiveDate: z.string().optional().describe("as the merchant wants it printed — never derived from the clock"),
+                })
+                    .optional(),
+                source: z.object({ url: z.string().optional() }).optional().describe("where the facts came from, when they were extracted rather than typed"),
+            })
+                .describe("ShopBusinessFacts — lib/puck/fill-shop-pack.ts is the type of record"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            filled: z.number().optional().describe("how many role pages were rewritten"),
+            roles: z.array(z.string()).optional().describe("which shop_role each rewritten page holds"),
+            error: z.string().optional().describe("`not_seeded` = no page carries a shop_role yet; call pages:instantiate-shop-pack first"),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    "pages:fill-shop-pack-extract": receiver({
+        receiver: "pages:fill-shop-pack-extract",
+        summary: "Best-effort ShopBusinessFacts from the seller's own site — fetch-then-confirm, never fetch-then-apply. Returns candidate facts for a form to pre-fill; nothing here writes a page. Reuses the movers SSRF guard (shape + fail-closed DNS, re-run on every redirect hop).",
+        request: z.object({
+            slug: z.string().optional().describe("which workspace. Authorized from ctx, never from this field; absent = the caller's own"),
+            url: z.string().describe("the seller's own site. Refused by name as `blocked_host` when the SSRF guard — or any redirect hop's guard — says private"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            facts: z.record(z.string(), z.unknown()).optional().describe("CANDIDATE facts for a human to correct — never applied by this call"),
+            error: z.string().optional().describe("`invalid_url` · `blocked_host` · `fetch_failed` · `no_content` · `extract_failed`"),
+        }),
+        effect: "ask", cost: "variable", reversible: true, idempotent: true, auth: "member",
+    }),
     "pages:fill-pack": receiver({
         receiver: "pages:fill-pack",
         summary: "Fill a pack's instantiated pages with real business facts — one call, still drafts. Never fabricates a testimonial; pricing derives from one rate, not typed per page.",
@@ -4115,6 +5236,234 @@ export const RECEIVERS = {
         response: z.object({ ok: z.boolean(), slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(), restoredTs: z.number().optional(), error: z.string().optional() }),
         effect: "ask", cost: "free", reversible: false, idempotent: false, auth: "member",
     }),
+    // ── gap-pages · ten pages:* doors that RESOLVED but were never DECLARED ──────
+    //
+    // Each of these has shipped a handler in `one.ie/web/src/lib/resolvers/pages.ts`
+    // for months and reached it only through the undeclared-receiver escape hatch —
+    // no edge zod parse, no auth floor, and invisible to `meta:catalog`, so the
+    // `pages:` rail under-reported itself by ten.
+    //
+    // WHAT DECLARING TURNS ON, and why each schema below is derived rather than
+    // designed. `/api/ask` dispatches `validation.payload`, which is zod's PARSED
+    // output, so a field a live caller sends that the schema omits is SILENTLY
+    // STRIPPED before the handler reads it. Every shape here was read off the
+    // handler AND off every live caller first:
+    //
+    //   channels/src/tools/pages.ts        get · children · update-block ·
+    //                                      add-block · remove-block · move-block · rename
+    //   components/live-edit/LiveEditShell.tsx   get · add-block · update-block
+    //                                      (`runBlockOp` sends `{slug, page, ...opData}`)
+    //   components/live-edit/LiveEditSheet.tsx   move-block · add-block · remove-block
+    //   components/chat/BlockFrame.tsx     add-block   ·  components/puck/AddToPage.tsx  add-block
+    //   components/puck/{MoversIntakeForm,PageCreator}.tsx  instantiate-pack
+    //   scripts/demo-instantiate-movers.ts instantiate-pack
+    //   lib/workflow-templates.ts          instantiate-pack (tool step, args `{slug}`)
+    //   channels/src/cron.ts               optimize (`pages-optimize-tick`, `data: {}`)
+    //   pages/api/pages/[slug]/experiments.ts    propose (in-process dispatchReceiver)
+    //
+    // `actorId` IS NOT DECLARED, on purpose, and the channels tools send it on
+    // seven of these. It is the exact reasoning `pages:delete` records above:
+    // `pagesDenyReason` authorizes off `ctx` alone and its `data` argument is
+    // documented unused (`resolvers/_shared.ts` — the body-`actorId` fallback was a
+    // spoofable alternate authority path and was DELETED, not patched). Declaring
+    // it would publish a field nothing consumes and invite a caller to think it
+    // authorizes something. It is stripped at the edge and nothing reads it.
+    //
+    // `auth: "member"` on all ten, for `pages:delete`'s reason: it is what every
+    // declared sibling in this family carries, and those siblings are called by the
+    // same channels tools over the same gateway hop, so the floor is measured
+    // rather than reasoned. It resolves to `authenticated` in AUTH_POLICY, so the
+    // in-process binder warns rather than refuses; what it does change is the HTTP
+    // edge, where `requiresAttestedCaller("member")` now stops an ANONYMOUS caller
+    // at the envelope instead of letting it reach the resolver to be refused there
+    // — the same gain `pages:instantiate-shop-pack` was declared for.
+    //
+    // And `member` installs NO per-node floor, which is the mechanical half of why
+    // it is the safe label: it is not one of the 40 `RoleAction` names, so
+    // `roleActionFor()` answers `undefined` and `decide(principal, node, action)` is
+    // never consulted. `update_group` — which the channels tools declare as their
+    // own tool CAPABILITY — IS an action name, and picking it here would have
+    // installed a floor nothing upstream argued for, on top of resolving to
+    // `tenant`, which AUTH_POLICY enforces rather than warns.
