@wowok/agent-mcp 3.3.6 → 3.3.8

package/dist/schemas/query_toolkit.output.json

@@ -5374,6 +5374,40 @@
                                           "type": "null"
                                         }
                                       ]
+                                    },
+                                    "evidence": {
+                                      "description": "ksk9d2-tn-261026 F-01 claim-time attestation pin (reward::evidence_bind). REQUIRES store_from_id on the SAME guard — the binding reads THE pinned store_from row, so the chain aborts 16 (E_EVIDENCE_NEEDS_STORE_FROM) at build time without it. At claim the chain counts repository rows under (repo, key) matching the predicate for the claim's OWN store_from value (the submitted order) via the native evidence_count and aborts 15 (E_EVIDENCE_NOT_OWNED) when none — a borrowed foreign row can never pay.",
+                                      "type": "object",
+                                      "properties": {
+                                        "repo": {
+                                          "type": "string",
+                                          "description": "Repository object ID or name holding the attestation rows."
+                                        },
+                                        "key": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "integer",
+                                            "minimum": 0,
+                                            "maximum": 255
+                                          },
+                                          "description": "Repository data key bytes (the policy name the rows live under, e.g. UTF-8 bytes of 'rating')."
+                                        },
+                                        "predicate": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "integer",
+                                            "minimum": 0,
+                                            "maximum": 255
+                                          },
+                                          "description": "BCS-encoded RepositoryDataPredicateWire bytes — the same predicate blob the repository read channel uses."
+                                        }
+                                      },
+                                      "required": [
+                                        "repo",
+                                        "key",
+                                        "predicate"
+                                      ],
+                                      "additionalProperties": false
                                     }
                                   },
                                   "required": [
@@ -15626,6 +15660,10 @@
                               "digest": {
                                 "description": "Transaction digest that caused this change",
                                 "type": "string"
+                              },
+                              "synthesized": {
+                                "description": "C-F31 (5R-10): true when this removal entry (deleted/wrapped/unwrapped) was reconstructed from the transaction effects because the node's objectChanges omitted the consumed object. Effect refs are typeless, so object_type is unavailable on synthesized entries — resolve the type via the object id's history if needed. Never ignore a synthesized removal in a fund audit: it is the money's exit door.",
+                                "type": "boolean"
                               }
                             },
                             "required": [
@@ -16250,6 +16288,10 @@
                   ],
                   "additionalProperties": false
                 },
+                "paused": {
+                  "type": "boolean",
+                  "description": "bs29 R-16 (O18): True when the Service is paused — the quote still computes prices, but EVERY buy is refused while the pause stands (client pre-buy gate, then the on-chain E_PAUSED assert). There is no on-chain scheduled resume: the merchant must submit pause:false. Do not budget against a paused quote."
+                },
                 "payment_token": {
                   "type": "object",
                   "properties": {
@@ -16326,7 +16368,7 @@
                     },
                     "note": {
                       "type": "string",
-                      "description": "order_new.buy.total_pay.balance must equal this exactly when passed explicitly — the on-chain buy aborts on any drift. Without a discount you may omit total_pay entirely: the buy auto-derives this exact total (M-K17)."
+                      "description": "FLOOR semantics (bs29 R-17, service.move:480-481): total_pay is a MINIMUM — an under-funded total aborts (E_COIN_NOT_ENOUGH); an over-funded one succeeds but the ORDER still escrows exactly Σ(unit_price × quantity) − discount (the excess is split back, never escrowed). Pass exactly this balance; without a discount you may omit total_pay entirely (the buy auto-derives this exact total, M-K17). Prefixed with the paused warning when the Service is paused (R-16)."
                     }
                   },
                   "required": [
@@ -16355,6 +16397,21 @@
                             }
                           ]
                         },
+                        "owned_by": {
+                          "anyOf": [
+                            {
+                              "type": "string"
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "KB-02 attribution: the coupon's current HOLDER address (unwrapped from the on-chain owner field); null when the chain read could not resolve it. The coupon is a holder object — this address is its only valid spender."
+                        },
+                        "ownership_note": {
+                          "type": "string",
+                          "description": "KB-02 attribution disclosure: the coupon is owned by <holder>; only the holder can redeem — a coupon held by another address cannot be applied to your order, have the owner transfer it first (discount_send); refunds settle the post-coupon amount only. When owned_by is null the note says the holder is UNVERIFIED and must be checked before checkout."
