@wowok/agent-mcp 3.2.9 → 3.3.1

package/dist/schemas/onchain_operations.schema.json

@@ -230,7 +230,7 @@
                   "additionalProperties": false
                 },
                 "order_required_info": {
-                  "description": "Contact object ID or WTS Proof object, RECORDED on the Order as evidence that the order holder delivered the private information the Service declares in customer_required (e.g. phone/email/shipping_address). RECORD-ONLY, NOT ENFORCED: nothing on-chain reads this field — the purchase entry never requires it, and an order supplying none of the declared fields is still created. FLOW: the order holder sends the information to the Service's Contact (um) via end-to-end encrypted Messenger, then passes the Contact object ID or the generated WTS Proof here. To ENFORCE delivery on-chain, mount the pattern.required_info_evidence_gate Guard on the forward that hands over goods or funds, asserting order.required_info is some (presence-only — the recorded address value is never a guard condition; accepting the delivered information is the merchant's confirming forward). ATTESTATION-ONLY: the recorded value is self-attested, has no on-chain readback, and MUST NOT be used as a gate condition. PER-ORDER BINDING: when the listing genuinely promises a per-order credential, use the dedicated controlled bind operation (order_required_info_bind) with a Proof whose about is THIS order and whose creator is the order holder — the chain verifies both at write time and rejects a mismatch without writing anything. The reuse model (one Contact Proof across orders) stays the default for this plain record field; pick per listing promise, not per habit.",
+                  "description": "Contact object ID or WTS Proof object, RECORDED on the Order as evidence that the order holder delivered the private information the Service declares in customer_required (e.g. phone/email/shipping_address). RECORD-ONLY, NOT ENFORCED: nothing on-chain reads this field — the purchase entry never requires it, and an order supplying none of the declared fields is still created. FLOW: the order holder sends the information to the Service's Contact (um) via end-to-end encrypted Messenger, then passes the Contact object ID or the generated WTS Proof here. To ENFORCE delivery on-chain, mount the pattern.required_info_evidence_gate Guard on the forward that hands over goods or funds, asserting order.required_info is some (presence-only — the recorded address value is never a guard condition; accepting the delivered information is the merchant's confirming forward). ATTESTATION-ONLY: the recorded value is self-attested, has no on-chain readback, and MUST NOT be used as a gate condition. PER-ORDER BINDING: when the listing genuinely promises a per-order credential, use the dedicated controlled bind operation (order_required_info_bind) with a Proof whose about is THIS order and whose creator is the order holder — the chain verifies both at write time and rejects a mismatch without writing anything. The reuse model (one Contact Proof across orders) stays the default for this plain record field; pick per listing promise, not per habit. BOUNDARY: that binding proves the credential AUTHOR only, never its content or any rating — do not mirror it onto review/reward claims; public reviews are Repository rows whose values are enforced guard-side via data-value probes, not through Proof objects.",
                   "type": "string"
                 },
                 "transfer": {
@@ -341,7 +341,7 @@
               "type": "string"
             },
             "sales": {
-              "description": "Service sales products or services list. ⚠️ WIP NETWORK-DEPLOYMENT RULE: a non-empty sale.wip MUST be a publicly reachable URL (GitHub Pages / IPFS / your own website). The URL is stored ON-CHAIN and every customer fetches it at order time — a local file path, localhost/loopback URL, or LAN private-IP URL is unreachable by customers on other machines and aborts order_new 100%. Local-network URLs are INTERNAL TEST USE ONLY (env.network = localnet). Leave sale.wip empty (\"\") to skip WIP verification (TESTING ONLY).",
+              "description": "Service sales products or services list. ⚠️ WIP (PRODUCT-DETAIL FILE) — HOW TO PROVIDE IT: (1) EASIEST — official free hosting: upload the detail file with the wip_file tool; the default endpoint is https://wip.store.wowok.net (free: 10 files per account, 180-day retention, 12MB per file, rate-limited; files stay until you purge them). Put the returned URL into sale.wip. (2) Your own hosting: any publicly reachable URL (GitHub Pages / IPFS / your own website) — pass customBaseUrl to wip_file when uploading to a non-default endpoint, or host the file yourself and put that URL into sale.wip. For long-lived MAINNET listings prefer your own endpoint so the detail page outlives the free retention window. ⚠️ REACHABILITY RULE: a non-empty sale.wip MUST be a publicly reachable URL. The URL is stored ON-CHAIN and every customer fetches it at order time — a local file path, localhost/loopback URL, or LAN private-IP URL is unreachable by customers on other machines and aborts order_new 100%. Local-network URLs are INTERNAL TEST USE ONLY (env.network = localnet). ⚠️ SCORING: on mainnet, a sale item without a product-detail file is an incomplete listing — it hurts the service's market completeness score. Leave sale.wip empty (\"\") only for quick local testing.",
               "oneOf": [
                 {
                   "type": "object",
@@ -1103,7 +1103,7 @@
                                         "GuardIdentifier"
                                       ],
                                       "additionalProperties": false,
-                                      "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                                      "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                                     },
                                     {
                                       "type": "object",
@@ -1142,7 +1142,7 @@
                                         "Signer"
                                       ],
                                       "additionalProperties": false,
-                                      "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                                      "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                                     }
                                   ],