+    // ── the four block-addressed mutators (lossless; every untouched block survives)
+    "pages:add-block": receiver({
+        receiver: "pages:add-block",
+        summary: "Insert ONE block into a page at a position (default: append). Every other block is preserved verbatim — the targeted alternative to pages:edit's full-page rewrite.",
+        request: z.object({
+            slug: z.string().describe("The WORKSPACE slug. Names which workspace; it never authorizes one — the caller clears `pagesDenyReason`'s attested walk."),
+            page: z.string().describe("The page's own slug."),
+            section: z.object({
+                component: z.string().describe("A block name. Letters and digits, starting with a letter — anything else is refused as `invalid section`. Any of the registry blocks, not only the CRO subset `pages:edit` allowlists, plus any tenant block `blocks:declare` named."),
+                props: z.record(z.string(), z.unknown()).optional().describe("The block's props, sent VERBATIM — the server runs `normalizeBlockProps` and does not fill defaults for you. Omitted is treated as `{}` by the handler."),
+            }),
+            atIndex: z.number().int().min(0).optional().describe("0-based insert position. Omitted = append at the end."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            blocks: z.number().optional().describe("How many blocks the page holds AFTER the insert."),
+            updatedAt: z.number().optional().describe("The write's timestamp, epoch ms."),
+            unknownBlocks: z.array(z.string()).optional().describe("PRESENT ⟺ the name is one the renderer CANNOT DRAW. The block was still stored and will paint nothing; repair with `pages:update-block`. An ALIASED or collapsed family name (HeroCentered, Wallet) is NOT listed — the render path rewrites it."),
+            expandedFrom: z.string().optional().describe("Present ⟺ `section.component` was a TENANT block; this is the name that was sent."),
+            expandedInto: z.array(z.string()).optional().describe("The registry block names the tenant block expanded into, in order. Expansion is a SNAPSHOT: editing the composition later does not rewrite this page."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+    }),
+    "pages:update-block": receiver({
+        receiver: "pages:update-block",
+        summary: "Merge new props into ONE block by id — a SHALLOW merge, so send only the top-level keys you are changing. Every other block is preserved verbatim.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+            blockId: z.string().describe("The block's id, as `pages:get` reports it in `blocks[]`."),
+            props: z.record(z.string(), z.unknown()).describe("REQUIRED and must be an object — a missing or non-object value is refused `props must be an object`. Shallow-merged over the block's existing props, so a nested object is REPLACED, not deep-merged."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            blocks: z.number().optional(), updatedAt: z.number().optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    "pages:remove-block": receiver({
+        receiver: "pages:remove-block",
+        summary: "Drop ONE block from a page by id. Every other block is preserved verbatim. NOT undoable through this door — the page's prior state lives only in a pages:versions snapshot if one was taken.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+            blockId: z.string().describe("The block's id, as `pages:get` reports it in `blocks[]`."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            blocks: z.number().optional(), updatedAt: z.number().optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: false, idempotent: false, auth: "member",
+    }),
+    "pages:move-block": receiver({
+        receiver: "pages:move-block",
+        summary: "Reorder ONE block to a new index. Every block keeps its props; only the order changes.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+            blockId: z.string().describe("The block's id, as `pages:get` reports it in `blocks[]`."),
+            toIndex: z.number().int().min(0).describe("0-based destination index."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            blocks: z.number().optional(), updatedAt: z.number().optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    // ── the two block-tree reads ────────────────────────────────────────────────
+    "pages:get": receiver({
+        receiver: "pages:get",
+        summary: "Read one page as the EDITOR sees it — title, the lossless blocks[] (every block, every type, with its id) and the legacy CRO sections[]. Drafts included; call this before any block-addressed edit. pages:view is the public, published-only read.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(), title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            updatedAt: z.number().optional(),
+            blocks: z.array(z.object({ id: z.string(), type: z.string(), props: z.record(z.string(), z.unknown()) })).optional().describe("THE LOSSLESS READ — every block on the page including the types the CRO `sections` schema cannot carry. `id` is what `pages:update-block` / `remove-block` / `move-block` target."),
+            sections: z.array(z.object({ component: z.string(), props: z.record(z.string(), z.unknown()) })).optional().describe("The legacy CRO-subset view, derived from the canonical blob. LOSSY by design — a non-CRO block is absent here and present in `blocks[]`. Never edit from this."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    "pages:children": receiver({
+        receiver: "pages:children",
+        summary: "Walk a page's own block tree and return every ChildPageBlock's target slug. ONE LEVEL ONLY — never transitive into the embedded page's own tree.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional(),
+            childPages: z.array(z.string()).optional().describe("The page slugs this page embeds, one level deep."),
+            childBlocks: z.array(z.object({ id: z.string(), type: z.string() })).optional().describe("The blocks that carry those embeds, so a caller can address one."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+    }),
+    // ── address + pack + the experiment ratchet ─────────────────────────────────
+    "pages:rename": receiver({
+        receiver: "pages:rename",
+        summary: "Change a page's URL slug. OLD LINKS BREAK — the page moves to /p/<newSlug> and the old path serves nothing.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's CURRENT slug."),
+            newSlug: z.string().describe("The new slug. The collision check is GLOBAL, not per-workspace (`/p/<slug>` resolves by slug alone), so a slug any workspace already serves is refused `slug_taken`. Renaming to the same slug is refused `slug_unchanged`."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            slug: z.string().optional().describe("The NEW slug on success."),
+            title: z.string().optional(), url: z.string().optional(), status: z.string().optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+    }),
