@wowok/agent-mcp 3.2.7 → 3.3.0

package/dist/schemas/onchain_operations_reward.schema.json

@@ -225,7 +225,7 @@
           ]
         },
         "guard_add": {
-          "description": "Add Guard to Reward object.",
+          "description": "Add Guard to Reward object. IDIOMS (F08 — these differ from Service allocation, follow THIS shape here): recipient is ONE OF {GuardIdentifier: <u8>} | {Entity: {name_or_address: 'mark'}} | {Signer: 'signer'} (string const INSIDE the key, NOT a bare string) — BUT on the REWARD claim rail the recipient MUST equal the transaction sender (chain assert, abort 14), so {Signer: 'signer'} is the canonical form and {Entity} also passes (SDK replaces it with the claimant's account at claim time); a {GuardIdentifier} recipient resolves to the submitted Order and is STRUCTURALLY UNPAYABLE (every claim aborts 14) — the tool gate rejects it (crs-mn-261015 F-12). amount is {type: 'Fixed', value: '0.1WOW'} — value accepts a display string with token symbol ('0.1WOW') or a smallest-unit integer ('100000000'), NOT the plain balance string used by allocation `sharing`. FULL EXAMPLE: [{guard: '0xabc...', recipient: {Signer: 'signer'}, amount: {type: 'Fixed', value: '0.1WOW'}}].",
           "type": "array",
           "items": {
             "type": "object",
@@ -250,7 +250,7 @@
                       "GuardIdentifier"
                     ],
                     "additionalProperties": false,
-                    "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                    "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                   },
                   {
                     "type": "object",
@@ -289,10 +289,10 @@
                       "Signer"
                     ],
                     "additionalProperties": false,
-                    "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                    "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                   }
                 ],
-                "description": "Recipient ID. Three forms:\n  - {GuardIdentifier: u8}  — DYNAMIC address resolved from Passport at alloc() time\n  - {Entity: {name_or_address: 'mark_name'}}  — FIXED static address via LocalMark (recommended)\n  - {Signer: 'signer'}  — transaction sender at alloc() time (e.g. self-refund; customer must call alloc_by_guard themselves)"
+                "description": "Recipient ID. Three forms:\n  - {GuardIdentifier: u8}  — DYNAMIC address resolved from Passport at alloc() time (Allocation rails only; structurally unpayable on reward.guard_add — abort 14)\n  - {Entity: {name_or_address: 'mark_name'}}  — FIXED static address via LocalMark (recommended)\n  - {Signer: 'signer'}  — transaction sender at alloc() time (e.g. self-refund; customer must call alloc_by_guard themselves; canonical on reward claim rails)"
               },
               "amount": {
                 "oneOf": [
@@ -392,9 +392,18 @@
           ]
         },
         "owner_receive": {
-          "description": "Unwrap CoinWrapper objects and other objects received by this Reward object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+          "description": "Unwrap CoinWrapper objects and other objects received by this Reward object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
           "anyOf": [
             {
+              "type": "string",
+              "const": "recently"
+            },
+            {
+              "type": "string",
+              "pattern": "^0x[0-9a-fA-F]{8,}$"
+            },
+            {
+              "minItems": 1,
               "type": "array",
               "items": {
                 "type": "object",
@@ -502,10 +511,6 @@
               ],
               "additionalProperties": false,
               "description": "Received record of Coin objects"
-            },
-            {
-              "type": "string",
-              "const": "recently"
             }
           ]
         },
@@ -520,13 +525,89 @@
               "type": "null"
             }
           ]
+        },
+        "withdraw": {
+          "description": "Permission-gated balance exit (the ONLY non-claim exit from the Reward balance): withdraws this amount from the Reward balance and delivers it to the transaction sender inside a Payment object (the on-chain auditable receipt, keyed by the RewardWithdrawEvent). The executing account needs the withdraw right (permission index 158) on the Reward's Permission object. Fails on-chain when the balance is insufficient or while the declared no-guard window (guard_expiration_time) is still in the future; claim replay protection is unaffected. Use it to recover mismatched or overfunded pools.",
+          "type": "object",
+          "properties": {
+            "amount": {
+              "anyOf": [
+                {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 9007199254740991
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "description": "Amount to withdraw (SMALLEST token units, e.g. '100000000')."
