@onesi/genesis 0.2.8 → 0.2.9

package/dist/genesis.openapi.json

@@ -32622,8 +32622,8 @@
       ],
       "post": {
         "operationId": "fleets_topUpSeat",
-        "summary": "Add credits to a seat's purse",
-        "description": "Repays any overdraft first, then adds to the available credits. A seat's computer minutes come from its plan (upgrade it, or use a pool). A seat paused with purse_empty resumes when credits are available again. Reusing idempotency_key returns the first result. A pooled seat answers 409 (code pooled_seat); top up the pool.",
+        "summary": "Add credits (and optionally computer minutes) to a seat's purse",
+        "description": "Repays any overdraft first, then adds to the available credits. Optional computer_minutes add to the seat's computer entitlement under the same idempotency_key and are recorded as minutes on the ledger top_up entry. credits may be 0 when computer_minutes is above 0; both 0 is 422. A helper seat with computer_minutes above 0 answers 403 (code computer_not_entitled). A pooled seat answers 409 (code pooled_seat); top up the pool. A seat paused with purse_empty resumes when credits are available again. Reusing idempotency_key returns the first result.",
         "requestBody": {
           "required": true,
           "content": {
@@ -32649,18 +32649,16 @@
             "description": "Verified Genesis identity required"
           },
           "403": {
-            "description": "Insufficient scope (fleets:write)"
+            "description": "Insufficient scope (fleets:write), or computer_minutes on a helper seat (code computer_not_entitled)"
           },
           "404": {
             "description": "Seat is missing or belongs to another organization"
           },
           "409": {
-            "description": "Seat is releasing or released",
-            "pooled (code pooled_seat)": null,
-            "or idempotency conflict": null
+            "description": "Seat is releasing or released, pooled (code pooled_seat), or idempotency conflict"
           },
           "422": {
-            "description": "Invalid input"
+            "description": "Invalid input, or credits and computer_minutes both 0"
           }
         },
         "tags": [
@@ -45750,7 +45748,7 @@
       "get": {
         "operationId": "minds_listMinds",
         "summary": "List owned Minds and the verified creation-context fingerprint",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "after",
@@ -45803,8 +45801,8 @@
       },
       "post": {
         "operationId": "minds_createMind",
-        "summary": "Create one capped Sandbox Mind; retain the same operation key after uncertainty",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "summary": "Create one capped Mind in the selected environment; retain the same operation key after uncertainty",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation. A Live create is admitted per organization by the Minds controller (default off, with an instance cap); otherwise 403 MINDS_LIVE_NOT_ENABLED, or 403 MINDS_LIVE_CAP_REACHED at the cap, and nothing is created.",
         "parameters": [
           {
             "name": "idempotency-key",
@@ -45869,7 +45867,7 @@
       "get": {
         "operationId": "minds_getMind",
         "summary": "Read one Mind owned by the verified organization and project",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -45916,7 +45914,7 @@
       "delete": {
         "operationId": "minds_deleteMind",
         "summary": "Delete an owned Mind (controller lifecycle action delete) without an automatic retry",
-        "description": "Requires the original human Console Sandbox selection and Minds delete permission (minds:instances:delete). Pass the desired_generation from a fresh owned read as expected_generation; retain the same key and generation after uncertainty. The controller resolves durable replay before checking generation. A Mind that is already deleted answers 409 MIND_DELETED. No body, capacity or tenant fields. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live) and Minds delete permission (minds:instances:delete). Pass the desired_generation from a fresh owned read as expected_generation; retain the same key and generation after uncertainty. The controller resolves durable replay before checking generation. A Mind that is already deleted answers 409 MIND_DELETED. No body, capacity or tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -45983,7 +45981,7 @@
       "post": {
         "operationId": "minds_insertEpisodicMemory",
         "summary": "Persist an episodic event in an explicit ready Mind; never automatically replay",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind",
@@ -46042,7 +46040,7 @@
       "put": {
         "operationId": "minds_updateEpisodicMemory",
         "summary": "Update content of the same stored episodic event",
-        "description": "Original human Console Sandbox authorization only. Requires the existing logical event_id and preserves all other stored metadata. No delete/recreate, automatic retry or atomic compare-and-swap guarantee. Reconcile an unknown result with get. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Original human Console authorization only (Sandbox, or Live). Requires the existing logical event_id and preserves all other stored metadata. No delete/recreate, automatic retry or atomic compare-and-swap guarantee. Reconcile an unknown result with get. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "storage_id",
@@ -46139,7 +46137,7 @@
       "get": {
         "operationId": "minds_getEpisodicMemory",
         "summary": "Read a persisted memory by storage UUID in an explicit ready Mind",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "storage_id",
@@ -46198,7 +46196,7 @@
       "post": {
         "operationId": "minds_searchMemory",
         "summary": "Search actual episodic memory in an explicit ready Mind",
-        "description": "Requires an original human One account session with a verified pf_console Sandbox selection. No caller tenant fields. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires an original human One account session with a verified pf_console selection (Sandbox, or Live). No caller tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind",
@@ -46260,7 +46258,7 @@
       "post": {
         "operationId": "minds_resumeMind",
         "summary": "Resume an owned Mind on its retained volume without an automatic retry",
-        "description": "Requires the original human Console Sandbox selection and existing Minds update permission. Retain the same key and original expected_generation after uncertainty. The controller resolves durable replay before checking generation; no capacity or tenant fields are accepted. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live) and existing Minds update permission. Retain the same key and original expected_generation after uncertainty. The controller resolves durable replay before checking generation; no capacity or tenant fields are accepted. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -46630,7 +46628,7 @@
       "get": {
         "operationId": "minds_listAgentGroups",
         "summary": "List canonical owner agent groups",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [],
         "responses": {
           "200": {
@@ -46663,7 +46661,7 @@
       "post": {
         "operationId": "minds_createAgentGroup",
         "summary": "Create a canonical owner agent group",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [],
         "responses": {
           "200": {
@@ -46708,7 +46706,7 @@
       "get": {
         "operationId": "minds_listAgentGroupMembers",
         "summary": "List canonical group members including tombstones",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "group_id",
@@ -46751,7 +46749,7 @@
       "post": {
         "operationId": "minds_addAgentGroupMember",
         "summary": "Add a canonical agent to a group with an explicit revision",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "group_id",
@@ -46806,7 +46804,7 @@
       "delete": {
         "operationId": "minds_removeAgentGroupMember",
         "summary": "Remove a group member and retain its revision",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "group_id",
@@ -46870,7 +46868,7 @@
       "get": {
         "operationId": "minds_listMindAttachments",
         "summary": "List canonical Mind attachments including tombstones",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "mind_id",
@@ -46917,7 +46915,7 @@
       "post": {
         "operationId": "minds_attachMind",
         "summary": "Attach an existing agent or group to a Mind",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "mind_id",
@@ -46976,7 +46974,7 @@
       "delete": {
         "operationId": "minds_detachMind",
         "summary": "Detach a canonical Mind attachment and retain its revision",
-        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase.",
+        "description": "Original selected pf_console human bearer only, verified online with current organization/project/workspace/Sandbox context. No agent credential fallback, caller tenant headers, credential issuance, context fingerprint or automatic retry. Independently default-off owner-management admission; all bodies use camelCase. Sandbox only: a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before Auth or IAM is asked, even where Minds is Live.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47044,7 +47042,7 @@
       "get": {
         "operationId": "minds_getUsage",
         "summary": "Read native operational usage for the selected project",
-        "description": "Requires the original human Console Sandbox selection and Minds read permission. Explicit RFC3339 from/to window must be positive and at most 93 days. Account totals and financial fields are excluded; unreported telemetry is not zero. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live) and Minds read permission. Explicit RFC3339 from/to window must be positive and at most 93 days. Account totals and financial fields are excluded; unreported telemetry is not zero. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "from",
@@ -47100,7 +47098,7 @@
       "post": {
         "operationId": "minds_stopMind",
         "summary": "Stop an owned Mind while retaining its volume without an automatic retry",
-        "description": "Requires the original human Console Sandbox selection and existing Minds update permission. Retain the same key and original expected_generation after uncertainty. The controller resolves durable replay before checking generation. No wake reason, capacity or tenant fields are accepted. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live) and existing Minds update permission. Retain the same key and original expected_generation after uncertainty. The controller resolves durable replay before checking generation. No wake reason, capacity or tenant fields are accepted. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47169,7 +47167,7 @@
       "post": {
         "operationId": "minds_createWebhookDelivery",
         "summary": "Record a webhook delivery for an owned Mind; a stopped-idle Mind is woken",
-        "description": "Requires the original human Console Sandbox selection and Minds update permission. The receipt is durable per delivery_id: replay the same body to read the original receipt after an uncertain outcome. No idempotency header or tenant fields. Org API keys with a Sandbox binding are admitted with `minds:write`. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live) and Minds update permission. The receipt is durable per delivery_id: replay the same body to read the original receipt after an uncertain outcome. No idempotency header or tenant fields. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47228,7 +47226,7 @@
       "get": {
         "operationId": "minds_getWebhookDelivery",
         "summary": "Read a webhook delivery receipt issued by the caller",
-        "description": "Requires the original human Console Sandbox selection. Only the issuing principal can read its receipt, including after the Mind is deleted. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Requires the original human Console selection (Sandbox, or Live). Only the issuing principal can read its receipt, including after the Mind is deleted. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47412,7 +47410,7 @@
       "post": {
         "operationId": "minds_resizeMind",
         "summary": "Resize an owned Mind to an existing Pro profile (controller lifecycle action resize)",
-        "description": "Requires the original human Console Sandbox selection and Minds manage permission (minds:instances:manage). Only the existing Pro profiles F1, D1 and D2 at their fixed capacity; the retained volume never shrinks. Resizing makes the Mind Pro-labelled and is admitted against the paid account; prices are unchanged. Retain the same key and expected_generation after uncertainty. Org API keys with a Sandbox binding are admitted with `minds:manage`, which does not imply read or write. Live selections answer 409 ENVIRONMENT_NOT_AVAILABLE to keys.",
+        "description": "Org API keys with `minds:manage` only (Sandbox or Live binding); Console sessions get 403 MINDS_MANAGE_KEY_REQUIRED before any delegation, because Auth does not delegate minds:instances:manage to sessions. Only the existing Pro profiles F1, D1 and D2 at their fixed capacity; the retained volume never shrinks. Resizing makes the Mind Pro-labelled and is admitted against the paid account; prices are unchanged. Retain the same key and expected_generation after uncertainty. `minds:manage` does not imply read or write. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47478,7 +47476,7 @@
       "post": {
         "operationId": "minds_engineKeyValuePostKeyspace",
         "summary": "key-value: POST /v1/:keyspace",
-        "description": "Calls `POST /v1/:keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `{path.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/:keyspace` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `{path.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47572,7 +47570,7 @@
       "delete": {
         "operationId": "minds_engineKeyValueDeleteKeyspaceId",
         "summary": "key-value: DELETE /v1/:keyspace/:id",