+    "pages:instantiate-pack": receiver({
+        receiver: "pages:instantiate-pack",
+        summary: "Seed the whole movers anatomy as ten draft pages in ONE call. NOT idempotent — a second call creates a second set, deduped by slug (home → home-2). pages:instantiate-shop-pack is the storefront's role-keyed equivalent, and that one IS idempotent.",
+        request: z.object({
+            slug: z.string().describe("The workspace to seed. Names which workspace; the attested `callerControlsWorkspace` walk decides whether this caller may."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            pages: z.array(z.object({
+                pageSlug: z.string().describe("The pack's own key for this page — STABLE across calls."),
+                slug: z.string().describe("The real slug that was minted, which differs from `pageSlug` whenever one was already taken."),
+                title: z.string(),
+                url: z.string(),
+            })).optional().describe("The created pages, in MOVERS_PACK order. `pages:fill-pack` takes this array unchanged — same field names, no reshape step exists in the eight workflow kinds."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: false, idempotent: false, auth: "member",
+    }),
+    "pages:optimize": receiver({
+        receiver: "pages:optimize",
+        summary: "The page-experiment ratchet: decide promote / dissolve / keep for every active experiment the caller owns. The hourly `pages-optimize-tick` cron fires this with an empty body.",
+        request: z.object({
+            page: z.string().optional().describe("Narrow to one page's experiments. Omitted = every active experiment the caller owns. THE WORKSPACE IS NOT A FIELD — it is always `ctx.ownerSlug`, so a body cannot aim this at someone else's pages."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional().describe("The workspace that was scanned — the ATTESTED caller, never a body field."),
+            receipts: z.array(z.object({
+                page_slug: z.string(), prop_path: z.string(),
+                action: z.string().describe("`promote` (the winner was written into the page), `dissolve` (the experiment was closed with no winner) or `keep` (nothing changed and no path was marked)."),
+                variant: z.string().optional(), lift_pct: z.number().optional(),
+            })).optional().describe("One row per active experiment considered. An empty array means nothing was active, never that the run failed."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: false, idempotent: false, auth: "member",
+    }),
+    "pages:propose": receiver({
+        receiver: "pages:propose",
+        summary: "Fill an active experiment's variant pool with up to five LLM-written plain-text candidates. Runs OFFLINE — the render path never calls a model.",
+        request: z.object({
+            slug: z.string().describe("The workspace slug."),
+            page: z.string().describe("The page's own slug."),
+            prop_path: z.string().describe("The experiment's prop path — SNAKE_CASE, matching the `page_experiments` column, not a camelCase spelling."),
+            count: z.number().optional().describe("How many candidates to ask for. CLAMPED to 5; the handler defaults to 3 when absent or non-numeric. The pool itself is capped at 5 total, so fewer may be added than requested."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            page_slug: z.string().optional(), prop_path: z.string().optional(),
+            added: z.number().optional().describe("Candidates actually added to the pool, after the 5-total cap. `0` is impossible — an empty model answer is refused `no_candidates`."),
+            error: z.string().optional().describe("`no_active_experiment` · `llm_failed` · `no_candidates` — each a refusal with nothing written."),
+        }),
+        effect: "ask", cost: "variable", reversible: true, idempotent: false, auth: "member",
+    }),
     "mover:agent-context": receiver({
         receiver: "mover:agent-context",
         summary: "The fact→agent bridge — render MoverBusinessFacts into ground-truth prose and write it to the workspace's company_context, so the mounted chat agent answers as the operator's real business. Never invents a service/review/policy; same facts as pages:fill-pack, one intake, two artifacts.",
@@ -4379,7 +5728,17 @@ export const RECEIVERS = {
         receiver: "web:crawl",
         summary: "Fetch a URL and extract domain, name, description, and readable text (public)",
         request: z.object({ url: z.string() }),
-        response: z.object({ ok: z.boolean(), url: z.string().optional(), domain: z.string().optional(), name: z.string().optional(), description: z.string().optional(), text: z.string().optional(), error: z.string().optional() }),
+        response: z.object({
+            ok: z.boolean(),
+            url: z.string().optional().describe("The URL that ANSWERED, not the one asked for — a crawl of an apex that 301s to www reports the www URL here"),
+            domain: z.string().optional(),
+            name: z.string().optional(),
+            description: z.string().optional(),
+            text: z.string().optional(),
+            error: z.string().optional().describe("NAMED, never a single catch-all. invalid_url · https_required · dns_unresolved · blocked_host · redirect_no_location · redirect_invalid_url · redirect_blocked:<ssrf reason> · too_many_redirects · fetch_failed:<status> · not_html · timeout · fetch_error. Until 2026-09-15 every network cause collapsed into `fetch_error`, so a 301 apex->www and an origin refusing the fetch outright were indistinguishable — read `detail` beside this."),
+            detail: z.string().optional().describe("The underlying cause in words, ≤200 chars — the exception class and message, the blocked hop, or the content-type that was refused. Present on most errors, never on success."),
+            redirects: z.number().optional().describe("Hops followed before the answer. Redirects are followed MANUALLY, at most 4, and the SSRF guard re-runs on every hop — a public URL that redirects to a private address is refused at that hop with redirect_blocked."),
+        }),
         effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
     }),
     // ── people / companies / conversation — handlers in resolvers/groups.ts ────────
@@ -4768,6 +6127,29 @@ export const RECEIVERS = {
         auth: "manage_workflows",
         examples: [{ name: "Client Onboarding" }, { name: "demo", simulate: true }],
     }),
+    "workflow:publish": receiver({
+        receiver: "workflow:publish",
+        surfaces: { mcp: true },
+        summary: "Bind a workflow the caller OWNS to a priced market listing. The seller is DERIVED from the workflow's own workspace through the attested ctx — there is deliberately no sellerUid field to spoof.",
+        request: z.object({
+            workflowId: z.string(),
+            price: z.number().nonnegative().optional(), // credits; 0 = free. Defaults to 0.