+            },
+            "payment_info": {
+              "type": "object",
+              "properties": {
+                "for_object": {
+                  "description": "Binding anchor for this distribution. On an Allocation a SET for_object is ENFORCED at alloc(): every GuardIdentifier recipient submission must equal this address or the whole tx aborts (ERECIPIENT_NOT_FOR_OBJECT, code 15) — verify the anchor matches the intended recipient flow BEFORE create; payment_info is immutable afterwards. NULL/omitted = no anchor: nothing is enforced on-chain, recipient routing is entirely the creator's design. Also recorded at creation for auditors to query the distribution's business context.",
+                  "anyOf": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ]
+                },
+                "for_guard": {
+                  "description": "Payment to satisfy verification of a Guard object",
+                  "anyOf": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ]
+                },
+                "remark": {
+                  "type": "string",
+                  "description": "Payment record remark"
+                },
+                "index": {
+                  "anyOf": [
+                    {
+                      "type": "number"
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "description": "Payment record index"
+                }
+              },
+              "required": [
+                "remark",
+                "index"
+              ],
+              "additionalProperties": false,
+              "description": "Payment receipt metadata (remark/index). The withdrawn funds leave the Reward balance inside a Payment object — the on-chain auditable receipt."
+            },
+            "unwrap": {
+              "description": "Auto-unwrap: when true, the coin is paid straight to the transaction sender in the SAME transaction (single-PTB flow). When false or omitted (default), a CoinWrapper is delivered to the sender's wallet for later unwrapping via the payment call with receive:true. Both modes keep the Payment object as the on-chain receipt.",
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "amount",
+            "payment_info"
+          ],
+          "additionalProperties": false
         }
       },
       "required": [
         "object"
       ],
       "additionalProperties": false,
-      "description": "On-chain Reward operations. USAGE: (1) CREATE NEW: Set 'object' field with OBJECT format {name, type_parameter, permission, ...} to create a Reward. NOTE: 'name' goes INSIDE 'object', NOT at the data root level.'permission' can be a new Permission object or reference an existing one - check 'object' field description for details. (2) OPERATE EXISTING: Set 'object' field with STRING format (object ID or name). The 'object' field is CRITICAL and REQUIRED in both cases. STRING for existing, OBJECT for new creation."
+      "description": "On-chain Reward operations. USAGE: (1) CREATE NEW: Set 'object' field with OBJECT format {name, type_parameter, permission, ...} to create a Reward. NOTE: 'name' goes INSIDE 'object', NOT at the data root level.'permission' can be a new Permission object or reference an existing one - check 'object' field description for details. (2) OPERATE EXISTING: Set 'object' field with STRING format (object ID or name). The 'object' field is CRITICAL and REQUIRED in both cases. STRING for existing, OBJECT for new creation. NAME RESOLUTION SCOPE (T8 az3-mn-261013): a LocalMark name resolves ONLY within the SIGNING account's own local mark store — when the Reward was named by a DIFFERENT account (e.g. the merchant's mark) and you operate it from another account, the name lookup fails with 'not found locally'; pass the on-chain 0x object ID instead (resolve it once via workspace/onchain_objects and reuse the id)."
     },
     "env": {
       "type": "object",
@@ -673,6 +754,7 @@
                       "description": "Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."
                     },
                     "value_type": {
+                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.",
                       "anyOf": [
                         {
                           "type": "number",
@@ -959,11 +1041,10 @@
                           "const": "vecvecu8",
                           "description": "vecvecu8"
                         }
-                      ],
-                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details."
+                      ]
                     },
                     "value": {
-                      "description": "The actual value data. Format depends on `value_type`:\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
+                      "description": "The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
                       "anyOf": [
                         {
                           "type": "boolean"
@@ -1122,7 +1203,7 @@
                   "additionalProperties": false,
                   "description": "Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"
                 },
-                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}]"
+                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."
               }
             },
             "required": [
@@ -1132,7 +1213,7 @@
             "additionalProperties": false,
             "description": "One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."