-        "description": "Calls `DELETE /v1/:keyspace/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `{path.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `DELETE /v1/:keyspace/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete` on `{path.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47656,7 +47654,7 @@
       "get": {
         "operationId": "minds_engineKeyValueGetKeyspaceId",
         "summary": "key-value: GET /v1/:keyspace/:id",
-        "description": "Calls `GET /v1/:keyspace/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `{path.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/:keyspace/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `{path.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47742,7 +47740,7 @@
       "post": {
         "operationId": "minds_engineKeyValuePostKeyspaceQuery",
         "summary": "key-value: POST /v1/:keyspace/query",
-        "description": "Calls `POST /v1/:keyspace/query` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `{path.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/:keyspace/query` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `{path.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47840,7 +47838,7 @@
       "post": {
         "operationId": "minds_engineAnalyticsPostAnalyticsSourcesCore",
         "summary": "analytics: POST /v1/analytics/sources/core",
-        "description": "Calls `POST /v1/analytics/sources/core` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/analytics/sources/core` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47882,7 +47880,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -47936,7 +47935,7 @@
       "post": {
         "operationId": "minds_engineAnalyticsPostAnalyticsSql",
         "summary": "analytics: POST /v1/analytics/sql",
-        "description": "Calls `POST /v1/analytics/sql` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/analytics/sql` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48023,7 +48022,7 @@
       "get": {
         "operationId": "minds_engineAnalyticsGetAnalyticsViews",
         "summary": "analytics: GET /v1/analytics/views",
-        "description": "Calls `GET /v1/analytics/views` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/analytics/views` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48088,7 +48087,7 @@
       "post": {
         "operationId": "minds_engineAnalyticsPostAnalyticsViews",
         "summary": "analytics: POST /v1/analytics/views",
-        "description": "Calls `POST /v1/analytics/views` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/analytics/views` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48180,7 +48179,7 @@
       "delete": {
         "operationId": "minds_engineAnalyticsDeleteAnalyticsViewsName",
         "summary": "analytics: DELETE /v1/analytics/views/:name",
-        "description": "Calls `DELETE /v1/analytics/views/:name` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `DELETE /v1/analytics/views/:name` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48256,7 +48255,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnClear",
         "summary": "associative-memory: POST /v1/assoc/mhn/clear",
-        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `query`, `delete` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:admin`, `query`, `delete` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48338,7 +48337,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnConfig",
         "summary": "associative-memory: POST /v1/assoc/mhn/config",
-        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48419,7 +48418,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnList",
         "summary": "associative-memory: POST /v1/assoc/mhn/list",
-        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48500,7 +48499,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnNew",
         "summary": "associative-memory: POST /v1/assoc/mhn/new",
-        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `mhn:write`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:admin`, `mhn:write`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48582,7 +48581,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieve",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48663,7 +48662,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByKey",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_key",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48744,7 +48743,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByVector",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_vector",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48825,7 +48824,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStats",
         "summary": "associative-memory: POST /v1/assoc/mhn/stats",
-        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48906,7 +48905,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStore",
         "summary": "associative-memory: POST /v1/assoc/mhn/store",
-        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:write`, `query`, `read`, `update` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:write`, `query`, `read`, `update` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48989,7 +48988,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnSystemInfo",
         "summary": "associative-memory: POST /v1/assoc/mhn/system_info",
-        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49070,7 +49069,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveCycles",
         "summary": "cognitive-cycle: GET /v1/cognitive/cycles",
-        "description": "Calls `GET /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/cycles` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49136,7 +49135,7 @@
       "post": {
         "operationId": "minds_engineCognitiveCyclePostCognitiveCycles",
         "summary": "cognitive-cycle: POST /v1/cognitive/cycles",
-        "description": "Calls `POST /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `query`, `delete` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/cognitive/cycles` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `query`, `delete` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49223,7 +49222,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveCyclesId",
         "summary": "cognitive-cycle: GET /v1/cognitive/cycles/:id",
-        "description": "Calls `GET /v1/cognitive/cycles/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/cycles/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49299,7 +49298,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveStats",
         "summary": "cognitive-cycle: GET /v1/cognitive/stats",
-        "description": "Calls `GET /v1/cognitive/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49367,7 +49366,7 @@
       "get": {
         "operationId": "minds_engineContinualLearningGetContinualCheckpointsStatus",
         "summary": "continual-learning: GET /v1/continual/checkpoints/status",
-        "description": "Calls `GET /v1/continual/checkpoints/status` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/continual/checkpoints/status` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49434,7 +49433,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualComponents",
         "summary": "continual-learning: POST /v1/continual/components",
-        "description": "Calls `POST /v1/continual/components` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/components` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49522,7 +49521,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualComponentsDelete",
         "summary": "continual-learning: POST /v1/continual/components/delete",
-        "description": "Calls `POST /v1/continual/components/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/components/delete` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49610,7 +49609,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskConsolidate",
         "summary": "continual-learning: POST /v1/continual/task/consolidate",
-        "description": "Calls `POST /v1/continual/task/consolidate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/consolidate` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49693,7 +49692,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskDelete",
         "summary": "continual-learning: POST /v1/continual/task/delete",
-        "description": "Calls `POST /v1/continual/task/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/delete` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49781,7 +49780,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskEvaluate",
         "summary": "continual-learning: POST /v1/continual/task/evaluate",
-        "description": "Calls `POST /v1/continual/task/evaluate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/evaluate` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49869,7 +49868,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskNew",
         "summary": "continual-learning: POST /v1/continual/task/new",
-        "description": "Calls `POST /v1/continual/task/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/new` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49958,7 +49957,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskPause",
         "summary": "continual-learning: POST /v1/continual/task/pause",
-        "description": "Calls `POST /v1/continual/task/pause` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/pause` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50041,7 +50040,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskResume",
         "summary": "continual-learning: POST /v1/continual/task/resume",
-        "description": "Calls `POST /v1/continual/task/resume` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/resume` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50124,7 +50123,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskStats",
         "summary": "continual-learning: POST /v1/continual/task/stats",
-        "description": "Calls `POST /v1/continual/task/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50206,7 +50205,7 @@
       "post": {
         "operationId": "minds_engineContinualLearningPostContinualTaskTrain",
         "summary": "continual-learning: POST /v1/continual/task/train",
-        "description": "Calls `POST /v1/continual/task/train` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/continual/task/train` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_continual` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50299,7 +50298,7 @@
       "get": {
         "operationId": "minds_engineForgettingGetForgettingPolicies",
         "summary": "forgetting: GET /v1/forgetting/policies",
-        "description": "Calls `GET /v1/forgetting/policies` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/forgetting/policies` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50366,7 +50365,7 @@
       "post": {
         "operationId": "minds_engineForgettingPostForgettingPoliciesIdToggle",
         "summary": "forgetting: POST /v1/forgetting/policies/:id/toggle",
-        "description": "Calls `POST /v1/forgetting/policies/:id/toggle` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/forgetting/policies/:id/toggle` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50457,7 +50456,7 @@
       "get": {
         "operationId": "minds_engineForgettingGetForgettingProofId",
         "summary": "forgetting: GET /v1/forgetting/proof/:id",
-        "description": "Calls `GET /v1/forgetting/proof/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/forgetting/proof/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50533,7 +50532,7 @@
       "get": {
         "operationId": "minds_engineForgettingGetForgettingRequests",
         "summary": "forgetting: GET /v1/forgetting/requests",
-        "description": "Calls `GET /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/forgetting/requests` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50599,7 +50598,7 @@
       "post": {
         "operationId": "minds_engineForgettingPostForgettingRequests",
         "summary": "forgetting: POST /v1/forgetting/requests",
-        "description": "Calls `POST /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `_system_forgetting_requests` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/forgetting/requests` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read`, `write` on `_system_forgetting_requests` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50699,7 +50698,7 @@
       "post": {
         "operationId": "minds_engineForgettingPostForgettingRequestsIdApprove",
         "summary": "forgetting: POST /v1/forgetting/requests/:id/approve",
-        "description": "Calls `POST /v1/forgetting/requests/:id/approve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/forgetting/requests/:id/approve` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `write`, `delete` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50743,19 +50742,20 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:manage",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/forgetting/requests/:id/approve",
           "actions": [
-            "query",
-            "read"
+            "read",
+            "write",
+            "delete"
           ],
           "keyspaces": [
-            "_system_forgetting_requests"
+            "*"
           ],
-          "scope": "minds:instances:read",
-          "mintable": true,
+          "scope": "minds:instances:manage",
+          "mintable": false,
           "flag": "database(enable_kv|graph|analytics|ml|inference|vector|memory)",
           "grant": "table"
         },
@@ -50776,7 +50776,7 @@
       "get": {
         "operationId": "minds_engineForgettingGetForgettingStats",
         "summary": "forgetting: GET /v1/forgetting/stats",
-        "description": "Calls `GET /v1/forgetting/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/forgetting/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50844,7 +50844,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphAlgComponents",
         "summary": "knowledge-graph: POST /v1/graph/alg/components",
-        "description": "Calls `POST /v1/graph/alg/components` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/alg/components` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50926,7 +50926,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphAlgPagerank",
         "summary": "knowledge-graph: POST /v1/graph/alg/pagerank",