+            name: z.string().optional(), // defaults to the workflow's own name
+            tags: z.array(z.string()).optional(), // `workflow` is always added
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            sid: z.string().optional(), // `${sellerUid}:workflow:${workflowId}` — seller-scoped, so two creators never collapse into one card
+            sellerUid: z.string().optional(), // the workflow's own workspace, never a body field
+            skillId: z.string().optional(), // `workflow:<workflowId>` — namespaced so it cannot collide with a skill listing
+            price: z.number().optional(),
+            kind: z.string().optional(), // always "listing" — no sixth ItemKind (plan § 8)
+            error: z.string().optional(), // 'not_found' (absent OR not yours — never an existence oracle) | 'no_db' | 'name_required'
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, simulatable: false,
+        auth: "manage_workflows",
+        examples: [{ workflowId: "wf_abc", price: 25 }],
+    }),
     "workflow:webhook-subscribe": receiver({
         receiver: "workflow:webhook-subscribe",
         summary: "Register a URL that receives every future run's events for one workflow as signed, retried POSTs. Mints a signing secret server-side, returned once.",
@@ -4787,7 +6169,9 @@ export const RECEIVERS = {
     }),
     "workflow:apply-diff": receiver({
         receiver: "workflow:apply-diff",
-        surfaces: { mcp: true },
+        // Named, not derived: the derived `workflow_apply-diff` duplicated the
+        // hand-written `workflow_apply_diff` under a second separator.
+        surfaces: { mcp: { name: "workflow_apply_diff" } },
         summary: "Apply a WorkflowDiff (add/remove/connect/disconnect/update). simulate=true validates the DAG without persisting",
         request: z.object({
             workflowId: z.string(),
@@ -4830,10 +6214,14 @@ export const RECEIVERS = {
         summary: "Start a run — spawns the WorkflowRun DO, executes each step, marks path strength on traversed edges",
         request: z.object({
             workflowId: z.string(),
+            // Undeclared, zod STRIPPED this and the run fell back to the caller's own
+            // workspace: a staff run of group `david`'s workflow was minted under `tony`,
+            // the DO refused the mismatched graph, and the row sat `open` forever.
+            slug: z.string().optional().describe("Workspace whose workflow to run; honoured only if you control it. Omit for your own. Refused (forbidden), never swapped for your own."),
             triggerPayload: z.record(z.string(), z.unknown()).optional(),
             idempotencyKey: z.string().optional(),
         }),
-        response: z.object({ runId: z.string(), status: z.string(), error: z.string().optional() }),
+        response: z.object({ runId: z.string(), status: z.string().describe("open | done | paused | failed — never `open` for a run whose executor refused to start it"), error: z.string().optional() }),
         effect: "ask", cost: "variable", reversible: false, idempotent: true, simulatable: false, settles: "none",
         auth: "manage_workflows",
         examples: [{ workflowId: "wf_abc" }],
@@ -5061,6 +6449,11 @@ export const RECEIVERS = {
             actorId: z.string().optional(),
             skill: z.string().optional(),
             instructions: z.string().optional(),
+            model: z
+                .string()
+                .max(64)
+                .optional()
+                .describe("Run this turn on a named model (an OpenRouter id, e.g. 'moonshotai/kimi-k3') instead of the actor's own. VETTED server-side against the workspace's enabledModelIds — a claim outside that list degrades to the operator's configured model, never to the claim. Absent = the actor's model, unchanged."),
         }).catchall(z.unknown()), // extra keys = the agent's input
         response: z.object({ ok: z.boolean(), text: z.string().optional(), actorId: z.string().optional(), error: z.string().optional() }),
         effect: "ask", cost: "variable", reversible: false, idempotent: false, simulatable: false, settles: "none", auth: "manage_workflows",
@@ -5597,6 +6990,190 @@ export const RECEIVERS = {
         effect: "ask", cost: "free", reversible: false, idempotent: false, auth: "member",
         examples: [{ actorIds: ["u-1", "u-2"], destination: "/launch", campaignId: "q3" }],
     }),
+    // ── tags: family — a workspace's tag NAMESPACES ───────────────────────────
+    // WHY. A tag is a bare word and a namespace is the closed set a workspace has
+    // agreed on — the same vocabulary an agent's `subscribes:` stake is written
+    // in. It was reachable only from a browser (`/api/tags`), so `meta:catalog`
+    // could not tell an agent the words its own workspace uses. Handler:
+    // one.ie/web/src/lib/resolvers/tags.ts; both surfaces call lib/in/tags.ts.