           },
-          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
+          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
         }
       },
       "required": [

package/dist/schemas/onchain_operations_service.schema.json

@@ -228,7 +228,7 @@
               "additionalProperties": false
             },
             "order_required_info": {
-              "description": "Contact object ID or WTS Proof object, RECORDED on the Order as evidence that the order holder delivered the private information the Service declares in customer_required (e.g. phone/email/shipping_address). RECORD-ONLY, NOT ENFORCED: nothing on-chain reads this field — the purchase entry never requires it, and an order supplying none of the declared fields is still created. FLOW: the order holder sends the information to the Service's Contact (um) via end-to-end encrypted Messenger, then passes the Contact object ID or the generated WTS Proof here. To ENFORCE delivery on-chain, mount the pattern.required_info_evidence_gate Guard on the forward that hands over goods or funds, asserting order.required_info is some (presence-only — the recorded address value is never a guard condition; accepting the delivered information is the merchant's confirming forward).",
+              "description": "Contact object ID or WTS Proof object, RECORDED on the Order as evidence that the order holder delivered the private information the Service declares in customer_required (e.g. phone/email/shipping_address). RECORD-ONLY, NOT ENFORCED: nothing on-chain reads this field — the purchase entry never requires it, and an order supplying none of the declared fields is still created. FLOW: the order holder sends the information to the Service's Contact (um) via end-to-end encrypted Messenger, then passes the Contact object ID or the generated WTS Proof here. To ENFORCE delivery on-chain, mount the pattern.required_info_evidence_gate Guard on the forward that hands over goods or funds, asserting order.required_info is some (presence-only — the recorded address value is never a guard condition; accepting the delivered information is the merchant's confirming forward). ATTESTATION-ONLY: the recorded value is self-attested, has no on-chain readback, and MUST NOT be used as a gate condition. PER-ORDER BINDING: when the listing genuinely promises a per-order credential, use the dedicated controlled bind operation (order_required_info_bind) with a Proof whose about is THIS order and whose creator is the order holder — the chain verifies both at write time and rejects a mismatch without writing anything. The reuse model (one Contact Proof across orders) stays the default for this plain record field; pick per listing promise, not per habit. BOUNDARY: that binding proves the credential AUTHOR only, never its content or any rating — do not mirror it onto review/reward claims; public reviews are Repository rows whose values are enforced guard-side via data-value probes, not through Proof objects.",
               "type": "string"
             },
             "transfer": {
@@ -339,7 +339,7 @@
           "type": "string"
         },
         "sales": {
-          "description": "Service sales products or services list. ⚠️ WIP NETWORK-DEPLOYMENT RULE: a non-empty sale.wip MUST be a publicly reachable URL (GitHub Pages / IPFS / your own website). The URL is stored ON-CHAIN and every customer fetches it at order time — a local file path, localhost/loopback URL, or LAN private-IP URL is unreachable by customers on other machines and aborts order_new 100%. Local-network URLs are INTERNAL TEST USE ONLY (env.network = localnet). Leave sale.wip empty (\"\") to skip WIP verification (TESTING ONLY).",
+          "description": "Service sales products or services list. ⚠️ WIP (PRODUCT-DETAIL FILE) — HOW TO PROVIDE IT: (1) EASIEST — official free hosting: upload the detail file with the wip_file tool; the default endpoint is https://wip.store.wowok.net (free: 10 files per account, 180-day retention, 12MB per file, rate-limited; files stay until you purge them). Put the returned URL into sale.wip. (2) Your own hosting: any publicly reachable URL (GitHub Pages / IPFS / your own website) — pass customBaseUrl to wip_file when uploading to a non-default endpoint, or host the file yourself and put that URL into sale.wip. For long-lived MAINNET listings prefer your own endpoint so the detail page outlives the free retention window. ⚠️ REACHABILITY RULE: a non-empty sale.wip MUST be a publicly reachable URL. The URL is stored ON-CHAIN and every customer fetches it at order time — a local file path, localhost/loopback URL, or LAN private-IP URL is unreachable by customers on other machines and aborts order_new 100%. Local-network URLs are INTERNAL TEST USE ONLY (env.network = localnet). ⚠️ SCORING: on mainnet, a sale item without a product-detail file is an incomplete listing — it hurts the service's market completeness score. Leave sale.wip empty (\"\") only for quick local testing.",
           "oneOf": [
             {
               "type": "object",
@@ -740,7 +740,7 @@
           ]
         },
         "rewards": {
-          "description": "Service Reward object list. May share the Service's Permission (no conflict check — intentional: rewards are the provider's own incentive tool; only Arbitration requires a different Permission for neutrality).",