                                   "description": "Recipient of this allocation. Three forms — each resolves the address at a DIFFERENT time:\n• { GuardIdentifier: u8 } — DYNAMIC address resolved from Passport at alloc() time (from the passport's submission record). Use 0 for Order owner in Service-integrated mode (Customer who created the Order). The identifier must match a Guard table entry with b_submission=true. If Passport has no matching submission, contract aborts with E_VERIFY_FAILED. Use when the recipient address is not known at config time and must be supplied via Guard submission data.\n• { Entity: { name_or_address: '...' } } — FIXED address resolved via LocalMark at SDK build time (passed to contract as a literal address). Use for known recipients (e.g., 'turo_host', or a Treasury object address). Use when the recipient is a stable, known address (e.g., operator receives rent, platform fee to treasury).\n• 'Signer' — the transaction sender at the time of the alloc() call (tx_context::sender). RESOLVED AT EXECUTION TIME, not at config time. For refunds: the customer (Order owner) must call alloc_by_guard THEMSELVES so that tx_context::sender resolves to THEIR address — if the operator calls alloc_by_guard, the operator becomes the recipient (Signer = operator), NOT the customer. Use when the recipient is whoever submits the allocation transaction (e.g., customer receives refund)."
@@ -1288,7 +1288,7 @@
                                     "GuardIdentifier"
                                   ],
                                   "additionalProperties": false,
-                                  "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                                  "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                                 },
                                 {
                                   "type": "object",
@@ -1327,7 +1327,7 @@
                                     "Signer"
                                   ],
                                   "additionalProperties": false,
-                                  "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                                  "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                                 }
                               ],
                               "description": "Recipient of this allocation. Three forms — each resolves the address at a DIFFERENT time:\n• { GuardIdentifier: u8 } — DYNAMIC address resolved from Passport at alloc() time (from the passport's submission record). Use 0 for Order owner in Service-integrated mode (Customer who created the Order). The identifier must match a Guard table entry with b_submission=true. If Passport has no matching submission, contract aborts with E_VERIFY_FAILED. Use when the recipient address is not known at config time and must be supplied via Guard submission data.\n• { Entity: { name_or_address: '...' } } — FIXED address resolved via LocalMark at SDK build time (passed to contract as a literal address). Use for known recipients (e.g., 'turo_host', or a Treasury object address). Use when the recipient is a stable, known address (e.g., operator receives rent, platform fee to treasury).\n• 'Signer' — the transaction sender at the time of the alloc() call (tx_context::sender). RESOLVED AT EXECUTION TIME, not at config time. For refunds: the customer (Order owner) must call alloc_by_guard THEMSELVES so that tx_context::sender resolves to THEIR address — if the operator calls alloc_by_guard, the operator becomes the recipient (Signer = operator), NOT the customer. Use when the recipient is whoever submits the allocation transaction (e.g., customer receives refund)."
@@ -1630,8 +1630,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Service object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Service object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -1741,10 +1749,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -1792,6 +1796,9 @@
             "publish": {
               "description": "Whether to publish the Service. After publishing, customers can place orders. ⚠️ PRE-PUBLISH EVALUATION (mandatory, stop-node fund-exit coverage): service.allocators MUST cover EVERY stop node of the bound Machine — every node where an order can rest (terminal nodes AND waiting states: review windows, handovers, open disputes) needs BOTH a withdrawal (release) AND a refund allocation rule, and each mapping guard must be satisfiable in BOTH directions. An uncovered stop node strands escrowed funds permanently (order_allocators is L1-immutable). Review-gated release is a TIME VARIANT inside ONE exit guard ('reviewed OR unreviewed after T'), never parallel outgoing edges (race deadlock). See pattern.fund_flow_stop_node_coverage + rules R-M5-03 / R-M5-09. VERIFIED against Move source + SDK (4-level immutability matrix):\n  L1 — PERMANENTLY LOCKED after publish (assert!(!bPublished), no pause+lock exception):\n    • machine          (workflow template)\n    • order_allocators (fund distribution rules — full replacement locked; APPEND-ONLY additions remain possible via order_allocators_append, prefix/threshold frozen)\n  L2 — TIME-LOCKED after publish (unpublished-state check — requires pause + setting_lock_duration elapsed):\n    • arbitrations remove/clear (dispute resolution objects)\n    • rewards remove/clear       (reward objects)\n    • compensation_fund_withdraw (withdraw ALL funds)\n    RATIONALE (deliberate design, NOT a defect): these three REVOKE buyer-facing guarantees that placed orders already rely on — the lock protects buyer expectations. Daily operations (sales add/remove, price, stock, description) are NEVER gated by this lock.\n  L3 — REMAIN MUTABLE after publish (no SDK check, no Move check):\n    • arbitrations add, rewards add (no assert — can add after publish)\n    • buy_guard, sales, discount, description, location, pause, repositories,\n    • compensation_fund_add, setting_lock_duration_add, customer_required, um (Contact)\nThese 2 L1-LOCKED fields (machine/order_allocators) MUST be set BEFORE publish=true.\narbitrations/rewards can be ADDED after publish but remove/clear requires pause+lock.\n\n⚠️ COMPENSATION_FUND + ARBITRATION LINKAGE:\n  At publish time, if compensation_fund > 0, Arbitration MUST be bound:\n    if (balance::value(&self.compensation_fund) > 0) {\n        assert!(arbitration_count > 0, E_ARBITRATION_NOT_SET_WITH_COMPENSATION_FUND);\n    }\n  The MCP handler enforces this as a HARD PRE-CHECK: if publish=true AND compensation_fund_add   is set in the same call AND arbitrations is empty, the call is REJECTED before submission.   If compensation_fund was deposited in a prior call, a SOFT WARNING is issued.\n\nSCHEMA-03 / P0-01 fix — DEPLOYMENT WORKFLOW (two-phase, avoids circular dependency):\n  Phase 1 — CREATE (no publish): object={name:'my-service', type_parameter, permission} + machine + order_allocators + arbitrations.\n    NOTE: buy_guard can use a LocalMark NAME (not address) to break the Guard→Service circular dependency.\n    The name is resolved to an address at transaction build time.\n  Phase 2 — PUBLISH: object='my-service' (string ref) + publish=true.\n    All L1-LOCKED fields must be set in Phase 1; Phase 2 only flips the publish flag.\n  Post-publish updates: buy_guard, sales, description, repositories (add), rewards (add), arbitrations (add), etc.",