-        "description": "Calls `POST /v1/graph/alg/pagerank` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/alg/pagerank` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51008,7 +51008,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphAlgShortestPath",
         "summary": "knowledge-graph: POST /v1/graph/alg/shortest_path",
-        "description": "Calls `POST /v1/graph/alg/shortest_path` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/alg/shortest_path` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51099,7 +51099,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypher",
         "summary": "knowledge-graph: POST /v1/graph/cypher",
-        "description": "Calls `POST /v1/graph/cypher` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51186,7 +51186,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypherLite",
         "summary": "knowledge-graph: POST /v1/graph/cypher-lite",
-        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, which cypher-lite needs before it runs a write clause, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, which cypher-lite needs before it runs a write clause, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51276,7 +51276,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphFulltextSearch",
         "summary": "knowledge-graph: POST /v1/graph/fulltext/search",
-        "description": "Calls `POST /v1/graph/fulltext/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/fulltext/search` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51364,7 +51364,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureComposite",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/composite",
-        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51456,7 +51456,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureProperty",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/property",
-        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51545,7 +51545,7 @@
       "get": {
         "operationId": "minds_engineKnowledgeGraphGetGraphIndexStats",
         "summary": "knowledge-graph: GET /v1/graph/index/stats",
-        "description": "Calls `GET /v1/graph/index/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/graph/index/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51609,11 +51609,11 @@
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/microtheory/keyspace": {
-      "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheoryKeyspace",
-        "summary": "knowledge-graph: POST /v1/graph/microtheory/keyspace",
-        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+    "/v1/minds/services/{mind_id}/engine/v1/graph/microtheory": {
+      "get": {
+        "operationId": "minds_engineKnowledgeGraphGetGraphMicrotheory",
+        "summary": "knowledge-graph: GET /v1/graph/microtheory",
+        "description": "Calls `GET /v1/graph/microtheory` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51650,11 +51650,9 @@
         },
         "x-required-scope": "minds:manage",
         "x-minds-engine": {
-          "daemon_method": "POST",
-          "daemon_path": "/v1/graph/microtheory/keyspace",
+          "daemon_method": "GET",
+          "daemon_path": "/v1/graph/microtheory",
           "actions": [
-            "write",
-            "update",
             "read",
             "query"
           ],
@@ -51666,43 +51664,24 @@
           "flag": "enable_graph",
           "grant": "table"
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "name"
-                ],
-                "additionalProperties": true
-              }
-            }
-          }
-        },
         "tags": [
           "minds"
         ],
         "x-genesis-service": "minds",
         "x-upstream": {
           "base": "https://console.life.one/api/v1/minds",
-          "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/microtheory/keyspace",
+          "method": "GET",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/microtheory",
           "status": "not_deployed"
         },
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/microtheory/switch": {
+    "/v1/minds/services/{mind_id}/engine/v1/graph/microtheory/keyspace": {
       "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheorySwitch",
-        "summary": "knowledge-graph: POST /v1/graph/microtheory/switch",
-        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheoryKeyspace",
+        "summary": "knowledge-graph: POST /v1/graph/microtheory/keyspace",
+        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51740,7 +51719,7 @@
         "x-required-scope": "minds:manage",
         "x-minds-engine": {
           "daemon_method": "POST",
-          "daemon_path": "/v1/graph/microtheory/switch",
+          "daemon_path": "/v1/graph/microtheory/keyspace",
           "actions": [
             "write",
             "update",
@@ -51781,85 +51760,17 @@
         "x-upstream": {
           "base": "https://console.life.one/api/v1/minds",
           "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/microtheory/switch",
-          "status": "not_deployed"
-        },
-        "x-mcp": false
-      }
-    },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/schema": {
-      "get": {
-        "operationId": "minds_engineKnowledgeGraphGetGraphSchema",
-        "summary": "knowledge-graph: GET /v1/graph/schema",
-        "description": "Calls `GET /v1/graph/schema` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
-        "parameters": [
-          {
-            "name": "mind_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "format": "uuid"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The Mind engine's JSON response, unchanged.",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "403": {
-            "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
-          },
-          "default": {
-            "description": "Genesis error envelope.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Minds.EngineError"
-                }
-              }
-            }
-          }
-        },
-        "x-required-scope": "minds:manage",
-        "x-minds-engine": {
-          "daemon_method": "GET",
-          "daemon_path": "/v1/graph/schema",
-          "actions": [
-            "read",
-            "query"
-          ],
-          "keyspaces": [
-            "*"
-          ],
-          "scope": "minds:instances:manage",
-          "mintable": false,
-          "flag": "enable_graph",
-          "grant": "table"
-        },
-        "tags": [
-          "minds"
-        ],
-        "x-genesis-service": "minds",
-        "x-upstream": {
-          "base": "https://console.life.one/api/v1/minds",
-          "method": "GET",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/schema",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/microtheory/keyspace",
           "status": "not_deployed"
         },
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/subdomain/query": {
+    "/v1/minds/services/{mind_id}/engine/v1/graph/microtheory/switch": {
       "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphSubdomainQuery",
-        "summary": "knowledge-graph: POST /v1/graph/subdomain/query",
-        "description": "Calls `POST /v1/graph/subdomain/query` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheorySwitch",
+        "summary": "knowledge-graph: POST /v1/graph/microtheory/switch",
+        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51897,10 +51808,12 @@
         "x-required-scope": "minds:manage",
         "x-minds-engine": {
           "daemon_method": "POST",
-          "daemon_path": "/v1/graph/subdomain/query",
+          "daemon_path": "/v1/graph/microtheory/switch",
           "actions": [
-            "query",
-            "read"
+            "write",
+            "update",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -51917,21 +51830,12 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "namespace": {
-                    "type": "string"
-                  },
-                  "domain": {
-                    "type": "string"
-                  },
-                  "subdomain": {
+                  "name": {
                     "type": "string"
-                  },
-                  "limit": {}
+                  }
                 },
                 "required": [
-                  "namespace",
-                  "domain",
-                  "subdomain"
+                  "name"
                 ],
                 "additionalProperties": true
               }
@@ -51945,17 +51849,17 @@
         "x-upstream": {
           "base": "https://console.life.one/api/v1/minds",
           "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/subdomain/query",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/microtheory/switch",
           "status": "not_deployed"
         },
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/begin": {
-      "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphTxBegin",
-        "summary": "knowledge-graph: POST /v1/graph/tx/begin",
-        "description": "Calls `POST /v1/graph/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+    "/v1/minds/services/{mind_id}/engine/v1/graph/schema": {
+      "get": {
+        "operationId": "minds_engineKnowledgeGraphGetGraphSchema",
+        "summary": "knowledge-graph: GET /v1/graph/schema",
+        "description": "Calls `GET /v1/graph/schema` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51992,11 +51896,9 @@
         },
         "x-required-scope": "minds:manage",
         "x-minds-engine": {
-          "daemon_method": "POST",
-          "daemon_path": "/v1/graph/tx/begin",
+          "daemon_method": "GET",
+          "daemon_path": "/v1/graph/schema",
           "actions": [
-            "write",
-            "update",
             "read",
             "query"
           ],
@@ -52014,18 +51916,18 @@
         "x-genesis-service": "minds",
         "x-upstream": {
           "base": "https://console.life.one/api/v1/minds",
-          "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/begin",
+          "method": "GET",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/schema",
           "status": "not_deployed"
         },
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/commit": {
+    "/v1/minds/services/{mind_id}/engine/v1/graph/subdomain/query": {
       "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphTxCommit",
-        "summary": "knowledge-graph: POST /v1/graph/tx/commit",
-        "description": "Calls `POST /v1/graph/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "operationId": "minds_engineKnowledgeGraphPostGraphSubdomainQuery",
+        "summary": "knowledge-graph: POST /v1/graph/subdomain/query",
+        "description": "Calls `POST /v1/graph/subdomain/query` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52063,12 +51965,10 @@
         "x-required-scope": "minds:manage",
         "x-minds-engine": {
           "daemon_method": "POST",
-          "daemon_path": "/v1/graph/tx/commit",
+          "daemon_path": "/v1/graph/subdomain/query",
           "actions": [
-            "write",
-            "update",
-            "read",
-            "query"
+            "query",
+            "read"
           ],
           "keyspaces": [
             "*"
@@ -52085,101 +51985,21 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "id": {
+                  "namespace": {
                     "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "additionalProperties": true
-              }
-            }
-          }
-        },
-        "tags": [
-          "minds"
-        ],
-        "x-genesis-service": "minds",
-        "x-upstream": {
-          "base": "https://console.life.one/api/v1/minds",
-          "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/commit",
-          "status": "not_deployed"
-        },
-        "x-mcp": false
-      }
-    },
-    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/rollback": {
-      "post": {
-        "operationId": "minds_engineKnowledgeGraphPostGraphTxRollback",
-        "summary": "knowledge-graph: POST /v1/graph/tx/rollback",
-        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
-        "parameters": [
-          {
-            "name": "mind_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "format": "uuid"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The Mind engine's JSON response, unchanged.",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "403": {
-            "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
-          },
-          "default": {
-            "description": "Genesis error envelope.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Minds.EngineError"
-                }
-              }
-            }
-          }
-        },
-        "x-required-scope": "minds:manage",
-        "x-minds-engine": {
-          "daemon_method": "POST",
-          "daemon_path": "/v1/graph/tx/rollback",
-          "actions": [
-            "write",
-            "update",
-            "read",
-            "query"
-          ],
-          "keyspaces": [
-            "*"
-          ],
-          "scope": "minds:instances:manage",
-          "mintable": false,
-          "flag": "enable_graph",
-          "grant": "table"
-        },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "id": {
+                  },
+                  "domain": {
                     "type": "string"
-                  }
+                  },
+                  "subdomain": {
+                    "type": "string"
+                  },
+                  "limit": {}
                 },
                 "required": [
-                  "id"
+                  "namespace",
+                  "domain",
+                  "subdomain"
                 ],
                 "additionalProperties": true
               }
@@ -52193,17 +52013,17 @@
         "x-upstream": {
           "base": "https://console.life.one/api/v1/minds",
           "method": "POST",
-          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/rollback",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/subdomain/query",
           "status": "not_deployed"
         },
         "x-mcp": false
       }
     },
-    "/v1/minds/services/{mind_id}/engine/v1/inference/{model_id}": {
+    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/begin": {
       "post": {
-        "operationId": "minds_engineInferencePostInferenceModelId",