+          "description": "Service Reward object list. May share the Service's Permission (no conflict check — intentional: rewards are the provider's own incentive tool; only Arbitration requires a different Permission for neutrality). ⚠️ OP SEMANTICS (SDK translation, etm-mn-261013 E-06): op:'set' executes as clear + add — and reward clear is TIME-LOCKED after publish (E_LOCKED_TIME_NOT_ENOUGH = abort 24: requires pause + setting_lock_duration elapsed, default 30 days). BEFORE publish op:'set' is fine; AFTER publish attach rewards with op:'add' ONLY (add has no lock).",
           "anyOf": [
             {
               "type": "object",
@@ -810,7 +810,7 @@
           ]
         },
         "arbitrations": {
-          "description": "Service Arbitration object list. FORMAT: same as repositories — use the `objects` field name inside the operation data. Example: {arbitrations: {op: 'set', objects: [{name: 'my_arb_1'}, {name: 'my_arb_2'}]}}. NOTE: op:'add' is disabled on this surface (its success response can arrive unparseable and reads like a failure); ALWAYS pass the FULL list with op:'set'. Each item is a NameOrAddress (object ID or local mark name). ⚠️ PERMISSION RULE (contract-enforced): every Arbitration bound here MUST use a Permission object DIFFERENT from THIS Service's permission — binding an Arbitration that shares the Service's Permission aborts with E_ARBITRATION_PERMISSION_CONFLICT (error 33). Create a dedicated Permission for each Arbitration BEFORE binding. DESIGN RATIONALE (confirmed intentional): dispute resolution requires NEUTRALITY — an Arbitration controlled by the same Permission admins as the Service it judges would be a conflict of interest. ONLY Arbitration has this check: Reward and Treasury objects MAY share the Service's Permission (they are the provider's own tools).",
+          "description": "Service Arbitration object list. FORMAT: same as repositories — use the `objects` field name inside the operation data. Example: {arbitrations: {op: 'add', objects: [{name: 'my_arb_1'}]}}. Each item is a NameOrAddress (object ID or local mark name). ⚠️ OP SEMANTICS (SDK translation, etm-mn-261013 E-06 + crs P3-1): op:'add' appends and is the ONLY  unlocked path after publish (add has no publish assert, service.move). op:'set' executes as clear + add and REPLACES the entire allowlist (pass EVERY Arbitration that must remain bound) — clear is TIME-LOCKED after publish (E_LOCKED_TIME_NOT_ENOUGH = abort 24: requires pause + setting_lock_duration elapsed, default 30 days), so use op:'set' BEFORE publish only. (The 2026-10-08 op:'add' disable was lifted: the unparseable-success-response SDK bug it responded to is fixed — safeTextJson + big-int conversion.) ⚠️ PERMISSION RULE (contract-enforced): every Arbitration bound here MUST use a Permission object DIFFERENT from THIS Service's permission — binding an Arbitration that shares the Service's Permission aborts with E_ARBITRATION_PERMISSION_CONFLICT (error 33). Create a dedicated Permission for each Arbitration BEFORE binding. DESIGN RATIONALE (confirmed intentional): dispute resolution requires NEUTRALITY — an Arbitration controlled by the same Permission admins as the Service it judges would be a conflict of interest. ONLY Arbitration has this check: Reward and Treasury objects MAY share the Service's Permission (they are the provider's own tools).",
           "anyOf": [
             {
               "type": "object",
@@ -933,9 +933,13 @@
               ]
             },
             "time_ms_start": {
-              "description": "Discount start time (milliseconds)",
+              "description": "Discount start time (milliseconds). ⚠️ A FUTURE start mints a coupon that is listed as usable but CANNOT be spent until the window opens (every spend aborts E_DISCOUNT_TIME_INVALID / buy code 35). Legitimate for scheduled campaigns — the mint carries a loud warning; do not distribute the coupon to recipients before the window opens.",
               "type": "number"
             },
+            "allow_zero_total": {
+              "description": "FREE-TIER ESCAPE HATCH (BKN-P2): a coupon that would drive the final total to 0 (MINUS value >= the cheapest SKU price, or RATES value 10000) is BLOCKED at issuance by default. Set true ONLY to declare a deliberate zero-price product: the issuance then proceeds with a disclosure that zero-total orders carry an empty escrow and NEVER trigger reward/incentive rails. Omit (default false) for normal discounts.",
+              "type": "boolean"
+            },
             "time_ms_end": {
               "type": "number",
               "description": "Discount end time (milliseconds)"
@@ -976,7 +980,7 @@
                 "check_all_founded"
               ],
               "additionalProperties": false,
-              "description": "Discount recipient"
+              "description": "Discount recipient. OBJECT FORM REQUIRED (T9 az3-mn-261013): a bare string is REJECTED here — pass {entities: [{name_or_address: '<account_name_or_0x_address>'}]} (example: {entities: [{name_or_address: 'buyer1'}]}). Total coupons delivered = count × number of recipients."