               "type": "boolean"
+            },
+            "creation_plan": {
+              "description": "WIZARD CONTRACT: the Plan JSON that merchant_guide delivered (its creation_plan / plan field), passed back VERBATIM on the Service publish call (data.publish=true). The publish gate replays the plan's freeze matrix (preflight) right before submission and REJECTS the publish when any gate fails (structural issues, critical audit findings, or a failed rule check) — this closes the preflight bypass where a plan that failed merchant_guide's audit could still be materialized manually. OMIT this field on every NON-publish call and on fully manual (non-wizard) builds — the manual path is unchanged and never gated by this field. Do NOT edit, trim, or 'improve' the plan in transit: a mutated plan is rejected (target cross-check) and the publish must be redone from merchant_guide."
             }
           },
           "required": [
@@ -2931,6 +2938,10 @@
                                   "description": "Node pair in Machine object"
                                 },
                                 "description": "Node pair list"
+                              },
+                              "optional": {
+                                "description": "OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).",
+                                "type": "boolean"
                               }
                             },
                             "required": [
@@ -3118,6 +3129,10 @@
                                   "description": "Node pair in Machine object"
                                 },
                                 "description": "Node pair list"
+                              },
+                              "optional": {
+                                "description": "OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).",
+                                "type": "boolean"
                               }
                             },
                             "required": [
@@ -3493,8 +3508,16 @@
               "type": "boolean"
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Machine object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Machine object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -3604,10 +3627,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -4453,8 +4472,16 @@
               "additionalProperties": false
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Progress object and send them to the owner of the bound Machine's Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Progress object and send them to the owner of the bound Machine's Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -4564,10 +4591,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -6071,8 +6094,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Repository object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Repository object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -6182,10 +6213,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -7049,7 +7076,7 @@
                 },
                 "voting_deadline": {
                   "default": null,
-                  "description": "Voting deadline as Unix timestamp in MILLISECONDS (ms). SEMANTICS OF SPECIAL VALUES: null (DEFAULT when omitted) = open-ended voting, no deadline; parties may vote at any time and the arbitrator may deliver the verdict immediately (arb.move skips the deadline assert when the Option is none) — this is the SAFE default; a future timestamp = normal bounded voting window (recommended: now + at least 86400000 ms = 24 hours); 0 = deadline already passed → voting is IMPOSSIBLE (every vote aborts E_VOTING_DEADLINE_PASSED) and only a direct verdict is possible. Only pass 0 deliberately when you truly want a no-vote verdict. COMMON MISTAKE: using seconds instead of milliseconds (multiply by 1000). Example: Date.now() + 259200000 for 3 days from now.",
+                  "description": "Voting deadline as Unix timestamp in MILLISECONDS (ms). SEMANTICS OF SPECIAL VALUES: null (DEFAULT when omitted) = open-ended voting, no deadline; parties may vote at any time and the arbitrator may deliver the verdict after casting at least one ballot (arb.move skips the deadline assert when the Option is none) — this is the SAFE default; a future timestamp = normal bounded voting window (recommended: now + at least 86400000 ms = 24 hours); 0 = deadline already passed → the case PERMANENTLY DEADLOCKS (kl-real-261016 F-01, chain-verified): every vote aborts E_VOTING_DEADLINE_PASSED, so no ballot can ever exist, the verdict then aborts E_NO_VOTE_CAST (a verdict requires >= 1 cast ballot), and reset aborts as well. NEVER pass 0. Direct verdict = null + cast one ballot first, then deliver the verdict. COMMON MISTAKE: using seconds instead of milliseconds (multiply by 1000). Example: Date.now() + 259200000 for 3 days from now.",
                   "anyOf": [
                     {
                       "type": "integer",
@@ -7085,7 +7112,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "New voting deadline as Unix timestamp in MILLISECONDS (ms). SEMANTICS OF SPECIAL VALUES: 0 = deadline already passed → voting is IMPOSSIBLE and the arbitrator may deliver the verdict immediately; null = open-ended voting with no deadline (verdict allowed anytime); a future timestamp = normal voting window (recommended: now + at least 86400000 ms = 24 hours). COMMON MISTAKE: using seconds instead of milliseconds (multiply by 1000). Example: Date.now() + 259200000 for 3 days from now."