-        "summary": "inference: POST /v1/inference/:model_id",
-        "description": "Calls `POST /v1/inference/:model_id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "operationId": "minds_engineKnowledgeGraphPostGraphTxBegin",
+        "summary": "knowledge-graph: POST /v1/graph/tx/begin",
+        "description": "Calls `POST /v1/graph/tx/begin` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52213,15 +52033,263 @@
               "type": "string",
               "format": "uuid"
             }
-          },
-          {
-            "name": "model_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "pattern": "^[A-Za-z0-9_][A-Za-z0-9_.:@+=-]{0,255}$"
-            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The Mind engine's JSON response, unchanged.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "default": {
+            "description": "Genesis error envelope.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Minds.EngineError"
+                }
+              }
+            }
+          }
+        },
+        "x-required-scope": "minds:manage",
+        "x-minds-engine": {
+          "daemon_method": "POST",
+          "daemon_path": "/v1/graph/tx/begin",
+          "actions": [
+            "write",
+            "update",
+            "read",
+            "query"
+          ],
+          "keyspaces": [
+            "*"
+          ],
+          "scope": "minds:instances:manage",
+          "mintable": false,
+          "flag": "enable_graph",
+          "grant": "table"
+        },
+        "tags": [
+          "minds"
+        ],
+        "x-genesis-service": "minds",
+        "x-upstream": {
+          "base": "https://console.life.one/api/v1/minds",
+          "method": "POST",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/begin",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/commit": {
+      "post": {
+        "operationId": "minds_engineKnowledgeGraphPostGraphTxCommit",
+        "summary": "knowledge-graph: POST /v1/graph/tx/commit",
+        "description": "Calls `POST /v1/graph/tx/commit` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "parameters": [
+          {
+            "name": "mind_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The Mind engine's JSON response, unchanged.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "default": {
+            "description": "Genesis error envelope.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Minds.EngineError"
+                }
+              }
+            }
+          }
+        },
+        "x-required-scope": "minds:manage",
+        "x-minds-engine": {
+          "daemon_method": "POST",
+          "daemon_path": "/v1/graph/tx/commit",
+          "actions": [
+            "write",
+            "update",
+            "read",
+            "query"
+          ],
+          "keyspaces": [
+            "*"
+          ],
+          "scope": "minds:instances:manage",
+          "mintable": false,
+          "flag": "enable_graph",
+          "grant": "table"
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "tags": [
+          "minds"
+        ],
+        "x-genesis-service": "minds",
+        "x-upstream": {
+          "base": "https://console.life.one/api/v1/minds",
+          "method": "POST",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/commit",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/minds/services/{mind_id}/engine/v1/graph/tx/rollback": {
+      "post": {
+        "operationId": "minds_engineKnowledgeGraphPostGraphTxRollback",
+        "summary": "knowledge-graph: POST /v1/graph/tx/rollback",
+        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "parameters": [
+          {
+            "name": "mind_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The Mind engine's JSON response, unchanged.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "default": {
+            "description": "Genesis error envelope.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Minds.EngineError"
+                }
+              }
+            }
+          }
+        },
+        "x-required-scope": "minds:manage",
+        "x-minds-engine": {
+          "daemon_method": "POST",
+          "daemon_path": "/v1/graph/tx/rollback",
+          "actions": [
+            "write",
+            "update",
+            "read",
+            "query"
+          ],
+          "keyspaces": [
+            "*"
+          ],
+          "scope": "minds:instances:manage",
+          "mintable": false,
+          "flag": "enable_graph",
+          "grant": "table"
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "tags": [
+          "minds"
+        ],
+        "x-genesis-service": "minds",
+        "x-upstream": {
+          "base": "https://console.life.one/api/v1/minds",
+          "method": "POST",
+          "path": "/v1/services/{mind_id}/engine/v1/graph/tx/rollback",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/minds/services/{mind_id}/engine/v1/inference/{model_id}": {
+      "post": {
+        "operationId": "minds_engineInferencePostInferenceModelId",
+        "summary": "inference: POST /v1/inference/:model_id",
+        "description": "Calls `POST /v1/inference/:model_id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "parameters": [
+          {
+            "name": "mind_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "model_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_][A-Za-z0-9_.:@+=-]{0,255}$"
+            }
           }
         ],
         "responses": {
@@ -52309,7 +52377,7 @@
       "get": {
         "operationId": "minds_engineInferenceGetInferenceJobs",
         "summary": "inference: GET /v1/inference/jobs",
-        "description": "Calls `GET /v1/inference/jobs` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/inference/jobs` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52385,7 +52453,7 @@
       "get": {
         "operationId": "minds_engineInferenceGetInferenceJobsJobId",
         "summary": "inference: GET /v1/inference/jobs/:job_id",
-        "description": "Calls `GET /v1/inference/jobs/:job_id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/inference/jobs/:job_id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52461,7 +52529,7 @@
       "post": {
         "operationId": "minds_engineInferencePostInferenceJobsJobIdCancel",
         "summary": "inference: POST /v1/inference/jobs/:job_id/cancel",
-        "description": "Calls `POST /v1/inference/jobs/:job_id/cancel` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/inference/jobs/:job_id/cancel` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52539,7 +52607,7 @@
       "post": {
         "operationId": "minds_engineInferencePostInferenceJobsJobIdRetry",
         "summary": "inference: POST /v1/inference/jobs/:job_id/retry",
-        "description": "Calls `POST /v1/inference/jobs/:job_id/retry` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/inference/jobs/:job_id/retry` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_inference` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52617,7 +52685,7 @@
       "post": {
         "operationId": "minds_engineAnalyticsPostIngest",
         "summary": "analytics: POST /v1/ingest",
-        "description": "Calls `POST /v1/ingest` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ingest` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52709,7 +52777,7 @@
       "get": {
         "operationId": "minds_engineKeyValueGetKeyspaces",
         "summary": "key-value: GET /v1/keyspaces",
-        "description": "Calls `GET /v1/keyspaces` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/keyspaces` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52774,7 +52842,7 @@
       "post": {
         "operationId": "minds_engineKeyValuePostKeyspaces",
         "summary": "key-value: POST /v1/keyspaces",
-        "description": "Calls `POST /v1/keyspaces` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `admin` on `{body.name}` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/keyspaces` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `admin` on `{body.name}` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52871,7 +52939,7 @@
       "delete": {
         "operationId": "minds_engineKeyValueDeleteKeyspacesName",
         "summary": "key-value: DELETE /v1/keyspaces/:name",
-        "description": "Calls `DELETE /v1/keyspaces/:name` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `admin` on `{path.name}` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `DELETE /v1/keyspaces/:name` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `admin` on `{path.name}` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52946,7 +53014,7 @@
       "get": {
         "operationId": "minds_engineKeyValueGetKeyspacesName",
         "summary": "key-value: GET /v1/keyspaces/:name",
-        "description": "Calls `GET /v1/keyspaces/:name` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `{path.name}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/keyspaces/:name` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `{path.name}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53023,7 +53091,7 @@
       "post": {
         "operationId": "minds_engineLineagePostLineageGraph",
         "summary": "lineage: POST /v1/lineage/graph",
-        "description": "Calls `POST /v1/lineage/graph` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/lineage/graph` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53106,7 +53174,7 @@
       "post": {
         "operationId": "minds_engineLineagePostLineageImpact",
         "summary": "lineage: POST /v1/lineage/impact",
-        "description": "Calls `POST /v1/lineage/impact` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/lineage/impact` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53193,7 +53261,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageNodesId",
         "summary": "lineage: GET /v1/lineage/nodes/:id",
-        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53270,7 +53338,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageStats",
         "summary": "lineage: GET /v1/lineage/stats",
-        "description": "Calls `GET /v1/lineage/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53338,7 +53406,7 @@
       "post": {
         "operationId": "minds_engineLineagePostLineageVerify",
         "summary": "lineage: POST /v1/lineage/verify",
-        "description": "Calls `POST /v1/lineage/verify` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/lineage/verify` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53425,7 +53493,7 @@
       "post": {
         "operationId": "minds_engineMcpPostMcpToolsCall",
         "summary": "mcp: POST /v1/mcp/tools/call",
-        "description": "Calls `POST /v1/mcp/tools/call` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: per tool, from the daemon's MCP authority table (for example `recall` mints query on memory:episodic); `configure_index` and a vault export need minds:instances:manage. Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mcp` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` plus the scope of the tool's grant (`minds:write` for writes, `minds:manage` for `configure_index` and a vault export). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/mcp/tools/call` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: per tool, from the daemon's MCP authority table (for example `recall` mints query on memory:episodic); `configure_index` and a vault export need minds:instances:manage. Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_mcp` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` plus the scope of the tool's grant (`minds:write` for writes, `minds:manage` for `configure_index` and a vault export). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53517,7 +53585,7 @@
       "post": {
         "operationId": "minds_engineMcpPostMcpToolsList",
         "summary": "mcp: POST /v1/mcp/tools/list",
-        "description": "Calls `POST /v1/mcp/tools/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_mcp` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/mcp/tools/list` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_mcp` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53596,7 +53664,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveDecision",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/decision",
-        "description": "Calls `POST /v1/memory/cognitive/decision` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/decision` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53682,7 +53750,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveInteraction",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/interaction",
-        "description": "Calls `POST /v1/memory/cognitive/interaction` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/interaction` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53768,7 +53836,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveQuery",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/query",
-        "description": "Calls `POST /v1/memory/cognitive/query` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/query` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53852,7 +53920,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveResource",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/resource",
-        "description": "Calls `POST /v1/memory/cognitive/resource` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/resource` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53930,7 +53998,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveResources",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/resources",
-        "description": "Calls `POST /v1/memory/cognitive/resources` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/resources` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54008,7 +54076,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveResourcesUsage",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/resources/usage",
-        "description": "Calls `POST /v1/memory/cognitive/resources/usage` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/resources/usage` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54086,7 +54154,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveSession",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/session",