             },
             "transferable": {
               "type": "boolean",
@@ -1013,7 +1017,7 @@
                 "type": "string",
                 "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
               },
-              "description": "Coupon object IDs or local names to transfer. You MUST own these Discount objects. Each coupon must have been minted with transferable:true — otherwise the chain aborts with E_DISCOUNT_NOT_TRANSFERABLE (semantic code service:10). Coupons stay single-use; the transfer does not change that. Max 1000 coupons per call (SDK limit MAX_DISCOUNT_COUNT_ONCE)."
+              "description": "Coupon object IDs or local names to transfer. You MUST own these Discount objects. Each coupon must have been minted with transferable:true — otherwise the chain aborts with E_DISCOUNT_NOT_TRANSFERABLE (semantic code service:10). Coupons stay single-use; the transfer does not change that. There is NO batch entry on-chain — each coupon is delivered by its own singleton call (fanned out automatically); prefer ONE coupon per transaction for coupon migrations (SDK cap MAX_DISCOUNT_COUNT_ONCE still applies)."
             },
             "recipient": {
               "type": "object",
@@ -1097,7 +1101,7 @@
                                     "GuardIdentifier"
                                   ],
                                   "additionalProperties": false,
-                                  "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                                  "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                                 },
                                 {
                                   "type": "object",
@@ -1136,7 +1140,7 @@
                                     "Signer"
                                   ],
                                   "additionalProperties": false,
-                                  "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                                  "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                                 }
                               ],
                               "description": "Recipient of this allocation. Three forms — each resolves the address at a DIFFERENT time:\n• { GuardIdentifier: u8 } — DYNAMIC address resolved from Passport at alloc() time (from the passport's submission record). Use 0 for Order owner in Service-integrated mode (Customer who created the Order). The identifier must match a Guard table entry with b_submission=true. If Passport has no matching submission, contract aborts with E_VERIFY_FAILED. Use when the recipient address is not known at config time and must be supplied via Guard submission data.\n• { Entity: { name_or_address: '...' } } — FIXED address resolved via LocalMark at SDK build time (passed to contract as a literal address). Use for known recipients (e.g., 'turo_host', or a Treasury object address). Use when the recipient is a stable, known address (e.g., operator receives rent, platform fee to treasury).\n• 'Signer' — the transaction sender at the time of the alloc() call (tx_context::sender). RESOLVED AT EXECUTION TIME, not at config time. For refunds: the customer (Order owner) must call alloc_by_guard THEMSELVES so that tx_context::sender resolves to THEIR address — if the operator calls alloc_by_guard, the operator becomes the recipient (Signer = operator), NOT the customer. Use when the recipient is whoever submits the allocation transaction (e.g., customer receives refund)."