+    "tags:list": receiver({
+        receiver: "tags:list",
+        summary: "List a workspace's tag namespaces, with the platform's LOCKED namespaces beside them. `workspace` names which workspace; the caller's authority over it is walked from the attested session, never from the field.",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug to read; defaults to the caller's own. The caller must control it or a 'forbidden' is returned"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            namespaces: z.array(z.unknown()).optional(),
+            locked: z.array(z.string()).optional().describe("Platform-reserved namespace names — substrate vocabulary, not tenant vocabulary; a create naming one is refused"),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+        examples: [{ workspace: "acme" }],
+    }),
+    "tags:create": receiver({
+        receiver: "tags:create",
+        summary: "Create a tag namespace in a workspace. Refuses a LOCKED name — those are substrate vocabulary, not tenant vocabulary. A re-create is IDEMPOTENT and returns the existing row (the insert is ON CONFLICT DO NOTHING), the same answer `POST /api/tags` gives; `not_created` means the row could not be read back at all, never that it already existed.",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug to create in; defaults to the caller's own"),
+            namespace: z.string().describe("The namespace, one bare word — never `lifecycle:marketing`"),
+            values: z.array(z.string()).optional().describe("Closed set of allowed values; omit for a free namespace"),
+            colour: z.string().optional(),
+        }),
+        response: z.object({ ok: z.boolean(), namespace: z.unknown().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: false, auth: "member",
+        examples: [{ workspace: "acme", namespace: "industry", values: ["saas", "retail"] }],
+    }),
+    "tags:delete": receiver({
+        receiver: "tags:delete",
+        summary: "Delete a tag namespace by id (`<workspace>:<namespace>`). The authority walk runs against the ROW's stored workspace, never the id's prefix — an id is caller-supplied and may not name its own owner. A locked namespace is refused.",
+        request: z.object({ id: z.string().describe("Namespace row id, `<workspace>:<namespace>`") }),
+        response: z.object({ ok: z.boolean(), id: z.string().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: false, idempotent: true, auth: "member",
+        examples: [{ id: "acme:industry" }],
+    }),
+    "tags:suggest": receiver({
+        receiver: "tags:suggest",
+        summary: "Ad-hoc tags used more often than `threshold` in a workspace — the candidates an owner may promote into a namespace. Capped at 100 rows by the query.",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug to read; defaults to the caller's own"),
+            threshold: z.number().optional().describe("Minimum usage count; default 20. A negative or non-numeric value falls back to 20 rather than returning everything"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            threshold: z.number().optional(),
+            suggestions: z.array(z.unknown()).optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+        examples: [{ workspace: "acme", threshold: 20 }],
+    }),
+    // ── templates: family — a workspace's saved signal templates ──────────────
+    // WHY. An agent that can `signal(...)` could not ask what its workspace had
+    // already agreed to SAY. Handler: one.ie/web/src/lib/resolvers/templates.ts;
+    // both surfaces call lib/in/templates.ts.
+    "templates:list": receiver({
+        receiver: "templates:list",
+        summary: "List a workspace's signal templates — the saved composer pre-fills, newest starred first. Optional role and free-text filters.",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug to read; defaults to the caller's own"),
+            role: z.enum(["marketer", "sales", "service", "owner"]).optional(),
+            search: z.string().optional().describe("Substring matched against name and body"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            templates: z.array(z.unknown()).optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+        examples: [{ workspace: "acme", role: "sales" }],
+    }),
+    "templates:save": receiver({
+        receiver: "templates:save",
+        summary: "Create or update one signal template. `workspace_id` is stamped from the EXISTING row when the id already exists, otherwise from the walked workspace — a body can never file a template into a workspace the caller does not control. The `_starter` catalogue is read-only.",
+        request: z.object({
+            id: z.string().describe("Stable template id; an existing id updates that row in its own workspace"),
+            name: z.string(),
+            workspace: z.string().optional().describe("Workspace to file a NEW template under; ignored when the id already exists"),
+            role: z.enum(["marketer", "sales", "service", "owner"]).optional().describe("Default 'owner'"),
+            receiverMode: z.enum(["direct", "world", "all", "sub"]).optional().describe("Default 'direct'"),
+            receiverTarget: z.string().optional(),
+            tags: z.array(z.string()).optional().describe("BARE words — never `lifecycle:marketing`"),
+            body: z.string().optional(),
+            sendAt: z.string().optional().describe("'now' | '+24h' | an ISO datetime; default 'now'"),
+            attach: z.array(z.string()).optional(),
+            starred: z.boolean().optional(),
+            createdAt: z.number().optional(),
+        }),
+        response: z.object({ ok: z.boolean(), id: z.string().optional(), workspace: z.string().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "member",
+        examples: [{ id: "tpl-welcome", name: "Welcome", role: "sales", body: "Hi {{name}} —", tags: ["lead"] }],
+    }),
+    "templates:delete": receiver({
+        receiver: "templates:delete",
+        summary: "Delete one signal template by id. The authority walk runs against the ROW's stored workspace, never a body field. The `_starter` catalogue is read-only.",
+        request: z.object({ id: z.string() }),
+        response: z.object({ ok: z.boolean(), id: z.string().optional(), error: z.string().optional() }),
+        effect: "ask", cost: "free", reversible: false, idempotent: true, auth: "member",
+        examples: [{ id: "tpl-welcome" }],
+    }),
+    // ── rewards: family — the referral binding ────────────────────────────────
+    // ALREADY RUNNING, now declared. `pay/backend/src/rewards.ts enrollReferrer`
+    // has dispatched this since the rewards rail shipped; it was absent from the
+    // registry, so `meta:catalog` did not list the referral door at all. The
+    // request shape below is READ OFF THAT CALLER — it posts `{tags, content}`,
+    // and zod returns its PARSED output, so a schema that omitted `content` would
+    // strip the two wallet addresses and bind nothing.