-        "description": "Calls `POST /v1/memory/cognitive/session` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/session` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54176,7 +54244,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveThought",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/thought",
-        "description": "Calls `POST /v1/memory/cognitive/thought` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/thought` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:cognitive` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54262,7 +54330,7 @@
       "post": {
         "operationId": "minds_engineCognitiveMemoryPostMemoryCognitiveUsage",
         "summary": "cognitive-memory: POST /v1/memory/cognitive/usage",
-        "description": "Calls `POST /v1/memory/cognitive/usage` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/cognitive/usage` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `memory:cognitive` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54340,7 +54408,7 @@
       "post": {
         "operationId": "minds_engineEpisodicMemoryPostMemoryEpisodic",
         "summary": "episodic-memory: POST /v1/memory/episodic",
-        "description": "Calls `POST /v1/memory/episodic` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/episodic` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54424,7 +54492,7 @@
       "delete": {
         "operationId": "minds_engineEpisodicMemoryDeleteMemoryEpisodicId",
         "summary": "episodic-memory: DELETE /v1/memory/episodic/:id",
-        "description": "Calls `DELETE /v1/memory/episodic/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `DELETE /v1/memory/episodic/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54498,7 +54566,7 @@
       "get": {
         "operationId": "minds_engineEpisodicMemoryGetMemoryEpisodicId",
         "summary": "episodic-memory: GET /v1/memory/episodic/:id",
-        "description": "Calls `GET /v1/memory/episodic/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/episodic/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54572,7 +54640,7 @@
       "put": {
         "operationId": "minds_engineEpisodicMemoryPutMemoryEpisodicId",
         "summary": "episodic-memory: PUT /v1/memory/episodic/:id",
-        "description": "Calls `PUT /v1/memory/episodic/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `PUT /v1/memory/episodic/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `update` on `memory:episodic` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54666,7 +54734,7 @@
       "post": {
         "operationId": "minds_engineEpisodicMemoryPostMemoryEpisodicSearch",
         "summary": "episodic-memory: POST /v1/memory/episodic/search",
-        "description": "Calls `POST /v1/memory/episodic/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/episodic/search` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54750,7 +54818,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProcedures",
         "summary": "procedural-memory: POST /v1/memory/procedures",
-        "description": "Calls `POST /v1/memory/procedures` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54836,7 +54904,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresDelete",
         "summary": "procedural-memory: POST /v1/memory/procedures/delete",
-        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete`, `read`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54924,7 +54992,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresGet",
         "summary": "procedural-memory: POST /v1/memory/procedures/get",
-        "description": "Calls `POST /v1/memory/procedures/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/get` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55011,7 +55079,7 @@
       "get": {
         "operationId": "minds_engineProceduralMemoryGetMemoryProceduresList",
         "summary": "procedural-memory: GET /v1/memory/procedures/list",
-        "description": "Calls `GET /v1/memory/procedures/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/procedures/list` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55079,7 +55147,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresSearch",
         "summary": "procedural-memory: POST /v1/memory/procedures/search",
-        "description": "Calls `POST /v1/memory/procedures/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/search` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55166,7 +55234,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresUpdate",
         "summary": "procedural-memory: POST /v1/memory/procedures/update",
-        "description": "Calls `POST /v1/memory/procedures/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/update` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `update`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55258,7 +55326,7 @@
       "get": {
         "operationId": "minds_engineMemoryGetMemoryReindexStatus",
         "summary": "memory: GET /v1/memory/reindex/status",
-        "description": "Calls `GET /v1/memory/reindex/status` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:system` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/reindex/status` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:system` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55325,7 +55393,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResources",
         "summary": "resource-memory: POST /v1/memory/resources",
-        "description": "Calls `POST /v1/memory/resources` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:resource` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:resource` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55415,7 +55483,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesAccess",
         "summary": "resource-memory: POST /v1/memory/resources/access",
-        "description": "Calls `POST /v1/memory/resources/access` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update`, `write` on `memory:resource` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/access` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `update`, `write` on `memory:resource` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55455,6 +55523,7 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/resources/access",
           "actions": [
+            "read",
             "update",
             "write"
           ],
@@ -55506,7 +55575,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesChunks",
         "summary": "resource-memory: POST /v1/memory/resources/chunks",
-        "description": "Calls `POST /v1/memory/resources/chunks` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/chunks` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55592,7 +55661,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesData",
         "summary": "resource-memory: POST /v1/memory/resources/data",
-        "description": "Calls `POST /v1/memory/resources/data` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/data` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55678,7 +55747,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesDataExists",
         "summary": "resource-memory: POST /v1/memory/resources/data/exists",
-        "description": "Calls `POST /v1/memory/resources/data/exists` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/data/exists` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55764,7 +55833,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesDataSize",
         "summary": "resource-memory: POST /v1/memory/resources/data/size",
-        "description": "Calls `POST /v1/memory/resources/data/size` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/data/size` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55850,7 +55919,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesGet",
         "summary": "resource-memory: POST /v1/memory/resources/get",
-        "description": "Calls `POST /v1/memory/resources/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/get` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55936,7 +56005,7 @@
       "get": {
         "operationId": "minds_engineResourceMemoryGetMemoryResourcesList",
         "summary": "resource-memory: GET /v1/memory/resources/list",
-        "description": "Calls `GET /v1/memory/resources/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/resources/list` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56004,7 +56073,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesType",
         "summary": "resource-memory: POST /v1/memory/resources/type",
-        "description": "Calls `POST /v1/memory/resources/type` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/type` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56091,7 +56160,7 @@
       "post": {
         "operationId": "minds_engineResourceMemoryPostMemoryResourcesUsage",
         "summary": "resource-memory: POST /v1/memory/resources/usage",
-        "description": "Calls `POST /v1/memory/resources/usage` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/resources/usage` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:resource` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56178,7 +56247,7 @@
       "post": {
         "operationId": "minds_engineMemoryPostMemoryRetrievalHybrid",
         "summary": "memory: POST /v1/memory/retrieval/hybrid",
-        "description": "Calls `POST /v1/memory/retrieval/hybrid` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/retrieval/hybrid` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `memory:episodic` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56268,7 +56337,7 @@
       "get": {
         "operationId": "minds_engineMemoryGetMemoryStats",
         "summary": "memory: GET /v1/memory/stats",
-        "description": "Calls `GET /v1/memory/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:system` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:system` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56335,7 +56404,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVault",
         "summary": "vault: POST /v1/memory/vault",
-        "description": "Calls `POST /v1/memory/vault` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `read`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56431,7 +56500,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultAccessLog",
         "summary": "vault: POST /v1/memory/vault/access-log",
-        "description": "Calls `POST /v1/memory/vault/access-log` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `admin` on `memory:vault` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/access-log` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `admin` on `memory:vault` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56512,7 +56581,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultDelete",
         "summary": "vault: POST /v1/memory/vault/delete",
-        "description": "Calls `POST /v1/memory/vault/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/delete` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete`, `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56601,7 +56670,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultGet",
         "summary": "vault: POST /v1/memory/vault/get",
-        "description": "Calls `POST /v1/memory/vault/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/get` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56689,7 +56758,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultSearch",
         "summary": "vault: POST /v1/memory/vault/search",
-        "description": "Calls `POST /v1/memory/vault/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/search` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56777,7 +56846,7 @@
       "get": {
         "operationId": "minds_engineVaultGetMemoryVaultStats",
         "summary": "vault: GET /v1/memory/vault/stats",
-        "description": "Calls `GET /v1/memory/vault/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/memory/vault/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56845,7 +56914,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultUpdate",
         "summary": "vault: POST /v1/memory/vault/update",
-        "description": "Calls `POST /v1/memory/vault/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/update` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `update`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56933,7 +57002,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlEmbed",
         "summary": "machine-learning: POST /v1/ml/embed",
-        "description": "Calls `POST /v1/ml/embed` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/embed` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57024,7 +57093,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlGenerate",
         "summary": "machine-learning: POST /v1/ml/generate",
-        "description": "Calls `POST /v1/ml/generate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/generate` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57117,7 +57186,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlMetrics",
         "summary": "machine-learning: POST /v1/ml/metrics",
-        "description": "Calls `POST /v1/ml/metrics` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/metrics` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57204,7 +57273,7 @@
       "get": {
         "operationId": "minds_engineMachineLearningGetMlModels",
         "summary": "machine-learning: GET /v1/ml/models",
-        "description": "Calls `GET /v1/ml/models` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/models` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57272,7 +57341,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsLoad",
         "summary": "machine-learning: POST /v1/ml/models/load",
-        "description": "Calls `POST /v1/ml/models/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/load` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57370,7 +57439,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsUnload",
         "summary": "machine-learning: POST /v1/ml/models/unload",
-        "description": "Calls `POST /v1/ml/models/unload` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/unload` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57458,7 +57527,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTokenizersLoad",
         "summary": "machine-learning: POST /v1/ml/tokenizers/load",
-        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57545,7 +57614,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainHrm",