+                        },
                         "type": {
                           "type": "string",
                           "description": "'rates' (off is bps of the list total) or 'minus' (off is a fixed smallest-units amount)."
@@ -16376,7 +16433,7 @@
                         },
                         "benchmark_met": {
                           "type": "boolean",
-                          "description": "False when the list total is below benchmark — on chain the buy still succeeds at FULL price and DESTROYS the coupon."
+                          "description": "False when the list total is below benchmark — the chain quote is then issued at FULL price WITHOUT stamping the coupon (service.move:436-442), so attaching the coupon at buy aborts (E_DISCOUNT_COUPON_UNEXPECTED, full rollback, nothing paid, coupon PRESERVED). Drop the coupon to buy at full price and keep it; raise the basket to actually use it."
                         },
                         "applied": {
                           "type": "boolean",
@@ -16395,12 +16452,14 @@
                         },
                         "note": {
                           "type": "string",
-                          "description": "Burn warning when benchmark is unmet; guidance to use final_total when applied."
+                          "description": "Benchmark-unmet guidance (threshold + refusal semantics) when benchmark is unmet; burn-on-use and refund-basis guidance when applied."
                         }
                       },
                       "required": [
                         "coupon",
                         "name",
+                        "owned_by",
+                        "ownership_note",
                         "type",
                         "off",
                         "benchmark",
@@ -16417,7 +16476,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "Discount pricing block, mirroring the on-chain discounted-quote validation and price-reduction rules (service.move:282-302, 357-365). null when no discount was requested. Wrong-service or expired coupons REJECT the quote (the chain aborts the same way); an unmet benchmark returns applied:false with a burn warning (the only non-aborting failure). Read-only — quoting never consumes the coupon."
+                  "description": "Discount pricing block, mirroring the on-chain discounted-quote validation and price-reduction rules (the service module's discounted quote and its buy-time price-reduction twin). null when no discount was requested. Wrong-service or expired coupons REJECT the quote (the chain aborts the same way); an unmet benchmark returns applied:false with a benchmark-unmet warning — the buy with the coupon attached is refused (F-21 ptrn3: the threshold is disclosed HERE so the storefront can grey the coupon instead of failing at checkout). Read-only — quoting never consumes the coupon."
                 },
                 "allocation_preview": {
                   "anyOf": [
@@ -16498,7 +16557,7 @@
                         },
                         "max_coverable_order": {
                           "type": "string",
-                          "description": "Raw smallest units: fund / 3 — the LARGEST single order this fund can still cover (F-OF2-06). Orders above this ceiling are refused at buy (compensation_fund_below_order_ceiling), so this is the storefront's effective price cap; check it before promising a bigger basket."
+                          "description": "Raw smallest units: fund / 3 — the LARGEST single order this fund can fully cover (F-OF2-06). Orders above this ceiling proceed with a buy-time warning (compensation_fund_below_order_ceiling, demoted to warning by 拍板⑤ dm-mtw-261027), so treat this as the storefront's fully-covered cap; check it before promising a bigger basket."
                         },
                         "max_coverable_order_display": {
                           "anyOf": [
@@ -16526,7 +16585,7 @@
                         },
                         "shortfall": {
                           "type": "string",
-                          "description": "Raw smallest units the merchant must add via service.compensation_fund_add before THIS basket can be ordered: max(0, required_for_this_basket - fund_balance). 0 when already covered."
+                          "description": "Raw smallest units the merchant should add via service.compensation_fund_add to fully cover THIS basket: max(0, required_for_this_basket - fund_balance). 0 when already covered. The basket can still be ordered with a warning while the shortfall stands (拍板⑤ dm-mtw-261027)."
                         },
                         "shortfall_display": {
                           "anyOf": [
@@ -16564,7 +16623,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "Per-order compensation-fund coverage for THIS basket (b6-11): the enforcement moved off the publish gate to the buy path — a fund-carrying Service below 3x the ORDER amount blocks order creation (compensation_fund_below_order_ceiling, no money moves), so the quote surfaces the same arithmetic BEFORE ordering. fund = 0 is a disclosed no-protection choice, never blocked. The chain-side claim-time gate remains the backstop: a zero fund aborts the payout (code 27, claim NOT consumed); a fund below the award pays it capped at the fund balance (tiered payout)."