+    "rewards:enroll": receiver({
+        receiver: "rewards:enroll",
+        summary: "Bind a referrer wallet to a referred wallet at signup, as a weighted Path written with `mark`. FIRST BINDING WINS — an existing inbound path to the referred wallet is never re-routed, so a later spoof cannot redirect a payout. Accepts the two addresses either flat or under `content` (the shape pay/backend sends). Self-referral is refused.",
+        request: z.object({
+            content: z.object({
+                referrer: z.string().describe("Referrer wallet address"),
+                referred: z.string().describe("Referred wallet address"),
+            }).optional().describe("The nested shape pay/backend's enrollReferrer posts"),
+            referrer: z.string().optional().describe("Referrer wallet address, flat form"),
+            referred: z.string().optional().describe("Referred wallet address, flat form"),
+            tags: z.array(z.string()).optional().describe("Carried through from the signal envelope; not read by the handler"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            bound: z.enum(["created", "existing"]).optional().describe("`existing` = the referred wallet was already bound and nothing moved"),
+            referrer: z.string().optional(),
+            referred: z.string().optional(),
+            error: z.string().optional(),
+        }),
+        effect: "signal", cost: "free", reversible: false, idempotent: true, auth: "agent_key",
+        examples: [{ content: { referrer: "0xabc…", referred: "0xdef…" }, tags: ["rewards", "enroll"] }],
+    }),
+    // ── sui: family — the Move-contract vocabulary + lifecycle read ───────────
+    // ALREADY RUNNING, now declared. `components/activity/SuiSubstrate.tsx` calls
+    // `/api/ask/sui:vocabulary` and `/api/ask/sui:lifecycle` with an empty body
+    // from an ANONYMOUS page, which is why both are labelled `public`: they return
+    // the embedded vocabulary and a testnet run snapshot, no tenant data.
+    "sui:vocabulary": receiver({
+        receiver: "sui:vocabulary",
+        summary: "The ONE vocabulary as the Sui Move contracts express it — the 6 dimensions and 6 verbs with their TQL and Move names, plus the Move module list. Read-only, no arguments, no tenant data.",
+        request: z.object({}),
+        response: z.object({ ok: z.boolean(), vocabulary: z.unknown().optional(), modules: z.array(z.unknown()).optional() }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
+        examples: [{}],
+    }),
+    "sui:lifecycle": receiver({
+        receiver: "sui:lifecycle",
+        summary: "The latest lifecycle journey run on Sui — one transaction per stage with its explorer digest. Served from KV when the simulator has written one (`source:'kv'`), otherwise the embedded testnet snapshot. Read-only, no arguments.",
+        request: z.object({}),
+        response: z.object({
+            ok: z.boolean(),
+            source: z.string().optional().describe("`kv` = a live simulator run; absent = the embedded snapshot"),
+            explorer: z.string().optional(),
+            transactions: z.array(z.unknown()).optional(),
+        }),
+        effect: "ask", cost: "free", reversible: true, idempotent: true, auth: "public",
+        examples: [{}],
+    }),
+    "sui:generate": receiver({
+        receiver: "sui:generate",
+        summary: "Run the vocabulary enrichment workflow for a workspace: extract, validate alignment against the Move modules, then fan out to the cache and task sinks. Returns the consolidated summary, or `{ok:false, stage:'validate', findings}` when alignment fails — a failed validation never fans out. The workspace is walked from the attested caller.",
+        request: z.object({
+            workspace: z.string().optional().describe("Workspace slug; defaults to the caller's own. The caller must control it"),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            stage: z.string().optional(),
+            vocabulary: z.unknown().optional(),
+            modules: z.array(z.unknown()).optional(),
+            fanout: z.unknown().optional(),
+            validation: z.unknown().optional(),
+            findings: z.array(z.unknown()).optional(),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "variable", reversible: false, idempotent: false, auth: "member",
+        examples: [{ workspace: "one" }],
+    }),
     // ── fn: family — typed substrate function calls (C5) ──────────────────────
     "fn:run": receiver({
         receiver: "fn:run",
@@ -5812,7 +7389,8 @@ export const RECEIVERS = {
     }),
     "seo:keyword-metrics": receiver({
         receiver: "seo:keyword-metrics",
-        surfaces: { mcp: true },
+        // Named, not derived — collapses into the hand-written `seo_keyword_metrics`.
+        surfaces: { mcp: { name: "seo_keyword_metrics" } },
         summary: "Return monthly search volume, CPC, and competition for a list of keywords via DataForSEO async task",
         request: z.object({ keywords: z.array(z.string()), location_code: z.number().int().optional(), language_code: z.string().optional() }),
         response: z.object({ ok: z.boolean(), data: z.unknown().optional(), error: z.string().optional() }),
@@ -6054,6 +7632,144 @@ export const RECEIVERS = {
         settles: "none",
         examples: [{ href: "/u/one/in", reason: "agent" }],
     }),
+    // ── media:* ─────────────────────────────────────────────────────────────────
+    // THE WORKSPACE MEDIA LIBRARY, for an agent.