         "summary": "machine-learning: POST /v1/ml/train/hrm",
-        "description": "Calls `POST /v1/ml/train/hrm` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/hrm` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57653,7 +57722,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainSupervised",
         "summary": "machine-learning: POST /v1/ml/train/supervised",
-        "description": "Calls `POST /v1/ml/train/supervised` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/supervised` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57758,7 +57827,7 @@
       "get": {
         "operationId": "minds_engineVectorsGetMlVector",
         "summary": "vectors: GET /v1/ml/vector",
-        "description": "Calls `GET /v1/ml/vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/vector` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57826,7 +57895,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorAdd",
         "summary": "vectors: POST /v1/ml/vector/add",
-        "description": "Calls `POST /v1/ml/vector/add` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/add` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -57926,7 +57995,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorCreate",
         "summary": "vectors: POST /v1/ml/vector/create",
-        "description": "Calls `POST /v1/ml/vector/create` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/create` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58023,7 +58092,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorSave",
         "summary": "vectors: POST /v1/ml/vector/save",
-        "description": "Calls `POST /v1/ml/vector/save` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/save` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58112,7 +58181,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorSearch",
         "summary": "vectors: POST /v1/ml/vector/search",
-        "description": "Calls `POST /v1/ml/vector/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/search` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58210,7 +58279,7 @@
       "get": {
         "operationId": "minds_engineReasoningGetNsCacheStats",
         "summary": "reasoning: GET /v1/ns/cache/stats",
-        "description": "Calls `GET /v1/ns/cache/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ns/cache/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58277,7 +58346,7 @@
       "get": {
         "operationId": "minds_engineReasoningGetNsHistory",
         "summary": "reasoning: GET /v1/ns/history",
-        "description": "Calls `GET /v1/ns/history` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ns/history` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58344,7 +58413,7 @@
       "post": {
         "operationId": "minds_engineReasoningPostNsPathsFind",
         "summary": "reasoning: POST /v1/ns/paths/find",
-        "description": "Calls `POST /v1/ns/paths/find` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ns/paths/find` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58435,7 +58504,7 @@
       "post": {
         "operationId": "minds_engineReasoningPostNsPrefetchStart",
         "summary": "reasoning: POST /v1/ns/prefetch/start",
-        "description": "Calls `POST /v1/ns/prefetch/start` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ns/prefetch/start` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58523,7 +58592,7 @@
       "post": {
         "operationId": "minds_engineReasoningPostNsPrefetchStop",
         "summary": "reasoning: POST /v1/ns/prefetch/stop",
-        "description": "Calls `POST /v1/ns/prefetch/stop` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ns/prefetch/stop` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58592,7 +58661,7 @@
       "post": {
         "operationId": "minds_engineReasoningPostNsRetrieve",
         "summary": "reasoning: POST /v1/ns/retrieve",
-        "description": "Calls `POST /v1/ns/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ns/retrieve` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58681,7 +58750,7 @@
       "post": {
         "operationId": "minds_engineReasoningPostNsRetrieveWithMode",
         "summary": "reasoning: POST /v1/ns/retrieve_with_mode",
-        "description": "Calls `POST /v1/ns/retrieve_with_mode` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ns/retrieve_with_mode` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58770,7 +58839,7 @@
       "get": {
         "operationId": "minds_engineReasoningGetNsRules",
         "summary": "reasoning: GET /v1/ns/rules",
-        "description": "Calls `GET /v1/ns/rules` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ns/rules` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58837,7 +58906,7 @@
       "get": {
         "operationId": "minds_engineReasoningGetNsStats",
         "summary": "reasoning: GET /v1/ns/stats",
-        "description": "Calls `GET /v1/ns/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ns/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_neurosymbolic` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58904,7 +58973,7 @@
       "post": {
         "operationId": "minds_engineKeyValuePostPrimitivesExport",
         "summary": "key-value: POST /v1/primitives/export",
-        "description": "Calls `POST /v1/primitives/export` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `{body.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/primitives/export` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query` on `{body.keyspace}` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58991,7 +59060,7 @@
       "post": {
         "operationId": "minds_engineKeyValuePostPrimitivesImport",
         "summary": "key-value: POST /v1/primitives/import",
-        "description": "Calls `POST /v1/primitives/import` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `{body.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/primitives/import` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `{body.keyspace}` (minds:instances:update). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59086,7 +59155,7 @@
       "get": {
         "operationId": "minds_engineLearningIsolationGetQuarantineItems",
         "summary": "learning-isolation: GET /v1/quarantine/items",
-        "description": "Calls `GET /v1/quarantine/items` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/quarantine/items` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59172,7 +59241,7 @@
       "get": {
         "operationId": "minds_engineLearningIsolationGetQuarantineItemsId",
         "summary": "learning-isolation: GET /v1/quarantine/items/:id",
-        "description": "Calls `GET /v1/quarantine/items/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/quarantine/items/:id` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59248,7 +59317,7 @@
       "post": {
         "operationId": "minds_engineLearningIsolationPostQuarantineItemsIdApprove",
         "summary": "learning-isolation: POST /v1/quarantine/items/:id/approve",
-        "description": "Calls `POST /v1/quarantine/items/:id/approve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `_system_quarantine` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/quarantine/items/:id/approve` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `_system_quarantine` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59326,7 +59395,7 @@
       "post": {
         "operationId": "minds_engineLearningIsolationPostQuarantineItemsIdReject",
         "summary": "learning-isolation: POST /v1/quarantine/items/:id/reject",
-        "description": "Calls `POST /v1/quarantine/items/:id/reject` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `_system_quarantine` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/quarantine/items/:id/reject` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `_system_quarantine` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59404,7 +59473,7 @@
       "get": {
         "operationId": "minds_engineLearningIsolationGetQuarantinePolicies",
         "summary": "learning-isolation: GET /v1/quarantine/policies",
-        "description": "Calls `GET /v1/quarantine/policies` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/quarantine/policies` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59471,7 +59540,7 @@
       "get": {
         "operationId": "minds_engineLearningIsolationGetQuarantineStats",
         "summary": "learning-isolation: GET /v1/quarantine/stats",
-        "description": "Calls `GET /v1/quarantine/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/quarantine/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59539,7 +59608,7 @@
       "post": {
         "operationId": "minds_engineLearningIsolationPostQuarantineTestGate",
         "summary": "learning-isolation: POST /v1/quarantine/test-gate",
-        "description": "Calls `POST /v1/quarantine/test-gate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/quarantine/test-gate` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `_system_quarantine` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59631,7 +59700,7 @@
       "post": {
         "operationId": "minds_engineMaintenancePostSearchText",
         "summary": "maintenance: POST /v1/search/text",
-        "description": "Calls `POST /v1/search/text` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` or `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/search/text` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` or `enable_analytics` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59723,7 +59792,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkBuild",
         "summary": "spiking-networks: POST /v1/snn/network/build",
-        "description": "Calls `POST /v1/snn/network/build` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:admin`, `snn:write`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/build` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:admin`, `snn:write`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59807,7 +59876,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkCompile",
         "summary": "spiking-networks: POST /v1/snn/network/compile",
-        "description": "Calls `POST /v1/snn/network/compile` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:execute`, `snn:write` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/compile` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:execute`, `snn:write` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59890,7 +59959,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkState",
         "summary": "spiking-networks: POST /v1/snn/network/state",
-        "description": "Calls `POST /v1/snn/network/state` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/state` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:read`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -59973,7 +60042,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkStep",
         "summary": "spiking-networks: POST /v1/snn/network/step",
-        "description": "Calls `POST /v1/snn/network/step` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:execute` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/step` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:execute` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60055,7 +60124,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNeurons",
         "summary": "spiking-networks: POST /v1/snn/neurons",
-        "description": "Calls `POST /v1/snn/neurons` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/neurons` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60144,7 +60213,7 @@
       "get": {
         "operationId": "minds_engineSpikingNetworksGetSnnStats",
         "summary": "spiking-networks: GET /v1/snn/stats",
-        "description": "Calls `GET /v1/snn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/snn/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60214,7 +60283,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnTrainBptt",
         "summary": "spiking-networks: POST /v1/snn/train/bptt",
-        "description": "Calls `POST /v1/snn/train/bptt` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:train` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/train/bptt` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `snn:train` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:update). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60296,7 +60365,7 @@
       "get": {
         "operationId": "minds_engineKeyValueGetStats",
         "summary": "key-value: GET /v1/stats",
-        "description": "Calls `GET /v1/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `genesis:none` (minds:instances:read). Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60363,7 +60432,7 @@
       "post": {
         "operationId": "minds_engineTextChunkingPostTextChunk",
         "summary": "text-chunking: POST /v1/text/chunk",
-        "description": "Calls `POST /v1/text/chunk` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `genesis:none` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/text/chunk` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `genesis:none` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60450,7 +60519,7 @@
       "get": {
         "operationId": "minds_engineTextChunkingGetTextChunkConfig",
         "summary": "text-chunking: GET /v1/text/chunk/config",
-        "description": "Calls `GET /v1/text/chunk/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `genesis:none` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/text/chunk/config` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `genesis:none` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60517,7 +60586,7 @@
       "post": {
         "operationId": "minds_engineTransactionsPostTxAbort",
         "summary": "transactions: POST /v1/tx/abort",
-        "description": "Calls `POST /v1/tx/abort` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/tx/abort` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60605,7 +60674,7 @@
       "post": {
         "operationId": "minds_engineTransactionsPostTxBegin",
         "summary": "transactions: POST /v1/tx/begin",
-        "description": "Calls `POST /v1/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/tx/begin` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60697,7 +60766,7 @@
       "post": {
         "operationId": "minds_engineTransactionsPostTxCommit",
         "summary": "transactions: POST /v1/tx/commit",