+                  "description": "New voting deadline as Unix timestamp in MILLISECONDS (ms). SEMANTICS OF SPECIAL VALUES: 0 = deadline already passed → the case PERMANENTLY DEADLOCKS (votes abort E_VOTING_DEADLINE_PASSED, no ballot can ever exist, verdict aborts E_NO_VOTE_CAST, reset aborts). NEVER pass 0; null = open-ended voting with no deadline (verdict allowed after casting at least one ballot — use this for the immediate-verdict flow: cast one ballot, then deliver); a future timestamp = normal voting window (recommended: now + at least 86400000 ms = 24 hours). COMMON MISTAKE: using seconds instead of milliseconds (multiply by 1000). Example: Date.now() + 259200000 for 3 days from now."
                 }
               },
               "required": [
@@ -7403,8 +7430,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Arbitration object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Arbitration object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -7514,10 +7549,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -8380,8 +8411,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Receive objects sent to this Contact object and unwrap them to the permission owner.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Receive objects sent to this Contact object and unwrap them to the permission owner.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -8491,10 +8530,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             }
@@ -9874,8 +9909,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Treasury object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Treasury object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -9985,10 +10028,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -10857,7 +10896,7 @@
               ]
             },
             "guard_add": {
-              "description": "Add Guard to Reward object. IDIOMS (F08 — these differ from Service allocation, follow THIS shape here): recipient is ONE OF {GuardIdentifier: <u8>} | {Entity: {name_or_address: 'mark'}} | {Signer: 'signer'} (string const INSIDE the key, NOT a bare string); amount is {type: 'Fixed', value: '0.1WOW'} — value accepts a display string with token symbol ('0.1WOW') or a smallest-unit integer ('100000000'), NOT the plain balance string used by allocation `sharing`. FULL EXAMPLE: [{guard: '0xabc...', recipient: {Signer: 'signer'}, amount: {type: 'Fixed', value: '0.1WOW'}}].",
+              "description": "Add Guard to Reward object. IDIOMS (F08 — these differ from Service allocation, follow THIS shape here): recipient is ONE OF {GuardIdentifier: <u8>} | {Entity: {name_or_address: 'mark'}} | {Signer: 'signer'} (string const INSIDE the key, NOT a bare string) — BUT on the REWARD claim rail the recipient MUST equal the transaction sender (chain assert, abort 14), so {Signer: 'signer'} is the canonical form and {Entity} also passes (SDK replaces it with the claimant's account at claim time); a {GuardIdentifier} recipient resolves to the submitted Order and is STRUCTURALLY UNPAYABLE (every claim aborts 14) — the tool gate rejects it (crs-mn-261015 F-12). amount is {type: 'Fixed', value: '0.1WOW'} — value accepts a display string with token symbol ('0.1WOW') or a smallest-unit integer ('100000000'), NOT the plain balance string used by allocation `sharing`. FULL EXAMPLE: [{guard: '0xabc...', recipient: {Signer: 'signer'}, amount: {type: 'Fixed', value: '0.1WOW'}}].",
               "type": "array",
               "items": {
                 "type": "object",
@@ -10882,7 +10921,7 @@
                           "GuardIdentifier"
                         ],
                         "additionalProperties": false,
-                        "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                        "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                       },
                       {
                         "type": "object",
@@ -10921,10 +10960,10 @@
                           "Signer"
                         ],
                         "additionalProperties": false,
-                        "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                        "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                       }
                     ],
-                    "description": "Recipient ID. Three forms:\n  - {GuardIdentifier: u8}  — DYNAMIC address resolved from Passport at alloc() time\n  - {Entity: {name_or_address: 'mark_name'}}  — FIXED static address via LocalMark (recommended)\n  - {Signer: 'signer'}  — transaction sender at alloc() time (e.g. self-refund; customer must call alloc_by_guard themselves)"
+                    "description": "Recipient ID. Three forms:\n  - {GuardIdentifier: u8}  — DYNAMIC address resolved from Passport at alloc() time (Allocation rails only; structurally unpayable on reward.guard_add — abort 14)\n  - {Entity: {name_or_address: 'mark_name'}}  — FIXED static address via LocalMark (recommended)\n  - {Signer: 'signer'}  — transaction sender at alloc() time (e.g. self-refund; customer must call alloc_by_guard themselves; canonical on reward claim rails)"
                   },
                   "amount": {
                     "oneOf": [
@@ -11024,8 +11063,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Reward object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Reward object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -11135,10 +11182,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -11153,6 +11196,82 @@
                   "type": "null"
                 }
               ]
+            },
+            "withdraw": {
+              "description": "Permission-gated balance exit (the ONLY non-claim exit from the Reward balance): withdraws this amount from the Reward balance and delivers it to the transaction sender inside a Payment object (the on-chain auditable receipt, keyed by the RewardWithdrawEvent). The executing account needs the withdraw right (permission index 158) on the Reward's Permission object. Fails on-chain when the balance is insufficient or while the declared no-guard window (guard_expiration_time) is still in the future; claim replay protection is unaffected. Use it to recover mismatched or overfunded pools.",
+              "type": "object",
+              "properties": {
+                "amount": {
+                  "anyOf": [
+                    {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 9007199254740991
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "description": "Amount to withdraw (SMALLEST token units, e.g. '100000000')."