@@ -1282,7 +1286,7 @@
                                 "GuardIdentifier"
                               ],
                               "additionalProperties": false,
-                              "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                              "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                             },
                             {
                               "type": "object",
@@ -1321,7 +1325,7 @@
                                 "Signer"
                               ],
                               "additionalProperties": false,
-                              "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                              "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                             }
                           ],
                           "description": "Recipient of this allocation. Three forms — each resolves the address at a DIFFERENT time:\n• { GuardIdentifier: u8 } — DYNAMIC address resolved from Passport at alloc() time (from the passport's submission record). Use 0 for Order owner in Service-integrated mode (Customer who created the Order). The identifier must match a Guard table entry with b_submission=true. If Passport has no matching submission, contract aborts with E_VERIFY_FAILED. Use when the recipient address is not known at config time and must be supplied via Guard submission data.\n• { Entity: { name_or_address: '...' } } — FIXED address resolved via LocalMark at SDK build time (passed to contract as a literal address). Use for known recipients (e.g., 'turo_host', or a Treasury object address). Use when the recipient is a stable, known address (e.g., operator receives rent, platform fee to treasury).\n• 'Signer' — the transaction sender at the time of the alloc() call (tx_context::sender). RESOLVED AT EXECUTION TIME, not at config time. For refunds: the customer (Order owner) must call alloc_by_guard THEMSELVES so that tx_context::sender resolves to THEIR address — if the operator calls alloc_by_guard, the operator becomes the recipient (Signer = operator), NOT the customer. Use when the recipient is whoever submits the allocation transaction (e.g., customer receives refund)."
@@ -1624,9 +1628,18 @@
           ]
         },
         "owner_receive": {
-          "description": "Unwrap CoinWrapper objects and other objects received by this Service object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+          "description": "Unwrap CoinWrapper objects and other objects received by this Service object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
           "anyOf": [
             {
+              "type": "string",
+              "const": "recently"
+            },
+            {
+              "type": "string",
+              "pattern": "^0x[0-9a-fA-F]{8,}$"
+            },
+            {
+              "minItems": 1,
               "type": "array",
               "items": {
                 "type": "object",
@@ -1734,10 +1747,6 @@
               ],
               "additionalProperties": false,
               "description": "Received record of Coin objects"
-            },
-            {
-              "type": "string",
-              "const": "recently"
             }
           ]
         },
@@ -1785,6 +1794,9 @@
         "publish": {
           "description": "Whether to publish the Service. After publishing, customers can place orders. ⚠️ PRE-PUBLISH EVALUATION (mandatory, stop-node fund-exit coverage): service.allocators MUST cover EVERY stop node of the bound Machine — every node where an order can rest (terminal nodes AND waiting states: review windows, handovers, open disputes) needs BOTH a withdrawal (release) AND a refund allocation rule, and each mapping guard must be satisfiable in BOTH directions. An uncovered stop node strands escrowed funds permanently (order_allocators is L1-immutable). Review-gated release is a TIME VARIANT inside ONE exit guard ('reviewed OR unreviewed after T'), never parallel outgoing edges (race deadlock). See pattern.fund_flow_stop_node_coverage + rules R-M5-03 / R-M5-09. VERIFIED against Move source + SDK (4-level immutability matrix):\n  L1 — PERMANENTLY LOCKED after publish (assert!(!bPublished), no pause+lock exception):\n    • machine          (workflow template)\n    • order_allocators (fund distribution rules — full replacement locked; APPEND-ONLY additions remain possible via order_allocators_append, prefix/threshold frozen)\n  L2 — TIME-LOCKED after publish (unpublished-state check — requires pause + setting_lock_duration elapsed):\n    • arbitrations remove/clear (dispute resolution objects)\n    • rewards remove/clear       (reward objects)\n    • compensation_fund_withdraw (withdraw ALL funds)\n    RATIONALE (deliberate design, NOT a defect): these three REVOKE buyer-facing guarantees that placed orders already rely on — the lock protects buyer expectations. Daily operations (sales add/remove, price, stock, description) are NEVER gated by this lock.\n  L3 — REMAIN MUTABLE after publish (no SDK check, no Move check):\n    • arbitrations add, rewards add (no assert — can add after publish)\n    • buy_guard, sales, discount, description, location, pause, repositories,\n    • compensation_fund_add, setting_lock_duration_add, customer_required, um (Contact)\nThese 2 L1-LOCKED fields (machine/order_allocators) MUST be set BEFORE publish=true.\narbitrations/rewards can be ADDED after publish but remove/clear requires pause+lock.