+                  "description": "Per-order compensation-fund coverage for THIS basket (b6-11, demoted to warning by 拍板⑤ dm-mtw-261027): the buy path WARNS when a fund-carrying Service is below 3x the ORDER amount (compensation_fund_below_order_ceiling) but the order still proceeds — the quote surfaces the same arithmetic BEFORE ordering so the buyer can opt out or the merchant can top up first. fund = 0 is a disclosed no-protection choice, never blocked. The chain-side claim-time gate remains the backstop: a zero fund aborts the payout (code 27, claim NOT consumed); a fund below the award pays it capped at the fund balance (tiered payout)."
                 },
                 "reward_terms": {
                   "anyOf": [
@@ -16679,6 +16738,51 @@
                                         }
                                       ],
                                       "description": "Rating condition detected in the claim guard (F-AOF-4): 'like' or 'dislike' = the claim ONLY pays for that rating (any other rating aborts the claim); '>= N' / '> N' / '== N' = a numeric rating floor decoded from the claim guard's structured root (F-AOF-4 v2, bkg15 F17 / klk15 C-05 — the claim only pays at or above N stars); 'unknown' = a rating condition EXISTS but its shape could not be parsed — check the guard before promising the incentive; null = no rating condition detected."
+                                    },
+                                    "claim_window": {
+                                      "anyOf": [
+                                        {
+                                          "type": "object",
+                                          "properties": {
+                                            "opens_after_s": {
+                                              "anyOf": [
+                                                {
+                                                  "type": "number"
+                                                },
+                                                {
+                                                  "type": "null"
+                                                }
+                                              ],
+                                              "description": "Seconds after the anchor event before the claim window opens (the guard's time lower bound); null = no lower bound decoded."
+                                            },
+                                            "closes_after_s": {
+                                              "anyOf": [
+                                                {
+                                                  "type": "number"
+                                                },
+                                                {
+                                                  "type": "null"
+                                                }
+                                              ],
+                                              "description": "Seconds after the anchor event until the claim window closes (the guard's time upper bound — claims abort E_GUARD_EXPIRED past it); null = no upper bound decoded."
+                                            },
+                                            "anchor": {
+                                              "type": "string",
+                                              "description": "The clock anchor the window counts from ('order.time' = the order's creation/grant time)."
+                                            }
+                                          },
+                                          "required": [
+                                            "opens_after_s",
+                                            "closes_after_s",
+                                            "anchor"
+                                          ],
+                                          "additionalProperties": false
+                                        },
+                                        {
+                                          "type": "null"
+                                        }
+                                      ],
+                                      "description": "R-09 (bs29): the claim window decoded from the claim guard's time constants — the object-level expiration_time above is usually null, the REAL '60–600s after grant'-style window lives HERE. null = the guard's raw payload was unreadable or carries no Clock comparison (fail-honest: window NOT decoded; check the claim guard before promising a timing to the buyer)."
                                     }
                                   },
                                   "required": [
@@ -16689,11 +16793,43 @@
                                     "expiration_time",
                                     "expiration_display",
                                     "expired",
-                                    "min_rating"
+                                    "min_rating",
+                                    "claim_window"
                                   ],
                                   "additionalProperties": false
                                 }
                               },
+                              "replay_scope": {
+                                "type": "object",
+                                "properties": {
+                                  "scope": {
+                                    "type": "string",
+                                    "enum": [
+                                      "once_per_order",
+                                      "once_per_stamp",
+                                      "once_per_recipient_guard",
+                                      "mixed",
+                                      "unknown"
+                                    ],
+                                    "description": "R2-06(b): what is once-scoped on the reward PULL rail, derived from the mounted guard entries' store_from_id. 'once_per_order' = every claim entry stamps the conventional Order slot 0; 'once_per_stamp' = stamped, but not the conventional Order slot; 'once_per_recipient_guard' = EMPTY store_from slot, i.e. one claim per (recipient, guard) FOR LIFE (the buyer's second order aborts 13, E_CLAIM_ALREADY_MADE); 'mixed' = some entries stamped; 'unknown' = mounted guards unreadable."