+                },
+                "payment_info": {
+                  "type": "object",
+                  "properties": {
+                    "for_object": {
+                      "description": "Binding anchor for this distribution. On an Allocation a SET for_object is ENFORCED at alloc(): every GuardIdentifier recipient submission must equal this address or the whole tx aborts (ERECIPIENT_NOT_FOR_OBJECT, code 15) — verify the anchor matches the intended recipient flow BEFORE create; payment_info is immutable afterwards. NULL/omitted = no anchor: nothing is enforced on-chain, recipient routing is entirely the creator's design. Also recorded at creation for auditors to query the distribution's business context.",
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "for_guard": {
+                      "description": "Payment to satisfy verification of a Guard object",
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "remark": {
+                      "type": "string",
+                      "description": "Payment record remark"
+                    },
+                    "index": {
+                      "anyOf": [
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "description": "Payment record index"
+                    }
+                  },
+                  "required": [
+                    "remark",
+                    "index"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Payment receipt metadata (remark/index). The withdrawn funds leave the Reward balance inside a Payment object — the on-chain auditable receipt."
+                },
+                "unwrap": {
+                  "description": "Auto-unwrap: when true, the coin is paid straight to the transaction sender in the SAME transaction (single-PTB flow). When false or omitted (default), a CoinWrapper is delivered to the sender's wallet for later unwrapping via the payment call with receive:true. Both modes keep the Payment object as the on-chain receipt.",
+                  "type": "boolean"
+                }
+              },
+              "required": [
+                "amount",
+                "payment_info"
+              ],
+              "additionalProperties": false
             }
           },
           "required": [
@@ -11879,7 +11998,7 @@
                                         "GuardIdentifier"
                                       ],
                                       "additionalProperties": false,
-                                      "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type."
+                                      "description": "Guard verified recipient ID. Get recipient ID from specified data index in Guard table. The ID must be of address type. ALLOCATION rails only — the REWARD claim rail requires recipient == the transaction sender (abort 14), so a GuardIdentifier recipient on reward.guard_add resolves to the submitted Order and is structurally unpayable; the tool gate rejects it (crs-mn-261015 F-12)."
                                     },
                                     {
                                       "type": "object",
@@ -11918,7 +12037,7 @@
                                         "Signer"
                                       ],
                                       "additionalProperties": false,
-                                      "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds."
+                                      "description": "Current transaction signer (tx_context::sender) at the time of the alloc() call. For refunds, the Order owner must call alloc_by_guard themselves to receive the funds. On the REWARD claim rail this is the CANONICAL recipient (the claim entry requires recipient == the tx sender)."
                                     }
                                   ],
                                   "description": "Recipient of this allocation. Three forms — each resolves the address at a DIFFERENT time:\n• { GuardIdentifier: u8 } — DYNAMIC address resolved from Passport at alloc() time (from the passport's submission record). Use 0 for Order owner in Service-integrated mode (Customer who created the Order). The identifier must match a Guard table entry with b_submission=true. If Passport has no matching submission, contract aborts with E_VERIFY_FAILED. Use when the recipient address is not known at config time and must be supplied via Guard submission data.\n• { Entity: { name_or_address: '...' } } — FIXED address resolved via LocalMark at SDK build time (passed to contract as a literal address). Use for known recipients (e.g., 'turo_host', or a Treasury object address). Use when the recipient is a stable, known address (e.g., operator receives rent, platform fee to treasury).\n• 'Signer' — the transaction sender at the time of the alloc() call (tx_context::sender). RESOLVED AT EXECUTION TIME, not at config time. For refunds: the customer (Order owner) must call alloc_by_guard THEMSELVES so that tx_context::sender resolves to THEIR address — if the operator calls alloc_by_guard, the operator becomes the recipient (Signer = operator), NOT the customer. Use when the recipient is whoever submits the allocation transaction (e.g., customer receives refund)."