+    //
+    // WHY. Measured 2026-09-16 over this file: 362 receivers, and not one touched a
+    // stored asset. `video:*` (14) is rooms, sessions and recordings — a call, never a
+    // file. So the media console at `/u/<slug>/media` was HTTP-only: a human could list,
+    // upload and generate; an agent could not reach any of it, from any surface.
+    //
+    // THE ONE AUTHORITY RULE, and it is not either HTTP door's. `workspace` is a SCOPE
+    // REQUEST on all three — never an identity, never a default. It is honoured only
+    // through the owner-tree walk, and a request the caller cannot clear is REFUSED BY
+    // NAME. The three HTTP write doors (`api/media/generate.ts:35`, storefront
+    // image-upload/image-generate) instead derive from `locals.slug` and IGNORE the
+    // workspace handed to them, so an agency uploading at `/u/client/media` files into
+    // the AGENCY's library while the grid shows the CLIENT's — and answers 200. These
+    // receivers do not inherit that: a silent downgrade is a success you cannot audit.
+    // Resolver: `one.ie/web/src/lib/resolvers/media.ts`.
+    "media:list": receiver({
+        receiver: "media:list",
+        surfaces: { mcp: true, chat: true },
+        summary: "Every image and video a workspace owns, as typed rows — ONE R2 scan of `{workspace}/` filtered to the seven prefixes the reader will actually serve (media, chat, ads, products, pages, brand, courses), so generated chat images and ad creative are visible, not just hand-uploads. Carries `scanned` (how much of the page was not media), `truncated` (the budget that bit) and `nextCursor`. Each row's `url` is the one door that reads bytes.",
+        request: z.object({
+            workspace: z.string().optional().describe("Group slug. Omit for your own. Honoured only if you may read it."),
+            kind: z.enum(["image", "video"]).optional().describe("Omit for both. Filters the rows on this page; it does not change what is scanned."),
+            prefix: z.enum(["media", "chat", "ads", "products", "pages", "brand", "courses"]).optional()
+                .describe("Only assets under this top-level namespace. media = hand-uploads and library generations; chat = images/videos an agent made in a conversation; ads = creative; products/pages/courses/brand = assets filed beside the thing they illustrate."),
+            limit: z.number().int().min(1).max(1000).optional()
+                .describe("R2 objects to SCAN on this page BEFORE prefix/kind filtering — not a row count. Default 500, max 1000 (R2's own ceiling). A workspace whose bucket is mostly non-media can return few rows from a full scan; that is what `scanned` reports."),
+            cursor: z.string().optional().describe("The nextCursor from the previous page."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional().describe("The workspace actually read — always the one you asked for, because a request you may not read is refused rather than downgraded."),
+            items: z.array(z.object({
+                key: z.string().describe("The R2 object key, `{workspace}/{prefix}/…` — the handle every other media receiver takes."),
+                url: z.string().describe("`/api/product-image/{workspace}/{path}` — THE reader. Range-forwarding, prefix-allowlisted, refuses SVG by stored contentType."),
+                kind: z.enum(["image", "video"]),
+                prefix: z.string().describe("Top-level namespace, no trailing slash."),
+                contentType: z.string(),
+                size: z.number().nullable().describe("Bytes, or null when R2 did not report it."),
+                uploaded: z.string().nullable().describe("ISO time, or null."),
+            })).optional(),
+            total: z.number().optional()
+                .describe("Media rows in THIS answer, after the kind/prefix filter. NOT a pre-paging count — an R2 scan cannot know one without walking every page. A FLOOR whenever `truncated` is present: say 'at least N'."),
+            scanned: z.number().optional()
+                .describe("Objects R2 listed on this page BEFORE filtering. `scanned` far above `total` means most of the page was not media — follow the cursor rather than concluding the workspace is empty."),
+            byPrefix: z.record(z.string(), z.number()).optional().describe("What each namespace contributed to THIS page — never a workspace total."),
+            prefixes: z.array(z.string()).optional().describe("Every prefix this door will ever return, so a caller can offer the filter without hardcoding the list."),
+            truncated: z.object({
+                rows: z.number().optional(),
+                scanned: z.number().optional(),
+                limit: z.number().optional().describe("The scan budget that bit."),
+                reason: z.string().optional(),
+            }).optional().describe("ABSENT IS NOT FALSE — a complete answer carries no such key. Present = R2 reported more objects under this workspace, `total` is a floor, and you must say so before planning on it."),
+            nextCursor: z.string().optional().describe("Present iff `truncated` is. Follow it or you have not seen the bucket."),
+            error: z.string().optional(),
+        }),
+        effect: "ask", cost: "free", idempotent: true, reversible: true, settles: "none", auth: "member",
+        examples: [
+            { workspace: "one" },
+            { workspace: "one", kind: "video" },
+            { prefix: "ads", limit: 1000 },
+        ],
+    }),
+    // media:upload — bytes in, one key out, under `{workspace}/media/`.
+    //
+    // TWO SHAPES BECAUSE AN AGENT HAS NEITHER A FILE PICKER NOR A MULTIPART BODY. The
+    // HTTP door takes multipart and nothing else, so this is not a wrapper: the R2 write
+    // and the magic-byte sniff are reimplemented at the same 5 MiB cap.