\n\n⚠️ COMPENSATION_FUND + ARBITRATION LINKAGE:\n  At publish time, if compensation_fund > 0, Arbitration MUST be bound:\n    if (balance::value(&self.compensation_fund) > 0) {\n        assert!(arbitration_count > 0, E_ARBITRATION_NOT_SET_WITH_COMPENSATION_FUND);\n    }\n  The MCP handler enforces this as a HARD PRE-CHECK: if publish=true AND compensation_fund_add   is set in the same call AND arbitrations is empty, the call is REJECTED before submission.   If compensation_fund was deposited in a prior call, a SOFT WARNING is issued.\n\nSCHEMA-03 / P0-01 fix — DEPLOYMENT WORKFLOW (two-phase, avoids circular dependency):\n  Phase 1 — CREATE (no publish): object={name:'my-service', type_parameter, permission} + machine + order_allocators + arbitrations.\n    NOTE: buy_guard can use a LocalMark NAME (not address) to break the Guard→Service circular dependency.\n    The name is resolved to an address at transaction build time.\n  Phase 2 — PUBLISH: object='my-service' (string ref) + publish=true.\n    All L1-LOCKED fields must be set in Phase 1; Phase 2 only flips the publish flag.\n  Post-publish updates: buy_guard, sales, description, repositories (add), rewards (add), arbitrations (add), etc.",
           "type": "boolean"
+        },
+        "creation_plan": {
+          "description": "WIZARD CONTRACT: the Plan JSON that merchant_guide delivered (its creation_plan / plan field), passed back VERBATIM on the Service publish call (data.publish=true). The publish gate replays the plan's freeze matrix (preflight) right before submission and REJECTS the publish when any gate fails (structural issues, critical audit findings, or a failed rule check) — this closes the preflight bypass where a plan that failed merchant_guide's audit could still be materialized manually. OMIT this field on every NON-publish call and on fully manual (non-wizard) builds — the manual path is unchanged and never gated by this field. Do NOT edit, trim, or 'improve' the plan in transit: a mutated plan is rejected (target cross-check) and the publish must be redone from merchant_guide."
         }
       },
       "required": [
@@ -1938,6 +1950,7 @@
                       "description": "Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."
                     },
                     "value_type": {
+                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.",
                       "anyOf": [
                         {
                           "type": "number",
@@ -2224,11 +2237,10 @@
                           "const": "vecvecu8",
                           "description": "vecvecu8"
                         }
-                      ],
-                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details."
+                      ]
                     },
                     "value": {
-                      "description": "The actual value data. Format depends on `value_type`:\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
+                      "description": "The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
                       "anyOf": [
                         {
                           "type": "boolean"
@@ -2387,7 +2399,7 @@
                   "additionalProperties": false,
                   "description": "Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"
                 },
-                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}]"
+                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."
               }
             },
             "required": [
@@ -2397,7 +2409,7 @@
             "additionalProperties": false,
             "description": "One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."
           },
-          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
+          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
         }
       },
       "required": [

package/dist/schemas/onchain_operations_treasury.schema.json

@@ -748,9 +748,18 @@
           ]
         },
         "owner_receive": {
-          "description": "Unwrap CoinWrapper objects and other objects received by this Treasury object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+          "description": "Unwrap CoinWrapper objects and other objects received by this Treasury object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
           "anyOf": [
             {
+              "type": "string",
+              "const": "recently"
+            },
+            {
+              "type": "string",
+              "pattern": "^0x[0-9a-fA-F]{8,}$"
+            },
+            {
+              "minItems": 1,
               "type": "array",
               "items": {
                 "type": "object",
@@ -858,10 +867,6 @@
               ],
               "additionalProperties": false,
               "description": "Received record of Coin objects"
-            },
-            {
-              "type": "string",
-              "const": "recently"
             }
           ]
         },
@@ -1029,6 +1034,7 @@
                       "description": "Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."
                     },
                     "value_type": {
+                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.",
                       "anyOf": [
                         {
                           "type": "number",
@@ -1315,11 +1321,10 @@
                           "const": "vecvecu8",
                           "description": "vecvecu8"
                         }
-                      ],
-                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details."