@@ -13496,8 +13615,16 @@
               "additionalProperties": false
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Permission object and send them to the builder(owner).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Permission object and send them to the builder(owner).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -13607,10 +13734,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -14240,7 +14363,7 @@
                               "type": "string"
                             }
                           ],
-                          "description": "ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive."
+                          "description": "ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive. STRONGLY PREFER the NAME form: a numeric ID is resolved VERBATIM at runtime, so a wrong-but-existing ID silently checks a DIFFERENT field and only fails at Guard trigger time (abort 7, no leg named) — a wrong name fails loudly at validation here instead (rndb58d8d 04-ROOTCAUSE-A A2). If you only know the field, list the catalog first via schema_query action='get_guard_queries'."
                         },
                         "object": {
                           "type": "object",
@@ -15600,13 +15723,26 @@
                               "minimum": 0,
                               "maximum": 255,
                               "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                            },
+                            "convert_witness": {
+                              "description": "Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.",
+                              "anyOf": [
+                                {
+                                  "type": "integer",
+                                  "minimum": -9007199254740991,
+                                  "maximum": 9007199254740991
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ]
                             }
                           },
                           "required": [
                             "identifier"
                           ],
                           "additionalProperties": false,
-                          "description": "Reference to the Progress object in the Guard table (must be Address type)."
+                          "description": "Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."
                         },
                         "where": {
                           "type": "object",
@@ -15662,7 +15798,7 @@
                       "properties": {
                         "type": {
                           "type": "string",
-                          "const": "query_progress_history_session_find"
+                          "const": "query_progress_history_time"
                         },
                         "object": {
                           "type": "object",
@@ -15672,33 +15808,57 @@
                               "minimum": 0,
                               "maximum": 255,
                               "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                            },
+                            "convert_witness": {
+                              "description": "Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.",
+                              "anyOf": [
+                                {
+                                  "type": "integer",
+                                  "minimum": -9007199254740991,
+                                  "maximum": 9007199254740991
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ]
                             }
                           },
                           "required": [
                             "identifier"
                           ],
                           "additionalProperties": false,
-                          "description": "Reference to the Progress object in the Guard table (must be Address type)."
-                        },
-                        "historyIdx": {
-                          "description": "GuardNode that returns the history index (U64 type) to search within. Typically an 'identifier' node referencing a U64 value from the Guard table.",
-                          "allOf": [
-                            {
-                              "$ref": "#/definitions/__schema3"
-                            }
-                          ],
-                          "$ref": "#/definitions/__schema2"
+                          "description": "Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."
                         },
                         "where": {
                           "type": "object",
                           "properties": {
+                            "node": {
+                              "description": "Optional filter: node name string to match.",
+                              "type": "string"
+                            },
                             "nextNode": {
-                              "description": "Optional filter: next node name string to match.",
+                              "description": "Optional filter: next node name string to match — the canonical time anchor is where:{nextNode:'<node>'}, find:'last', which returns the IMMUTABLE moment that node was entered (1280 history.time is written once on entry and never rewritten, unlike the 1272 current-time read which refreshes on re-entry). An empty where {} with find:'last' returns the entry time of the CURRENT node — safe for node-SET gates.",
+                              "type": "string"
+                            },
+                            "timeMin": {
+                              "description": "Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.",
+                              "type": "string"
+                            },
+                            "timeMax": {
+                              "description": "Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.",
+                              "type": "string"
+                            },
+                            "indexMin": {
+                              "description": "Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.",
+                              "type": "string"
+                            },
+                            "indexMax": {
+                              "description": "Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.",
                               "type": "string"
                             }
                           },
                           "additionalProperties": false,
-                          "description": "Filter conditions for the progress history session query."
+                          "description": "Filter conditions for the progress history time query."
                         },
                         "find": {
                           "type": "string",
@@ -15706,25 +15866,24 @@
                             "first",
                             "last"
                           ],
-                          "description": "'first' finds the earliest matching session, 'last' finds the most recent matching session."
+                          "description": "'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."
                         }
                       },
                       "required": [
                         "type",
                         "object",
-                        "historyIdx",
                         "where",
                         "find"
                       ],
                       "additionalProperties": false,
-                      "description": "Returns U64. Finds the index of the first or last session within the specified history entry matching the filter conditions. Returns the session index (U64) if found. Throws error if no matching session is found (Guard validation fails)."
+                      "description": "Returns U64. Returns the TIMESTAMP (ms) of the first or last history entry matching the filter conditions — the immutable entry moment of a node (query 1280 progress.history.time). Preferred over query 1272 progress.current_time for time anchors: 1272 reads the node's CURRENT time and refreshes on re-entry (drift-prone), while 1280 is written once on entering next_node and never rewritten. Throws error if no matching entry is found (Guard validation fails)."