-        "description": "Calls `POST /v1/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/tx/commit` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Auth does not delegate minds:instances:manage to Console sessions, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage, layer gateway) before any delegation; use an org API key with `minds:manage`. Exists only on Minds created with `enable_kv` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60785,7 +60854,7 @@
       "get": {
         "operationId": "minds_engineWorkingMemoryGetWorkingMemorySlots",
         "summary": "working-memory: GET /v1/working-memory/slots",
-        "description": "Calls `GET /v1/working-memory/slots` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:working` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/working-memory/slots` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:working` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60852,7 +60921,7 @@
       "post": {
         "operationId": "minds_engineWorkingMemoryPostWorkingMemorySlotsClear",
         "summary": "working-memory: POST /v1/working-memory/slots/clear",
-        "description": "Calls `POST /v1/working-memory/slots/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:working` (minds:instances:update). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/working-memory/slots/clear` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `delete` on `memory:working` (minds:instances:update). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -60938,7 +61007,7 @@
       "post": {
         "operationId": "minds_engineWorkingMemoryPostWorkingMemorySlotsInject",
         "summary": "working-memory: POST /v1/working-memory/slots/inject",
-        "description": "Calls `POST /v1/working-memory/slots/inject` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:working` (minds:instances:update). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/working-memory/slots/inject` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `write` on `memory:working` (minds:instances:update). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` and `minds:write`. A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -61026,7 +61095,7 @@
       "get": {
         "operationId": "minds_engineWorkingMemoryGetWorkingMemoryStats",
         "summary": "working-memory: GET /v1/working-memory/stats",
-        "description": "Calls `GET /v1/working-memory/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:working` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/working-memory/stats` on the selected Mind's engine with a capability minted for this request only, in the selection's environment. Grant: actions `read` on `memory:working` (minds:instances:read). Registered on every Mind. Requires a `genesis login` session with a Console selection, or an org API key. Org API keys with a Sandbox or Live binding are admitted with `minds:read` (or `minds:write`). A Live selection reaches its Live Mind only once the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); until then it answers 409 `ENVIRONMENT_NOT_AVAILABLE` before any capability is minted. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -78587,6 +78656,460 @@
         "x-mcp": true
       }
     },
+    "/v1/credits": {
+      "get": {
+        "operationId": "gateway_getCredits",
+        "summary": "Your One credit balance",
+        "description": "The credit balance of your own organization (a One tenant): plan and period, balance in micro-USD (1 credit = 10,000 micro-USD) and credits, the buckets it is drawn from, this month's spend by source, the borrow ceiling and use, auto-refill, the Stripe subscription, the count of paid-seat fundings waiting to be moved (`seat_funding_pending`) and the Foundry cap mirror (`foundry`). Needs genesis.billing.read: a login session, or an org API key bound to the organization. Takes no query. An organization that is not a One tenant answers 404 credits_account_not_found. Stripe test mode only; a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE.",
+        "responses": {
+          "200": {
+            "description": "The credit balance",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditBalance"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (an M2M token, or a key without genesis.billing.read)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "ENVIRONMENT_NOT_AVAILABLE (a Live selection)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "GET",
+          "path": "/v1/credits",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/credits/entries": {
+      "get": {
+        "operationId": "gateway_listCreditEntries",
+        "summary": "Your One credit ledger",
+        "description": "Append-only ledger entries, newest first: the signed change in micro-USD, the balance after it, the reason, the bucket, the run or receipt it belongs to and a flat detail record (the overrun amount of an inflight_overrun entry, for example). Page with `before` (the `next_before` of the previous page). Needs genesis.billing.read.",
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            },
+            "description": "Entries per page (default set by the service)"
+          },
+          {
+            "name": "before",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_\\-:.]{1,128}$"
+            },
+            "description": "The next_before cursor of the previous page"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "One page of ledger entries",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditEntryPage"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request (an unknown query parameter",
+            "or a bad limit or cursor)": null
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "ENVIRONMENT_NOT_AVAILABLE (a Live selection)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "GET",
+          "path": "/v1/credits/entries",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/credits/usage": {
+      "get": {
+        "operationId": "gateway_listCreditUsage",
+        "summary": "Credits spent by a run or turn",
+        "description": "The usage rows behind a debit, with the credits each cost. `ref` is the Henry run id or the Foundry receipt id the ledger entry carries. Needs genesis.billing.read.",
+        "parameters": [
+          {
+            "name": "ref",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "pattern": "^[\\x21-\\x7e]{1,200}$"
+            },
+            "description": "The Henry run id (henry:<run>:<phase>) or receipt id: 1 to 200 visible ASCII characters"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Usage rows",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditUsage"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "ENVIRONMENT_NOT_AVAILABLE (a Live selection)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "GET",
+          "path": "/v1/credits/usage",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/credits/settings": {
+      "patch": {
+        "operationId": "gateway_updateCreditSettings",
+        "summary": "Change your borrow ceiling and auto-refill",
+        "description": "Changes only the settings you send: `borrow_ceiling_credits` (how many credits your agents' seats may borrow from your balance in a period) and `auto_refill` (`enabled`, `pack` 10, 25 or 50, `monthly_ceiling_credits`). Unknown fields are refused. Needs genesis.billing.manage and an Idempotency-Key; reuse the key to replay.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Gateway.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Gateway.CreditSettingsPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The settings after the change",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditSettings"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request, idempotency_key_required or a value the service refuses"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (needs genesis.billing.manage)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "the Idempotency-Key was used for a different request",
+            "or ENVIRONMENT_NOT_AVAILABLE (a Live selection)": null
+          },
+          "413": {
+            "description": "body_too_large (16 KiB)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "PATCH",
+          "path": "/v1/credits/settings",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/credits/checkout": {
+      "post": {
+        "operationId": "gateway_createCreditCheckout",
+        "summary": "Start a Stripe Checkout for a plan, seats or a credit pack",
+        "description": "Returns the hosted Stripe Checkout URL (test mode) for the items: a plan or seat price (`one_one_monthly`, `one_pro_monthly`, `one_operator_monthly`, ...) or a credit pack (`one_pack_10`, `one_pack_25`, `one_pack_50`). The URL is always on https://checkout.stripe.com and never a live-mode session. Nothing is charged until you pay on that page. Needs genesis.billing.manage and an Idempotency-Key.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Gateway.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Gateway.CreditItems"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The Checkout URL",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditCheckout"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request, idempotency_key_required or an item the service refuses"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (needs genesis.billing.manage)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "the Idempotency-Key was used for a different request",
+            "or ENVIRONMENT_NOT_AVAILABLE (a Live selection)": null
+          },
+          "413": {
+            "description": "body_too_large (16 KiB)"
+          },
+          "502": {
+            "description": "invalid_response (including a Checkout URL that is not on checkout.stripe.com or is a live-mode session)"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "POST",
+          "path": "/v1/credits/checkout",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/credits/subscription": {
+      "post": {
+        "operationId": "gateway_changeCreditSubscription",
+        "summary": "Change your plan or seats",
+        "description": "Upgrades or downgrades the subscription to `items` (a plan lookup key and seat quantities); Stripe prorates. Needs genesis.billing.manage and an Idempotency-Key.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Gateway.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Gateway.CreditItems"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The subscription after the change",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditSubscriptionResult"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request, idempotency_key_required or an item the service refuses"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (needs genesis.billing.manage)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "the Idempotency-Key was used for a different request",
+            "or ENVIRONMENT_NOT_AVAILABLE (a Live selection)": null
+          },
+          "413": {
+            "description": "body_too_large (16 KiB)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "POST",
+          "path": "/v1/credits/subscription",
+          "status": "live"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "gateway_cancelCreditSubscription",
+        "summary": "Cancel your subscription at the end of the period",
+        "description": "Cancels at period end: your plan and seats keep working until `current_period_end`, then the organization returns to the free plan. Takes no body. Needs genesis.billing.manage and an Idempotency-Key.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Gateway.IdempotencyKey"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The subscription, now cancel_at_period_end",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditSubscriptionResult"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request or idempotency_key_required"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (needs genesis.billing.manage)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "the Idempotency-Key was used for a different request",
+            "or ENVIRONMENT_NOT_AVAILABLE (a Live selection)": null
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "DELETE",
+          "path": "/v1/credits/subscription",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/taps/taps": {
       "post": {
         "operationId": "taps_createTap",
@@ -99997,8 +100520,6 @@
           "organizationId",
           "billingAccountId",
           "environmentId",
-          "stripeAccountId",
-          "stripeCustomerId",
           "livemode",
           "canEnsure"
         ],
@@ -100030,9 +100551,11 @@
             ]
           },
           "stripeAccountId": {
+            "description": "Present for a human Console session only; never returned to an org API key.",
             "type": "string"
           },
           "stripeCustomerId": {
+            "description": "Present for a human Console session only; never returned to an org API key.",
             "type": [
               "string",
               "null"
@@ -107698,6 +108221,7 @@
             "enum": [
               "sandbox_allowance",
               "stripe_test_metered",
+              "internal_allowance",
               null
             ]
           },
@@ -107775,6 +108299,7 @@
             ],
             "enum": [
               "sandbox_allowance",
+              "internal_allowance",
               null
             ]
           },
@@ -121746,8 +122271,15 @@
         "properties": {
           "credits": {
             "type": "integer",
-            "minimum": 1,
-            "maximum": 100000000
+            "minimum": 0,
+            "maximum": 100000000,
+            "description": "May be 0 when computer_minutes is above 0"
+          },
+          "computer_minutes": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 100000000,
+            "description": "Added to the seat's computer entitlement; not for helper or pooled seats"
           },
           "idempotency_key": {
             "$ref": "#/components/schemas/Fleets.IdempotencyKey"
@@ -130285,9 +130817,9 @@
         "properties": {
           "name": {
             "type": "string",
-            "pattern": "^Sandbox(?: .+)?$",
             "maxLength": 80,
-            "description": "Mind on existing Sandbox placement; capacity and tenant are server owned."