+                      ]
                     },
                     "value": {
-                      "description": "The actual value data. Format depends on `value_type`:\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
+                      "description": "The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
                       "anyOf": [
                         {
                           "type": "boolean"
@@ -1478,7 +1483,7 @@
                   "additionalProperties": false,
                   "description": "Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"
                 },
-                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}]"
+                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."
               }
             },
             "required": [
@@ -1488,7 +1493,7 @@
             "additionalProperties": false,
             "description": "One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."
           },
-          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
+          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
         }
       },
       "required": [

package/dist/schemas/onchain_table_data.output.json

@@ -653,7 +653,7 @@
                                       "description": "vecvecu8"
                                     }
                                   ],
-                                  "description": "User available value type (number or string, e.g., 6 or 'U64' or 'u64')"
+                                  "description": "User available value type (number, numeric string, or name — e.g., 6, '6', 'U64', 'u64')"
                                 },
                                 {
                                   "type": "number",
@@ -1642,7 +1642,7 @@
                                         "description": "vecvecu8"
                                       }
                                     ],
-                                    "description": "User available value type (number or string, e.g., 6 or 'U64' or 'u64')"
+                                    "description": "User available value type (number, numeric string, or name — e.g., 6, '6', 'U64', 'u64')"
                                   },
                                   {
                                     "type": "number",
@@ -2904,7 +2904,7 @@
                         "type": "null"
                       }
                     ],
-                    "description": "Buyer-recorded credential (order.required_info): the merchant's IM user address resolved from the Service's Contact (zero cost) or an on-chain WTS Proof object id (embeds the IM address + last-message timestamp); null when not submitted"
+                    "description": "Buyer-recorded credential (order.required_info): the merchant's IM user address resolved from the Service's Contact (zero cost) or an on-chain WTS Proof object id (embeds the IM address + last-message timestamp); null when not submitted. ATTESTATION-ONLY: the value is self-attested by the buyer, has no on-chain readback, and MUST NOT be used as a gate condition."
                   },
                   "progress_next": {
                     "anyOf": [
@@ -4259,7 +4259,7 @@
                                             "description": "vecvecu8"
                                           }
                                         ],
-                                        "description": "User available value type (number or string, e.g., 6 or 'U64' or 'u64')"
+                                        "description": "User available value type (number, numeric string, or name — e.g., 6, '6', 'U64', 'u64')"
                                       },
                                       {
                                         "type": "number",
@@ -8297,7 +8297,7 @@
                                                     "description": "vecvecu8"
                                                   }
                                                 ],
-                                                "description": "User available value type (number or string, e.g., 6 or 'U64' or 'u64')"
+                                                "description": "User available value type (number, numeric string, or name — e.g., 6, '6', 'U64', 'u64')"
                                               },
                                               {
                                                 "type": "number",
@@ -9186,7 +9186,7 @@
             "query_type"
           ],
           "additionalProperties": false,
-          "description": "ONE-CALL detail-page panorama for Progress / Demand / Order / Arb / Repository / Proof objects (client panorama family): discriminated `object_type` + head (name/tags/description) + the object's own typed fields + type-specific extras (Demand presenters from the GLOBAL tx table, Progress session/forwards, Arb votes & propositions, Repository policies, Proof anchored root + WTS cross-check). Read-only."
+          "description": "ONE-CALL detail-page panorama for Progress / Demand / Order / Allocation / Arb / Repository / Proof objects (client panorama family): discriminated `object_type` + head (name/tags/description) + the object's own typed fields + type-specific extras (Demand presenters from the GLOBAL tx table, Progress session/forwards, Order fund state, Allocation pool balance + per-rail resolved recipients + Payment children, Arb votes & propositions, Repository policies, Proof anchored root + WTS cross-check). Read-only."
         },
         {
           "type": "object",
@@ -11416,7 +11416,7 @@
                       "description": "vecvecu8"
                     }
                   ],
-                  "description": "User available value type (number or string, e.g., 6 or 'U64' or 'u64')"
+                  "description": "User available value type (number, numeric string, or name — e.g., 6, '6', 'U64', 'u64')"
                 },
                 {
                   "type": "number",