                     },
                     {
                       "type": "object",
                       "properties": {
                         "type": {
                           "type": "string",
-                          "const": "query_progress_history_session_forward_find"
+                          "const": "query_progress_history_session_find"
                         },
                         "object": {
                           "type": "object",
@@ -15743,16 +15902,7 @@
                           "description": "Reference to the Progress object in the Guard table (must be Address type)."
                         },
                         "historyIdx": {
-                          "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
-                          "allOf": [
-                            {
-                              "$ref": "#/definitions/__schema3"
-                            }
-                          ],
-                          "$ref": "#/definitions/__schema2"
-                        },
-                        "sessionIdx": {
-                          "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "description": "GuardNode that returns the history index (U64 type) to search within. Typically an 'identifier' node referencing a U64 value from the Guard table.",
                           "allOf": [
                             {
                               "$ref": "#/definitions/__schema3"
@@ -15763,11 +15913,82 @@
                         "where": {
                           "type": "object",
                           "properties": {
-                            "who": {
-                              "description": "Optional filter: operator address string to match.",
+                            "nextNode": {
+                              "description": "Optional filter: next node name string to match.",
                               "type": "string"
-                            },
-                            "operation": {
+                            }
+                          },
+                          "additionalProperties": false,
+                          "description": "Filter conditions for the progress history session query."
+                        },
+                        "find": {
+                          "type": "string",
+                          "enum": [
+                            "first",
+                            "last"
+                          ],
+                          "description": "'first' finds the earliest matching session, 'last' finds the most recent matching session."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object",
+                        "historyIdx",
+                        "where",
+                        "find"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns U64. Finds the index of the first or last session within the specified history entry matching the filter conditions. Returns the session index (U64) if found. Throws error if no matching session is found (Guard validation fails)."
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_progress_history_session_forward_find"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Progress object in the Guard table (must be Address type)."
+                        },
+                        "historyIdx": {
+                          "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        },
+                        "sessionIdx": {
+                          "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        },
+                        "where": {
+                          "type": "object",
+                          "properties": {
+                            "who": {
+                              "description": "Optional filter: operator address string to match.",
+                              "type": "string"
+                            },
+                            "operation": {
                               "description": "Optional filter: operation name string to match.",
                               "type": "string"
                             },
@@ -15960,6 +16181,77 @@
                       "additionalProperties": false,
                       "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
                     },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "query_progress_history_session_forward_retained_submission_value"
+                        },
+                        "object": {
+                          "type": "object",
+                          "properties": {
+                            "identifier": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 255,
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                            }
+                          },
+                          "required": [
+                            "identifier"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Reference to the Progress object in the Guard table (must be Address type)."
+                        },
+                        "historyIdx": {
+                          "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        },
+                        "sessionIdx": {
+                          "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        },
+                        "forwardIdx": {
+                          "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        },
+                        "identifier": {
+                          "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
+                          "allOf": [
+                            {
+                              "$ref": "#/definitions/__schema3"
+                            }
+                          ],
+                          "$ref": "#/definitions/__schema2"
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "object",
+                        "historyIdx",
+                        "sessionIdx",
+                        "forwardIdx",
+                        "identifier"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+                    },
                     {
                       "type": "object",
                       "properties": {
@@ -18882,8 +19174,16 @@
               ]
             },
             "owner_receive": {
-              "description": "Unwrap CoinWrapper objects and other objects received by this Demand object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects and other objects received by this Demand object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -18993,10 +19293,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -19811,8 +20107,16 @@
               "additionalProperties": false
             },
             "receive": {
-              "description": "Unwrap CoinWrapper objects or other objects received by the order and transfer them to the order owner. Consistent with `owner_receive` on other objects (arbitration/contact/demand/machine/permission/repository/reward/service/treasury).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received.\"\n  Example: receive: 'recently'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
+              "description": "Unwrap CoinWrapper objects or other objects received by the order and transfer them to the order owner. Consistent with `owner_receive` on other objects (arbitration/contact/demand/machine/permission/repository/reward/service/treasury).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
               "anyOf": [
+                {
+                  "type": "string",
+                  "const": "recently"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^0x[0-9a-fA-F]{8,}$"
+                },
                 {
                   "minItems": 1,
                   "type": "array",
@@ -19922,10 +20226,6 @@
                   ],
                   "additionalProperties": false,
                   "description": "Received record of Coin objects"
-                },
-                {
-                  "type": "string",
-                  "const": "recently"
                 }
               ]
             },
@@ -22744,7 +23044,7 @@
                   "type": "string"
                 }
               ],
-              "description": "ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive."
+              "description": "ID or name of the wowok object data query instruction. Can be a numeric ID (e.g., 1001) or a name string (e.g., 'permission.description'). Name matching is case-insensitive. STRONGLY PREFER the NAME form: a numeric ID is resolved VERBATIM at runtime, so a wrong-but-existing ID silently checks a DIFFERENT field and only fails at Guard trigger time (abort 7, no leg named) — a wrong name fails loudly at validation here instead (rndb58d8d 04-ROOTCAUSE-A A2). If you only know the field, list the catalog first via schema_query action='get_guard_queries'."