+            "description": "Sandbox: \"Sandbox\" or \"Sandbox <label>\". Live: any non-blank name. At most 80 bytes after trimming; capacity and tenant are server owned.",
+            "minLength": 1
           },
           "plan": {
             "type": "string",
@@ -140954,6 +141486,530 @@
           }
         }
       },
+      "Gateway.CreditSubscription": {
+        "type": "object",
+        "required": [
+          "status",
+          "items",
+          "current_period_end",
+          "cancel_at_period_end"
+        ],
+        "properties": {
+          "status": {
+            "type": "string"
+          },
+          "items": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditItem"
+            }
+          },
+          "current_period_end": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "cancel_at_period_end": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Gateway.CreditItem": {
+        "type": "object",
+        "required": [
+          "lookup_key",
+          "quantity"
+        ],
+        "properties": {
+          "lookup_key": {
+            "type": "string",
+            "pattern": "^one_[a-z0-9_]{1,56}$",
+            "description": "A Stripe price lookup key of the One catalog (one_one_monthly",
+            "one_pack_25": null,
+            "...)": null
+          },
+          "quantity": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 1000
+          }
+        }
+      },
+      "Gateway.CreditItems": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "items"
+        ],
+        "properties": {
+          "items": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 10,
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditItem"
+            }
+          }
+        }
+      },
+      "Gateway.CreditBorrow": {
+        "type": "object",
+        "required": [
+          "ceiling_credits",
+          "used_credits"
+        ],
+        "properties": {
+          "ceiling_credits": {
+            "type": "number"
+          },
+          "used_credits": {
+            "type": "number"
+          }
+        }
+      },
+      "Gateway.CreditAutoRefill": {
+        "type": "object",
+        "required": [
+          "enabled",
+          "pack",
+          "monthly_ceiling_credits"
+        ],
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "pack": {
+            "type": [
+              "number",
+              "null"
+            ],
+            "description": "The pack bought on a refill: 10, 25 or 50 credits"
+          },
+          "monthly_ceiling_credits": {
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "used_this_month_credits": {
+            "type": "number"
+          }
+        }
+      },
+      "Gateway.CreditBalance": {
+        "type": "object",
+        "required": [
+          "org",
+          "plan",
+          "period",
+          "balance_micro_usd",
+          "balance_credits",
+          "buckets",
+          "month",
+          "borrow",
+          "auto_refill",
+          "subscription"
+        ],
+        "properties": {
+          "org": {
+            "type": "string"
+          },
+          "plan": {
+            "type": "string",
+            "description": "free, one, pro, max (and the seat plans)"
+          },
+          "period": {
+            "type": "object",
+            "required": [
+              "start",
+              "end"
+            ],
+            "properties": {
+              "start": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "end": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            }
+          },
+          "balance_micro_usd": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Integer micro-USD at provider list price; 1 credit = 10,000"
+          },
+          "balance_credits": {
+            "type": "number",
+            "description": "balance_micro_usd / 10,000, up to 4 decimals"
+          },
+          "buckets": {
+            "type": "object",
+            "required": [
+              "allowance",
+              "pack",
+              "refill",
+              "grant"
+            ],
+            "properties": {
+              "allowance": {
+                "type": "number",
+                "description": "Plan allowance for the period; does not roll over"
+              },
+              "seat": {
+                "type": "number",
+                "description": "A paid seat's allowance waiting to be moved into its purse; never spent directly"
+              },
+              "pack": {
+                "type": "number",
+                "description": "Purchased credits; expire 12 months after purchase"
+              },
+              "refill": {
+                "type": "number"
+              },
+              "grant": {
+                "type": "number"
+              }
+            }
+          },
+          "month": {
+            "type": "object",
+            "required": [
+              "spent_micro_usd",
+              "by_source"
+            ],
+            "properties": {
+              "spent_micro_usd": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "by_source": {
+                "type": "object",
+                "required": [
+                  "inference",
+                  "computer",
+                  "voice"
+                ],
+                "properties": {
+                  "inference": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "computer": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "voice": {
+                    "type": "integer",
+                    "minimum": 0
+                  }
+                }
+              }
+            }
+          },
+          "borrow": {
+            "$ref": "#/components/schemas/Gateway.CreditBorrow"
+          },
+          "auto_refill": {
+            "$ref": "#/components/schemas/Gateway.CreditAutoRefill"
+          },
+          "subscription": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/Gateway.CreditSubscription"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "seat_funding_pending": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Paid-seat fundings waiting for One to move them into Fleets purses"
+          },
+          "foundry": {
+            "type": "object",
+            "required": [
+              "status",
+              "granted_micro_usd"
+            ],
+            "description": "The mirror of your credits as Foundry's prepaid cap",
+            "properties": {
+              "status": {
+                "type": "string",
+                "description": "registered, pending, disabled or external"
+              },
+              "granted_micro_usd": {
+                "type": "integer",
+                "minimum": 0
+              }
+            }
+          }
+        }
+      },
+      "Gateway.CreditEntry": {
+        "type": "object",
+        "required": [
+          "id",
+          "at",
+          "delta_micro_usd",
+          "balance_after_micro_usd",
+          "reason",
+          "bucket",
+          "ref",
+          "detail"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "at": {
+            "type": "string"
+          },
+          "delta_micro_usd": {
+            "type": "integer",
+            "description": "Signed change; 0 for an inflight_overrun record"
+          },
+          "balance_after_micro_usd": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "reason": {
+            "type": "string"
+          },
+          "bucket": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "ref": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The Henry run id or receipt id"
+          },
+          "detail": {
+            "type": [
+              "object",
+              "null"
+            ],
+            "additionalProperties": true
+          }
+        }
+      },
+      "Gateway.CreditEntryPage": {
+        "type": "object",
+        "required": [
+          "data",
+          "has_more",
+          "next_before"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditEntry"
+            }
+          },
+          "has_more": {
+            "type": "boolean"
+          },
+          "next_before": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        }
+      },
+      "Gateway.CreditUsageRow": {
+        "type": "object",
+        "required": [
+          "source",
+          "amount_micro_usd",
+          "credits"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "at": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string",
+            "description": "inference, computer or voice"
+          },
+          "model": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "input_tokens": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "output_tokens": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "cache_read_tokens": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "cache_write_tokens": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "seconds": {
+            "type": "number"
+          },
+          "characters": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "amount_micro_usd": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "credits": {
+            "type": "number"
+          },
+          "ref": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "upstream_cost_micro_usd": {
+            "type": [
+              "integer",
+              "null"
+            ]
+          }
+        }
+      },
+      "Gateway.CreditUsage": {
+        "type": "object",
+        "required": [
+          "ref",
+          "data"
+        ],
+        "properties": {
+          "ref": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditUsageRow"
+            }
+          }
+        }
+      },
+      "Gateway.CreditSettingsPatch": {
+        "type": "object",
+        "additionalProperties": false,
+        "minProperties": 1,
+        "properties": {
+          "borrow_ceiling_credits": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 1000000000
+          },
+          "auto_refill": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "enabled"
+            ],
+            "properties": {
+              "enabled": {
+                "type": "boolean"
+              },
+              "pack": {
+                "type": "integer",
+                "enum": [
+                  10,
+                  25,
+                  50
+                ]
+              },
+              "monthly_ceiling_credits": {
+                "type": "number",
+                "minimum": 0,
+                "maximum": 1000000000
+              }
+            }
+          }
+        }
+      },
+      "Gateway.CreditSettings": {
+        "type": "object",
+        "required": [
+          "org",
+          "borrow",
+          "auto_refill"
+        ],
+        "properties": {
+          "org": {
+            "type": "string"
+          },
+          "borrow": {
+            "$ref": "#/components/schemas/Gateway.CreditBorrow"
+          },
+          "auto_refill": {
+            "$ref": "#/components/schemas/Gateway.CreditAutoRefill"
+          }
+        }
+      },
+      "Gateway.CreditCheckout": {
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Always https://checkout.stripe.com/..., never a live-mode session"
+          }
+        }
+      },
+      "Gateway.CreditSubscriptionResult": {
+        "type": "object",
+        "required": [
+          "subscription"
+        ],
+        "properties": {
+          "plan": {
+            "type": "string"
+          },
+          "subscription": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/Gateway.CreditSubscription"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        }
+      },
       "Taps.Priority": {
         "type": "string",
         "enum": [
@@ -153259,7 +154315,7 @@
         }
       },
       "Minds.MindsHumanSelectionRequired": {
-        "description": "HUMAN_SANDBOX_SELECTION_REQUIRED: the credential is neither an original human One account session with a Console Sandbox selection nor an org API key with a selected (bound) context. M2M tokens receive this enveloped refusal. SCOPE_MISSING (with required_scope) answers an org API key without the operation's Minds scope.",
+        "description": "HUMAN_SANDBOX_SELECTION_REQUIRED: the credential is neither an original human One account session with a current Console selection (Sandbox, or Live where Minds is Live) nor an org API key with a selected (bound) context. M2M tokens receive this enveloped refusal. SCOPE_MISSING (with required_scope) answers an org API key without the operation's Minds scope. On create, SANDBOX_CREATE_NOT_ADMITTED means creation is not admitted on this gateway. In Live (create, resume, stop, delete, resize, webhook wakes), MINDS_LIVE_NOT_ENABLED means Live Minds are not enabled for this organization (default off, per organization) and MINDS_LIVE_CAP_REACHED means it is at its Live instance cap; nothing is created, started or changed.",
         "content": {
           "application/json": {
             "schema": {
@@ -154793,8 +155849,8 @@
       "title": "Minds (dedicated memory)",
       "upstream": "https://console.life.one/api/v1/minds",
       "status": "not_deployed",
-      "statusNote": "Human Sandbox operations require verified Console selection. Separate agent-memory operations require an existing authorized agent credential and default-off producer admission; no attachment management or token exchange. Owner groups/attachments use the same original selected Console human bearer and separate default-off admission; no credential issuance. Agent Mind creation uses an approved agent-create token with DPoP and its own default-off admission (MINDS_AGENT_CREATE_ENABLED). Engine routes (/v1/minds/services/{mind_id}/engine/...) admit exactly the generated tenant route table and mint one capability per call; for human sessions, routes needing minds:instances:manage answer 403 MINDS_ENGINE_MANAGE_REQUIRED. Org API keys with a selected context are admitted on native and engine routes by scope (minds:read, minds:write, minds:manage) and signed to the controller on the Minds gateway key lane (MINDS_GATEWAY_KEY_SIGNING_FILE); Live selections answer 409.",
-      "operations": 191
+      "statusNote": "Human operations require a verified Console selection. Separate agent-memory operations require an existing authorized agent credential and default-off producer admission; no attachment management or token exchange. Owner groups/attachments are Sandbox only (a Live selection answers 409) and use the same original selected Console human bearer and separate default-off admission; no credential issuance. Agent Mind creation uses an approved agent-create token with DPoP and its own default-off admission (MINDS_AGENT_CREATE_ENABLED). Engine routes (/v1/minds/services/{mind_id}/engine/...) admit exactly the generated tenant route table and mint one capability per call; for human sessions, routes needing minds:instances:manage answer 403 MINDS_ENGINE_MANAGE_REQUIRED. Org API keys with a selected context are admitted on native and engine routes by scope (minds:read, minds:write, minds:manage) and signed to the controller on the Minds gateway key lane (MINDS_GATEWAY_KEY_SIGNING_FILE). Live selections are forwarded with the verified environment once minds is on GENESIS_LIVE_SERVICES (Live create: controller allowlist and cap, 403 MINDS_LIVE_NOT_ENABLED); until then they answer 409 ENVIRONMENT_NOT_AVAILABLE.",
+      "operations": 192
     },
     {
       "name": "traces",
@@ -154881,9 +155937,9 @@
       "title": "Genesis gateway (native reads)",
       "upstream": "https://os.one.ml/api",
       "status": "live",
-      "statusNote": "Served by the gateway itself, never forwarded. Usage and billing take a login session or an org API key holding genesis.usage.read / genesis.billing.read / genesis.billing.manage.",
+      "statusNote": "Served by the gateway itself, never forwarded. Usage, billing and One credits (/v1/credits, behind GENESIS_CREDITS_ENABLED) take a login session or an org API key holding genesis.usage.read / genesis.billing.read / genesis.billing.manage.",
       "gatewayRoute": "dedicated",
-      "operations": 29
+      "operations": 36
     },
     {
       "name": "taps",