+    //
+    // `url` IS A NEW OUTBOUND-FETCH SURFACE and is treated as one — the shared SSRF guard
+    // (shape + DNS, fail-closed) runs BEFORE the fetch, `redirect:'manual'` with any
+    // 3xx refused as `redirect_refused` (workerd rejects `redirect:'error'`) so a public
+    // host cannot 302 the worker onto a metadata address, and the body is read against a
+    // hard byte budget rather than trusting `content-length`.
+    "media:upload": receiver({
+        receiver: "media:upload",
+        surfaces: { mcp: true, chat: true },
+        summary: "Put ONE raster image into a workspace's media library and get back the key and the url that serves it. Name exactly one source: `base64` (bytes you hold) or `url` (a public https address the server fetches under an SSRF guard, no redirects, 5 MiB hard cap). The stored content type comes from the MAGIC BYTES, never from what you declare — SVG is refused deliberately, and video is not accepted here.",
+        request: z.object({
+            workspace: z.string().optional().describe("Group slug. Omit for your own. Honoured only if you may read it."),
+            url: z.string().optional().describe("Public https address to fetch. Alternative to `base64`, never both. Private, loopback, link-local and CGNAT addresses are refused, as is any redirect."),
+            base64: z.string().optional().describe("The image bytes, base64. A `data:` prefix is accepted and stripped. Alternative to `url`, never both."),
+            filename: z.string().optional().describe("A LABEL for the key, not a path — separators are stripped and the extension always comes from the sniffed bytes, so `../` and a `.svg` suffix are both inert. Omit and the key is a bare uuid."),
+            contentType: z.string().optional().describe("A HINT only. The stored value is decided by the magic bytes, because the public reader serves the stored value verbatim under nosniff."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            key: z.string().optional().describe("`{workspace}/media/…` — the handle media:list returns."),
+            url: z.string().optional().describe("`/api/product-image/{workspace}/{path}` — THE reader."),
+            kind: z.literal("image").optional().describe("Always image. Video is a 5 MiB-cap and multipart-shape decision this door does not make; PUT /api/media/video-upload is the door that does."),
+            contentType: z.string().optional().describe("Sniffed, not declared."),
+            size: z.number().optional().describe("Bytes actually stored."),
+            error: z.string().optional().describe("Named: forbidden · too_large · unsupported_type · blocked_url · redirect_refused: <the 3xx status> · fetch_failed · storage_error. A refusal is never a downgrade to your own workspace."),
+        }),
+        effect: "ask", cost: "free", idempotent: false, reversible: false, settles: "none", auth: "member",
+        examples: [
+            { workspace: "one", url: "https://example.com/logo.png", filename: "logo" },
+            { base64: "iVBORw0KGgo…" },
+        ],
+    }),
+    // media:generate — one image from a prompt, straight into `{workspace}/media/`.
+    //
+    // DELIBERATELY NOT `surfaces.chat`. Chat already ships a curated `generate_image`
+    // (`channels/src/aitools.ts:376`): three providers, aspect/width/height, per-call
+    // billing and a spend-shaped approval gate — strictly more capable there, and it
+    // files under `{ws}/chat/`. Flagging this for chat too would offer a model TWO image
+    // generators with different prefixes and no way to choose between them, and the names
+    // differ (`generate_image` vs `media_generate`) so the curated-wins precedence in
+    // `channels/src/tools/from-registry.ts` would not suppress it. MCP has no such tool;
+    // that is where this one earns its place.
+    //
+    // `context` is a PROMPT QUALIFIER, not a key prefix. A library is THE prefix, not a
+    // context — the distinction `api/media/generate.ts`'s header argues out against the
+    // contextual storefront door. Nothing this receiver writes lands outside `media/`.
+    "media:generate": receiver({
+        receiver: "media:generate",
+        surfaces: { mcp: true },
+        summary: "Generate ONE image from a prompt and file it in the workspace's media library. Keyless — flux-1-schnell on the Cloudflare AI binding. Returns the key and the url that serves it. Unlike the storefront generator this takes no destination: it always writes `{workspace}/media/`, because a library is a prefix and not a context.",
+        request: z.object({
+            workspace: z.string().optional().describe("Group slug. Omit for your own. Honoured only if you may read it."),
+            prompt: z.string().min(1).describe("What to draw. Truncated at 2000 chars after `context` is folded in."),
+            context: z.string().optional().describe("Extra prompt material — brand, palette, subject. A QUALIFIER appended to the prompt, NOT a destination: it never changes the key prefix."),
+        }),
+        response: z.object({
+            ok: z.boolean(),
+            workspace: z.string().optional(),
+            key: z.string().optional().describe("`{workspace}/media/{uuid}.{ext}` — a uuid, never a timestamp: the url it names is served by a PUBLIC reader, so the name is the only thing standing between the object and a stranger."),
+            url: z.string().optional().describe("`/api/product-image/{workspace}/{path}` — THE reader."),
+            kind: z.literal("image").optional(),
+            contentType: z.string().optional().describe("Sniffed from the returned bytes — flux returns JPEG today and returned PNG when the storefront door was written."),
+            size: z.number().optional(),
+            error: z.string().optional().describe("Named: forbidden · not_configured (no AI or CONTENT binding) · generation_failed · storage_error."),
+        }),
+        effect: "ask", cost: "variable", idempotent: false, reversible: false, settles: "none", auth: "member",
+        examples: [{ workspace: "one", prompt: "a wide banner of a quiet harbour at dawn, muted palette" }],
+    }),
 };
 /**
  * RECIPES — the four agent journeys as typed, ordered receiver sequences (C6).