+                                  },
+                                  "detail": {
+                                    "type": "string",
+                                    "description": "Human-readable statement of the claim key actually in force (RewardClaimKey{recipient, guard, store_from})."
+                                  },
+                                  "per_order_note": {
+                                    "type": "string",
+                                    "description": "What a per-order replay would require: a guard_add store_from_id stamp on the submitted-Order slot PLUS an order-scoped where:{storeFromId} record gate (SV-2); a chain-enforced per-order once needs an Allocation leg declaring protocol slot 254."
+                                  }
+                                },
+                                "required": [
+                                  "scope",
+                                  "detail",
+                                  "per_order_note"
+                                ],
+                                "additionalProperties": false,
+                                "description": "R2-06(b) once-scope disclosure (gf27 P0-03): do not promise a per-order bounty unless scope is once_per_order."
+                              },
                               "coverage": {
                                 "anyOf": [
                                   {
@@ -16713,6 +16849,7 @@
                               "pool_balance_display",
                               "record_count",
                               "claims",
+                              "replay_scope",
                               "coverage"
                             ],
                             "additionalProperties": false
@@ -16744,6 +16881,7 @@
                 "action",
                 "network",
                 "service",
+                "paused",
                 "payment_token",
                 "items",
                 "total_pay",
@@ -26787,6 +26925,165 @@
           ],
           "additionalProperties": false,
           "description": "Returns VecString. Lists ALL policy key names of the Repository (max 50). Use vec_length to bound per-key composite queries or vec_contains_string to assert a key exists."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_order_named_operator_member"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Order object in the Guard table (must be Address type)."
+            }
+          },
+          "required": [
+            "type",
+            "object"
+          ],
+          "additionalProperties": false,
+          "description": "Returns Bool. Whether the transaction signer is on the order's named-operator roster (DM-P1 rider-roster exclusive admission): reads the namedOperator roster of the order's Progress and checks tx-signer membership. Parameterless — the signer comes from the transaction context. Gated by protocol v138 (feature flag enable_order_named_operator_member); on a chain without the flag the guard evaluation aborts. Typical use: AND it into the forward-edge guard on courier handover edges (e.g. PickupOrder/DeliverOrder) so only roster members can advance — the on-chain namedOperator rail alone only AUTHORIZES, it never DENIES (R-19)."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_repository_data_has"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Repository object in the Guard table (must be Address type)."
+            },
+            "id": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the row's principal address (Address type table entry) — the row id the data was written under."
+            },
+            "key": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Row name — the policy key string of the data row to probe."
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "id",
+            "key"
+          ],
+          "additionalProperties": false,
+          "description": "Returns Bool. Whether the Repository holds a data row for (key, id) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation (e.g. a settlement keeper asserting the buyer acceptance row exists before executing a refund allocator). NOT protocol-gated (legacy query, works on every chain version)."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "query_repository_data"
+            },
+            "object": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the Repository object in the Guard table (must be Address type)."
+            },
+            "id": {
+              "type": "object",
+              "properties": {
+                "identifier": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 255,
+                  "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                }
+              },
+              "required": [
+                "identifier"
+              ],
+              "additionalProperties": false,
+              "description": "Reference to the row's principal address (Address type table entry) — the row id the data was written under."
+            },
+            "key": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Row name — the policy key string of the data row to read."
+            },
+            "conditions": {
+              "description": "Optional equality conditions compared against the read row bytes; when non-empty the node emits ONE on-chain logic_equal over the read plus all conditions and returns Bool instead of VecU8.",
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "identifier": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 255,
+                    "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                  }
+                },
+                "required": [
+                  "identifier"
+                ],
+                "additionalProperties": false,
+                "description": "Reference to a VecU8-type table entry whose value must equal the read row — a b_submission slot (the submitted acceptance value) is the typical leg."
+              }
+            }
+          },
+          "required": [
+            "type",
+            "object",
+            "id",
+            "key"
+          ],
+          "additionalProperties": false,
+          "description": "Returns VecU8 (the row bytes [type_byte, ...bcs_payload]) — single-row exact read by (key, id), the primitive for per-value mutual-consent attestation. With conditions, returns Bool: the kernel-enforced 'stored value == submitted value' check (b_submission condition entries make the comparison read the passport submission slot) — this turns a self-attested policy write into kernel-verified mutual consent. NOT protocol-gated (legacy query). Absent row: empty blob under the v136 sentinel flag (never equals a non-empty acceptance value — fail-closed), guard abort on older chains."