             },
             "object": {
               "type": "object",
@@ -24104,13 +24404,26 @@
                   "minimum": 0,
                   "maximum": 255,
                   "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                },
+                "convert_witness": {
+                  "description": "Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.",
+                  "anyOf": [
+                    {
+                      "type": "integer",
+                      "minimum": -9007199254740991,
+                      "maximum": 9007199254740991
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ]
                 }
               },
               "required": [
                 "identifier"
               ],
               "additionalProperties": false,
-              "description": "Reference to the Progress object in the Guard table (must be Address type)."
+              "description": "Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."
             },
             "where": {
               "type": "object",
@@ -24161,6 +24474,91 @@
           "additionalProperties": false,
           "description": "Returns U64. Finds the index of the first or last history entry matching the filter conditions. Returns the history index (U64) if found. Throws error if no matching entry is found (Guard validation fails)."
         },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_progress_history_time"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                },
+                "convert_witness": {
+                  "description": "Optional witness to derive the Progress object from the submitted Order (e.g. 'OrderProgress'): the table object is the ORDER address and the chain resolves its per-order Progress — one Guard serves every order. Omit when the table object is a concrete Progress address.",
+                  "anyOf": [
+                    {
+                      "type": "integer",
+                      "minimum": -9007199254740991,
+                      "maximum": 9007199254740991
+                    },
+                    {
+                      "type": "string"
+                    }
+                  ]
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the queried object in the Guard table: a Progress address, or an Order address when convert_witness is set."
+            },
+            "where": {
+              "type": "object",
+              "properties": {
+                "node": {
+                  "description": "Optional filter: node name string to match.",
+                  "type": "string"
+                },
+                "nextNode": {
+                  "description": "Optional filter: next node name string to match — the canonical time anchor is where:{nextNode:'<node>'}, find:'last', which returns the IMMUTABLE moment that node was entered (1280 history.time is written once on entry and never rewritten, unlike the 1272 current-time read which refreshes on re-entry). An empty where {} with find:'last' returns the entry time of the CURRENT node — safe for node-SET gates.",
+                  "type": "string"
+                },
+                "timeMin": {
+                  "description": "Optional filter: minimum timestamp (inclusive) for history entry time. Use string to represent U64 value.",
+                  "type": "string"
+                },
+                "timeMax": {
+                  "description": "Optional filter: maximum timestamp (inclusive) for history entry time. Use string to represent U64 value.",
+                  "type": "string"
+                },
+                "indexMin": {
+                  "description": "Optional filter: minimum history index (inclusive) to search within. Use string to represent U64 value.",
+                  "type": "string"
+                },
+                "indexMax": {
+                  "description": "Optional filter: maximum history index (inclusive) to search within. Use string to represent U64 value.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false,
+              "description": "Filter conditions for the progress history time query."
+            },
+            "find": {
+              "type": "string",
+              "enum": [
+                "first",
+                "last"
+              ],
+              "description": "'first' finds the earliest matching history entry, 'last' finds the most recent matching history entry."
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "where",
+            "find"
+          ],
+          "additionalProperties": false,
+          "description": "Returns U64. Returns the TIMESTAMP (ms) of the first or last history entry matching the filter conditions — the immutable entry moment of a node (query 1280 progress.history.time). Preferred over query 1272 progress.current_time for time anchors: 1272 reads the node's CURRENT time and refreshes on re-entry (drift-prone), while 1280 is written once on entering next_node and never rewritten. Throws error if no matching entry is found (Guard validation fails)."
+        },
         {
           "type": "object",
           "properties": {
@@ -24464,6 +24862,77 @@
           "additionalProperties": false,
           "description": "Returns U64. Counts the number of retained submissions within the specified forward operation."
         },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_progress_history_session_forward_retained_submission_value"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Progress object in the Guard table (must be Address type)."
+            },
+            "historyIdx": {
+              "description": "GuardNode that returns the history index (U64 type). Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "sessionIdx": {
+              "description": "GuardNode that returns the session index (U64 type) within the history entry. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "forwardIdx": {
+              "description": "GuardNode that returns the forward operation index (U64 type) within the session. Typically an 'identifier' node referencing a U64 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            },
+            "identifier": {
+              "description": "GuardNode that returns the submission identifier (U8 type) — which retained submission of the forward to read. Typically an 'identifier' node referencing a U8 value from the Guard table.",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/__schema3"
+                }
+              ],
+              "$ref": "#/definitions/__schema2"
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "historyIdx",
+            "sessionIdx",
+            "forwardIdx",
+            "identifier"
+          ],
+          "additionalProperties": false,
+          "description": "Returns VecU8 (the ONLY history query that does not return U64). Value of the specified retained submission of a HISTORY record (query 1281) — the history-side counterpart of the ACTIVE-SESSION-ONLY 1268 read, which goes blind once the session migrates into history. Use 1274/1275 to discover the history/session/forward indexes first. Throws error when the record carries no submission for the identifier (Guard validation fails)."
+        },
         {
           "type": "object",
           "properties": {