         }
       ]
     }

package/dist/schemas/service_clone_operation.output.json

@@ -145,6 +145,84 @@
                 "additionalProperties": false
               }
             },
+            "superseded_consumers": {
+              "type": "object",
+              "properties": {
+                "findings": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "level": {
+                        "type": "string",
+                        "const": "warning",
+                        "description": "4R-06②: always warning level — never blocks the gate."
+                      },
+                      "consumer_kind": {
+                        "type": "string",
+                        "enum": [
+                          "allocation",
+                          "service_binding",
+                          "repository_binding"
+                        ],
+                        "description": "Live-tested silent-staleness class (h1q F-WO-03)."
+                      },
+                      "op_step": {
+                        "type": "number",
+                        "description": "Operation step carrying the stale reference."
+                      },
+                      "op_type": {
+                        "type": "string"
+                      },
+                      "field": {
+                        "type": "string",
+                        "description": "JSON path inside the op payload, e.g. order_allocators.allocators[2].guard."
+                      },
+                      "superseded_address": {
+                        "type": "string",
+                        "description": "Address this rebuild supersedes (source Service/Machine or a source-bound guard)."
+                      },
+                      "replacement": {
+                        "anyOf": [
+                          {
+                            "type": "string"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ],
+                        "description": "LocalMark name to rebind to; null when no replacement was emitted (e.g. guard_mode='reuse_all')."
+                      },
+                      "remediation": {
+                        "type": "string",
+                        "description": "Precise op + field to rebind the consumer."
+                      }
+                    },
+                    "required": [
+                      "level",
+                      "consumer_kind",
+                      "op_step",
+                      "op_type",
+                      "field",
+                      "superseded_address",
+                      "replacement",
+                      "remediation"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "note": {
+                  "type": "string",
+                  "description": "Scope + residual: consumers outside this rebuild payload are not scanned (no address-level consumer index)."
+                }
+              },
+              "required": [
+                "findings",
+                "note"
+              ],
+              "additionalProperties": false,
+              "description": "Post-rebuild consumer self-check over the emitted operations."
+            },
             "next_step": {
               "type": "string"
             }
@@ -154,6 +232,7 @@
             "source",
             "gate",
             "operations",
+            "superseded_consumers",
             "next_step"
           ],
           "additionalProperties": false

package/dist/tools/handlers/benchmark-migration.d.ts

@@ -3,6 +3,13 @@ import { type TemplateScanResult } from "../../knowledge/template-scanner.js";
 import type { DeliverableDefinition } from "../../playbooks/service-build/intent-analyzer.js";
 import type { IndustryMode } from "../../extensions/index.js";
 import type { ToolDispatchResult } from "../types.js";
+export interface StaleBuildDisclosure {
+    stale: boolean;
+    known: boolean;
+    lag_minutes: number | null;
+    detail: string;
+}
+export declare function staleBuildFace(srcDir?: string, distDir?: string): StaleBuildDisclosure;
 declare function driftFace(templateId: string): {
     template: string;
     state: "current";
@@ -68,8 +75,16 @@ export declare function planNextAction(plan: Record<string, unknown>, retryActio
 export interface RewardPoolPrefill {
     fee_key: "review_reward_pool";
     value: number;
+    claim_source?: "semantic_ir";
 }
 export declare function extractRewardPoolCandidate(description: string | undefined): number | undefined;
+export interface NumericFeePrefill {
+    fee_key: string;
+    value: number;
+    claim_source?: "semantic_ir";
+}
+export declare function extractFundingThresholdCandidate(description: string | undefined): number | undefined;
+export declare function extractMinOrderCandidate(description: string | undefined): number | undefined;
 export { validateAllocatorRows };
 export declare function variantPaymentModel(t: IndustryTemplate): "milestone" | "subscription" | "escrow";
 export declare function variantDeliverables(t: IndustryTemplate, traits: IndustryMode["traits"] | undefined): DeliverableDefinition[];